www.crowdstrike.com Open in urlscan Pro
2606:4700::6810:1c08 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://www.crowdstrike.com/blog/hijackloader-expands-techniques/
Submission: On February 13 via api (February 13th 2024, 2:23:09 pm UTC) from DE — Scanned from DE

Summary HTTP 153 Redirects Links 15 Behaviour Indicators

Summary

This website contacted 19 IPs in 3 countries across 14 domains to perform 153 HTTP transactions. The main IP is 2606:4700::6810:1c08, located in United States and belongs to CLOUDFLARENET, US. The main domain is www.crowdstrike.com. The Cisco Umbrella rank of the primary domain is 109475.
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on November 27th 2023. Valid for: a year.

This is the only time www.crowdstrike.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
84	2606:4700::68... 2606:4700::6810:1c08	13335 (CLOUDFLAR...) (CLOUDFLARENET)
12	2606:4700::68... 2606:4700::6812:82ec	13335 (CLOUDFLAR...) (CLOUDFLARENET)
4	2606:4700:e6:... 2606:4700:e6::ac40:ce26	13335 (CLOUDFLAR...) (CLOUDFLARENET)
3	2600:9000:215... 2600:9000:2156:f800:a:de52:1580:93a1	16509 (AMAZON-02) (AMAZON-02)
6	2a02:26f0:480... 2a02:26f0:480:7b1::1e80	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
4	2a02:26f0:350... 2a02:26f0:3500:16::215:1486	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	2a02:26f0:480... 2a02:26f0:480:f::213:7ed3	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	104.17.73.206 104.17.73.206	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700:440... 2606:4700:4400::6812:2089	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	2a03:2880:f08... 2a03:2880:f083:100:face:b00c:0:3	32934 (FACEBOOK) (FACEBOOK)
3	2a00:1450:400... 2a00:1450:4001:812::2008	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:82a::200e	15169 (GOOGLE) (GOOGLE)
10	2a02:6ea0:c70... 2a02:6ea0:c700::17	60068 (CDN77 _) (CDN77 _)
9	2.17.22.194 2.17.22.194	() ()
1	2600:1f14:5db... 2600:1f14:5db:eb00:e29d:e8fa:9217:9611	16509 (AMAZON-02) (AMAZON-02)
1	37.252.171.52 37.252.171.52	29990 (ASN-APPNEX) (ASN-APPNEX)
1	2a02:26f0:ab0... 2a02:26f0:ab00::214:8e41	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
2	13.248.142.121 13.248.142.121	16509 (AMAZON-02) (AMAZON-02)
6	2a02:6ea0:c70... 2a02:6ea0:c700::18	60068 (CDN77 _) (CDN77 _)
153	19

84 2606:4700::6810:1c08 (United States)

ASN13335 (CLOUDFLARENET, US)

www.crowdstrike.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

12 2606:4700::6812:82ec (United States)

ASN13335 (CLOUDFLARENET, US)

cdn.cookielaw.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2606:4700:e6::ac40:ce26 (United States)

ASN13335 (CLOUDFLARENET, US)

use.fontawesome.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2600:9000:2156:f800:a:de52:1580:93a1 (United States)

ASN16509 (AMAZON-02, US)

cdn.addsearch.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2a02:26f0:480:7b1::1e80 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)

assets.adobedtm.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a02:26f0:3500:16::215:1486 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)

use.typekit.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:26f0:480:f::213:7ed3 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)

p.typekit.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.17.73.206 (None, )

ASN13335 (CLOUDFLARENET, US)

go.crowdstrike.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:4400::6812:2089 (United States)

ASN13335 (CLOUDFLARENET, US)

geolocation.onetrust.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f083:100:face:b00c:0:3 (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:812::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:82a::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.youtube.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 2a02:6ea0:c700::17 (Frankfurt am Main, Germany)

ASN60068 (CDN77 _, GB)

cdn.userway.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 2.17.22.194 (Düsseldorf, Germany)

ASN- ()
PTR: a2-17-22-194.deploy.static.akamaitechnologies.com

j.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
c.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
b.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:1f14:5db:eb00:e29d:e8fa:9217:9611 (Boardman, United States)

ASN16509 (AMAZON-02, US)

api.userway.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 37.252.171.52 (Frankfurt am Main, Germany)

ASN29990 (ASN-APPNEX, US)
PTR: 1005.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net

secure.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:26f0:ab00::214:8e41 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)

ipv6.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 13.248.142.121 (United States)

ASN16509 (AMAZON-02, US)
PTR: ac3ff6aafb2cddae2.awsglobalaccelerator.com

epsilon.6sense.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2a02:6ea0:c700::18 (Frankfurt am Main, Germany)

ASN60068 (CDN77 _, GB)

cdn77.api.userway.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
85	crowdstrike.com www.crowdstrike.com — Cisco Umbrella Rank: 109475 go.crowdstrike.com — Cisco Umbrella Rank: 225553	8 MB
17	userway.org cdn.userway.org — Cisco Umbrella Rank: 3098 api.userway.org — Cisco Umbrella Rank: 3051 cdn77.api.userway.org — Cisco Umbrella Rank: 6203	315 KB
12	cookielaw.org cdn.cookielaw.org — Cisco Umbrella Rank: 337	204 KB
10	6sc.co j.6sc.co — Cisco Umbrella Rank: 5424 c.6sc.co — Cisco Umbrella Rank: 8319 ipv6.6sc.co — Cisco Umbrella Rank: 5585 b.6sc.co — Cisco Umbrella Rank: 3739	21 KB
6	adobedtm.com assets.adobedtm.com — Cisco Umbrella Rank: 442	119 KB
5	typekit.net use.typekit.net — Cisco Umbrella Rank: 475 p.typekit.net — Cisco Umbrella Rank: 589	73 KB
4	fontawesome.com use.fontawesome.com — Cisco Umbrella Rank: 1043	282 KB
3	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 37	280 KB
3	addsearch.com cdn.addsearch.com — Cisco Umbrella Rank: 169797	84 KB
2	6sense.com epsilon.6sense.com — Cisco Umbrella Rank: 9660	709 B
2	youtube.com www.youtube.com — Cisco Umbrella Rank: 74	69 KB
2	facebook.net connect.facebook.net — Cisco Umbrella Rank: 171	60 KB
1	adnxs.com secure.adnxs.com — Cisco Umbrella Rank: 459	702 B
1	onetrust.com geolocation.onetrust.com — Cisco Umbrella Rank: 553	304 B
153	14

	Domain	Requested by
84	www.crowdstrike.com	www.crowdstrike.com
12	cdn.cookielaw.org	www.crowdstrike.com cdn.cookielaw.org
10	cdn.userway.org	assets.adobedtm.com cdn.userway.org
7	b.6sc.co	www.crowdstrike.com
6	cdn77.api.userway.org	cdn.userway.org
6	assets.adobedtm.com	www.crowdstrike.com assets.adobedtm.com
4	use.typekit.net	www.crowdstrike.com use.typekit.net
4	use.fontawesome.com	www.crowdstrike.com use.fontawesome.com
3	www.googletagmanager.com	assets.adobedtm.com www.googletagmanager.com
3	cdn.addsearch.com	www.crowdstrike.com cdn.addsearch.com
2	epsilon.6sense.com	j.6sc.co
2	www.youtube.com	assets.adobedtm.com www.youtube.com
2	connect.facebook.net	assets.adobedtm.com connect.facebook.net
1	ipv6.6sc.co	j.6sc.co
1	c.6sc.co	j.6sc.co
1	secure.adnxs.com	j.6sc.co
1	api.userway.org	cdn.userway.org
1	j.6sc.co	assets.adobedtm.com
1	geolocation.onetrust.com	cdn.cookielaw.org
1	go.crowdstrike.com	www.crowdstrike.com
1	p.typekit.net	use.typekit.net
153	21

This site contains links to these domains. Also see Links.

Domain
twitter.com
www.facebook.com
www.linkedin.com
www.youtube.com
go.crowdstrike.com
gist.github.com
github.com
www.hybrid-analysis.com
www.instagram.com
cookiepedia.co.uk
www.onetrust.com

Subject Issuer	Validity	Valid
crowdstrike.com Cloudflare Inc ECC CA-3	`2023-11-27` - `2024-11-26`	a year	crt.sh
cookielaw.org Cloudflare Inc ECC CA-3	`2023-04-01` - `2024-03-31`	a year	crt.sh
use.fontawesome.com Cloudflare Inc ECC CA-3	`2023-10-12` - `2024-10-10`	a year	crt.sh
cdn.addsearch.com Amazon RSA 2048 M03	`2024-01-14` - `2025-02-11`	a year	crt.sh
assets.adobedtm.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-07-11` - `2024-08-10`	a year	crt.sh
use.typekit.net DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2024-02-01` - `2025-03-03`	a year	crt.sh
go.crowdstrike.com Cloudflare Inc ECC CA-3	`2024-02-06` - `2024-12-31`	a year	crt.sh
onetrust.com Cloudflare Inc ECC CA-3	`2023-11-13` - `2024-11-12`	a year	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2023-11-22` - `2024-02-20`	3 months	crt.sh
*.google-analytics.com GTS CA 1C3	`2024-01-09` - `2024-04-02`	3 months	crt.sh
*.google.com GTS CA 1C3	`2024-01-09` - `2024-04-02`	3 months	crt.sh
1667503734.rsc.cdn77.org R3	`2023-12-19` - `2024-03-18`	3 months	crt.sh
6sc.co R3	`2024-01-29` - `2024-04-28`	3 months	crt.sh
api.userway.org Amazon RSA 2048 M03	`2023-09-02` - `2024-09-30`	a year	crt.sh
*.adnxs.com GeoTrust ECC CA 2018	`2023-02-13` - `2024-03-15`	a year	crt.sh
*.6sense.com Amazon RSA 2048 M01	`2023-05-01` - `2024-05-29`	a year	crt.sh
1784939676.rsc.cdn77.org R3	`2024-01-12` - `2024-04-11`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/
Frame ID: 357B5121E59DE417785B293C137F5B37
Requests: 149 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

HijackLoader Expands Techniques to Improve Defense EvasionBack ButtonFilter Button

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

<link rel=["']stylesheet["'] [^>]+/wp-(?:content|includes)/
/wp-(?:content|includes)/

AppNexus (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

adnxs\.(?:net|com)

Facebook (Widgets) Expand

Overall confidence: 100%
Detected patterns

//connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js

Font Awesome (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtag/js

OneTrust (Cookie compliance) Expand

Overall confidence: 100%
Detected patterns

cdn\.cookielaw\.org
otSDKStub\.js

UserWay (Accessibility) Expand

Overall confidence: 100%
Detected patterns

cdn\.userway\.org/widget.*\.js

Page Statistics

153
Requests

100 %
HTTPS

79 %
IPv6

14
Domains

21
Subdomains

19
IPs

3
Countries

9467 kB
Transfer

14215 kB
Size

13
Cookies

15 Outgoing links

These are links going to different origins than the main page.

URL: https://twitter.com/CrowdStrike

Search URL Search Domain Scan URL

URL: https://www.facebook.com/CrowdStrike

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/company/crowdstrike

Search URL Search Domain Scan URL

URL: https://www.youtube.com/user/CrowdStrike

Search URL Search Domain Scan URL

URL: https://go.crowdstrike.com/try-falcon-prevent.html
Title: Start Free Trial

Search URL Search Domain Scan URL

URL: https://gist.github.com/Cr4sh/76b66b612a5d1dc2c614#file-wow64_call-cpp-L61
Title: existing

Search URL Search Domain Scan URL

URL: https://github.com/hasherezade/transacted_hollowing/blob/main/transacted_file.cpp#L13C29
Title: this project

Search URL Search Domain Scan URL

URL: https://www.hybrid-analysis.com/sample/6f345b9fda1ceb9fe4cf58b33337bb9f820550ba08ae07c782c2e142f7323748
Title: 6f345b9fda1ceb9fe4cf58b33337bb9f820550ba08ae07c782c2e142f7323748

Search URL Search Domain Scan URL

URL: https://twitter.com/share?text=HijackLoader+Expands+Techniques+to+Improve+Defense+Evasion&url=https://www.crowdstrike.com/blog/hijackloader-expands-techniques/
Title: Tweet

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/shareArticle?mini=true&url=https://www.crowdstrike.com/blog/hijackloader-expands-techniques/&title=HijackLoader+Expands+Techniques+to+Improve+Defense+Evasion
Title: Share

Search URL Search Domain Scan URL

URL: https://www.facebook.com/CrowdStrike/

Search URL Search Domain Scan URL

URL: https://www.instagram.com/crowdstrike/?hl=en

Search URL Search Domain Scan URL

URL: http://www.youtube.com/user/CrowdStrike

Search URL Search Domain Scan URL

URL: https://cookiepedia.co.uk/giving-consent-to-cookies
Title: More information.

Search URL Search Domain Scan URL

URL: https://www.onetrust.com/products/cookie-consent/

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

153 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
www.crowdstrike.com/blog/hijackloader-expands-techniques/ 83 KB
19 KB 260ms
146ms Document
text/html 2606:4700::6810:1c08
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.crowdstrike.com/blog/hijackloader-expands-techniques/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:1c08 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f98d5d24000b6c7fc435a2234b1022dbb34693227112c49e0624b2ce38113445

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;report-uri /csp-violation-report-endpoint/
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	ALLOW-FROM https://crowdstrike.pathfactory.com https://crowdstrike.com
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 354
cache-control: public, max-age=14400
cf-cache-status: HIT
cf-ray: 854dba223cec5d85-FRA
content-encoding: br
content-security-policy: upgrade-insecure-requests;report-uri /csp-violation-report-endpoint/
content-type: text/html
date: Tue, 13 Feb 2024 14:23:04 GMT
expires: Tue, 13 Feb 2024 18:23:04 GMT
last-modified: Wed, 07 Feb 2024 15:20:00 GMT
referrer-policy: strict-origin-when-cross-origin
server: cloudflare
strict-transport-security: max-age=31536000; includeSubDomains
vary: Accept-Encoding
via: 1.1 1a3d61cabf9778724765b3e70befe816.cloudfront.net (CloudFront)
x-amz-cf-id: faDnRFiq7lwxCcgvU160R5lFxUOORVDPddpTsZTteonP5g-myxo5lw==
x-amz-cf-pop: FRA56-C2
x-amz-version-id: Xygfvocfu.2RjDullXkCTEhvcpgn9w8E
x-cache: Miss from cloudfront
x-content-type-options: nosniff
x-frame-options: ALLOW-FROM https://crowdstrike.pathfactory.com https://crowdstrike.com
x-xss-protection: 1; mode=block

GET
H2 200 OtAutoBlock.js Show response
cdn.cookielaw.org/consent/bee15b7c-b632-450e-9003-9c8b60b3b978/ 110 KB
16 KB 149ms
63ms Script
application/x-javascript 2606:4700::6812:82ec
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/consent/bee15b7c-b632-450e-9003-9c8b60b3b978/OtAutoBlock.js

Requested by

Host: www.crowdstrike.com
URL: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:82ec , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2f108b18f7f86a049baec95d87b0818299204489f6777d88ff1873514dbaf248

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.crowdstrike.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Tue, 13 Feb 2024 14:23:04 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
strict-transport-security: max-age=31536000; includeSubDomains; preload
age: 38530
content-md5: maPf270iuRnaxIin4poM2Q==
content-length: 16246
x-ms-lease-status: unlocked
last-modified: Thu, 08 Feb 2024 02:33:56 GMT
server: cloudflare
etag: 0x8DC284E661D2211
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: *
x-ms-request-id: 5e6386c0-b01e-0058-7337-5ae1dc000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=86400
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 854dba23bd079c01-FRA
expires: Wed, 14 Feb 2024 14:23:04 GMT

GET
H2 200 single-post.min.css
www.crowdstrike.com/wp-content/themes/main-theme/dist/styles/pages/ 42 KB
6 KB 134ms
131ms Stylesheet
text/css 2606:4700::6810:1c08
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.crowdstrike.com/wp-content/themes/main-theme/dist/styles/pages/single-post.min.css?ver=1707277106

Requested by

Host: www.crowdstrike.com
URL: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:1c08 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

029eb8df13db1d0196b896a20dd780fc32955f410b29bce771bf00afd164d7fe

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Tue, 13 Feb 2024 14:23:04 GMT
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 a4af9b42c2ec29f616825af32712c204.cloudfront.net (CloudFront)
cf-cache-status: HIT
content-encoding: br
x-amz-version-id: 0IGIaLXyS0O4msqLzYUsys7bSe4dxEa7
age: 354
x-amz-cf-pop: FRA56-C2
x-cache: Hit from cloudfront
last-modified: Tue, 13 Feb 2024 14:10:21 GMT
server: cloudflare
etag: W/"b991d9c90da6770d21eb9396bc13d082"
vary: Accept-Encoding
content-type: text/css
cache-control: public, max-age=14400
cf-ray: 854dba232e6c5d85-FRA
x-amz-cf-id: YVVqC6lj672qH-aA9h4f736i7kO621THExWpKzK482I2JuWzW3BH2A==
expires: Tue, 13 Feb 2024 18:23:04 GMT

GET
H2 200 theme-styles.min.css
www.crowdstrike.com/wp-content/themes/main-theme/dist/styles/ 434 KB
75 KB 134ms
131ms Stylesheet
text/css 2606:4700::6810:1c08
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.crowdstrike.com/wp-content/themes/main-theme/dist/styles/theme-styles.min.css?ver=1707277106

Requested by

Host: www.crowdstrike.com
URL: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:1c08 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

38ddf8f49aeddf9f1855259e69302912f2c8c298c9676eb44bc7ecb94d8bc1ca

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Tue, 13 Feb 2024 14:23:04 GMT
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 cbe141923b7469a299306144733821c2.cloudfront.net (CloudFront)
cf-cache-status: HIT
content-encoding: br
x-amz-version-id: TjKdslP8H_KW.ep8LobsBspgMPLCNpBn
age: 354
x-amz-cf-pop: FRA56-C2
x-cache: Hit from cloudfront
last-modified: Tue, 13 Feb 2024 14:10:21 GMT
server: cloudflare
etag: W/"7ba837075a66b917ff0f5e46ec885e89"
vary: Accept-Encoding
content-type: text/css
cache-control: public, max-age=14400
cf-ray: 854dba232e6e5d85-FRA
x-amz-cf-id: ofb6t7xB9HxMn522IErX4DrMmVZNW1tUb60Zjo5sKyoaS3VESwnrWg==
expires: Tue, 13 Feb 2024 18:23:04 GMT

GET
H2 200 tablepress-combined.min.css
www.crowdstrike.com/wp-content/ 6 KB
2 KB 89ms
86ms Stylesheet
text/css 2606:4700::6810:1c08
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.crowdstrike.com/wp-content/tablepress-combined.min.css?ver=31

Requested by

Host: www.crowdstrike.com
URL: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:1c08 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

db69a3d25d8125632acede7426cfaa714390a3a713e8fb38fca4264581341744

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Tue, 13 Feb 2024 14:23:04 GMT
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 d8670b0c6b76371fb58f730881dfe504.cloudfront.net (CloudFront)
cf-cache-status: HIT
content-encoding: br
x-amz-version-id: tsHm.4aglhivxJ6SfEs8YL4ACcBPHmEM
age: 718
x-amz-cf-pop: FRA56-C2
x-cache: Hit from cloudfront
last-modified: Tue, 30 Aug 2022 15:32:39 GMT
server: cloudflare
etag: W/"e246c6f72f6db9cc7c8a1061c6b8717b"
vary: Accept-Encoding
content-type: text/css
cache-control: public, max-age=14400
cf-ray: 854dba232e705d85-FRA
x-amz-cf-id: Yd_Gm9Ovk9ZfGZoAuCP4n-5JVjdiY-HM4SizUnbnsqehoJvq3RVDbA==
expires: Tue, 13 Feb 2024 18:23:04 GMT

GET
H2 200 all.css
use.fontawesome.com/releases/v6.4.2/css/ 100 KB
23 KB 154ms
63ms Stylesheet
text/css 2606:4700:e6::ac40:ce26
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://use.fontawesome.com/releases/v6.4.2/css/all.css
Requested by: Host: www.crowdstrike.com
URL: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:e6::ac40:ce26 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0934b1fc0d3a766d41d3adf5e7a115875e66e98ebba408d965a41cf3d2cb4ab5

Request headers

Referer: https://www.crowdstrike.com/
Origin: https://www.crowdstrike.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Tue, 13 Feb 2024 14:23:04 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Fri, 22 Sep 2023 01:46:33 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 151717
etag: W/"5222e06b77a1692fa2520a219840e6be"
vary: Origin, Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=C1EEXWaK0c9%2BPCWfgsnGpHDAt5Zw54a5M%2B0l5y8Xjcp3c%2F0ygiorgNEel2mcbRkb62MGlw55E2UJ%2FkjGoKMUOGa8TwrH%2B3qJ%2FRg9GvgnDkaBoJ5uIZu3X3jA5hs%2FSeIFCsLaEkSAm%2FL6G8XucyJWScWn"}],"group":"cf-nel","max_age":604800}
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=31536000
cf-ray: 854dba23be97b3af-MUC
alt-svc: h3=":443"; ma=86400

GET
H2 200 v4-shims.css
use.fontawesome.com/releases/v6.4.2/css/ 27 KB
5 KB 149ms
59ms Stylesheet
text/css 2606:4700:e6::ac40:ce26
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://use.fontawesome.com/releases/v6.4.2/css/v4-shims.css
Requested by: Host: www.crowdstrike.com
URL: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:e6::ac40:ce26 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0e0a27c105caf20bd4cc76fe58f222d856ab8f626447846842dddca8ce7509ef

Request headers

Referer: https://www.crowdstrike.com/
Origin: https://www.crowdstrike.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Tue, 13 Feb 2024 14:23:04 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Fri, 22 Sep 2023 01:46:32 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 1305399
etag: W/"665de85010641f678f0178a9d330a7af"
vary: Origin, Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=R7hsBe7tlxdujsyfLz%2BvnLhBrBZkzfelV7P5%2Fei%2BZVok11qJyEVjFcK8hr38e%2BypM8sVtWZYNddO%2FE94o9aCYLatWmEKoNAj4kRMmM0mkbZ26BYrAdgtGhGPP%2B5zwKfjE2D4GxQM2t0Nqe4rJPVS1e35"}],"group":"cf-nel","max_age":604800}
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=31536000
cf-ray: 854dba23be94b3af-MUC
alt-svc: h3=":443"; ma=86400

GET
H2 200 fetch-inject.js Show response
www.crowdstrike.com/wp-content/themes/main-theme/dist/scripts/ 1 KB
942 B 92ms
90ms Script
application/javascript 2606:4700::6810:1c08
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.crowdstrike.com/wp-content/themes/main-theme/dist/scripts/fetch-inject.js?ver=1707277106

Requested by

Host: www.crowdstrike.com
URL: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:1c08 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

eee66297afe4bfd363c9e7b27978892a34adffde1664ef7509335aff8aa31cc0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Tue, 13 Feb 2024 14:23:04 GMT
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 39f309504c11c4fe223e3b1f0425f198.cloudfront.net (CloudFront)
cf-cache-status: HIT
content-encoding: br
x-amz-version-id: qdbKbOYWuMSEQJmf0BzgzpCnyCfjSr_V
age: 408
x-amz-cf-pop: CDG53-C1
cf-polished: origSize=1343
x-cache: Hit from cloudfront
last-modified: Tue, 13 Feb 2024 14:10:17 GMT
cf-bgj: minify
server: cloudflare
etag: W/"e80eef79b8a9c769c9fe24903f880fb5"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=14400
cf-ray: 854dba232e735d85-FRA
x-amz-cf-id: 0NVfA-wXVnDSfl0vmTAoGWGcmy7yknLdCaF4LsffcQ0rwyFGy-PnXw==
expires: Tue, 13 Feb 2024 18:23:04 GMT

GET
H2 200 blog-navigation.min.js Show response
www.crowdstrike.com/wp-content/themes/main-theme/dist/scripts/components/ 7 KB
3 KB 178ms
176ms Script
application/javascript 2606:4700::6810:1c08
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.crowdstrike.com/wp-content/themes/main-theme/dist/scripts/components/blog-navigation.min.js?ver=1707277106

Requested by

Host: www.crowdstrike.com
URL: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:1c08 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

3af4950136e1829a2ee6ea85d29abb0e6c654c820bb828b73e4a5124e1943968

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Tue, 13 Feb 2024 14:23:04 GMT
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 8fd360cd20d33fa1400394ae41746f66.cloudfront.net (CloudFront)
cf-cache-status: HIT
content-encoding: br
x-amz-version-id: 9I32P5iDy_JDLqtVCdFbP_4rZmpopcrd
age: 354
x-amz-cf-pop: FRA56-C2
x-cache: Hit from cloudfront
last-modified: Tue, 13 Feb 2024 14:10:16 GMT
server: cloudflare
etag: W/"9d341daca2a55ca68145f6cb110df24b"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=14400
cf-ray: 854dba232e745d85-FRA
x-amz-cf-id: 3rtDT9W7OmsIHRlkVmyEVoY3ew1C9OsIruWX8UME6zYtUNHFl8A1ig==
expires: Tue, 13 Feb 2024 18:23:04 GMT

GET
H2 200 blog-free-trial.min.js Show response
www.crowdstrike.com/wp-content/themes/main-theme/dist/scripts/components/ 2 KB
1 KB 97ms
96ms Script
application/javascript 2606:4700::6810:1c08
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.crowdstrike.com/wp-content/themes/main-theme/dist/scripts/components/blog-free-trial.min.js?ver=1707277106

Requested by

Host: www.crowdstrike.com
URL: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:1c08 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

bb43ebbb2a062b085b9d9a2cea902487fa614e99cd88bb0206c452f1c5bb1cc5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Tue, 13 Feb 2024 14:23:04 GMT
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 0d5d2d408eb42296c7636196e25ef8a2.cloudfront.net (CloudFront)
cf-cache-status: HIT
content-encoding: br
x-amz-version-id: BSUQ.EhJjCQOYXhIm_rVWl2F1Ad3JRoS
age: 354
x-amz-cf-pop: FRA56-C2
x-cache: Hit from cloudfront
last-modified: Tue, 13 Feb 2024 14:10:16 GMT
server: cloudflare
etag: W/"171f0cd42d6f7d17731c4ea1818d1ad4"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=14400
cf-ray: 854dba232e765d85-FRA
x-amz-cf-id: MclyNOcxUUxgpWbvIVvR-7ZJWBPI2Grq7DrBvw09tpEw-AitItdQUw==
expires: Tue, 13 Feb 2024 18:23:04 GMT

GET
H2 200 blog-categories.min.js Show response
www.crowdstrike.com/wp-content/themes/main-theme/dist/scripts/components/ 6 KB
2 KB 96ms
95ms Script
application/javascript 2606:4700::6810:1c08
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.crowdstrike.com/wp-content/themes/main-theme/dist/scripts/components/blog-categories.min.js?ver=1707277106

Requested by

Host: www.crowdstrike.com
URL: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:1c08 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f6f2064be189ce3de89d8f963d3af580b5fc9a83c07ec8aeb911e46ce17bcd25

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Tue, 13 Feb 2024 14:23:04 GMT
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 fdc45b521af7652438141328494a79d2.cloudfront.net (CloudFront)
cf-cache-status: HIT
content-encoding: br
x-amz-version-id: jNdFGUtgad62q2NOVbm4DKEaQm07BNVQ
age: 354
x-amz-cf-pop: FRA56-C2
x-cache: Hit from cloudfront
last-modified: Tue, 13 Feb 2024 14:10:16 GMT
server: cloudflare
etag: W/"c3c02fb8d1b491f228c801f119ab485c"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=14400
cf-ray: 854dba232e785d85-FRA
x-amz-cf-id: VCJVuSUHemaVCNsDE4dtNwRRMx_Dm1mXsNo8Vu-i-vhaZTQUn74lvA==
expires: Tue, 13 Feb 2024 18:23:04 GMT

GET
H2 200 blog-category-sidebar.min.js Show response
www.crowdstrike.com/wp-content/themes/main-theme/dist/scripts/components/ 6 KB
2 KB 95ms
93ms Script
application/javascript 2606:4700::6810:1c08
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.crowdstrike.com/wp-content/themes/main-theme/dist/scripts/components/blog-category-sidebar.min.js?ver=1707277106

Requested by

Host: www.crowdstrike.com
URL: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:1c08 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0386f1b61b8df1871fdda7f77f5d36248b86faa3026ea5787827e9673393278d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Tue, 13 Feb 2024 14:23:04 GMT
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 3298c44116035984c2fac24b89183c4e.cloudfront.net (CloudFront)
cf-cache-status: HIT
content-encoding: br
x-amz-version-id: vk.F5JiECxhjCyxH858iEcBvlp7I_yA6
age: 354
x-amz-cf-pop: FRA56-C2
x-cache: Hit from cloudfront
last-modified: Tue, 13 Feb 2024 14:10:16 GMT
server: cloudflare
etag: W/"01229a4261120a86f81f5b4269b343a5"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=14400
cf-ray: 854dba232e7f5d85-FRA
x-amz-cf-id: xi6By2paf2dmAFLOt7FVrpbkPqaHI9AQbEzlrHY3BYABFbALXmPepA==
expires: Tue, 13 Feb 2024 18:23:04 GMT

GET
H2 200 addsearch-ui.min.js Show response
cdn.addsearch.com/v5/ 312 KB
76 KB 131ms
46ms Script
application/javascript 2600:9000:2156:f800:a:de52:1580:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.addsearch.com/v5/addsearch-ui.min.js?key=7737a29b854de71521b1cd72c4118cfc&id=asw_01
Requested by: Host: www.crowdstrike.com
URL: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2156:f800:a:de52:1580:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: ced035236ef87e76d0e300e6c7c507d982c4a48c99a137f3a7fb61a94cb83688

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.crowdstrike.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Tue, 13 Feb 2024 04:54:31 GMT
content-encoding: br
via: 1.1 a1098f0eeab192209962e3a9d76d0338.cloudfront.net (CloudFront)
last-modified: Tue, 07 Nov 2023 15:45:02 GMT
server: AmazonS3
x-amz-cf-pop: FRA50-C1
age: 34114
x-amz-server-side-encryption: AES256
etag: W/"b04213a26b90b906bfdd4edace511330"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
x-amz-cf-id: raFWQj2WxAdnr7u8VffBOZE4v3YDT8NqA7ShCLmToI5WEHPoMHFcmA==

GET
H2 200 Blog_1060x698-4.jpeg
www.crowdstrike.com/wp-content/uploads/2021/09/ 348 KB
349 KB 98ms
96ms Image
image/jpeg 2606:4700::6810:1c08
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.crowdstrike.com/wp-content/uploads/2021/09/Blog_1060x698-4.jpeg

Requested by

Host: www.crowdstrike.com
URL: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:1c08 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

aa8ccd00b2ec30041f8503ee680bb673acc72b2af2732a5623ca8d4b2cd10821

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Tue, 13 Feb 2024 14:23:04 GMT
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 0d4b487d54766de7560aa02de852bbf8.cloudfront.net (CloudFront)
cf-cache-status: HIT
x-amz-version-id: VeFDjz9XdBhWfFt0m.9OxrRqICo4hpjI
age: 354
x-amz-cf-pop: FRA56-C2
cf-polished: degrade=85, origSize=1130870
x-cache: Hit from cloudfront
content-length: 356088
last-modified: Wed, 07 Feb 2024 15:20:01 GMT
cf-bgj: imgq:85,h2pri
server: cloudflare
etag: "bfeb06b718111c5af0d785febcb47cfb-1"
vary: Accept-Encoding
content-type: image/jpeg
cache-control: public, max-age=14400
accept-ranges: bytes
cf-ray: 854dba232e825d85-FRA
x-amz-cf-id: CUk8Jc_tx6mXhmqBdD4aWsPeuFEAsILUNOk8SyEeS1oqoqxxFeEzrQ==
expires: Tue, 13 Feb 2024 18:23:04 GMT

GET
H2 200 Figure1-2.png
www.crowdstrike.com/wp-content/uploads/2024/02/ 81 KB
81 KB 144ms
142ms Image
image/png 2606:4700::6810:1c08
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.crowdstrike.com/wp-content/uploads/2024/02/Figure1-2.png

Requested by

Host: www.crowdstrike.com
URL: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:1c08 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ea3c802e8d4cf12efe24d09a58f7aebbd24cb0a1aa717dfb16e4b567410261c4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Tue, 13 Feb 2024 14:23:04 GMT
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 84f381696dd33e92960b92250106e464.cloudfront.net (CloudFront)
cf-cache-status: HIT
x-amz-version-id: X5tpMmRhTZmYQ2GUOjw3VN2X76D2Cxgw
age: 354
x-amz-cf-pop: FRA56-C2
cf-polished: status=not_needed
x-cache: Miss from cloudfront
content-length: 82804
last-modified: Wed, 07 Feb 2024 15:20:06 GMT
cf-bgj: imgq:85,h2pri
server: cloudflare
etag: "faedb1635eee39cc575f90d383943a35-1"
vary: Accept-Encoding
content-type: image/png
cache-control: public, max-age=14400
accept-ranges: bytes
cf-ray: 854dba232e855d85-FRA
x-amz-cf-id: XjlXx11IIyg4RsMOC5RqUqURY_lRrFDvkobMnojaiAHFLRcqWz7t7g==
expires: Tue, 13 Feb 2024 18:23:04 GMT

GET
H2 200 Figure2a.png
www.crowdstrike.com/wp-content/uploads/2024/02/ 39 KB
39 KB 143ms
142ms Image
image/png 2606:4700::6810:1c08
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.crowdstrike.com/wp-content/uploads/2024/02/Figure2a.png

Requested by

Host: www.crowdstrike.com
URL: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:1c08 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

49d81348bc96c5ae3f30d8d9a3023ed90b57ec425f66c652f68786736be2896b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Tue, 13 Feb 2024 14:23:04 GMT
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 8e83c42d247a31c5b365c08a0352d8f8.cloudfront.net (CloudFront)
cf-cache-status: HIT
x-amz-version-id: LqtOyg1aComuqT9EkMTZVAJGpYu9reMx
age: 354
x-amz-cf-pop: FRA56-C2
cf-polished: origSize=40986
x-cache: Miss from cloudfront
content-length: 39638
last-modified: Wed, 07 Feb 2024 15:20:10 GMT
cf-bgj: imgq:85,h2pri
server: cloudflare
etag: "85c0cdd3ba2121cfc4c6aa25e37693c1-1"
vary: Accept-Encoding
content-type: image/png
cache-control: public, max-age=14400
accept-ranges: bytes
cf-ray: 854dba236eea5d85-FRA
x-amz-cf-id: Lp5hruR2jlUM-rOF8rRMF0RA7rBuEODDsV7rAQ8vlU5mipNwIM4pFQ==
expires: Tue, 13 Feb 2024 18:23:04 GMT

GET
H2 200 23-OTH-060_adversary-1-kitten-iran.png
www.crowdstrike.com/wp-content/uploads/2023/11/ 288 KB
289 KB 104ms
103ms Image
image/png 2606:4700::6810:1c08
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.crowdstrike.com/wp-content/uploads/2023/11/23-OTH-060_adversary-1-kitten-iran.png

Requested by

Host: www.crowdstrike.com
URL: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:1c08 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

371c77d9d1f5d96c55daf6224cb162828509919e3f97f59722ef1b1dc971571a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Tue, 13 Feb 2024 14:23:04 GMT
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 0434556f8ccac61e8735f7c75767727c.cloudfront.net (CloudFront)
cf-cache-status: HIT
x-amz-version-id: _lvyU_qMKjuATLzyVJm0mwETdCXnirny
age: 354
x-amz-cf-pop: FRA56-C2
cf-polished: status=not_needed
x-cache: Hit from cloudfront
content-length: 294977
last-modified: Wed, 07 Feb 2024 15:20:17 GMT
cf-bgj: imgq:85,h2pri
server: cloudflare
etag: "230dd9230ab5e3af44a76e87491b6784-1"
vary: Accept-Encoding
content-type: image/png
cache-control: public, max-age=14400
accept-ranges: bytes
cf-ray: 854dba2458185d85-FRA
x-amz-cf-id: AJrnMi0xLiO80xobUC57D4B8Vd5LwN-BrEa_IxpbM-OCbiS3usD-hg==
expires: Tue, 13 Feb 2024 18:23:04 GMT

GET
H2 200 0123_06_Linux-Container-Escapes_Blog_1060x698.jpg
www.crowdstrike.com/wp-content/uploads/2023/01/ 194 KB
195 KB 89ms
89ms Image
image/jpeg 2606:4700::6810:1c08
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.crowdstrike.com/wp-content/uploads/2023/01/0123_06_Linux-Container-Escapes_Blog_1060x698.jpg

Requested by

Host: www.crowdstrike.com
URL: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:1c08 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

284b0049b3b206bb58f97cce490ed45e9ec29d3522388c5d146c3da5b0cd695c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Tue, 13 Feb 2024 14:23:04 GMT
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 3acba66e95e31977aee0842f44a6f08e.cloudfront.net (CloudFront)
cf-cache-status: HIT
x-amz-version-id: ShqO52X6WTbCzkaw3wSsQ7iFhUWhIB.x
age: 354
x-amz-cf-pop: FRA56-C2
cf-polished: degrade=85, origSize=721850
x-cache: Hit from cloudfront
content-length: 198848
last-modified: Wed, 07 Feb 2024 15:20:18 GMT
cf-bgj: imgq:85,h2pri
server: cloudflare
etag: "3a6846eb9c6ddbae8d93c5c87cc3e45f-1"
vary: Accept-Encoding
content-type: image/jpeg
cache-control: public, max-age=14400
accept-ranges: bytes
cf-ray: 854dba2488585d85-FRA
x-amz-cf-id: 0Q-ukfWh2U_Rx6Cjb3dGs-0gmXrKc8mK5UYCOiGgMC13ZW7bSUDvkw==
expires: Tue, 13 Feb 2024 18:23:04 GMT

GET
H2 200 0823_01_MSFT-Windows-Restart-Manager.jpg
www.crowdstrike.com/wp-content/uploads/2023/08/ 88 KB
88 KB 71ms
71ms Image
image/jpeg 2606:4700::6810:1c08
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.crowdstrike.com/wp-content/uploads/2023/08/0823_01_MSFT-Windows-Restart-Manager.jpg

Requested by

Host: www.crowdstrike.com
URL: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:1c08 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ac2cea87b2980e211b88ecc676e39fe1ecf5bb25f3596f94534e6e786e22a962

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Tue, 13 Feb 2024 14:23:04 GMT
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 0a4e8f7c3d348e526848328c55dd452a.cloudfront.net (CloudFront)
cf-cache-status: HIT
x-amz-version-id: Vp8PCfo9LixloyQlK6.EsiQm453n2unx
age: 353
x-amz-cf-pop: FRA56-C2
cf-polished: degrade=85, origSize=332841
x-cache: Hit from cloudfront
content-length: 90269
last-modified: Wed, 07 Feb 2024 15:20:19 GMT
cf-bgj: imgq:85,h2pri
server: cloudflare
etag: "4208951930ac32a38c488d81b98bc45b-1"
vary: Accept-Encoding
content-type: image/jpeg
cache-control: public, max-age=14400
accept-ranges: bytes
cf-ray: 854dba263a645d85-FRA
x-amz-cf-id: F0mm739Qq0q1-toyCynl2GnHFfJYf4kOMbo-6TKE0LbJDDtV9PC92g==
expires: Tue, 13 Feb 2024 18:23:04 GMT

GET
H2 200 exit-promoter.min.css
www.crowdstrike.com/wp-content/themes/main-theme/dist/styles/components/ 4 KB
1 KB 93ms
93ms Stylesheet
text/css 2606:4700::6810:1c08
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.crowdstrike.com/wp-content/themes/main-theme/dist/styles/components/exit-promoter.min.css?ver=1707277106

Requested by

Host: www.crowdstrike.com
URL: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:1c08 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d918dfd178470f1be12242960742fd20f811cf84c1beb90695770308a92cf017

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Tue, 13 Feb 2024 14:23:04 GMT
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 cb1bcb02f5d0667fafd0890701965f18.cloudfront.net (CloudFront)
cf-cache-status: HIT
content-encoding: br
x-amz-version-id: XgKKWoLXmbnvNY4aVQDg1QLki0MkMtLa
age: 354
x-amz-cf-pop: FRA56-C2
x-cache: Hit from cloudfront
last-modified: Tue, 13 Feb 2024 14:10:18 GMT
server: cloudflare
etag: W/"37121aa112ff01e70805c21126a4ae89"
vary: Accept-Encoding
content-type: text/css
cache-control: public, max-age=14400
cf-ray: 854dba2529225d85-FRA
x-amz-cf-id: NCXO8WUosPfb2UW3DVVa-bMtJuW-c-ZBS42s2WBzR-gt5dTQ0ccCIA==
expires: Tue, 13 Feb 2024 18:23:04 GMT

GET
H2 200 footer-navigation.min.js Show response
www.crowdstrike.com/wp-content/themes/main-theme/dist/scripts/components/ 24 KB
9 KB 79ms
79ms Script
application/javascript 2606:4700::6810:1c08
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.crowdstrike.com/wp-content/themes/main-theme/dist/scripts/components/footer-navigation.min.js?ver=1707277106

Requested by

Host: www.crowdstrike.com
URL: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:1c08 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

134b5ab773033a3001ff9594a52fcfef2a5229da6eb823d7a561da504f36a35f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Tue, 13 Feb 2024 14:23:04 GMT
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 0a4e8f7c3d348e526848328c55dd452a.cloudfront.net (CloudFront)
cf-cache-status: HIT
content-encoding: br
x-amz-version-id: k0PiOSUka1FBSOn16UaLWHZn01bmn2Y7
age: 354
x-amz-cf-pop: FRA56-C2
x-cache: Hit from cloudfront
last-modified: Tue, 13 Feb 2024 14:10:16 GMT
server: cloudflare
etag: W/"ca235bfd3cdc04132d1d2083f13e75f3"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=14400
cf-ray: 854dba2529285d85-FRA
x-amz-cf-id: EnLPxD6r02D5R6yFvXbu5483PtGhqFNgERxzRrI75N-VthHJ1fb__Q==
expires: Tue, 13 Feb 2024 18:23:04 GMT

GET
H2 200 theme-scripts.min.js Show response
www.crowdstrike.com/wp-content/themes/main-theme/dist/scripts/ 204 KB
66 KB 110ms
109ms Script
application/javascript 2606:4700::6810:1c08
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.crowdstrike.com/wp-content/themes/main-theme/dist/scripts/theme-scripts.min.js?ver=1707277106

Requested by

Host: www.crowdstrike.com
URL: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:1c08 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c29c89bd0ecf3f4b2eb429ac866478beef45f89e882bfe328bd5e0b8a3cee542

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Tue, 13 Feb 2024 14:23:04 GMT
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 84f381696dd33e92960b92250106e464.cloudfront.net (CloudFront)
cf-cache-status: HIT
content-encoding: br
x-amz-version-id: 7AJf72ei4gNGa8YoipwdZeDtyMHQyA6z
age: 353
x-amz-cf-pop: FRA56-C2
x-cache: Hit from cloudfront
last-modified: Tue, 13 Feb 2024 14:10:18 GMT
server: cloudflare
etag: W/"f2a0e3b2c2c7b976d1d1ba5ffdf77cac"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=14400
cf-ray: 854dba265a7a5d85-FRA
x-amz-cf-id: 0kdNXbB9_ZYDmJgn5kGLhOH5pxFDz5o1EOjey_X0KtWaS3wHYfFdPw==
expires: Tue, 13 Feb 2024 18:23:04 GMT

GET
H2 200 exit-promoter.min.js Show response
www.crowdstrike.com/wp-content/themes/main-theme/dist/scripts/plugins/ 23 KB
8 KB 89ms
89ms Script
application/javascript 2606:4700::6810:1c08
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.crowdstrike.com/wp-content/themes/main-theme/dist/scripts/plugins/exit-promoter.min.js?ver=1707277106

Requested by

Host: www.crowdstrike.com
URL: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:1c08 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

39817e2dc1903ef3353ad8a0186c4f30dcbf9f6923f68b737b76ac46b1a151ff

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Tue, 13 Feb 2024 14:23:04 GMT
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 27f780feafa4114cfc67d86fca85d124.cloudfront.net (CloudFront)
cf-cache-status: HIT
content-encoding: br
x-amz-version-id: H.NqsLHbtgHUmMbCTiksWdNm_NeRkpxA
age: 354
x-amz-cf-pop: FRA56-C2
x-cache: Hit from cloudfront
last-modified: Tue, 13 Feb 2024 14:10:17 GMT
server: cloudflare
etag: W/"e08631cd4ec6cd7bf487d8a5dff6c53a"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=14400
cf-ray: 854dba25a9c45d85-FRA
x-amz-cf-id: gJgVNn0p7pgiITGtb1rIf3EgVWGmjKeg-PQF7KdV8J5SkxoM5rEvwA==
expires: Tue, 13 Feb 2024 18:23:04 GMT

GET
H2 200 launch-6cccf53edc18.min.js Show response
assets.adobedtm.com/d72cd986aea0/09e1256af957/ 431 KB
115 KB 125ms
42ms Script
application/x-javascript 2a02:26f0:480:7b1::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/d72cd986aea0/09e1256af957/launch-6cccf53edc18.min.js
Requested by: Host: www.crowdstrike.com
URL: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:480:7b1::1e80 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 00a1e07ffa91e55f51f59a60efaf8f4524f101bab79ecabf50688d3b4f8ca152

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.crowdstrike.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Tue, 13 Feb 2024 14:23:04 GMT
content-encoding: gzip
last-modified: Sat, 10 Feb 2024 00:02:53 GMT
server: AkamaiNetStorage
etag: "fcea947678533f72e8cc866e1957344c:1707523373.611322"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: https://www.crowdstrike.com
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 117096
expires: Tue, 13 Feb 2024 15:23:04 GMT

GET
H2 200 otSDKStub.js Show response
cdn.cookielaw.org/scripttemplates/ 21 KB
7 KB 53ms
52ms Script
application/javascript 2606:4700::6812:82ec
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/otSDKStub.js

Requested by

Host: www.crowdstrike.com
URL: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:82ec , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5be2dfa172d505acb197760b55c4731347cc239a7a046013c251948bb8214dbc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.crowdstrike.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Tue, 13 Feb 2024 14:23:04 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
content-md5: jEXNH7qItSS8Y+G7eM2k2w==
age: 38118
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-length: 6841
x-ms-lease-status: unlocked
last-modified: Mon, 12 Feb 2024 01:58:21 GMT
server: cloudflare
etag: 0x8DC2B6E17656464
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-ms-request-id: ef2c1a01-201e-0091-5160-5d5c31000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: max-age=86400
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 854dba2658649c01-FRA

GET
H2 200 zya3koo.css
use.typekit.net/ 3 KB
915 B 157ms
40ms Stylesheet
text/css 2a02:26f0:3500:16::215:1486
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://use.typekit.net/zya3koo.css

Requested by

Host: www.crowdstrike.com
URL: https://www.crowdstrike.com/wp-content/themes/main-theme/dist/styles/theme-styles.min.css?ver=1707277106

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:3500:16::215:1486 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

nginx /

Resource Hash

d1c90bd20c04adf24d97ff015095058b528a293e12533fcc37a6f4b61970785e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.crowdstrike.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains;
content-encoding: gzip
date: Tue, 13 Feb 2024 14:23:04 GMT
server: nginx
vary: Accept-Encoding
content-type: text/css;charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=600, stale-while-revalidate=604800
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 692

GET
H2 200 p.css
p.typekit.net/ 5 B
172 B 163ms
45ms Stylesheet
text/css 2a02:26f0:480:f::213:7ed3
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://p.typekit.net/p.css?s=1&k=zya3koo&ht=tk&f=39496.39498.39500&a=30979937&app=typekit&e=css
Requested by: Host: use.typekit.net
URL: https://use.typekit.net/zya3koo.css
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:480:f::213:7ed3 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: nginx /
Resource Hash: 1c0ff118a4290c99f39c90abb38703a866e47251b23cca20266c69c812ccafeb

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://use.typekit.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Tue, 13 Feb 2024 14:23:04 GMT
last-modified: Fri, 14 Jul 2023 12:44:32 GMT
server: nginx
etag: "64b14330-5"
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=604800
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
content-length: 5

GET
H2 200 free-trial-content.json Show response
www.crowdstrike.com/wp-content/themes/main-theme/dist/data/blog/widgets/ 334 B
480 B 70ms
70ms Fetch
application/json 2606:4700::6810:1c08
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.crowdstrike.com/wp-content/themes/main-theme/dist/data/blog/widgets/free-trial-content.json

Requested by

Host: www.crowdstrike.com
URL: https://www.crowdstrike.com/wp-content/themes/main-theme/dist/scripts/components/blog-free-trial.min.js?ver=1707277106

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:1c08 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

3d871b6771dfa1a9115eee87e6dbb038d19387e11f27904622a56ff9bd4d2b84

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Tue, 13 Feb 2024 14:23:04 GMT
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 08b9c2fd11813ffdb8fa03129d0a465c.cloudfront.net (CloudFront)
cf-cache-status: HIT
content-encoding: br
x-amz-version-id: wC4iI4BNGAo2gpY6dX.ep.4ECa5ggEgw
age: 353
x-amz-cf-pop: FRA56-C2
x-cache: Hit from cloudfront
last-modified: Fri, 09 Feb 2024 18:27:51 GMT
server: cloudflare
etag: W/"601c272358b511909bc7b5eb4103d6dc"
vary: Accept-Encoding
content-type: application/json
cache-control: public, max-age=14400
cf-ray: 854dba265a7b5d85-FRA
x-amz-cf-id: LOgvqaz3HMpRQ6pTcC2OPYz9q1SVTOQfrfvWruNQYnk2wQN6lC-dpg==
expires: Tue, 13 Feb 2024 18:23:04 GMT

GET
H2 200 categories-all-info.json Show response
www.crowdstrike.com/wp-content/themes/main-theme/dist/data/blog/widgets/ 1 KB
652 B 75ms
74ms Fetch
application/json 2606:4700::6810:1c08
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.crowdstrike.com/wp-content/themes/main-theme/dist/data/blog/widgets/categories-all-info.json

Requested by

Host: www.crowdstrike.com
URL: https://www.crowdstrike.com/wp-content/themes/main-theme/dist/scripts/components/blog-category-sidebar.min.js?ver=1707277106

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:1c08 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

4477c0eb88cbdde1b13f6970d4d42c998e233bd3cb4133aaa3ac5547ccf6c592

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Tue, 13 Feb 2024 14:23:04 GMT
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 ef4ff53b101ef123a46ec560b6c94cb8.cloudfront.net (CloudFront)
cf-cache-status: HIT
content-encoding: br
x-amz-version-id: 7zJenvFQbKxo8MUM.SKdhKxGQgMobUjW
age: 717
x-amz-cf-pop: FRA56-C2
x-cache: Hit from cloudfront
last-modified: Tue, 13 Feb 2024 14:09:54 GMT
server: cloudflare
etag: W/"702bd7dad93a5b3b57026542ef357183"
vary: Accept-Encoding
content-type: application/json
cache-control: public, max-age=14400
cf-ray: 854dba265a7d5d85-FRA
x-amz-cf-id: T_xUe9ddTsuxJuBr4v68iUbqe-uuhAP_kwzZLHIgl0gp-nvRE9lbRQ==
expires: Tue, 13 Feb 2024 18:23:04 GMT

GET
H2 200 footer-social-nav.json Show response
www.crowdstrike.com/wp-content/themes/main-theme/dist/scripts/footer/ 603 B
430 B 74ms
73ms Fetch
application/json 2606:4700::6810:1c08
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.crowdstrike.com/wp-content/themes/main-theme/dist/scripts/footer/footer-social-nav.json

Requested by

Host: www.crowdstrike.com
URL: https://www.crowdstrike.com/wp-content/themes/main-theme/dist/scripts/components/blog-category-sidebar.min.js?ver=1707277106

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:1c08 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

59fe5b428dbf3980f53ef1fb768b90a772e7f430cd33617da5c8ceb54820bf37

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Tue, 13 Feb 2024 14:23:04 GMT
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 c1e2423613b2dcb4230386a2b285734e.cloudfront.net (CloudFront)
cf-cache-status: HIT
content-encoding: br
x-amz-version-id: ZYYx1yO7enm.lOgTJyvlzfrCRFE8a10R
age: 717
x-amz-cf-pop: FRA56-C2
x-cache: Hit from cloudfront
last-modified: Tue, 13 Feb 2024 14:10:17 GMT
server: cloudflare
etag: W/"fe02e99b3de24459feabb1f3754fc4d1"
vary: Accept-Encoding
content-type: application/json
cache-control: public, max-age=14400
cf-ray: 854dba265a7f5d85-FRA
x-amz-cf-id: 3vp7GzFq0-hr5v8b4Q6gNhu1QPfRGuPf5RstTVDv7BpmA7KzeZDElg==
expires: Tue, 13 Feb 2024 18:23:04 GMT

GET
H2 200 sidebar-free-trail.json Show response
www.crowdstrike.com/wp-content/themes/main-theme/dist/data/blog/sidebar/ 159 B
361 B 88ms
88ms Fetch
application/json 2606:4700::6810:1c08
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.crowdstrike.com/wp-content/themes/main-theme/dist/data/blog/sidebar/sidebar-free-trail.json

Requested by

Host: www.crowdstrike.com
URL: https://www.crowdstrike.com/wp-content/themes/main-theme/dist/scripts/components/blog-category-sidebar.min.js?ver=1707277106

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:1c08 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d6a8b2d8de96a693a7f089ff23c3f7aa66ed14718e0d4464a1df1ffb828c8609

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Tue, 13 Feb 2024 14:23:04 GMT
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 bfa7dfbe8ca6d4eb3690c4c82ca6c0fa.cloudfront.net (CloudFront)
cf-cache-status: HIT
content-encoding: br
x-amz-version-id: tAt8lJmhOVfTx1C.dJ2jPILhS0lLnw.6
age: 717
x-amz-cf-pop: FRA56-C2
x-cache: Hit from cloudfront
last-modified: Thu, 30 Nov 2023 17:26:35 GMT
server: cloudflare
etag: W/"df1b037e9cbf2d8045e53137b1055ebe"
vary: Accept-Encoding
content-type: application/json
cache-control: public, max-age=14400
cf-ray: 854dba265a815d85-FRA
x-amz-cf-id: q3KqBngyuAlxE3AFvOFx_-uIGphD2KA_TEtHP-8sHMEJCbegCTe_Yg==
expires: Tue, 13 Feb 2024 18:23:04 GMT

GET
H2 200 sidebar-featured-articles.json Show response
www.crowdstrike.com/wp-content/themes/main-theme/dist/data/blog/widgets/ 4 KB
2 KB 70ms
69ms Fetch
application/json 2606:4700::6810:1c08
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.crowdstrike.com/wp-content/themes/main-theme/dist/data/blog/widgets/sidebar-featured-articles.json

Requested by

Host: www.crowdstrike.com
URL: https://www.crowdstrike.com/wp-content/themes/main-theme/dist/scripts/components/blog-category-sidebar.min.js?ver=1707277106

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:1c08 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c1e771120bf21d4102352843cb5c7374793a181ab940b270ee1178621a4f3a88

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Tue, 13 Feb 2024 14:23:04 GMT
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 a4af9b42c2ec29f616825af32712c204.cloudfront.net (CloudFront)
cf-cache-status: HIT
content-encoding: br
x-amz-version-id: xa53LLrVHMtqPwwmwq54I8.5Bp9NLBFE
age: 717
x-amz-cf-pop: FRA56-C2
x-cache: Hit from cloudfront
last-modified: Tue, 13 Feb 2024 14:09:54 GMT
server: cloudflare
etag: W/"5eb6e1a586d1b2d38258cdfca695e74d"
vary: Accept-Encoding
content-type: application/json
cache-control: public, max-age=14400
cf-ray: 854dba265a835d85-FRA
x-amz-cf-id: f7_9knE94SKnA02J6biQKvhxShBD7quBQ1ieiewOcdvJwjyD_ZxJ7g==
expires: Tue, 13 Feb 2024 18:23:04 GMT

GET
H2 200 sidebar-subscribe.json Show response
www.crowdstrike.com/wp-content/themes/main-theme/dist/data/blog/sidebar/ 178 B
402 B 82ms
81ms Fetch
application/json 2606:4700::6810:1c08
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.crowdstrike.com/wp-content/themes/main-theme/dist/data/blog/sidebar/sidebar-subscribe.json

Requested by

Host: www.crowdstrike.com
URL: https://www.crowdstrike.com/wp-content/themes/main-theme/dist/scripts/components/blog-category-sidebar.min.js?ver=1707277106

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:1c08 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b93680a9f50608d09c147af33f3e897a4b376ff3efb696bb062ed2e0f862d819

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Tue, 13 Feb 2024 14:23:04 GMT
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 95adda0bdbd310a1a9e4f54f540543e2.cloudfront.net (CloudFront)
cf-cache-status: HIT
content-encoding: br
x-amz-version-id: yF1sc_ulYXsHf8xRvR7b_uEQH5dfnrPb
age: 717
x-amz-cf-pop: FRA56-C2
x-cache: Hit from cloudfront
last-modified: Thu, 30 Nov 2023 17:26:35 GMT
server: cloudflare
etag: W/"1fbd7b14b1667df99fa1837a82639ee7"
vary: Accept-Encoding
content-type: application/json
cache-control: public, max-age=14400
cf-ray: 854dba265a845d85-FRA
x-amz-cf-id: _ajW8xA2jZ4TmCQzKppJtVyYYWTe-vbEJAGBU99YnsJ5EbdtXvyOzw==
expires: Tue, 13 Feb 2024 18:23:04 GMT

GET
H2 200 sidebar-demo.json Show response
www.crowdstrike.com/wp-content/themes/main-theme/dist/data/blog/sidebar/ 345 B
460 B 111ms
110ms Fetch
application/json 2606:4700::6810:1c08
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.crowdstrike.com/wp-content/themes/main-theme/dist/data/blog/sidebar/sidebar-demo.json

Requested by

Host: www.crowdstrike.com
URL: https://www.crowdstrike.com/wp-content/themes/main-theme/dist/scripts/components/blog-category-sidebar.min.js?ver=1707277106

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:1c08 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

52b269545d8b0251f5f585cfa9572691d8d50a4a55ddcd6c5dd4e5718136e4f5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Tue, 13 Feb 2024 14:23:04 GMT
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 9928105291571d6cae52bcb916c898d8.cloudfront.net (CloudFront)
cf-cache-status: HIT
content-encoding: br
x-amz-version-id: 1hYlvw7tvbZXbOaaCaEfis69ICdVUqEm
age: 717
x-amz-cf-pop: FRA56-C2
x-cache: Hit from cloudfront
last-modified: Thu, 30 Nov 2023 17:26:35 GMT
server: cloudflare
etag: W/"4d636d45eeb8585ade6681163017cc09"
vary: Accept-Encoding
content-type: application/json
cache-control: public, max-age=14400
cf-ray: 854dba265a855d85-FRA
x-amz-cf-id: Jw5BU1hqLCCYjkFS1bpDSobWQYuM-oJUUiASjUDukcpxz6RBqLB8tg==
expires: Tue, 13 Feb 2024 18:23:04 GMT

GET
H2 200 addsearch-ui.min.css
cdn.addsearch.com/v5/ 42 KB
6 KB 43ms
43ms Stylesheet
text/css 2600:9000:2156:f800:a:de52:1580:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.addsearch.com/v5/addsearch-ui.min.css
Requested by: Host: cdn.addsearch.com
URL: https://cdn.addsearch.com/v5/addsearch-ui.min.js?key=7737a29b854de71521b1cd72c4118cfc&id=asw_01
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2156:f800:a:de52:1580:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 6ebe1e4135bb845bd442e32f716d10da89f715f890bdfe4b71354edb5c7f17f8

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.crowdstrike.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Mon, 12 Feb 2024 19:57:41 GMT
content-encoding: gzip
via: 1.1 a1098f0eeab192209962e3a9d76d0338.cloudfront.net (CloudFront)
last-modified: Tue, 07 Nov 2023 15:45:00 GMT
server: AmazonS3
x-amz-cf-pop: FRA50-C1
age: 66324
etag: W/"38b86b391d57228f06ed64ca140efd1d"
x-amz-server-side-encryption: AES256
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: text/css
x-amz-cf-id: 65FkDieMQG3x2qPKb-WUZ9DobHPLNnYYK1QTsl407LD6D_aT_TKJ2Q==

GET
H2 200 fa-solid-900.woff2
use.fontawesome.com/releases/v6.4.2/webfonts/ 147 KB
147 KB 53ms
52ms Font
font/woff2 2606:4700:e6::ac40:ce26
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://use.fontawesome.com/releases/v6.4.2/webfonts/fa-solid-900.woff2
Requested by: Host: use.fontawesome.com
URL: https://use.fontawesome.com/releases/v6.4.2/css/all.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:e6::ac40:ce26 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 886c86112a804ef1ddd1cb206af4c8c40e34b73c26652ca231404aa35a6b30d9

Request headers

Referer: https://use.fontawesome.com/releases/v6.4.2/css/all.css
Origin: https://www.crowdstrike.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Tue, 13 Feb 2024 14:23:04 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 124008
alt-svc: h3=":443"; ma=86400
content-length: 150020
last-modified: Fri, 22 Sep 2023 01:46:37 GMT
server: cloudflare
etag: "d5e647388e2415268b700d3df2e30a0d"
vary: Origin, Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=wb1Qav47g4HxZ0jSvggLM%2F1iZ9MDT6iKMjWQZQCe9gam%2FhxRRZzvdELK6DikVn0GPIT4xTkMmmtB%2FY3Ybx02o2Dw6pkkTKooXHyVJ0WEZpWFrzSNLkQ%2B1wb7azth0DcCtg2jGLxT7sNrAYNB2p1YePA5"}],"group":"cf-nel","max_age":604800}
content-type: font/woff2
access-control-allow-origin: *
cache-control: max-age=31536000
accept-ranges: bytes
cf-ray: 854dba269b9bb3af-MUC

GET
H2 200 l
use.typekit.net/af/28f000/00000000000000003b9b2048/27/ 23 KB
23 KB 158ms
40ms Font
application/font-woff2 2a02:26f0:3500:16::215:1486
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://use.typekit.net/af/28f000/00000000000000003b9b2048/27/l?primer=7cdcb44be4a7db8877ffa5c0007b8dd865b3bbc383831fe2ea177f62257a9191&fvd=n5&v=3
Requested by: Host: use.typekit.net
URL: https://use.typekit.net/zya3koo.css
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:3500:16::215:1486 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: nginx /
Resource Hash: b332a3fa616df968bdd71567cde2fe6031561746f6022d06993bde4001ec2730

Request headers

Referer: https://use.typekit.net/zya3koo.css
Origin: https://www.crowdstrike.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Tue, 13 Feb 2024 14:23:04 GMT
server: nginx
etag: "5d5df1b25290dc82b22a668f0395604299f16750"
content-type: application/font-woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 23176

GET
H2 200 logo-red.svg
cdn.addsearch.com/v4/assets/ 4 KB
2 KB 43ms
43ms Image
image/svg+xml 2600:9000:2156:f800:a:de52:1580:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.addsearch.com/v4/assets/logo-red.svg
Requested by: Host: www.crowdstrike.com
URL: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2156:f800:a:de52:1580:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: bee78f076d7ef9d9be92fb1f293909e529c5b61891a52557d51e7183971e02cc

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.crowdstrike.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Mon, 12 Feb 2024 19:47:44 GMT
content-encoding: gzip
via: 1.1 a1098f0eeab192209962e3a9d76d0338.cloudfront.net (CloudFront)
last-modified: Mon, 27 Jun 2022 06:28:24 GMT
server: AmazonS3
x-amz-cf-pop: FRA50-C1
age: 66921
etag: W/"8c2b9e4242eb4f2a16941b1de3656f64"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: image/svg+xml
x-amz-cf-id: TTxloO4o1Rl1VLic5SIe3miycUbZmas2Gk-egOJYtidikezgy8US1w==

GET
H2 200 footer-social-nav.json Show response
www.crowdstrike.com/wp-content/themes/main-theme/dist/scripts/footer/ 603 B
435 B 90ms
90ms Fetch
application/json 2606:4700::6810:1c08
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.crowdstrike.com/wp-content/themes/main-theme/dist/scripts/footer/footer-social-nav.json

Requested by

Host: www.crowdstrike.com
URL: https://www.crowdstrike.com/wp-content/themes/main-theme/dist/scripts/components/footer-navigation.min.js?ver=1707277106

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:1c08 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

59fe5b428dbf3980f53ef1fb768b90a772e7f430cd33617da5c8ceb54820bf37

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Tue, 13 Feb 2024 14:23:04 GMT
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 c1e2423613b2dcb4230386a2b285734e.cloudfront.net (CloudFront)
cf-cache-status: HIT
content-encoding: br
x-amz-version-id: ZYYx1yO7enm.lOgTJyvlzfrCRFE8a10R
age: 717
x-amz-cf-pop: FRA56-C2
x-cache: Hit from cloudfront
last-modified: Tue, 13 Feb 2024 14:10:17 GMT
server: cloudflare
etag: W/"fe02e99b3de24459feabb1f3754fc4d1"
vary: Accept-Encoding
content-type: application/json
cache-control: public, max-age=14400
cf-ray: 854dba269ade5d85-FRA
x-amz-cf-id: 3vp7GzFq0-hr5v8b4Q6gNhu1QPfRGuPf5RstTVDv7BpmA7KzeZDElg==
expires: Tue, 13 Feb 2024 18:23:04 GMT

GET
H2 200 forms2.min.js Show response
go.crowdstrike.com/js/forms2/js/ 199 KB
67 KB 164ms
62ms Script
application/x-javascript 104.17.73.206
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://go.crowdstrike.com/js/forms2/js/forms2.min.js

Requested by

Host: www.crowdstrike.com
URL: https://www.crowdstrike.com/wp-content/themes/main-theme/dist/scripts/components/footer-navigation.min.js?ver=1707277106

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

104.17.73.206 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

be64da47ffc5fc1e40ba8205a0974330a76815e151e84ba365a750a7c96f1d1d

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.crowdstrike.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Tue, 13 Feb 2024 14:23:04 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
last-modified: Fri, 05 Jan 2024 00:21:30 GMT
server: cloudflare
age: 1702
etag: "20005-31ad2-60e27d4627680"
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: public, max-age=14400
cf-ray: 854dba2748b534f1-WAW
expires: Tue, 13 Feb 2024 18:23:04 GMT

GET
H2 200 marketo-forms.min.js Show response
www.crowdstrike.com/wp-content/themes/main-theme/dist/scripts/components/ 29 KB
10 KB 131ms
131ms Script
application/javascript 2606:4700::6810:1c08
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.crowdstrike.com/wp-content/themes/main-theme/dist/scripts/components/marketo-forms.min.js

Requested by

Host: www.crowdstrike.com
URL: https://www.crowdstrike.com/wp-content/themes/main-theme/dist/scripts/components/footer-navigation.min.js?ver=1707277106

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:1c08 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

57ddc734dae06a7364ef27a7a27b1695f22719f42cd3893b2faee935adb6beb6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Tue, 13 Feb 2024 14:23:04 GMT
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 f891d17fa862cc74a05434e03fa58dca.cloudfront.net (CloudFront)
cf-cache-status: HIT
content-encoding: br
x-amz-version-id: DmtpFlb_4HqVtaL96xeKLCnDh1qT5zX4
age: 714
x-amz-cf-pop: FRA56-C2
x-cache: Hit from cloudfront
last-modified: Tue, 13 Feb 2024 14:10:16 GMT
server: cloudflare
etag: W/"3323b3a5b97b4dfd880bbbfe74bea392"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=14400
cf-ray: 854dba26aae15d85-FRA
x-amz-cf-id: 8vroPjlHkfPZ_am8Kw8zLMmHXasphfbn07QdAKqKwP5BoqrNn83AlA==
expires: Tue, 13 Feb 2024 18:23:04 GMT

GET
H2 200 l
use.typekit.net/af/8a200c/00000000000000003b9b204a/27/ 24 KB
24 KB 154ms
51ms Font
application/font-woff2 2a02:26f0:3500:16::215:1486
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://use.typekit.net/af/8a200c/00000000000000003b9b204a/27/l?primer=7cdcb44be4a7db8877ffa5c0007b8dd865b3bbc383831fe2ea177f62257a9191&fvd=n6&v=3
Requested by: Host: use.typekit.net
URL: https://use.typekit.net/zya3koo.css
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:3500:16::215:1486 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: nginx /
Resource Hash: 0f9c2ce6f85c93eed9e3e0917378e13d9ecc30b3690a2c97f9eb013b81244f4b

Request headers

Referer: https://use.typekit.net/zya3koo.css
Origin: https://www.crowdstrike.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Tue, 13 Feb 2024 14:23:04 GMT
server: nginx
etag: "98e94e3a4f18a4bde13fe394b9115dd62fc5445b"
content-type: application/font-woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 24452

GET
H2 200 l
use.typekit.net/af/d562ce/00000000000000003b9b204c/27/ 25 KB
25 KB 148ms
45ms Font
application/font-woff2 2a02:26f0:3500:16::215:1486
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://use.typekit.net/af/d562ce/00000000000000003b9b204c/27/l?primer=7cdcb44be4a7db8877ffa5c0007b8dd865b3bbc383831fe2ea177f62257a9191&fvd=n7&v=3
Requested by: Host: use.typekit.net
URL: https://use.typekit.net/zya3koo.css
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:3500:16::215:1486 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: nginx /
Resource Hash: 0bf90a8569ed246ad28d91458f6771f6934a0c4983243eca5f6accf91d6979cc

Request headers

Referer: https://use.typekit.net/zya3koo.css
Origin: https://www.crowdstrike.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Tue, 13 Feb 2024 14:23:04 GMT
server: nginx
etag: "79b73a8b60023503d1f34e07b81f37976902b3f9"
content-type: application/font-woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 25780

GET
H2 200 fa-brands-400.woff2
use.fontawesome.com/releases/v6.4.2/webfonts/ 107 KB
108 KB 86ms
85ms Font
font/woff2 2606:4700:e6::ac40:ce26
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://use.fontawesome.com/releases/v6.4.2/webfonts/fa-brands-400.woff2
Requested by: Host: use.fontawesome.com
URL: https://use.fontawesome.com/releases/v6.4.2/css/all.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:e6::ac40:ce26 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: faae6fc0aa94cc5bde5076647c817a23206096a1cbeda10d1c6f3d89d6163ed1

Request headers

Referer: https://use.fontawesome.com/releases/v6.4.2/css/all.css
Origin: https://www.crowdstrike.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Tue, 13 Feb 2024 14:23:04 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 429054
alt-svc: h3=":443"; ma=86400
content-length: 109808
last-modified: Fri, 22 Sep 2023 01:46:37 GMT
server: cloudflare
etag: "005c9aa92b564b73b7582cc4f1fa49cb"
vary: Origin, Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Arf7VtWWxzA7m7rh3c9Kpb5TVVobZi7ob8p7ZMjoGUJvOSMvp2ozAbbZti6mi5iAzDIe507uPImrYAk3IoOjAfB0uDyEMlY%2FV27t%2FUBtQqqcPHcWs3H%2FOKe5hjJV08J3CTjgbS6afChuCZN3VVIFIx4h"}],"group":"cf-nel","max_age":604800}
content-type: font/woff2
access-control-allow-origin: *
cache-control: max-age=31536000
accept-ranges: bytes
cf-ray: 854dba26bbd9b3af-MUC

GET
H2 200 Fatman-Light.woff2
www.crowdstrike.com/wp-content/themes/main-theme/dist/fonts/Fatman/ 17 KB
18 KB 100ms
99ms Font
font/woff2 2606:4700::6810:1c08
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.crowdstrike.com/wp-content/themes/main-theme/dist/fonts/Fatman/Fatman-Light.woff2

Requested by

Host: www.crowdstrike.com
URL: https://www.crowdstrike.com/wp-content/themes/main-theme/dist/styles/theme-styles.min.css?ver=1707277106

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:1c08 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

cc6addb827a2a39237154916d2a692464bceb44dc7bd73e7cdeb7150181615b5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://www.crowdstrike.com/wp-content/themes/main-theme/dist/styles/theme-styles.min.css?ver=1707277106
Origin: https://www.crowdstrike.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Tue, 13 Feb 2024 14:23:04 GMT
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 a7631312afe99e40229aa0da70662112.cloudfront.net (CloudFront)
cf-cache-status: HIT
x-amz-version-id: vjeX0A4h_MxR8U2GdrRyNnDvMWCRugfS
age: 717
x-amz-cf-pop: FRA56-C2
x-cache: Hit from cloudfront
content-length: 17736
last-modified: Tue, 13 Feb 2024 14:09:56 GMT
server: cloudflare
etag: "85db19d40add135904a6215a2a29ef38"
vary: Accept-Encoding
content-type: font/woff2
cache-control: public, max-age=14400
accept-ranges: bytes
cf-ray: 854dba26aaef5d85-FRA
x-amz-cf-id: ZhOthRYSWmXonvZxPXuLKGr2UfCZRVo-QcBvM8AyuOU-HpPbgN7rtw==
expires: Tue, 13 Feb 2024 18:23:04 GMT

GET
H2 200 crowdstrike.ttf
www.crowdstrike.com/wp-content/themes/main-theme/dist/fonts/CrowdStrike/ 82 KB
47 KB 81ms
81ms Font
font/ttf 2606:4700::6810:1c08
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.crowdstrike.com/wp-content/themes/main-theme/dist/fonts/CrowdStrike/crowdstrike.ttf?sfjo45

Requested by

Host: www.crowdstrike.com
URL: https://www.crowdstrike.com/wp-content/themes/main-theme/dist/styles/theme-styles.min.css?ver=1707277106

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:1c08 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

9f9f09220578095d79ded54e8c0ee6ef21bc38e86475d2645b8656bbef22bbeb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://www.crowdstrike.com/wp-content/themes/main-theme/dist/styles/theme-styles.min.css?ver=1707277106
Origin: https://www.crowdstrike.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Tue, 13 Feb 2024 14:23:04 GMT
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 3298c44116035984c2fac24b89183c4e.cloudfront.net (CloudFront)
cf-cache-status: HIT
content-encoding: br
x-amz-version-id: C.vYZkEsM7EFDEu_gghACfta3jRCdP5_
age: 353
x-amz-cf-pop: FRA56-C2
x-cache: Hit from cloudfront
last-modified: Tue, 13 Feb 2024 14:09:54 GMT
server: cloudflare
etag: W/"ad87bba53a140fc17152a36f87a03f2f"
vary: Accept-Encoding
content-type: font/ttf
cache-control: public, max-age=14400
cf-ray: 854dba26aaf45d85-FRA
x-amz-cf-id: rPx4wfELOzI9A-dj4rlCj14HsKiZV2CJLG_wwzZUbKUqs0g3mjENaQ==
expires: Tue, 13 Feb 2024 18:23:04 GMT

GET
H2 200 blog-nav.json Show response
www.crowdstrike.com/wp-content/themes/main-theme/dist/data/blog/ 75 KB
6 KB 102ms
101ms XHR
application/json 2606:4700::6810:1c08
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.crowdstrike.com/wp-content/themes/main-theme/dist/data/blog/blog-nav.json?ts=1707834180000

Requested by

Host: www.crowdstrike.com
URL: https://www.crowdstrike.com/wp-content/themes/main-theme/dist/scripts/components/blog-navigation.min.js?ver=1707277106

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:1c08 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f4e1bfc87a88a106bfe6a37e4176ed1ac1c8a8eb82d05135adedeacb8d216160

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Tue, 13 Feb 2024 14:23:04 GMT
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 8fd360cd20d33fa1400394ae41746f66.cloudfront.net (CloudFront)
cf-cache-status: HIT
content-encoding: br
x-amz-version-id: NkJVktcGTPRjKyx5OvxuKiVUgw43bm8_
x-amz-cf-pop: FRA56-C2
x-cache: Hit from cloudfront
last-modified: Tue, 13 Feb 2024 14:09:51 GMT
server: cloudflare
etag: W/"51cb0cd01b215b44cb546415878c44cf"
vary: Accept-Encoding
content-type: application/json
cache-control: public, max-age=14400
cf-ray: 854dba26cb0f5d85-FRA
x-amz-cf-id: JKlk9L651ODq-YLWfM5Zy9dXXUf7D18A7yUwq_JovPlVKOXzezJhWA==
expires: Tue, 13 Feb 2024 18:23:04 GMT

GET
H2 200 bee15b7c-b632-450e-9003-9c8b60b3b978.json Show response
cdn.cookielaw.org/consent/bee15b7c-b632-450e-9003-9c8b60b3b978/ 5 KB
2 KB 143ms
62ms XHR
application/x-javascript 2606:4700::6812:82ec
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/consent/bee15b7c-b632-450e-9003-9c8b60b3b978/bee15b7c-b632-450e-9003-9c8b60b3b978.json

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:82ec , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d4b15d353de13549299d08a87c2f8ba100014369b257c44357f55b06b944a82f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.crowdstrike.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Tue, 13 Feb 2024 14:23:04 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
strict-transport-security: max-age=31536000; includeSubDomains; preload
age: 37392
content-md5: fIobBgxUeQjm7nxZOvzUww==
content-length: 1755
x-ms-lease-status: unlocked
last-modified: Thu, 08 Feb 2024 02:33:52 GMT
server: cloudflare
etag: 0x8DC284E63FD9EE7
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: *
x-ms-request-id: 8df5ea2a-f01e-0066-4f37-5a76a3000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=86400
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 854dba275d4003a0-FRA
expires: Wed, 14 Feb 2024 14:23:04 GMT

GET
H2 200 breaches-stop-here-post-cta.jpeg
www.crowdstrike.com/wp-content/uploads/2021/07/ 17 KB
17 KB 101ms
101ms Image
image/jpeg 2606:4700::6810:1c08
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.crowdstrike.com/wp-content/uploads/2021/07/breaches-stop-here-post-cta.jpeg

Requested by

Host: www.crowdstrike.com
URL: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:1c08 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

8e0c9ad71fdf2b8553461659e37cfbb453a5a569c5f8c67273cded5fc9e0d2ae

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Tue, 13 Feb 2024 14:23:04 GMT
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 0d5d2d408eb42296c7636196e25ef8a2.cloudfront.net (CloudFront)
cf-cache-status: HIT
x-amz-version-id: aPnhXcSd19qyXFMnDtLV9aa66s2nMfzf
age: 353
x-amz-cf-pop: FRA56-C2
cf-polished: origSize=17921
x-cache: Hit from cloudfront
content-length: 17580
last-modified: Mon, 21 Aug 2023 21:48:07 GMT
cf-bgj: imgq:85,h2pri
server: cloudflare
etag: "d954c6a287707fc4afac139378aae270"
vary: Accept-Encoding
content-type: image/jpeg
cache-control: public, max-age=14400
accept-ranges: bytes
cf-ray: 854dba26db275d85-FRA
x-amz-cf-id: wyR0k7UD_UPByewJc71SKIcDNFZ61G_dSIatd3HkG2R3WzApERIfwg==
expires: Tue, 13 Feb 2024 18:23:04 GMT

GET
H2 200 23-m-156_cloud-security-icon.svg
www.crowdstrike.com/wp-content/uploads/2023/11/ 3 KB
2 KB 73ms
73ms Image
image/svg+xml 2606:4700::6810:1c08
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.crowdstrike.com/wp-content/uploads/2023/11/23-m-156_cloud-security-icon.svg

Requested by

Host: www.crowdstrike.com
URL: https://www.crowdstrike.com/wp-content/themes/main-theme/dist/styles/pages/single-post.min.css?ver=1707277106

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:1c08 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0dcb4b8f8926bf46fb35389caec38cf06c566048372f67646d40efce85e24346

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.crowdstrike.com/wp-content/themes/main-theme/dist/styles/pages/single-post.min.css?ver=1707277106
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Tue, 13 Feb 2024 14:23:04 GMT
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 0a4e8f7c3d348e526848328c55dd452a.cloudfront.net (CloudFront)
cf-cache-status: HIT
content-encoding: br
x-amz-version-id: KLqVNZDbrgzQIWJhNjlgVagwiOj8yJQn
age: 353
x-amz-cf-pop: FRA56-C2
x-cache: Hit from cloudfront
last-modified: Fri, 17 Nov 2023 22:08:47 GMT
server: cloudflare
etag: W/"ad1aee8fa1ac90ea74a166f24797a258"
vary: Accept-Encoding
content-type: image/svg+xml
cache-control: public, max-age=14400
cf-ray: 854dba26eb3b5d85-FRA
x-amz-cf-id: 5IGVKPIyGMM-KrHJcoyXQJCRhrrefaaBPEnOfEII0mCk_G3J_zq8IQ==
expires: Tue, 13 Feb 2024 18:23:04 GMT

GET
H2 200 itcavantgardepro-xlt-webfont.woff
www.crowdstrike.com/wp-content/themes/main-theme/dist/fonts/ITCAvantGardePro/ 26 KB
26 KB 96ms
96ms Font
font/woff 2606:4700::6810:1c08
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.crowdstrike.com/wp-content/themes/main-theme/dist/fonts/ITCAvantGardePro/itcavantgardepro-xlt-webfont.woff

Requested by

Host: www.crowdstrike.com
URL: https://www.crowdstrike.com/wp-content/themes/main-theme/dist/styles/theme-styles.min.css?ver=1707277106

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:1c08 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0f1c1c319dae1d32ef2feaa657e6d82c5f8fe4c98aa8bbc7ee0aab8b5b9d5d38

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://www.crowdstrike.com/wp-content/themes/main-theme/dist/styles/theme-styles.min.css?ver=1707277106
Origin: https://www.crowdstrike.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Tue, 13 Feb 2024 14:23:04 GMT
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 0d4b487d54766de7560aa02de852bbf8.cloudfront.net (CloudFront)
cf-cache-status: HIT
x-amz-version-id: 5a7ED2IWwWle7rA1bjzx81JiUTElyHXd
age: 353
x-amz-cf-pop: FRA56-C2
x-cache: Hit from cloudfront
content-length: 26532
last-modified: Tue, 13 Feb 2024 14:09:57 GMT
server: cloudflare
etag: "97e5d80225ecf45f6488b9f660ecfd8c"
vary: Accept-Encoding
content-type: font/woff
cache-control: public, max-age=14400
accept-ranges: bytes
cf-ray: 854dba26eb3c5d85-FRA
x-amz-cf-id: GE_H7E2XraRbR8_hPNRMTHy74bn9oRhJ_2PGM3qC5N9zXW52T2CX0w==
expires: Tue, 13 Feb 2024 18:23:04 GMT

GET
H2 200 CS_Free_Trial_blog_300x600_final.jpg
www.crowdstrike.com/wp-content/uploads/2021/07/ 34 KB
34 KB 101ms
100ms Image
image/jpeg 2606:4700::6810:1c08
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.crowdstrike.com/wp-content/uploads/2021/07/CS_Free_Trial_blog_300x600_final.jpg

Requested by

Host: www.crowdstrike.com
URL: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:1c08 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

04466026773f10391f6d0d84d702b9eef45db6438822b4edcd931cf5cc89d2d2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Tue, 13 Feb 2024 14:23:04 GMT
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 9928105291571d6cae52bcb916c898d8.cloudfront.net (CloudFront)
cf-cache-status: HIT
x-amz-version-id: cfHzBS98Ix2fCm5KBQbaOjBHu5VCHYBi
age: 353
x-amz-cf-pop: FRA56-C2
cf-polished: degrade=85, origSize=105065
x-cache: Hit from cloudfront
content-length: 34443
last-modified: Fri, 12 Jan 2024 17:28:36 GMT
cf-bgj: imgq:85,h2pri
server: cloudflare
etag: "11edcc35473c47fabaa1e19b2f186d08-1"
vary: Accept-Encoding
content-type: image/jpeg
cache-control: public, max-age=14400
accept-ranges: bytes
cf-ray: 854dba26fb405d85-FRA
x-amz-cf-id: y1gOobWoiZucPEJ8QwuMK3RdC_KsbNV59hTjgcUaNKzdOuG3yVU08w==
expires: Tue, 13 Feb 2024 18:23:04 GMT

GET
H2 200 red-falcon.svg
www.crowdstrike.com/wp-content/uploads/2021/07/ 4 KB
2 KB 95ms
95ms Image
image/svg+xml 2606:4700::6810:1c08
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.crowdstrike.com/wp-content/uploads/2021/07/red-falcon.svg

Requested by

Host: www.crowdstrike.com
URL: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:1c08 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f8f105a0a91843bdeac95e6aff14d7753ca2aaff00c942cf1bcb1da1025cff4c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Tue, 13 Feb 2024 14:23:04 GMT
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 a4af9b42c2ec29f616825af32712c204.cloudfront.net (CloudFront)
cf-cache-status: HIT
content-encoding: br
x-amz-version-id: TcFqfoqw60gqGStaXtVlISxjk.DdUyRi
age: 353
x-amz-cf-pop: FRA56-C2
x-cache: Hit from cloudfront
last-modified: Mon, 10 Jul 2023 19:37:50 GMT
server: cloudflare
etag: W/"2c1e9eeb3990af43e758701889df354a-1"
vary: Accept-Encoding
content-type: image/svg+xml
cache-control: public, max-age=14400
cf-ray: 854dba271b705d85-FRA
x-amz-cf-id: 79jnBXcd8_PLlcEK3pFzs4IqPiwBB6HcsM5N55_iqmJgnQlLsymKhg==
expires: Tue, 13 Feb 2024 18:23:04 GMT

GET
H2 200 promo.json Show response
www.crowdstrike.com/wp-content/themes/main-theme/dist/scripts/promo-json/ 7 KB
2 KB 76ms
76ms Fetch
application/json 2606:4700::6810:1c08
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.crowdstrike.com/wp-content/themes/main-theme/dist/scripts/promo-json/promo.json

Requested by

Host: www.crowdstrike.com
URL: https://www.crowdstrike.com/wp-content/themes/main-theme/dist/scripts/theme-scripts.min.js?ver=1707277106

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:1c08 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

cd25fbf311f88907fc669385ab12793353e5781fdc7f360767a97344896a88e7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Tue, 13 Feb 2024 14:23:04 GMT
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 753f415578c1ca010e51a83aef192330.cloudfront.net (CloudFront)
cf-cache-status: HIT
content-encoding: br
x-amz-version-id: 0tnSF88q3e8rjC41TUR0PxCCW2upVEX5
age: 715
x-amz-cf-pop: FRA56-C2
x-cache: Hit from cloudfront
last-modified: Fri, 09 Feb 2024 18:54:40 GMT
server: cloudflare
etag: W/"16053b3aa98bd1ec34b9dd7e0e17cec2"
vary: Accept-Encoding
content-type: application/json
cache-control: public, max-age=14400
cf-ray: 854dba271b7d5d85-FRA
x-amz-cf-id: 8yglZdi6SYRpL_o8zPd1es30OZOeGMJ1wwx3iVpEy5GrcpZUENLBqQ==
expires: Tue, 13 Feb 2024 18:23:04 GMT

GET
H2 200 footer-nav.json Show response
www.crowdstrike.com/wp-content/themes/main-theme/dist/scripts/footer/ 3 KB
784 B 98ms
98ms Fetch
application/json 2606:4700::6810:1c08
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.crowdstrike.com/wp-content/themes/main-theme/dist/scripts/footer/footer-nav.json

Requested by

Host: www.crowdstrike.com
URL: https://www.crowdstrike.com/wp-content/themes/main-theme/dist/scripts/components/footer-navigation.min.js?ver=1707277106

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:1c08 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e2f64fa9ea0c7f0abc1ad4a0d11b3808ffb66ca288d93e4129a53478be0145bf

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Tue, 13 Feb 2024 14:23:04 GMT
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 9928105291571d6cae52bcb916c898d8.cloudfront.net (CloudFront)
cf-cache-status: HIT
content-encoding: br
x-amz-version-id: plDIuDhlgwBaNyfd0.wT_s3Qq5kQPmfu
age: 717
x-amz-cf-pop: FRA56-C2
x-cache: Hit from cloudfront
last-modified: Tue, 13 Feb 2024 14:10:16 GMT
server: cloudflare
etag: W/"5e2a12ce9a5e06043165aec32f686b1b"
vary: Accept-Encoding
content-type: application/json
cache-control: public, max-age=14400
cf-ray: 854dba273b935d85-FRA
x-amz-cf-id: blggtbUwmpO8kkuVOjbeVhD_PJLj2vkzHDXkikPyuBP9KdfyEPCTsA==
expires: Tue, 13 Feb 2024 18:23:04 GMT

GET
H2 200 RedLogoCS.svg
www.crowdstrike.com/wp-content/themes/main-theme/dist/images/logos/crowdstrike/ 6 KB
2 KB 81ms
72ms Image
image/svg+xml 2606:4700::6810:1c08
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.crowdstrike.com/wp-content/themes/main-theme/dist/images/logos/crowdstrike/RedLogoCS.svg

Requested by

Host: www.crowdstrike.com
URL: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:1c08 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

74a8d08bfffcc2b091168ebe5d30299c4857f962280f3b214ec64f460587b4c7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Tue, 13 Feb 2024 14:23:04 GMT
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 d8670b0c6b76371fb58f730881dfe504.cloudfront.net (CloudFront)
cf-cache-status: HIT
content-encoding: br
x-amz-version-id: w7vBpzdiLKQTyp6lpzQQ7B4dHCYyWqjA
age: 353
x-amz-cf-pop: FRA56-C2
x-cache: Hit from cloudfront
last-modified: Tue, 13 Feb 2024 14:10:10 GMT
server: cloudflare
etag: W/"81ee08b1302889572e1a229ba2a2029b"
vary: Accept-Encoding
content-type: image/svg+xml
cache-control: public, max-age=14400
cf-ray: 854dba277beb5d85-FRA
x-amz-cf-id: PRS9oeQciABr4zcqQyVU2ir4oMKXOu20MFwyS66TM3CrbD_UcpObAA==
expires: Tue, 13 Feb 2024 18:23:04 GMT

GET
H2 200 24-CLD-001_Forrester-CWS-Wave_Blog-1.png
www.crowdstrike.com/wp-content/uploads/2024/01/ 64 KB
64 KB 108ms
99ms Image
image/png 2606:4700::6810:1c08
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.crowdstrike.com/wp-content/uploads/2024/01/24-CLD-001_Forrester-CWS-Wave_Blog-1.png

Requested by

Host: www.crowdstrike.com
URL: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:1c08 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c177ad8c33494cceb633584a0bcdf034091b5b3058c086dd89edfe1412f497dd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Tue, 13 Feb 2024 14:23:04 GMT
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 1a3d61cabf9778724765b3e70befe816.cloudfront.net (CloudFront)
cf-cache-status: HIT
x-amz-version-id: qnGudxVO98OGj5TtDKHPwLlKQ_bVp5Uo
age: 353
x-amz-cf-pop: FRA56-C2
cf-polished: status=not_needed
x-cache: Hit from cloudfront
content-length: 65344
last-modified: Fri, 09 Feb 2024 21:27:17 GMT
cf-bgj: imgq:85,h2pri
server: cloudflare
etag: "9fdf9c4e1b9f7910b624c28f5fc604ff-1"
vary: Accept-Encoding
content-type: image/png
cache-control: public, max-age=14400
accept-ranges: bytes
cf-ray: 854dba277bed5d85-FRA
x-amz-cf-id: hhJDYU71o7t-XN_HRjj1GliIjBE0lZWcEdrgpZ5nn6Zyv9qTTqioeg==
expires: Tue, 13 Feb 2024 18:23:04 GMT

GET
H2 200 0124_01_Cs-Defends-Against-Azure-Attacks.jpg
www.crowdstrike.com/wp-content/uploads/2024/02/ 175 KB
176 KB 108ms
99ms Image
image/jpeg 2606:4700::6810:1c08
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.crowdstrike.com/wp-content/uploads/2024/02/0124_01_Cs-Defends-Against-Azure-Attacks.jpg

Requested by

Host: www.crowdstrike.com
URL: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:1c08 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

224571e698a1c81926236b1c4e311041ceed09e992ab08750f7ed225f7d884b7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Tue, 13 Feb 2024 14:23:04 GMT
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 a4af9b42c2ec29f616825af32712c204.cloudfront.net (CloudFront)
cf-cache-status: HIT
x-amz-version-id: AIpPTYI9CsFlPD3rzXbGTAfcOm3MRCtW
age: 353
x-amz-cf-pop: FRA56-C2
cf-polished: degrade=85, origSize=614365
x-cache: Hit from cloudfront
content-length: 179704
last-modified: Tue, 13 Feb 2024 14:03:34 GMT
cf-bgj: imgq:85,h2pri
server: cloudflare
etag: "19d8bceb79fbe05b33a033a0ba886a6b-1"
vary: Accept-Encoding
content-type: image/jpeg
cache-control: public, max-age=14400
accept-ranges: bytes
cf-ray: 854dba277bee5d85-FRA
x-amz-cf-id: zeYCv5dw-arOMfl6Pg9cHVf0qqWcdptPdtyFckdddKLWCHJOlK_0lw==
expires: Tue, 13 Feb 2024 18:23:04 GMT

GET
H2 200 Generic_Blogs_Cloud_Security-1.png
www.crowdstrike.com/wp-content/uploads/2024/01/ 54 KB
54 KB 91ms
82ms Image
image/png 2606:4700::6810:1c08
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.crowdstrike.com/wp-content/uploads/2024/01/Generic_Blogs_Cloud_Security-1.png

Requested by

Host: www.crowdstrike.com
URL: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:1c08 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

469f4c87c308eb70d2ef173724ad54f9270ab81c29ae15ff7e052eb33d3b9974

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Tue, 13 Feb 2024 14:23:04 GMT
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 99399b4523bd3370d7a592870d630ec8.cloudfront.net (CloudFront)
cf-cache-status: HIT
x-amz-version-id: GzEIt9hlzXCULU5gVoT42MeaeI4MfYg4
age: 353
x-amz-cf-pop: FRA56-C2
cf-polished: status=not_needed
x-cache: Hit from cloudfront
content-length: 55344
last-modified: Thu, 08 Feb 2024 20:22:57 GMT
cf-bgj: imgq:85,h2pri
server: cloudflare
etag: "2406a55f6e1c23157316636c597a10d6-1"
vary: Accept-Encoding
content-type: image/png
cache-control: public, max-age=14400
accept-ranges: bytes
cf-ray: 854dba277bf05d85-FRA
x-amz-cf-id: F7dEqUP8gbzYmwuVAypAt0fPF2LmV8-fwXA0pAC5jeA558B53vbzbg==
expires: Tue, 13 Feb 2024 18:23:04 GMT

GET
H2 200 app-security-report-blog-post-art.jpg
www.crowdstrike.com/wp-content/uploads/2024/02/ 173 KB
174 KB 107ms
99ms Image
image/jpeg 2606:4700::6810:1c08
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.crowdstrike.com/wp-content/uploads/2024/02/app-security-report-blog-post-art.jpg

Requested by

Host: www.crowdstrike.com
URL: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:1c08 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

3aea19d73e1aef8c605d28b0ac9e774acadb4c401dfe4335d9da9bbe1a665876

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Tue, 13 Feb 2024 14:23:04 GMT
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 6c7a5d26be7fb35284e54d321f16b6f6.cloudfront.net (CloudFront)
cf-cache-status: HIT
x-amz-version-id: gFEisWmFtK6SIMFRUJ6dmu_LNYIFDvht
age: 507
x-amz-cf-pop: FRA56-C2
cf-polished: degrade=85, origSize=255332
x-cache: Hit from cloudfront
content-length: 177238
last-modified: Tue, 13 Feb 2024 14:03:27 GMT
cf-bgj: imgq:85,h2pri
server: cloudflare
etag: "39b5a952d2dd69b21db3db1adf48e7ce-1"
vary: Accept-Encoding
content-type: image/jpeg
cache-control: public, max-age=14400
accept-ranges: bytes
cf-ray: 854dba277bf45d85-FRA
x-amz-cf-id: WrMVwoy25zKjTIFRAay_0lJs_aX1D59SWFEFHD_vDpss_0tZsAKNTg==
expires: Tue, 13 Feb 2024 18:23:04 GMT

GET
H2 200 Blog_1060x698-18.jpeg
www.crowdstrike.com/wp-content/uploads/2021/09/ 198 KB
199 KB 108ms
100ms Image
image/jpeg 2606:4700::6810:1c08
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.crowdstrike.com/wp-content/uploads/2021/09/Blog_1060x698-18.jpeg

Requested by

Host: www.crowdstrike.com
URL: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:1c08 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

accf452e39300d2d291ca9788c8fc18ea151a8966a75946adc64b5845dffd08d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Tue, 13 Feb 2024 14:23:04 GMT
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 95adda0bdbd310a1a9e4f54f540543e2.cloudfront.net (CloudFront)
cf-cache-status: HIT
x-amz-version-id: jJhM4ZVp.iuSK8QHk82sOWOYJjyFM5Ml
age: 353
x-amz-cf-pop: FRA56-C2
cf-polished: degrade=85, origSize=579579
x-cache: Hit from cloudfront
content-length: 202848
last-modified: Tue, 13 Feb 2024 14:03:33 GMT
cf-bgj: imgq:85,h2pri
server: cloudflare
etag: "eb62e91d612d0458ee72cd931435aa7d-1"
vary: Accept-Encoding
content-type: image/jpeg
cache-control: public, max-age=14400
accept-ranges: bytes
cf-ray: 854dba277bf65d85-FRA
x-amz-cf-id: Xarg7mVsYwpWJmvn79yOfZjI4sl5Ch396-Vqk2Mi4MVDNHhe0tXYOw==
expires: Tue, 13 Feb 2024 18:23:04 GMT

GET
H2 200 IR-Video-Blog-1.jpg
www.crowdstrike.com/wp-content/uploads/2019/12/ 14 KB
14 KB 82ms
74ms Image
image/jpeg 2606:4700::6810:1c08
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.crowdstrike.com/wp-content/uploads/2019/12/IR-Video-Blog-1.jpg

Requested by

Host: www.crowdstrike.com
URL: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:1c08 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e36ce51df6d05a63225d449ba07b002ef1c2cd73b946e21e27456b251449712b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Tue, 13 Feb 2024 14:23:04 GMT
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 dca6db3c8f31f3cd48bb06d78a8be624.cloudfront.net (CloudFront)
cf-cache-status: HIT
x-amz-version-id: FSNIdF8CVVHTE6acQqnEZJh8Pm4UlDXN
age: 353
x-amz-cf-pop: FRA56-C2
cf-polished: degrade=85, origSize=60108
x-cache: Hit from cloudfront
content-length: 14351
last-modified: Tue, 11 Jul 2023 13:42:31 GMT
cf-bgj: imgq:85,h2pri
server: cloudflare
etag: "96e7d13e7744d7a668c204a2d141f878-1"
vary: Accept-Encoding
content-type: image/jpeg
cache-control: public, max-age=14400
accept-ranges: bytes
cf-ray: 854dba277bf85d85-FRA
x-amz-cf-id: uJro0ND0OeH8ybQaMpYCsssrPVZNo0l9JPJKfaaDy2JFvKCyemLi5A==
expires: Tue, 13 Feb 2024 18:23:04 GMT

GET
H2 200 Blog-Image-CredTheft-Demo-1.png
www.crowdstrike.com/wp-content/uploads/2019/04/ 96 KB
96 KB 134ms
126ms Image
image/png 2606:4700::6810:1c08
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.crowdstrike.com/wp-content/uploads/2019/04/Blog-Image-CredTheft-Demo-1.png

Requested by

Host: www.crowdstrike.com
URL: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:1c08 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

36d220e0244517475dfe10f437bf2226a28eca7378c4b8fafa914a01174776cc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Tue, 13 Feb 2024 14:23:04 GMT
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 753f415578c1ca010e51a83aef192330.cloudfront.net (CloudFront)
cf-cache-status: HIT
x-amz-version-id: iMGtZ12dDgxsJhlmM046vdcng70ZbGf_
age: 353
x-amz-cf-pop: FRA56-C2
cf-polished: status=not_needed
x-cache: Hit from cloudfront
content-length: 98080
last-modified: Tue, 11 Jul 2023 13:42:32 GMT
cf-bgj: imgq:85,h2pri
server: cloudflare
etag: "f73ac3e06cb6538eadd78182243a04b7-1"
vary: Accept-Encoding
content-type: image/png
cache-control: public, max-age=14400
accept-ranges: bytes
cf-ray: 854dba277bf95d85-FRA
x-amz-cf-id: PH0JfmhhDsU1kzHL8pwrvUtCkTW_8lgJNk8dTympKErZn_iJzuW_ow==
expires: Tue, 13 Feb 2024 18:23:04 GMT

GET
H2 200 Blog-Image-Priv-Esca-Demo2-1.png
www.crowdstrike.com/wp-content/uploads/2019/04/ 73 KB
74 KB 133ms
125ms Image
image/png 2606:4700::6810:1c08
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.crowdstrike.com/wp-content/uploads/2019/04/Blog-Image-Priv-Esca-Demo2-1.png

Requested by

Host: www.crowdstrike.com
URL: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:1c08 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e35507d68c9460b1bc5526d5a64fa382b04ea0c9da24b87a9bec7c6fd30bc55e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Tue, 13 Feb 2024 14:23:04 GMT
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 747e99d9d8c5e29fdc713cf866bc3f82.cloudfront.net (CloudFront)
cf-cache-status: HIT
x-amz-version-id: Iw15lE9OpS4V8Nkf7rEUZp2uHTTfTWMy
age: 353
x-amz-cf-pop: FRA56-C2
cf-polished: status=not_needed
x-cache: Hit from cloudfront
content-length: 75011
last-modified: Tue, 11 Jul 2023 13:42:33 GMT
cf-bgj: imgq:85,h2pri
server: cloudflare
etag: "0e7785cd57282d63d5e8212ec20d14ee-1"
vary: Accept-Encoding
content-type: image/png
cache-control: public, max-age=14400
accept-ranges: bytes
cf-ray: 854dba277bfb5d85-FRA
x-amz-cf-id: hlBJnqVwfwUoQLES6qyHSFSfUgEvyMmZHNy0NUY5lt_wKt7fOt6d2g==
expires: Tue, 13 Feb 2024 18:23:04 GMT

GET
H2 200 Blog-Image-Delivery-Demo2-1.png
www.crowdstrike.com/wp-content/uploads/2019/04/ 75 KB
75 KB 83ms
75ms Image
image/png 2606:4700::6810:1c08
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.crowdstrike.com/wp-content/uploads/2019/04/Blog-Image-Delivery-Demo2-1.png

Requested by

Host: www.crowdstrike.com
URL: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:1c08 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c572f7e6cda5feec58f66e79f96df91cfd83f6981d7d1f2958137b98ebf499cb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Tue, 13 Feb 2024 14:23:04 GMT
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 9928105291571d6cae52bcb916c898d8.cloudfront.net (CloudFront)
cf-cache-status: HIT
x-amz-version-id: gIsCw5sgE7fxh0dDhUuCzSEo7IP81XF8
age: 353
x-amz-cf-pop: FRA56-C2
cf-polished: status=not_needed
x-cache: Hit from cloudfront
content-length: 76455
last-modified: Thu, 20 Oct 2022 18:02:29 GMT
cf-bgj: imgq:85,h2pri
server: cloudflare
etag: "4e65fb1433a46d01ecf24e6e633cc562-1"
vary: Accept-Encoding
content-type: image/png
cache-control: public, max-age=14400
accept-ranges: bytes
cf-ray: 854dba277bfc5d85-FRA
x-amz-cf-id: LDttEuEVFxmhYNDdwUOZ001Wmtl1DhziVkVLMrHMHePQ0-sHPAkB-w==
expires: Tue, 13 Feb 2024 18:23:04 GMT

GET
H2 200 Blog_1060x698.jpeg
www.crowdstrike.com/wp-content/uploads/2022/08/ 213 KB
213 KB 107ms
99ms Image
image/jpeg 2606:4700::6810:1c08
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.crowdstrike.com/wp-content/uploads/2022/08/Blog_1060x698.jpeg

Requested by

Host: www.crowdstrike.com
URL: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:1c08 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

cdaf63a2f4551c164deec45146faa8281f515880edddbd807aa0820721bda6d0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Tue, 13 Feb 2024 14:23:04 GMT
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 d8670b0c6b76371fb58f730881dfe504.cloudfront.net (CloudFront)
cf-cache-status: HIT
x-amz-version-id: lf0sBNbKYCNNPUFt.hTq9IdY47Lwiypu
age: 353
x-amz-cf-pop: FRA56-C2
cf-polished: degrade=85, origSize=749613
x-cache: Hit from cloudfront
content-length: 217615
last-modified: Tue, 13 Feb 2024 14:03:35 GMT
cf-bgj: imgq:85,h2pri
server: cloudflare
etag: "1a52d46d3ea687362eb48a3416b136fc-1"
vary: Accept-Encoding
content-type: image/jpeg
cache-control: public, max-age=14400
accept-ranges: bytes
cf-ray: 854dba277bfd5d85-FRA
x-amz-cf-id: PW4Rf_cI5JWAETc0_qjAoItZ-fMqgK4s6D83i-l_xVdMVqK89r5nqg==
expires: Tue, 13 Feb 2024 18:23:04 GMT

GET
H2 200 1123_08_Insider-Vulnerabilities.jpg
www.crowdstrike.com/wp-content/uploads/2023/12/ 92 KB
92 KB 108ms
100ms Image
image/jpeg 2606:4700::6810:1c08
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.crowdstrike.com/wp-content/uploads/2023/12/1123_08_Insider-Vulnerabilities.jpg

Requested by

Host: www.crowdstrike.com
URL: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:1c08 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a6dee6c73c3fffab45a1d559044b3806b79ce98c1370945608a1121f3badea14

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Tue, 13 Feb 2024 14:23:04 GMT
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 8e83c42d247a31c5b365c08a0352d8f8.cloudfront.net (CloudFront)
cf-cache-status: HIT
x-amz-version-id: jBLzErEq5z3hV9ViOKohLKVYwphmywPT
age: 353
x-amz-cf-pop: FRA56-C2
cf-polished: degrade=85, origSize=422581
x-cache: Hit from cloudfront
content-length: 94294
last-modified: Mon, 11 Dec 2023 18:58:36 GMT
cf-bgj: imgq:85,h2pri
server: cloudflare
etag: "5452ae5075ab443d4f21a322abce5a5d-1"
vary: Accept-Encoding
content-type: image/jpeg
cache-control: public, max-age=14400
accept-ranges: bytes
cf-ray: 854dba277bff5d85-FRA
x-amz-cf-id: uMVzJeDtbFJAKDcaiDsgFPJgCKaLSaBXfYUUvnR-f8BzzjqOeGNPxw==
expires: Tue, 13 Feb 2024 18:23:04 GMT

GET
H2 200 1123_02_Holiday-Access-Brokers.jpg
www.crowdstrike.com/wp-content/uploads/2023/11/ 86 KB
86 KB 95ms
87ms Image
image/jpeg 2606:4700::6810:1c08
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.crowdstrike.com/wp-content/uploads/2023/11/1123_02_Holiday-Access-Brokers.jpg

Requested by

Host: www.crowdstrike.com
URL: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:1c08 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b97d4dfe2ec56762522f5fbb2fbffd2bdd339d52f235d169e57024f9b154af80

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Tue, 13 Feb 2024 14:23:04 GMT
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 9928105291571d6cae52bcb916c898d8.cloudfront.net (CloudFront)
cf-cache-status: HIT
x-amz-version-id: qkk.i2TFCFOEEchpVBak3B6PGYe6guEA
age: 353
x-amz-cf-pop: FRA56-C2
cf-polished: degrade=85, origSize=246608
x-cache: Hit from cloudfront
content-length: 87808
last-modified: Mon, 11 Dec 2023 18:58:40 GMT
cf-bgj: imgq:85,h2pri
server: cloudflare
etag: "522b3007cc274170e046299c39d0ca69-1"
vary: Accept-Encoding
content-type: image/jpeg
cache-control: public, max-age=14400
accept-ranges: bytes
cf-ray: 854dba277c005d85-FRA
x-amz-cf-id: XKqaNDUGsXlVsXv0cse4esv6RTppwz3zQKPudeLiCqdAYxb8p9uxSA==
expires: Tue, 13 Feb 2024 18:23:04 GMT

GET
H2 200 Falcon-X-Recon-featured-image-1.jpg
www.crowdstrike.com/wp-content/uploads/2023/06/ 280 KB
281 KB 108ms
101ms Image
image/jpeg 2606:4700::6810:1c08
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.crowdstrike.com/wp-content/uploads/2023/06/Falcon-X-Recon-featured-image-1.jpg

Requested by

Host: www.crowdstrike.com
URL: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:1c08 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c77b68e97c7c808e6662e4dda77dd798831e80a592f9e175c68314cd9b74d704

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Tue, 13 Feb 2024 14:23:04 GMT
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 bfa7dfbe8ca6d4eb3690c4c82ca6c0fa.cloudfront.net (CloudFront)
cf-cache-status: HIT
x-amz-version-id: FTBACt0omUfFwsjV_1BIjCcOjqDR_kGr
age: 353
x-amz-cf-pop: FRA56-C2
cf-polished: degrade=85, origSize=922540
x-cache: Hit from cloudfront
content-length: 286658
last-modified: Thu, 07 Dec 2023 15:00:23 GMT
cf-bgj: imgq:85,h2pri
server: cloudflare
etag: "5c526708a6ceb5e32f706df43adc4690-1"
vary: Accept-Encoding
content-type: image/jpeg
cache-control: public, max-age=14400
accept-ranges: bytes
cf-ray: 854dba277c025d85-FRA
x-amz-cf-id: u7UZeakGf4Sm8doHla6FU0tdElaYHZnstPmo3VqvNgfkxy2xuT-myg==
expires: Tue, 13 Feb 2024 18:23:04 GMT

GET
H2 200 Blog_1060x698-1-1.jpeg
www.crowdstrike.com/wp-content/uploads/2023/01/ 120 KB
121 KB 117ms
109ms Image
image/jpeg 2606:4700::6810:1c08
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.crowdstrike.com/wp-content/uploads/2023/01/Blog_1060x698-1-1.jpeg

Requested by

Host: www.crowdstrike.com
URL: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:1c08 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e9f39654eac26623ffbf7e6da9953393cd48b8b6e94d41b1a1cc28a6f4c005da

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Tue, 13 Feb 2024 14:23:04 GMT
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 941049c97e511f86acc1525badae21c2.cloudfront.net (CloudFront)
cf-cache-status: HIT
x-amz-version-id: zTRBNWCNVrP1GDJnJkgNQgNr2dHjzQQ2
age: 597
x-amz-cf-pop: AMS58-P1
cf-polished: degrade=85, origSize=476622
x-cache: Hit from cloudfront
content-length: 123274
last-modified: Tue, 13 Feb 2024 01:03:35 GMT
cf-bgj: imgq:85,h2pri
server: cloudflare
etag: "9d532cf07f5bac9c8f406446960d134f-1"
vary: Accept-Encoding
content-type: image/jpeg
cache-control: public, max-age=14400
accept-ranges: bytes
cf-ray: 854dba277c035d85-FRA
x-amz-cf-id: r6g2suWaOhke0VQDLwHrbcQwninry5i1QMs-yxdlvU4Ciye_PYBNsA==
expires: Tue, 13 Feb 2024 18:23:04 GMT

GET
H2 200 0123_09_SMB-Malware-Attacks_Blog_1060x698.jpeg
www.crowdstrike.com/wp-content/uploads/2023/01/ 132 KB
133 KB 90ms
82ms Image
image/jpeg 2606:4700::6810:1c08
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.crowdstrike.com/wp-content/uploads/2023/01/0123_09_SMB-Malware-Attacks_Blog_1060x698.jpeg

Requested by

Host: www.crowdstrike.com
URL: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:1c08 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

42e37144c07620e6e3e6ed4683aade1ee7f34ca821d95fc103b83af3070264ee

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Tue, 13 Feb 2024 14:23:04 GMT
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 b25bc331cb2e5e7e25d9488f5ecdc940.cloudfront.net (CloudFront)
cf-cache-status: HIT
x-amz-version-id: 0mmYwhTZcTTe1EsCg46BTEoDyW8X1N9_
age: 353
x-amz-cf-pop: FRA56-C2
cf-polished: degrade=85, origSize=429442
x-cache: Hit from cloudfront
content-length: 135640
last-modified: Wed, 07 Feb 2024 14:02:13 GMT
cf-bgj: imgq:85,h2pri
server: cloudflare
etag: "b57c670efb3cd686a1ab048b9519637e-1"
vary: Accept-Encoding
content-type: image/jpeg
cache-control: public, max-age=14400
accept-ranges: bytes
cf-ray: 854dba277c045d85-FRA
x-amz-cf-id: THidYEe1gVy3RuL6hraXZfpL0eJD-siujBaLXTFT9FRw4VIV9oKLcg==
expires: Tue, 13 Feb 2024 18:23:04 GMT

GET
H2 200 2310-cmp-pc-blog-multiple-posts-1060x698-final-illustration.jpg
www.crowdstrike.com/wp-content/uploads/2024/01/ 711 KB
712 KB 107ms
100ms Image
image/jpeg 2606:4700::6810:1c08
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.crowdstrike.com/wp-content/uploads/2024/01/2310-cmp-pc-blog-multiple-posts-1060x698-final-illustration.jpg

Requested by

Host: www.crowdstrike.com
URL: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:1c08 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

4ba704e4058d82ab5188b028627a2f284b36121fb9f2134d0fe7f2387f6c216f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Tue, 13 Feb 2024 14:23:04 GMT
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 753f415578c1ca010e51a83aef192330.cloudfront.net (CloudFront)
cf-cache-status: HIT
x-amz-version-id: GoIIErMJiO3Nxck4pBoRPvsugq0HojAS
age: 353
x-amz-cf-pop: FRA56-C2
cf-polished: degrade=85, origSize=1169460
x-cache: Hit from cloudfront
content-length: 728067
last-modified: Wed, 07 Feb 2024 14:02:14 GMT
cf-bgj: imgq:85,h2pri
server: cloudflare
etag: "64709cb3c862ccbada4b962bc7054025-1"
vary: Accept-Encoding
content-type: image/jpeg
cache-control: public, max-age=14400
accept-ranges: bytes
cf-ray: 854dba277c065d85-FRA
x-amz-cf-id: k6g4WcGN7Ewk1PJ81b22Y7B3XmeJwKDID_PYXX3wWOOP6a2SwN-Keg==
expires: Tue, 13 Feb 2024 18:23:04 GMT

GET
H2 200 0123_11_DLL-Sideloading_Advanced-Memory-Scanning_Blog_1060x698.jpeg
www.crowdstrike.com/wp-content/uploads/2023/02/ 187 KB
188 KB 127ms
119ms Image
image/jpeg 2606:4700::6810:1c08
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.crowdstrike.com/wp-content/uploads/2023/02/0123_11_DLL-Sideloading_Advanced-Memory-Scanning_Blog_1060x698.jpeg

Requested by

Host: www.crowdstrike.com
URL: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:1c08 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

3b461442bdf6f086af9023de4b6f909e8b21599229c8a8ba3ae4fc92a5c08a6a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Tue, 13 Feb 2024 14:23:04 GMT
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 103eb504d36d97c9f30550032223d996.cloudfront.net (CloudFront)
cf-cache-status: HIT
x-amz-version-id: H9IBDiR_rob9XvIdUGb1UZiFmQklUfTu
age: 353
x-amz-cf-pop: FRA56-C2
cf-polished: degrade=85, origSize=617363
x-cache: Hit from cloudfront
content-length: 191687
last-modified: Fri, 22 Dec 2023 13:47:38 GMT
cf-bgj: imgq:85,h2pri
server: cloudflare
etag: "d25e598fe985128b0022a38d18ffc021-1"
vary: Accept-Encoding
content-type: image/jpeg
cache-control: public, max-age=14400
accept-ranges: bytes
cf-ray: 854dba277c075d85-FRA
x-amz-cf-id: lfbf8tlXclFP9qCUK5NE3IRfMgLTGVE3dRM7lUHBefrCSXq0NjdVGQ==
expires: Tue, 13 Feb 2024 18:23:04 GMT

GET
H2 200 mapping-it-out-1.jpg
www.crowdstrike.com/wp-content/uploads/2021/02/ 109 KB
110 KB 112ms
104ms Image
image/jpeg 2606:4700::6810:1c08
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.crowdstrike.com/wp-content/uploads/2021/02/mapping-it-out-1.jpg

Requested by

Host: www.crowdstrike.com
URL: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:1c08 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

057cf64e13a70d98b7ad8f18487273135e4bb1f5083088f3f58bdf345c197620

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Tue, 13 Feb 2024 14:23:04 GMT
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 3298c44116035984c2fac24b89183c4e.cloudfront.net (CloudFront)
cf-cache-status: HIT
x-amz-version-id: .CgaE_tL6ZMMM4tC6TEeDC.E.8Y_8dCG
age: 353
x-amz-cf-pop: FRA56-C2
cf-polished: degrade=85, origSize=321647
x-cache: Hit from cloudfront
content-length: 111753
last-modified: Wed, 27 Sep 2023 16:56:25 GMT
cf-bgj: imgq:85,h2pri
server: cloudflare
etag: "a1c9f1bfd248a5bf73316d1c50cf3cfe-1"
vary: Accept-Encoding
content-type: image/jpeg
cache-control: public, max-age=14400
accept-ranges: bytes
cf-ray: 854dba277c085d85-FRA
x-amz-cf-id: cN2wLnY8kCXdFdwmOpwxR-SyngNOvha6XYN0Q-wQj1VFjqHRVlN-mw==
expires: Tue, 13 Feb 2024 18:23:04 GMT

GET
H2 200 23-SRV-013_Forrester-Wave_MDR_2023_Blog_1060x698_V1.jpg
www.crowdstrike.com/wp-content/uploads/2023/05/ 52 KB
53 KB 121ms
114ms Image
image/jpeg 2606:4700::6810:1c08
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.crowdstrike.com/wp-content/uploads/2023/05/23-SRV-013_Forrester-Wave_MDR_2023_Blog_1060x698_V1.jpg

Requested by

Host: www.crowdstrike.com
URL: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:1c08 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

62fd61035104aaa35fe90d9fe8cb52aa5bff1c8685b5825862b3a75bc89a5470

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Tue, 13 Feb 2024 14:23:04 GMT
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 ef4ff53b101ef123a46ec560b6c94cb8.cloudfront.net (CloudFront)
cf-cache-status: HIT
x-amz-version-id: JDWUwS2gzgeux.4WWLn9RwQSqXh_Znxv
age: 353
x-amz-cf-pop: FRA56-C2
cf-polished: degrade=85, origSize=159117
x-cache: Hit from cloudfront
content-length: 53445
last-modified: Tue, 30 Jan 2024 17:33:49 GMT
cf-bgj: imgq:85,h2pri
server: cloudflare
etag: "eab16fd8ba31c8b16cf6d42c7972d73c-1"
vary: Accept-Encoding
content-type: image/jpeg
cache-control: public, max-age=14400
accept-ranges: bytes
cf-ray: 854dba277c0a5d85-FRA
x-amz-cf-id: 7_YRiJNggcgSuuew2vVAWFSUmGG-eYyTdmXRJIAwEtTspFCwYFcCig==
expires: Tue, 13 Feb 2024 18:23:04 GMT

GET
H2 200 1123_05_Ai-Powered-Protection-for-SMB_V2.jpg
www.crowdstrike.com/wp-content/uploads/2023/11/ 47 KB
47 KB 107ms
101ms Image
image/jpeg 2606:4700::6810:1c08
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.crowdstrike.com/wp-content/uploads/2023/11/1123_05_Ai-Powered-Protection-for-SMB_V2.jpg

Requested by

Host: www.crowdstrike.com
URL: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:1c08 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

28813c38fd69327ee77259a3017f49ac8d57a6f53cb5533ae26a0f7292c3c711

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Tue, 13 Feb 2024 14:23:04 GMT
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 0a4e8f7c3d348e526848328c55dd452a.cloudfront.net (CloudFront)
cf-cache-status: HIT
x-amz-version-id: 3TI_eW4xaLrluUgJmLCoWOPvHyRCdWPO
age: 353
x-amz-cf-pop: FRA56-C2
cf-polished: degrade=85, origSize=159534
x-cache: Hit from cloudfront
content-length: 47622
last-modified: Tue, 19 Dec 2023 18:53:18 GMT
cf-bgj: imgq:85,h2pri
server: cloudflare
etag: "eb9b07b6785cf87e2d3b419c7ea9cfb2-1"
vary: Accept-Encoding
content-type: image/jpeg
cache-control: public, max-age=14400
accept-ranges: bytes
cf-ray: 854dba277c0c5d85-FRA
x-amz-cf-id: a_sXXeFRl1jNlRaKL5JT7c7ST01WsnqpwB9xlL5JpfFnF3Q6RcRHew==
expires: Tue, 13 Feb 2024 18:23:04 GMT

GET
H2 200 0222_03_Falcon_Platform_Blog_1060x698.jpeg
www.crowdstrike.com/wp-content/uploads/2022/02/ 23 KB
23 KB 146ms
140ms Image
image/jpeg 2606:4700::6810:1c08
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.crowdstrike.com/wp-content/uploads/2022/02/0222_03_Falcon_Platform_Blog_1060x698.jpeg

Requested by

Host: www.crowdstrike.com
URL: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:1c08 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

4909664b2cd227fc85ce6fd9d530ec41bef8528f31af916ba9ed95a2cb230823

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Tue, 13 Feb 2024 14:23:04 GMT
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 34435958fa6d40b77fd22fa1c1f56176.cloudfront.net (CloudFront)
cf-cache-status: HIT
x-amz-version-id: BuyDn8LYLIzsd5R7PgDHFslEwlg4Cc0T
age: 353
x-amz-cf-pop: FRA56-C2
cf-polished: degrade=85, origSize=96931
x-cache: Hit from cloudfront
content-length: 23201
last-modified: Tue, 13 Feb 2024 01:03:34 GMT
cf-bgj: imgq:85,h2pri
server: cloudflare
etag: "a8826c5d8fe6f92d156adfc33de6387d-1"
vary: Accept-Encoding
content-type: image/jpeg
cache-control: public, max-age=14400
accept-ranges: bytes
cf-ray: 854dba27bc435d85-FRA
x-amz-cf-id: 5FGPxrygNGy-Tcy4FS5ekMfzTn1IVAdtOPn3Dcv1wd4M7ikRA9_kMA==
expires: Tue, 13 Feb 2024 18:23:04 GMT

GET
H2 200 MITRE-100_Blog_01.jpg
www.crowdstrike.com/wp-content/uploads/2023/09/ 62 KB
62 KB 132ms
126ms Image
image/jpeg 2606:4700::6810:1c08
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.crowdstrike.com/wp-content/uploads/2023/09/MITRE-100_Blog_01.jpg

Requested by

Host: www.crowdstrike.com
URL: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:1c08 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

479a42c03c6ff55c0993365193e76f8bafaf7d48b53929dead68e5837950a104

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Tue, 13 Feb 2024 14:23:04 GMT
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 95adda0bdbd310a1a9e4f54f540543e2.cloudfront.net (CloudFront)
cf-cache-status: HIT
x-amz-version-id: eRGQ1zCG.djYMy8brKCqBKd91CSG86z_
age: 353
x-amz-cf-pop: FRA56-C2
cf-polished: degrade=85, origSize=174240
x-cache: Hit from cloudfront
content-length: 63443
last-modified: Tue, 19 Dec 2023 18:53:19 GMT
cf-bgj: imgq:85,h2pri
server: cloudflare
etag: "ba0d6c92f4ed0c1cb51e7338becfd2d8-1"
vary: Accept-Encoding
content-type: image/jpeg
cache-control: public, max-age=14400
accept-ranges: bytes
cf-ray: 854dba27bc445d85-FRA
x-amz-cf-id: 2PaUX9hh2tSR-cwKBgZ9kwIPd6acVbQM-dBMF2gUFhvrMenmN_q__Q==
expires: Tue, 13 Feb 2024 18:23:04 GMT

GET
H2 200 0122_03_IR_Tracker_for_DFIR_Community.jpg
www.crowdstrike.com/wp-content/uploads/2023/10/ 262 KB
263 KB 132ms
126ms Image
image/jpeg 2606:4700::6810:1c08
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.crowdstrike.com/wp-content/uploads/2023/10/0122_03_IR_Tracker_for_DFIR_Community.jpg

Requested by

Host: www.crowdstrike.com
URL: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:1c08 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

fa242f524a71571952cc44ed52cca22fae9718a281a24a8bd9029b959fbf1261

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Tue, 13 Feb 2024 14:23:04 GMT
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 cb1bcb02f5d0667fafd0890701965f18.cloudfront.net (CloudFront)
cf-cache-status: HIT
x-amz-version-id: 2Ph.jVoD2ezTBZswm6ylfbQsqYcVf28I
age: 353
x-amz-cf-pop: FRA56-C2
cf-polished: degrade=85, origSize=861794
x-cache: Hit from cloudfront
content-length: 268270
last-modified: Mon, 23 Oct 2023 17:08:44 GMT
cf-bgj: imgq:85,h2pri
server: cloudflare
etag: "41c46e95502aedc2aac95128cacc4ebd-1"
vary: Accept-Encoding
content-type: image/jpeg
cache-control: public, max-age=14400
accept-ranges: bytes
cf-ray: 854dba27bc465d85-FRA
x-amz-cf-id: TT6BqWJnrqf4HdUBm0ziVaC2wJUl2hCpZ-w131fMbydoIc28z6FVtw==
expires: Tue, 13 Feb 2024 18:23:04 GMT

GET
H2 200 23-OTH-060_adversary-5-panda-china.png
www.crowdstrike.com/wp-content/uploads/2023/06/ 410 KB
411 KB 157ms
151ms Image
image/png 2606:4700::6810:1c08
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.crowdstrike.com/wp-content/uploads/2023/06/23-OTH-060_adversary-5-panda-china.png

Requested by

Host: www.crowdstrike.com
URL: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:1c08 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

4f6f07e26ae7e95df3b138d21eb6ef322beda975eddf7d5dd88156c48004e6c3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Tue, 13 Feb 2024 14:23:04 GMT
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 9928105291571d6cae52bcb916c898d8.cloudfront.net (CloudFront)
cf-cache-status: HIT
x-amz-version-id: oE9Vv.QwYze6FBfTxF_8TcJP1utBndol
age: 353
x-amz-cf-pop: FRA56-C2
cf-polished: origSize=429520
x-cache: Hit from cloudfront
content-length: 420334
last-modified: Mon, 23 Oct 2023 17:08:56 GMT
cf-bgj: imgq:85,h2pri
server: cloudflare
etag: "595d23ef3dcb777f3f92bd3dc5ceb7f6-1"
vary: Accept-Encoding
content-type: image/png
cache-control: public, max-age=14400
accept-ranges: bytes
cf-ray: 854dba27bc4b5d85-FRA
x-amz-cf-id: A07EyE5gqAUkK1wWqeiKu1VjlYqwdGm6NMjtpdEjZDf3oOBZWwXHQw==
expires: Tue, 13 Feb 2024 18:23:04 GMT

GET
H2 200 Blog_1060x698-8.jpeg
www.crowdstrike.com/wp-content/uploads/2022/01/ 204 KB
204 KB 131ms
125ms Image
image/jpeg 2606:4700::6810:1c08
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.crowdstrike.com/wp-content/uploads/2022/01/Blog_1060x698-8.jpeg

Requested by

Host: www.crowdstrike.com
URL: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:1c08 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d248cadd7c9d133a66cd2126b103fba268494b449dc54f486225e400a0453478

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Tue, 13 Feb 2024 14:23:04 GMT
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 50ef760066390594318a8cc54c245fd2.cloudfront.net (CloudFront)
cf-cache-status: HIT
x-amz-version-id: SghvZdRuBPx1gDsIbbkMUG25USLqdyPG
age: 353
x-amz-cf-pop: LHR61-P2
cf-polished: degrade=85, origSize=563870
x-cache: Hit from cloudfront
content-length: 208396
last-modified: Mon, 23 Oct 2023 17:08:59 GMT
cf-bgj: imgq:85,h2pri
server: cloudflare
etag: "b805ca115d732c3d04ec3c6240312f93-1"
vary: Accept-Encoding
content-type: image/jpeg
cache-control: public, max-age=14400
accept-ranges: bytes
cf-ray: 854dba27bc4d5d85-FRA
x-amz-cf-id: BYcsrQKdJajVPp5PoamOx1HzOiEVVeswdRJlr2a3_TrK870pHPmZbw==
expires: Tue, 13 Feb 2024 18:23:04 GMT

GET
H2 200 0523_01_APAC-Cross-Boarder-Transfer-Systems_03.jpg
www.crowdstrike.com/wp-content/uploads/2023/05/ 90 KB
90 KB 141ms
136ms Image
image/jpeg 2606:4700::6810:1c08
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.crowdstrike.com/wp-content/uploads/2023/05/0523_01_APAC-Cross-Boarder-Transfer-Systems_03.jpg

Requested by

Host: www.crowdstrike.com
URL: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:1c08 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

04727f699b52a1d71fb08c642b35b5352b4df1d961f1e06a84ade494c73c08b0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Tue, 13 Feb 2024 14:23:04 GMT
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 aff6ac5c98fa897349204752e5877c80.cloudfront.net (CloudFront)
cf-cache-status: HIT
x-amz-version-id: jj7EgGyMgKNfHrMjoz0nIhhwY7GO0W3e
age: 353
x-amz-cf-pop: FRA56-C2
cf-polished: degrade=85, origSize=359254
x-cache: Hit from cloudfront
content-length: 92030
last-modified: Mon, 23 Oct 2023 17:09:02 GMT
cf-bgj: imgq:85,h2pri
server: cloudflare
etag: "9f2548af0c4b0574886c5902cee76461-1"
vary: Accept-Encoding
content-type: image/jpeg
cache-control: public, max-age=14400
accept-ranges: bytes
cf-ray: 854dba27bc4f5d85-FRA
x-amz-cf-id: nkoGMTXKJ6MMoh66HGS_geqc_u_fkKPGRc9HDg-nZRi_zC4EKSJnyQ==
expires: Tue, 13 Feb 2024 18:23:04 GMT

GET
H2 200 0124_02_FalconFund-Partners-with-Aembit.jpg
www.crowdstrike.com/wp-content/uploads/2024/01/ 86 KB
86 KB 145ms
139ms Image
image/jpeg 2606:4700::6810:1c08
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.crowdstrike.com/wp-content/uploads/2024/01/0124_02_FalconFund-Partners-with-Aembit.jpg

Requested by

Host: www.crowdstrike.com
URL: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:1c08 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

15b5c8f3f652691450c66ccf98499876ec9bbeff6809dceeccdfb73acc72cf8c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Tue, 13 Feb 2024 14:23:04 GMT
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 2f776eb8784339c430e14ec7520b4944.cloudfront.net (CloudFront)
cf-cache-status: HIT
x-amz-version-id: y28dXpkUGGJuDqiqs6_XA0dGAuH6TboP
age: 353
x-amz-cf-pop: LHR61-P2
cf-polished: degrade=85, origSize=312984
x-cache: Hit from cloudfront
content-length: 87779
last-modified: Tue, 30 Jan 2024 20:16:12 GMT
cf-bgj: imgq:85,h2pri
server: cloudflare
etag: "bd69a0dca2f45f29886e3de77637556f-1"
vary: Accept-Encoding
content-type: image/jpeg
cache-control: public, max-age=14400
accept-ranges: bytes
cf-ray: 854dba27bc525d85-FRA
x-amz-cf-id: YdOnpAQm1ByCGDWN55zMI7TPybfotCgaC2PlObNj1dBLR7melB03sQ==
expires: Tue, 13 Feb 2024 18:23:04 GMT

GET
H2 200 0222_05_FalconFusion_Ransomware_Malware.jpg
www.crowdstrike.com/wp-content/uploads/2023/12/ 201 KB
202 KB 137ms
132ms Image
image/jpeg 2606:4700::6810:1c08
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.crowdstrike.com/wp-content/uploads/2023/12/0222_05_FalconFusion_Ransomware_Malware.jpg

Requested by

Host: www.crowdstrike.com
URL: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:1c08 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

912aa1e8380e28a95269a2997c3ddf4ec6ceed1f90df5487ada201c88f96536d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Tue, 13 Feb 2024 14:23:04 GMT
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 0d4b487d54766de7560aa02de852bbf8.cloudfront.net (CloudFront)
cf-cache-status: HIT
x-amz-version-id: X6vkPle0PXDqsTuV77PpEF8HpqzZAQTz
age: 353
x-amz-cf-pop: FRA56-C2
cf-polished: degrade=85, origSize=659573
x-cache: Hit from cloudfront
content-length: 205713
last-modified: Tue, 30 Jan 2024 20:16:19 GMT
cf-bgj: imgq:85,h2pri
server: cloudflare
etag: "f17e5c56bc8a786d7dba31c15c3ac698-1"
vary: Accept-Encoding
content-type: image/jpeg
cache-control: public, max-age=14400
accept-ranges: bytes
cf-ray: 854dba27bc535d85-FRA
x-amz-cf-id: 3VG7O1NvB8mD0XEwOHgfqAW81gfZFoYPkEC-iGUjuCw2oTsmZZcH6w==
expires: Tue, 13 Feb 2024 18:23:04 GMT

GET
H2 200 0322_02_Reinventing_MDRIDP_Blog_1060x698.jpeg
www.crowdstrike.com/wp-content/uploads/2023/03/ 74 KB
75 KB 140ms
136ms Image
image/jpeg 2606:4700::6810:1c08
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.crowdstrike.com/wp-content/uploads/2023/03/0322_02_Reinventing_MDRIDP_Blog_1060x698.jpeg

Requested by

Host: www.crowdstrike.com
URL: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:1c08 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b25d2319903d6e206b3bd9a7340206ec7d6b603405403130d95a6ffca76a80db

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Tue, 13 Feb 2024 14:23:04 GMT
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 bfa7dfbe8ca6d4eb3690c4c82ca6c0fa.cloudfront.net (CloudFront)
cf-cache-status: HIT
x-amz-version-id: KATgKbpiCWf46vvFm48yML0H9vGvgvI3
age: 353
x-amz-cf-pop: FRA56-C2
cf-polished: degrade=85, origSize=297157
x-cache: Hit from cloudfront
content-length: 76202
last-modified: Wed, 07 Feb 2024 22:03:42 GMT
cf-bgj: imgq:85,h2pri
server: cloudflare
etag: "5b883786664d9e0c17f1d61bef867c0f-1"
vary: Accept-Encoding
content-type: image/jpeg
cache-control: public, max-age=14400
accept-ranges: bytes
cf-ray: 854dba27bc555d85-FRA
x-amz-cf-id: o_tVXC7H3_QZMUroASRIJmuotpCspkrjHbPTi46NDkiIQjXRDIM0ww==
expires: Tue, 13 Feb 2024 18:23:04 GMT

GET
H2 200 Blog_1060x698-3.jpeg
www.crowdstrike.com/wp-content/uploads/2022/12/ 193 KB
194 KB 130ms
125ms Image
image/jpeg 2606:4700::6810:1c08
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.crowdstrike.com/wp-content/uploads/2022/12/Blog_1060x698-3.jpeg

Requested by

Host: www.crowdstrike.com
URL: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:1c08 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b753594ff7e815b6bef74092861f26eb873ce93687e6f5f6253214b63da67ede

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Tue, 13 Feb 2024 14:23:04 GMT
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 cbacf5aa8c3f4eb54c61c0a348347df4.cloudfront.net (CloudFront)
cf-cache-status: HIT
x-amz-version-id: CjnErwVT_WT7Ylg5h.LSFnxTukeS44Kh
age: 353
x-amz-cf-pop: LHR61-P2
cf-polished: degrade=85, origSize=604748
x-cache: Hit from cloudfront
content-length: 197885
last-modified: Tue, 30 Jan 2024 21:51:50 GMT
cf-bgj: imgq:85,h2pri
server: cloudflare
etag: "42320077f55efadcbcfcbc46e7069e62-1"
vary: Accept-Encoding
content-type: image/jpeg
cache-control: public, max-age=14400
accept-ranges: bytes
cf-ray: 854dba27bc575d85-FRA
x-amz-cf-id: 6PxzuKoOnvi3xVB_O-AE5REik7L2WN5K5R77GDZYW3a2WKEH6zyvXQ==
expires: Tue, 13 Feb 2024 18:23:04 GMT

GET
H2 200 XXXX_Falcon-LogScale-So-Fast_Blog_1060x698.jpeg
www.crowdstrike.com/wp-content/uploads/2022/11/ 265 KB
265 KB 168ms
163ms Image
image/jpeg 2606:4700::6810:1c08
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.crowdstrike.com/wp-content/uploads/2022/11/XXXX_Falcon-LogScale-So-Fast_Blog_1060x698.jpeg

Requested by

Host: www.crowdstrike.com
URL: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:1c08 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0f5a20aea350274cc88cc79a153797c6b253aec6a77259467378f0ca2dc29203

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Tue, 13 Feb 2024 14:23:04 GMT
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 a7631312afe99e40229aa0da70662112.cloudfront.net (CloudFront)
cf-cache-status: HIT
x-amz-version-id: H4nQ_I1WP3N.O_fn0il7DRYGVimknpUi
age: 353
x-amz-cf-pop: FRA56-C2
cf-polished: degrade=85, origSize=810899
x-cache: Hit from cloudfront
content-length: 270962
last-modified: Tue, 13 Feb 2024 01:03:36 GMT
cf-bgj: imgq:85,h2pri
server: cloudflare
etag: "566134bd7bd51455c57a56f0e2931258-1"
vary: Accept-Encoding
content-type: image/jpeg
cache-control: public, max-age=14400
accept-ranges: bytes
cf-ray: 854dba27bc595d85-FRA
x-amz-cf-id: rJ-zOQKaS1GN7kpwASRYAT-OKnMR9EbcK5Jf31CCVEy5-v9yafF57A==
expires: Tue, 13 Feb 2024 18:23:04 GMT

GET
H2 200 Blog_1060x698-2.jpeg
www.crowdstrike.com/wp-content/uploads/2021/10/ 216 KB
216 KB 137ms
133ms Image
image/jpeg 2606:4700::6810:1c08
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.crowdstrike.com/wp-content/uploads/2021/10/Blog_1060x698-2.jpeg

Requested by

Host: www.crowdstrike.com
URL: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:1c08 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

1c36239bcd80f237805e530e80214ecc5b43821a943bb7aa744bfbaa87c4415f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Tue, 13 Feb 2024 14:23:04 GMT
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 c1e2423613b2dcb4230386a2b285734e.cloudfront.net (CloudFront)
cf-cache-status: HIT
x-amz-version-id: 1glZo5VR4lM1wVs4D4s7EXdJVW3hIL7R
age: 353
x-amz-cf-pop: FRA56-C2
cf-polished: degrade=85, origSize=664953
x-cache: Hit from cloudfront
content-length: 221139
last-modified: Thu, 18 Jan 2024 18:25:32 GMT
cf-bgj: imgq:85,h2pri
server: cloudflare
etag: "1789900ad04733812ed89f0015539646-1"
vary: Accept-Encoding
content-type: image/jpeg
cache-control: public, max-age=14400
accept-ranges: bytes
cf-ray: 854dba27bc5b5d85-FRA
x-amz-cf-id: qI4Bvmu13-DD-JftWiJ8n7BD5q_Pznpm8ndNcvzs9ScRO919ExiA2g==
expires: Tue, 13 Feb 2024 18:23:04 GMT

GET
H2 200 0923_03_LogScale_ThreatHunting_Chrome.jpg
www.crowdstrike.com/wp-content/uploads/2023/09/ 19 KB
20 KB 187ms
183ms Image
image/jpeg 2606:4700::6810:1c08
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.crowdstrike.com/wp-content/uploads/2023/09/0923_03_LogScale_ThreatHunting_Chrome.jpg

Requested by

Host: www.crowdstrike.com
URL: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:1c08 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ebe53644b0b082753243929e09b9e652a9e7051b3cf971e1a018104382778771

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Tue, 13 Feb 2024 14:23:05 GMT
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 0d4b487d54766de7560aa02de852bbf8.cloudfront.net (CloudFront)
cf-cache-status: HIT
x-amz-version-id: X8_yRKwmUWGKleg.49Gd8XIAMZfKXURq
age: 353
x-amz-cf-pop: FRA56-C2
cf-polished: degrade=85, origSize=60252
x-cache: Hit from cloudfront
content-length: 19780
last-modified: Thu, 18 Jan 2024 18:25:33 GMT
cf-bgj: imgq:85,h2pri
server: cloudflare
etag: "9d5ae4b58ca017e7ad5eeb82058fd20e-1"
vary: Accept-Encoding
content-type: image/jpeg
cache-control: public, max-age=14400
accept-ranges: bytes
cf-ray: 854dba27bc5d5d85-FRA
x-amz-cf-id: Z2fFEy1XMxEd3Ye6dIeu-2aq2nDUeJAJICrLV_B8CXWwmybMcVlvFg==
expires: Tue, 13 Feb 2024 18:23:04 GMT

GET
H2 200 0223_01_Audits-Centralized-Log-Mgmt_Blog_1060x698.jpg
www.crowdstrike.com/wp-content/uploads/2023/02/ 204 KB
204 KB 123ms
119ms Image
image/jpeg 2606:4700::6810:1c08
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.crowdstrike.com/wp-content/uploads/2023/02/0223_01_Audits-Centralized-Log-Mgmt_Blog_1060x698.jpg

Requested by

Host: www.crowdstrike.com
URL: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:1c08 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0d616ec0b06b0da8f53e9f291e1873edca40739f641c7499525040750072b0b1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Tue, 13 Feb 2024 14:23:04 GMT
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 34435958fa6d40b77fd22fa1c1f56176.cloudfront.net (CloudFront)
cf-cache-status: HIT
x-amz-version-id: HAeuB4VjcKI4lhgZAVpl9RidJf0lcyoX
age: 353
x-amz-cf-pop: FRA56-C2
cf-polished: degrade=85, origSize=669828
x-cache: Hit from cloudfront
content-length: 208419
last-modified: Thu, 18 Jan 2024 18:25:34 GMT
cf-bgj: imgq:85,h2pri
server: cloudflare
etag: "9d717ae48ec87b8cd6569613c6e3b3a0-1"
vary: Accept-Encoding
content-type: image/jpeg
cache-control: public, max-age=14400
accept-ranges: bytes
cf-ray: 854dba27cc625d85-FRA
x-amz-cf-id: BYx3Ley446uChNj9pmnNcQ7pM5U10GJal5RrtRITv1HB6Q6PwojQSA==
expires: Tue, 13 Feb 2024 18:23:04 GMT

GET
H2 200 mentorships-1.jpg
www.crowdstrike.com/wp-content/uploads/2021/03/ 242 KB
243 KB 144ms
140ms Image
image/jpeg 2606:4700::6810:1c08
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.crowdstrike.com/wp-content/uploads/2021/03/mentorships-1.jpg

Requested by

Host: www.crowdstrike.com
URL: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:1c08 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b527f88908eeebbb1870931f8d3c110e7678486424d50343667336a335f33e28

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Tue, 13 Feb 2024 14:23:04 GMT
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 bfa7dfbe8ca6d4eb3690c4c82ca6c0fa.cloudfront.net (CloudFront)
cf-cache-status: HIT
x-amz-version-id: PRN3t3ti5_uBio4uj8avo3RK8hccbWNR
age: 353
x-amz-cf-pop: FRA56-C2
cf-polished: degrade=85, origSize=958952
x-cache: Hit from cloudfront
content-length: 247770
last-modified: Tue, 06 Jun 2023 21:09:35 GMT
cf-bgj: imgq:85,h2pri
server: cloudflare
etag: "e881929de4def2a5579a84a9e4f944ed-1"
vary: Accept-Encoding
content-type: image/jpeg
cache-control: public, max-age=14400
accept-ranges: bytes
cf-ray: 854dba27cc655d85-FRA
x-amz-cf-id: TanBhl2GK969uMjh8rwgnPm5HNQKh6ohH0VmCE1ERJcooy3-r6bu2A==
expires: Tue, 13 Feb 2024 18:23:04 GMT

GET
H2 200 Blog_FB_1200x630-1.jpg
www.crowdstrike.com/wp-content/uploads/2020/10/ 33 KB
33 KB 130ms
126ms Image
image/jpeg 2606:4700::6810:1c08
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.crowdstrike.com/wp-content/uploads/2020/10/Blog_FB_1200x630-1.jpg

Requested by

Host: www.crowdstrike.com
URL: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:1c08 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

205dcb7bbc168099a95944b3670fcaec5407412da2d2f6e129ea3faec0731ee1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Tue, 13 Feb 2024 14:23:04 GMT
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 08b9c2fd11813ffdb8fa03129d0a465c.cloudfront.net (CloudFront)
cf-cache-status: HIT
x-amz-version-id: VyqPNgo5HN007h6kSHWDDopZgBnP6ecg
age: 353
x-amz-cf-pop: FRA56-C2
cf-polished: degrade=85, origSize=83414
x-cache: Hit from cloudfront
content-length: 33765
last-modified: Tue, 06 Jun 2023 21:09:40 GMT
cf-bgj: imgq:85,h2pri
server: cloudflare
etag: "b1757e1dec848cde3ad547969daac9ae-1"
vary: Accept-Encoding
content-type: image/jpeg
cache-control: public, max-age=14400
accept-ranges: bytes
cf-ray: 854dba27cc665d85-FRA
x-amz-cf-id: reTJczuRKx1Yue3rGqNsN4TXkemY4HgalWGHZ9U2XDOLGRcMMH5lPw==
expires: Tue, 13 Feb 2024 18:23:04 GMT

GET
H2 200 womens-history-month-1.jpg
www.crowdstrike.com/wp-content/uploads/2021/03/ 209 KB
209 KB 171ms
167ms Image
image/jpeg 2606:4700::6810:1c08
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.crowdstrike.com/wp-content/uploads/2021/03/womens-history-month-1.jpg

Requested by

Host: www.crowdstrike.com
URL: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:1c08 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7f094e6666e540aaa55a90812a019ea5ea34bd173ad2dc8ed1b4538b53fd68b3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Tue, 13 Feb 2024 14:23:04 GMT
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 756f5290bceb9f9b2ec963e0ab326968.cloudfront.net (CloudFront)
cf-cache-status: HIT
x-amz-version-id: 14WVF2.OwbOH7EGNQhXNQWcZSxgHzaRv
age: 353
x-amz-cf-pop: FRA56-C2
cf-polished: degrade=85, origSize=736516
x-cache: Hit from cloudfront
content-length: 213646
last-modified: Tue, 06 Jun 2023 21:09:40 GMT
cf-bgj: imgq:85,h2pri
server: cloudflare
etag: "b949171b18f4ba9e01b5204bdfd486ec-1"
vary: Accept-Encoding
content-type: image/jpeg
cache-control: public, max-age=14400
accept-ranges: bytes
cf-ray: 854dba27cc685d85-FRA
x-amz-cf-id: 4l73KuVLotJmW3u6nuY34XsB9XIP6SBG4L2prVV7JuSNHMdfhSGPrQ==
expires: Tue, 13 Feb 2024 18:23:04 GMT

GET
H2 200 0123_03_MLK-Day-2023_Blog_1060x698_V1.jpg
www.crowdstrike.com/wp-content/uploads/2023/01/ 62 KB
63 KB 136ms
133ms Image
image/jpeg 2606:4700::6810:1c08
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.crowdstrike.com/wp-content/uploads/2023/01/0123_03_MLK-Day-2023_Blog_1060x698_V1.jpg

Requested by

Host: www.crowdstrike.com
URL: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:1c08 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6925696138e919bcfc54d241d2e51017d3383293ea4cf5bd0b7b3932ada195ea

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Tue, 13 Feb 2024 14:23:04 GMT
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 0363fab377de19b9b4f85394469f6fca.cloudfront.net (CloudFront)
cf-cache-status: HIT
x-amz-version-id: HfWvl5qeksh_QrIwbWyKt1oRM8SQYUy7
age: 353
x-amz-cf-pop: FRA56-C2
cf-polished: degrade=85, origSize=228171
x-cache: Hit from cloudfront
content-length: 63908
last-modified: Tue, 06 Jun 2023 21:09:41 GMT
cf-bgj: imgq:85,h2pri
server: cloudflare
etag: "e00038a2fed4ae2e3bd05f8799efccd3-1"
vary: Accept-Encoding
content-type: image/jpeg
cache-control: public, max-age=14400
accept-ranges: bytes
cf-ray: 854dba27cc6a5d85-FRA
x-amz-cf-id: jLpkrbrDiSOKsD4_Blvf5lvnBQVotRm9FppKVNBCcue3VM-mcZnMQA==
expires: Tue, 13 Feb 2024 18:23:04 GMT

GET
H2 200 Blog-1.jpeg
www.crowdstrike.com/wp-content/uploads/2021/12/ 27 KB
27 KB 142ms
139ms Image
image/jpeg 2606:4700::6810:1c08
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.crowdstrike.com/wp-content/uploads/2021/12/Blog-1.jpeg

Requested by

Host: www.crowdstrike.com
URL: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:1c08 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ed6c1ed511a6160b35044d7c49e35e9b85da14be0164b3c40d5aa23c8ab027b0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Tue, 13 Feb 2024 14:23:04 GMT
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 f891d17fa862cc74a05434e03fa58dca.cloudfront.net (CloudFront)
cf-cache-status: HIT
x-amz-version-id: _N14FJByGO7nrqMqmVysNFhK.hYE7BVW
age: 353
x-amz-cf-pop: FRA56-C2
cf-polished: degrade=85, origSize=100740
x-cache: Hit from cloudfront
content-length: 27622
last-modified: Thu, 29 Sep 2022 17:10:49 GMT
cf-bgj: imgq:85,h2pri
server: cloudflare
etag: "2d26935459e4c57e3485d38f612d2aa3-1"
vary: Accept-Encoding
content-type: image/jpeg
cache-control: public, max-age=14400
accept-ranges: bytes
cf-ray: 854dba27cc6c5d85-FRA
x-amz-cf-id: CrMqUhU0fdGLICQBkg03axpWwpstQyXW_0iZh17vhxYVTOT0ZDi4AA==
expires: Tue, 13 Feb 2024 18:23:04 GMT

GET
H2 200 CS_EY_Blog_1060x698_v2-1.jpeg
www.crowdstrike.com/wp-content/uploads/2021/05/ 85 KB
86 KB 149ms
147ms Image
image/jpeg 2606:4700::6810:1c08
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.crowdstrike.com/wp-content/uploads/2021/05/CS_EY_Blog_1060x698_v2-1.jpeg

Requested by

Host: www.crowdstrike.com
URL: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:1c08 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f58861e85bd3a7fd0aa7dd3b60eaf71ac79324dc48d6ec4bda8cd561eecc2234

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Tue, 13 Feb 2024 14:23:04 GMT
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 1c12254585d1d316d9380549d59e3c80.cloudfront.net (CloudFront)
cf-cache-status: HIT
x-amz-version-id: Ko50gL_d99TA5H0.5K5BGipCvbIohHc9
age: 353
x-amz-cf-pop: FRA56-C2
cf-polished: degrade=85, origSize=375867
x-cache: Hit from cloudfront
content-length: 87525
last-modified: Thu, 29 Sep 2022 17:10:50 GMT
cf-bgj: imgq:85,h2pri
server: cloudflare
etag: "2cac6448dd2f54f3691a5c9c58dcad10-1"
vary: Accept-Encoding
content-type: image/jpeg
cache-control: public, max-age=14400
accept-ranges: bytes
cf-ray: 854dba27cc6e5d85-FRA
x-amz-cf-id: ohYroD-KsS07Rg9zQ9c4-m4ST2QstVvSJBvg6wF2vvf1Lit0-Pm3Aw==
expires: Tue, 13 Feb 2024 18:23:04 GMT

GET
H2 200 Go-Beyond-the-Perimeter-1.jpg
www.crowdstrike.com/wp-content/uploads/2021/03/ 405 KB
406 KB 142ms
140ms Image
image/jpeg 2606:4700::6810:1c08
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.crowdstrike.com/wp-content/uploads/2021/03/Go-Beyond-the-Perimeter-1.jpg

Requested by

Host: www.crowdstrike.com
URL: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:1c08 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6e188efafb2df40e1f4bd4973d31d37ae32a41676bc9c43d008388ec1ea72e1b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Tue, 13 Feb 2024 14:23:04 GMT
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 ef4ff53b101ef123a46ec560b6c94cb8.cloudfront.net (CloudFront)
cf-cache-status: HIT
x-amz-version-id: 06E88jVhse7R5o7Y5ABM3Wm4oNqLJfPv
age: 353
x-amz-cf-pop: FRA56-C2
cf-polished: degrade=85, origSize=1167150
x-cache: Hit from cloudfront
content-length: 415208
last-modified: Mon, 30 Jan 2023 19:50:28 GMT
cf-bgj: imgq:85,h2pri
server: cloudflare
etag: "5f2005763f57c0c0bc2719131824a0ad-1"
vary: Accept-Encoding
content-type: image/jpeg
cache-control: public, max-age=14400
accept-ranges: bytes
cf-ray: 854dba27cc715d85-FRA
x-amz-cf-id: 00_uiB3r_tbhlbrb1iJ3wX_-ox5qlLKJkbnwSjd8SG25kEI1aTLulg==
expires: Tue, 13 Feb 2024 18:23:04 GMT

GET
H2 200 TechCenter-2.jpg
www.crowdstrike.com/wp-content/uploads/2016/07/ 28 KB
28 KB 149ms
147ms Image
image/jpeg 2606:4700::6810:1c08
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.crowdstrike.com/wp-content/uploads/2016/07/TechCenter-2.jpg

Requested by

Host: www.crowdstrike.com
URL: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:1c08 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e0d7247f9a18889ae8a68fd56edaa202264826e284c725ce09964a71d1ee663e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Tue, 13 Feb 2024 14:23:04 GMT
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 0d4b487d54766de7560aa02de852bbf8.cloudfront.net (CloudFront)
cf-cache-status: HIT
x-amz-version-id: rB0Wte_NCdSZ2B3A4yrT8qCjhxXr75jd
age: 353
x-amz-cf-pop: FRA56-C2
cf-polished: degrade=85, origSize=111775
x-cache: Hit from cloudfront
content-length: 28432
last-modified: Fri, 12 Jan 2024 17:28:35 GMT
cf-bgj: imgq:85,h2pri
server: cloudflare
etag: "3fb44700e9a9760adce14063cd8304dc-1"
vary: Accept-Encoding
content-type: image/jpeg
cache-control: public, max-age=14400
accept-ranges: bytes
cf-ray: 854dba27cc735d85-FRA
x-amz-cf-id: 2UCdYSMdaoxg1k7iB7DLhbRSLjqHdPjPWE9A6DE1IXZlsP7MDWejGA==
expires: Tue, 13 Feb 2024 18:23:04 GMT

GET
H2 200 Blue.jpg
www.crowdstrike.com/wp-content/uploads/2016/03/ 35 KB
35 KB 135ms
133ms Image
image/jpeg 2606:4700::6810:1c08
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.crowdstrike.com/wp-content/uploads/2016/03/Blue.jpg

Requested by

Host: www.crowdstrike.com
URL: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:1c08 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

43831e0c2254516177e700ab7677297a3c544ec51703c063be52d33c54c969aa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Tue, 13 Feb 2024 14:23:04 GMT
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 6cbc993371a5407a8b834ea22f7fcbd2.cloudfront.net (CloudFront)
cf-cache-status: HIT
x-amz-version-id: MP_QVB3DLPNlZt7YmI84ODiRS.k3aa0N
age: 353
x-amz-cf-pop: AMS58-P1
cf-polished: degrade=85, origSize=40653
x-cache: Hit from cloudfront
content-length: 35333
last-modified: Tue, 13 Feb 2024 08:00:28 GMT
cf-bgj: imgq:85,h2pri
server: cloudflare
etag: "0ec159b29ef1f80f1425740f0e68e589-1"
vary: Accept-Encoding
content-type: image/jpeg
cache-control: public, max-age=14400
accept-ranges: bytes
cf-ray: 854dba27cc765d85-FRA
x-amz-cf-id: QhNSBW8jcC8LX69XGuaKPs5UhuaVPcg3kSi5Sez46iWUD4yBfmeZig==
expires: Tue, 13 Feb 2024 18:23:04 GMT

GET
H2 200 location Show response
geolocation.onetrust.com/cookieconsentpub/v1/geo/ 59 B
304 B 149ms
67ms XHR
application/json 2606:4700:4400::6812:2089
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://geolocation.onetrust.com/cookieconsentpub/v1/geo/location

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::6812:2089 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2157361193375a79ade3559e960f982daa8d599cf7f4a92d36e3eef257738f16

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept: application/json
Referer: https://www.crowdstrike.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Tue, 13 Feb 2024 14:23:05 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
server: cloudflare
vary: Accept-Encoding
access-control-allow-methods: GET, OPTIONS
content-type: application/json
access-control-allow-origin: *
cf-ray: 854dba2839e03673-FRA
access-control-allow-headers: Content-Type

GET
H2 200 footer-privacy-nav.json Show response
www.crowdstrike.com/wp-content/themes/main-theme/dist/scripts/footer/ 670 B
537 B 110ms
110ms Fetch
application/json 2606:4700::6810:1c08
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.crowdstrike.com/wp-content/themes/main-theme/dist/scripts/footer/footer-privacy-nav.json

Requested by

Host: www.crowdstrike.com
URL: https://www.crowdstrike.com/wp-content/themes/main-theme/dist/scripts/components/footer-navigation.min.js?ver=1707277106

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:1c08 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e8eda05fa3bffe9499012fd70f4e296d97d91026b0db3682b2d12be64f005f81

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Tue, 13 Feb 2024 14:23:04 GMT
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 9928105291571d6cae52bcb916c898d8.cloudfront.net (CloudFront)
cf-cache-status: HIT
content-encoding: br
x-amz-version-id: R3R0WlPDFF4xz0WAF3F5xyO8ZdVxI9rn
age: 716
x-amz-cf-pop: FRA56-C2
x-cache: Hit from cloudfront
last-modified: Tue, 13 Feb 2024 14:10:17 GMT
server: cloudflare
etag: W/"e32196cf2ac9305f69d8209ccfd1afb9"
vary: Accept-Encoding
content-type: application/json
cache-control: public, max-age=14400
cf-ray: 854dba27dc835d85-FRA
x-amz-cf-id: KsNlzIg1j75ZpdUWs-y1y3HlTO0MpketK0jj2NNCorys9ycmJAWA8g==
expires: Tue, 13 Feb 2024 18:23:04 GMT

GET
H2 200 fbevents.js Show response
connect.facebook.net/en_US/ 214 KB
58 KB 128ms
46ms Script
application/x-javascript 2a03:2880:f083:100:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/d72cd986aea0/09e1256af957/launch-6cccf53edc18.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f083:100:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

bca51ed2fe251488a1b150edf560d43880f1486740f34d24120ede486f99676b

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' data: blob: facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;script-src .fbcdn.net .facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.crowdstrike.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

permissions-policy-report-only: autoplay=(), clipboard-read=(), clipboard-write=(), display-capture=(), encrypted-media=(), fullscreen=(), picture-in-picture=(), xr-spatial-tracking=();report-to="permissions_policy"
content-security-policy: default-src 'self' data: blob: facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script';
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; preload; includeSubDomains
date: Tue, 13 Feb 2024 14:23:05 GMT
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 57257
x-xss-protection: 0
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
pragma: public
x-fb-debug: t7eNSEuSboObKuvxGFeM8UWTqcRkQUeNuSpp3T9XUHzWLxDjOqarTLMwmm5bAPk+y05WNTsMy17gV8TMxUm9Aw==
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
cross-origin-opener-policy: same-origin-allow-popups;report-to="coop_report"
vary: Accept-Encoding
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
content-type: application/x-javascript; charset=utf-8
x-frame-options: DENY
cache-control: public, max-age=1200
permissions-policy: accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), usb=(), window-management=();report-to="permissions_policy"
timing-allow-origin: *
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 187 KB
68 KB 146ms
53ms Script
application/javascript 2a00:1450:4001:812::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=DC-12037336&l=dataLayer

Requested by

Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/d72cd986aea0/09e1256af957/launch-6cccf53edc18.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

3c6522a60dfb491aef168a66e1aca8244bf7e6d08d9aa653f8a660b013085e20

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.crowdstrike.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Tue, 13 Feb 2024 14:23:05 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 69693
x-xss-protection: 0
last-modified: Tue, 13 Feb 2024 12:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Tue, 13 Feb 2024 14:23:05 GMT

GET
H2 200 iframe_api Show response
www.youtube.com/ 993 B
2 KB 607ms
514ms Script
text/javascript 2a00:1450:4001:82a::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/iframe_api

Requested by

Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/d72cd986aea0/09e1256af957/launch-6cccf53edc18.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

96469ec71636303e1b8e7ca9369b3fa55a2cf1712c9cb1a5b2064381522cae6f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.crowdstrike.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Tue, 13 Feb 2024 14:23:05 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-encoding: br
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657?hl=de for more info."
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
server: ESF
x-frame-options: SAMEORIGIN
vary: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
content-type: text/javascript; charset=utf-8
report-to: {"group":"youtube_main","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube_main"}]}
cache-control: private, max-age=0
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
origin-trial: AvC9UlR6RDk2crliDsFl66RWLnTbHrDbp+DiY6AYz/PNQ4G4tdUTjrHYr2sghbkhGQAVxb7jaPTHpEVBz0uzQwkAAAB4eyJvcmlnaW4iOiJodHRwczovL3lvdXR1YmUuY29tOjQ0MyIsImZlYXR1cmUiOiJXZWJWaWV3WFJlcXVlc3RlZFdpdGhEZXByZWNhdGlvbiIsImV4cGlyeSI6MTcxOTUzMjc5OSwiaXNTdWJkb21haW4iOnRydWV9
cross-origin-opener-policy-report-only: same-origin; report-to="youtube_main"
expires: Tue, 13 Feb 2024 14:23:05 GMT

GET
H2 200 widget.js Show response
cdn.userway.org/ 2 KB
2 KB 128ms
44ms Script
application/javascript 2a02:6ea0:c700::17
CDN77 _

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.userway.org/widget.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/d72cd986aea0/09e1256af957/launch-6cccf53edc18.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:6ea0:c700::17 Frankfurt am Main, Germany, ASN60068 (CDN77 _, GB),
Reverse DNS
Software: CDN77-Turbo /
Resource Hash: 1a415ea6fb205b85c941633bcd78fbd88e1fac779536d57b16cc6b5aecf2aa9a

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.crowdstrike.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

x-77-pop: frankfurtDE
date: Tue, 13 Feb 2024 14:23:05 GMT
via: 1.1 9ce5bc08de451222a6a280b1273d60c6.cloudfront.net (CloudFront)
content-encoding: gzip
x-amz-cf-pop: DUS51-P1
age: 1095
x-amz-server-side-encryption: AES256
x-77-cache: HIT
x-cache: HIT
x-age: 2790
x-accel-date: 1707831395
x-77-nzt: EgwBnJIhiAH35goAAAwBisclxAH3AAAAAA
x-accel-expires: @1707834995
x-77-age: 2790
last-modified: Wed, 07 Feb 2024 14:14:42 GMT
server: CDN77-Turbo
etag: W/"4d52f85f2af725a4a1f9f0e7bfe6c532"
x-77-nzt-ray: f6587a1df5d583af497bcb65f35d8902
access-control-max-age: 3000
vary: Accept-Encoding, Accept-Encoding
access-control-allow-methods: GET, HEAD, PUT, POST, DELETE
access-control-allow-origin: *
access-control-expose-headers: Content-Range, Content-Length, ETag, Content-Type
cache-control: max-age=3600, public
content-type: application/javascript
x-amz-cf-id: ThFIQoxnRzex5aM-JLwG0lVJOWXqyqS7lo9Nu0rXt4wuAVRc1H2ohw==

GET
H2 200 RCd4a8da803122457eb6df6cf216d28fc4-source.min.js Show response
assets.adobedtm.com/d72cd986aea0/09e1256af957/3c6de5fd0c0b/ 2 KB
1 KB 41ms
41ms Script
application/x-javascript 2a02:26f0:480:7b1::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/d72cd986aea0/09e1256af957/3c6de5fd0c0b/RCd4a8da803122457eb6df6cf216d28fc4-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/d72cd986aea0/09e1256af957/launch-6cccf53edc18.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:480:7b1::1e80 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: a27d6e4fcd5512236ab3edb056c2a9eab7ffea6580deb690e186524c4cf897e0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.crowdstrike.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Tue, 13 Feb 2024 14:23:04 GMT
content-encoding: gzip
last-modified: Sat, 10 Feb 2024 00:03:00 GMT
server: AkamaiNetStorage
etag: "037449f255db2cf3fcadc930e36bf21d:1707523380.898433"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: https://www.crowdstrike.com
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 877
expires: Tue, 13 Feb 2024 15:23:04 GMT

GET
H2 200 otBannerSdk.js Show response
cdn.cookielaw.org/scripttemplates/202301.1.0/ 395 KB
94 KB 60ms
60ms Script
application/javascript 2606:4700::6812:82ec
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/202301.1.0/otBannerSdk.js

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:82ec , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0cda584e7c5036ad66d7d528d2209bc596a14179fa1792a559e2ae9eaa91e851

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.crowdstrike.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Tue, 13 Feb 2024 14:23:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
content-md5: TPatHKMti4L8TVrK0PWkxg==
age: 47001
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-length: 96303
x-ms-lease-status: unlocked
last-modified: Wed, 22 Feb 2023 03:39:35 GMT
server: cloudflare
etag: 0x8DB14866ADAA84A
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-ms-request-id: bdce70f4-f01e-00ad-093e-79f88c000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: max-age=86400
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 854dba28db309c01-FRA

GET
H2 200 RC6d6f42081a154a5d8562e114bceace58-source.min.js Show response
assets.adobedtm.com/d72cd986aea0/09e1256af957/3c6de5fd0c0b/ 376 B
505 B 40ms
40ms Script
application/x-javascript 2a02:26f0:480:7b1::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/d72cd986aea0/09e1256af957/3c6de5fd0c0b/RC6d6f42081a154a5d8562e114bceace58-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/d72cd986aea0/09e1256af957/launch-6cccf53edc18.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:480:7b1::1e80 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 95eb12099b7b1a54a255c0c2c6ebf9cb537aa5ac56e6a31aca10b11ea2f88f11

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.crowdstrike.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Tue, 13 Feb 2024 14:23:05 GMT
content-encoding: gzip
last-modified: Sat, 10 Feb 2024 00:03:00 GMT
server: AkamaiNetStorage
etag: "037449f255db2cf3fcadc930e36bf21d:1707523380.898433"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: https://www.crowdstrike.com
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 245
expires: Tue, 13 Feb 2024 15:23:05 GMT

GET
H2 200 RCc9e993aecb03421e94969c659f736031-source.min.js Show response
assets.adobedtm.com/d72cd986aea0/09e1256af957/3c6de5fd0c0b/ 2 KB
1 KB 42ms
42ms Script
application/x-javascript 2a02:26f0:480:7b1::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/d72cd986aea0/09e1256af957/3c6de5fd0c0b/RCc9e993aecb03421e94969c659f736031-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/d72cd986aea0/09e1256af957/launch-6cccf53edc18.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:480:7b1::1e80 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 015e7f3ebea532c012598dcd5636b53f2773d2fa8c6c1310398e60f5adfbba1a

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.crowdstrike.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Tue, 13 Feb 2024 14:23:05 GMT
content-encoding: gzip
last-modified: Sat, 10 Feb 2024 00:03:00 GMT
server: AkamaiNetStorage
etag: "037449f255db2cf3fcadc930e36bf21d:1707523380.898433"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: https://www.crowdstrike.com
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 1070
expires: Tue, 13 Feb 2024 15:23:05 GMT

GET
H2 200 widget_app_base_1707315122285.js Show response
cdn.userway.org/widgetapp/2024-02-07-14-12-02/ 149 KB
43 KB 125ms
41ms Script
application/javascript 2a02:6ea0:c700::17
CDN77 _

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.userway.org/widgetapp/2024-02-07-14-12-02/widget_app_base_1707315122285.js
Requested by: Host: cdn.userway.org
URL: https://cdn.userway.org/widget.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:6ea0:c700::17 Frankfurt am Main, Germany, ASN60068 (CDN77 _, GB),
Reverse DNS
Software: CDN77-Turbo /
Resource Hash: 389f18566f9a77749a729c029b9016c87cfaf1f066b41124b7fc07fd5392ca00

Request headers

Referer: https://www.crowdstrike.com/
Origin: https://www.crowdstrike.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

x-77-pop: frankfurtDE
date: Tue, 13 Feb 2024 14:23:05 GMT
via: 1.1 603f36cbe39a66d93949b80e7296dad4.cloudfront.net (CloudFront)
content-encoding: gzip
x-amz-cf-pop: DUS51-P1
age: 354
x-amz-server-side-encryption: AES256
x-77-cache: HIT
x-cache: HIT
x-age: 517732
x-accel-date: 1707316453
x-77-nzt: EgwBnJIhiAH3ZOYHAAwBisclwQH35QIAAA
x-accel-expires: @1733235712
x-77-age: 518473
last-modified: Wed, 07 Feb 2024 14:14:37 GMT
server: CDN77-Turbo
etag: W/"3db7b33bffe0673d213a4a2718000de5"
x-77-nzt-ray: f6587a1db1ce5eb4497bcb656574920b
access-control-max-age: 3000
vary: Accept-Encoding, Accept-Encoding
access-control-allow-methods: GET, HEAD, PUT, POST, DELETE
access-control-allow-origin: *
access-control-expose-headers: Content-Range, Content-Length, ETag, Content-Type
cache-control: max-age=25920000, public
content-type: application/javascript
x-amz-cf-id: RtRPBs5eVHXJJf3q8TanXlhcmSwuogN0I0ryOPkbenueaBEfCW-64w==

GET
H2 200 6si.min.js Show response
j.6sc.co/ 64 KB
17 KB 172ms
43ms Script
application/javascript 2.17.22.194

General

Check archive.org

Show headers Download Go to

Full URL

https://j.6sc.co/6si.min.js

Requested by

Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/d72cd986aea0/09e1256af957/launch-6cccf53edc18.min.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.17.22.194 Düsseldorf, Germany, ASN (),

Reverse DNS

a2-17-22-194.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

2d699428fb1a87452cb15775f3e9a531b9c8a98bfa41be2a24be4814ff0a5baf

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.crowdstrike.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 13 Feb 2024 14:23:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 20 Dec 2023 22:26:49 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "65836a29-fee9"
vary: Accept-Encoding
content-type: application/javascript
cache-control: private, no-cache, proxy-revalidate
accept-ranges: bytes
content-length: 17567
expires: Tue, 13 Feb 2024 14:23:05 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 331 KB
106 KB 48ms
48ms Script
application/javascript 2a00:1450:4001:812::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-ZKTET1D58V&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=DC-12037336&l=dataLayer

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

f9f58c1d68e8d224ead13a1ea32344e66277c6e41e7b19292adad5f9584ef0a6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.crowdstrike.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Tue, 13 Feb 2024 14:23:05 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 108251
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Tue, 13 Feb 2024 14:23:05 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 331 KB
106 KB 75ms
75ms Script
application/javascript 2a00:1450:4001:812::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-797629828&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=DC-12037336&l=dataLayer

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

0387b42680fd92cfb4d64d3d697e8e3f5ab54abc28636abe5bcb6f0f68d3ba4a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.crowdstrike.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Tue, 13 Feb 2024 14:23:05 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 108244
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Tue, 13 Feb 2024 14:23:05 GMT

GET
H2 200 en.json Show response
cdn.cookielaw.org/consent/bee15b7c-b632-450e-9003-9c8b60b3b978/b2193cd5-8954-4870-b8f7-b3be5ea49b82/ 174 KB
37 KB 66ms
66ms Fetch
application/x-javascript 2606:4700::6812:82ec
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/consent/bee15b7c-b632-450e-9003-9c8b60b3b978/b2193cd5-8954-4870-b8f7-b3be5ea49b82/en.json

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/202301.1.0/otBannerSdk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:82ec , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

03c245f01d27acbca6d02fe3852ce5027e127cbbc9cc5c60b6719ea60dc54cbb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.crowdstrike.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Tue, 13 Feb 2024 14:23:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
strict-transport-security: max-age=31536000; includeSubDomains; preload
age: 37392
content-md5: xfqr81g8p7otmAi1zTmu3A==
content-length: 37325
x-ms-lease-status: unlocked
last-modified: Thu, 08 Feb 2024 02:34:07 GMT
server: cloudflare
etag: 0x8DC284E6C6EDC0D
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: *
x-ms-request-id: 992dfde6-401e-0063-4837-5aa478000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=86400
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 854dba29880703a0-FRA
expires: Wed, 14 Feb 2024 14:23:05 GMT

GET
H2 200 950083805267950 Show response
connect.facebook.net/signals/config/ 6 KB
3 KB 41ms
40ms Script
application/x-javascript 2a03:2880:f083:100:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/950083805267950?v=2.9.145&r=stable&domain=www.crowdstrike.com&hme=20c913bdcd4be51a752120153aa5caaecb3ee86c7f26cf737846e40b202aba68&ex_m=62%2C106%2C94%2C98%2C53%2C3%2C88%2C61%2C14%2C86%2C79%2C44%2C46%2C150%2C153%2C164%2C160%2C161%2C163%2C25%2C89%2C45%2C68%2C162%2C145%2C148%2C157%2C158%2C165%2C115%2C13%2C43%2C169%2C168%2C117%2C16%2C29%2C32%2C1%2C36%2C57%2C58%2C59%2C63%2C83%2C15%2C12%2C85%2C82%2C81%2C95%2C97%2C31%2C96%2C26%2C22%2C146%2C149%2C124%2C24%2C9%2C10%2C11%2C5%2C6%2C21%2C19%2C20%2C49%2C54%2C56%2C66%2C90%2C23%2C67%2C8%2C7%2C71%2C41%2C18%2C92%2C91%2C17%2C4%2C73%2C80%2C72%2C78%2C40%2C39%2C77%2C33%2C35%2C76%2C48%2C74%2C28%2C37%2C65%2C0%2C84%2C75%2C2%2C30%2C55%2C34%2C93%2C38%2C70%2C60%2C99%2C52%2C51%2C27%2C87%2C50%2C47%2C42%2C69%2C64%2C100

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f083:100:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

cb4c799592e4092b490da8b0f3402312d8df6d486af541ee740e1906f456c84c

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' data: blob: facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;script-src .fbcdn.net .facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.crowdstrike.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

permissions-policy-report-only: autoplay=(), clipboard-read=(), clipboard-write=(), display-capture=(), encrypted-media=(), fullscreen=(), picture-in-picture=(), xr-spatial-tracking=();report-to="permissions_policy"
content-security-policy: default-src 'self' data: blob: facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script';
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; preload; includeSubDomains
date: Tue, 13 Feb 2024 14:23:05 GMT
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 2428
x-xss-protection: 0
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
pragma: public
x-fb-debug: 32u8twfix6P5vauyqXLmAz5FQXDCubJHsxmGBVnCAr+EwR/Shjgp1OHObhFR1TL6p0uScwwTvFkTrFiU9KMVwA==
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
cross-origin-opener-policy: same-origin-allow-popups;report-to="coop_report"
vary: Accept-Encoding
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
content-type: application/x-javascript; charset=utf-8
x-frame-options: DENY
origin-agent-cluster: ?0
cache-control: public, max-age=1200
permissions-policy: accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), usb=(), window-management=();report-to="permissions_policy"
timing-allow-origin: *
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 otFlat.json Show response
cdn.cookielaw.org/scripttemplates/202301.1.0/assets/ 13 KB
3 KB 72ms
71ms Fetch
application/json 2606:4700::6812:82ec
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/202301.1.0/assets/otFlat.json

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/202301.1.0/otBannerSdk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:82ec , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

1df323c03e742ff217794c8ace2c647f3f0cf868c91d4396c166262ca1075acc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.crowdstrike.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Tue, 13 Feb 2024 14:23:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
content-md5: JRquOrwnT+1fACynxEiZlA==
age: 67795
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-length: 3020
x-ms-lease-status: unlocked
last-modified: Wed, 22 Feb 2023 03:39:28 GMT
server: cloudflare
etag: 0x8DB148666B3B223
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: *
x-ms-request-id: 7b447f3a-f01e-0059-188d-0cbe00000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: max-age=86400
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 854dba2a28a103a0-FRA

GET
H2 200 otPcTab.json Show response
cdn.cookielaw.org/scripttemplates/202301.1.0/assets/v2/ 62 KB
13 KB 76ms
75ms Fetch
application/json 2606:4700::6812:82ec
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/202301.1.0/assets/v2/otPcTab.json

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/202301.1.0/otBannerSdk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:82ec , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a9c89c2a0df62b9bd73d859ae616ffe92cb9e86e1428a1a0fc797418f3e03dd9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.crowdstrike.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Tue, 13 Feb 2024 14:23:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
content-md5: 5x5OTvRos5JBKPa+Qbpqxg==
age: 67795
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-length: 13354
x-ms-lease-status: unlocked
last-modified: Wed, 22 Feb 2023 03:39:30 GMT
server: cloudflare
etag: 0x8DB148668308060
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: *
x-ms-request-id: f7a0b0f2-401e-005c-0540-0d6cdb000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: max-age=86400
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 854dba2a28a203a0-FRA

GET
H2 200 otCommonStyles.css Show response
cdn.cookielaw.org/scripttemplates/202301.1.0/assets/ 21 KB
4 KB 77ms
76ms Fetch
text/css 2606:4700::6812:82ec
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/202301.1.0/assets/otCommonStyles.css

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/202301.1.0/otBannerSdk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:82ec , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

930239150e702d9d4bf43c3881aa70f8ad5fd9068dcbecb7c8bcca654784f7f1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.crowdstrike.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Tue, 13 Feb 2024 14:23:05 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: gzip
content-md5: XcxlleAcPGO2n5kTZrHH2Q==
age: 82601
x-ms-lease-status: unlocked
last-modified: Wed, 22 Feb 2023 03:39:39 GMT
server: cloudflare
vary: Accept-Encoding
content-type: text/css
access-control-allow-origin: *
x-ms-request-id: 37e42e60-201e-0145-4ee1-5a4322000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: max-age=86400
x-ms-version: 2009-09-19
cf-ray: 854dba2a28a503a0-FRA

GET
H2 200 RC698dc8385de1411c824b73d0b3be0648-source.min.js Show response
assets.adobedtm.com/d72cd986aea0/09e1256af957/3c6de5fd0c0b/ 626 B
580 B 40ms
40ms Script
application/x-javascript 2a02:26f0:480:7b1::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/d72cd986aea0/09e1256af957/3c6de5fd0c0b/RC698dc8385de1411c824b73d0b3be0648-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/d72cd986aea0/09e1256af957/launch-6cccf53edc18.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:480:7b1::1e80 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 5f312a8528f9d8b6d94c841609abdc515f480820a110fd93aa9de7e9ab2a3db8

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.crowdstrike.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Tue, 13 Feb 2024 14:23:05 GMT
content-encoding: gzip
last-modified: Sat, 10 Feb 2024 00:03:00 GMT
server: AkamaiNetStorage
etag: "037449f255db2cf3fcadc930e36bf21d:1707523380.898433"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: https://www.crowdstrike.com
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 321
expires: Tue, 13 Feb 2024 15:23:05 GMT

POST
H2 200 dyvvHf6oG0 Show response
api.userway.org/api/tunings/ 3 KB
3 KB 597ms
199ms XHR
application/json 2600:1f14:5db:eb00:e29d:e8fa:9217:9611
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://api.userway.org/api/tunings/dyvvHf6oG0
Requested by: Host: cdn.userway.org
URL: https://cdn.userway.org/widgetapp/2024-02-07-14-12-02/widget_app_base_1707315122285.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:1f14:5db:eb00:e29d:e8fa:9217:9611 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: ec04952619b2b05cca30dd261a1aeed9853ebd6fddc4c701ec81c1de09d7277e

Request headers

Referer: https://www.crowdstrike.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

date: Tue, 13 Feb 2024 14:23:05 GMT
etag: W/"ab6-cRehFH3vf44MrktXADNnBVtVJXY"
access-control-max-age: 3000
access-control-allow-methods: GET, HEAD, PUT, PATCH, POST, DELETE
content-type: application/json; charset=utf-8
access-control-allow-origin: *
x-service-request-id: usr277df021b80c40b
access-control-expose-headers: Content-Range, Content-Length, ETag, Content-Type
cache-control: no-cache, no-store, must-revalidate
access-control-allow-headers: *
content-length: 2742
x-service-version: uw-pr

GET
H2 200 getuidj Show response
secure.adnxs.com/ 11 B
702 B 118ms
39ms XHR
application/json 37.252.171.52
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.adnxs.com/getuidj

Requested by

Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.171.52 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

1005.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net

Software

nginx/1.23.4 /

Resource Hash

31b45c462302ac175bfa43f9e5591491db780ca094f6ecdd2907f25ad578448d

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.crowdstrike.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 13 Feb 2024 14:23:05 GMT
an-x-request-uuid: dcdcf5ad-0742-4291-aeb3-ef096254af54
server: nginx/1.23.4
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: application/json; charset=utf-8
access-control-allow-origin: https://www.crowdstrike.com
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
x-proxy-origin: 80.255.7.101; 80.255.7.101; 1005.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
content-length: 11
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 / Show response
c.6sc.co/ 7 B
196 B 73ms
73ms XHR
text/html 2.17.22.194

General

Check archive.org

Show headers Download Go to

Full URL: https://c.6sc.co/
Requested by: Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2.17.22.194 Düsseldorf, Germany, ASN (),
Reverse DNS: a2-17-22-194.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: fe04a9dc88d3f3be8d4f6bc63a9a80f45a4c6d8460e7551dab849457c091920a

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.crowdstrike.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Tue, 13 Feb 2024 14:23:05 GMT
access-control-max-age: 86400
access-control-allow-methods: GET,POST
content-type: text/html
access-control-allow-origin: https://www.crowdstrike.com
access-control-allow-credentials: true
access-control-allow-headers: *
content-length: 7

GET
H2 200 / Show response
ipv6.6sc.co/ 19 B
311 B 157ms
38ms XHR
text/html 2a02:26f0:ab00::214:8e41
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://ipv6.6sc.co/
Requested by: Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:ab00::214:8e41 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: /
Resource Hash: a0ae602e4b19bb4491ccba1bab200ae243fa876b70cefdd8894ae0111a788306

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.crowdstrike.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 13 Feb 2024 14:23:05 GMT
vary: Origin
content-type: text/html
access-control-allow-origin: https://www.crowdstrike.com
cache-control: max-age=0, no-cache, no-store
6si-ipv6: 2a01:4a0:1338:92::9
server-timing: cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="1707834185417_34901565_336956163_26_885_38_79_219";dur=1
content-length: 19
expires: Tue, 13 Feb 2024 14:23:05 GMT

GET
H2 200 ot_close.svg
cdn.cookielaw.org/logos/static/ 651 B
601 B 51ms
51ms Image
image/svg+xml 2606:4700::6812:82ec
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cdn.cookielaw.org/logos/static/ot_close.svg

Requested by

Host: www.crowdstrike.com
URL: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:82ec , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

901bb0e03b8c3c0a1cf4c487a177417328bb7d8c94106ecefceedd7d7f6c4ddc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.crowdstrike.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Tue, 13 Feb 2024 14:23:05 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: gzip
content-md5: pcXWFGpuVeSg/jVnYCseRg==
age: 22665
x-ms-lease-status: unlocked
last-modified: Mon, 12 Feb 2024 01:58:28 GMT
server: cloudflare
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
x-ms-request-id: b9f17cee-f01e-0049-736f-5d7b68000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: max-age=86400
x-ms-version: 2009-09-19
cf-ray: 854dba2aad929c01-FRA

GET
H2 200 ot_guard_logo.svg Show response
cdn.cookielaw.org/logos/static/ 497 B
494 B 52ms
52ms Fetch
image/svg+xml 2606:4700::6812:82ec
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/logos/static/ot_guard_logo.svg

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/202301.1.0/otBannerSdk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:82ec , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

691dcdb24853a0f5ce4e6597e5713dea66799b57ffe2c2a10f28f98e0b569b19

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.crowdstrike.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Tue, 13 Feb 2024 14:23:05 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: gzip
content-md5: tXyZydHjxQshFMbbBT1/8A==
age: 11184
x-ms-lease-status: unlocked
last-modified: Mon, 12 Feb 2024 19:24:03 GMT
server: cloudflare
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
x-ms-request-id: 63b7fb7d-101e-001c-3d0a-5e6be3000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: max-age=86400
x-ms-version: 2009-09-19
cf-ray: 854dba2ab96503a0-FRA

GET
H2 200 CS_Logos_2020_InlineRed_b.png
cdn.cookielaw.org/logos/c109dae9-46f3-4e91-a59e-7844ef645107/cad7e755-8c86-4939-8df1-4d68f074f0fc/53cb332e-5cc4-44a8-9590-9e086136bfe9/ 23 KB
24 KB 53ms
53ms Image
application/octet-stream 2606:4700::6812:82ec
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cdn.cookielaw.org/logos/c109dae9-46f3-4e91-a59e-7844ef645107/cad7e755-8c86-4939-8df1-4d68f074f0fc/53cb332e-5cc4-44a8-9590-9e086136bfe9/CS_Logos_2020_InlineRed_b.png

Requested by

Host: www.crowdstrike.com
URL: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:82ec , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0dbd9ca47f4fd338efab8e6f5188a6de45cf390f04cfaea4a65abc47635550c6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.crowdstrike.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Tue, 13 Feb 2024 14:23:05 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
content-md5: QB/VUZMYBu/LYPsEI/xs+w==
age: 80608
content-length: 24007
x-ms-lease-status: unlocked
last-modified: Tue, 21 Jul 2020 19:10:59 GMT
server: cloudflare
etag: 0x8D82DA9CDE4D646
vary: Accept-Encoding
content-type: application/octet-stream
access-control-allow-origin: *
x-ms-request-id: 6f3aa707-101e-001c-50e6-1d6be3000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: max-age=86400
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 854dba2acdaf9c01-FRA

GET
H2 200 powered_by_logo.svg
cdn.cookielaw.org/logos/static/ 5 KB
2 KB 52ms
52ms Image
image/svg+xml 2606:4700::6812:82ec
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cdn.cookielaw.org/logos/static/powered_by_logo.svg

Requested by

Host: www.crowdstrike.com
URL: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:82ec , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5fa00d047acd959697b9d7772c31dcd37bec33c70c6fbf80ab8316205d1d286d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.crowdstrike.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Tue, 13 Feb 2024 14:23:05 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: gzip
content-md5: Y+c301RBZNK39PvKQWrIBw==
age: 30337
x-ms-lease-status: unlocked
last-modified: Mon, 12 Feb 2024 01:58:28 GMT
server: cloudflare
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
x-ms-request-id: 230af1d3-301e-0046-1267-5d0d04000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: max-age=86400
x-ms-version: 2009-09-19
cf-ray: 854dba2acdb69c01-FRA

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
485 B 264ms
264ms Image
image/gif 2.17.22.194

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=840a4ffa1a26e59267b6b28298d972e1&svisitor=null&visitor=536b3338-88cd-4004-8882-5745a2645fe7&session=ff4f5878-bd94-421c-89e2-309d5fd2c65a&event=a_pageload&q=%7B%22pageLoadTime%22%3A%22Tue%2C%2013%20Feb%202024%2014%3A23%3A05%20GMT%22%7D&isIframe=false&m=%7B%22description%22%3A%22Read%20this%20blog%20to%20learn%20about%20the%20HijackLoader%20sample%20that%20employs%20sophisticated%20evasion%20techniques%20to%20enhance%20the%20complexity%20of%20the%20threat.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22HijackLoader%20Expands%20Techniques%20to%20Improve%20Defense%20Evasion%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.crowdstrike.com%2Fblog%2Fhijackloader-expands-techniques%2F&pageViewId=a9582c50-f1da-433d-8b01-7093cff49d59&an_uid=0&v=1.1.14

Requested by

Host: www.crowdstrike.com
URL: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.17.22.194 Düsseldorf, Germany, ASN (),

Reverse DNS

a2-17-22-194.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.crowdstrike.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Tue, 13 Feb 2024 14:23:05 GMT
x-content-type-options: nosniff
content-length: 43
pragma: no-cache
last-modified: Sat, 18 Feb 2023 02:04:22 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "63f03226-2b"
access-control-max-age: 86400
access-control-allow-methods: GET,POST
content-type: image/gif
access-control-allow-origin
cache-control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: *
expires: Wed, 19 Apr 2000 11:43:00 GMT

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
485 B 277ms
277ms Image
image/gif 2.17.22.194

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=840a4ffa1a26e59267b6b28298d972e1&svisitor=null&visitor=536b3338-88cd-4004-8882-5745a2645fe7&session=ff4f5878-bd94-421c-89e2-309d5fd2c65a&event=ni%3AasyncSettingsAudit&q=%7B%22settings%22%3A%22%5B%7B%5C%22name%5C%22%3A%5C%22enableCompanyDetails%5C%22%2C%5C%22value%5C%22%3A%5C%22%5Btrue%2Cnull%2C3%5D%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Tue%2C%2013%20Feb%202024%2014%3A23%3A05%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setEpsilonKey%5C%22%2C%5C%22value%5C%22%3A%5C%2212b151d5b8d6b92a46cc0179565c5a619e148092%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Tue%2C%2013%20Feb%202024%2014%3A23%3A05%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setToken%5C%22%2C%5C%22value%5C%22%3A%5C%22840a4ffa1a26e59267b6b28298d972e1%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Tue%2C%2013%20Feb%202024%2014%3A23%3A05%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22enableEventTracking%5C%22%2C%5C%22value%5C%22%3A%5C%22true%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Tue%2C%2013%20Feb%202024%2014%3A23%3A05%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22enableRetargeting%5C%22%2C%5C%22value%5C%22%3A%5C%22true%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Tue%2C%2013%20Feb%202024%2014%3A23%3A05%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%5D%22%7D&isIframe=false&m=%7B%22description%22%3A%22Read%20this%20blog%20to%20learn%20about%20the%20HijackLoader%20sample%20that%20employs%20sophisticated%20evasion%20techniques%20to%20enhance%20the%20complexity%20of%20the%20threat.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22HijackLoader%20Expands%20Techniques%20to%20Improve%20Defense%20Evasion%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.crowdstrike.com%2Fblog%2Fhijackloader-expands-techniques%2F&pageViewId=a9582c50-f1da-433d-8b01-7093cff49d59&an_uid=0&v=1.1.14

Requested by

Host: www.crowdstrike.com
URL: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.17.22.194 Düsseldorf, Germany, ASN (),

Reverse DNS

a2-17-22-194.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.crowdstrike.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Tue, 13 Feb 2024 14:23:05 GMT
x-content-type-options: nosniff
content-length: 43
pragma: no-cache
last-modified: Sat, 05 Jun 2021 07:56:05 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "60bb2e15-2b"
access-control-max-age: 86400
access-control-allow-methods: GET,POST
content-type: image/gif
access-control-allow-origin
cache-control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: *
expires: Wed, 19 Apr 2000 11:43:00 GMT

GET
H2 200 details Show response
epsilon.6sense.com/v3/company/ 725 B
709 B 119ms
49ms XHR
application/json 13.248.142.121
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://epsilon.6sense.com/v3/company/details
Requested by: Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 13.248.142.121 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ac3ff6aafb2cddae2.awsglobalaccelerator.com
Software: nginx /
Resource Hash: d454566fbbab8fcbc70a1c3139be25be5205712442564fe24a5e0258e3337a98

Request headers

Referer: https://www.crowdstrike.com/
accept-language: de-DE,de;q=0.9
Authorization: Token 12b151d5b8d6b92a46cc0179565c5a619e148092
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36
X-6s-CustomID: WebTag1.0 840a4ffa1a26e59267b6b28298d972e1

Response headers

x-trace-id: 672870733861321084
date: Tue, 13 Feb 2024 14:23:05 GMT
content-encoding: gzip
server: nginx
vary: Origin, Accept-Encoding
content-type: application/json
x-6si-region: eu-central-1a
access-control-allow-origin: https://www.crowdstrike.com
access-control-expose-headers: X-6si-Region
access-control-allow-credentials: true
timing-allow-origin: https://6sense.com, https://www.ssga.com
content-length: 387

OPTIONS
H2 200 details
epsilon.6sense.com/v3/company/ 0
0 114ms
43ms Preflight 13.248.142.121
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://epsilon.6sense.com/v3/company/details
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 13.248.142.121 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ac3ff6aafb2cddae2.awsglobalaccelerator.com
Software: nginx /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: authorization,x-6s-customid
Access-Control-Request-Method: GET
Origin: https://www.crowdstrike.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: authorization,x-6s-customid
access-control-allow-methods: OPTIONS,GET
access-control-allow-origin: https://www.crowdstrike.com
access-control-expose-headers: X-6si-Region
access-control-max-age: 1800
date: Tue, 13 Feb 2024 14:23:05 GMT
server: nginx
timing-allow-origin: https://6sense.com, https://www.ssga.com
x-6si-region: eu-central-1a
x-trace-id: 488742626843396892

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
485 B 295ms
295ms Image
image/gif 2.17.22.194

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=840a4ffa1a26e59267b6b28298d972e1&svisitor=null&visitor=536b3338-88cd-4004-8882-5745a2645fe7&session=ff4f5878-bd94-421c-89e2-309d5fd2c65a&event=ipv6&q=%7B%22address%22%3A%222a01%3A4a0%3A1338%3A92%3A%3A9%22%7D&isIframe=false&m=%7B%22description%22%3A%22Read%20this%20blog%20to%20learn%20about%20the%20HijackLoader%20sample%20that%20employs%20sophisticated%20evasion%20techniques%20to%20enhance%20the%20complexity%20of%20the%20threat.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22HijackLoader%20Expands%20Techniques%20to%20Improve%20Defense%20Evasion%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.crowdstrike.com%2Fblog%2Fhijackloader-expands-techniques%2F&pageViewId=a9582c50-f1da-433d-8b01-7093cff49d59&an_uid=0&v=1.1.14

Requested by

Host: www.crowdstrike.com
URL: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.17.22.194 Düsseldorf, Germany, ASN (),

Reverse DNS

a2-17-22-194.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.crowdstrike.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Tue, 13 Feb 2024 14:23:05 GMT
x-content-type-options: nosniff
content-length: 43
pragma: no-cache
last-modified: Sat, 18 Feb 2023 02:04:22 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "63f03226-2b"
access-control-max-age: 86400
access-control-allow-methods: GET,POST
content-type: image/gif
access-control-allow-origin
cache-control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: *
expires: Wed, 19 Apr 2000 11:43:00 GMT

GET
H2 200 www-widgetapi.js Show response
www.youtube.com/s/player/5e928255/www-widgetapi.vflset/ 216 KB
67 KB 40ms
39ms Script
text/javascript 2a00:1450:4001:82a::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/s/player/5e928255/www-widgetapi.vflset/www-widgetapi.js

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/iframe_api

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

266a29bf57b54d51f7289747197132d43179b4f024d61069dbaea01da8012d13

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.crowdstrike.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Tue, 13 Feb 2024 14:21:06 GMT
content-encoding: br
x-content-type-options: nosniff
age: 119
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 68548
x-xss-protection: 0
last-modified: Tue, 06 Feb 2024 05:19:47 GMT
server: sffe
vary: Accept-Encoding, Origin
report-to: {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="youtube"
expires: Wed, 12 Feb 2025 14:21:06 GMT

GET
H2 200 RC8de780f02ed7489ea63027c24b833a79-source.min.js Show response
assets.adobedtm.com/d72cd986aea0/09e1256af957/3c6de5fd0c0b/ 571 B
596 B 40ms
40ms Script
application/x-javascript 2a02:26f0:480:7b1::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/d72cd986aea0/09e1256af957/3c6de5fd0c0b/RC8de780f02ed7489ea63027c24b833a79-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/d72cd986aea0/09e1256af957/launch-6cccf53edc18.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:480:7b1::1e80 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 1cd90e6c722ffc4078beee524a162b03c767bc8efd6f52fdf7fba5b90ee09d54

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.crowdstrike.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Tue, 13 Feb 2024 14:23:05 GMT
content-encoding: gzip
last-modified: Sat, 10 Feb 2024 00:03:00 GMT
server: AkamaiNetStorage
etag: "037449f255db2cf3fcadc930e36bf21d:1707523380.898433"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: https://www.crowdstrike.com
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 336
expires: Tue, 13 Feb 2024 15:23:05 GMT

GET
H2 200 en-US.json Show response
cdn.userway.org/widgetapp/2024-02-07-14-12-02/locales/ 501 B
959 B 41ms
40ms XHR
application/json 2a02:6ea0:c700::17
CDN77 _

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.userway.org/widgetapp/2024-02-07-14-12-02/locales/en-US.json
Requested by: Host: cdn.userway.org
URL: https://cdn.userway.org/widgetapp/2024-02-07-14-12-02/widget_app_base_1707315122285.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:6ea0:c700::17 Frankfurt am Main, Germany, ASN60068 (CDN77 _, GB),
Reverse DNS
Software: CDN77-Turbo /
Resource Hash: b87d34c5425a5b6bc0d37a08c2cd36cf21c2dac2645262a375f7460829859138

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.crowdstrike.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

x-77-pop: frankfurtDE
date: Tue, 13 Feb 2024 14:23:05 GMT
via: 1.1 b43c04a791e8dcb8ddb6bb0847fcf95a.cloudfront.net (CloudFront)
content-encoding: gzip
x-amz-cf-pop: FRA60-P3
age: 1083
x-amz-server-side-encryption: AES256
x-77-cache: HIT
x-cache: HIT
x-age: 517726
x-accel-date: 1707316459
x-77-nzt: EgwBnJIhiAH3XuYHAAwB1GY4EQH3DgAAAA
x-accel-expires: @1733236445
x-77-age: 517740
last-modified: Wed, 07 Feb 2024 14:14:36 GMT
server: CDN77-Turbo
etag: W/"27831556b168f3c27f0819652aac1fb5"
x-77-nzt-ray: f6587a1db1ce5eb4497bcb65e92b5838
access-control-max-age: 3000
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD, PUT, POST, DELETE
access-control-allow-origin: *
access-control-expose-headers: Content-Range, Content-Length, ETag, Content-Type
cache-control: max-age=25920000, public
content-type: application/json
x-amz-cf-id: uRRBHD66yVzxCXwf2MDL4QEb8EM36JZLZpYDaknHPNVQ72F07fEXOQ==

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
484 B 232ms
232ms Image
image/gif 2.17.22.194

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=840a4ffa1a26e59267b6b28298d972e1&svisitor=null&visitor=536b3338-88cd-4004-8882-5745a2645fe7&session=ff4f5878-bd94-421c-89e2-309d5fd2c65a&event=active_time_track&q=%7B%22currentTime%22%3A%22Tue%2C%2013%20Feb%202024%2014%3A23%3A06%20GMT%22%2C%22lastTrackTime%22%3A%22Tue%2C%2013%20Feb%202024%2014%3A23%3A05%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%221001%22%7D&isIframe=false&m=%7B%22description%22%3A%22Read%20this%20blog%20to%20learn%20about%20the%20HijackLoader%20sample%20that%20employs%20sophisticated%20evasion%20techniques%20to%20enhance%20the%20complexity%20of%20the%20threat.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22HijackLoader%20Expands%20Techniques%20to%20Improve%20Defense%20Evasion%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.crowdstrike.com%2Fblog%2Fhijackloader-expands-techniques%2F&pageViewId=a9582c50-f1da-433d-8b01-7093cff49d59&an_uid=0&v=1.1.14

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.17.22.194 Düsseldorf, Germany, ASN (),

Reverse DNS

a2-17-22-194.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.crowdstrike.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Tue, 13 Feb 2024 14:23:06 GMT
x-content-type-options: nosniff
content-length: 43
pragma: no-cache
last-modified: Sat, 18 Feb 2023 00:49:36 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "63f020a0-2b"
access-control-max-age: 86400
access-control-allow-methods: GET,POST
content-type: image/gif
access-control-allow-origin
cache-control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: *
expires: Wed, 19 Apr 2000 11:43:00 GMT

GET
H2 200 remediation_1707315122285.js Show response
cdn.userway.org/widgetapp/2024-02-07-14-12-02/remediation/ 112 KB
30 KB 108ms
107ms Script
application/javascript 2a02:6ea0:c700::17
CDN77 _

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.userway.org/widgetapp/2024-02-07-14-12-02/remediation/remediation_1707315122285.js
Requested by: Host: cdn.userway.org
URL: https://cdn.userway.org/widgetapp/2024-02-07-14-12-02/widget_app_base_1707315122285.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:6ea0:c700::17 Frankfurt am Main, Germany, ASN60068 (CDN77 _, GB),
Reverse DNS
Software: CDN77-Turbo /
Resource Hash: a51da23632b50edb94b10e105416f06bcbc482e5c35eac9a4e34bc5ab2f9d9d8

Request headers

Referer: https://www.crowdstrike.com/
Origin: https://www.crowdstrike.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

x-77-pop: frankfurtDE
date: Tue, 13 Feb 2024 14:23:06 GMT
via: 1.1 5b6e22c950501920595c86fc25834582.cloudfront.net (CloudFront)
content-encoding: gzip
x-amz-cf-pop: FRA60-P3
age: 1076
x-amz-server-side-encryption: AES256
x-77-cache: HIT
x-cache: HIT
x-age: 517730
x-accel-date: 1707316456
x-77-nzt: EgwBnJIhiAH3YuYHAAwBnJIhHwH3DgAAAA
x-accel-expires: @1733236442
x-77-age: 517744
last-modified: Wed, 07 Feb 2024 14:14:37 GMT
server: CDN77-Turbo
etag: W/"422aee77914c2c72a7587b1d2906fdcf"
x-77-nzt-ray: f6587a1db1ce5eb44a7bcb6599d4a81a
access-control-max-age: 3000
vary: Accept-Encoding, Accept-Encoding
access-control-allow-methods: GET, HEAD, PUT, POST, DELETE
access-control-allow-origin: *
access-control-expose-headers: Content-Range, Content-Length, ETag, Content-Type
cache-control: max-age=25920000, public
content-type: application/javascript
x-amz-cf-id: AqTgi34YMrkBAqoQKnIWvsGbP8ULfwO_W57BWL16XF1aEKr7CfQG_Q==

GET
H2 200 F5hp0ZvjLU55eQR8.json Show response
cdn.userway.org/remediations/consolidated/2376540/ 791 KB
102 KB 50ms
50ms XHR
application/json 2a02:6ea0:c700::17
CDN77 _

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.userway.org/remediations/consolidated/2376540/F5hp0ZvjLU55eQR8.json
Requested by: Host: cdn.userway.org
URL: https://cdn.userway.org/widgetapp/2024-02-07-14-12-02/widget_app_base_1707315122285.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:6ea0:c700::17 Frankfurt am Main, Germany, ASN60068 (CDN77 _, GB),
Reverse DNS
Software: CDN77-Turbo /
Resource Hash: 3f37273d791716aa8633c33e58b59ac916a3764b2d35a00ea12f81bd517d549a

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.crowdstrike.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

x-77-pop: frankfurtDE
date: Tue, 13 Feb 2024 14:23:06 GMT
via: 1.1 6b2d62d60926d8d51fdcbcc94fce643a.cloudfront.net (CloudFront)
content-encoding: gzip
x-amz-cf-pop: DUS51-P1
x-amz-server-side-encryption: AES256
x-77-cache: HIT
x-cache: HIT
x-age: 10467
x-accel-date: 1707823719
x-77-nzt: EgwBnJIhiAH34ygAAAwBisclxAH31AMAAA
x-accel-expires: @1739358739
x-77-age: 11447
last-modified: Tue, 13 Feb 2024 11:12:14 GMT
server: CDN77-Turbo
etag: W/"9652136942aad407b8ca7cf816c08866"
x-77-nzt-ray: f6587a1db1ce5eb44a7bcb6574149e1a
access-control-max-age: 3000
vary: Accept-Encoding, Accept-Encoding
access-control-allow-methods: GET, HEAD, PUT, POST, DELETE
access-control-allow-origin: *
access-control-expose-headers: Content-Range, Content-Length, ETag, Content-Type
cache-control: public, max-age=31536000
content-type: application/json
x-amz-cf-id: msiTo1qcmvo4ZrJaTWHnjvbes_4S2YWDVeqYmEmkaeDaCXE2JH0OmA==

GET
H2 200 body_wh.svg
cdn.userway.org/widgetapp/images/ 4 KB
3 KB 42ms
41ms Image
image/svg+xml 2a02:6ea0:c700::17
CDN77 _

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.userway.org/widgetapp/images/body_wh.svg
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:6ea0:c700::17 Frankfurt am Main, Germany, ASN60068 (CDN77 _, GB),
Reverse DNS
Software: CDN77-Turbo /
Resource Hash: 21eb1e487c899c6192c31800445bfb81caa7ff1fca550ea3fdb3444834d85710

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.crowdstrike.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

x-77-pop: frankfurtDE
date: Tue, 13 Feb 2024 14:23:06 GMT
via: 1.1 fa8c9f29fb8ef5c537a2a53f4de05240.cloudfront.net (CloudFront)
content-encoding: gzip
x-amz-cf-pop: FRA60-P3
x-amz-server-side-encryption: AES256
x-77-cache: HIT
x-cache: HIT
x-age: 517732
x-accel-date: 1707316454
x-77-nzt: EgwBnJIhiAH3ZOYHAAwBJRPCNAH3YQMAAA
x-accel-expires: @1733235589
x-77-age: 518597
last-modified: Wed, 27 Dec 2023 13:17:34 GMT
server: CDN77-Turbo
etag: W/"1d8b1582fe82bd329041cc1982ad42e4"
x-77-nzt-ray: f6587a1df5d583af4a7bcb6540a3061c
access-control-max-age: 3000
vary: Accept-Encoding, Accept-Encoding
access-control-allow-methods: GET, HEAD, PUT, POST, DELETE
access-control-allow-origin: *
access-control-expose-headers: Content-Range, Content-Length, ETag, Content-Type
cache-control: max-age=25920000, public
content-type: image/svg+xml
x-amz-cf-id: dF6r-_v3mnmvS_xXrRjjtIRgbdPJhavOCGxWbWUo55XLob5Pg69Q4w==

GET
H2 200 spin_wh.svg
cdn.userway.org/widgetapp/images/ 2 KB
1 KB 42ms
42ms Image
image/svg+xml 2a02:6ea0:c700::17
CDN77 _

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.userway.org/widgetapp/images/spin_wh.svg
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:6ea0:c700::17 Frankfurt am Main, Germany, ASN60068 (CDN77 _, GB),
Reverse DNS
Software: CDN77-Turbo /
Resource Hash: c45f637f905e1ea01ba81aa39e8da62ee7e7f8703c3da4c3bba55f6192e5834c

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.crowdstrike.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

x-77-pop: frankfurtDE
date: Tue, 13 Feb 2024 14:23:06 GMT
via: 1.1 3296b04068551f925d5fafd1b785ff30.cloudfront.net (CloudFront)
content-encoding: gzip
x-amz-cf-pop: FRA60-P3
x-amz-server-side-encryption: AES256
x-77-cache: HIT
x-cache: HIT
x-age: 517732
x-accel-date: 1707316454
x-77-nzt: EgwBnJIhiAH3ZOYHAAwBJRPCMQH3YAMAAA
x-accel-expires: @1733235590
x-77-age: 518596
last-modified: Fri, 13 Jan 2023 11:00:14 GMT
server: CDN77-Turbo
etag: W/"8e0a35946bf39d10f46a1f1653366a0a"
x-77-nzt-ray: f6587a1df5d583af4a7bcb6563fd121c
access-control-max-age: 3000
vary: Accept-Encoding, Accept-Encoding
access-control-allow-methods: GET, HEAD, PUT, POST, DELETE
access-control-allow-origin: *
access-control-expose-headers: Content-Range, Content-Length, ETag, Content-Type
cache-control: max-age=25920000, public
content-type: image/svg+xml
x-amz-cf-id: k6zW_e0DVNz1F5sKpDUTn7cG2IF5_hr3i7zuRe1k6sYw_Y8jULYxqg==

GET
H2 200 remediation-tool.js Show response
cdn.userway.org/remediation/paid/ 49 KB
18 KB 44ms
43ms Script
application/javascript 2a02:6ea0:c700::17
CDN77 _

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.userway.org/remediation/paid/remediation-tool.js?ts=1707315122285
Requested by: Host: cdn.userway.org
URL: https://cdn.userway.org/widgetapp/2024-02-07-14-12-02/widget_app_base_1707315122285.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:6ea0:c700::17 Frankfurt am Main, Germany, ASN60068 (CDN77 _, GB),
Reverse DNS
Software: CDN77-Turbo /
Resource Hash: b8f9b0f28637041e05cd76c465d90599cb81e8845e4958b5da7517fda7e57982

Request headers

Referer: https://www.crowdstrike.com/
Origin: https://www.crowdstrike.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

x-77-pop: frankfurtDE
date: Tue, 13 Feb 2024 14:23:06 GMT
via: 1.1 b43c04a791e8dcb8ddb6bb0847fcf95a.cloudfront.net (CloudFront)
content-encoding: gzip
x-amz-cf-pop: FRA60-P3
age: 222
x-amz-server-side-encryption: AES256
x-77-cache: HIT
x-cache: HIT
x-age: 517730
x-accel-date: 1707316456
x-77-nzt: EgwBnJIhiAH3YuYHAAwBJRPCLgH3YwMAAA
x-accel-expires: @1733235589
x-77-age: 518597
last-modified: Wed, 07 Feb 2024 14:14:42 GMT
server: CDN77-Turbo
etag: W/"fd1af69dd4c552316ce8fc439e082ffe"
x-77-nzt-ray: f6587a1db1ce5eb44a7bcb65503caf22
access-control-max-age: 3000
vary: Accept-Encoding, Accept-Encoding
access-control-allow-methods: GET, HEAD, PUT, POST, DELETE
access-control-allow-origin: *
access-control-expose-headers: Content-Range, Content-Length, ETag, Content-Type
cache-control: max-age=25920000, public
content-type: application/javascript
x-amz-cf-id: qmIBmC7vZR3ekLNwkpwGRQjD4msw4vVXkEsi9ckirCSbdzAKoHPRGg==

GET
H2 200 F5hp0ZvjLU55eQR8.json Show response
cdn.userway.org/remediations/consolidated/2376540/ 791 KB
102 KB 42ms
42ms Fetch
application/json 2a02:6ea0:c700::17
CDN77 _

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.userway.org/remediations/consolidated/2376540/F5hp0ZvjLU55eQR8.json
Requested by: Host: cdn.userway.org
URL: https://cdn.userway.org/remediation/paid/remediation-tool.js?ts=1707315122285
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:6ea0:c700::17 Frankfurt am Main, Germany, ASN60068 (CDN77 _, GB),
Reverse DNS
Software: CDN77-Turbo /
Resource Hash: 3f37273d791716aa8633c33e58b59ac916a3764b2d35a00ea12f81bd517d549a

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.crowdstrike.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

x-77-pop: frankfurtDE
date: Tue, 13 Feb 2024 14:23:06 GMT
via: 1.1 6b2d62d60926d8d51fdcbcc94fce643a.cloudfront.net (CloudFront)
content-encoding: gzip
x-amz-cf-pop: DUS51-P1
x-amz-server-side-encryption: AES256
x-77-cache: HIT
x-cache: HIT
x-age: 10467
x-accel-date: 1707823719
x-77-nzt: EgwBnJIhiAH34ygAAAwBisclxAH31AMAAA
x-accel-expires: @1739358739
x-77-age: 11447
last-modified: Tue, 13 Feb 2024 11:12:14 GMT
server: CDN77-Turbo
etag: W/"9652136942aad407b8ca7cf816c08866"
x-77-nzt-ray: f6587a1db1ce5eb44a7bcb6584649225
access-control-max-age: 3000
vary: Accept-Encoding, Accept-Encoding
access-control-allow-methods: GET, HEAD, PUT, POST, DELETE
access-control-allow-origin: *
access-control-expose-headers: Content-Range, Content-Length, ETag, Content-Type
cache-control: public, max-age=31536000
content-type: application/json
x-amz-cf-id: msiTo1qcmvo4ZrJaTWHnjvbes_4S2YWDVeqYmEmkaeDaCXE2JH0OmA==

OPTIONS
H2 200 alts.json
cdn77.api.userway.org/api/img-dscr/v2/dyvvHf6oG0/2376540/BvBnLxcgsitibG0n/ 0
0 290ms
210ms Preflight 2a02:6ea0:c700::18
CDN77 _

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn77.api.userway.org/api/img-dscr/v2/dyvvHf6oG0/2376540/BvBnLxcgsitibG0n/alts.json?dto=%7B%22sorted%22%3A%5B%7B%22src%22%3A%22https%3A%2F%2Fwww.crowdstrike.com%2Fwp-content%2Fthemes%2Fmain-theme%2Fdist%2Fimages%2Flogos%2Fcrowdstrike%2FRedLogoCS.svg%22%2C%22alt%22%3A%22CrowdStrike%22%2C%22dir%22%3A%22RO%22%7D%5D%2C%22tier%22%3A%22PAID_QUOTA_TIER%22%7D
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:6ea0:c700::18 Frankfurt am Main, Germany, ASN60068 (CDN77 _, GB),
Reverse DNS
Software: CDN77-Turbo /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: GET
Origin: https://www.crowdstrike.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

access-control-allow-headers: *
access-control-allow-methods: GET, HEAD, PUT, PATCH, POST, DELETE
access-control-allow-origin: *
access-control-expose-headers: Content-Range, Content-Length, ETag, Content-Type
access-control-max-age: 3000
cache-control: max-age=604800
date: Tue, 13 Feb 2024 14:23:07 GMT
server: CDN77-Turbo
x-77-cache: MISS
x-77-nzt: EggBnJIhiwAACAElE8I0AAA
x-77-nzt-ray: cf87872748b7a0b04b7bcb65c7f50112
x-77-pop: frankfurtDE
x-service-version: img-dscr-srv-ca87f731

GET
H2 200 Figure3-1.png
www.crowdstrike.com/wp-content/uploads/2024/02/ 73 KB
74 KB 137ms
136ms Image
image/png 2606:4700::6810:1c08
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.crowdstrike.com/wp-content/uploads/2024/02/Figure3-1.png

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:1c08 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2d337c9c94494f96609802ab3dc4053ddc9edb3c64e7079ec34b232d58c81f25

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Tue, 13 Feb 2024 14:23:07 GMT
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 34435958fa6d40b77fd22fa1c1f56176.cloudfront.net (CloudFront)
cf-cache-status: HIT
x-amz-version-id: 0PBR0NwNWbGCQPMRZUp_aq7ngI2t8Gp0
age: 354
x-amz-cf-pop: FRA56-C2
cf-polished: status=not_needed
x-cache: Miss from cloudfront
content-length: 75263
last-modified: Wed, 07 Feb 2024 15:20:13 GMT
cf-bgj: imgq:85,h2pri
server: cloudflare
etag: "ad476e70b1463fb0ba0c9ae09b24402e-1"
vary: Accept-Encoding
content-type: image/png
cache-control: public, max-age=14400
accept-ranges: bytes
cf-ray: 854dba361dbe5d85-FRA
x-amz-cf-id: yneN_dd0zGFEah9U3M0gVQo3_Efq8yi_6ouc6TOPIkd3OElcD35GbA==
expires: Tue, 13 Feb 2024 18:23:07 GMT

GET
H2 200 alts.json Show response
cdn77.api.userway.org/api/img-dscr/v2/dyvvHf6oG0/2376540/BvBnLxcgsitibG0n/ 284 B
811 B 40ms
39ms Fetch
application/json 2a02:6ea0:c700::18
CDN77 _

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn77.api.userway.org/api/img-dscr/v2/dyvvHf6oG0/2376540/BvBnLxcgsitibG0n/alts.json?dto=%7B%22sorted%22%3A%5B%7B%22src%22%3A%22https%3A%2F%2Fwww.crowdstrike.com%2Fwp-content%2Fthemes%2Fmain-theme%2Fdist%2Fimages%2Flogos%2Fcrowdstrike%2FRedLogoCS.svg%22%2C%22alt%22%3A%22CrowdStrike%22%2C%22dir%22%3A%22RO%22%7D%5D%2C%22tier%22%3A%22PAID_QUOTA_TIER%22%7D
Requested by: Host: cdn.userway.org
URL: https://cdn.userway.org/remediation/paid/remediation-tool.js?ts=1707315122285
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:6ea0:c700::18 Frankfurt am Main, Germany, ASN60068 (CDN77 _, GB),
Reverse DNS
Software: CDN77-Turbo /
Resource Hash: cd24f5bed39abff3794a1239dba98000015195dce1486f8bfbcfc364417f49eb

Request headers

Referer: https://www.crowdstrike.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36
Content-Type: application/json

Response headers

x-77-pop: frankfurtDE
date: Tue, 13 Feb 2024 14:23:07 GMT
content-encoding: gzip
x-77-cache: HIT
x-cache: HIT
x-age: 517357
x-accel-date: 1707316830
x-service-version: img-dscr-srv-bad7d880
x-77-nzt: EgwBnJIhiwH37eQHAAwBJRPCNAH39VkGAA
x-accel-expires: @1707921234
x-77-age: 933602
server: CDN77-Turbo
etag: W/"11c-mqzrkG3g8ICAqtilMG3dKqjInKY"
x-77-nzt-ray: cf87872748b7a0b04b7bcb65facd971e
vary: Accept-Encoding, Accept-Encoding
access-control-allow-methods: GET, HEAD, PUT, PATCH, POST, DELETE
content-type: application/json; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: Content-Range, Content-Length, ETag, Content-Type
access-control-max-age: 3000
cache-control: max-age=604800
access-control-allow-headers: *

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
484 B 310ms
309ms Image
image/gif 2.17.22.194

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=840a4ffa1a26e59267b6b28298d972e1&svisitor=null&visitor=536b3338-88cd-4004-8882-5745a2645fe7&session=ff4f5878-bd94-421c-89e2-309d5fd2c65a&event=active_time_track&q=%7B%22currentTime%22%3A%22Tue%2C%2013%20Feb%202024%2014%3A23%3A07%20GMT%22%2C%22lastTrackTime%22%3A%22Tue%2C%2013%20Feb%202024%2014%3A23%3A06%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%222002%22%7D&isIframe=false&m=%7B%22description%22%3A%22Read%20this%20blog%20to%20learn%20about%20the%20HijackLoader%20sample%20that%20employs%20sophisticated%20evasion%20techniques%20to%20enhance%20the%20complexity%20of%20the%20threat.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22HijackLoader%20Expands%20Techniques%20to%20Improve%20Defense%20Evasion%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.crowdstrike.com%2Fblog%2Fhijackloader-expands-techniques%2F&pageViewId=a9582c50-f1da-433d-8b01-7093cff49d59&an_uid=0&v=1.1.14

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.17.22.194 Düsseldorf, Germany, ASN (),

Reverse DNS

a2-17-22-194.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.crowdstrike.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Tue, 13 Feb 2024 14:23:07 GMT
x-content-type-options: nosniff
content-length: 43
pragma: no-cache
last-modified: Tue, 05 Oct 2021 22:17:52 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "615ccf10-2b"
access-control-max-age: 86400
access-control-allow-methods: GET,POST
content-type: image/gif
access-control-allow-origin
cache-control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: *
expires: Wed, 19 Apr 2000 11:43:00 GMT

GET
H2 200 nav_menu_helper_1707315122285.js Show response
cdn.userway.org/widgetapp/2024-02-07-14-12-02/remediation/ 23 KB
7 KB 40ms
39ms Script
application/javascript 2a02:6ea0:c700::17
CDN77 _

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.userway.org/widgetapp/2024-02-07-14-12-02/remediation/nav_menu_helper_1707315122285.js
Requested by: Host: cdn.userway.org
URL: https://cdn.userway.org/widgetapp/2024-02-07-14-12-02/widget_app_base_1707315122285.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:6ea0:c700::17 Frankfurt am Main, Germany, ASN60068 (CDN77 _, GB),
Reverse DNS
Software: CDN77-Turbo /
Resource Hash: 37f8550406bebf8003ec760c4c81fbe861e3d38a5bbbd069ae9d60358710f038

Request headers

Referer: https://www.crowdstrike.com/
Origin: https://www.crowdstrike.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

x-77-pop: frankfurtDE
date: Tue, 13 Feb 2024 14:23:07 GMT
via: 1.1 5492e1c9a06f2320204e7fcc383cff5c.cloudfront.net (CloudFront)
content-encoding: gzip
x-amz-cf-pop: FRA60-P3
age: 222
x-amz-server-side-encryption: AES256
x-77-cache: HIT
x-cache: HIT
x-age: 517730
x-accel-date: 1707316457
x-77-nzt: EgwBnJIhiAH3YuYHAAwBJRPCNAH3YwMAAA
x-accel-expires: @1733235590
x-77-age: 518597
last-modified: Wed, 07 Feb 2024 14:14:37 GMT
server: CDN77-Turbo
etag: W/"f270f813f648a284d50fe8f345c21bdc"
x-77-nzt-ray: f6587a1db1ce5eb44b7bcb6526dcb722
access-control-max-age: 3000
vary: Accept-Encoding, Accept-Encoding
access-control-allow-methods: GET, HEAD, PUT, POST, DELETE
access-control-allow-origin: *
access-control-expose-headers: Content-Range, Content-Length, ETag, Content-Type
cache-control: max-age=25920000, public
content-type: application/javascript
x-amz-cf-id: SpuibV-kLLAo6nbF8hEzMwxksP8yvSauidcuGL1MIEZjWGfIKxhr0Q==

OPTIONS
H2 200 alts.json
cdn77.api.userway.org/api/img-dscr/v2/dyvvHf6oG0/2376540/BvBnLxcgsitibG0n/ 0
0 584ms
583ms Preflight 2a02:6ea0:c700::18
CDN77 _

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn77.api.userway.org/api/img-dscr/v2/dyvvHf6oG0/2376540/BvBnLxcgsitibG0n/alts.json?dto=%7B%22sorted%22%3A%5B%7B%22src%22%3A%22https%3A%2F%2Fcdn.cookielaw.org%2Flogos%2Fc109dae9-46f3-4e91-a59e-7844ef645107%2Fcad7e755-8c86-4939-8df1-4d68f074f0fc%2F53cb332e-5cc4-44a8-9590-9e086136bfe9%2FCS_Logos_2020_InlineRed_b.png%22%2C%22alt%22%3A%22Company%20Logo%22%2C%22dir%22%3A%22RO%22%7D%2C%7B%22src%22%3A%22https%3A%2F%2Fcdn.cookielaw.org%2Flogos%2Fstatic%2Fpowered_by_logo.svg%22%2C%22alt%22%3A%22Powered%20by%20Onetrust%22%2C%22dir%22%3A%22RO%22%7D%2C%7B%22src%22%3A%22https%3A%2F%2Fwww.crowdstrike.com%2Fwp-content%2Fuploads%2F2016%2F03%2FBlue.jpg%22%2C%22alt%22%3A%22%22%2C%22dir%22%3A%22RO%22%7D%2C%7B%22src%22%3A%22https%3A%2F%2Fwww.crowdstrike.com%2Fwp-content%2Fuploads%2F2016%2F07%2FTechCenter-2.jpg%22%2C%22alt%22%3A%22%22%2C%22dir%22%3A%22RO%22%7D%2C%7B%22src%22%3A%22https%3A%2F%2Fwww.crowdstrike.com%2Fwp-content%2Fuploads%2F2019%2F04%2FBlog-Image-CredTheft-Demo-1.png%22%2C%22alt%22%3A%22%22%2C%22dir%22%3A%22RO%22%7D%2C%7B%22src%22%3A%22https%3A%2F%2Fwww.crowdstrike.com%2Fwp-content%2Fuploads%2F2019%2F04%2FBlog-Image-Delivery-Demo2-1.png%22%2C%22alt%22%3A%22%22%2C%22dir%22%3A%22RO%22%7D%2C%7B%22src%22%3A%22https%3A%2F%2Fwww.crowdstrike.com%2Fwp-content%2Fuploads%2F2019%2F04%2FBlog-Image-Priv-Esca-Demo2-1.png%22%2C%22alt%22%3A%22%22%2C%22dir%22%3A%22RO%22%7D%2C%7B%22src%22%3A%22https%3A%2F%2Fwww.crowdstrike.com%2Fwp-content%2Fuploads%2F2019%2F12%2FIR-Video-Blog-1.jpg%22%2C%22alt%22%3A%22%22%2C%22dir%22%3A%22RO%22%7D%2C%7B%22src%22%3A%22https%3A%2F%2Fwww.crowdstrike.com%2Fwp-content%2Fuploads%2F2020%2F10%2FBlog_FB_1200x630-1.jpg%22%2C%22alt%22%3A%22%22%2C%22dir%22%3A%22RO%22%7D%2C%7B%22src%22%3A%22https%3A%2F%2Fwww.crowdstrike.com%2Fwp-content%2Fuploads%2F2021%2F02%2Fmapping-it-out-1.jpg%22%2C%22alt%22%3A%22%22%2C%22dir%22%3A%22RO%22%7D%2C%7B%22src%22%3A%22https%3A%2F%2Fwww.crowdstrike.com%2Fwp-content%2Fuploads%2F2021%2F03%2FGo-Beyond-the-Perimeter-1.jpg%22%2C%22alt%22%3A%22%22%2C%22dir%22%3A%22RO%22%7D%2C%7B%22src%22%3A%22https%3A%2F%2Fwww.crowdstrike.com%2Fwp-content%2Fuploads%2F2021%2F03%2Fmentorships-1.jpg%22%2C%22alt%22%3A%22%22%2C%22dir%22%3A%22RO%22%7D%2C%7B%22src%22%3A%22https%3A%2F%2Fwww.crowdstrike.com%2Fwp-content%2Fuploads%2F2021%2F03%2Fwomens-history-month-1.jpg%22%2C%22alt%22%3A%22%22%2C%22dir%22%3A%22RO%22%7D%2C%7B%22src%22%3A%22https%3A%2F%2Fwww.crowdstrike.com%2Fwp-content%2Fuploads%2F2021%2F05%2FCS_EY_Blog_1060x698_v2-1.jpeg%22%2C%22alt%22%3A%22%22%2C%22dir%22%3A%22RO%22%7D%2C%7B%22src%22%3A%22https%3A%2F%2Fwww.crowdstrike.com%2Fwp-content%2Fuploads%2F2021%2F07%2Fbreaches-stop-here-post-cta.jpeg%22%2C%22alt%22%3A%22%22%7D%2C%7B%22src%22%3A%22https%3A%2F%2Fwww.crowdstrike.com%2Fwp-content%2Fuploads%2F2021%2F07%2FCS_Free_Trial_blog_300x600_final.jpg%22%2C%22alt%22%3A%22%22%7D%2C%7B%22src%22%3A%22https%3A%2F%2Fwww.crowdstrike.com%2Fwp-content%2Fuploads%2F2021%2F07%2Fred-falcon.svg%22%2C%22alt%22%3A%22%22%2C%22dir%22%3A%22RO%22%7D%2C%7B%22src%22%3A%22https%3A%2F%2Fwww.crowdstrike.com%2Fwp-content%2Fuploads%2F2021%2F09%2FBlog_1060x698-18.jpeg%22%2C%22alt%22%3A%22%22%2C%22dir%22%3A%22RO%22%7D%2C%7B%22src%22%3A%22https%3A%2F%2Fwww.crowdstrike.com%2Fwp-content%2Fuploads%2F2021%2F09%2FBlog_1060x698-4.jpeg%22%2C%22alt%22%3A%22%22%2C%22dir%22%3A%22RO%22%7D%2C%7B%22src%22%3A%22https%3A%2F%2Fwww.crowdstrike.com%2Fwp-content%2Fuploads%2F2021%2F10%2FBlog_1060x698-2.jpeg%22%2C%22alt%22%3A%22%22%2C%22dir%22%3A%22RO%22%7D%2C%7B%22src%22%3A%22https%3A%2F%2Fwww.crowdstrike.com%2Fwp-content%2Fuploads%2F2021%2F12%2FBlog-1.jpeg%22%2C%22alt%22%3A%22%22%2C%22dir%22%3A%22RO%22%7D%2C%7B%22src%22%3A%22https%3A%2F%2Fwww.crowdstrike.com%2Fwp-content%2Fuploads%2F2022%2F01%2FBlog_1060x698-8.jpeg%22%2C%22alt%22%3A%22%22%2C%22dir%22%3A%22RO%22%7D%2C%7B%22src%22%3A%22https%3A%2F%2Fwww.crowdstrike.com%2Fwp-content%2Fuploads%2F2022%2F02%2F0222_03_Falcon_Platform_Blog_1060x698.jpeg%22%2C%22alt%22%3A%22%22%2C%22dir%22%3A%22RO%22%7D%2C%7B%22src%22%3A%22https%3A%2F%2Fwww.crowdstrike.com%2Fwp-content%2Fuploads%2F2022%2F08%2FBlog_1060x698.jpeg%22%2C%22alt%22%3A%22%22%2C%22dir%22%3A%22RO%22%7D%2C%7B%22src%22%3A%22https%3A%2F%2Fwww.crowdstrike.com%2Fwp-content%2Fuploads%2F2022%2F11%2FXXXX_Falcon-LogScale-So-Fast_Blog_1060x698.jpeg%22%2C%22alt%22%3A%22%22%2C%22dir%22%3A%22RO%22%7D%2C%7B%22src%22%3A%22https%3A%2F%2Fwww.crowdstrike.com%2Fwp-content%2Fuploads%2F2022%2F12%2FBlog_1060x698-3.jpeg%22%2C%22alt%22%3A%22%22%2C%22dir%22%3A%22RO%22%7D%2C%7B%22src%22%3A%22https%3A%2F%2Fwww.crowdstrike.com%2Fwp-content%2Fuploads%2F2023%2F01%2F0123_03_MLK-Day-2023_Blog_1060x698_V1.jpg%22%2C%22alt%22%3A%22%22%2C%22dir%22%3A%22RO%22%7D%2C%7B%22src%22%3A%22https%3A%2F%2Fwww.crowdstrike.com%2Fwp-content%2Fuploads%2F2023%2F01%2F0123_06_Linux-Container-Escapes_Blog_1060x698.jpg%22%2C%22alt%22%3A%22%22%7D%5D%2C%22tier%22%3A%22PAID_QUOTA_TIER%22%7D
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:6ea0:c700::18 Frankfurt am Main, Germany, ASN60068 (CDN77 _, GB),
Reverse DNS
Software: CDN77-Turbo /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: GET
Origin: https://www.crowdstrike.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

access-control-allow-headers: *
access-control-allow-methods: GET, HEAD, PUT, PATCH, POST, DELETE
access-control-allow-origin: *
access-control-expose-headers: Content-Range, Content-Length, ETag, Content-Type
access-control-max-age: 3000
cache-control: max-age=604800
date: Tue, 13 Feb 2024 14:23:08 GMT
server: CDN77-Turbo
x-77-cache: MISS
x-77-nzt: EggBnJIhiwAACAGKxyXBAAA
x-77-nzt-ray: cf87872748b7a0b04c7bcb65501a7216
x-77-pop: frankfurtDE
x-service-version: img-dscr-srv-ca87f731

GET
H2 200 alts.json Show response
cdn77.api.userway.org/api/img-dscr/v2/dyvvHf6oG0/2376540/BvBnLxcgsitibG0n/ 6 KB
2 KB 40ms
40ms Fetch
application/json 2a02:6ea0:c700::18
CDN77 _

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn77.api.userway.org/api/img-dscr/v2/dyvvHf6oG0/2376540/BvBnLxcgsitibG0n/alts.json?dto=%7B%22sorted%22%3A%5B%7B%22src%22%3A%22https%3A%2F%2Fcdn.cookielaw.org%2Flogos%2Fc109dae9-46f3-4e91-a59e-7844ef645107%2Fcad7e755-8c86-4939-8df1-4d68f074f0fc%2F53cb332e-5cc4-44a8-9590-9e086136bfe9%2FCS_Logos_2020_InlineRed_b.png%22%2C%22alt%22%3A%22Company%20Logo%22%2C%22dir%22%3A%22RO%22%7D%2C%7B%22src%22%3A%22https%3A%2F%2Fcdn.cookielaw.org%2Flogos%2Fstatic%2Fpowered_by_logo.svg%22%2C%22alt%22%3A%22Powered%20by%20Onetrust%22%2C%22dir%22%3A%22RO%22%7D%2C%7B%22src%22%3A%22https%3A%2F%2Fwww.crowdstrike.com%2Fwp-content%2Fuploads%2F2016%2F03%2FBlue.jpg%22%2C%22alt%22%3A%22%22%2C%22dir%22%3A%22RO%22%7D%2C%7B%22src%22%3A%22https%3A%2F%2Fwww.crowdstrike.com%2Fwp-content%2Fuploads%2F2016%2F07%2FTechCenter-2.jpg%22%2C%22alt%22%3A%22%22%2C%22dir%22%3A%22RO%22%7D%2C%7B%22src%22%3A%22https%3A%2F%2Fwww.crowdstrike.com%2Fwp-content%2Fuploads%2F2019%2F04%2FBlog-Image-CredTheft-Demo-1.png%22%2C%22alt%22%3A%22%22%2C%22dir%22%3A%22RO%22%7D%2C%7B%22src%22%3A%22https%3A%2F%2Fwww.crowdstrike.com%2Fwp-content%2Fuploads%2F2019%2F04%2FBlog-Image-Delivery-Demo2-1.png%22%2C%22alt%22%3A%22%22%2C%22dir%22%3A%22RO%22%7D%2C%7B%22src%22%3A%22https%3A%2F%2Fwww.crowdstrike.com%2Fwp-content%2Fuploads%2F2019%2F04%2FBlog-Image-Priv-Esca-Demo2-1.png%22%2C%22alt%22%3A%22%22%2C%22dir%22%3A%22RO%22%7D%2C%7B%22src%22%3A%22https%3A%2F%2Fwww.crowdstrike.com%2Fwp-content%2Fuploads%2F2019%2F12%2FIR-Video-Blog-1.jpg%22%2C%22alt%22%3A%22%22%2C%22dir%22%3A%22RO%22%7D%2C%7B%22src%22%3A%22https%3A%2F%2Fwww.crowdstrike.com%2Fwp-content%2Fuploads%2F2020%2F10%2FBlog_FB_1200x630-1.jpg%22%2C%22alt%22%3A%22%22%2C%22dir%22%3A%22RO%22%7D%2C%7B%22src%22%3A%22https%3A%2F%2Fwww.crowdstrike.com%2Fwp-content%2Fuploads%2F2021%2F02%2Fmapping-it-out-1.jpg%22%2C%22alt%22%3A%22%22%2C%22dir%22%3A%22RO%22%7D%2C%7B%22src%22%3A%22https%3A%2F%2Fwww.crowdstrike.com%2Fwp-content%2Fuploads%2F2021%2F03%2FGo-Beyond-the-Perimeter-1.jpg%22%2C%22alt%22%3A%22%22%2C%22dir%22%3A%22RO%22%7D%2C%7B%22src%22%3A%22https%3A%2F%2Fwww.crowdstrike.com%2Fwp-content%2Fuploads%2F2021%2F03%2Fmentorships-1.jpg%22%2C%22alt%22%3A%22%22%2C%22dir%22%3A%22RO%22%7D%2C%7B%22src%22%3A%22https%3A%2F%2Fwww.crowdstrike.com%2Fwp-content%2Fuploads%2F2021%2F03%2Fwomens-history-month-1.jpg%22%2C%22alt%22%3A%22%22%2C%22dir%22%3A%22RO%22%7D%2C%7B%22src%22%3A%22https%3A%2F%2Fwww.crowdstrike.com%2Fwp-content%2Fuploads%2F2021%2F05%2FCS_EY_Blog_1060x698_v2-1.jpeg%22%2C%22alt%22%3A%22%22%2C%22dir%22%3A%22RO%22%7D%2C%7B%22src%22%3A%22https%3A%2F%2Fwww.crowdstrike.com%2Fwp-content%2Fuploads%2F2021%2F07%2Fbreaches-stop-here-post-cta.jpeg%22%2C%22alt%22%3A%22%22%7D%2C%7B%22src%22%3A%22https%3A%2F%2Fwww.crowdstrike.com%2Fwp-content%2Fuploads%2F2021%2F07%2FCS_Free_Trial_blog_300x600_final.jpg%22%2C%22alt%22%3A%22%22%7D%2C%7B%22src%22%3A%22https%3A%2F%2Fwww.crowdstrike.com%2Fwp-content%2Fuploads%2F2021%2F07%2Fred-falcon.svg%22%2C%22alt%22%3A%22%22%2C%22dir%22%3A%22RO%22%7D%2C%7B%22src%22%3A%22https%3A%2F%2Fwww.crowdstrike.com%2Fwp-content%2Fuploads%2F2021%2F09%2FBlog_1060x698-18.jpeg%22%2C%22alt%22%3A%22%22%2C%22dir%22%3A%22RO%22%7D%2C%7B%22src%22%3A%22https%3A%2F%2Fwww.crowdstrike.com%2Fwp-content%2Fuploads%2F2021%2F09%2FBlog_1060x698-4.jpeg%22%2C%22alt%22%3A%22%22%2C%22dir%22%3A%22RO%22%7D%2C%7B%22src%22%3A%22https%3A%2F%2Fwww.crowdstrike.com%2Fwp-content%2Fuploads%2F2021%2F10%2FBlog_1060x698-2.jpeg%22%2C%22alt%22%3A%22%22%2C%22dir%22%3A%22RO%22%7D%2C%7B%22src%22%3A%22https%3A%2F%2Fwww.crowdstrike.com%2Fwp-content%2Fuploads%2F2021%2F12%2FBlog-1.jpeg%22%2C%22alt%22%3A%22%22%2C%22dir%22%3A%22RO%22%7D%2C%7B%22src%22%3A%22https%3A%2F%2Fwww.crowdstrike.com%2Fwp-content%2Fuploads%2F2022%2F01%2FBlog_1060x698-8.jpeg%22%2C%22alt%22%3A%22%22%2C%22dir%22%3A%22RO%22%7D%2C%7B%22src%22%3A%22https%3A%2F%2Fwww.crowdstrike.com%2Fwp-content%2Fuploads%2F2022%2F02%2F0222_03_Falcon_Platform_Blog_1060x698.jpeg%22%2C%22alt%22%3A%22%22%2C%22dir%22%3A%22RO%22%7D%2C%7B%22src%22%3A%22https%3A%2F%2Fwww.crowdstrike.com%2Fwp-content%2Fuploads%2F2022%2F08%2FBlog_1060x698.jpeg%22%2C%22alt%22%3A%22%22%2C%22dir%22%3A%22RO%22%7D%2C%7B%22src%22%3A%22https%3A%2F%2Fwww.crowdstrike.com%2Fwp-content%2Fuploads%2F2022%2F11%2FXXXX_Falcon-LogScale-So-Fast_Blog_1060x698.jpeg%22%2C%22alt%22%3A%22%22%2C%22dir%22%3A%22RO%22%7D%2C%7B%22src%22%3A%22https%3A%2F%2Fwww.crowdstrike.com%2Fwp-content%2Fuploads%2F2022%2F12%2FBlog_1060x698-3.jpeg%22%2C%22alt%22%3A%22%22%2C%22dir%22%3A%22RO%22%7D%2C%7B%22src%22%3A%22https%3A%2F%2Fwww.crowdstrike.com%2Fwp-content%2Fuploads%2F2023%2F01%2F0123_03_MLK-Day-2023_Blog_1060x698_V1.jpg%22%2C%22alt%22%3A%22%22%2C%22dir%22%3A%22RO%22%7D%2C%7B%22src%22%3A%22https%3A%2F%2Fwww.crowdstrike.com%2Fwp-content%2Fuploads%2F2023%2F01%2F0123_06_Linux-Container-Escapes_Blog_1060x698.jpg%22%2C%22alt%22%3A%22%22%7D%5D%2C%22tier%22%3A%22PAID_QUOTA_TIER%22%7D
Requested by: Host: cdn.userway.org
URL: https://cdn.userway.org/remediation/paid/remediation-tool.js?ts=1707315122285
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:6ea0:c700::18 Frankfurt am Main, Germany, ASN60068 (CDN77 _, GB),
Reverse DNS
Software: CDN77-Turbo /
Resource Hash: f2c08d33847eaa68e859967176468981e9113c0c10ce2434e9519e0059e4b48a

Request headers

Referer: https://www.crowdstrike.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36
Content-Type: application/json

Response headers

x-77-pop: frankfurtDE
date: Tue, 13 Feb 2024 14:23:08 GMT
content-encoding: gzip
x-77-cache: HIT
x-cache: HIT
x-age: 284
x-accel-date: 1707833904
x-service-version: img-dscr-srv-ca87f731
x-77-nzt: EgwBnJIhiwH3HAEAAAwBisclwQH3k8YEAA
x-accel-expires: @1708125725
x-77-age: 313263
server: CDN77-Turbo
etag: W/"17ba-ysWwAemf1rArBvusGtBJ6V6lou8"
x-77-nzt-ray: cf87872748b7a0b04c7bcb6578c11739
vary: Accept-Encoding, Accept-Encoding
access-control-allow-methods: GET, HEAD, PUT, PATCH, POST, DELETE
content-type: application/json; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: Content-Range, Content-Length, ETag, Content-Type
access-control-max-age: 3000
cache-control: max-age=604800
access-control-allow-headers: *

GET
H2 200 alts.json Show response
cdn77.api.userway.org/api/img-dscr/v2/dyvvHf6oG0/2376540/BvBnLxcgsitibG0n/ 6 KB
2 KB 40ms
40ms Fetch
application/json 2a02:6ea0:c700::18
CDN77 _

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn77.api.userway.org/api/img-dscr/v2/dyvvHf6oG0/2376540/BvBnLxcgsitibG0n/alts.json?dto=%7B%22sorted%22%3A%5B%7B%22src%22%3A%22https%3A%2F%2Fwww.crowdstrike.com%2Fwp-content%2Fuploads%2F2023%2F01%2F0123_09_SMB-Malware-Attacks_Blog_1060x698.jpeg%22%2C%22alt%22%3A%22%22%2C%22dir%22%3A%22RO%22%7D%2C%7B%22src%22%3A%22https%3A%2F%2Fwww.crowdstrike.com%2Fwp-content%2Fuploads%2F2023%2F01%2FBlog_1060x698-1-1.jpeg%22%2C%22alt%22%3A%22%22%2C%22dir%22%3A%22RO%22%7D%2C%7B%22src%22%3A%22https%3A%2F%2Fwww.crowdstrike.com%2Fwp-content%2Fuploads%2F2023%2F02%2F0123_11_DLL-Sideloading_Advanced-Memory-Scanning_Blog_1060x698.jpeg%22%2C%22alt%22%3A%22%22%2C%22dir%22%3A%22RO%22%7D%2C%7B%22src%22%3A%22https%3A%2F%2Fwww.crowdstrike.com%2Fwp-content%2Fuploads%2F2023%2F02%2F0223_01_Audits-Centralized-Log-Mgmt_Blog_1060x698.jpg%22%2C%22alt%22%3A%22%22%2C%22dir%22%3A%22RO%22%7D%2C%7B%22src%22%3A%22https%3A%2F%2Fwww.crowdstrike.com%2Fwp-content%2Fuploads%2F2023%2F03%2F0322_02_Reinventing_MDRIDP_Blog_1060x698.jpeg%22%2C%22alt%22%3A%22%22%2C%22dir%22%3A%22RO%22%7D%2C%7B%22src%22%3A%22https%3A%2F%2Fwww.crowdstrike.com%2Fwp-content%2Fuploads%2F2023%2F05%2F0523_01_APAC-Cross-Boarder-Transfer-Systems_03.jpg%22%2C%22alt%22%3A%22%22%2C%22dir%22%3A%22RO%22%7D%2C%7B%22src%22%3A%22https%3A%2F%2Fwww.crowdstrike.com%2Fwp-content%2Fuploads%2F2023%2F05%2F23-SRV-013_Forrester-Wave_MDR_2023_Blog_1060x698_V1.jpg%22%2C%22alt%22%3A%22%22%2C%22dir%22%3A%22RO%22%7D%2C%7B%22src%22%3A%22https%3A%2F%2Fwww.crowdstrike.com%2Fwp-content%2Fuploads%2F2023%2F06%2F23-OTH-060_adversary-5-panda-china.png%22%2C%22alt%22%3A%22%22%2C%22dir%22%3A%22RO%22%7D%2C%7B%22src%22%3A%22https%3A%2F%2Fwww.crowdstrike.com%2Fwp-content%2Fuploads%2F2023%2F06%2FFalcon-X-Recon-featured-image-1.jpg%22%2C%22alt%22%3A%22%22%2C%22dir%22%3A%22RO%22%7D%2C%7B%22src%22%3A%22https%3A%2F%2Fwww.crowdstrike.com%2Fwp-content%2Fuploads%2F2023%2F08%2F0823_01_MSFT-Windows-Restart-Manager.jpg%22%2C%22alt%22%3A%22%22%2C%22dir%22%3A%22RO%22%7D%2C%7B%22src%22%3A%22https%3A%2F%2Fwww.crowdstrike.com%2Fwp-content%2Fuploads%2F2023%2F09%2F0923_03_LogScale_ThreatHunting_Chrome.jpg%22%2C%22alt%22%3A%22%22%2C%22dir%22%3A%22RO%22%7D%2C%7B%22src%22%3A%22https%3A%2F%2Fwww.crowdstrike.com%2Fwp-content%2Fuploads%2F2023%2F09%2FMITRE-100_Blog_01.jpg%22%2C%22alt%22%3A%22%22%2C%22dir%22%3A%22RO%22%7D%2C%7B%22src%22%3A%22https%3A%2F%2Fwww.crowdstrike.com%2Fwp-content%2Fuploads%2F2023%2F10%2F0122_03_IR_Tracker_for_DFIR_Community.jpg%22%2C%22alt%22%3A%22%22%2C%22dir%22%3A%22RO%22%7D%2C%7B%22src%22%3A%22https%3A%2F%2Fwww.crowdstrike.com%2Fwp-content%2Fuploads%2F2023%2F11%2F1123_02_Holiday-Access-Brokers.jpg%22%2C%22alt%22%3A%22%22%2C%22dir%22%3A%22RO%22%7D%2C%7B%22src%22%3A%22https%3A%2F%2Fwww.crowdstrike.com%2Fwp-content%2Fuploads%2F2023%2F11%2F1123_05_Ai-Powered-Protection-for-SMB_V2.jpg%22%2C%22alt%22%3A%22%22%2C%22dir%22%3A%22RO%22%7D%2C%7B%22src%22%3A%22https%3A%2F%2Fwww.crowdstrike.com%2Fwp-content%2Fuploads%2F2023%2F11%2F23-OTH-060_adversary-1-kitten-iran.png%22%2C%22alt%22%3A%22%22%2C%22dir%22%3A%22RO%22%7D%2C%7B%22src%22%3A%22https%3A%2F%2Fwww.crowdstrike.com%2Fwp-content%2Fuploads%2F2023%2F12%2F0222_05_FalconFusion_Ransomware_Malware.jpg%22%2C%22alt%22%3A%22%22%2C%22dir%22%3A%22RO%22%7D%2C%7B%22src%22%3A%22https%3A%2F%2Fwww.crowdstrike.com%2Fwp-content%2Fuploads%2F2023%2F12%2F1123_08_Insider-Vulnerabilities.jpg%22%2C%22alt%22%3A%22%22%2C%22dir%22%3A%22RO%22%7D%2C%7B%22src%22%3A%22https%3A%2F%2Fwww.crowdstrike.com%2Fwp-content%2Fuploads%2F2024%2F01%2F0124_02_FalconFund-Partners-with-Aembit.jpg%22%2C%22alt%22%3A%22%22%2C%22dir%22%3A%22RO%22%7D%2C%7B%22src%22%3A%22https%3A%2F%2Fwww.crowdstrike.com%2Fwp-content%2Fuploads%2F2024%2F01%2F2310-cmp-pc-blog-multiple-posts-1060x698-final-illustration.jpg%22%2C%22alt%22%3A%22%22%2C%22dir%22%3A%22RO%22%7D%2C%7B%22src%22%3A%22https%3A%2F%2Fwww.crowdstrike.com%2Fwp-content%2Fuploads%2F2024%2F01%2F24-CLD-001_Forrester-CWS-Wave_Blog-1.png%22%2C%22alt%22%3A%22%22%2C%22dir%22%3A%22RO%22%7D%2C%7B%22src%22%3A%22https%3A%2F%2Fwww.crowdstrike.com%2Fwp-content%2Fuploads%2F2024%2F01%2FGeneric_Blogs_Cloud_Security-1.png%22%2C%22alt%22%3A%22%22%2C%22dir%22%3A%22RO%22%7D%2C%7B%22src%22%3A%22https%3A%2F%2Fwww.crowdstrike.com%2Fwp-content%2Fuploads%2F2024%2F02%2F0124_01_Cs-Defends-Against-Azure-Attacks.jpg%22%2C%22alt%22%3A%22%22%2C%22dir%22%3A%22RO%22%7D%2C%7B%22src%22%3A%22https%3A%2F%2Fwww.crowdstrike.com%2Fwp-content%2Fuploads%2F2024%2F02%2Fapp-security-report-blog-post-art.jpg%22%2C%22alt%22%3A%22%22%2C%22dir%22%3A%22RO%22%7D%2C%7B%22src%22%3A%22https%3A%2F%2Fwww.crowdstrike.com%2Fwp-content%2Fuploads%2F2024%2F02%2FFigure1-2.png%22%2C%22alt%22%3A%22%22%2C%22dir%22%3A%22RO%22%7D%2C%7B%22src%22%3A%22https%3A%2F%2Fwww.crowdstrike.com%2Fwp-content%2Fuploads%2F2024%2F02%2FFigure2a.png%22%2C%22alt%22%3A%22%22%2C%22dir%22%3A%22RO%22%7D%2C%7B%22src%22%3A%22https%3A%2F%2Fwww.crowdstrike.com%2Fwp-content%2Fuploads%2F2024%2F02%2FFigure3-1.png%22%2C%22alt%22%3A%22%22%2C%22dir%22%3A%22RO%22%7D%5D%2C%22tier%22%3A%22PAID_QUOTA_TIER%22%7D
Requested by: Host: cdn.userway.org
URL: https://cdn.userway.org/remediation/paid/remediation-tool.js?ts=1707315122285
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:6ea0:c700::18 Frankfurt am Main, Germany, ASN60068 (CDN77 _, GB),
Reverse DNS
Software: CDN77-Turbo /
Resource Hash: be396212b50003f563af6040d9d0a9ffc403a2bcbeadb918fc6a777f65323c1c

Request headers

Referer: https://www.crowdstrike.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36
Content-Type: application/json

Response headers

x-77-pop: frankfurtDE
date: Tue, 13 Feb 2024 14:23:08 GMT
content-encoding: gzip
x-77-cache: HIT
x-cache: MISS
x-accel-date: 1707833744
x-service-version: img-dscr-srv-ca87f731
x-77-nzt: EggBnJIhiwFBDAGKxyXEAfe8AQAA
x-accel-expires: @1708438544
x-77-age: 444
server: CDN77-Turbo
etag: W/"1769-BI9VSGlwxwrpUfyQKqTT5Zu0CHE"
x-77-nzt-ray: cf87872748b7a0b04c7bcb6508c11923
vary: Accept-Encoding, Accept-Encoding
access-control-allow-methods: GET, HEAD, PUT, PATCH, POST, DELETE
content-type: application/json; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: Content-Range, Content-Length, ETag, Content-Type
access-control-max-age: 3000
cache-control: max-age=604800
access-control-allow-headers: *

OPTIONS
H2 200 alts.json
cdn77.api.userway.org/api/img-dscr/v2/dyvvHf6oG0/2376540/BvBnLxcgsitibG0n/ 0
0 215ms
215ms Preflight 2a02:6ea0:c700::18
CDN77 _

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn77.api.userway.org/api/img-dscr/v2/dyvvHf6oG0/2376540/BvBnLxcgsitibG0n/alts.json?dto=%7B%22sorted%22%3A%5B%7B%22src%22%3A%22https%3A%2F%2Fwww.crowdstrike.com%2Fwp-content%2Fuploads%2F2023%2F01%2F0123_09_SMB-Malware-Attacks_Blog_1060x698.jpeg%22%2C%22alt%22%3A%22%22%2C%22dir%22%3A%22RO%22%7D%2C%7B%22src%22%3A%22https%3A%2F%2Fwww.crowdstrike.com%2Fwp-content%2Fuploads%2F2023%2F01%2FBlog_1060x698-1-1.jpeg%22%2C%22alt%22%3A%22%22%2C%22dir%22%3A%22RO%22%7D%2C%7B%22src%22%3A%22https%3A%2F%2Fwww.crowdstrike.com%2Fwp-content%2Fuploads%2F2023%2F02%2F0123_11_DLL-Sideloading_Advanced-Memory-Scanning_Blog_1060x698.jpeg%22%2C%22alt%22%3A%22%22%2C%22dir%22%3A%22RO%22%7D%2C%7B%22src%22%3A%22https%3A%2F%2Fwww.crowdstrike.com%2Fwp-content%2Fuploads%2F2023%2F02%2F0223_01_Audits-Centralized-Log-Mgmt_Blog_1060x698.jpg%22%2C%22alt%22%3A%22%22%2C%22dir%22%3A%22RO%22%7D%2C%7B%22src%22%3A%22https%3A%2F%2Fwww.crowdstrike.com%2Fwp-content%2Fuploads%2F2023%2F03%2F0322_02_Reinventing_MDRIDP_Blog_1060x698.jpeg%22%2C%22alt%22%3A%22%22%2C%22dir%22%3A%22RO%22%7D%2C%7B%22src%22%3A%22https%3A%2F%2Fwww.crowdstrike.com%2Fwp-content%2Fuploads%2F2023%2F05%2F0523_01_APAC-Cross-Boarder-Transfer-Systems_03.jpg%22%2C%22alt%22%3A%22%22%2C%22dir%22%3A%22RO%22%7D%2C%7B%22src%22%3A%22https%3A%2F%2Fwww.crowdstrike.com%2Fwp-content%2Fuploads%2F2023%2F05%2F23-SRV-013_Forrester-Wave_MDR_2023_Blog_1060x698_V1.jpg%22%2C%22alt%22%3A%22%22%2C%22dir%22%3A%22RO%22%7D%2C%7B%22src%22%3A%22https%3A%2F%2Fwww.crowdstrike.com%2Fwp-content%2Fuploads%2F2023%2F06%2F23-OTH-060_adversary-5-panda-china.png%22%2C%22alt%22%3A%22%22%2C%22dir%22%3A%22RO%22%7D%2C%7B%22src%22%3A%22https%3A%2F%2Fwww.crowdstrike.com%2Fwp-content%2Fuploads%2F2023%2F06%2FFalcon-X-Recon-featured-image-1.jpg%22%2C%22alt%22%3A%22%22%2C%22dir%22%3A%22RO%22%7D%2C%7B%22src%22%3A%22https%3A%2F%2Fwww.crowdstrike.com%2Fwp-content%2Fuploads%2F2023%2F08%2F0823_01_MSFT-Windows-Restart-Manager.jpg%22%2C%22alt%22%3A%22%22%2C%22dir%22%3A%22RO%22%7D%2C%7B%22src%22%3A%22https%3A%2F%2Fwww.crowdstrike.com%2Fwp-content%2Fuploads%2F2023%2F09%2F0923_03_LogScale_ThreatHunting_Chrome.jpg%22%2C%22alt%22%3A%22%22%2C%22dir%22%3A%22RO%22%7D%2C%7B%22src%22%3A%22https%3A%2F%2Fwww.crowdstrike.com%2Fwp-content%2Fuploads%2F2023%2F09%2FMITRE-100_Blog_01.jpg%22%2C%22alt%22%3A%22%22%2C%22dir%22%3A%22RO%22%7D%2C%7B%22src%22%3A%22https%3A%2F%2Fwww.crowdstrike.com%2Fwp-content%2Fuploads%2F2023%2F10%2F0122_03_IR_Tracker_for_DFIR_Community.jpg%22%2C%22alt%22%3A%22%22%2C%22dir%22%3A%22RO%22%7D%2C%7B%22src%22%3A%22https%3A%2F%2Fwww.crowdstrike.com%2Fwp-content%2Fuploads%2F2023%2F11%2F1123_02_Holiday-Access-Brokers.jpg%22%2C%22alt%22%3A%22%22%2C%22dir%22%3A%22RO%22%7D%2C%7B%22src%22%3A%22https%3A%2F%2Fwww.crowdstrike.com%2Fwp-content%2Fuploads%2F2023%2F11%2F1123_05_Ai-Powered-Protection-for-SMB_V2.jpg%22%2C%22alt%22%3A%22%22%2C%22dir%22%3A%22RO%22%7D%2C%7B%22src%22%3A%22https%3A%2F%2Fwww.crowdstrike.com%2Fwp-content%2Fuploads%2F2023%2F11%2F23-OTH-060_adversary-1-kitten-iran.png%22%2C%22alt%22%3A%22%22%2C%22dir%22%3A%22RO%22%7D%2C%7B%22src%22%3A%22https%3A%2F%2Fwww.crowdstrike.com%2Fwp-content%2Fuploads%2F2023%2F12%2F0222_05_FalconFusion_Ransomware_Malware.jpg%22%2C%22alt%22%3A%22%22%2C%22dir%22%3A%22RO%22%7D%2C%7B%22src%22%3A%22https%3A%2F%2Fwww.crowdstrike.com%2Fwp-content%2Fuploads%2F2023%2F12%2F1123_08_Insider-Vulnerabilities.jpg%22%2C%22alt%22%3A%22%22%2C%22dir%22%3A%22RO%22%7D%2C%7B%22src%22%3A%22https%3A%2F%2Fwww.crowdstrike.com%2Fwp-content%2Fuploads%2F2024%2F01%2F0124_02_FalconFund-Partners-with-Aembit.jpg%22%2C%22alt%22%3A%22%22%2C%22dir%22%3A%22RO%22%7D%2C%7B%22src%22%3A%22https%3A%2F%2Fwww.crowdstrike.com%2Fwp-content%2Fuploads%2F2024%2F01%2F2310-cmp-pc-blog-multiple-posts-1060x698-final-illustration.jpg%22%2C%22alt%22%3A%22%22%2C%22dir%22%3A%22RO%22%7D%2C%7B%22src%22%3A%22https%3A%2F%2Fwww.crowdstrike.com%2Fwp-content%2Fuploads%2F2024%2F01%2F24-CLD-001_Forrester-CWS-Wave_Blog-1.png%22%2C%22alt%22%3A%22%22%2C%22dir%22%3A%22RO%22%7D%2C%7B%22src%22%3A%22https%3A%2F%2Fwww.crowdstrike.com%2Fwp-content%2Fuploads%2F2024%2F01%2FGeneric_Blogs_Cloud_Security-1.png%22%2C%22alt%22%3A%22%22%2C%22dir%22%3A%22RO%22%7D%2C%7B%22src%22%3A%22https%3A%2F%2Fwww.crowdstrike.com%2Fwp-content%2Fuploads%2F2024%2F02%2F0124_01_Cs-Defends-Against-Azure-Attacks.jpg%22%2C%22alt%22%3A%22%22%2C%22dir%22%3A%22RO%22%7D%2C%7B%22src%22%3A%22https%3A%2F%2Fwww.crowdstrike.com%2Fwp-content%2Fuploads%2F2024%2F02%2Fapp-security-report-blog-post-art.jpg%22%2C%22alt%22%3A%22%22%2C%22dir%22%3A%22RO%22%7D%2C%7B%22src%22%3A%22https%3A%2F%2Fwww.crowdstrike.com%2Fwp-content%2Fuploads%2F2024%2F02%2FFigure1-2.png%22%2C%22alt%22%3A%22%22%2C%22dir%22%3A%22RO%22%7D%2C%7B%22src%22%3A%22https%3A%2F%2Fwww.crowdstrike.com%2Fwp-content%2Fuploads%2F2024%2F02%2FFigure2a.png%22%2C%22alt%22%3A%22%22%2C%22dir%22%3A%22RO%22%7D%2C%7B%22src%22%3A%22https%3A%2F%2Fwww.crowdstrike.com%2Fwp-content%2Fuploads%2F2024%2F02%2FFigure3-1.png%22%2C%22alt%22%3A%22%22%2C%22dir%22%3A%22RO%22%7D%5D%2C%22tier%22%3A%22PAID_QUOTA_TIER%22%7D
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:6ea0:c700::18 Frankfurt am Main, Germany, ASN60068 (CDN77 _, GB),
Reverse DNS
Software: CDN77-Turbo /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: GET
Origin: https://www.crowdstrike.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

access-control-allow-headers: *
access-control-allow-methods: GET, HEAD, PUT, PATCH, POST, DELETE
access-control-allow-origin: *
access-control-expose-headers: Content-Range, Content-Length, ETag, Content-Type
access-control-max-age: 3000
cache-control: max-age=604800
date: Tue, 13 Feb 2024 14:23:08 GMT
server: CDN77-Turbo
x-77-cache: MISS
x-77-nzt: EggBnJIhiwAACAGKxyXEAAA
x-77-nzt-ray: cf87872748b7a0b04c7bcb6508587816
x-77-pop: frankfurtDE
x-service-version: img-dscr-srv-ca87f731

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
484 B 227ms
227ms Image
image/gif 2.17.22.194

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=840a4ffa1a26e59267b6b28298d972e1&svisitor=null&visitor=536b3338-88cd-4004-8882-5745a2645fe7&session=ff4f5878-bd94-421c-89e2-309d5fd2c65a&event=active_time_track&q=%7B%22currentTime%22%3A%22Tue%2C%2013%20Feb%202024%2014%3A23%3A08%20GMT%22%2C%22lastTrackTime%22%3A%22Tue%2C%2013%20Feb%202024%2014%3A23%3A07%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%223003%22%7D&isIframe=false&m=%7B%22description%22%3A%22Read%20this%20blog%20to%20learn%20about%20the%20HijackLoader%20sample%20that%20employs%20sophisticated%20evasion%20techniques%20to%20enhance%20the%20complexity%20of%20the%20threat.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22HijackLoader%20Expands%20Techniques%20to%20Improve%20Defense%20Evasion%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.crowdstrike.com%2Fblog%2Fhijackloader-expands-techniques%2F&pageViewId=a9582c50-f1da-433d-8b01-7093cff49d59&an_uid=0&v=1.1.14

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.17.22.194 Düsseldorf, Germany, ASN (),

Reverse DNS

a2-17-22-194.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.crowdstrike.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Tue, 13 Feb 2024 14:23:08 GMT
x-content-type-options: nosniff
content-length: 43
pragma: no-cache
last-modified: Sat, 18 Feb 2023 00:49:36 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "63f020a0-2b"
access-control-max-age: 86400
access-control-allow-methods: GET,POST
content-type: image/gif
access-control-allow-origin
cache-control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: *
expires: Wed, 19 Apr 2000 11:43:00 GMT

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
485 B 277ms
277ms Image
image/gif 2.17.22.194

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=840a4ffa1a26e59267b6b28298d972e1&svisitor=null&visitor=536b3338-88cd-4004-8882-5745a2645fe7&session=ff4f5878-bd94-421c-89e2-309d5fd2c65a&event=active_time_track&q=%7B%22currentTime%22%3A%22Tue%2C%2013%20Feb%202024%2014%3A23%3A09%20GMT%22%2C%22lastTrackTime%22%3A%22Tue%2C%2013%20Feb%202024%2014%3A23%3A08%20GMT%22%2C%22timeSpent%22%3A%221000%22%2C%22totalTimeSpent%22%3A%224003%22%7D&isIframe=false&m=%7B%22description%22%3A%22Read%20this%20blog%20to%20learn%20about%20the%20HijackLoader%20sample%20that%20employs%20sophisticated%20evasion%20techniques%20to%20enhance%20the%20complexity%20of%20the%20threat.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22HijackLoader%20Expands%20Techniques%20to%20Improve%20Defense%20Evasion%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.crowdstrike.com%2Fblog%2Fhijackloader-expands-techniques%2F&pageViewId=a9582c50-f1da-433d-8b01-7093cff49d59&an_uid=0&v=1.1.14

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.17.22.194 Düsseldorf, Germany, ASN (),

Reverse DNS

a2-17-22-194.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.crowdstrike.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date: Tue, 13 Feb 2024 14:23:09 GMT
x-content-type-options: nosniff
content-length: 43
pragma: no-cache
last-modified: Sat, 05 Jun 2021 07:56:05 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "60bb2e15-2b"
access-control-max-age: 86400
access-control-allow-methods: GET,POST
content-type: image/gif
access-control-allow-origin
cache-control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: *
expires: Wed, 19 Apr 2000 11:43:00 GMT

Verdicts & Comments Add Verdict or Comment

99 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

13 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.crowdstrike.com/	1970-01-20 18:23:55	Name: __cf_bm Value: X4fk9MG98_bzz626Awbb5p4KOUlMAdplAwS8__gV1ik-1707834184-1-AY/IJz3mgaTXudChp2WA3L3TcbRjizfZnafH4PYu9qpUJMhmfTNsXfkXNZ/9/JM6EaPsy7f7/rZuGABqGEr8QdI=
.go.crowdstrike.com/	1970-01-20 18:23:55	Name: __cf_bm Value: klg.vZbm9O11yUrrhxfEZu2zCBRUJXJ8XnokE_L.ITM-1707834184-1-Ae6qwY590rJuREZnPFGf4I22orrud/iYCzUXeJAOWRHBJx238n6N5/4kRajNuYXN1TE6wA+jydIfB2gyQzc5VQE=
.crowdstrike.com/	1969-12-31 23:59:59	Name: _csUtms3 Value: %7B%22utm_medium%22%3A%22dir%22%7D
.crowdstrike.com/	1969-12-31 23:59:59	Name: _gcl_au Value: 1.1.317196578.1707834185
.crowdstrike.com/	1970-01-21 03:09:30	Name: OptanonConsent Value: isGpcEnabled=0&datestamp=Tue+Feb+13+2024+15%3A23%3A05+GMT%2B0100+(Central+European+Standard+Time)&version=202301.1.0&isIABGlobal=false&hosts=&consentId=65cbcb9a-9c6d-4b7b-ae23-836dbfd3b327&interactionCount=0&landingPath=https%3A%2F%2Fwww.crowdstrike.com%2Fblog%2Fhijackloader-expands-techniques%2F&groups=C0001%3A1%2CC0003%3A0%2CC0002%3A0%2CC0004%3A0
.adnxs.com/	1970-01-21 03:59:54	Name: receive-cookie-deprecation Value: 1
www.crowdstrike.com/	1970-01-20 18:33:58	Name: _an_uid Value: 0
www.crowdstrike.com/	1970-01-21 03:59:54	Name: _gd_visitor Value: 536b3338-88cd-4004-8882-5745a2645fe7
www.crowdstrike.com/	1970-01-20 18:24:08	Name: _gd_session Value: ff4f5878-bd94-421c-89e2-309d5fd2c65a
.youtube.com/	1969-12-31 23:59:59	Name: YSC Value: jv6Fna86fCQ
.youtube.com/	1970-01-20 22:43:06	Name: VISITOR_INFO1_LIVE Value: jsh3JmFathg
.6sc.co/	1970-01-21 03:59:54	Name: 6suuid Value: be16110250370100497bcb65170300000fd15b00
www.crowdstrike.com/	1970-01-20 18:23:55	Name: _csRef Value: www.crowdstrike.com/blog/hijackloader-expands-techniques/

15 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
other	warning	URL: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	upgrade-insecure-requests;report-uri /csp-violation-report-endpoint/
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	ALLOW-FROM https://crowdstrike.pathfactory.com https://crowdstrike.com
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

api.userway.org
assets.adobedtm.com
b.6sc.co
c.6sc.co
cdn.addsearch.com
cdn.cookielaw.org
cdn.userway.org
cdn77.api.userway.org
connect.facebook.net
epsilon.6sense.com
geolocation.onetrust.com
go.crowdstrike.com
ipv6.6sc.co
j.6sc.co
p.typekit.net
secure.adnxs.com
use.fontawesome.com
use.typekit.net
www.crowdstrike.com
www.googletagmanager.com
www.youtube.com
104.17.73.206
13.248.142.121
2.17.22.194
2600:1f14:5db:eb00:e29d:e8fa:9217:9611
2600:9000:2156:f800:a:de52:1580:93a1
2606:4700:4400::6812:2089
2606:4700::6810:1c08
2606:4700::6812:82ec
2606:4700:e6::ac40:ce26
2a00:1450:4001:812::2008
2a00:1450:4001:82a::200e
2a02:26f0:3500:16::215:1486
2a02:26f0:480:7b1::1e80
2a02:26f0:480:f::213:7ed3
2a02:26f0:ab00::214:8e41
2a02:6ea0:c700::17
2a02:6ea0:c700::18
2a03:2880:f083:100:face:b00c:0:3
37.252.171.52
00a1e07ffa91e55f51f59a60efaf8f4524f101bab79ecabf50688d3b4f8ca152
015e7f3ebea532c012598dcd5636b53f2773d2fa8c6c1310398e60f5adfbba1a
029eb8df13db1d0196b896a20dd780fc32955f410b29bce771bf00afd164d7fe
0386f1b61b8df1871fdda7f77f5d36248b86faa3026ea5787827e9673393278d
0387b42680fd92cfb4d64d3d697e8e3f5ab54abc28636abe5bcb6f0f68d3ba4a
03c245f01d27acbca6d02fe3852ce5027e127cbbc9cc5c60b6719ea60dc54cbb
04466026773f10391f6d0d84d702b9eef45db6438822b4edcd931cf5cc89d2d2
04727f699b52a1d71fb08c642b35b5352b4df1d961f1e06a84ade494c73c08b0
057cf64e13a70d98b7ad8f18487273135e4bb1f5083088f3f58bdf345c197620
0934b1fc0d3a766d41d3adf5e7a115875e66e98ebba408d965a41cf3d2cb4ab5
0bf90a8569ed246ad28d91458f6771f6934a0c4983243eca5f6accf91d6979cc
0cda584e7c5036ad66d7d528d2209bc596a14179fa1792a559e2ae9eaa91e851
0d616ec0b06b0da8f53e9f291e1873edca40739f641c7499525040750072b0b1
0dbd9ca47f4fd338efab8e6f5188a6de45cf390f04cfaea4a65abc47635550c6
0dcb4b8f8926bf46fb35389caec38cf06c566048372f67646d40efce85e24346
0e0a27c105caf20bd4cc76fe58f222d856ab8f626447846842dddca8ce7509ef
0f1c1c319dae1d32ef2feaa657e6d82c5f8fe4c98aa8bbc7ee0aab8b5b9d5d38
0f5a20aea350274cc88cc79a153797c6b253aec6a77259467378f0ca2dc29203
0f9c2ce6f85c93eed9e3e0917378e13d9ecc30b3690a2c97f9eb013b81244f4b
134b5ab773033a3001ff9594a52fcfef2a5229da6eb823d7a561da504f36a35f
15b5c8f3f652691450c66ccf98499876ec9bbeff6809dceeccdfb73acc72cf8c
1a415ea6fb205b85c941633bcd78fbd88e1fac779536d57b16cc6b5aecf2aa9a
1c0ff118a4290c99f39c90abb38703a866e47251b23cca20266c69c812ccafeb
1c36239bcd80f237805e530e80214ecc5b43821a943bb7aa744bfbaa87c4415f
1cd90e6c722ffc4078beee524a162b03c767bc8efd6f52fdf7fba5b90ee09d54
1df323c03e742ff217794c8ace2c647f3f0cf868c91d4396c166262ca1075acc
205dcb7bbc168099a95944b3670fcaec5407412da2d2f6e129ea3faec0731ee1
2157361193375a79ade3559e960f982daa8d599cf7f4a92d36e3eef257738f16
21eb1e487c899c6192c31800445bfb81caa7ff1fca550ea3fdb3444834d85710
224571e698a1c81926236b1c4e311041ceed09e992ab08750f7ed225f7d884b7
266a29bf57b54d51f7289747197132d43179b4f024d61069dbaea01da8012d13
284b0049b3b206bb58f97cce490ed45e9ec29d3522388c5d146c3da5b0cd695c
28813c38fd69327ee77259a3017f49ac8d57a6f53cb5533ae26a0f7292c3c711
2d337c9c94494f96609802ab3dc4053ddc9edb3c64e7079ec34b232d58c81f25
2d699428fb1a87452cb15775f3e9a531b9c8a98bfa41be2a24be4814ff0a5baf
2f108b18f7f86a049baec95d87b0818299204489f6777d88ff1873514dbaf248
31b45c462302ac175bfa43f9e5591491db780ca094f6ecdd2907f25ad578448d
36d220e0244517475dfe10f437bf2226a28eca7378c4b8fafa914a01174776cc
371c77d9d1f5d96c55daf6224cb162828509919e3f97f59722ef1b1dc971571a
37f8550406bebf8003ec760c4c81fbe861e3d38a5bbbd069ae9d60358710f038
389f18566f9a77749a729c029b9016c87cfaf1f066b41124b7fc07fd5392ca00
38ddf8f49aeddf9f1855259e69302912f2c8c298c9676eb44bc7ecb94d8bc1ca
39817e2dc1903ef3353ad8a0186c4f30dcbf9f6923f68b737b76ac46b1a151ff
3aea19d73e1aef8c605d28b0ac9e774acadb4c401dfe4335d9da9bbe1a665876
3af4950136e1829a2ee6ea85d29abb0e6c654c820bb828b73e4a5124e1943968
3b461442bdf6f086af9023de4b6f909e8b21599229c8a8ba3ae4fc92a5c08a6a
3c6522a60dfb491aef168a66e1aca8244bf7e6d08d9aa653f8a660b013085e20
3d871b6771dfa1a9115eee87e6dbb038d19387e11f27904622a56ff9bd4d2b84
3f37273d791716aa8633c33e58b59ac916a3764b2d35a00ea12f81bd517d549a
42e37144c07620e6e3e6ed4683aade1ee7f34ca821d95fc103b83af3070264ee
43831e0c2254516177e700ab7677297a3c544ec51703c063be52d33c54c969aa
4477c0eb88cbdde1b13f6970d4d42c998e233bd3cb4133aaa3ac5547ccf6c592
469f4c87c308eb70d2ef173724ad54f9270ab81c29ae15ff7e052eb33d3b9974
479a42c03c6ff55c0993365193e76f8bafaf7d48b53929dead68e5837950a104
4909664b2cd227fc85ce6fd9d530ec41bef8528f31af916ba9ed95a2cb230823
49d81348bc96c5ae3f30d8d9a3023ed90b57ec425f66c652f68786736be2896b
4ba704e4058d82ab5188b028627a2f284b36121fb9f2134d0fe7f2387f6c216f
4f6f07e26ae7e95df3b138d21eb6ef322beda975eddf7d5dd88156c48004e6c3
52b269545d8b0251f5f585cfa9572691d8d50a4a55ddcd6c5dd4e5718136e4f5
57ddc734dae06a7364ef27a7a27b1695f22719f42cd3893b2faee935adb6beb6
59fe5b428dbf3980f53ef1fb768b90a772e7f430cd33617da5c8ceb54820bf37
5be2dfa172d505acb197760b55c4731347cc239a7a046013c251948bb8214dbc
5f312a8528f9d8b6d94c841609abdc515f480820a110fd93aa9de7e9ab2a3db8
5fa00d047acd959697b9d7772c31dcd37bec33c70c6fbf80ab8316205d1d286d
62fd61035104aaa35fe90d9fe8cb52aa5bff1c8685b5825862b3a75bc89a5470
691dcdb24853a0f5ce4e6597e5713dea66799b57ffe2c2a10f28f98e0b569b19
6925696138e919bcfc54d241d2e51017d3383293ea4cf5bd0b7b3932ada195ea
6e188efafb2df40e1f4bd4973d31d37ae32a41676bc9c43d008388ec1ea72e1b
6ebe1e4135bb845bd442e32f716d10da89f715f890bdfe4b71354edb5c7f17f8
74a8d08bfffcc2b091168ebe5d30299c4857f962280f3b214ec64f460587b4c7
7f094e6666e540aaa55a90812a019ea5ea34bd173ad2dc8ed1b4538b53fd68b3
886c86112a804ef1ddd1cb206af4c8c40e34b73c26652ca231404aa35a6b30d9
8e0c9ad71fdf2b8553461659e37cfbb453a5a569c5f8c67273cded5fc9e0d2ae
901bb0e03b8c3c0a1cf4c487a177417328bb7d8c94106ecefceedd7d7f6c4ddc
912aa1e8380e28a95269a2997c3ddf4ec6ceed1f90df5487ada201c88f96536d
930239150e702d9d4bf43c3881aa70f8ad5fd9068dcbecb7c8bcca654784f7f1
95eb12099b7b1a54a255c0c2c6ebf9cb537aa5ac56e6a31aca10b11ea2f88f11
96469ec71636303e1b8e7ca9369b3fa55a2cf1712c9cb1a5b2064381522cae6f
9f9f09220578095d79ded54e8c0ee6ef21bc38e86475d2645b8656bbef22bbeb
a0ae602e4b19bb4491ccba1bab200ae243fa876b70cefdd8894ae0111a788306
a27d6e4fcd5512236ab3edb056c2a9eab7ffea6580deb690e186524c4cf897e0
a51da23632b50edb94b10e105416f06bcbc482e5c35eac9a4e34bc5ab2f9d9d8
a6dee6c73c3fffab45a1d559044b3806b79ce98c1370945608a1121f3badea14
a9c89c2a0df62b9bd73d859ae616ffe92cb9e86e1428a1a0fc797418f3e03dd9
aa8ccd00b2ec30041f8503ee680bb673acc72b2af2732a5623ca8d4b2cd10821
ac2cea87b2980e211b88ecc676e39fe1ecf5bb25f3596f94534e6e786e22a962
accf452e39300d2d291ca9788c8fc18ea151a8966a75946adc64b5845dffd08d
b25d2319903d6e206b3bd9a7340206ec7d6b603405403130d95a6ffca76a80db
b332a3fa616df968bdd71567cde2fe6031561746f6022d06993bde4001ec2730
b527f88908eeebbb1870931f8d3c110e7678486424d50343667336a335f33e28
b753594ff7e815b6bef74092861f26eb873ce93687e6f5f6253214b63da67ede
b87d34c5425a5b6bc0d37a08c2cd36cf21c2dac2645262a375f7460829859138
b8f9b0f28637041e05cd76c465d90599cb81e8845e4958b5da7517fda7e57982
b93680a9f50608d09c147af33f3e897a4b376ff3efb696bb062ed2e0f862d819
b97d4dfe2ec56762522f5fbb2fbffd2bdd339d52f235d169e57024f9b154af80
bb43ebbb2a062b085b9d9a2cea902487fa614e99cd88bb0206c452f1c5bb1cc5
bca51ed2fe251488a1b150edf560d43880f1486740f34d24120ede486f99676b
be396212b50003f563af6040d9d0a9ffc403a2bcbeadb918fc6a777f65323c1c
be64da47ffc5fc1e40ba8205a0974330a76815e151e84ba365a750a7c96f1d1d
bee78f076d7ef9d9be92fb1f293909e529c5b61891a52557d51e7183971e02cc
c177ad8c33494cceb633584a0bcdf034091b5b3058c086dd89edfe1412f497dd
c1e771120bf21d4102352843cb5c7374793a181ab940b270ee1178621a4f3a88
c29c89bd0ecf3f4b2eb429ac866478beef45f89e882bfe328bd5e0b8a3cee542
c45f637f905e1ea01ba81aa39e8da62ee7e7f8703c3da4c3bba55f6192e5834c
c572f7e6cda5feec58f66e79f96df91cfd83f6981d7d1f2958137b98ebf499cb
c77b68e97c7c808e6662e4dda77dd798831e80a592f9e175c68314cd9b74d704
cb4c799592e4092b490da8b0f3402312d8df6d486af541ee740e1906f456c84c
cc6addb827a2a39237154916d2a692464bceb44dc7bd73e7cdeb7150181615b5
cd24f5bed39abff3794a1239dba98000015195dce1486f8bfbcfc364417f49eb
cd25fbf311f88907fc669385ab12793353e5781fdc7f360767a97344896a88e7
cdaf63a2f4551c164deec45146faa8281f515880edddbd807aa0820721bda6d0
ced035236ef87e76d0e300e6c7c507d982c4a48c99a137f3a7fb61a94cb83688
d1c90bd20c04adf24d97ff015095058b528a293e12533fcc37a6f4b61970785e
d248cadd7c9d133a66cd2126b103fba268494b449dc54f486225e400a0453478
d454566fbbab8fcbc70a1c3139be25be5205712442564fe24a5e0258e3337a98
d4b15d353de13549299d08a87c2f8ba100014369b257c44357f55b06b944a82f
d6a8b2d8de96a693a7f089ff23c3f7aa66ed14718e0d4464a1df1ffb828c8609
d918dfd178470f1be12242960742fd20f811cf84c1beb90695770308a92cf017
db69a3d25d8125632acede7426cfaa714390a3a713e8fb38fca4264581341744
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
e0d7247f9a18889ae8a68fd56edaa202264826e284c725ce09964a71d1ee663e
e2f64fa9ea0c7f0abc1ad4a0d11b3808ffb66ca288d93e4129a53478be0145bf
e35507d68c9460b1bc5526d5a64fa382b04ea0c9da24b87a9bec7c6fd30bc55e
e36ce51df6d05a63225d449ba07b002ef1c2cd73b946e21e27456b251449712b
e8eda05fa3bffe9499012fd70f4e296d97d91026b0db3682b2d12be64f005f81
e9f39654eac26623ffbf7e6da9953393cd48b8b6e94d41b1a1cc28a6f4c005da
ea3c802e8d4cf12efe24d09a58f7aebbd24cb0a1aa717dfb16e4b567410261c4
ebe53644b0b082753243929e09b9e652a9e7051b3cf971e1a018104382778771
ec04952619b2b05cca30dd261a1aeed9853ebd6fddc4c701ec81c1de09d7277e
ed6c1ed511a6160b35044d7c49e35e9b85da14be0164b3c40d5aa23c8ab027b0
eee66297afe4bfd363c9e7b27978892a34adffde1664ef7509335aff8aa31cc0
f2c08d33847eaa68e859967176468981e9113c0c10ce2434e9519e0059e4b48a
f4e1bfc87a88a106bfe6a37e4176ed1ac1c8a8eb82d05135adedeacb8d216160
f58861e85bd3a7fd0aa7dd3b60eaf71ac79324dc48d6ec4bda8cd561eecc2234
f6f2064be189ce3de89d8f963d3af580b5fc9a83c07ec8aeb911e46ce17bcd25
f8f105a0a91843bdeac95e6aff14d7753ca2aaff00c942cf1bcb1da1025cff4c
f98d5d24000b6c7fc435a2234b1022dbb34693227112c49e0624b2ce38113445
f9f58c1d68e8d224ead13a1ea32344e66277c6e41e7b19292adad5f9584ef0a6
fa242f524a71571952cc44ed52cca22fae9718a281a24a8bd9029b959fbf1261
faae6fc0aa94cc5bde5076647c817a23206096a1cbeda10d1c6f3d89d6163ed1
fe04a9dc88d3f3be8d4f6bc63a9a80f45a4c6d8460e7551dab849457c091920a

www.crowdstrike.com Open in urlscan Pro 2606:4700::6810:1c08 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

153 Requests

100 %HTTPS

79 %IPv6

14 Domains

21 Subdomains

19 IPs

3 Countries

9467 kBTransfer

14215 kBSize

13 Cookies

15 Outgoing links

Redirected requests

153 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

www.crowdstrike.com Open in urlscan Pro
2606:4700::6810:1c08 Public Scan

Screenshot
Live screenshot

Full Image

153
Requests

100 %
HTTPS

79 %
IPv6

14
Domains

21
Subdomains

19
IPs

3
Countries

9467 kB
Transfer

14215 kB
Size

13
Cookies

153 HTTP transactions
0 data transactions