arcticwolf.com Open in urlscan Pro
13.224.189.102 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://arcticwolf.com/resources/blog/tellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware/
Submission: On November 07 via api (November 7th 2023, 4:48:38 pm UTC) from TR — Scanned from DE

Summary HTTP 282 Redirects Links 15 Behaviour Indicators

Summary

This website contacted 54 IPs in 5 countries across 43 domains to perform 282 HTTP transactions. The main IP is 13.224.189.102, located in United States and belongs to AMAZON-02, US. The main domain is arcticwolf.com. The Cisco Umbrella rank of the primary domain is 75864.
TLS certificate: Issued by DigiCert EV RSA CA G2 on October 10th 2023. Valid for: a year.

This is the only time arcticwolf.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
68	13.224.189.102 13.224.189.102	16509 (AMAZON-02) (AMAZON-02)
1	35.201.125.192 35.201.125.192	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
3	2a00:1450:400... 2a00:1450:4001:810::200a	15169 (GOOGLE) (GOOGLE)
12	2606:4700::68... 2606:4700::6812:82ec	13335 (CLOUDFLAR...) (CLOUDFLARENET)
7	2a00:1450:400... 2a00:1450:4001:802::2008	15169 (GOOGLE) (GOOGLE)
3	13.32.99.6 13.32.99.6	16509 (AMAZON-02) (AMAZON-02)
8	104.17.74.206 104.17.74.206	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700:440... 2606:4700:4400::6812:2089	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1 10	2600:9000:225... 2600:9000:2250:b000:0:f267:a5c0:93a1	16509 (AMAZON-02) (AMAZON-02)
3	2a00:1450:400... 2a00:1450:4001:828::2003	15169 (GOOGLE) (GOOGLE)
2	44.218.211.184 44.218.211.184	14618 (AMAZON-AES) (AMAZON-AES)
7	23.38.98.66 23.38.98.66	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1 3	2a00:1450:400... 2a00:1450:4001:82f::2002	15169 (GOOGLE) (GOOGLE)
1	146.75.120.157 146.75.120.157	54113 (FASTLY) (FASTLY)
4	2a02:26f0:480... 2a02:26f0:480:f::213:7ec6	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	2a04:4e42::396 2a04:4e42::396	54113 (FASTLY) (FASTLY)
2	2a00:1450:400... 2a00:1450:4001:809::200e	15169 (GOOGLE) (GOOGLE)
2	2.23.65.88 2.23.65.88	16625 (AKAMAI-AS) (AKAMAI-AS)
1 6	2620:1ec:c11:... 2620:1ec:c11::200	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
2	2a03:2880:f08... 2a03:2880:f083:9:face:b00c:0:3	32934 (FACEBOOK) (FACEBOOK)
1	2606:4700:440... 2606:4700:4400::6812:2b1f	13335 (CLOUDFLAR...) (CLOUDFLARENET)
6	2606:4700::68... 2606:4700::6810:890f	13335 (CLOUDFLAR...) (CLOUDFLARENET)
65	18.245.86.73 18.245.86.73	16509 (AMAZON-02) (AMAZON-02)
1	2606:4700:440... 2606:4700:4400::6812:24c4	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	35.244.142.80 35.244.142.80	15169 (GOOGLE) (GOOGLE)
1	2606:4700:e6:... 2606:4700:e6::ac40:c11b	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	2001:4860:480... 2001:4860:4802:34::178	15169 (GOOGLE) (GOOGLE)
1 4	2a00:1450:400... 2a00:1450:4001:813::2004	15169 (GOOGLE) (GOOGLE)
5	2a00:1450:400... 2a00:1450:4001:82a::2003	15169 (GOOGLE) (GOOGLE)
2	104.244.42.133 104.244.42.133	13414 (TWITTER) (TWITTER)
1	104.244.42.131 104.244.42.131	13414 (TWITTER) (TWITTER)
1	151.101.129.140 151.101.129.140	54113 (FASTLY) (FASTLY)
1 1	35.201.70.94 35.201.70.94	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1	2600:9000:205... 2600:9000:2057:f800:1c:f10a:ad80:93a1	16509 (AMAZON-02) (AMAZON-02)
5 7	2620:1ec:21::14 2620:1ec:21::14	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
2	13.107.42.14 13.107.42.14	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
4	2620:1ec:bdf::45 2620:1ec:bdf::45	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
2	34.111.208.231 34.111.208.231	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1	192.28.147.68 192.28.147.68	15224 (OMNITURE) (OMNITURE)
2	2001:4860:480... 2001:4860:4802:36::36	15169 (GOOGLE) (GOOGLE)
1	2a03:2880:f17... 2a03:2880:f176:84:face:b00c:0:25de	32934 (FACEBOOK) (FACEBOOK)
2	2a00:1450:400... 2a00:1450:400c:c04::9b	15169 (GOOGLE) (GOOGLE)
6	2600:1f18:e8a... 2600:1f18:e8a:cd00:e7aa:3ac6:9899:87c4	14618 (AMAZON-AES) (AMAZON-AES)
1	52.57.208.64 52.57.208.64	16509 (AMAZON-02) (AMAZON-02)
3	151.101.0.143 151.101.0.143	54113 (FASTLY) (FASTLY)
5	20.114.189.135 20.114.189.135	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	172.217.18.2 172.217.18.2	15169 (GOOGLE) (GOOGLE)
1	2001:4860:480... 2001:4860:4802:32::36	15169 (GOOGLE) (GOOGLE)
1	169.46.32.99 169.46.32.99	36351 (SOFTLAYER) (SOFTLAYER)
1 3	68.219.88.97 68.219.88.97	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	2a02:26f0:710... 2a02:26f0:7100::210:180	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
3	104.18.37.212 104.18.37.212	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	18.194.102.200 18.194.102.200	16509 (AMAZON-02) (AMAZON-02)
2	50.16.7.188 50.16.7.188	14618 (AMAZON-AES) (AMAZON-AES)
282	54

68 13.224.189.102 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-224-189-102.fra2.r.cloudfront.net

arcticwolf.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.201.125.192 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 192.125.201.35.bc.googleusercontent.com

marvel-b2-cdn.bc0a.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:810::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

12 2606:4700::6812:82ec (United States)

ASN13335 (CLOUDFLARENET, US)

cdn.cookielaw.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 2a00:1450:4001:802::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 13.32.99.6 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-32-99-6.fra60.r.cloudfront.net

app.cdn.lookbookhq.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
cdn-app.pathfactory.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 104.17.74.206 (None, )

ASN13335 (CLOUDFLARENET, US)

cybersecurity.arcticwolf.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:4400::6812:2089 (United States)

ASN13335 (CLOUDFLARENET, US)

geolocation.onetrust.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 2600:9000:2250:b000:0:f267:a5c0:93a1 (United States) 1 redirects

ASN16509 (AMAZON-02, US)

marvel-b1-cdn.bc0a.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:828::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 44.218.211.184 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-44-218-211-184.compute-1.amazonaws.com

jukebox.pathfactory.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 23.38.98.66 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)
PTR: a23-38-98-66.deploy.static.akamaitechnologies.com

j.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
c.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
b.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:82f::2002 (Frankfurt am Main, Germany) 1 redirects

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 146.75.120.157 (Frankfurt am Main, Germany)

ASN54113 (FASTLY, US)

static.ads-twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a02:26f0:480:f::213:7ec6 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)

snap.licdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a04:4e42::396 (United States)

ASN54113 (FASTLY, US)

www.redditstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:809::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.youtube.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2.23.65.88 (Düsseldorf, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a2-23-65-88.deploy.static.akamaitechnologies.com

munchkin.marketo.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2620:1ec:c11::200 (United States) 1 redirects

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

bat.bing.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
c.bing.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f083:9:face:b00c:0:3 (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:4400::6812:2b1f (United States)

ASN13335 (CLOUDFLARENET, US)

tracking.g2crowd.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2606:4700::6810:890f (United States)

ASN13335 (CLOUDFLARENET, US)

ws.zoominfo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
ws-assets.zoominfo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

65 18.245.86.73 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-245-86-73.fra60.r.cloudfront.net

js.driftt.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:4400::6812:24c4 (United States)

ASN13335 (CLOUDFLARENET, US)

trk.techtarget.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.244.142.80 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 80.142.244.35.bc.googleusercontent.com

cdn.pdst.fm	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:e6::ac40:c11b (United States)

ASN13335 (CLOUDFLARENET, US)

siteimproveanalytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2001:4860:4802:34::178 (United States)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:813::2004 (Frankfurt am Main, Germany) 1 redirects

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2a00:1450:4001:82a::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 104.244.42.133 (United States)

ASN13414 (TWITTER, US)

t.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.244.42.131 (United States)

ASN13414 (TWITTER, US)

analytics.twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.129.140 (United States)

ASN54113 (FASTLY, US)

alb.reddit.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.201.70.94 (Kansas City, United States) 1 redirects

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 94.70.201.35.bc.googleusercontent.com

marvel-processor.bc0a.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:2057:f800:1c:f10a:ad80:93a1 (United States)

ASN16509 (AMAZON-02, US)

ob.robotflowermobile.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 2620:1ec:21::14 (United States) 5 redirects

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

px.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
www.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 13.107.42.14 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

px4.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2620:1ec:bdf::45 (United States)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

www.clarity.ms	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 34.111.208.231 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 231.208.111.34.bc.googleusercontent.com

ibc-flow.techtarget.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 192.28.147.68 (United States)

ASN15224 (OMNITURE, US)

840-osq-661.mktoresp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2001:4860:4802:36::36 (United States)

ASN15169 (GOOGLE, US)

us-central1-adaptive-growth.cloudfunctions.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a03:2880:f176:84:face:b00c:0:25de (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:400c:c04::9b (Brussels, Belgium)

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2600:1f18:e8a:cd00:e7aa:3ac6:9899:87c4 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)

obs.robotflowermobile.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.57.208.64 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-57-208-64.eu-central-1.compute.amazonaws.com

6145655.global.siteimproveanalytics.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 151.101.0.143 (United States)

ASN54113 (FASTLY, US)

s.swiftypecdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 20.114.189.135 (Boydton, United States)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

v.clarity.ms	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 172.217.18.2 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s22-in-f2.1e100.net

www.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2001:4860:4802:32::36 (United States)

ASN15169 (GOOGLE, US)

region1.analytics.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 169.46.32.99 (Irving, United States)

ASN36351 (SOFTLAYER, US)
PTR: 63.20.2ea9.ip4.static.sl-reverse.com

cc.swiftype.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 68.219.88.97 (Dublin, Ireland) 1 redirects

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

c.clarity.ms	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:26f0:7100::210:180 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)

ipv6.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 104.18.37.212 (None, )

ASN13335 (CLOUDFLARENET, US)

js.zi-scripts.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 18.194.102.200 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-18-194-102-200.eu-central-1.compute.amazonaws.com

epsilon.6sense.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 50.16.7.188 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-50-16-7-188.compute-1.amazonaws.com

bootstrap.api.drift.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
metrics.api.drift.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
76	arcticwolf.com arcticwolf.com — Cisco Umbrella Rank: 75864 cybersecurity.arcticwolf.com — Cisco Umbrella Rank: 200934	913 KB
65	driftt.com js.driftt.com — Cisco Umbrella Rank: 5586	758 KB
12	clarity.ms 1 redirects www.clarity.ms — Cisco Umbrella Rank: 827 v.clarity.ms — Cisco Umbrella Rank: 7292 c.clarity.ms — Cisco Umbrella Rank: 1405	54 KB
12	cookielaw.org cdn.cookielaw.org — Cisco Umbrella Rank: 342	203 KB
12	bc0a.com 2 redirects marvel-b2-cdn.bc0a.com — Cisco Umbrella Rank: 18849 marvel-b1-cdn.bc0a.com — Cisco Umbrella Rank: 18102 marvel-processor.bc0a.com — Cisco Umbrella Rank: 31921	99 KB
9	linkedin.com 5 redirects px.ads.linkedin.com — Cisco Umbrella Rank: 377 www.linkedin.com — Cisco Umbrella Rank: 629 px4.ads.linkedin.com — Cisco Umbrella Rank: 6003	6 KB
8	6sc.co j.6sc.co — Cisco Umbrella Rank: 5465 c.6sc.co — Cisco Umbrella Rank: 8564 ipv6.6sc.co — Cisco Umbrella Rank: 5738 b.6sc.co — Cisco Umbrella Rank: 3759	19 KB
7	robotflowermobile.com ob.robotflowermobile.com — Cisco Umbrella Rank: 515780 obs.robotflowermobile.com — Cisco Umbrella Rank: 421856	39 KB
7	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 35	594 KB
6	zoominfo.com ws.zoominfo.com — Cisco Umbrella Rank: 4272 ws-assets.zoominfo.com — Cisco Umbrella Rank: 15113	29 KB
6	bing.com 1 redirects bat.bing.com — Cisco Umbrella Rank: 366 c.bing.com — Cisco Umbrella Rank: 236	30 KB
5	google.de www.google.de — Cisco Umbrella Rank: 6862	753 B
5	google.com 1 redirects www.google.com — Cisco Umbrella Rank: 2 region1.analytics.google.com — Cisco Umbrella Rank: 3040	903 B
5	doubleclick.net 1 redirects googleads.g.doubleclick.net — Cisco Umbrella Rank: 33 stats.g.doubleclick.net — Cisco Umbrella Rank: 78	4 KB
4	licdn.com snap.licdn.com — Cisco Umbrella Rank: 778	38 KB
3	zi-scripts.com js.zi-scripts.com — Cisco Umbrella Rank: 9225	3 KB
3	swiftypecdn.com s.swiftypecdn.com — Cisco Umbrella Rank: 10851	149 KB
3	techtarget.com trk.techtarget.com — Cisco Umbrella Rank: 24529 ibc-flow.techtarget.com — Cisco Umbrella Rank: 22103	2 KB
3	gstatic.com fonts.gstatic.com	73 KB
3	pathfactory.com cdn-app.pathfactory.com — Cisco Umbrella Rank: 41830 jukebox.pathfactory.com — Cisco Umbrella Rank: 33670	305 KB
3	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 31	3 KB
2	drift.com bootstrap.api.drift.com — Cisco Umbrella Rank: 6353 metrics.api.drift.com — Cisco Umbrella Rank: 6159	736 B
2	6sense.com epsilon.6sense.com — Cisco Umbrella Rank: 9302	572 B
2	cloudfunctions.net us-central1-adaptive-growth.cloudfunctions.net — Cisco Umbrella Rank: 2957	123 B
2	t.co t.co — Cisco Umbrella Rank: 607	493 B
2	google-analytics.com www.google-analytics.com — Cisco Umbrella Rank: 27	21 KB
2	facebook.net connect.facebook.net — Cisco Umbrella Rank: 174	89 KB
2	marketo.net munchkin.marketo.net — Cisco Umbrella Rank: 3497	6 KB
2	youtube.com www.youtube.com — Cisco Umbrella Rank: 68	69 KB
2	lookbookhq.com app.cdn.lookbookhq.com — Cisco Umbrella Rank: 62588	3 KB
1	swiftype.com cc.swiftype.com — Cisco Umbrella Rank: 11597	279 B
1	googleadservices.com www.googleadservices.com — Cisco Umbrella Rank: 145	2 KB
1	siteimproveanalytics.io 6145655.global.siteimproveanalytics.io	479 B
1	facebook.com www.facebook.com — Cisco Umbrella Rank: 110	185 B
1	mktoresp.com 840-osq-661.mktoresp.com — Cisco Umbrella Rank: 950222	318 B
1	reddit.com alb.reddit.com — Cisco Umbrella Rank: 1452	637 B
1	twitter.com analytics.twitter.com — Cisco Umbrella Rank: 747	396 B
1	siteimproveanalytics.com siteimproveanalytics.com — Cisco Umbrella Rank: 3692	15 KB
1	pdst.fm cdn.pdst.fm — Cisco Umbrella Rank: 2918	6 KB
1	g2crowd.com tracking.g2crowd.com — Cisco Umbrella Rank: 8571	1 KB
1	redditstatic.com www.redditstatic.com — Cisco Umbrella Rank: 1333	8 KB
1	ads-twitter.com static.ads-twitter.com — Cisco Umbrella Rank: 713	15 KB
1	onetrust.com geolocation.onetrust.com — Cisco Umbrella Rank: 590	304 B
282	43

	Domain	Requested by
68	arcticwolf.com	arcticwolf.com ob.robotflowermobile.com
65	js.driftt.com	arcticwolf.com js.driftt.com
12	cdn.cookielaw.org	arcticwolf.com cdn.cookielaw.org
10	marvel-b1-cdn.bc0a.com	1 redirects arcticwolf.com
8	cybersecurity.arcticwolf.com	arcticwolf.com cybersecurity.arcticwolf.com
7	www.googletagmanager.com	arcticwolf.com www.googletagmanager.com ob.robotflowermobile.com
6	obs.robotflowermobile.com	ob.robotflowermobile.com arcticwolf.com
6	px.ads.linkedin.com	4 redirects snap.licdn.com
5	b.6sc.co	arcticwolf.com
5	v.clarity.ms	www.clarity.ms
5	www.google.de	arcticwolf.com
5	ws.zoominfo.com	arcticwolf.com js.zi-scripts.com ws-assets.zoominfo.com
5	bat.bing.com	arcticwolf.com bat.bing.com
4	www.clarity.ms	bat.bing.com www.clarity.ms
4	www.google.com	1 redirects arcticwolf.com
4	snap.licdn.com	www.googletagmanager.com snap.licdn.com arcticwolf.com
3	js.zi-scripts.com	arcticwolf.com js.zi-scripts.com
3	c.clarity.ms	1 redirects arcticwolf.com www.clarity.ms
3	s.swiftypecdn.com	arcticwolf.com s.swiftypecdn.com
3	googleads.g.doubleclick.net	1 redirects www.googletagmanager.com
3	fonts.gstatic.com	fonts.googleapis.com
3	fonts.googleapis.com	arcticwolf.com cybersecurity.arcticwolf.com
2	epsilon.6sense.com	j.6sc.co
2	stats.g.doubleclick.net	www.google-analytics.com www.googletagmanager.com
2	us-central1-adaptive-growth.cloudfunctions.net	cdn.pdst.fm
2	ibc-flow.techtarget.com	trk.techtarget.com
2	px4.ads.linkedin.com	arcticwolf.com
2	t.co	arcticwolf.com
2	www.google-analytics.com	www.googletagmanager.com www.google-analytics.com
2	connect.facebook.net	arcticwolf.com connect.facebook.net
2	munchkin.marketo.net	arcticwolf.com munchkin.marketo.net
2	www.youtube.com	arcticwolf.com www.youtube.com
2	jukebox.pathfactory.com	cdn-app.pathfactory.com
2	app.cdn.lookbookhq.com	arcticwolf.com
1	metrics.api.drift.com	js.driftt.com
1	ws-assets.zoominfo.com	js.zi-scripts.com
1	bootstrap.api.drift.com	js.driftt.com
1	ipv6.6sc.co	j.6sc.co
1	c.6sc.co	j.6sc.co
1	c.bing.com	1 redirects
1	cc.swiftype.com	arcticwolf.com
1	region1.analytics.google.com	www.googletagmanager.com
1	www.googleadservices.com	www.googletagmanager.com
1	6145655.global.siteimproveanalytics.io	arcticwolf.com
1	www.facebook.com	arcticwolf.com
1	840-osq-661.mktoresp.com	munchkin.marketo.net
1	www.linkedin.com	1 redirects
1	ob.robotflowermobile.com	www.googletagmanager.com
1	marvel-processor.bc0a.com	1 redirects
1	alb.reddit.com	arcticwolf.com
1	analytics.twitter.com	arcticwolf.com
1	siteimproveanalytics.com	www.googletagmanager.com
1	cdn.pdst.fm	arcticwolf.com
1	trk.techtarget.com	arcticwolf.com
1	tracking.g2crowd.com	arcticwolf.com
1	www.redditstatic.com	www.googletagmanager.com
1	static.ads-twitter.com	www.googletagmanager.com
1	j.6sc.co	arcticwolf.com
1	geolocation.onetrust.com	cdn.cookielaw.org
1	cdn-app.pathfactory.com	arcticwolf.com
1	marvel-b2-cdn.bc0a.com	arcticwolf.com
282	61

This site contains links to these domains. Also see Links.

Domain
pkg.go.dev
nvd.nist.gov
github.com
securityonline.info
paper.seebug.org
www.crowdstrike.com
www.360.cn
www.facebook.com
www.twitter.com
www.youtube.com
www.linkedin.com
cookiepedia.co.uk
www.onetrust.com

Subject Issuer	Validity	Valid
arcticwolf.com DigiCert EV RSA CA G2	`2023-10-10` - `2024-10-21`	a year	crt.sh
cdn.bc0a.com GTS CA 1D4	`2023-10-02` - `2023-12-31`	3 months	crt.sh
upload.video.google.com GTS CA 1C3	`2023-10-16` - `2024-01-08`	3 months	crt.sh
cookielaw.org Cloudflare Inc ECC CA-3	`2023-04-01` - `2024-03-31`	a year	crt.sh
*.google-analytics.com GTS CA 1C3	`2023-10-16` - `2024-01-08`	3 months	crt.sh
*.pathfactory.com Amazon RSA 2048 M02	`2023-06-11` - `2024-07-09`	a year	crt.sh
cybersecurity.arcticwolf.com Cloudflare Inc ECC CA-3	`2023-04-05` - `2024-04-04`	a year	crt.sh
onetrust.com Cloudflare Inc ECC CA-3	`2022-12-13` - `2023-12-13`	a year	crt.sh
marvel-cdn.bc0a.com Amazon RSA 2048 M01	`2023-02-09` - `2024-03-09`	a year	crt.sh
*.gstatic.com GTS CA 1C3	`2023-10-16` - `2024-01-08`	3 months	crt.sh
6sc.co R3	`2023-11-03` - `2024-02-01`	3 months	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2023-10-16` - `2024-01-08`	3 months	crt.sh
ads-twitter.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-07-21` - `2024-07-19`	a year	crt.sh
snap.licdn.com DigiCert SHA2 Secure Server CA	`2023-02-01` - `2024-01-31`	a year	crt.sh
www.redditstatic.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-08-25` - `2024-02-21`	6 months	crt.sh
*.google.com GTS CA 1C3	`2023-10-16` - `2024-01-08`	3 months	crt.sh
*.marketo.net DigiCert TLS RSA SHA256 2020 CA1	`2023-02-06` - `2024-02-05`	a year	crt.sh
www.bing.com Microsoft Azure TLS Issuing CA 01	`2023-10-24` - `2024-04-21`	6 months	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2023-08-16` - `2023-11-14`	3 months	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2023-07-24` - `2024-07-23`	a year	crt.sh
zoominfo.com Cloudflare Inc ECC CA-3	`2023-04-04` - `2024-04-03`	a year	crt.sh
drift.com Amazon RSA 2048 M02	`2023-08-15` - `2024-09-11`	a year	crt.sh
cdn.pdst.fm GTS CA 1D4	`2023-09-22` - `2023-12-21`	3 months	crt.sh
siteimproveanalytics.com GTS CA 1P5	`2023-10-29` - `2024-01-27`	3 months	crt.sh
www.google.com GTS CA 1C3	`2023-10-16` - `2024-01-08`	3 months	crt.sh
www.google.de GTS CA 1C3	`2023-10-16` - `2024-01-08`	3 months	crt.sh
t.co DigiCert TLS Hybrid ECC SHA384 2020 CA1	`2023-02-05` - `2024-02-05`	a year	crt.sh
*.twitter.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-10-31` - `2024-10-29`	a year	crt.sh
*.reddit.com DigiCert TLS RSA SHA256 2020 CA1	`2023-09-01` - `2024-02-28`	6 months	crt.sh
*.robotflowermobile.com Amazon RSA 2048 M02	`2023-07-18` - `2024-08-15`	a year	crt.sh
www.clarity.ms DigiCert TLS RSA SHA256 2020 CA1	`2023-08-29` - `2024-08-29`	a year	crt.sh
ibc-flow.techtarget.com GTS CA 1D4	`2023-09-21` - `2023-12-20`	3 months	crt.sh
*.mktoresp.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-09-07` - `2024-10-07`	a year	crt.sh
misc.google.com GTS CA 1C3	`2023-10-16` - `2024-01-08`	3 months	crt.sh
*.global.r1.siteimproveanalytics.io Amazon RSA 2048 M03	`2023-10-26` - `2024-11-23`	a year	crt.sh
s.swiftypecdn.com GlobalSign Atlas R3 DV TLS CA 2023 Q2	`2023-07-02` - `2024-08-02`	a year	crt.sh
a.clarity.ms Microsoft Azure TLS Issuing CA 06	`2023-02-13` - `2024-02-08`	a year	crt.sh
www.googleadservices.com GTS CA 1C3	`2023-10-16` - `2024-01-08`	3 months	crt.sh
*.google.de GTS CA 1C3	`2023-10-16` - `2024-01-08`	3 months	crt.sh
www.linkedin.com DigiCert SHA2 Secure Server CA	`2023-11-03` - `2024-05-03`	6 months	crt.sh
*.swiftype.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-06-21` - `2024-07-14`	a year	crt.sh
zi-scripts.com GTS CA 1P5	`2023-10-04` - `2024-01-02`	3 months	crt.sh
c.msn.com Microsoft Azure TLS Issuing CA 05	`2023-06-06` - `2024-05-31`	a year	crt.sh
*.6sense.com Amazon RSA 2048 M01	`2023-05-01` - `2024-05-29`	a year	crt.sh

This page contains 6 frames:

Primary Page: https://arcticwolf.com/resources/blog/tellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware/
Frame ID: 8335756C739C3DDB6996A97B52A617FD
Requests: 195 HTTP requests in this frame

Frame: https://cybersecurity.arcticwolf.com/index.php/form/XDFrame
Frame ID: F5575646A2640D012FEEE6CCC5A98706
Requests: 2 HTTP requests in this frame

Frame: https://arcticwolf.com/cheq-ppc-invalid-users/
Frame ID: AC87314C92E93873E9EAF7C376CA3415
Requests: 5 HTTP requests in this frame

Frame: https://bat.bing.com/bat.js
Frame ID: 19AA40447375A4D7E7223B09C69E79BC
Requests: 8 HTTP requests in this frame

Frame: https://js.driftt.com/core?d=1&embedId=zaxd53bdwtvy&eId=zaxd53bdwtvy&region=US&forceShow=false&skipCampaigns=false&sessionId=3746222f-280d-4d84-8ab3-990ff4680b50&sessionStarted=1699375715.546&campaignRefreshToken=959eaf2e-9498-42aa-88c2-83fe2e027f06&hideController=false&pageLoadStartTime=1699375708552&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Farcticwolf.com%2Fresources%2Fblog%2Ftellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware%2F
Frame ID: CCFA95F03B374B08574568ACB00D6887
Requests: 33 HTTP requests in this frame

Frame: https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1699375708552
Frame ID: 41CDD796D6DBB7270F856391A8CD98D5
Requests: 34 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Exploitation of CVE-2023-46604 Leading to RansomwareBack ButtonSearch IconFilter Icon

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

/wp-(?:content|includes)/

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

Ruby on Rails (Web Frameworks) Expand

Overall confidence: 75%
Detected patterns

Mustache (JavaScript Frameworks) Expand

Overall confidence: 100%
Detected patterns

mustache(?:\.min)?\.js

Yoast SEO (SEO) Expand

Overall confidence: 100%
Detected patterns

<!-- This site is optimized with the Yoast (?:WordPress )?SEO plugin v([\d.]+) -

Facebook (Widgets) Expand

Overall confidence: 100%
Detected patterns

//connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js

Font Awesome (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

google-analytics\.com/(?:ga|urchin|analytics)\.js

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtm\.js
googletagmanager\.com/gtag/js

Linkedin Insight Tag (Analytics) Expand

Overall confidence: 100%
Detected patterns

snap\.licdn\.com/li\.lms-analytics/insight\.min\.js

Marketo (Marketing Automation) Expand

Overall confidence: 100%
Detected patterns

munchkin\.marketo\.\w+/(?:([\d.]+)/)?munchkin\.js

OneTrust (Cookie compliance) Expand

Overall confidence: 100%
Detected patterns

cdn\.cookielaw\.org
otSDKStub\.js

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

jQuery Migrate (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]migrate(?:-([\d.]+))?(?:\.min)?\.js(?:\?ver=([\d.]+))?

Page Statistics

282
Requests

96 %
HTTPS

52 %
IPv6

43
Domains

61
Subdomains

54
IPs

5
Countries

3587 kB
Transfer

13230 kB
Size

54
Cookies

15 Outgoing links

These are links going to different origins than the main page.

URL: https://pkg.go.dev/os/user#Current
Title: golang os.User.Current

Search URL Search Domain Scan URL

URL: https://pkg.go.dev/os#Hostname
Title: golang os.hostname

Search URL Search Domain Scan URL

URL: https://pkg.go.dev/net#InterfaceAddrs
Title: golang net.InterfaceAddr

Search URL Search Domain Scan URL

URL: https://nvd.nist.gov/vuln/detail/CVE-2023-46604
Title: https://nvd.nist.gov/vuln/detail/CVE-2023-46604

Search URL Search Domain Scan URL

URL: https://github.com/XZB-1248/Spark
Title: https://github.com/XZB-1248/Spark

Search URL Search Domain Scan URL

URL: https://securityonline.info/apache-activemq-remote-code-execution-vulnerability/
Title: https://securityonline.info/apache-activemq-remote-code-execution-vulnerability/

Search URL Search Domain Scan URL

URL: https://paper.seebug.org/3058/
Title: https://paper.seebug.org/3058/

Search URL Search Domain Scan URL

URL: https://www.crowdstrike.com/blog/tellyouthepass-ransomware-analysis-reveals-modern-reinterpretation-using-golang/
Title: https://www.crowdstrike.com/blog/tellyouthepass-ransomware-analysis-reveals-modern-reinterpretation-using-golang/

Search URL Search Domain Scan URL

URL: https://www.360.cn/n/12370.html
Title: https://www.360.cn/n/12370.html

Search URL Search Domain Scan URL

URL: https://www.facebook.com/ArcticWolfNetworks

Search URL Search Domain Scan URL

URL: https://www.twitter.com/AWNetworks
Title: 𝕏

Search URL Search Domain Scan URL

URL: https://www.youtube.com/c/ArcticWolfNetworks

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/company/arctic-wolf-networks

Search URL Search Domain Scan URL

URL: https://cookiepedia.co.uk/giving-consent-to-cookies
Title: Weitere Informationen

Search URL Search Domain Scan URL

URL: https://www.onetrust.com/products/cookie-consent/

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 122

https://marvel-b1-cdn.bc0a.com/f00000000241276/t.co/i/adsct?bci=3&eci=2&event_id=08b70c70-da87-45e5-971b-cffa65ddcebb&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=985d179d-9614-4430-9a10-c7e712453bde&tw_document_href=https%3A%2F%2Farcticwolf.com%2Fresources%2Fblog%2Ftellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware%2F&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=nxet7&type=javascript&version=2.3.29 HTTP 302
https://marvel-processor.bc0a.com/snowcloud/v1/api/loadUrl?customer=f00000000241276&url=https://t.co/i/adsct?bci=3&eci=2&event_id=08b70c70-da87-45e5-971b-cffa65ddcebb&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=985d179d-9614-4430-9a10-c7e712453bde&tw_document_href=https%3A%2F%2Farcticwolf.com%2Fresources%2Fblog%2Ftellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware%2F&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=nxet7&type=javascript&version=2.3.29 HTTP 307
https://t.co/i/adsct?bci=3&eci=2&event_id=08b70c70-da87-45e5-971b-cffa65ddcebb&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=985d179d-9614-4430-9a10-c7e712453bde&tw_document_href=https%3A%2F%2Farcticwolf.com%2Fresources%2Fblog%2Ftellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware%2F&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=nxet7&type=javascript&version=2.3.29

Request Chain 135

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=50605&time=1699375711485&url=https%3A%2F%2Farcticwolf.com%2Fresources%2Fblog%2Ftellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware%2F HTTP 302
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=50605&time=1699375711485&url=https%3A%2F%2Farcticwolf.com%2Fresources%2Fblog%2Ftellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware%2F&cookiesTest=true HTTP 302
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D50605%26time%3D1699375711485%26url%3Dhttps%253A%252F%252Farcticwolf.com%252Fresources%252Fblog%252Ftellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware%252F%26cookiesTest%3Dtrue%26liSync%3Dtrue HTTP 302
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=50605&time=1699375711485&url=https%3A%2F%2Farcticwolf.com%2Fresources%2Fblog%2Ftellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware%2F&cookiesTest=true&liSync=true HTTP 302
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=50605&time=1699375711485&url=https%3A%2F%2Farcticwolf.com%2Fresources%2Fblog%2Ftellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware%2F&cookiesTest=true&liSync=true&e_ipv6=AQLD2H3cEUH-qgAAAYuqr4f6Ei0Pm4-awuohQ63Hy-qPNEPvgI2kk1n-0201ONW07HKGAuA

Request Chain 172

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=50605&time=1699375712461&url=https%3A%2F%2Farcticwolf.com%2Fresources%2Fblog%2Ftellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware%2F HTTP 302
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=50605&time=1699375712461&url=https%3A%2F%2Farcticwolf.com%2Fresources%2Fblog%2Ftellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware%2F&e_ipv6=AQKCDvqVfPbItgAAAYuqr4kq9wA1IjYtamnwTcOUIfVCtL9wt-xgt1cQQfBbFVv9w14OawE

Request Chain 175

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/410966486/?random=1976014780&cv=11&fst=1699375712354&bg=ffffff&guid=ON&async=1&gtm=45be3b60v896750397&gcd=11l1l1l1l1&u_w=1600&u_h=1200&url=https%3A%2F%2Farcticwolf.com%2Fresources%2Fblog%2Ftellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware%2F&label=lzDbCJmv1ocYENaz-8MB&hn=www.googleadservices.com&frm=0&tiba=Exploitation%20of%20CVE-2023-46604%20Leading%20to%20Ransomware&gtm_ee=1&auid=1349226205.1699375711&uamb=0&uaw=0&data=event%3Dconversion&fmt=3&ct_cookie_present=false&ocp_id=YGpKZZnVHcaUjuwPp9KnwAs&sscte=1&crd=&pscrd=Ek5DaEFJZ04ybnFnWVFoWk9xNi1pbTk3aGpFaVlBV2ZYR1poeW9INzBoUVpYVHpObThRNEZGeXR5UkJpcURIQTBTMFpqZDVkT29oQy1MU2caV0NnOElnTjJucWdZUXJzTzVuYTZmaFJBU0xnQ0dJd29MTDVSSThnN1NWZ0ZQNDNsbGtfNGphWnlCOEJiYzk0cmxXRjFBelBCTnlOcVBoTlBsalJpZTVFcyITCJmFu-2rsoIDFUaKgwcdJ-kJuA HTTP 302
https://www.google.com/pagead/1p-conversion/410966486/?random=1976014780&cv=11&fst=1699375712354&bg=ffffff&guid=ON&async=1&gtm=45be3b60v896750397&gcd=11l1l1l1l1&u_w=1600&u_h=1200&url=https%3A%2F%2Farcticwolf.com%2Fresources%2Fblog%2Ftellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware%2F&label=lzDbCJmv1ocYENaz-8MB&hn=www.googleadservices.com&frm=0&tiba=Exploitation%20of%20CVE-2023-46604%20Leading%20to%20Ransomware&gtm_ee=1&auid=1349226205.1699375711&uamb=0&uaw=0&data=event%3Dconversion&fmt=3&ct_cookie_present=false&sscte=1&crd=&pscrd=Ek5DaEFJZ04ybnFnWVFoWk9xNi1pbTk3aGpFaVlBV2ZYR1poeW9INzBoUVpYVHpObThRNEZGeXR5UkJpcURIQTBTMFpqZDVkT29oQy1MU2caV0NnOElnTjJucWdZUXJzTzVuYTZmaFJBU0xnQ0dJd29MTDVSSThnN1NWZ0ZQNDNsbGtfNGphWnlCOEJiYzk0cmxXRjFBelBCTnlOcVBoTlBsalJpZTVFcyITCJmFu-2rsoIDFUaKgwcdJ-kJuA&is_vtc=1&ocp_id=YGpKZZnVHcaUjuwPp9KnwAs&cid=CAQSKQDICaaNWGJZaEfI5u4FQRaMdGQCElH7xzwNht6QOApJyhcxV_pUdUHd&random=1109559659 HTTP 302
https://www.google.de/pagead/1p-conversion/410966486/?random=1976014780&cv=11&fst=1699375712354&bg=ffffff&guid=ON&async=1&gtm=45be3b60v896750397&gcd=11l1l1l1l1&u_w=1600&u_h=1200&url=https%3A%2F%2Farcticwolf.com%2Fresources%2Fblog%2Ftellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware%2F&label=lzDbCJmv1ocYENaz-8MB&hn=www.googleadservices.com&frm=0&tiba=Exploitation%20of%20CVE-2023-46604%20Leading%20to%20Ransomware&gtm_ee=1&auid=1349226205.1699375711&uamb=0&uaw=0&data=event%3Dconversion&fmt=3&ct_cookie_present=false&sscte=1&crd=&pscrd=Ek5DaEFJZ04ybnFnWVFoWk9xNi1pbTk3aGpFaVlBV2ZYR1poeW9INzBoUVpYVHpObThRNEZGeXR5UkJpcURIQTBTMFpqZDVkT29oQy1MU2caV0NnOElnTjJucWdZUXJzTzVuYTZmaFJBU0xnQ0dJd29MTDVSSThnN1NWZ0ZQNDNsbGtfNGphWnlCOEJiYzk0cmxXRjFBelBCTnlOcVBoTlBsalJpZTVFcyITCJmFu-2rsoIDFUaKgwcdJ-kJuA&is_vtc=1&ocp_id=YGpKZZnVHcaUjuwPp9KnwAs&cid=CAQSKQDICaaNWGJZaEfI5u4FQRaMdGQCElH7xzwNht6QOApJyhcxV_pUdUHd&random=1109559659&ipr=y

Request Chain 188

https://c.clarity.ms/c.gif HTTP 302
https://c.bing.com/c.gif?ctsa=mr&CtsSyncId=E9145896A9784D4E9511EDBE98EAD5CB&RedC=c.clarity.ms&MXFR=3503D6B96BA76204291FC57B6FA76C5A HTTP 302
https://c.clarity.ms/c.gif?ctsa=mr&CtsSyncId=E9145896A9784D4E9511EDBE98EAD5CB&MUID=1092E828465369190596FBEA47FF6870

282 HTTP transactions
2 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
arcticwolf.com/resources/blog/tellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware/ 389 KB
61 KB 191ms
63ms Document
text/html 13.224.189.102
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://arcticwolf.com/resources/blog/tellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.189.102 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-224-189-102.fra2.r.cloudfront.net

Software

AmazonS3 /

Resource Hash

cf48573e140a266c7f3f7143927609cce8e0ddb49f35172c2f51f75bfbf742e1

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 489
cache-control: must-revalidate, max-age=0, s-maxage=86400
content-encoding: gzip
content-type: text/html; charset=UTF-8
date: Tue, 07 Nov 2023 16:40:20 GMT
etag: W/"a0e97e7f91951f13b0851695b6f2b259"
last-modified: Tue, 07 Nov 2023 16:36:18 GMT
server: AmazonS3
strict-transport-security: max-age=63072000; includeSubdomains; preload
vary: Accept-Encoding
via: 1.1 c80ae6bd97b709ed6e4747f0d5ea4efc.cloudfront.net (CloudFront), 1.1 3bf3e75bcb9a86b3eb343a1d4392a6de.cloudfront.net (CloudFront)
x-amz-cf-id: xWI5W1BF0Q6SfFdIcGpFhRXQiIqDk93PEKzLc6OEHlWaF15xmA_BQg==
x-amz-cf-pop: FRA60-P3 FRA2-C1
x-amz-version-id: 7Awp5PFiYioTthqj5zUpyd3OeCJHab4G
x-cache: Miss from cloudfront
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN

GET
H2 200 marvel.js Show response
marvel-b2-cdn.bc0a.com/ 9 KB
4 KB 160ms
40ms Script
application/javascript 35.201.125.192
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://marvel-b2-cdn.bc0a.com/marvel.js

Requested by

Host: arcticwolf.com
URL: https://arcticwolf.com/resources/blog/tellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

35.201.125.192 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

192.125.201.35.bc.googleusercontent.com

Software

UploadServer /

Resource Hash

190db2ea37186511e3cdfaeb6e37e68830c90647a9c18840f33ce00c03a05bd0

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' 'unsafe-inline';
Strict-Transport-Security	max-age=63072000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://arcticwolf.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 16:13:25 GMT
content-encoding: gzip
strict-transport-security: max-age=63072000; includeSubDomains
content-security-policy: default-src 'self' 'unsafe-inline';
age: 2103
x-guploader-uploadid: ABPtcPp5QnSKwC0A-bU9WX-aMvFCyt4GupofyhSbVYVJKqo71rq0j4pq3Vv7t4A1KKR1sNiAHPxtTc-fK3mWvG25-cSNgpTpDqEK
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 2
x-goog-stored-content-encoding: gzip
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 3142
last-modified: Wed, 12 Apr 2023 17:03:33 GMT
server: UploadServer
etag: "0b57832ab47cd1fea51ee8a2dfa4f649"
vary: Accept-Encoding
x-goog-hash: crc32c=EF0vLQ==, md5=C1eDKrR80f6lHuii36T2SQ==
x-goog-generation: 1681319013677342
content-language: en
access-control-allow-origin: *
access-control-expose-headers: Content-Type
cache-control: public, max-age=3600
x-goog-stored-content-length: 3142
accept-ranges: bytes
content-type: application/javascript
expires: Tue, 07 Nov 2023 17:13:25 GMT

GET
H2 200 premium-addons.min.css
arcticwolf.com/wp-content/plugins/premium-addons-for-elementor/assets/frontend/min-css/ 355 KB
42 KB 471ms
460ms Stylesheet
text/css 13.224.189.102
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://arcticwolf.com/wp-content/plugins/premium-addons-for-elementor/assets/frontend/min-css/premium-addons.min.css?ver=4.10.14

Requested by

Host: arcticwolf.com
URL: https://arcticwolf.com/resources/blog/tellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.189.102 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-224-189-102.fra2.r.cloudfront.net

Software

AmazonS3 /

Resource Hash

42e75f4dd3477b364ab00bac4c00e3aeb82e4f9cb848bf5afe95bf714172ec81

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://arcticwolf.com/resources/blog/tellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 16:48:29 GMT
x-amz-version-id: rIOy5GQKm7.We5jx05uLtgp.C_UoJlqx
x-content-type-options: nosniff
strict-transport-security: max-age=63072000; includeSubdomains; preload
content-encoding: gzip
x-amz-cf-pop: FRA60-P3, FRA2-C1
via: 1.1 3296b04068551f925d5fafd1b785ff30.cloudfront.net (CloudFront), 1.1 3bf3e75bcb9a86b3eb343a1d4392a6de.cloudfront.net (CloudFront)
x-cache: Miss from cloudfront
last-modified: Tue, 07 Nov 2023 16:16:08 GMT
server: AmazonS3
etag: W/"7f4f05bc8f031fe63c23ec1c8f6703e2"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=31536000
x-amz-cf-id: iSySPWgyIsTvujgwqRCARdwefGH-VB_28W4TleqRWr-LaGvCAZVJ5w==

GET
H2 200 premium-addons.min.css
arcticwolf.com/wp-content/plugins/premium-addons-pro/assets/frontend/min-css/ 200 KB
25 KB 305ms
294ms Stylesheet
text/css 13.224.189.102
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://arcticwolf.com/wp-content/plugins/premium-addons-pro/assets/frontend/min-css/premium-addons.min.css?ver=2.9.8

Requested by

Host: arcticwolf.com
URL: https://arcticwolf.com/resources/blog/tellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.189.102 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-224-189-102.fra2.r.cloudfront.net

Software

AmazonS3 /

Resource Hash

fd286663cd94d01fd93d5a6e9e397341593939340afeb76e2ee54ee8f5a4be37

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://arcticwolf.com/resources/blog/tellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 16:48:29 GMT
x-amz-version-id: klENvOWYHy4L15eiTNwbTUR0PffXt1if
x-content-type-options: nosniff
strict-transport-security: max-age=63072000; includeSubdomains; preload
content-encoding: gzip
x-amz-cf-pop: FRA60-P3, FRA2-C1
via: 1.1 6bf2ca4ea5a5c92a1d7cd2f9767e8674.cloudfront.net (CloudFront), 1.1 3bf3e75bcb9a86b3eb343a1d4392a6de.cloudfront.net (CloudFront)
x-cache: Miss from cloudfront
last-modified: Tue, 07 Nov 2023 16:16:09 GMT
server: AmazonS3
etag: W/"199caceae643181f4a44af99234a6feb"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=31536000
x-amz-cf-id: QXIsr55W_YfuSXhldOrkJDOLwJbG8DRbvE1RyhpYgO0h7viJOhSXkA==

GET
H2 200 styles.css
arcticwolf.com/wp-content/plugins/sitepress-multilingual-cms/dist/css/blocks/ 58 KB
9 KB 247ms
236ms Stylesheet
text/css 13.224.189.102
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://arcticwolf.com/wp-content/plugins/sitepress-multilingual-cms/dist/css/blocks/styles.css?ver=4.6.6

Requested by

Host: arcticwolf.com
URL: https://arcticwolf.com/resources/blog/tellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.189.102 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-224-189-102.fra2.r.cloudfront.net

Software

AmazonS3 /

Resource Hash

58c855e7eb9b917e71e6b733e73c542c25bacb986f3ba7df2be1570200312135

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://arcticwolf.com/resources/blog/tellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 16:48:29 GMT
x-amz-version-id: yA7VawGwf5Q9d359R1NB4Jhn.J4PhMOB
x-content-type-options: nosniff
strict-transport-security: max-age=63072000; includeSubdomains; preload
content-encoding: gzip
x-amz-cf-pop: FRA60-P3, FRA2-C1
via: 1.1 c43915e0cad14ee7685e5f74a99ce93c.cloudfront.net (CloudFront), 1.1 3bf3e75bcb9a86b3eb343a1d4392a6de.cloudfront.net (CloudFront)
x-cache: Miss from cloudfront
last-modified: Tue, 07 Nov 2023 16:16:01 GMT
server: AmazonS3
etag: W/"4940e4ae72b6124a6eab7e97fc8df1f4"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=31536000
x-amz-cf-id: q-lISnWMXFFFoMgqNJgmB74iIg8hneIYhBXRXcehcBu7eQWRY9Kl4A==

GET
H2 200 strattic-search.css
arcticwolf.com/wp-content/plugins/strattic-search-extension/assets/ 2 KB
1 KB 503ms
492ms Stylesheet
text/css 13.224.189.102
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://arcticwolf.com/wp-content/plugins/strattic-search-extension/assets/strattic-search.css?ver=1.0

Requested by

Host: arcticwolf.com
URL: https://arcticwolf.com/resources/blog/tellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.189.102 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-224-189-102.fra2.r.cloudfront.net

Software

AmazonS3 /

Resource Hash

3d0a742c9613bf7bb6797f4cf0568f031c40de94b40a3ba2b6df5938a76aa5c0

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://arcticwolf.com/resources/blog/tellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 16:48:29 GMT
x-amz-version-id: YDEdGtUPBqLWjTDrPExxzqVNtiClEGvP
x-content-type-options: nosniff
strict-transport-security: max-age=63072000; includeSubdomains; preload
content-encoding: gzip
x-amz-cf-pop: FRA60-P3, FRA2-C1
via: 1.1 b43c04a791e8dcb8ddb6bb0847fcf95a.cloudfront.net (CloudFront), 1.1 3bf3e75bcb9a86b3eb343a1d4392a6de.cloudfront.net (CloudFront)
x-cache: Miss from cloudfront
last-modified: Mon, 06 Nov 2023 22:18:24 GMT
server: AmazonS3
etag: W/"98becf92e15740fd07b99fe520a9d392"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=31536000
x-amz-cf-id: vUitDs5hKQb55IKzMhJCvEkZFFPR-53IMdK_n092a2-pVPrpAkBoyA==

GET
H2 200 style.min.css
arcticwolf.com/wp-content/plugins/sitepress-multilingual-cms/templates/language-switchers/legacy-dropdown/ 2 KB
1 KB 472ms
461ms Stylesheet
text/css 13.224.189.102
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://arcticwolf.com/wp-content/plugins/sitepress-multilingual-cms/templates/language-switchers/legacy-dropdown/style.min.css?ver=1

Requested by

Host: arcticwolf.com
URL: https://arcticwolf.com/resources/blog/tellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.189.102 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-224-189-102.fra2.r.cloudfront.net

Software

AmazonS3 /

Resource Hash

1aeb9107928bb523947c28e17358efb50a07b942e15ed0a72259a5794ea2ca96

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://arcticwolf.com/resources/blog/tellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 16:48:29 GMT
x-amz-version-id: 9nHZIg3rqMJTlC7kkhIdraexaTtZbXOC
x-content-type-options: nosniff
strict-transport-security: max-age=63072000; includeSubdomains; preload
content-encoding: gzip
x-amz-cf-pop: FRA60-P3, FRA2-C1
via: 1.1 fa8c9f29fb8ef5c537a2a53f4de05240.cloudfront.net (CloudFront), 1.1 3bf3e75bcb9a86b3eb343a1d4392a6de.cloudfront.net (CloudFront)
x-cache: Miss from cloudfront
last-modified: Tue, 07 Nov 2023 16:16:11 GMT
server: AmazonS3
etag: W/"72a49c98f1c6118869dd01f1bdce2fce"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=31536000
x-amz-cf-id: g9BsmqjQfYrmSlodDNqP9r9ws7SPH2uqA-tir3gFX_IzEFXzdzjFnA==

GET
H2 200 style_en.css
arcticwolf.com/wp-content/uploads/maxmegamenu/ 323 KB
26 KB 93ms
86ms Stylesheet
text/css 13.224.189.102
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://arcticwolf.com/wp-content/uploads/maxmegamenu/style_en.css?ver=5fd7f2

Requested by

Host: arcticwolf.com
URL: https://arcticwolf.com/resources/blog/tellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.189.102 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-224-189-102.fra2.r.cloudfront.net

Software

AmazonS3 /

Resource Hash

31f7d8113ce6f90108d916a4d35c15a1ee50fe171224ff0d122e310005e08960

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://arcticwolf.com/resources/blog/tellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 16:38:58 GMT
x-amz-version-id: Lk_fizi71IMzRTASdH4GmmETKBU77mm4
x-content-type-options: nosniff
strict-transport-security: max-age=63072000; includeSubdomains; preload
content-encoding: gzip
x-amz-cf-pop: FRA60-P3, FRA2-C1
age: 571
via: 1.1 5b6e22c950501920595c86fc25834582.cloudfront.net (CloudFront), 1.1 3bf3e75bcb9a86b3eb343a1d4392a6de.cloudfront.net (CloudFront)
x-cache: Miss from cloudfront
last-modified: Tue, 07 Nov 2023 16:16:11 GMT
server: AmazonS3
etag: W/"35f5f43ead5e3689c0d495eb84c8817b"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=31536000
x-amz-cf-id: psNzwDJAXcXrSsVkRI0L2_dw6jD788XB02yt3-t9ZLOmGcpgB7GhNA==

GET
H2 200 dashicons.min.css
arcticwolf.com/wp-includes/css/ 58 KB
36 KB 358ms
351ms Stylesheet
text/css 13.224.189.102
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://arcticwolf.com/wp-includes/css/dashicons.min.css?ver=6.3.2

Requested by

Host: arcticwolf.com
URL: https://arcticwolf.com/resources/blog/tellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.189.102 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-224-189-102.fra2.r.cloudfront.net

Software

AmazonS3 /

Resource Hash

c21e5a2b32c47bc5f9d9efc97bc0e29fd081946d1d3ebffc5621cfafb1d3960e

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://arcticwolf.com/resources/blog/tellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 16:48:29 GMT
x-amz-version-id: Q3nDyrNjgJE1UtW4TR92igIvNnn1iKAw
x-content-type-options: nosniff
strict-transport-security: max-age=63072000; includeSubdomains; preload
content-encoding: gzip
x-amz-cf-pop: FRA60-P3, FRA2-C1
via: 1.1 fa8c9f29fb8ef5c537a2a53f4de05240.cloudfront.net (CloudFront), 1.1 3bf3e75bcb9a86b3eb343a1d4392a6de.cloudfront.net (CloudFront)
x-cache: Miss from cloudfront
last-modified: Tue, 07 Nov 2023 16:16:05 GMT
server: AmazonS3
etag: W/"d68d6bf519169d86e155bad0bed833f8"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=31536000
x-amz-cf-id: JrkJv35DvmRyxJfixwXjZoLTlXUnT0xzVj4u0JEVFR5AvZWG0Vgq2Q==

GET
H2 200 all.min.css
arcticwolf.com/wp-content/plugins/megamenu-pro/icons/fontawesome6/css/ 100 KB
22 KB 514ms
507ms Stylesheet
text/css 13.224.189.102
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://arcticwolf.com/wp-content/plugins/megamenu-pro/icons/fontawesome6/css/all.min.css?ver=2.3

Requested by

Host: arcticwolf.com
URL: https://arcticwolf.com/resources/blog/tellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.189.102 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-224-189-102.fra2.r.cloudfront.net

Software

AmazonS3 /

Resource Hash

0934b1fc0d3a766d41d3adf5e7a115875e66e98ebba408d965a41cf3d2cb4ab5

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://arcticwolf.com/resources/blog/tellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 16:48:29 GMT
x-amz-version-id: 6i92j0js9FI1QvFLLcZodF_eL8ZMGfUW
x-content-type-options: nosniff
strict-transport-security: max-age=63072000; includeSubdomains; preload
content-encoding: gzip
x-amz-cf-pop: FRA60-P3, FRA2-C1
via: 1.1 7fd88bab22735486702d23ba4e028d86.cloudfront.net (CloudFront), 1.1 3bf3e75bcb9a86b3eb343a1d4392a6de.cloudfront.net (CloudFront)
x-cache: Miss from cloudfront
last-modified: Tue, 07 Nov 2023 16:15:59 GMT
server: AmazonS3
etag: W/"5222e06b77a1692fa2520a219840e6be"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=31536000
x-amz-cf-id: TXYa_MJVQJitm0cf0VgFTGEdvGTRouKu2Dmlnz0gOYuB9zmib65EvA==

GET
H2 200 style.css
arcticwolf.com/wp-content/themes/blankslate-child/ 23 KB
5 KB 389ms
382ms Stylesheet
text/css 13.224.189.102
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://arcticwolf.com/wp-content/themes/blankslate-child/style.css?ver=6.3.2

Requested by

Host: arcticwolf.com
URL: https://arcticwolf.com/resources/blog/tellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.189.102 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-224-189-102.fra2.r.cloudfront.net

Software

AmazonS3 /

Resource Hash

c5904cf8f871eff63432d228df275b03148a0f5e8cc30abfed54f8a8dac1966a

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://arcticwolf.com/resources/blog/tellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 16:48:29 GMT
x-amz-version-id: QzUGeHM5e6Rza9N2WDvQmSLibtfdf2xv
x-content-type-options: nosniff
strict-transport-security: max-age=63072000; includeSubdomains; preload
content-encoding: gzip
x-amz-cf-pop: FRA60-P3, FRA2-C1
via: 1.1 c80ae6bd97b709ed6e4747f0d5ea4efc.cloudfront.net (CloudFront), 1.1 3bf3e75bcb9a86b3eb343a1d4392a6de.cloudfront.net (CloudFront)
x-cache: Miss from cloudfront
last-modified: Tue, 07 Nov 2023 16:16:02 GMT
server: AmazonS3
etag: W/"e3c319ae4cb9ac69d6d043628c7a4551"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=31536000
x-amz-cf-id: 3FgP8vM_2-sS57edNDqWcYTLs9Df7bqsKyXtxkRZxU3I71NQe_bfaw==

GET
H2 200 elementor-icons.min.css
arcticwolf.com/wp-content/plugins/elementor/assets/lib/eicons/css/ 19 KB
4 KB 276ms
269ms Stylesheet
text/css 13.224.189.102
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://arcticwolf.com/wp-content/plugins/elementor/assets/lib/eicons/css/elementor-icons.min.css?ver=5.23.0

Requested by

Host: arcticwolf.com
URL: https://arcticwolf.com/resources/blog/tellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.189.102 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-224-189-102.fra2.r.cloudfront.net

Software

AmazonS3 /

Resource Hash

941b1493157dfb7316bcb3c7357a94e9ba173607d80559408620f4ab4c39c88d

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://arcticwolf.com/resources/blog/tellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 16:48:29 GMT
x-amz-version-id: eT4QVDSfWWMSJ1KY258lBC3A2UF4Sr8u
x-content-type-options: nosniff
strict-transport-security: max-age=63072000; includeSubdomains; preload
content-encoding: gzip
x-amz-cf-pop: FRA60-P3, FRA2-C1
via: 1.1 6ae82cc0c8a39c993134c2be90b4d120.cloudfront.net (CloudFront), 1.1 3bf3e75bcb9a86b3eb343a1d4392a6de.cloudfront.net (CloudFront)
x-cache: Miss from cloudfront
last-modified: Tue, 07 Nov 2023 16:16:10 GMT
server: AmazonS3
etag: W/"3683d21c678ef9e264a1cb0fa2007285"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=31536000
x-amz-cf-id: OxttJIv5VbY6Vxcx8rhGdWKOo9Y-ZYJCNVdeWu6rgtOcq1A4mH2AhA==

GET
H2 200 frontend.min.css
arcticwolf.com/wp-content/plugins/elementor/assets/css/ 167 KB
20 KB 295ms
288ms Stylesheet
text/css 13.224.189.102
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://arcticwolf.com/wp-content/plugins/elementor/assets/css/frontend.min.css?ver=3.17.2

Requested by

Host: arcticwolf.com
URL: https://arcticwolf.com/resources/blog/tellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.189.102 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-224-189-102.fra2.r.cloudfront.net

Software

AmazonS3 /

Resource Hash

d2fed8e15746b8f841e6ca76b690a83fd254e038616529e81e38c0d9f36f3ca0

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://arcticwolf.com/resources/blog/tellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 16:48:29 GMT
x-amz-version-id: fbBqYh1bkfgYjysrNjuWJF9Wl9iZwYn3
x-content-type-options: nosniff
strict-transport-security: max-age=63072000; includeSubdomains; preload
content-encoding: gzip
x-amz-cf-pop: FRA60-P3, FRA2-C1
via: 1.1 a54cda8ccda3480314f451558e4dd062.cloudfront.net (CloudFront), 1.1 3bf3e75bcb9a86b3eb343a1d4392a6de.cloudfront.net (CloudFront)
x-cache: Miss from cloudfront
last-modified: Tue, 07 Nov 2023 16:16:04 GMT
server: AmazonS3
etag: W/"af2973173a2e7b652cf5f47f82d04668"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=31536000
x-amz-cf-id: YmX-475_k63huhPrulqG5Oej7OQnL6eX10bPSXxzdbdo4sfS0LgV4w==

GET
H2 200 swiper.min.css
arcticwolf.com/wp-content/plugins/elementor/assets/lib/swiper/css/ 13 KB
3 KB 332ms
326ms Stylesheet
text/css 13.224.189.102
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://arcticwolf.com/wp-content/plugins/elementor/assets/lib/swiper/css/swiper.min.css?ver=5.3.6

Requested by

Host: arcticwolf.com
URL: https://arcticwolf.com/resources/blog/tellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.189.102 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-224-189-102.fra2.r.cloudfront.net

Software

AmazonS3 /

Resource Hash

d622534d53d3ac1095af275f0b30274fcd835785577df2dde6d9398e6f7a2c8f

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://arcticwolf.com/resources/blog/tellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 16:48:29 GMT
x-amz-version-id: BQ3k_aqr_NZ4OVMzRCh7pd_cL_r12dfa
x-content-type-options: nosniff
strict-transport-security: max-age=63072000; includeSubdomains; preload
content-encoding: gzip
x-amz-cf-pop: FRA60-P3, FRA2-C1
via: 1.1 319f376925908156190f5fc160137b42.cloudfront.net (CloudFront), 1.1 3bf3e75bcb9a86b3eb343a1d4392a6de.cloudfront.net (CloudFront)
x-cache: Miss from cloudfront
last-modified: Tue, 07 Nov 2023 16:16:00 GMT
server: AmazonS3
etag: W/"bcad7781b3e74db2565b8424c45232cd"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=31536000
x-amz-cf-id: pj1UkbyaBqpDM9tvjS0H70QpKRGdEHjWNvNzA6gtqalkO3Mj4bCOCQ==

GET
H2 200 post-16145.css
arcticwolf.com/wp-content/uploads/elementor/css/ 4 KB
1 KB 377ms
371ms Stylesheet
text/css 13.224.189.102
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://arcticwolf.com/wp-content/uploads/elementor/css/post-16145.css?ver=1698970864

Requested by

Host: arcticwolf.com
URL: https://arcticwolf.com/resources/blog/tellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.189.102 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-224-189-102.fra2.r.cloudfront.net

Software

AmazonS3 /

Resource Hash

9c637b699240b1c90cdfc30198a397159051cb59db4ab6e49f9d231992824b93

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://arcticwolf.com/resources/blog/tellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 16:48:29 GMT
x-amz-version-id: XHxS97z2fC03NQMxhHfJ0uvxh65bjX8A
x-content-type-options: nosniff
strict-transport-security: max-age=63072000; includeSubdomains; preload
content-encoding: gzip
x-amz-cf-pop: FRA60-P3, FRA2-C1
via: 1.1 7fd88bab22735486702d23ba4e028d86.cloudfront.net (CloudFront), 1.1 3bf3e75bcb9a86b3eb343a1d4392a6de.cloudfront.net (CloudFront)
x-cache: Miss from cloudfront
last-modified: Tue, 07 Nov 2023 16:16:02 GMT
server: AmazonS3
etag: W/"b99a92b7420e4e28f9c6d9458a38b23d"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=31536000
x-amz-cf-id: HgFnasLqNblpy_A17zLKLIaTWuyRM-nORYAszVF_UPLcTVq8ztnhvw==

GET
H2 200 frontend.min.css
arcticwolf.com/wp-content/plugins/elementor-pro/assets/css/ 440 KB
42 KB 331ms
325ms Stylesheet
text/css 13.224.189.102
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://arcticwolf.com/wp-content/plugins/elementor-pro/assets/css/frontend.min.css?ver=3.17.1

Requested by

Host: arcticwolf.com
URL: https://arcticwolf.com/resources/blog/tellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.189.102 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-224-189-102.fra2.r.cloudfront.net

Software

AmazonS3 /

Resource Hash

54b504a934b8cc1b8bf548c18b209e1f490a9ed03e7d6905935743d488e02344

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://arcticwolf.com/resources/blog/tellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 16:48:29 GMT
x-amz-version-id: sDjAnwGbaBiNZm4ZpY2FIf.grTBUaaDI
x-content-type-options: nosniff
strict-transport-security: max-age=63072000; includeSubdomains; preload
content-encoding: gzip
x-amz-cf-pop: FRA60-P3, FRA2-C1
via: 1.1 319f376925908156190f5fc160137b42.cloudfront.net (CloudFront), 1.1 3bf3e75bcb9a86b3eb343a1d4392a6de.cloudfront.net (CloudFront)
x-cache: Miss from cloudfront
last-modified: Tue, 07 Nov 2023 16:16:01 GMT
server: AmazonS3
etag: W/"7a9007b912b1950d74a0b7d24e702327"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=31536000
x-amz-cf-id: lCJ7z1IHZaLA_RCptNB6l3vHTw63eECS2raa8Rx66rFZH_j3tEo3Uw==

GET
H2 200 all.min.css
arcticwolf.com/wp-content/plugins/elementor/assets/lib/font-awesome/css/ 58 KB
13 KB 306ms
301ms Stylesheet
text/css 13.224.189.102
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://arcticwolf.com/wp-content/plugins/elementor/assets/lib/font-awesome/css/all.min.css?ver=4.10.14

Requested by

Host: arcticwolf.com
URL: https://arcticwolf.com/resources/blog/tellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.189.102 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-224-189-102.fra2.r.cloudfront.net

Software

AmazonS3 /

Resource Hash

d87ddf917b7a1449ab45e2b8e3c98354629bdd65b6659c37e6023bbea1ce1386

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://arcticwolf.com/resources/blog/tellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 16:48:29 GMT
x-amz-version-id: dCeWDDNTzc8BD2PryFDxnO103XgmQM3Y
x-content-type-options: nosniff
strict-transport-security: max-age=63072000; includeSubdomains; preload
content-encoding: gzip
x-amz-cf-pop: FRA60-P3, FRA2-C1
via: 1.1 231be1c97cc722fa08b64d21072ebfac.cloudfront.net (CloudFront), 1.1 3bf3e75bcb9a86b3eb343a1d4392a6de.cloudfront.net (CloudFront)
x-cache: Miss from cloudfront
last-modified: Tue, 07 Nov 2023 16:16:05 GMT
server: AmazonS3
etag: W/"74bab4578692993514e7f882cc15c218"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=31536000
x-amz-cf-id: VyIHn_qPGJcIBDjv2iZQaHDPCBDIsktIc4DAhPgrURIgOepXv7z2dA==

GET
H2 200 v4-shims.min.css
arcticwolf.com/wp-content/plugins/elementor/assets/lib/font-awesome/css/ 26 KB
5 KB 292ms
275ms Stylesheet
text/css 13.224.189.102
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://arcticwolf.com/wp-content/plugins/elementor/assets/lib/font-awesome/css/v4-shims.min.css?ver=3.17.2

Requested by

Host: arcticwolf.com
URL: https://arcticwolf.com/resources/blog/tellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.189.102 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-224-189-102.fra2.r.cloudfront.net

Software

AmazonS3 /

Resource Hash

c55902832fb84522d02ea1a60a30747403a140d8651fa748f13ba398b0c0df3a

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://arcticwolf.com/resources/blog/tellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 16:48:29 GMT
x-amz-version-id: C.UXli50ObzWWRb8FB49ex5su4EvJhYv
x-content-type-options: nosniff
strict-transport-security: max-age=63072000; includeSubdomains; preload
content-encoding: gzip
x-amz-cf-pop: FRA60-P3, FRA2-C1
via: 1.1 319f376925908156190f5fc160137b42.cloudfront.net (CloudFront), 1.1 3bf3e75bcb9a86b3eb343a1d4392a6de.cloudfront.net (CloudFront)
x-cache: Miss from cloudfront
last-modified: Tue, 07 Nov 2023 16:15:59 GMT
server: AmazonS3
etag: W/"c55205bce667f5d812354fd1353e7389"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=31536000
x-amz-cf-id: _i7gcBchzVFhq4xV62IwZJdeLTlZRZC_8LI4PEYT4fbnuGWGLDOm2Q==

GET
H2 200 global.css
arcticwolf.com/wp-content/uploads/elementor/css/ 592 KB
26 KB 455ms
438ms Stylesheet
text/css 13.224.189.102
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://arcticwolf.com/wp-content/uploads/elementor/css/global.css?ver=1698970869

Requested by

Host: arcticwolf.com
URL: https://arcticwolf.com/resources/blog/tellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.189.102 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-224-189-102.fra2.r.cloudfront.net

Software

AmazonS3 /

Resource Hash

59a173f8b6cb9f95f090a5358f2bcb59a4abfafdfe04ef47932312cfe6a14eb1

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://arcticwolf.com/resources/blog/tellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 16:48:29 GMT
x-amz-version-id: 8zfUO1LAvc9B5y2kGsJjnPy.YmibuWQi
x-content-type-options: nosniff
strict-transport-security: max-age=63072000; includeSubdomains; preload
content-encoding: gzip
x-amz-cf-pop: FRA60-P3, FRA2-C1
via: 1.1 68b2682a924ac399aa2724b5b439e75c.cloudfront.net (CloudFront), 1.1 3bf3e75bcb9a86b3eb343a1d4392a6de.cloudfront.net (CloudFront)
x-cache: Miss from cloudfront
last-modified: Tue, 07 Nov 2023 16:16:12 GMT
server: AmazonS3
etag: W/"b45cc215e54277f09f0841e95e920037"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=31536000
x-amz-cf-id: tQaBL_HjGwmLkCMGPuJJ4JODrGsd4suH6nGCGaasBK7CUTEBt25sRQ==

GET
H2 200 post-48911.css
arcticwolf.com/wp-content/uploads/elementor/css/ 34 KB
4 KB 413ms
397ms Stylesheet
text/css 13.224.189.102
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://arcticwolf.com/wp-content/uploads/elementor/css/post-48911.css?ver=1698971223

Requested by

Host: arcticwolf.com
URL: https://arcticwolf.com/resources/blog/tellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.189.102 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-224-189-102.fra2.r.cloudfront.net

Software

AmazonS3 /

Resource Hash

1ec113f46304f75ff44544a25a9116a3798709d10a07c52c5f87c15b8e0f9f43

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://arcticwolf.com/resources/blog/tellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 16:48:29 GMT
x-amz-version-id: ix3DxJIHaVkZEk82..KgBh4wTboavOdK
x-content-type-options: nosniff
strict-transport-security: max-age=63072000; includeSubdomains; preload
content-encoding: gzip
x-amz-cf-pop: FRA60-P3, FRA2-C1
via: 1.1 2a44338adc8233e5b25aca28287a69c8.cloudfront.net (CloudFront), 1.1 3bf3e75bcb9a86b3eb343a1d4392a6de.cloudfront.net (CloudFront)
x-cache: Miss from cloudfront
last-modified: Mon, 06 Nov 2023 22:18:22 GMT
server: AmazonS3
etag: W/"8bc0426f3930b475a37f8d6c08f829eb"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=31536000
x-amz-cf-id: v0GKrviEMAOlYi6UOs1DcU6nye7EUY3b7lDTyN5vkOl4BvhEksLGEg==

GET
H2 200 style.min.css
arcticwolf.com/wp-content/plugins/happy-elementor-addons/assets/fonts/ 25 KB
6 KB 437ms
420ms Stylesheet
text/css 13.224.189.102
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://arcticwolf.com/wp-content/plugins/happy-elementor-addons/assets/fonts/style.min.css?ver=3.9.1.1

Requested by

Host: arcticwolf.com
URL: https://arcticwolf.com/resources/blog/tellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.189.102 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-224-189-102.fra2.r.cloudfront.net

Software

AmazonS3 /

Resource Hash

a526f7e1a82516f99f2639fc48cd8033545c9d1ddae99c01942dede8116d4ee5

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://arcticwolf.com/resources/blog/tellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 16:48:29 GMT
x-amz-version-id: iDrcMPTXnxz5FNZIQnQ_T23DWxoHtl85
x-content-type-options: nosniff
strict-transport-security: max-age=63072000; includeSubdomains; preload
content-encoding: gzip
x-amz-cf-pop: FRA60-P3, FRA2-C1
via: 1.1 7251dede1ac94066b27bcd33919b30c6.cloudfront.net (CloudFront), 1.1 3bf3e75bcb9a86b3eb343a1d4392a6de.cloudfront.net (CloudFront)
x-cache: Miss from cloudfront
last-modified: Tue, 07 Nov 2023 16:16:06 GMT
server: AmazonS3
etag: W/"2a122fab955f87f5d0f9662a8fc5fc24"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=31536000
x-amz-cf-id: h7yMEN20QGgFAfrBDkqu2DTtVBi6B2bNQ1UHFGDD5NZguPs6qMXIyg==

GET
H2 200 font-awesome.min.css
arcticwolf.com/wp-content/plugins/elementor/assets/lib/font-awesome/css/ 30 KB
7 KB 362ms
346ms Stylesheet
text/css 13.224.189.102
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://arcticwolf.com/wp-content/plugins/elementor/assets/lib/font-awesome/css/font-awesome.min.css?ver=4.7.0

Requested by

Host: arcticwolf.com
URL: https://arcticwolf.com/resources/blog/tellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.189.102 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-224-189-102.fra2.r.cloudfront.net

Software

AmazonS3 /

Resource Hash

c4047043368afb4baf1aed25d358a5c2a333842a3b436b58491ab36aeee65b9d

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://arcticwolf.com/resources/blog/tellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 16:48:29 GMT
x-amz-version-id: hEGXMrrI7IVMbRGb3AZlVVzfp8TdNC.X
x-content-type-options: nosniff
strict-transport-security: max-age=63072000; includeSubdomains; preload
content-encoding: gzip
x-amz-cf-pop: FRA60-P3, FRA2-C1
via: 1.1 d262e104d5d9dd6a4a52f090bdf9395c.cloudfront.net (CloudFront), 1.1 3bf3e75bcb9a86b3eb343a1d4392a6de.cloudfront.net (CloudFront)
x-cache: Miss from cloudfront
last-modified: Tue, 07 Nov 2023 16:16:15 GMT
server: AmazonS3
etag: W/"008e0bb5ebfa7bc298a042f95944df25"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=31536000
x-amz-cf-id: IJc4RTjibTRZk-ZfQYTmtW9fPyEQF9DMTU9L_mbybyEvlpWMOPcDmQ==

GET
H2 200 general.min.css
arcticwolf.com/wp-content/plugins/essential-addons-for-elementor-lite/assets/front-end/css/view/ 3 KB
1 KB 375ms
359ms Stylesheet
text/css 13.224.189.102
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://arcticwolf.com/wp-content/plugins/essential-addons-for-elementor-lite/assets/front-end/css/view/general.min.css?ver=5.8.13

Requested by

Host: arcticwolf.com
URL: https://arcticwolf.com/resources/blog/tellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.189.102 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-224-189-102.fra2.r.cloudfront.net

Software

AmazonS3 /

Resource Hash

3e584003b5c6df9bc2854b2775e527ef7240f3d1cae4047e9aa504cdfbc109f9

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://arcticwolf.com/resources/blog/tellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 16:48:29 GMT
x-amz-version-id: 1qbFIfDpJPJ7iiVHrvWbgdufYTAEjvLB
x-content-type-options: nosniff
strict-transport-security: max-age=63072000; includeSubdomains; preload
content-encoding: gzip
x-amz-cf-pop: FRA60-P3, FRA2-C1
via: 1.1 c80ae6bd97b709ed6e4747f0d5ea4efc.cloudfront.net (CloudFront), 1.1 3bf3e75bcb9a86b3eb343a1d4392a6de.cloudfront.net (CloudFront)
x-cache: Miss from cloudfront
last-modified: Tue, 07 Nov 2023 16:16:01 GMT
server: AmazonS3
etag: W/"ac793cfd8de80e4763d4f9ded0d96508"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=31536000
x-amz-cf-id: 5R2WYkPmVrVlUOgstWoWp_AnTpu2IcaG_z6X_MSPYrPpvlAQPujWTA==

GET
H2 200 css
fonts.googleapis.com/ 43 KB
2 KB 159ms
54ms Stylesheet
text/css 2a00:1450:4001:810::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Encode+Sans%3A100%2C100italic%2C200%2C200italic%2C300%2C300italic%2C400%2C400italic%2C500%2C500italic%2C600%2C600italic%2C700%2C700italic%2C800%2C800italic%2C900%2C900italic%7CLato%3A100%2C100italic%2C200%2C200italic%2C300%2C300italic%2C400%2C400italic%2C500%2C500italic%2C600%2C600italic%2C700%2C700italic%2C800%2C800italic%2C900%2C900italic%7CRoboto%3A100%2C100italic%2C200%2C200italic%2C300%2C300italic%2C400%2C400italic%2C500%2C500italic%2C600%2C600italic%2C700%2C700italic%2C800%2C800italic%2C900%2C900italic&display=auto&ver=6.3.2

Requested by

Host: arcticwolf.com
URL: https://arcticwolf.com/resources/blog/tellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

4cd62f7068c73edc7f160882c315aa7aed6df4740fba5cb504f9c413400c093c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://arcticwolf.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Tue, 07 Nov 2023 16:48:28 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Tue, 07 Nov 2023 16:48:28 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Tue, 07 Nov 2023 16:48:28 GMT

GET
H2 200 fontawesome.min.css
arcticwolf.com/wp-content/plugins/elementor/assets/lib/font-awesome/css/ 57 KB
13 KB 391ms
377ms Stylesheet
text/css 13.224.189.102
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://arcticwolf.com/wp-content/plugins/elementor/assets/lib/font-awesome/css/fontawesome.min.css?ver=5.15.3

Requested by

Host: arcticwolf.com
URL: https://arcticwolf.com/resources/blog/tellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.189.102 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-224-189-102.fra2.r.cloudfront.net

Software

AmazonS3 /

Resource Hash

d01a2ba2805c78957e15a2958135de0f3cb88e95159dd0f6c0a032bd76b1b0e9

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://arcticwolf.com/resources/blog/tellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 16:48:29 GMT
x-amz-version-id: z14p0NV0ppp47GTG12U1Z.PQjeVEmdHt
x-content-type-options: nosniff
strict-transport-security: max-age=63072000; includeSubdomains; preload
content-encoding: gzip
x-amz-cf-pop: FRA60-P3, FRA2-C1
via: 1.1 5b6e22c950501920595c86fc25834582.cloudfront.net (CloudFront), 1.1 3bf3e75bcb9a86b3eb343a1d4392a6de.cloudfront.net (CloudFront)
x-cache: Miss from cloudfront
last-modified: Tue, 07 Nov 2023 16:15:59 GMT
server: AmazonS3
etag: W/"eeb705d0bdccfd645d3bbd46dd1fbab3"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=31536000
x-amz-cf-id: 7TgYpLca5O5zk8us3TsU-3hnvvAJz_qJtr1RTzqJGtU5mWBno43-Sg==

GET
H2 200 solid.min.css
arcticwolf.com/wp-content/plugins/elementor/assets/lib/font-awesome/css/ 669 B
1 KB 412ms
399ms Stylesheet
text/css 13.224.189.102
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://arcticwolf.com/wp-content/plugins/elementor/assets/lib/font-awesome/css/solid.min.css?ver=5.15.3

Requested by

Host: arcticwolf.com
URL: https://arcticwolf.com/resources/blog/tellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.189.102 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-224-189-102.fra2.r.cloudfront.net

Software

AmazonS3 /

Resource Hash

37bab6cd583982e8eff58501a99d7c5c4d63664c1ca34f9e3b7cf526c5b73ae2

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://arcticwolf.com/resources/blog/tellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 16:48:29 GMT
x-amz-version-id: NZEwR5db.TSgskIeJFfmI96nN0kEvxS5
x-content-type-options: nosniff
strict-transport-security: max-age=63072000; includeSubdomains; preload
last-modified: Tue, 07 Nov 2023 16:16:13 GMT
server: AmazonS3
via: 1.1 d262e104d5d9dd6a4a52f090bdf9395c.cloudfront.net (CloudFront), 1.1 3bf3e75bcb9a86b3eb343a1d4392a6de.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P3, FRA2-C1
etag: "9eb2d3c87feb6bb2ffa63b70532b1477"
x-frame-options: SAMEORIGIN
x-cache: Miss from cloudfront
content-type: text/css
cache-control: max-age=31536000
content-length: 669
x-amz-cf-id: UdLQaMCLD48O5efWszQT5fXrw-U0kvwn8freAYIyQrugF6CENwAC-A==

GET
H2 200 script.min.js Show response
arcticwolf.com/wp-content/plugins/sitepress-multilingual-cms/templates/language-switchers/legacy-dropdown/ 409 B
948 B 383ms
370ms Script
application/javascript 13.224.189.102
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://arcticwolf.com/wp-content/plugins/sitepress-multilingual-cms/templates/language-switchers/legacy-dropdown/script.min.js?ver=1

Requested by

Host: arcticwolf.com
URL: https://arcticwolf.com/resources/blog/tellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.189.102 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-224-189-102.fra2.r.cloudfront.net

Software

AmazonS3 /

Resource Hash

f7bb442b06bfb13ecfee3c3ec2b6b19440a33e080ca9378f8d6f161281bd01ed

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://arcticwolf.com/resources/blog/tellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 16:48:29 GMT
x-amz-version-id: ksCmxYWw4o.Jq_vJhvNxD7fBlyrQ2.YQ
x-content-type-options: nosniff
strict-transport-security: max-age=63072000; includeSubdomains; preload
last-modified: Tue, 07 Nov 2023 16:16:01 GMT
server: AmazonS3
via: 1.1 fa8c9f29fb8ef5c537a2a53f4de05240.cloudfront.net (CloudFront), 1.1 3bf3e75bcb9a86b3eb343a1d4392a6de.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P3, FRA2-C1
etag: "b2cb713d9736e814a08353c2fedcb8e1"
x-frame-options: SAMEORIGIN
x-cache: Miss from cloudfront
content-type: application/javascript
cache-control: max-age=31536000
content-length: 409
x-amz-cf-id: fiI_aKqqb4Ceb00RJw1WstKkd7CkQ0hRHSgIMeNqzRFM5riPYyh11Q==

GET
H2 200 jquery.min.js Show response
arcticwolf.com/wp-includes/js/jquery/ 85 KB
30 KB 297ms
285ms Script
application/javascript 13.224.189.102
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://arcticwolf.com/wp-includes/js/jquery/jquery.min.js?ver=3.7.0

Requested by

Host: arcticwolf.com
URL: https://arcticwolf.com/resources/blog/tellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.189.102 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-224-189-102.fra2.r.cloudfront.net

Software

AmazonS3 /

Resource Hash

5c93f77799d122fb5255ee24da285f9f228cc118cba11e6ceb2b6bda8cdf4164

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://arcticwolf.com/resources/blog/tellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 16:48:29 GMT
x-amz-version-id: vQoNmZsN5AUek6LP2KsIAyPeHs5_Xp_L
x-content-type-options: nosniff
strict-transport-security: max-age=63072000; includeSubdomains; preload
content-encoding: gzip
x-amz-cf-pop: FRA60-P3, FRA2-C1
via: 1.1 968007545c497b68cc41825f11e930ba.cloudfront.net (CloudFront), 1.1 3bf3e75bcb9a86b3eb343a1d4392a6de.cloudfront.net (CloudFront)
x-cache: Miss from cloudfront
last-modified: Tue, 07 Nov 2023 16:16:13 GMT
server: AmazonS3
etag: W/"ff04dd1ef5c67998d8652330c0441689"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=31536000
x-amz-cf-id: ZCn8NFmcQ_FiG2KMJqNvQRMezeOcOS_jOuEnDgArLGwO3idMpo7Pag==

GET
H2 200 jquery-migrate.min.js Show response
arcticwolf.com/wp-includes/js/jquery/ 13 KB
5 KB 336ms
323ms Script
application/javascript 13.224.189.102
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://arcticwolf.com/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.4.1

Requested by

Host: arcticwolf.com
URL: https://arcticwolf.com/resources/blog/tellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.189.102 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-224-189-102.fra2.r.cloudfront.net

Software

AmazonS3 /

Resource Hash

5274f11e6fb32ae0cf2dfb9f8043272865c397a7c4223b4cfa7d50ea52fbde89

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://arcticwolf.com/resources/blog/tellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 16:48:29 GMT
x-amz-version-id: _VIKgP5b1U1mgSwIY38ZE3Tr_uDVtPeC
x-content-type-options: nosniff
strict-transport-security: max-age=63072000; includeSubdomains; preload
content-encoding: gzip
x-amz-cf-pop: FRA60-P3, FRA2-C1
via: 1.1 a54cda8ccda3480314f451558e4dd062.cloudfront.net (CloudFront), 1.1 3bf3e75bcb9a86b3eb343a1d4392a6de.cloudfront.net (CloudFront)
x-cache: Miss from cloudfront
last-modified: Tue, 07 Nov 2023 16:16:11 GMT
server: AmazonS3
etag: W/"9ffeb32e2d9efbf8f70caabded242267"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=31536000
x-amz-cf-id: jAS3f_fEP8AHAMugv3HXlLqOP8yYnvEwXgWa_IV0ErDtqA1KXmkRLQ==

GET
H2 200 v4-shims.min.js Show response
arcticwolf.com/wp-content/plugins/elementor/assets/lib/font-awesome/js/ 15 KB
5 KB 307ms
303ms Script
application/javascript 13.224.189.102
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://arcticwolf.com/wp-content/plugins/elementor/assets/lib/font-awesome/js/v4-shims.min.js?ver=3.17.2

Requested by

Host: arcticwolf.com
URL: https://arcticwolf.com/resources/blog/tellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.189.102 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-224-189-102.fra2.r.cloudfront.net

Software

AmazonS3 /

Resource Hash

97cf1307c16a437b77b5f7f5c9bc0b985d0745a14be5a279019aca5a3432e264

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://arcticwolf.com/resources/blog/tellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 16:48:29 GMT
x-amz-version-id: 8VCRdmW.oirXtaaQGe.4_1IVT6z3n_KV
x-content-type-options: nosniff
strict-transport-security: max-age=63072000; includeSubdomains; preload
content-encoding: gzip
x-amz-cf-pop: FRA60-P3, FRA2-C1
via: 1.1 7251dede1ac94066b27bcd33919b30c6.cloudfront.net (CloudFront), 1.1 3bf3e75bcb9a86b3eb343a1d4392a6de.cloudfront.net (CloudFront)
x-cache: Miss from cloudfront
last-modified: Tue, 07 Nov 2023 16:16:01 GMT
server: AmazonS3
etag: W/"7a5dea0a705cc2f4cd87dbaaa6666bc6"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=31536000
x-amz-cf-id: Juspgn2sLCqsY_KaYQI791RPN0qqqaICfmJJ1Js5C9K_9TOFxVVjKA==

GET
H2 200 OtAutoBlock.js Show response
cdn.cookielaw.org/consent/db482b86-7cc0-40a4-94cb-f20d32869a3b/ 319 KB
38 KB 192ms
102ms Script
application/x-javascript 2606:4700::6812:82ec
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/consent/db482b86-7cc0-40a4-94cb-f20d32869a3b/OtAutoBlock.js

Requested by

Host: arcticwolf.com
URL: https://arcticwolf.com/resources/blog/tellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:82ec , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

31d95100c99a4bf5539f91f40bf5394d8655bd217c641ee8635f1c2ca355d1a8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://arcticwolf.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Tue, 07 Nov 2023 16:48:28 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
strict-transport-security: max-age=31536000; includeSubDomains; preload
age: 15765
content-md5: ShppntI2wKxzyM/oqaz6bQ==
content-length: 38410
x-ms-lease-status: unlocked
last-modified: Tue, 17 Oct 2023 15:56:52 GMT
server: cloudflare
etag: 0x8DBCF29ADD82369
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: *
x-ms-request-id: 08b35ac9-601e-0016-4412-01cf54000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=86400
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 822710631a3365ab-FRA
expires: Wed, 08 Nov 2023 16:48:28 GMT

GET
H2 200 otSDKStub.js Show response
cdn.cookielaw.org/scripttemplates/ 21 KB
7 KB 179ms
89ms Script
application/javascript 2606:4700::6812:82ec
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/otSDKStub.js

Requested by

Host: arcticwolf.com
URL: https://arcticwolf.com/resources/blog/tellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:82ec , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6b1fc966c38b12c845f9fd8bdb76027106b776783fd44eeed917663942b5fd16

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://arcticwolf.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Tue, 07 Nov 2023 16:48:28 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
content-md5: R1P6TtSHAQZyvOSI/KawHw==
age: 34583
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-length: 6821
x-ms-lease-status: unlocked
last-modified: Mon, 06 Nov 2023 06:07:21 GMT
server: cloudflare
etag: 0x8DBDE8EA363970A
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-ms-request-id: d9ec0525-601e-0064-661e-11c81b000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: max-age=86400
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 822710631a3d65ab-FRA

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 179 KB
66 KB 157ms
60ms Script
application/javascript 2a00:1450:4001:802::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=DC-11592367

Requested by

Host: arcticwolf.com
URL: https://arcticwolf.com/resources/blog/tellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:802::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

9cc67772363e342ed79e99b9c01f3825ac7b282d6721bb67d77acc4ae37183af

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://arcticwolf.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 16:48:29 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 67181
x-xss-protection: 0
last-modified: Tue, 07 Nov 2023 15:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Tue, 07 Nov 2023 16:48:29 GMT

GET
H2 200 pf_header_update.js Show response
arcticwolf.com/wp-content/ 143 KB
22 KB 1130ms
1127ms Script
application/javascript 13.224.189.102
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://arcticwolf.com/wp-content/pf_header_update.js?v=2

Requested by

Host: arcticwolf.com
URL: https://arcticwolf.com/resources/blog/tellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.189.102 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-224-189-102.fra2.r.cloudfront.net

Software

AmazonS3 /

Resource Hash

4fc815561f5badd8bcd806002e2bc8411a6f154679f9bd8bec287fa5685279ed

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://arcticwolf.com/resources/blog/tellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 16:48:30 GMT
x-amz-version-id: BE1eIgg1Y7T.U9TqCyRlaUyjzlIvubiT
x-content-type-options: nosniff
strict-transport-security: max-age=63072000; includeSubdomains; preload
content-encoding: gzip
x-amz-cf-pop: FRA60-P3, FRA2-C1
via: 1.1 39e6266db143f6443f194d8c60e22480.cloudfront.net (CloudFront), 1.1 3bf3e75bcb9a86b3eb343a1d4392a6de.cloudfront.net (CloudFront)
x-cache: Miss from cloudfront
last-modified: Thu, 02 Nov 2023 14:52:29 GMT
server: AmazonS3
etag: W/"23ac895ce4660f45a749268eb2dc738a"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=31536000
x-amz-cf-id: Hw35__vuVbyXj1sT_ST1TenfISXxhySRXhie7vxilzpmMZwxlMqQDQ==

GET
H2 200 overlay.js Show response
app.cdn.lookbookhq.com/libraries/overlay/ 5 KB
2 KB 43ms
40ms Script
application/javascript 13.32.99.6
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://app.cdn.lookbookhq.com/libraries/overlay/overlay.js
Requested by: Host: arcticwolf.com
URL: https://arcticwolf.com/resources/blog/tellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.32.99.6 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-32-99-6.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 261774a6aad24d6e79e6998664f830b37bf553aee6bbb28526d119808b9bf3f8

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://arcticwolf.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

x-amz-version-id: null
content-encoding: gzip
via: 1.1 372875ad1ec20daf24f3f29f14a73cd0.cloudfront.net (CloudFront)
date: Tue, 07 Nov 2023 03:12:58 GMT
last-modified: Wed, 20 Jul 2022 01:16:06 GMT
server: AmazonS3
x-amz-cf-pop: FRA60-P3
age: 48932
etag: W/"813df591b7e8a03ddc84b1be21c23317"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
x-amz-cf-id: lsX_5qiXq4p9kctP7kBQ6uLhbWNMsqNx5dyFZ-U9sPGfoY1CKJXKzQ==

GET
H2 200 overlay.css
app.cdn.lookbookhq.com/libraries/overlay/ 569 B
922 B 173ms
41ms Stylesheet
text/css 13.32.99.6
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://app.cdn.lookbookhq.com/libraries/overlay/overlay.css
Requested by: Host: arcticwolf.com
URL: https://arcticwolf.com/resources/blog/tellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.32.99.6 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-32-99-6.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 5156dff19f3da0b22f54fae9883fdc4a140ab79ec89aac752751e9fc643159bc

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://arcticwolf.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

x-amz-version-id: null
date: Tue, 07 Nov 2023 05:51:18 GMT
via: 1.1 372875ad1ec20daf24f3f29f14a73cd0.cloudfront.net (CloudFront)
last-modified: Wed, 02 Feb 2022 02:43:20 GMT
server: AmazonS3
x-amz-cf-pop: FRA60-P3
age: 39431
etag: "73f6afb49415dbca4824d9ac67763fea"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: text/css
accept-ranges: bytes
content-length: 569
x-amz-cf-id: jj1w6jeeKYY--Y3nsP-rn9jUFCfYZGyqttivp9BA3hTNr69HltECvQ==

GET
H2 200 css
fonts.googleapis.com/ 6 KB
989 B 145ms
52ms Stylesheet
text/css 2a00:1450:4001:810::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Encode+Sans:400,500,600,700,900&display=swap

Requested by

Host: arcticwolf.com
URL: https://arcticwolf.com/resources/blog/tellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

a4070c8c1e9a3ec5f00c5072b23a70a87e32f2c336956bb4d12f515bc05b8196

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://arcticwolf.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Tue, 07 Nov 2023 16:48:28 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Tue, 07 Nov 2023 16:48:28 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Tue, 07 Nov 2023 16:48:28 GMT

GET
H2 200 jukebox.js Show response
cdn-app.pathfactory.com/production/jukebox/current/ 1 MB
305 KB 66ms
45ms Script
application/javascript 13.32.99.6
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn-app.pathfactory.com/production/jukebox/current/jukebox.js
Requested by: Host: arcticwolf.com
URL: https://arcticwolf.com/resources/blog/tellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.32.99.6 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-32-99-6.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: a75d3df8572f228732ea3d2011fbee4e7cf12d8ccd075eab6d420eb7f5550ae6

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://arcticwolf.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

x-amz-version-id: null
content-encoding: gzip
via: 1.1 372875ad1ec20daf24f3f29f14a73cd0.cloudfront.net (CloudFront)
date: Tue, 07 Nov 2023 06:35:00 GMT
last-modified: Thu, 26 Oct 2023 01:07:06 GMT
server: AmazonS3
x-amz-cf-pop: FRA60-P3
age: 36810
x-amz-server-side-encryption: AES256
etag: W/"a2fd1e4bcb9197f449bdfe220a2270d1"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
cache-control: max-age=43200
x-amz-cf-id: LtloYVSAIsHmLCMNq_etcVS4IFXTQAYpXJp2mwtbw0ZLUmlqQZOBUg==

GET
H2 200 AW_LOGO_REVERSE-334.png
arcticwolf.com/wp-content/uploads/2021/11/ 6 KB
7 KB 307ms
306ms Image
image/png 13.224.189.102
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://arcticwolf.com/wp-content/uploads/2021/11/AW_LOGO_REVERSE-334.png

Requested by

Host: arcticwolf.com
URL: https://arcticwolf.com/resources/blog/tellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.189.102 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-224-189-102.fra2.r.cloudfront.net

Software

AmazonS3 /

Resource Hash

04c4d305cf0edc83607305a34cd1e0d6c627e073dfc399ede6ac6729f6c508f3

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://arcticwolf.com/resources/blog/tellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 16:48:29 GMT
x-amz-version-id: 8EBi6UOaSBvFPBbBrEs8HScWTaSjfZab
x-content-type-options: nosniff
strict-transport-security: max-age=63072000; includeSubdomains; preload
last-modified: Wed, 15 Feb 2023 19:17:00 GMT
server: AmazonS3
via: 1.1 5492e1c9a06f2320204e7fcc383cff5c.cloudfront.net (CloudFront), 1.1 3bf3e75bcb9a86b3eb343a1d4392a6de.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P3, FRA2-C1
etag: "c74fe676a9a379941b26886b42997c03"
x-frame-options: SAMEORIGIN
x-cache: Miss from cloudfront
content-type: image/png
cache-control: max-age=31536000
content-length: 6598
x-amz-cf-id: iHI3t1As93PZ7jI3oqqgI41GTVD2tkZhxVr0Y0jlEcO8gfBKvrFdAA==

GET
H2 200 AW-mkto-floating-form-labels-styles-211027.css
cybersecurity.arcticwolf.com/rs/840-OSQ-661/images/ 16 KB
4 KB 832ms
235ms Stylesheet
text/css 104.17.74.206
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cybersecurity.arcticwolf.com/rs/840-OSQ-661/images/AW-mkto-floating-form-labels-styles-211027.css

Requested by

Host: arcticwolf.com
URL: https://arcticwolf.com/resources/blog/tellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware/

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

104.17.74.206 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

9babe27bc02fe4d0b02c5119b7257a15a4cc31ebdc2e25580197a61a184c7b38

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://arcticwolf.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 16:48:29 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: EXPIRED
last-modified: Sat, 07 Oct 2023 01:35:17 GMT
server: cloudflare
etag: "ee1c0c-4103-607165e8c53f5"
vary: Accept-Encoding
content-type: text/css
cache-control: public, max-age=60
accept-ranges: bytes
cf-ray: 8227106669f81994-FRA
content-length: 3651
expires: Tue, 07 Nov 2023 16:49:29 GMT

GET
H2 200 forms2.min.js Show response
cybersecurity.arcticwolf.com/js/forms2/js/ 208 KB
70 KB 355ms
70ms Script
application/x-javascript 104.17.74.206
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cybersecurity.arcticwolf.com/js/forms2/js/forms2.min.js

Requested by

Host: arcticwolf.com
URL: https://arcticwolf.com/resources/blog/tellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware/

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

104.17.74.206 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e6ff9c0c443a9050137759816c352d43e96a673bb4023c2ba231cdbed6fe6f52

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://arcticwolf.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 16:48:29 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
last-modified: Wed, 18 Oct 2023 06:07:17 GMT
server: cloudflare
age: 2373
etag: "c0241e-3414b-607f77394c966"
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: public, max-age=14400
cf-ray: 8227106669f61994-FRA
expires: Tue, 07 Nov 2023 20:48:29 GMT

GET
H2 200 AW-mkto-form-style-attributes-210628.js Show response
cybersecurity.arcticwolf.com/rs/840-OSQ-661/images/ 2 KB
857 B 211ms
211ms Script
application/x-javascript 104.17.74.206
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cybersecurity.arcticwolf.com/rs/840-OSQ-661/images/AW-mkto-form-style-attributes-210628.js

Requested by

Host: arcticwolf.com
URL: https://arcticwolf.com/resources/blog/tellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware/

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

104.17.74.206 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

93782ddf0e56d9337912140c04414253fd17fac6ed1520ea517dfce09975f83c

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://arcticwolf.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 16:48:29 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: EXPIRED
last-modified: Sat, 07 Oct 2023 01:37:04 GMT
server: cloudflare
etag: "ee1df0-7ad-6071664eea17c"
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: public, max-age=60
accept-ranges: bytes
cf-ray: 822710671b091994-FRA
content-length: 751
expires: Tue, 07 Nov 2023 16:49:29 GMT

GET
H2 200 regular.min.css
arcticwolf.com/wp-content/plugins/elementor/assets/lib/font-awesome/css/ 677 B
1 KB 293ms
292ms Stylesheet
text/css 13.224.189.102
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://arcticwolf.com/wp-content/plugins/elementor/assets/lib/font-awesome/css/regular.min.css?ver=5.15.3

Requested by

Host: arcticwolf.com
URL: https://arcticwolf.com/resources/blog/tellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.189.102 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-224-189-102.fra2.r.cloudfront.net

Software

AmazonS3 /

Resource Hash

eea3d6ccda7f6503078cce9dc41176c1357af1c93a5b3625131ef7cf21c9d7c4

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://arcticwolf.com/resources/blog/tellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 16:48:30 GMT
x-amz-version-id: lcpR1W_XaQKuxNZw0VyGG3JhY567h1Uu
x-content-type-options: nosniff
strict-transport-security: max-age=63072000; includeSubdomains; preload
last-modified: Mon, 06 Nov 2023 22:21:50 GMT
server: AmazonS3
via: 1.1 319f376925908156190f5fc160137b42.cloudfront.net (CloudFront), 1.1 3bf3e75bcb9a86b3eb343a1d4392a6de.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P3, FRA2-C1
etag: "3eef8c9e589a6fd58292e79bbac4ba5d"
x-frame-options: SAMEORIGIN
x-cache: Miss from cloudfront
content-type: text/css
cache-control: max-age=31536000
content-length: 677
x-amz-cf-id: tzePFk5_NNVyXbOFiB1LFYEmiMEBFT06s6BbSqAwkyBua-ofZXnS3Q==

GET
H2 200 brands.min.css
arcticwolf.com/wp-content/plugins/elementor/assets/lib/font-awesome/css/ 675 B
1 KB 303ms
303ms Stylesheet
text/css 13.224.189.102
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://arcticwolf.com/wp-content/plugins/elementor/assets/lib/font-awesome/css/brands.min.css?ver=5.15.3

Requested by

Host: arcticwolf.com
URL: https://arcticwolf.com/resources/blog/tellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.189.102 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-224-189-102.fra2.r.cloudfront.net

Software

AmazonS3 /

Resource Hash

9cd63b8cea25045c14623c538d26752518a58c0c682795ce6ad3078976c65a37

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://arcticwolf.com/resources/blog/tellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 16:48:30 GMT
x-amz-version-id: UrNqQdWKADOrBWdGNFhTOs2OExkeJlVL
x-content-type-options: nosniff
strict-transport-security: max-age=63072000; includeSubdomains; preload
last-modified: Mon, 06 Nov 2023 22:21:47 GMT
server: AmazonS3
via: 1.1 a54cda8ccda3480314f451558e4dd062.cloudfront.net (CloudFront), 1.1 3bf3e75bcb9a86b3eb343a1d4392a6de.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P3, FRA2-C1
etag: "144e43c3b3d8ea5b278c062c202c92f2"
x-frame-options: SAMEORIGIN
x-cache: Miss from cloudfront
content-type: text/css
cache-control: max-age=31536000
content-length: 675
x-amz-cf-id: vDtJNRXDMENkNdPc3MKTj_LEfXvez9TvzRsXv7saTZCfsfaP2mNNvA==

GET
H2 200 animations.min.css
arcticwolf.com/wp-content/plugins/elementor/assets/lib/animations/ 18 KB
3 KB 297ms
296ms Stylesheet
text/css 13.224.189.102
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://arcticwolf.com/wp-content/plugins/elementor/assets/lib/animations/animations.min.css?ver=3.17.2

Requested by

Host: arcticwolf.com
URL: https://arcticwolf.com/resources/blog/tellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.189.102 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-224-189-102.fra2.r.cloudfront.net

Software

AmazonS3 /

Resource Hash

fe513ef974b767510d0a2b9f1b4d3afa53185b89ab617c869e5e3d6db960192c

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://arcticwolf.com/resources/blog/tellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 16:48:30 GMT
x-amz-version-id: CsyYfGuctYT95_3X8Mqt5AfFAEJP7owh
x-content-type-options: nosniff
strict-transport-security: max-age=63072000; includeSubdomains; preload
content-encoding: gzip
x-amz-cf-pop: FRA60-P3, FRA2-C1
via: 1.1 6ae82cc0c8a39c993134c2be90b4d120.cloudfront.net (CloudFront), 1.1 3bf3e75bcb9a86b3eb343a1d4392a6de.cloudfront.net (CloudFront)
x-cache: Miss from cloudfront
last-modified: Tue, 07 Nov 2023 16:16:00 GMT
server: AmazonS3
etag: W/"4601ba55044413706c2022cb6c1c3d05"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=31536000
x-amz-cf-id: pLicK05sw9IMpcABilz4sjUXgdq1838lhQy9MiYPal4HhPb2kRmX5A==

GET
H2 200 mustache.js Show response
arcticwolf.com/wp-content/plugins/strattic-search-extension/assets/ 2 KB
1 KB 329ms
329ms Script
application/javascript 13.224.189.102
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://arcticwolf.com/wp-content/plugins/strattic-search-extension/assets/mustache.js?ver=1.0

Requested by

Host: arcticwolf.com
URL: https://arcticwolf.com/resources/blog/tellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.189.102 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-224-189-102.fra2.r.cloudfront.net

Software

AmazonS3 /

Resource Hash

a0013b499303da60cc6f7ae92351c6ce49a02ca2121992127d743b7610bed991

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://arcticwolf.com/resources/blog/tellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 16:48:30 GMT
x-amz-version-id: MQwAM4X2kNtrTUfvkHaKsmOjDorJ8lnl
x-content-type-options: nosniff
strict-transport-security: max-age=63072000; includeSubdomains; preload
content-encoding: gzip
x-amz-cf-pop: FRA60-P3, FRA2-C1
via: 1.1 c80ae6bd97b709ed6e4747f0d5ea4efc.cloudfront.net (CloudFront), 1.1 3bf3e75bcb9a86b3eb343a1d4392a6de.cloudfront.net (CloudFront)
x-cache: Miss from cloudfront
last-modified: Mon, 06 Nov 2023 22:18:23 GMT
server: AmazonS3
etag: W/"97fbab873e96c04584127b5328c678a9"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=31536000
x-amz-cf-id: rsXyTWw-wp6Mm4_ouSZOXzJZlZBxBOlEoIfWQMbPQ7gqMA8LIcLwAA==

GET
H2 200 algolia.js Show response
arcticwolf.com/wp-content/plugins/strattic-search-extension/assets/ 32 KB
9 KB 341ms
334ms Script
application/javascript 13.224.189.102
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://arcticwolf.com/wp-content/plugins/strattic-search-extension/assets/algolia.js?ver=1.0

Requested by

Host: arcticwolf.com
URL: https://arcticwolf.com/resources/blog/tellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.189.102 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-224-189-102.fra2.r.cloudfront.net

Software

AmazonS3 /

Resource Hash

5a84d09e92e25d2c3f4c66621d3ccc47b9ea6c943e83b8e283817a7920b45bab

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://arcticwolf.com/resources/blog/tellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 16:48:30 GMT
x-amz-version-id: R2AlVFbIsRIP67Uy7AR6zDRVZw79AuU0
x-content-type-options: nosniff
strict-transport-security: max-age=63072000; includeSubdomains; preload
content-encoding: gzip
x-amz-cf-pop: FRA60-P3, FRA2-C1
via: 1.1 c80ae6bd97b709ed6e4747f0d5ea4efc.cloudfront.net (CloudFront), 1.1 3bf3e75bcb9a86b3eb343a1d4392a6de.cloudfront.net (CloudFront)
x-cache: Miss from cloudfront
last-modified: Mon, 06 Nov 2023 22:18:19 GMT
server: AmazonS3
etag: W/"c152b0c8db7aa19fb668af4291bb8b2a"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=31536000
x-amz-cf-id: 46y2aPAVz4KqvczSp_YPaMHxn7t8Wzs26eVPmW6fYMSgpgB4bGpGUw==

GET
H2 200 strattic-search.js Show response
arcticwolf.com/wp-content/plugins/strattic-search-extension/assets/ 5 KB
2 KB 282ms
275ms Script
application/javascript 13.224.189.102
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://arcticwolf.com/wp-content/plugins/strattic-search-extension/assets/strattic-search.js?ver=1.0

Requested by

Host: arcticwolf.com
URL: https://arcticwolf.com/resources/blog/tellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.189.102 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-224-189-102.fra2.r.cloudfront.net

Software

AmazonS3 /

Resource Hash

2bd9df0ec0cb10f973c964c67a07e827482efd9c0a6c831d5ebfd7b2cc8d03c5

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://arcticwolf.com/resources/blog/tellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 16:48:31 GMT
x-amz-version-id: XmNFv3oKSsC_JP2DU2LwDxNe1kJbWK.n
x-content-type-options: nosniff
strict-transport-security: max-age=63072000; includeSubdomains; preload
content-encoding: gzip
x-amz-cf-pop: FRA60-P3, FRA2-C1
via: 1.1 968007545c497b68cc41825f11e930ba.cloudfront.net (CloudFront), 1.1 3bf3e75bcb9a86b3eb343a1d4392a6de.cloudfront.net (CloudFront)
x-cache: Miss from cloudfront
last-modified: Mon, 06 Nov 2023 22:18:25 GMT
server: AmazonS3
etag: W/"fa8d6bd068d09cb160f8fd11a683e3a1"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=31536000
x-amz-cf-id: CNQxhdvhVbh43IQt9TmovdzxbHugW1kdlX2BwkhPYaSyOKlW0Cpgtw==

GET
H2 200 happy-addons.min.js Show response
arcticwolf.com/wp-content/plugins/happy-elementor-addons/assets/js/ 44 KB
10 KB 368ms
361ms Script
application/javascript 13.224.189.102
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://arcticwolf.com/wp-content/plugins/happy-elementor-addons/assets/js/happy-addons.min.js?ver=3.9.1.1

Requested by

Host: arcticwolf.com
URL: https://arcticwolf.com/resources/blog/tellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.189.102 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-224-189-102.fra2.r.cloudfront.net

Software

AmazonS3 /

Resource Hash

e819900615c03aaca57d3acfd08960f3a4d88a538d2bcfa5a2a8747a2136fd3f

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://arcticwolf.com/resources/blog/tellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 16:48:31 GMT
x-amz-version-id: LhukzsJlWq4LSPdtyB09s00iOlp62nDP
x-content-type-options: nosniff
strict-transport-security: max-age=63072000; includeSubdomains; preload
content-encoding: gzip
x-amz-cf-pop: FRA60-P3, FRA2-C1
via: 1.1 fa8c9f29fb8ef5c537a2a53f4de05240.cloudfront.net (CloudFront), 1.1 3bf3e75bcb9a86b3eb343a1d4392a6de.cloudfront.net (CloudFront)
x-cache: Miss from cloudfront
last-modified: Tue, 07 Nov 2023 16:16:11 GMT
server: AmazonS3
etag: W/"c6b1cf5374421b271285983f3ea1513d"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=31536000
x-amz-cf-id: A2d1yiOs3Amh-ygQJk3Q1z0Oza3wKM8j525UYaRY41BnJZTGspGVJw==

GET
H2 200 smush-lazy-load.min.js Show response
arcticwolf.com/wp-content/plugins/wp-smush-pro/app/assets/js/ 8 KB
4 KB 406ms
399ms Script
application/javascript 13.224.189.102
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://arcticwolf.com/wp-content/plugins/wp-smush-pro/app/assets/js/smush-lazy-load.min.js?ver=3.15.0

Requested by

Host: arcticwolf.com
URL: https://arcticwolf.com/resources/blog/tellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.189.102 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-224-189-102.fra2.r.cloudfront.net

Software

AmazonS3 /

Resource Hash

f65784e5e7332dc1e4bbeacbec70fdeef4a1bea84f16ce2ee144999719d195ce

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://arcticwolf.com/resources/blog/tellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 16:48:31 GMT
x-amz-version-id: ixkOTEg6yclY54jsC_83AyVRHi9eLMlF
x-content-type-options: nosniff
strict-transport-security: max-age=63072000; includeSubdomains; preload
content-encoding: gzip
x-amz-cf-pop: FRA60-P3, FRA2-C1
via: 1.1 319f376925908156190f5fc160137b42.cloudfront.net (CloudFront), 1.1 3bf3e75bcb9a86b3eb343a1d4392a6de.cloudfront.net (CloudFront)
x-cache: Miss from cloudfront
last-modified: Tue, 07 Nov 2023 16:16:08 GMT
server: AmazonS3
etag: W/"75b90c4351b6e079459237e66836ef4e"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=31536000
x-amz-cf-id: QckcBsM3u-foJO3OTZ6Kp8BQ3RX1PMcstLMOkq_ggdOCn0AI2V3kKg==

GET
H2 200 general.min.js Show response
arcticwolf.com/wp-content/plugins/essential-addons-for-elementor-lite/assets/front-end/js/view/ 9 KB
4 KB 494ms
487ms Script
application/javascript 13.224.189.102
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://arcticwolf.com/wp-content/plugins/essential-addons-for-elementor-lite/assets/front-end/js/view/general.min.js?ver=5.8.13

Requested by

Host: arcticwolf.com
URL: https://arcticwolf.com/resources/blog/tellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.189.102 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-224-189-102.fra2.r.cloudfront.net

Software

AmazonS3 /

Resource Hash

948240da929defbe2f377b6a2173cf7c0988edc05972424cb3872abc739aa024

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://arcticwolf.com/resources/blog/tellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 16:48:31 GMT
x-amz-version-id: uLYz_73C3Ygo59f5zQQ.41MVcc4picn8
x-content-type-options: nosniff
strict-transport-security: max-age=63072000; includeSubdomains; preload
content-encoding: gzip
x-amz-cf-pop: FRA60-P3, FRA2-C1
via: 1.1 fa8c9f29fb8ef5c537a2a53f4de05240.cloudfront.net (CloudFront), 1.1 3bf3e75bcb9a86b3eb343a1d4392a6de.cloudfront.net (CloudFront)
x-cache: Miss from cloudfront
last-modified: Tue, 07 Nov 2023 16:16:14 GMT
server: AmazonS3
etag: W/"b8935fb76a794d27524f8696fcba58ea"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=31536000
x-amz-cf-id: jgM1YCkcsWrnJfXt4YRGj9gcNRsLJichRDpTuyPuVc9eCd0vxVO3nQ==

GET
H2 200 hoverIntent.min.js Show response
arcticwolf.com/wp-includes/js/ 1 KB
1 KB 259ms
253ms Script
application/javascript 13.224.189.102
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://arcticwolf.com/wp-includes/js/hoverIntent.min.js?ver=1.10.2

Requested by

Host: arcticwolf.com
URL: https://arcticwolf.com/resources/blog/tellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.189.102 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-224-189-102.fra2.r.cloudfront.net

Software

AmazonS3 /

Resource Hash

ed5b5df9ceacfe76857ac51964972b0b417a215b2f50e837fd6b64bad7339c40

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://arcticwolf.com/resources/blog/tellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 16:48:31 GMT
x-amz-version-id: 1fKJPf6YTkrbJbjS3cd1z5Ils0w.y4jz
x-content-type-options: nosniff
strict-transport-security: max-age=63072000; includeSubdomains; preload
content-encoding: gzip
x-amz-cf-pop: FRA60-P3, FRA2-C1
via: 1.1 d262e104d5d9dd6a4a52f090bdf9395c.cloudfront.net (CloudFront), 1.1 3bf3e75bcb9a86b3eb343a1d4392a6de.cloudfront.net (CloudFront)
x-cache: Miss from cloudfront
last-modified: Tue, 07 Nov 2023 16:16:07 GMT
server: AmazonS3
etag: W/"8c0498e2f1f7a684a8d2a3feb934b64b"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=31536000
x-amz-cf-id: FQbb3P-Qn9gtpYUoX4bM8Zsfxextris4EeOh8rOoJ7ZqZ1hlj_LGAg==

GET
H2 200 maxmegamenu.js Show response
arcticwolf.com/wp-content/plugins/megamenu/js/ 33 KB
6 KB 251ms
245ms Script
application/javascript 13.224.189.102
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://arcticwolf.com/wp-content/plugins/megamenu/js/maxmegamenu.js?ver=3.2.4

Requested by

Host: arcticwolf.com
URL: https://arcticwolf.com/resources/blog/tellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.189.102 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-224-189-102.fra2.r.cloudfront.net

Software

AmazonS3 /

Resource Hash

0b35f88d468214d1e8ea6b50a1161cddd4984b46d3c9b13d05f00438bf894083

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://arcticwolf.com/resources/blog/tellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 16:48:31 GMT
x-amz-version-id: UxaCCCYcGl2IKjs0sC_f77TBdtfYxB.n
x-content-type-options: nosniff
strict-transport-security: max-age=63072000; includeSubdomains; preload
content-encoding: gzip
x-amz-cf-pop: FRA60-P3, FRA2-C1
via: 1.1 2a44338adc8233e5b25aca28287a69c8.cloudfront.net (CloudFront), 1.1 3bf3e75bcb9a86b3eb343a1d4392a6de.cloudfront.net (CloudFront)
x-cache: Miss from cloudfront
last-modified: Tue, 07 Nov 2023 16:16:10 GMT
server: AmazonS3
etag: W/"0c51d0bbe2e1c6d892a9d5178abec42a"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=31536000
x-amz-cf-id: UTeYsehNgVn2CLV-Yajj_39apWgxSKnFjcwycODXfcgou-89ivxy6g==

GET
H2 200 public.js Show response
arcticwolf.com/wp-content/plugins/megamenu-pro/assets/ 25 KB
5 KB 709ms
703ms Script
application/javascript 13.224.189.102
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://arcticwolf.com/wp-content/plugins/megamenu-pro/assets/public.js?ver=2.3

Requested by

Host: arcticwolf.com
URL: https://arcticwolf.com/resources/blog/tellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.189.102 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-224-189-102.fra2.r.cloudfront.net

Software

AmazonS3 /

Resource Hash

b84e1123de812ccdb8a44854c47dce5c52e0ccc663c263031a10ce253506c376

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://arcticwolf.com/resources/blog/tellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 16:48:31 GMT
x-amz-version-id: 3jg.vAAZvfs..bwHL6MKtGPGeeDbB2VJ
x-content-type-options: nosniff
strict-transport-security: max-age=63072000; includeSubdomains; preload
content-encoding: gzip
x-amz-cf-pop: FRA60-P3, FRA2-C1
via: 1.1 5492e1c9a06f2320204e7fcc383cff5c.cloudfront.net (CloudFront), 1.1 3bf3e75bcb9a86b3eb343a1d4392a6de.cloudfront.net (CloudFront)
x-cache: Miss from cloudfront
last-modified: Tue, 07 Nov 2023 16:16:08 GMT
server: AmazonS3
etag: W/"3d85e61a1bc0e82d18f2a48812b50bd0"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=31536000
x-amz-cf-id: HQRLkUdGIZwX-c0PMG_ZCkbXvwGuqop7ybKc_Eqp8-gMqAusOWjMRQ==

GET
H2 200 imagesloaded.min.js Show response
arcticwolf.com/wp-includes/js/ 5 KB
2 KB 282ms
276ms Script
application/javascript 13.224.189.102
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://arcticwolf.com/wp-includes/js/imagesloaded.min.js?ver=4.1.4

Requested by

Host: arcticwolf.com
URL: https://arcticwolf.com/resources/blog/tellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.189.102 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-224-189-102.fra2.r.cloudfront.net

Software

AmazonS3 /

Resource Hash

ff4bd34aa98a0214833619d3d751838db015722dfbbec15cd14dadc66cd67869

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://arcticwolf.com/resources/blog/tellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 16:48:31 GMT
x-amz-version-id: 6RsV1McsnM9vxWxOE4oFsW3TA9YZGTKJ
x-content-type-options: nosniff
strict-transport-security: max-age=63072000; includeSubdomains; preload
content-encoding: gzip
x-amz-cf-pop: FRA60-P3, FRA2-C1
via: 1.1 68b2682a924ac399aa2724b5b439e75c.cloudfront.net (CloudFront), 1.1 3bf3e75bcb9a86b3eb343a1d4392a6de.cloudfront.net (CloudFront)
x-cache: Miss from cloudfront
last-modified: Mon, 06 Nov 2023 22:21:51 GMT
server: AmazonS3
etag: W/"3a56752b736635bf69cb069b8818cbfd"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=31536000
x-amz-cf-id: OZp6uCVNCc3MJ-1WVncPoORPVeXt365CF2aupNiSJkDS2x9j_vw-2w==

GET
H2 200 webpack-pro.runtime.min.js Show response
arcticwolf.com/wp-content/plugins/elementor-pro/assets/js/ 6 KB
3 KB 369ms
363ms Script
application/javascript 13.224.189.102
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://arcticwolf.com/wp-content/plugins/elementor-pro/assets/js/webpack-pro.runtime.min.js?ver=3.17.1

Requested by

Host: arcticwolf.com
URL: https://arcticwolf.com/resources/blog/tellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.189.102 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-224-189-102.fra2.r.cloudfront.net

Software

AmazonS3 /

Resource Hash

d9755b7eff734eeb6267db6515f0267fc66622cd873cd37f65761b3fcc94cac2

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://arcticwolf.com/resources/blog/tellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 16:48:31 GMT
x-amz-version-id: J9rZg9GfLjykyMoNzmXWDUMvWEUmnIEn
x-content-type-options: nosniff
strict-transport-security: max-age=63072000; includeSubdomains; preload
content-encoding: gzip
x-amz-cf-pop: FRA60-P3, FRA2-C1
via: 1.1 7fd88bab22735486702d23ba4e028d86.cloudfront.net (CloudFront), 1.1 3bf3e75bcb9a86b3eb343a1d4392a6de.cloudfront.net (CloudFront)
x-cache: Miss from cloudfront
last-modified: Tue, 07 Nov 2023 16:16:11 GMT
server: AmazonS3
etag: W/"8027f7d649c8b4b044a03ef82cc7ef68"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=31536000
x-amz-cf-id: CThG0ppXZfYW1U7VWywXVH8_hsQLL-MjabD3TETWn8QwrdDGz4u1FQ==

GET
H2 200 webpack.runtime.min.js Show response
arcticwolf.com/wp-content/plugins/elementor/assets/js/ 5 KB
3 KB 303ms
298ms Script
application/javascript 13.224.189.102
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://arcticwolf.com/wp-content/plugins/elementor/assets/js/webpack.runtime.min.js?ver=3.17.2

Requested by

Host: arcticwolf.com
URL: https://arcticwolf.com/resources/blog/tellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.189.102 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-224-189-102.fra2.r.cloudfront.net

Software

AmazonS3 /

Resource Hash

54ea57786634bfa60c34643638a57868ab254fcde1c47b6e2b30813eff03adbf

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://arcticwolf.com/resources/blog/tellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 16:48:31 GMT
x-amz-version-id: I7RNPxg3AKyguWPrNPzFUPZWJ9.iP84_
x-content-type-options: nosniff
strict-transport-security: max-age=63072000; includeSubdomains; preload
content-encoding: gzip
x-amz-cf-pop: FRA60-P3, FRA2-C1
via: 1.1 0a71d283a25c1e3f082b4dbc9d844dfe.cloudfront.net (CloudFront), 1.1 3bf3e75bcb9a86b3eb343a1d4392a6de.cloudfront.net (CloudFront)
x-cache: Miss from cloudfront
last-modified: Tue, 07 Nov 2023 16:16:08 GMT
server: AmazonS3
etag: W/"833d75d20e6a712588375fb2708f1e27"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=31536000
x-amz-cf-id: LWnixxbB1FSYTAWR9EvGPT8_KSV9pAp9coQt446K8uJZVj8eO8qvxQ==

GET
H2 200 frontend-modules.min.js Show response
arcticwolf.com/wp-content/plugins/elementor/assets/js/ 59 KB
17 KB 301ms
296ms Script
application/javascript 13.224.189.102
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://arcticwolf.com/wp-content/plugins/elementor/assets/js/frontend-modules.min.js?ver=3.17.2

Requested by

Host: arcticwolf.com
URL: https://arcticwolf.com/resources/blog/tellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.189.102 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-224-189-102.fra2.r.cloudfront.net

Software

AmazonS3 /

Resource Hash

3c08dbd48249fa7ed7d32a4ea1688e9892b432ed60ceb04e97325a3b67e97346

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://arcticwolf.com/resources/blog/tellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 16:48:31 GMT
x-amz-version-id: V1WDO7VY67KKuxd.d0ZeCk6sHillhMQ2
x-content-type-options: nosniff
strict-transport-security: max-age=63072000; includeSubdomains; preload
content-encoding: gzip
x-amz-cf-pop: FRA60-P3, FRA2-C1
via: 1.1 a54cda8ccda3480314f451558e4dd062.cloudfront.net (CloudFront), 1.1 3bf3e75bcb9a86b3eb343a1d4392a6de.cloudfront.net (CloudFront)
x-cache: Miss from cloudfront
last-modified: Tue, 07 Nov 2023 16:16:01 GMT
server: AmazonS3
etag: W/"3543b9209e6a70b3edb45cb13b521c55"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=31536000
x-amz-cf-id: q5yXj9XjEpUWpBvJ6f29fYi6GXD9V73zh4VzF-WQg93aTUFr68FPxA==

GET
H2 200 wp-polyfill-inert.min.js Show response
arcticwolf.com/wp-includes/js/dist/vendor/ 8 KB
3 KB 338ms
333ms Script
application/javascript 13.224.189.102
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://arcticwolf.com/wp-includes/js/dist/vendor/wp-polyfill-inert.min.js?ver=3.1.2

Requested by

Host: arcticwolf.com
URL: https://arcticwolf.com/resources/blog/tellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.189.102 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-224-189-102.fra2.r.cloudfront.net

Software

AmazonS3 /

Resource Hash

c1a9a3e223bad631dff12d33b5499eb145cb08d8621c20d9d73870e78d97afe4

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://arcticwolf.com/resources/blog/tellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 16:48:31 GMT
x-amz-version-id: 4ohakdwvbZrnIZG8IOeF0pWTMXcHn6Hh
x-content-type-options: nosniff
strict-transport-security: max-age=63072000; includeSubdomains; preload
content-encoding: gzip
x-amz-cf-pop: FRA60-P3, FRA2-C1
via: 1.1 7fd88bab22735486702d23ba4e028d86.cloudfront.net (CloudFront), 1.1 3bf3e75bcb9a86b3eb343a1d4392a6de.cloudfront.net (CloudFront)
x-cache: Miss from cloudfront
last-modified: Tue, 07 Nov 2023 16:16:10 GMT
server: AmazonS3
etag: W/"dda652db133fddb9b80a05c6d1b5c540"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=31536000
x-amz-cf-id: BrmWihyEGYDUoZTbgLSAjtCSGy9RIXSpDD83GnlH3-PMnYEbrT7L2g==

GET
H2 200 regenerator-runtime.min.js Show response
arcticwolf.com/wp-includes/js/dist/vendor/ 6 KB
3 KB 317ms
312ms Script
application/javascript 13.224.189.102
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://arcticwolf.com/wp-includes/js/dist/vendor/regenerator-runtime.min.js?ver=0.13.11

Requested by

Host: arcticwolf.com
URL: https://arcticwolf.com/resources/blog/tellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.189.102 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-224-189-102.fra2.r.cloudfront.net

Software

AmazonS3 /

Resource Hash

6974bfd8fa06b7831f05cb4b25860c851a5ad3f02a6699ebe688987dd7a6ebe6

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://arcticwolf.com/resources/blog/tellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 16:48:31 GMT
x-amz-version-id: baVJI_jvmKPuAdQb60WkTV.B5qVWBAir
x-content-type-options: nosniff
strict-transport-security: max-age=63072000; includeSubdomains; preload
content-encoding: gzip
x-amz-cf-pop: FRA60-P3, FRA2-C1
via: 1.1 a54cda8ccda3480314f451558e4dd062.cloudfront.net (CloudFront), 1.1 3bf3e75bcb9a86b3eb343a1d4392a6de.cloudfront.net (CloudFront)
x-cache: Miss from cloudfront
last-modified: Tue, 07 Nov 2023 16:16:10 GMT
server: AmazonS3
etag: W/"9a4f28a615173df36cb84be2b345816e"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=31536000
x-amz-cf-id: 8jeAfjTKqsnU8DeXpOiX-tZjdswaXa7kjwLUrT0jB-LEj_0fui4jTQ==

GET
H2 200 wp-polyfill.min.js Show response
arcticwolf.com/wp-includes/js/dist/vendor/ 16 KB
6 KB 304ms
300ms Script
application/javascript 13.224.189.102
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://arcticwolf.com/wp-includes/js/dist/vendor/wp-polyfill.min.js?ver=3.15.0

Requested by

Host: arcticwolf.com
URL: https://arcticwolf.com/resources/blog/tellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.189.102 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-224-189-102.fra2.r.cloudfront.net

Software

AmazonS3 /

Resource Hash

4c0ced2cb3830d045cdd74f745fd4d6dcb082d8edd3a9fe46e39295e30cb8032

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://arcticwolf.com/resources/blog/tellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 16:48:31 GMT
x-amz-version-id: mAjQCSXCIJBkwlUNhnbqJgXc91oknMvk
x-content-type-options: nosniff
strict-transport-security: max-age=63072000; includeSubdomains; preload
content-encoding: gzip
x-amz-cf-pop: FRA60-P3, FRA2-C1
via: 1.1 6ae82cc0c8a39c993134c2be90b4d120.cloudfront.net (CloudFront), 1.1 3bf3e75bcb9a86b3eb343a1d4392a6de.cloudfront.net (CloudFront)
x-cache: Miss from cloudfront
last-modified: Tue, 07 Nov 2023 16:15:58 GMT
server: AmazonS3
etag: W/"94dfdbe80f36b3be63ce74ff1135b996"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=31536000
x-amz-cf-id: 6N68SzzE63IAQsDr_bAcY2rLARRoKrrXGXc_d9HIRZItE4HTkeU3Lw==

GET
H2 200 hooks.min.js Show response
arcticwolf.com/wp-includes/js/dist/ 5 KB
2 KB 359ms
355ms Script
application/javascript 13.224.189.102
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://arcticwolf.com/wp-includes/js/dist/hooks.min.js?ver=c6aec9a8d4e5a5d543a1

Requested by

Host: arcticwolf.com
URL: https://arcticwolf.com/resources/blog/tellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.189.102 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-224-189-102.fra2.r.cloudfront.net

Software

AmazonS3 /

Resource Hash

7868467c94a5aa0b3f11ef542f45287967f9627b3b5acdc86e47f8f77a126596

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://arcticwolf.com/resources/blog/tellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 16:48:31 GMT
x-amz-version-id: bsM4xW2b7whIz0.fylXFAc.GjSmRvuwT
x-content-type-options: nosniff
strict-transport-security: max-age=63072000; includeSubdomains; preload
content-encoding: gzip
x-amz-cf-pop: FRA60-P3, FRA2-C1
via: 1.1 987865b81ba895db5b3f56f8ae175c84.cloudfront.net (CloudFront), 1.1 3bf3e75bcb9a86b3eb343a1d4392a6de.cloudfront.net (CloudFront)
x-cache: Miss from cloudfront
last-modified: Tue, 07 Nov 2023 16:16:02 GMT
server: AmazonS3
etag: W/"7bd48eb3bd568033e96caf0fb62e6690"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=31536000
x-amz-cf-id: rmCZZQSEgJDJHvrAW4Ae4x6WrglTxa7ZP5dVZLd9BbJuUygLTdHEmQ==

GET
H2 200 i18n.min.js Show response
arcticwolf.com/wp-includes/js/dist/ 9 KB
4 KB 402ms
398ms Script
application/javascript 13.224.189.102
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://arcticwolf.com/wp-includes/js/dist/i18n.min.js?ver=7701b0c3857f914212ef

Requested by

Host: arcticwolf.com
URL: https://arcticwolf.com/resources/blog/tellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.189.102 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-224-189-102.fra2.r.cloudfront.net

Software

AmazonS3 /

Resource Hash

698e93fe491cc7bbf07a470579a33dbd0db53c19142b7be41ebfd39a23aef11f

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://arcticwolf.com/resources/blog/tellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 16:48:31 GMT
x-amz-version-id: JLGtUckfhTIUEkWzQ.HxwMd_gbg_UyAR
x-content-type-options: nosniff
strict-transport-security: max-age=63072000; includeSubdomains; preload
content-encoding: gzip
x-amz-cf-pop: FRA60-P3, FRA2-C1
via: 1.1 d262e104d5d9dd6a4a52f090bdf9395c.cloudfront.net (CloudFront), 1.1 3bf3e75bcb9a86b3eb343a1d4392a6de.cloudfront.net (CloudFront)
x-cache: Miss from cloudfront
last-modified: Tue, 07 Nov 2023 16:15:58 GMT
server: AmazonS3
etag: W/"c2c4e2a562e06e1cb22293a5b920aca6"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=31536000
x-amz-cf-id: Urla58qnBb8IznlySKqOvAvWbPxuWMNhQg5BTLxJWFBtvc6UE7Xs_g==

GET
H2 200 frontend.min.js Show response
arcticwolf.com/wp-content/plugins/elementor-pro/assets/js/ 24 KB
7 KB 263ms
259ms Script
application/javascript 13.224.189.102
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://arcticwolf.com/wp-content/plugins/elementor-pro/assets/js/frontend.min.js?ver=3.17.1

Requested by

Host: arcticwolf.com
URL: https://arcticwolf.com/resources/blog/tellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.189.102 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-224-189-102.fra2.r.cloudfront.net

Software

AmazonS3 /

Resource Hash

c7267d9f9b72944e2b3772a521fd1b8882ca17b124de63549fbf591167efbd25

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://arcticwolf.com/resources/blog/tellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 16:48:31 GMT
x-amz-version-id: QP.VOM3JTUhqL.vMrWyX4WFInhkattDv
x-content-type-options: nosniff
strict-transport-security: max-age=63072000; includeSubdomains; preload
content-encoding: gzip
x-amz-cf-pop: FRA60-P3, FRA2-C1
via: 1.1 7251dede1ac94066b27bcd33919b30c6.cloudfront.net (CloudFront), 1.1 3bf3e75bcb9a86b3eb343a1d4392a6de.cloudfront.net (CloudFront)
x-cache: Miss from cloudfront
last-modified: Tue, 07 Nov 2023 16:16:14 GMT
server: AmazonS3
etag: W/"59ab277efa930785720a63e9007677aa"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=31536000
x-amz-cf-id: rrNhDzj-HSeR3g5MuBZZI_tmTzAOtPR3FDq4D_hZssE_rP5ctR_KuA==

GET
H2 200 waypoints.min.js Show response
arcticwolf.com/wp-content/plugins/elementor/assets/lib/waypoints/ 12 KB
4 KB 306ms
302ms Script
application/javascript 13.224.189.102
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://arcticwolf.com/wp-content/plugins/elementor/assets/lib/waypoints/waypoints.min.js?ver=4.0.2

Requested by

Host: arcticwolf.com
URL: https://arcticwolf.com/resources/blog/tellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.189.102 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-224-189-102.fra2.r.cloudfront.net

Software

AmazonS3 /

Resource Hash

214674cc77aba35ab3567b88e2739fd08e8e96c61d279559ad61874069683ea0

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://arcticwolf.com/resources/blog/tellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 16:48:31 GMT
x-amz-version-id: qOTb11AvKB3npl9ntc1e2qkiu6TKI0Rr
x-content-type-options: nosniff
strict-transport-security: max-age=63072000; includeSubdomains; preload
content-encoding: gzip
x-amz-cf-pop: FRA60-P3, FRA2-C1
via: 1.1 319f376925908156190f5fc160137b42.cloudfront.net (CloudFront), 1.1 3bf3e75bcb9a86b3eb343a1d4392a6de.cloudfront.net (CloudFront)
x-cache: Miss from cloudfront
last-modified: Tue, 07 Nov 2023 16:16:03 GMT
server: AmazonS3
etag: W/"3819c3569da71daec283a75483735f7e"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=31536000
x-amz-cf-id: SCS0MUJjThpPNhoo8FGJw90HP3tAds1vn5WenDKjZ1WP3GszESaDKw==

GET
H2 200 core.min.js Show response
arcticwolf.com/wp-includes/js/jquery/ui/ 21 KB
8 KB 303ms
299ms Script
application/javascript 13.224.189.102
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://arcticwolf.com/wp-includes/js/jquery/ui/core.min.js?ver=1.13.2

Requested by

Host: arcticwolf.com
URL: https://arcticwolf.com/resources/blog/tellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.189.102 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-224-189-102.fra2.r.cloudfront.net

Software

AmazonS3 /

Resource Hash

ca7dce2391845e8aec7da135f33fabd10f74eed28a532ac66fd01f761fcfb42f

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://arcticwolf.com/resources/blog/tellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 16:48:31 GMT
x-amz-version-id: DyrWJ3fTb.Bhni.IcImJlwWq_MbB_HHt
x-content-type-options: nosniff
strict-transport-security: max-age=63072000; includeSubdomains; preload
content-encoding: gzip
x-amz-cf-pop: FRA60-P3, FRA2-C1
via: 1.1 319f376925908156190f5fc160137b42.cloudfront.net (CloudFront), 1.1 3bf3e75bcb9a86b3eb343a1d4392a6de.cloudfront.net (CloudFront)
x-cache: Miss from cloudfront
last-modified: Tue, 07 Nov 2023 16:16:03 GMT
server: AmazonS3
etag: W/"c4e68a0f3463c0bd3c39eab38815e881"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=31536000
x-amz-cf-id: 3YmfqxyYySCxqS9sLCzAKsRtgQEE2a8_qI4d0K1mBGwTrNAEJ4LPVA==

GET
H2 200 frontend.min.js Show response
arcticwolf.com/wp-content/plugins/elementor/assets/js/ 39 KB
13 KB 346ms
343ms Script
application/javascript 13.224.189.102
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://arcticwolf.com/wp-content/plugins/elementor/assets/js/frontend.min.js?ver=3.17.2

Requested by

Host: arcticwolf.com
URL: https://arcticwolf.com/resources/blog/tellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.189.102 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-224-189-102.fra2.r.cloudfront.net

Software

AmazonS3 /

Resource Hash

d58038106e94ae0e80e0a6528a9c5ec528fbe725fe618d80be2a1f5f48db705e

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://arcticwolf.com/resources/blog/tellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 16:48:31 GMT
x-amz-version-id: YExAluRnQSuWqZ_HlgFBTkTi9_Ms_8yC
x-content-type-options: nosniff
strict-transport-security: max-age=63072000; includeSubdomains; preload
content-encoding: gzip
x-amz-cf-pop: FRA60-P3, FRA2-C1
via: 1.1 5b6e22c950501920595c86fc25834582.cloudfront.net (CloudFront), 1.1 3bf3e75bcb9a86b3eb343a1d4392a6de.cloudfront.net (CloudFront)
x-cache: Miss from cloudfront
last-modified: Tue, 07 Nov 2023 16:16:00 GMT
server: AmazonS3
etag: W/"72316f58398a8bbcffb9f981207a7b53"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=31536000
x-amz-cf-id: 3EMmFm2-S7OLBcrBEL7fWhIV-FJyMFbH0prDWbwWrmKyfJXfu3qfsA==

GET
H2 200 elements-handlers.min.js Show response
arcticwolf.com/wp-content/plugins/elementor-pro/assets/js/ 35 KB
9 KB 337ms
334ms Script
application/javascript 13.224.189.102
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://arcticwolf.com/wp-content/plugins/elementor-pro/assets/js/elements-handlers.min.js?ver=3.17.1

Requested by

Host: arcticwolf.com
URL: https://arcticwolf.com/resources/blog/tellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.189.102 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-224-189-102.fra2.r.cloudfront.net

Software

AmazonS3 /

Resource Hash

60a6db28503da0b2c2f4e39da485b7649425cd481da5dee9ff33f6c68e9cb480

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://arcticwolf.com/resources/blog/tellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 16:48:31 GMT
x-amz-version-id: Kgu8uJ5X76SRV_pDMFpWDSlGB9yjnDdn
x-content-type-options: nosniff
strict-transport-security: max-age=63072000; includeSubdomains; preload
content-encoding: gzip
x-amz-cf-pop: FRA60-P3, FRA2-C1
via: 1.1 0a71d283a25c1e3f082b4dbc9d844dfe.cloudfront.net (CloudFront), 1.1 3bf3e75bcb9a86b3eb343a1d4392a6de.cloudfront.net (CloudFront)
x-cache: Miss from cloudfront
last-modified: Tue, 07 Nov 2023 16:16:11 GMT
server: AmazonS3
etag: W/"9769d1d76fdce5a776506f7a4a4f9183"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=31536000
x-amz-cf-id: o7eGIJwD5Aoegqc8iK4-x7IdHsSalY7aHxQkgSvaWAWidqjFlUNeVg==

GET
BLOB 200
OK f83754f0-1ed9-42ba-8281-6c8b35ecd7e2
https://arcticwolf.com/ 1 KB
0 Other
text/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://arcticwolf.com/f83754f0-1ed9-42ba-8281-6c8b35ecd7e2
Requested by: Host: arcticwolf.com
URL: https://arcticwolf.com/resources/blog/tellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware/
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 453cb806084fdabec32e286af2e88899f79022125c2527afffbec507975d2c22

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

Content-Length: 1245
Content-Type: text/javascript

GET
H2 200 db482b86-7cc0-40a4-94cb-f20d32869a3b.json Show response
cdn.cookielaw.org/consent/db482b86-7cc0-40a4-94cb-f20d32869a3b/ 5 KB
2 KB 149ms
66ms XHR
application/x-javascript 2606:4700::6812:82ec
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/consent/db482b86-7cc0-40a4-94cb-f20d32869a3b/db482b86-7cc0-40a4-94cb-f20d32869a3b.json

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:82ec , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

abfb1822ca408cb63bb0404e5c2d835d873893f4fb7cefebc3ae00f6d889cf9c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://arcticwolf.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Tue, 07 Nov 2023 16:48:29 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
strict-transport-security: max-age=31536000; includeSubDomains; preload
age: 4664
content-md5: RKQGWZnPJfqB4kgXlCqITw==
content-length: 1810
x-ms-lease-status: unlocked
last-modified: Tue, 17 Oct 2023 15:56:49 GMT
server: cloudflare
etag: 0x8DBCF29AC963597
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: *
x-ms-request-id: fd6d096e-301e-0079-3712-01c5a7000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=86400
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 82271068bd6a1c09-FRA
expires: Wed, 08 Nov 2023 16:48:29 GMT

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 499 KB
130 KB 229ms
132ms Script
application/javascript 2a00:1450:4001:802::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-PMV4652

Requested by

Host: arcticwolf.com
URL: https://arcticwolf.com/resources/blog/tellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:802::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

e5d70d017ac28db5708fb5e9fd340202dfb4cb8c9b06b3de7af06e7b99ae60b2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://arcticwolf.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 16:48:30 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 132839
x-xss-protection: 0
last-modified: Tue, 07 Nov 2023 15:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Tue, 07 Nov 2023 16:48:30 GMT

GET
H2 200 location Show response
geolocation.onetrust.com/cookieconsentpub/v1/geo/ 59 B
304 B 187ms
103ms XHR
application/json 2606:4700:4400::6812:2089
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://geolocation.onetrust.com/cookieconsentpub/v1/geo/location

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::6812:2089 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2157361193375a79ade3559e960f982daa8d599cf7f4a92d36e3eef257738f16

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept: application/json
Referer: https://arcticwolf.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 16:48:29 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
server: cloudflare
vary: Accept-Encoding
access-control-allow-methods: GET, OPTIONS
content-type: application/json
access-control-allow-origin: *
cf-ray: 82271069a97637fb-FRA
access-control-allow-headers: Content-Type

GET
H2 200 otBannerSdk.js Show response
cdn.cookielaw.org/scripttemplates/202307.1.0/ 405 KB
98 KB 53ms
51ms Script
application/javascript 2606:4700::6812:82ec
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/202307.1.0/otBannerSdk.js

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:82ec , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

71d07479f4b2b809e5769a352f4f55b84690289026ace7ed5395230002551a11

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://arcticwolf.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Tue, 07 Nov 2023 16:48:29 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
content-md5: orDm7smwsr/pjTi/DOTSGQ==
age: 27139
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-length: 99815
x-ms-lease-status: unlocked
last-modified: Wed, 02 Aug 2023 03:24:04 GMT
server: cloudflare
etag: 0x8DB9307EC3B2CDE
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-ms-request-id: a7ed9111-701e-0095-7b03-c5b9d5000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: max-age=86400
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 8227106abef665ab-FRA

GET
DATA 200
OK truncated
/ 37 B
0 Image
image/gif

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

Content-Type: image/gif

GET
H2 200 AW_LOGO_REVERSE-334.png
marvel-b1-cdn.bc0a.com/f00000000241276/arcticwolf.com/wp-content/uploads/2021/11/ 3 KB
4 KB 181ms
65ms Image
image/webp 2600:9000:2250:b000:0:f267:a5c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://marvel-b1-cdn.bc0a.com/f00000000241276/arcticwolf.com/wp-content/uploads/2021/11/AW_LOGO_REVERSE-334.png
Requested by: Host: arcticwolf.com
URL: https://arcticwolf.com/resources/blog/tellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2250:b000:0:f267:a5c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: ad35c96a8104ac3ccd60c7ce3cd073f9804e816c496c48b90197672e87ab7623

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://arcticwolf.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

x-amz-version-id: 7mtQO29SdDOvYq2vfeY1ho74V0ZAYmDm
date: Tue, 07 Nov 2023 01:20:23 GMT
via: 1.1 0121ceb2efadb6db52d122a8b6b52f90.cloudfront.net (CloudFront)
x-amz-request-id: DZWK8AS755Q9RNJ7
x-amz-cf-pop: FRA60-P2
age: 55688
x-cache: Hit from cloudfront
content-length: 3006
x-amz-id-2: ZQjYJTE0vIBCkewdOoZloCWtavb9A+PtTTbmyPIhQL9ayBRTwGQj4qm1w0NG7IKvJVx6SQ8Ja/Q=
x-amz-expiration: expiry-date="Fri, 14 Feb 2025 00:00:00 GMT", rule-id="delete-old-images"
last-modified: Fri, 20 May 2022 18:47:57 GMT
server: AmazonS3
etag: "f4a87a6a0f906e089b9a969ec024c377"
content-type: image/webp
access-control-allow-origin: *
cache-control: max-age=31536000
accept-ranges: bytes
x-amz-cf-id: Y1o4dUb9wMM7dq-cbJIesi_iIIL8S9H9iB2o171GoCBbAHP6qiybvQ==

GET
H2 200 white-mag-icon.png
arcticwolf.com/wp-content/uploads/2020/03/ 286 B
818 B 349ms
347ms Image
image/png 13.224.189.102
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://arcticwolf.com/wp-content/uploads/2020/03/white-mag-icon.png

Requested by

Host: arcticwolf.com
URL: https://arcticwolf.com/resources/blog/tellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.189.102 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-224-189-102.fra2.r.cloudfront.net

Software

AmazonS3 /

Resource Hash

70473bd0b0e7e7184f687732de1aecf333cd42fea1bd239d95d9319b3fe7cd7c

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://arcticwolf.com/resources/blog/tellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 16:48:31 GMT
x-amz-version-id: vRpsNFPPi7mUSlbSrnV0otSRHfArAMFc
x-content-type-options: nosniff
strict-transport-security: max-age=63072000; includeSubdomains; preload
last-modified: Wed, 15 Feb 2023 19:15:46 GMT
server: AmazonS3
via: 1.1 39e6266db143f6443f194d8c60e22480.cloudfront.net (CloudFront), 1.1 3bf3e75bcb9a86b3eb343a1d4392a6de.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P3, FRA2-C1
etag: "08f8b78ae229b78ed0ed615a42f85c69"
x-frame-options: SAMEORIGIN
x-cache: Miss from cloudfront
content-type: image/png
cache-control: max-age=31536000
content-length: 286
x-amz-cf-id: ayoHEFpwMlitjTRQrpRkdrwGuaYuOWhlMAucGQyFkn6_oELQkWafBg==

GET
H2 200 icon-white-AW-globe-fluent02.png
arcticwolf.com/wp-content/uploads/2021/05/ 2 KB
2 KB 249ms
249ms Image
image/png 13.224.189.102
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://arcticwolf.com/wp-content/uploads/2021/05/icon-white-AW-globe-fluent02.png

Requested by

Host: arcticwolf.com
URL: https://arcticwolf.com/wp-content/themes/blankslate-child/style.css?ver=6.3.2

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.189.102 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-224-189-102.fra2.r.cloudfront.net

Software

AmazonS3 /

Resource Hash

458a0bfc433743487169403d4a82cfe6f703c488619ad7bd9568930ba95d5cc2

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://arcticwolf.com/wp-content/themes/blankslate-child/style.css?ver=6.3.2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 16:48:31 GMT
x-amz-version-id: cc69802z_y5BrsiFiP58WHWCXZDo0pv_
x-content-type-options: nosniff
strict-transport-security: max-age=63072000; includeSubdomains; preload
last-modified: Tue, 07 Nov 2023 16:31:43 GMT
server: AmazonS3
via: 1.1 231be1c97cc722fa08b64d21072ebfac.cloudfront.net (CloudFront), 1.1 3bf3e75bcb9a86b3eb343a1d4392a6de.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P3, FRA2-C1
etag: "289f3827ec7de87d6e947ec05798a2f8"
x-frame-options: SAMEORIGIN
x-cache: Miss from cloudfront
content-type: image/png
cache-control: max-age=31536000
content-length: 1914
x-amz-cf-id: Ylg78SCCvAvahYOsv7kUroOstQQ-31-o42p_fWqtcqASQHM5fwigIA==

GET
H2 200 AW-Security-Teams-Menu-bg.jpg
marvel-b1-cdn.bc0a.com/f00000000241276/arcticwolf.com/wp-content/uploads/2023/10/ 13 KB
14 KB 139ms
71ms Image
image/webp 2600:9000:2250:b000:0:f267:a5c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://marvel-b1-cdn.bc0a.com/f00000000241276/arcticwolf.com/wp-content/uploads/2023/10/AW-Security-Teams-Menu-bg.jpg
Requested by: Host: arcticwolf.com
URL: https://arcticwolf.com/resources/blog/tellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2250:b000:0:f267:a5c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 344d11a2807ba0c7d963b062a5cfa5c3423204ff01cce22fdbe696c464fd0058

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://arcticwolf.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

x-amz-version-id: c0lBaDi6Rq8lkIEKSVMf9pq2YZoGbywd
date: Tue, 07 Nov 2023 05:05:23 GMT
via: 1.1 0121ceb2efadb6db52d122a8b6b52f90.cloudfront.net (CloudFront)
x-amz-request-id: H68RQ6HH9P6ZWXEP
x-amz-cf-pop: FRA60-P2
x-amz-server-side-encryption: AES256
age: 42188
x-cache: Hit from cloudfront
content-length: 13450
x-amz-id-2: pDIFFewJ7rafzmp1ItWX3IzWYSFAMp1NBqZ5gRXJ+5RSJktmTjOi5cJVSgu9i1L5XgeVRS0JkcQ=
x-amz-expiration: expiry-date="Mon, 06 Jul 2026 00:00:00 GMT", rule-id="delete-old-images"
last-modified: Mon, 09 Oct 2023 23:54:14 GMT
server: AmazonS3
etag: "35f73b5161cc850a815cef4429ad7b78"
content-type: image/webp
access-control-allow-origin: *
cache-control: max-age=31536000
accept-ranges: bytes
x-amz-cf-id: -DmeWrVAAqSg5SwJ0n711QAJHG-CPg0Bg4-tHRqAPdf7d8vA8LQ3Zg==

GET
H2 200 S6uyw4BMUTPHjx4wXg.woff2
fonts.gstatic.com/s/lato/v24/ 23 KB
24 KB 143ms
40ms Font
font/woff2 2a00:1450:4001:828::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/lato/v24/S6uyw4BMUTPHjx4wXg.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Encode+Sans%3A100%2C100italic%2C200%2C200italic%2C300%2C300italic%2C400%2C400italic%2C500%2C500italic%2C600%2C600italic%2C700%2C700italic%2C800%2C800italic%2C900%2C900italic%7CLato%3A100%2C100italic%2C200%2C200italic%2C300%2C300italic%2C400%2C400italic%2C500%2C500italic%2C600%2C600italic%2C700%2C700italic%2C800%2C800italic%2C900%2C900italic%7CRoboto%3A100%2C100italic%2C200%2C200italic%2C300%2C300italic%2C400%2C400italic%2C500%2C500italic%2C600%2C600italic%2C700%2C700italic%2C800%2C800italic%2C900%2C900italic&display=auto&ver=6.3.2

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

918b7dc3e2e2d015c16ce08b57bcb64d2253bafc1707658f361e72865498e537

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://arcticwolf.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Thu, 02 Nov 2023 04:39:37 GMT
x-content-type-options: nosniff
age: 475733
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 23580
x-xss-protection: 0
last-modified: Tue, 02 May 2023 15:17:22 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 01 Nov 2024 04:39:37 GMT

GET
H2 200 S6u9w4BMUTPHh6UVSwiPGQ.woff2
fonts.gstatic.com/s/lato/v24/ 23 KB
23 KB 189ms
87ms Font
font/woff2 2a00:1450:4001:828::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/lato/v24/S6u9w4BMUTPHh6UVSwiPGQ.woff2

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c447dd7677b419db7b21dbdfc6277c7816a913ffda76fd2e52702df538de0e49

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://arcticwolf.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Sat, 04 Nov 2023 21:18:33 GMT
x-content-type-options: nosniff
age: 242997
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 23040
x-xss-protection: 0
last-modified: Tue, 02 May 2023 15:07:25 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 03 Nov 2024 21:18:33 GMT

GET
H2 200 fa-solid-900.woff2
arcticwolf.com/wp-content/plugins/elementor/assets/lib/font-awesome/webfonts/ 76 KB
77 KB 291ms
291ms Font
font/woff2 13.224.189.102
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://arcticwolf.com/wp-content/plugins/elementor/assets/lib/font-awesome/webfonts/fa-solid-900.woff2

Requested by

Host: arcticwolf.com
URL: https://arcticwolf.com/wp-content/plugins/elementor/assets/lib/font-awesome/css/all.min.css?ver=4.10.14

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.189.102 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-224-189-102.fra2.r.cloudfront.net

Software

AmazonS3 /

Resource Hash

d0b4256abed72481585662971262eabee345c19f837af00d7ce24239d3b40eef

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://arcticwolf.com/wp-content/plugins/elementor/assets/lib/font-awesome/css/all.min.css?ver=4.10.14
Origin: https://arcticwolf.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 16:48:31 GMT
x-amz-version-id: WYGs0MaTj6hZxgWB0PVX7zTBs3uzz1t_
x-content-type-options: nosniff
strict-transport-security: max-age=63072000; includeSubdomains; preload
via: 1.1 39e6266db143f6443f194d8c60e22480.cloudfront.net (CloudFront), 1.1 3bf3e75bcb9a86b3eb343a1d4392a6de.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P3, FRA2-C1
x-cache: Miss from cloudfront
content-length: 78196
last-modified: Fri, 03 Nov 2023 00:58:46 GMT
server: AmazonS3
etag: "e8a427e15cc502bef99cfd722b37ea98"
vary: Origin,Access-Control-Request-Headers,Access-Control-Request-Method
access-control-max-age: 600
access-control-allow-methods: GET, POST, PUT
content-type: font/woff2
access-control-allow-origin: *
cache-control: max-age=31536000
x-frame-options: SAMEORIGIN
x-amz-cf-id: PCmwaj5lu_2UwgZvb9JOklpYfTBiUg4mh-OcFLDzDMob3ry4ejmhfg==

GET
DATA 200
OK truncated
/ 31 KB
31 KB Font
application/x-font-woff

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: bc9c387b513b4d43675910f780fa03e92b9a4b58432b402a8f0a801a0d5ae855

Request headers

Referer
Origin: https://arcticwolf.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

Content-Type: application/x-font-woff;charset=utf-8

GET
H2 200 LDIhapOFNxEwR-Bd1O9uYNmnUQomAgE25imKSbHLSMA6.woff2
fonts.gstatic.com/s/encodesans/v19/ 27 KB
27 KB 197ms
96ms Font
font/woff2 2a00:1450:4001:828::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/encodesans/v19/LDIhapOFNxEwR-Bd1O9uYNmnUQomAgE25imKSbHLSMA6.woff2

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

84d61e7247b5194fedf074ca201a7bbc68d3ee141236b4e7cb5030abf9ab58c5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://arcticwolf.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Wed, 01 Nov 2023 16:39:02 GMT
x-content-type-options: nosniff
age: 518968
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 27320
x-xss-protection: 0
last-modified: Mon, 20 Mar 2023 20:55:44 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 31 Oct 2024 16:39:02 GMT

GET
H2 200 fa-brands-400.woff2
arcticwolf.com/wp-content/plugins/elementor/assets/lib/font-awesome/webfonts/ 75 KB
76 KB 304ms
303ms Font
font/woff2 13.224.189.102
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://arcticwolf.com/wp-content/plugins/elementor/assets/lib/font-awesome/webfonts/fa-brands-400.woff2

Requested by

Host: arcticwolf.com
URL: https://arcticwolf.com/wp-content/plugins/elementor/assets/lib/font-awesome/css/all.min.css?ver=4.10.14

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.189.102 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-224-189-102.fra2.r.cloudfront.net

Software

AmazonS3 /

Resource Hash

43c072c16c9ee6d67acdfa6c6d6685ff1e74eb4237b7cc3c1348ab1c108b26af

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://arcticwolf.com/wp-content/plugins/elementor/assets/lib/font-awesome/css/all.min.css?ver=4.10.14
Origin: https://arcticwolf.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 16:48:31 GMT
x-amz-version-id: vzK9r.PJAYYS7yEf22YRxsUT6xGhRVSj
x-content-type-options: nosniff
strict-transport-security: max-age=63072000; includeSubdomains; preload
via: 1.1 319f376925908156190f5fc160137b42.cloudfront.net (CloudFront), 1.1 3bf3e75bcb9a86b3eb343a1d4392a6de.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P3, FRA2-C1
x-cache: Miss from cloudfront
content-length: 76764
last-modified: Fri, 03 Nov 2023 00:58:37 GMT
server: AmazonS3
etag: "f7307680c7fe85959f3ecf122493ea7d"
vary: Origin,Access-Control-Request-Headers,Access-Control-Request-Method
access-control-max-age: 600
access-control-allow-methods: GET, POST, PUT
content-type: font/woff2
access-control-allow-origin: *
cache-control: max-age=31536000
x-frame-options: SAMEORIGIN
x-amz-cf-id: 7pcTCXojyKOYzMtcqSBv5Q_Iz2AnMdxY3XJ-lc5WSyX_bKjMfhM8fA==

GET
H2 200 getForm Show response
cybersecurity.arcticwolf.com/index.php/form/ 19 KB
5 KB 297ms
297ms Script
application/javascript 104.17.74.206
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cybersecurity.arcticwolf.com/index.php/form/getForm?munchkinId=840-OSQ-661&form=4815&url=https%3A%2F%2Farcticwolf.com%2Fresources%2Fblog%2Ftellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware%2F&callback=jQuery112402327424277933383_1699375710377&_=1699375710378
Requested by: Host: cybersecurity.arcticwolf.com
URL: https://cybersecurity.arcticwolf.com/js/forms2/js/forms2.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 104.17.74.206 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5df7062ba2bdba128e66405b62616576717b6d3506c58d54081f2715a42ce84d

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://arcticwolf.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 16:48:30 GMT
content-encoding: gzip
server: cloudflare
cf-ray: 8227106e98351994-FRA
cached: true
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8

GET
H2 200 de.json Show response
cdn.cookielaw.org/consent/db482b86-7cc0-40a4-94cb-f20d32869a3b/77bec06f-5a0f-402f-bf2b-1f770ac2ff6d/ 174 KB
34 KB 62ms
61ms Fetch
application/x-javascript 2606:4700::6812:82ec
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/consent/db482b86-7cc0-40a4-94cb-f20d32869a3b/77bec06f-5a0f-402f-bf2b-1f770ac2ff6d/de.json

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/202307.1.0/otBannerSdk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:82ec , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

916baea92eb9094e106e44c8d6de06469c6f446ae5ff8550767587489b80304c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://arcticwolf.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Tue, 07 Nov 2023 16:48:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
strict-transport-security: max-age=31536000; includeSubDomains; preload
age: 28510
content-md5: DQM9zXYP6kichaAAfgdR7w==
content-length: 34154
x-ms-lease-status: unlocked
last-modified: Tue, 17 Oct 2023 15:56:58 GMT
server: cloudflare
etag: 0x8DBCF29B1F5C403
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: *
x-ms-request-id: 33dc4fa7-d01e-004e-4f12-01170b000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=86400
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 8227106f2e9a1c09-FRA
expires: Wed, 08 Nov 2023 16:48:30 GMT

OPTIONS
H2 200 init
jukebox.pathfactory.com/api/public/v1/ Frame 0
0 400ms
122ms Preflight 44.218.211.184
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://jukebox.pathfactory.com/api/public/v1/init?image=&title=&url=https%3A%2F%2Farcticwolf.com%2Fresources%2Fblog%2Ftellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware%2F&clientId=LB-52456ADF-10926
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 44.218.211.184 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-218-211-184.compute-1.amazonaws.com
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: GET
Origin: https://arcticwolf.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: GET, PUT, POST, PATCH, OPTIONS
access-control-allow-origin: https://arcticwolf.com
access-control-expose-headers
access-control-max-age: 7200
date: Tue, 07 Nov 2023 16:48:30 GMT

GET
H2 204 init Show response
jukebox.pathfactory.com/api/public/v1/ 0
474 B 839ms
603ms XHR
text/plain 44.218.211.184
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://jukebox.pathfactory.com/api/public/v1/init?image=&title=&url=https%3A%2F%2Farcticwolf.com%2Fresources%2Fblog%2Ftellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware%2F&clientId=LB-52456ADF-10926

Requested by

Host: cdn-app.pathfactory.com
URL: https://cdn-app.pathfactory.com/production/jukebox/current/jukebox.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

44.218.211.184 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-44-218-211-184.compute-1.amazonaws.com

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Accept: application/json
Referer: https://arcticwolf.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36
Content-Type: application/json

Response headers

x-runtime: 0.480411
date: Tue, 07 Nov 2023 16:48:31 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
referrer-policy: no-referrer-when-downgrade
content-security-policy
access-control-max-age: 7200
access-control-allow-methods: GET, PUT, POST, PATCH, OPTIONS
access-control-allow-origin: https://arcticwolf.com
access-control-expose-headers
cache-control: no-cache
access-control-allow-credentials: true
vary: Origin
x-request-id: 955d9bcf-fe27-4bf5-96f5-ce852b2d3c92

GET
H2 200 6si.min.js Show response
j.6sc.co/ 60 KB
16 KB 189ms
41ms Script
application/javascript 23.38.98.66
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://j.6sc.co/6si.min.js

Requested by

Host: arcticwolf.com
URL: https://arcticwolf.com/resources/blog/tellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.38.98.66 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a23-38-98-66.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

e8a99c16a581c4e69330699d00aa4a7763158ed99194087bceebd232d53eb42f

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://arcticwolf.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 07 Nov 2023 16:48:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 17 Oct 2023 19:14:48 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "652edd28-f1f8"
vary: Accept-Encoding
content-type: application/javascript
cache-control: private, no-cache, proxy-revalidate
accept-ranges: bytes
content-length: 16484
expires: Tue, 07 Nov 2023 16:48:30 GMT

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/943679881/ 3 KB
2 KB 181ms
53ms Script
text/javascript 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/943679881/?random=1699375710704&cv=11&fst=1699375710704&bg=ffffff&guid=ON&async=1&gtm=45He3b60v78485517&gcd=11l1l1l1l1&u_w=1600&u_h=1200&url=https%3A%2F%2Farcticwolf.com%2Fresources%2Fblog%2Ftellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware%2F&hn=www.googleadservices.com&frm=0&tiba=Exploitation%20of%20CVE-2023-46604%20Leading%20to%20Ransomware&auid=1349226205.1699375711&uamb=0&uaw=0&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-PMV4652

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

bc0b140691452cb2f725b9cb77f5ada4759ca70a384071eeec68828469b7a174

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://arcticwolf.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 07 Nov 2023 16:48:30 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1316
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 uwt.js Show response
static.ads-twitter.com/ 56 KB
15 KB 161ms
36ms Script
application/javascript 146.75.120.157
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://static.ads-twitter.com/uwt.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-PMV4652
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 146.75.120.157 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: cf7fcc9f75c8717897bfaef72f303fab423ce1b70c98512aeb3677e4af988dee

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://arcticwolf.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 16:48:30 GMT
content-encoding: gzip
last-modified: Thu, 27 Oct 2022 16:56:53 GMT
etag: "32ad004436155ec972bc50e6238b5b67+gzip+gzip"
vary: Accept-Encoding,Host
x-cache: HIT, HIT
content-type: application/javascript; charset=utf-8
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
x-tw-cdn: FT
cache-control: no-cache
accept-ranges: bytes
content-length: 15375
x-served-by: cache-iad-kjyo7100081-IAD, cache-fra-etou8220021-FRA

GET
H2 200 insight.min.js Show response
snap.licdn.com/li.lms-analytics/ 12 KB
4 KB 163ms
40ms Script
application/javascript 2a02:26f0:480:f::213:7ec6
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://snap.licdn.com/li.lms-analytics/insight.min.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-PMV4652

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:480:f::213:7ec6 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Resource Hash

4799e6fee2ac082caeb34ece153a76289d6cce1159a3838bccf840970e066e30

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://arcticwolf.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 16:48:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 07 Nov 2023 07:13:07 GMT
x-cdn: AKAM
x-amz-server-side-encryption: AES256
vary: Accept-Encoding
content-type: application/javascript;charset=utf-8
cache-control: max-age=51908
accept-ranges: bytes
content-length: 3839

GET
H2 200 pixel.js Show response
www.redditstatic.com/ads/ 23 KB
8 KB 193ms
57ms Script
application/javascript 2a04:4e42::396
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://www.redditstatic.com/ads/pixel.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-PMV4652
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:4e42::396 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: snooserv /
Resource Hash: e803e774c7b59fe74f71ed93acaa875cf9a99947ff8ed7615cd0c93c1667250f

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://arcticwolf.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 16:48:30 GMT
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish
last-modified: Thu, 15 Jun 2023 20:49:59 GMT
server: snooserv
nel: {"report_to": "w3-reporting-nel", "max_age": 14400, "include_subdomains": false, "success_fraction": 0.02, "failure_fraction": 0.02}
etag: "4a205643a240cb95fa82289d62b5af7e"
x-amz-server-side-encryption: AES256
vary: Accept-Encoding,Origin
report-to: {"group": "w3-reporting-nel", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-nel.reddit.com/reports" }]}, {"group": "w3-reporting", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting.reddit.com/reports" }]}, {"group": "w3-reporting-csp", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-csp.reddit.com/reports" }]}
content-type: application/javascript
cache-control: public, max-age=60
accept-ranges: bytes
content-length: 7409

GET
H2 200 iframe_api Show response
www.youtube.com/ 993 B
2 KB 202ms
83ms Script
text/javascript 2a00:1450:4001:809::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/iframe_api

Requested by

Host: arcticwolf.com
URL: https://arcticwolf.com/resources/blog/tellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

f9f8a2c12a04d9ac4408a2e31569abedeac96e4817b3e3b25e10a80cff9fc200

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://arcticwolf.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 16:48:30 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-encoding: br
content-security-policy-report-only: require-trusted-types-for 'script';report-uri /cspreport
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657?hl=de for more info."
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
server: ESF
x-frame-options: SAMEORIGIN
vary: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
content-type: text/javascript; charset=utf-8
report-to: {"group":"youtube_main","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube_main"}]}
cache-control: private, max-age=0
origin-trial: AvC9UlR6RDk2crliDsFl66RWLnTbHrDbp+DiY6AYz/PNQ4G4tdUTjrHYr2sghbkhGQAVxb7jaPTHpEVBz0uzQwkAAAB4eyJvcmlnaW4iOiJodHRwczovL3lvdXR1YmUuY29tOjQ0MyIsImZlYXR1cmUiOiJXZWJWaWV3WFJlcXVlc3RlZFdpdGhEZXByZWNhdGlvbiIsImV4cGlyeSI6MTcxOTUzMjc5OSwiaXNTdWJkb21haW4iOnRydWV9
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
cross-origin-opener-policy-report-only: same-origin; report-to="youtube_main"
expires: Tue, 07 Nov 2023 16:48:30 GMT

GET
H/1.1 200
OK munchkin.js Show response
munchkin.marketo.net/ 1 KB
1 KB 178ms
61ms Script
application/x-javascript 2.23.65.88
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://munchkin.marketo.net/munchkin.js
Requested by: Host: arcticwolf.com
URL: https://arcticwolf.com/resources/blog/tellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2.23.65.88 Düsseldorf, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-23-65-88.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 5206536707c84baa892d3c3231b351985ee828cb8b9c0bd8db42cd3363995fc4

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://arcticwolf.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

Date: Tue, 07 Nov 2023 16:48:30 GMT
Content-Encoding: gzip
Last-Modified: Fri, 17 Mar 2023 01:24:48 GMT
Server: AkamaiNetStorage
ETag: "cb731cc5c2bd9f31d6bfeb19f3c8b1ff:1679016288.730763"
Vary: Accept-Encoding
Content-Type: application/x-javascript
P3P: policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR"
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 729

GET
H2 200 bat.js Show response
bat.bing.com/ 45 KB
13 KB 179ms
63ms Script
application/javascript 2620:1ec:c11::200
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://bat.bing.com/bat.js

Requested by

Host: arcticwolf.com
URL: https://arcticwolf.com/resources/blog/tellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

0dc90421cbf6414c9f1ef5e93af3dbe48a4e51899452330f0ae0b2815e38be94

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://arcticwolf.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
date: Tue, 07 Nov 2023 16:48:30 GMT
last-modified: Fri, 20 Oct 2023 01:13:24 GMT
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 971427B1611643DABB341A3F5A0F5BD6 Ref B: FRA31EDGE0721 Ref C: 2023-11-07T16:48:30Z
etag: "0125f9ff22da1:0"
vary: Accept-Encoding
x-cache: CONFIG_NOCACHE
content-type: application/javascript
cache-control: private,max-age=1800
accept-ranges: bytes
content-length: 13079

GET
H2 200 fbevents.js Show response
connect.facebook.net/en_US/ 202 KB
54 KB 157ms
41ms Script
application/x-javascript 2a03:2880:f083:9:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Host: arcticwolf.com
URL: https://arcticwolf.com/resources/blog/tellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f083:9:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

3e136e77083bfc6ef14ffc5abd19da89a82bf12fc0cda3c603e01582b93303c8

Security Headers

Name	Value
Content-Security-Policy	default-src facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com data: blob: 'self';script-src .fbcdn.net .facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://arcticwolf.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

content-security-policy: default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script';
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; preload; includeSubDomains
date: Tue, 07 Nov 2023 16:48:30 GMT
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 54273
x-xss-protection: 0
reporting-endpoints
pragma: public
x-fb-debug: blt4tsgaCs1yrrviHxG7873DGFMvT6m/fn/HX5eqOz/77kvd5rzeLZxTmc5dsKFiDGLROINhQoYNq777bjYklg==
cross-origin-opener-policy: same-origin-allow-popups
vary: Accept-Encoding
x-frame-options: DENY
content-type: application/x-javascript; charset=utf-8
cache-control: public, max-age=1200
permissions-policy: accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), magnetometer=(), microphone=(), midi=(), payment=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), usb=()
timing-allow-origin: *
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 3545.js Show response
tracking.g2crowd.com/attribution_tracking/conversions/ 16 B
1 KB 278ms
162ms Script
text/javascript 2606:4700:4400::6812:2b1f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://tracking.g2crowd.com/attribution_tracking/conversions/3545.js?p=https://arcticwolf.com/resources/blog/tellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware/&e=

Requested by

Host: arcticwolf.com
URL: https://arcticwolf.com/resources/blog/tellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::6812:2b1f , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

3dae93a05edd9dcfc1864b87178a31e0bfa93e1a9b1c486c6e9cbf73cae87862

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' .g2crowd.com .g2.com; connect-src 'self' .g2crowd.com .g2.com; font-src 'self' .g2crowd.com .g2.com; form-action 'self' .g2crowd.com .g2.com; frame-src 'self' .g2crowd.com .g2.com; img-src 'self' .g2crowd.com .g2.com; manifest-src 'self' .g2crowd.com .g2.com; media-src 'self' .g2crowd.com .g2.com; object-src 'self' .g2crowd.com .g2.com; script-src 'self' .g2crowd.com .g2.com; style-src 'self' .g2crowd.com .g2.com; worker-src 'self' .g2crowd.com .g2.com
Strict-Transport-Security	max-age=604800
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://arcticwolf.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 16:48:30 GMT
strict-transport-security: max-age=604800
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
content-encoding: br
x-permitted-cross-domain-policies: none
content-security-policy: default-src 'self' *.g2crowd.com *.g2.com; connect-src 'self' *.g2crowd.com *.g2.com; font-src 'self' *.g2crowd.com *.g2.com; form-action 'self' *.g2crowd.com *.g2.com; frame-src 'self' *.g2crowd.com *.g2.com; img-src 'self' *.g2crowd.com *.g2.com; manifest-src 'self' *.g2crowd.com *.g2.com; media-src 'self' *.g2crowd.com *.g2.com; object-src 'self' *.g2crowd.com *.g2.com; script-src 'self' *.g2crowd.com *.g2.com; style-src 'self' *.g2crowd.com *.g2.com; worker-src 'self' *.g2crowd.com *.g2.com
x-xss-protection: 1; mode=block
x-request-id: 214e7bd8-d3f6-4162-81b9-ff3af50be4c4
x-runtime: 0.003130
referrer-policy: strict-origin-when-cross-origin
server: cloudflare
etag: W/"3dae93a05edd9dcfc1864b87178a31e0"
x-download-options: noopen
x-frame-options: SAMEORIGIN
vary: Origin
content-type: text/javascript; charset=utf-8
cache-control: max-age=600, public
cf-ray: 82271070d9bd2bd5-FRA

GET
H2 200 uWhJBalAQeFpeNitJUHH Show response
ws.zoominfo.com/pixel/ 0
659 B 289ms
183ms Script
text/javascript 2606:4700::6810:890f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://ws.zoominfo.com/pixel/uWhJBalAQeFpeNitJUHH

Requested by

Host: arcticwolf.com
URL: https://arcticwolf.com/resources/blog/tellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:890f , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / Express

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://arcticwolf.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 16:48:31 GMT
via: 1.1 google
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
server: cloudflare
x-powered-by: Express
content-type: text/javascript
access-control-allow-origin: *
access-control-allow-credentials: true
cf-ray: 82271071cdd41e33-FRA
access-control-allow-headers: Content-Type,cf-ipcountry,service-version,x-appengine-user-ip,x-forwarded-for, x-ws-collect-type,requestFromZITag,unifiedScriptVerified,_zitok,_vtok,visited-url
content-length: 0
alt-svc: h3=":443"; ma=86400

GET
H2 200 zaxd53bdwtvy.js Show response
js.driftt.com/include/1699375800000/ 217 KB
61 KB 268ms
169ms Script
application/javascript 18.245.86.73
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/include/1699375800000/zaxd53bdwtvy.js

Requested by

Host: arcticwolf.com
URL: https://arcticwolf.com/resources/blog/tellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.245.86.73 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-245-86-73.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

7a7b726b264b8fc017eaf3f94de7fb9f47cc162b781f2806d4b8b9a371c6f8ff

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://arcticwolf.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

x-amz-version-id: Z1y6OO1J.6wfYXc3hh9KTJmbQcedQuea
strict-transport-security: max-age=31536000; includeSubDomains
content-encoding: gzip
date: Tue, 07 Nov 2023 16:48:31 GMT
via: 1.1 1c3c1c03f4bbd4e68725363918cb3454.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P6
x-amz-server-side-encryption: AES256
x-cache: RefreshHit from cloudfront
x-envoy-upstream-service-time: 30
last-modified: Fri, 03 Nov 2023 17:04:30 GMT
server: istio-envoy
etag: W/"85cc922fceed794b35b3bdfafde13cd4"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: no-cache
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: QdziftPgSDeAAuyIlK1o8G_xrRbdl-zxX4dVlJnOhFfc0AR6_TthUA==

GET
H2 200 tracking.js Show response
trk.techtarget.com/ 3 KB
2 KB 207ms
86ms Script
text/javascript 2606:4700:4400::6812:24c4
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://trk.techtarget.com/tracking.js
Requested by: Host: arcticwolf.com
URL: https://arcticwolf.com/resources/blog/tellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:4400::6812:24c4 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0c07b854855b0e2bd7839c3659defa45307e96e281b3c00571d09f213eb6a76e

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://arcticwolf.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 16:48:31 GMT
content-encoding: br
cf-cache-status: HIT
cf-bgj: minify
last-modified: Tue, 13 Dec 2022 15:01:39 GMT
server: cloudflare
age: 84313
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=1200
cf-ray: 82271071fbf2bb38-FRA
expires: Tue, 07 Nov 2023 17:08:31 GMT

GET
H2 200 ping.min.js Show response
cdn.pdst.fm/ 26 KB
6 KB 178ms
40ms Script
application/javascript 35.244.142.80
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.pdst.fm/ping.min.js
Requested by: Host: arcticwolf.com
URL: https://arcticwolf.com/resources/blog/tellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.142.80 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 80.142.244.35.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: cb8d40d1eb7e2dc885affcf0012d9e1a73c270d843e8b890d36538e52d0a0342

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://arcticwolf.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 16:14:32 GMT
content-encoding: gzip
age: 2039
x-guploader-uploadid: ABPtcPo-J-MG2zfQBjjjMLSFxE9fFT5_j48IqvrRpvYrDo3VrE118UC3LrTS6DS9NMeKi2yiVwARSKimXdVYeBrVEnYOu6gnOsnK
x-goog-storage-class: STANDARD
x-goog-metageneration: 4
x-goog-stored-content-encoding: gzip
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 5774
last-modified: Fri, 28 May 2021 20:34:03 GMT
server: UploadServer
etag: "d001d1c9f5a942fa5524eeacb047e819"
vary: Accept-Encoding
x-goog-generation: 1622234043862937
x-goog-hash: crc32c=oKoi/w==, md5=0AHRyfWpQvpVJO6ssEfoGQ==
access-control-allow-origin: *
access-control-expose-headers: Content-Type
cache-control: public, max-age=3600
x-goog-stored-content-length: 5774
accept-ranges: bytes
content-type: application/javascript;
expires: Tue, 07 Nov 2023 17:14:32 GMT

GET
H2 200 siteanalyze_6145655.js Show response
siteimproveanalytics.com/js/ 56 KB
15 KB 197ms
83ms Script
application/javascript 2606:4700:e6::ac40:c11b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://siteimproveanalytics.com/js/siteanalyze_6145655.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-PMV4652
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:e6::ac40:c11b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 465654367d23cf09659d2a2ac381addef4d04a2b613f4c62073b98e248ac4f48

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://arcticwolf.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 16:48:31 GMT
content-encoding: gzip
cf-cache-status: REVALIDATED
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-amz-request-id: 6WC1QBJB10KFFJYM
alt-svc: h3=":443"; ma=86400
content-length: 14363
x-amz-id-2: 7KT9NEb2fkvtqaAgburi4Tsnt1+z9lhRYegV+x5Udg3/BYw8pC8S5SpSds4Nt4R3LisCb3N449Q=
last-modified: Mon, 30 Oct 2023 16:19:24 GMT
server: cloudflare
etag: "ff5c0ee48309512449cafc39459bc159"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Dpb3YztZRTNb8q3PQOCPTo1DR4RuSDiBHjHZyua%2BMW9HWN4FQfDVFz3YTMBHljTZZdB6uP%2FlbVUfvh2izUKC4KWIBi6dBoRsAnIZ%2FuiUuj4L6JZSwsdAgYKSLvkAGIwc8hiu69O41%2BI6Q%2Bh%2BxaUf%2FwPGniid1r4%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
cache-control: max-age=86400, no-transform
accept-ranges: bytes
cf-ray: 82271071ff5935f6-FRA

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 180 KB
66 KB 54ms
53ms Script
application/javascript 2a00:1450:4001:802::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=DC-11592367&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-PMV4652

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:802::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

d9ef036ab51db2ff3702420a2f297920ff435fc8d3caf12b3e687b56288a4e78

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://arcticwolf.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 16:48:30 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 67171
x-xss-protection: 0
last-modified: Tue, 07 Nov 2023 15:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Tue, 07 Nov 2023 16:48:30 GMT

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 52 KB
21 KB 146ms
41ms Script
text/javascript 2001:4860:4802:34::178
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-PMV4652

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2001:4860:4802:34::178 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://arcticwolf.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
date: Tue, 07 Nov 2023 15:51:32 GMT
last-modified: Mon, 12 Jun 2023 18:23:07 GMT
server: Golfe2
age: 3419
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 20994
expires: Tue, 07 Nov 2023 17:51:32 GMT

GET
H2 200 otFloatingFlat.json Show response
cdn.cookielaw.org/scripttemplates/202307.1.0/assets/ 10 KB
3 KB 54ms
54ms Fetch
application/json 2606:4700::6812:82ec
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/202307.1.0/assets/otFloatingFlat.json

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/202307.1.0/otBannerSdk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:82ec , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

3321757433351762495ef3452adf0fcefa179583f4409dd04815c710c5e45f6f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://arcticwolf.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Tue, 07 Nov 2023 16:48:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
content-md5: FMq1aROKTLEntOEKFY9rXQ==
age: 30220
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-length: 2707
x-ms-lease-status: unlocked
last-modified: Wed, 02 Aug 2023 03:23:58 GMT
server: cloudflare
etag: 0x8DB9307E920F4DA
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: *
x-ms-request-id: 12706a2c-c01e-0144-5e46-c542df000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: max-age=86400
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 822710714a011c09-FRA

GET
H2 200 otPcCenter.json Show response
cdn.cookielaw.org/scripttemplates/202307.1.0/assets/v2/ 61 KB
12 KB 58ms
58ms Fetch
application/json 2606:4700::6812:82ec
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/202307.1.0/assets/v2/otPcCenter.json

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/202307.1.0/otBannerSdk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:82ec , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d55ad3bc35664e6ce9dc3e6a71bb6d3a4c8fddeb6af1a195727c0361ddd92a2e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://arcticwolf.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Tue, 07 Nov 2023 16:48:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
content-md5: lrjqvumkzLVMxa35AVJR4w==
age: 29297
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-length: 12544
x-ms-lease-status: unlocked
last-modified: Wed, 02 Aug 2023 03:24:00 GMT
server: cloudflare
etag: 0x8DB9307EA0A6EFC
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: *
x-ms-request-id: d5df3ede-301e-007c-2746-c545d3000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: max-age=86400
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 822710714a061c09-FRA

GET
H2 200 otCookieSettingsButton.json Show response
cdn.cookielaw.org/scripttemplates/202307.1.0/assets/ 5 KB
2 KB 63ms
63ms Fetch
application/json 2606:4700::6812:82ec
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/202307.1.0/assets/otCookieSettingsButton.json

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/202307.1.0/otBannerSdk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:82ec , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

509f2e49500fbaeb5d7e1959071f2922b693d0135080e2871e124ec8bdd08bb2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://arcticwolf.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Tue, 07 Nov 2023 16:48:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
content-md5: J/OXP0fdvy1F2I+bffRnrw==
age: 4663
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-length: 1766
x-ms-lease-status: unlocked
last-modified: Wed, 02 Aug 2023 03:23:59 GMT
server: cloudflare
etag: 0x8DB9307E9C4BDC1
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: *
x-ms-request-id: 08ebba26-501e-000d-40dd-e6f157000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: max-age=86400
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 822710714a091c09-FRA

GET
H2 200 otCommonStyles.css Show response
cdn.cookielaw.org/scripttemplates/202307.1.0/assets/ 21 KB
4 KB 58ms
58ms Fetch
text/css 2606:4700::6812:82ec
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/202307.1.0/assets/otCommonStyles.css

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/202307.1.0/otBannerSdk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:82ec , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

9ed6388d56fc9f2044791e0559ab4a283381791e359dc2981449955e702de56d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://arcticwolf.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Tue, 07 Nov 2023 16:48:30 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: gzip
content-md5: /b68gAlvQhCuyX9fCPcDyg==
age: 29297
x-ms-lease-status: unlocked
last-modified: Wed, 02 Aug 2023 03:24:08 GMT
server: cloudflare
vary: Accept-Encoding
content-type: text/css
access-control-allow-origin: *
x-ms-request-id: 40bc2471-a01e-0026-0a85-f0719b000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: max-age=86400
x-ms-version: 2009-09-19
cf-ray: 822710714a0c1c09-FRA

GET
H2 200 forms2.css
cybersecurity.arcticwolf.com/js/forms2/css/ 13 KB
3 KB 69ms
65ms Stylesheet
text/css 104.17.74.206
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cybersecurity.arcticwolf.com/js/forms2/css/forms2.css

Requested by

Host: cybersecurity.arcticwolf.com
URL: https://cybersecurity.arcticwolf.com/js/forms2/js/forms2.min.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

104.17.74.206 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

256e42104f48a5fa80b031da12dc56acde224fba3f9810f8f8192b39136d365a

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://arcticwolf.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 16:48:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
last-modified: Tue, 26 Sep 2023 22:55:04 GMT
server: cloudflare
age: 2373
etag: "26e1490-3437-6064af724e200"
vary: Accept-Encoding
content-type: text/css
cache-control: public, max-age=14400
accept-ranges: bytes
cf-ray: 822710716d261994-FRA
content-length: 2623
expires: Tue, 07 Nov 2023 20:48:30 GMT

GET
H2 200 forms2-theme-plain.css
cybersecurity.arcticwolf.com/js/forms2/css/ 828 B
381 B 64ms
60ms Stylesheet
text/css 104.17.74.206
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cybersecurity.arcticwolf.com/js/forms2/css/forms2-theme-plain.css

Requested by

Host: cybersecurity.arcticwolf.com
URL: https://cybersecurity.arcticwolf.com/js/forms2/js/forms2.min.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

104.17.74.206 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

57cd46adbabd6c40823602b4513aecbe89320a769572255272abe9f008de69fa

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://arcticwolf.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 16:48:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
last-modified: Tue, 26 Sep 2023 22:55:04 GMT
server: cloudflare
age: 6751
etag: "26e1493-33c-6064af724e200"
vary: Accept-Encoding
content-type: text/css
cache-control: public, max-age=14400
accept-ranges: bytes
cf-ray: 822710717d321994-FRA
content-length: 246
expires: Tue, 07 Nov 2023 20:48:30 GMT

GET
H2 200 css
fonts.googleapis.com/ 717 B
466 B 56ms
54ms Stylesheet
text/css 2a00:1450:4001:810::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Lato

Requested by

Host: cybersecurity.arcticwolf.com
URL: https://cybersecurity.arcticwolf.com/js/forms2/js/forms2.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

eb91e77384f9aff2e81a868ae4f2ae6fb5940c573d0e39088ff637414b4ffed9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://arcticwolf.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Tue, 07 Nov 2023 16:48:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Tue, 07 Nov 2023 16:23:28 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Tue, 07 Nov 2023 16:48:30 GMT

GET
H2 200 insight.beta.min.js Show response
snap.licdn.com/li.lms-analytics/ 41 KB
15 KB 51ms
42ms Script
application/javascript 2a02:26f0:480:f::213:7ec6
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://snap.licdn.com/li.lms-analytics/insight.beta.min.js

Requested by

Host: snap.licdn.com
URL: https://snap.licdn.com/li.lms-analytics/insight.min.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:480:f::213:7ec6 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Resource Hash

b6131e06fcb9060f687ce48a1c26f52333ba731796ee9bfc9c22589d71bbc859

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://arcticwolf.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 16:48:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 07 Nov 2023 07:13:08 GMT
x-cdn: AKAM
x-amz-server-side-encryption: AES256
vary: Accept-Encoding
content-type: application/javascript;charset=utf-8
cache-control: max-age=51974
accept-ranges: bytes
content-length: 15306

GET
H2 200 /
www.google.com/pagead/1p-user-list/943679881/ 42 B
455 B 150ms
50ms Image
image/gif 2a00:1450:4001:813::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/943679881/?random=1699375710704&cv=11&fst=1699372800000&bg=ffffff&guid=ON&async=1&gtm=45He3b60v78485517&u_w=1600&u_h=1200&url=https%3A%2F%2Farcticwolf.com%2Fresources%2Fblog%2Ftellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware%2F&frm=0&tiba=Exploitation%20of%20CVE-2023-46604%20Leading%20to%20Ransomware&fmt=3&is_vtc=1&cid=CAQSGwDICaaNQKbrrrexaxx0zetfmc2V1F2Z-YCLXg&random=3894668898&rmt_tld=0&ipr=y

Requested by

Host: arcticwolf.com
URL: https://arcticwolf.com/resources/blog/tellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://arcticwolf.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 07 Nov 2023 16:48:31 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.de/pagead/1p-user-list/943679881/ 42 B
455 B 151ms
52ms Image
image/gif 2a00:1450:4001:82a::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/943679881/?random=1699375710704&cv=11&fst=1699372800000&bg=ffffff&guid=ON&async=1&gtm=45He3b60v78485517&u_w=1600&u_h=1200&url=https%3A%2F%2Farcticwolf.com%2Fresources%2Fblog%2Ftellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware%2F&frm=0&tiba=Exploitation%20of%20CVE-2023-46604%20Leading%20to%20Ransomware&fmt=3&is_vtc=1&cid=CAQSGwDICaaNQKbrrrexaxx0zetfmc2V1F2Z-YCLXg&random=3894668898&rmt_tld=1&ipr=y

Requested by

Host: arcticwolf.com
URL: https://arcticwolf.com/resources/blog/tellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://arcticwolf.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 07 Nov 2023 16:48:31 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 adsct
t.co/i/ 43 B
377 B 229ms
145ms Image
image/gif 104.244.42.133
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://t.co/i/adsct?bci=3&eci=2&event_id=08b70c70-da87-45e5-971b-cffa65ddcebb&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=985d179d-9614-4430-9a10-c7e712453bde&tw_document_href=https%3A%2F%2Farcticwolf.com%2Fresources%2Fblog%2Ftellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware%2F&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=nxet7&type=javascript&version=2.3.29

Requested by

Host: arcticwolf.com
URL: https://arcticwolf.com/resources/blog/tellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.244.42.133 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://arcticwolf.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

x-response-time: 103
date: Tue, 07 Nov 2023 16:48:30 GMT
strict-transport-security: max-age=0
server: tsa_o
content-type: image/gif;charset=utf-8
x-transaction-id: 818610e7827b5f82
cache-control: no-cache, no-store, max-age=0
perf: 7626143928
x-connection-hash: 3e595cbbe3dac2431c32d115adb87d17003d67d0a6e1eee9956e3994d65c2588
content-length: 43

GET
H2 200 adsct
analytics.twitter.com/i/ 43 B
396 B 306ms
215ms Image
image/gif 104.244.42.131
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://analytics.twitter.com/i/adsct?bci=3&eci=2&event_id=08b70c70-da87-45e5-971b-cffa65ddcebb&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=985d179d-9614-4430-9a10-c7e712453bde&tw_document_href=https%3A%2F%2Farcticwolf.com%2Fresources%2Fblog%2Ftellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware%2F&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=nxet7&type=javascript&version=2.3.29

Requested by

Host: arcticwolf.com
URL: https://arcticwolf.com/resources/blog/tellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.244.42.131 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://arcticwolf.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

x-response-time: 175
date: Tue, 07 Nov 2023 16:48:30 GMT
strict-transport-security: max-age=631138519
server: tsa_o
content-type: image/gif;charset=utf-8
x-transaction-id: 0b3f051f5a9674f7
cache-control: no-cache, no-store, max-age=0
perf: 7626143928
x-connection-hash: 377ac0949139f86cf10c67507d80be3dd9ce7b77902b38ec0365b55be496b6cf
content-length: 43

GET
H/1.1 200
OK munchkin.js Show response
munchkin.marketo.net/163/ 11 KB
5 KB 44ms
44ms Script
application/x-javascript 2.23.65.88
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://munchkin.marketo.net/163/munchkin.js
Requested by: Host: munchkin.marketo.net
URL: https://munchkin.marketo.net/munchkin.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2.23.65.88 Düsseldorf, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-23-65-88.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 68cc280ce370c6f1f51a4fc5950103fc38df80a429552c549add04ebd8bd3a23

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://arcticwolf.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

Date: Tue, 07 Nov 2023 16:48:31 GMT
Content-Encoding: gzip
Last-Modified: Fri, 06 Jan 2023 02:26:40 GMT
Server: AkamaiNetStorage
ETag: "ea7826f34518d7c2295738f39c7640fa:1672972000.238769"
Vary: Accept-Encoding
Content-Type: application/x-javascript
P3P: policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR"
Cache-Control: max-age=8640000
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 4741
Expires: Thu, 15 Feb 2024 16:48:31 GMT

GET
H2 200 26066703.js Show response
bat.bing.com/p/action/ 4 KB
2 KB 66ms
65ms Script
application/javascript 2620:1ec:c11::200
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://bat.bing.com/p/action/26066703.js

Requested by

Host: bat.bing.com
URL: https://bat.bing.com/bat.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

040e7b516a60105fbbd09dfba5e37c49539ce6b22b78aab284468c1185530f3d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://arcticwolf.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: br
date: Tue, 07 Nov 2023 16:48:30 GMT
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: D5B3565FF97A491198EBA023FA435355 Ref B: FRA31EDGE0721 Ref C: 2023-11-07T16:48:31Z
vary: Accept-Encoding
x-cache: CONFIG_NOCACHE
content-type: application/javascript; charset=utf-8
cache-control: private,max-age=60

GET
H2 200 rp.gif
alb.reddit.com/ 42 B
637 B 152ms
42ms Image
image/gif 151.101.129.140
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://alb.reddit.com/rp.gif?ts=1699375711037&id=t2_6iqx4ime&event=PageVisit&m.itemCount=&m.value=&m.valueDecimal=&m.currency=&m.transactionId=&m.customEventName=&m.products=&m.conversionId=&uuid=a8afca71-abad-446e-89f2-b25da6e551fc&aaid=&em=&external_id=&idfa=&integration=reddit&opt_out=0&sh=1600&sw=1200&v=rdt_f5bd31b2
Requested by: Host: arcticwolf.com
URL: https://arcticwolf.com/resources/blog/tellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.129.140 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: Varnish /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://arcticwolf.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 16:48:31 GMT
via: 1.1 varnish
nel: {"report_to": "w3-reporting-nel", "max_age": 14400, "include_subdomains": false, "success_fraction": 0.3, "failure_fraction": 0.3}
server: Varnish
report-to: {"group": "w3-reporting-nel", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-nel.reddit.com/reports" }]}, {"group": "w3-reporting", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting.reddit.com/reports" }]}, {"group": "w3-reporting-csp", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-csp.reddit.com/reports" }]}
content-type: image/gif
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
content-length: 42
retry-after: 0

GET
H2 200 www-widgetapi.js Show response
www.youtube.com/s/player/9d15588c/www-widgetapi.vflset/ 215 KB
67 KB 42ms
41ms Script
text/javascript 2a00:1450:4001:809::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/s/player/9d15588c/www-widgetapi.vflset/www-widgetapi.js

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/iframe_api

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1442bd1e775db156e5e8dfdac18d3363e323fe5dcaa648224124fb898b97b441

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://arcticwolf.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 16:11:32 GMT
content-encoding: br
x-content-type-options: nosniff
age: 2219
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 68259
x-xss-protection: 0
last-modified: Wed, 01 Nov 2023 01:51:00 GMT
server: sffe
vary: Accept-Encoding, Origin
report-to: {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="youtube"
expires: Wed, 06 Nov 2024 16:11:32 GMT

GET
H2 200 480386592743035 Show response
connect.facebook.net/signals/config/ 133 KB
35 KB 168ms
167ms Script
application/x-javascript 2a03:2880:f083:9:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/480386592743035?v=2.9.138&r=stable&domain=arcticwolf.com

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f083:9:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

92007e698ebe04dda7f339497a7154271b384db07dc5588465c2e02b84643ed0

Security Headers

Name	Value
Content-Security-Policy	default-src facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com data: blob: 'self';script-src .fbcdn.net .facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://arcticwolf.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

content-security-policy: default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script';
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; preload; includeSubDomains
date: Tue, 07 Nov 2023 16:48:31 GMT
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
x-xss-protection: 0
reporting-endpoints
pragma: public
x-fb-debug: asaqQQGAFnNKTwdYG9BnzdJoPgmyuC+xX1I0W60peCFTi3tM6wqUwePpNg2OSpG96awXDY1CKhJJNvNTcUU2Vg==
cross-origin-opener-policy: same-origin-allow-popups
vary: Accept-Encoding
x-frame-options: DENY
content-type: application/x-javascript; charset=utf-8
origin-agent-cluster: ?0
cache-control: public, max-age=1200
permissions-policy: accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), magnetometer=(), microphone=(), midi=(), payment=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), usb=()
timing-allow-origin: *
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 wp-emoji-release.min.js Show response
arcticwolf.com/wp-includes/js/ 18 KB
6 KB 324ms
323ms Script
application/javascript 13.224.189.102
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://arcticwolf.com/wp-includes/js/wp-emoji-release.min.js?ver=6.3.2

Requested by

Host: arcticwolf.com
URL: https://arcticwolf.com/resources/blog/tellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.189.102 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-224-189-102.fra2.r.cloudfront.net

Software

AmazonS3 /

Resource Hash

4f79a89d16a5f717110fe080c0bf90b7e05ff95a4c4983f64d33110bf5f9c230

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://arcticwolf.com/resources/blog/tellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 16:48:32 GMT
x-amz-version-id: NVuUlVXPh6rITeBwsKVml8z7rG0bLjRs
x-content-type-options: nosniff
strict-transport-security: max-age=63072000; includeSubdomains; preload
content-encoding: gzip
x-amz-cf-pop: FRA60-P3, FRA2-C1
via: 1.1 68b2682a924ac399aa2724b5b439e75c.cloudfront.net (CloudFront), 1.1 3bf3e75bcb9a86b3eb343a1d4392a6de.cloudfront.net (CloudFront)
x-cache: Miss from cloudfront
last-modified: Sun, 16 Jul 2023 13:24:22 GMT
server: AmazonS3
etag: W/"4cc444663c1e69cb8ac7b909e7192bca"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=31536000
x-amz-cf-id: Rabp1S6R-jNvP9Za64eM3FLmETEGRzBReXSLFY1MySIvj2NoWfCytw==

GET
H2

200

adsct
t.co/i/
Redirect Chain

https://marvel-b1-cdn.bc0a.com/f00000000241276/t.co/i/adsct?bci=3&eci=2&event_id=08b70c70-da87-45e5-971b-cffa65ddcebb&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&integration=advertiser&p_id=Twitter&...
https://marvel-processor.bc0a.com/snowcloud/v1/api/loadUrl?customer=f00000000241276&url=https://t.co/i/adsct?bci=3&eci=2&event_id=08b70c70-da87-45e5-971b-cffa65ddcebb&events=%5B%5B%22pageview%22%2C...
https://t.co/i/adsct?bci=3&eci=2&event_id=08b70c70-da87-45e5-971b-cffa65ddcebb&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=985d179d-9614-4430-9a...

43 B
116 B

150ms
149ms

Image
image/gif

104.244.42.133
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

Requested by

Host: arcticwolf.com
URL: https://arcticwolf.com/resources/blog/tellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware/

Protocol

Server

104.244.42.133 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://arcticwolf.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

x-response-time: 109
date: Tue, 07 Nov 2023 16:48:31 GMT
strict-transport-security: max-age=0
server: tsa_o
content-type: image/gif;charset=utf-8
x-transaction-id: ae924f2f30acc96c
cache-control: no-cache, no-store, max-age=0
perf: 7626143928
x-connection-hash: 3e595cbbe3dac2431c32d115adb87d17003d67d0a6e1eee9956e3994d65c2588
content-length: 43

Redirect headers

pragma: no-cache
date: Tue, 07 Nov 2023 16:48:31 GMT
via: 1.1 google
x-content-type-options: nosniff
x-frame-options: DENY
location: https://t.co/i/adsct?bci=3&eci=2&event_id=08b70c70-da87-45e5-971b-cffa65ddcebb&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=985d179d-9614-4430-9a10-c7e712453bde&tw_document_href=https%3A%2F%2Farcticwolf.com%2Fresources%2Fblog%2Ftellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware%2F&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=nxet7&type=javascript&version=2.3.29
access-control-allow-origin: *
cache-control: no-cache, no-store, max-age=0, must-revalidate
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 1; mode=block
expires: 0

GET
H2 200 ot_close.svg
cdn.cookielaw.org/logos/static/ 651 B
623 B 70ms
70ms Image
image/svg+xml 2606:4700::6812:82ec
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cdn.cookielaw.org/logos/static/ot_close.svg

Requested by

Host: arcticwolf.com
URL: https://arcticwolf.com/resources/blog/tellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:82ec , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

901bb0e03b8c3c0a1cf4c487a177417328bb7d8c94106ecefceedd7d7f6c4ddc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://arcticwolf.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Tue, 07 Nov 2023 16:48:31 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: gzip
content-md5: pcXWFGpuVeSg/jVnYCseRg==
age: 83808
x-ms-lease-status: unlocked
last-modified: Mon, 06 Nov 2023 06:07:31 GMT
server: cloudflare
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
x-ms-request-id: 093195d2-701e-008c-5889-10518d000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: max-age=86400
x-ms-version: 2009-09-19
cf-ray: 822710733e6c65ab-FRA

GET
H2 200 ot_guard_logo.svg Show response
cdn.cookielaw.org/logos/static/ 497 B
538 B 53ms
51ms Fetch
image/svg+xml 2606:4700::6812:82ec
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/logos/static/ot_guard_logo.svg

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/202307.1.0/otBannerSdk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:82ec , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

691dcdb24853a0f5ce4e6597e5713dea66799b57ffe2c2a10f28f98e0b569b19

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://arcticwolf.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Tue, 07 Nov 2023 16:48:31 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: gzip
content-md5: tXyZydHjxQshFMbbBT1/8A==
age: 15273
x-ms-lease-status: unlocked
last-modified: Mon, 06 Nov 2023 06:07:30 GMT
server: cloudflare
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
x-ms-request-id: bbbf5193-e01e-0055-28b3-102908000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: max-age=86400
x-ms-version: 2009-09-19
cf-ray: 822710734d261c09-FRA

GET
H2 200 powered_by_logo.svg
cdn.cookielaw.org/logos/static/ 5 KB
2 KB 65ms
62ms Image
image/svg+xml 2606:4700::6812:82ec
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cdn.cookielaw.org/logos/static/powered_by_logo.svg

Requested by

Host: arcticwolf.com
URL: https://arcticwolf.com/resources/blog/tellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:82ec , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5fa00d047acd959697b9d7772c31dcd37bec33c70c6fbf80ab8316205d1d286d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://arcticwolf.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Tue, 07 Nov 2023 16:48:31 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: gzip
content-md5: Y+c301RBZNK39PvKQWrIBw==
age: 5572
x-ms-lease-status: unlocked
last-modified: Tue, 07 Nov 2023 03:36:19 GMT
server: cloudflare
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
x-ms-request-id: 2fead0c9-601e-0080-172e-11c685000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: max-age=86400
x-ms-version: 2009-09-19
cf-ray: 822710738ef265ab-FRA

GET
H2 200 AW_LOGO-sm.png
marvel-b1-cdn.bc0a.com/f00000000241276/cdn.cookielaw.org/logos/1a8208da-88f2-4102-bad8-e9cf7a89fe0a/9150a14e-93e2-498c-8817-005365b2b599/9f8c16e2-6b59-4db4-9486-30a9363b3cd5/ 26 KB
27 KB 70ms
67ms Image
image/webp 2600:9000:2250:b000:0:f267:a5c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://marvel-b1-cdn.bc0a.com/f00000000241276/cdn.cookielaw.org/logos/1a8208da-88f2-4102-bad8-e9cf7a89fe0a/9150a14e-93e2-498c-8817-005365b2b599/9f8c16e2-6b59-4db4-9486-30a9363b3cd5/AW_LOGO-sm.png
Requested by: Host: arcticwolf.com
URL: https://arcticwolf.com/resources/blog/tellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2250:b000:0:f267:a5c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 6e27fdad460fa326d0d3e8f311c5c22e6b28a34a93c58220d93f98357f08c058

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://arcticwolf.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

x-amz-version-id: YVHieAcyfqi7TXRYRI0563bJbNUk33zN
date: Tue, 07 Nov 2023 05:14:42 GMT
via: 1.1 0121ceb2efadb6db52d122a8b6b52f90.cloudfront.net (CloudFront)
x-amz-request-id: PN3E5Y0SZCQH343N
x-amz-cf-pop: FRA60-P2
x-amz-server-side-encryption: AES256
age: 41630
x-cache: Hit from cloudfront
content-length: 26902
x-amz-id-2: 6bRWZQ/vZc9DS0NwETPKUwKOGewXt2QeZSeZBAP7NN0zT95IZk8Wup6YsM3Tuh/giJIAJdKGdg0=
x-amz-expiration: expiry-date="Fri, 04 Jul 2025 00:00:00 GMT", rule-id="delete-old-images"
last-modified: Fri, 07 Oct 2022 22:40:53 GMT
server: AmazonS3
etag: "f15e30857e6cd2d20b235a20344db1a1"
content-type: image/webp
access-control-allow-origin: *
cache-control: max-age=31536000
accept-ranges: bytes
x-amz-cf-id: 7xMdRH2gI2Qlc4Nq0CH43CB5207w2c1jU4wUNx3puWliL2igk_7AwQ==

GET
H2 200 9decd3b0fe5c0841dd43a5375baa5a71.js Show response
ob.robotflowermobile.com/i/ 100 KB
37 KB 147ms
39ms Script
text/javascript 2600:9000:2057:f800:1c:f10a:ad80:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ob.robotflowermobile.com/i/9decd3b0fe5c0841dd43a5375baa5a71.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-PMV4652
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2057:f800:1c:f10a:ad80:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: Caddy /
Resource Hash: 9b6b1e260630ae98e454c1b77daffdb3e5dfd3af1693290a9a13f2a6217bf4cd

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://arcticwolf.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 11:20:35 GMT
content-encoding: gzip
via: 1.1 49140b838a62cd29e30f20e39a82dad0.cloudfront.net (CloudFront)
server: Caddy
x-amz-cf-pop: FRA6-C1
age: 19878
etag: "18e69-nH4ktESQmB+ZHA25VrbhVTBmpBs"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: text/javascript; charset=utf-8
cache-control: max-age=43200
content-length: 37258
x-amz-cf-id: W4clxm-I9dGnDtaP7V1pshLv4vgbggSv_6uhc3ns4HcAnuW09l96kQ==
expires: Tue, 07 Nov 2023 23:17:13 GMT

GET
H2 200 XDFrame Show response
cybersecurity.arcticwolf.com/index.php/form/ Frame F557 2 KB
906 B 225ms
225ms Document
text/html 104.17.74.206
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cybersecurity.arcticwolf.com/index.php/form/XDFrame

Requested by

Host: cybersecurity.arcticwolf.com
URL: https://cybersecurity.arcticwolf.com/js/forms2/js/forms2.min.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

104.17.74.206 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c375e284cb478a8f21e391c99fb79c9174682d0c21e13a3ed69aa0afa6fa073b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://arcticwolf.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: max-age=3600
cf-cache-status: DYNAMIC
cf-ray: 822710747a8c1994-FRA
content-encoding: gzip
content-type: text/html; charset=utf-8
date: Tue, 07 Nov 2023 16:48:31 GMT
server: cloudflare
vary: Accept-Encoding
x-content-type-options: nosniff

GET
H2 200 share-buttons.81497e7fccd4fa77b6b9.bundle.min.js Show response
arcticwolf.com/wp-content/plugins/elementor-pro/assets/js/ 2 KB
1 KB 313ms
313ms Script
application/javascript 13.224.189.102
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://arcticwolf.com/wp-content/plugins/elementor-pro/assets/js/share-buttons.81497e7fccd4fa77b6b9.bundle.min.js

Requested by

Host: arcticwolf.com
URL: https://arcticwolf.com/wp-content/plugins/elementor-pro/assets/js/webpack-pro.runtime.min.js?ver=3.17.1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.189.102 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-224-189-102.fra2.r.cloudfront.net

Software

AmazonS3 /

Resource Hash

4fab723e3b03f2720de214570b06da183b1591c142d72588252cd924bbc5bca0

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://arcticwolf.com/resources/blog/tellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 16:48:32 GMT
x-amz-version-id: krGJGRI6qOi8vac8jPz5Lu8kF0YgFTUZ
x-content-type-options: nosniff
strict-transport-security: max-age=63072000; includeSubdomains; preload
content-encoding: gzip
x-amz-cf-pop: FRA60-P3, FRA2-C1
via: 1.1 0a71d283a25c1e3f082b4dbc9d844dfe.cloudfront.net (CloudFront), 1.1 3bf3e75bcb9a86b3eb343a1d4392a6de.cloudfront.net (CloudFront)
x-cache: Miss from cloudfront
last-modified: Fri, 03 Nov 2023 00:58:51 GMT
server: AmazonS3
etag: W/"a55c93797361b53df51deacc840b34ab"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=31536000
x-amz-cf-id: QxWZsB1PkRAySBSNtiW_v8YMCxBIHQVellyJ6eH8OTdkwtdCAbF1lQ==

GET
H2 200 60745ddf42fde6647dbc.bundle.min.js Show response
arcticwolf.com/wp-content/plugins/elementor-pro/assets/js/ 21 KB
9 KB 218ms
217ms Script
application/javascript 13.224.189.102
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://arcticwolf.com/wp-content/plugins/elementor-pro/assets/js/60745ddf42fde6647dbc.bundle.min.js

Requested by

Host: arcticwolf.com
URL: https://arcticwolf.com/wp-content/plugins/elementor-pro/assets/js/webpack-pro.runtime.min.js?ver=3.17.1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.189.102 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-224-189-102.fra2.r.cloudfront.net

Software

AmazonS3 /

Resource Hash

7046172ae59943e9a78dee86bb214d3d892dc01a8ee4b0fcd2fdb1c20a8612b2

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://arcticwolf.com/resources/blog/tellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 16:48:32 GMT
x-amz-version-id: ok5N1dZg9gSJQTYSMnf7YAebk6p76kC9
x-content-type-options: nosniff
strict-transport-security: max-age=63072000; includeSubdomains; preload
content-encoding: gzip
x-amz-cf-pop: FRA60-P3, FRA2-C1
via: 1.1 6ae82cc0c8a39c993134c2be90b4d120.cloudfront.net (CloudFront), 1.1 3bf3e75bcb9a86b3eb343a1d4392a6de.cloudfront.net (CloudFront)
x-cache: Miss from cloudfront
last-modified: Fri, 03 Nov 2023 00:58:45 GMT
server: AmazonS3
etag: W/"3da3892aa6a68bc4726dda20af8b2824"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=31536000
x-amz-cf-id: 8zw6IjfSUchzG-jib0zHcDXnCPATuvHhplopeLWJ7hIsviMc73PflA==

GET
H2 200 table-of-contents.e42afd7d58cf06ab7a63.bundle.min.js Show response
arcticwolf.com/wp-content/plugins/elementor-pro/assets/js/ 8 KB
3 KB 273ms
273ms Script
application/javascript 13.224.189.102
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://arcticwolf.com/wp-content/plugins/elementor-pro/assets/js/table-of-contents.e42afd7d58cf06ab7a63.bundle.min.js

Requested by

Host: arcticwolf.com
URL: https://arcticwolf.com/wp-content/plugins/elementor-pro/assets/js/webpack-pro.runtime.min.js?ver=3.17.1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.189.102 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-224-189-102.fra2.r.cloudfront.net

Software

AmazonS3 /

Resource Hash

021f984ada81db0d517746f9748ffabbfa799e3a5d2958e07ea9139dce030c41

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://arcticwolf.com/resources/blog/tellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 16:48:32 GMT
x-amz-version-id: k1C3hzcqXsSjb2cZxcA065V5ViDd4YxA
x-content-type-options: nosniff
strict-transport-security: max-age=63072000; includeSubdomains; preload
content-encoding: gzip
x-amz-cf-pop: FRA60-P3, FRA2-C1
via: 1.1 a54cda8ccda3480314f451558e4dd062.cloudfront.net (CloudFront), 1.1 3bf3e75bcb9a86b3eb343a1d4392a6de.cloudfront.net (CloudFront)
x-cache: Miss from cloudfront
last-modified: Fri, 03 Nov 2023 00:58:38 GMT
server: AmazonS3
etag: W/"385a98414127ac0caad928f6d43f6dbe"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=31536000
x-amz-cf-id: rFemnO-RFEiMgp1bavNgN0bWCV2l1OG9tMIzTRohcVlvLQLO2m0xOQ==

GET
H2 200 load-more.064e7e640e7ef9c3fc30.bundle.min.js Show response
arcticwolf.com/wp-content/plugins/elementor-pro/assets/js/ 5 KB
2 KB 296ms
295ms Script
application/javascript 13.224.189.102
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://arcticwolf.com/wp-content/plugins/elementor-pro/assets/js/load-more.064e7e640e7ef9c3fc30.bundle.min.js

Requested by

Host: arcticwolf.com
URL: https://arcticwolf.com/wp-content/plugins/elementor-pro/assets/js/webpack-pro.runtime.min.js?ver=3.17.1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.189.102 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-224-189-102.fra2.r.cloudfront.net

Software

AmazonS3 /

Resource Hash

fd44e0aa8a3a221018e8d2e8a05adadc50a642b86c621a8223b26c7fda681162

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://arcticwolf.com/resources/blog/tellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 16:48:32 GMT
x-amz-version-id: JFT7jI_R.nh8TN54_UbYq69mK6W4hbKm
x-content-type-options: nosniff
strict-transport-security: max-age=63072000; includeSubdomains; preload
content-encoding: gzip
x-amz-cf-pop: FRA60-P3, FRA2-C1
via: 1.1 7fd88bab22735486702d23ba4e028d86.cloudfront.net (CloudFront), 1.1 3bf3e75bcb9a86b3eb343a1d4392a6de.cloudfront.net (CloudFront)
x-cache: Miss from cloudfront
last-modified: Fri, 03 Nov 2023 00:58:43 GMT
server: AmazonS3
etag: W/"5eeeef86cde4eae22c1af48b1418075c"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=31536000
x-amz-cf-id: I6Dq1LVQnWCMvtLYFE3bso4cX-ZMx5z-V-ehs38JP0zza2Uhnzj1_w==

GET
H2 200 posts.e33113a212454e383747.bundle.min.js Show response
arcticwolf.com/wp-content/plugins/elementor-pro/assets/js/ 3 KB
2 KB 280ms
279ms Script
application/javascript 13.224.189.102
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://arcticwolf.com/wp-content/plugins/elementor-pro/assets/js/posts.e33113a212454e383747.bundle.min.js

Requested by

Host: arcticwolf.com
URL: https://arcticwolf.com/wp-content/plugins/elementor-pro/assets/js/webpack-pro.runtime.min.js?ver=3.17.1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.189.102 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-224-189-102.fra2.r.cloudfront.net

Software

AmazonS3 /

Resource Hash

98e8251688b86ed104b49c547b53408315fa196773ba220faf4f2945010eeedc

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://arcticwolf.com/resources/blog/tellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 16:48:32 GMT
x-amz-version-id: RkhZdeHLP1Bjt.._TlWXwPzTV1fn1gUs
x-content-type-options: nosniff
strict-transport-security: max-age=63072000; includeSubdomains; preload
content-encoding: gzip
x-amz-cf-pop: FRA60-P3, FRA2-C1
via: 1.1 7fd88bab22735486702d23ba4e028d86.cloudfront.net (CloudFront), 1.1 3bf3e75bcb9a86b3eb343a1d4392a6de.cloudfront.net (CloudFront)
x-cache: Miss from cloudfront
last-modified: Fri, 03 Nov 2023 00:58:42 GMT
server: AmazonS3
etag: W/"19744f4fb95d9f5210d5a74673405d52"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=31536000
x-amz-cf-id: LVwQq8-1tJ4sr9RiPyx-Ju-sUrUamGTJGKkV_HV628jlDF5Ed3mBag==

POST
H2 200 collect Show response
www.google-analytics.com/j/ 4 B
208 B 46ms
46ms XHR
text/plain 2001:4860:4802:34::178
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j101&a=1996549396&t=pageview&_s=1&dl=https%3A%2F%2Farcticwolf.com%2Fresources%2Fblog%2Ftellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware%2F&ul=en-us&de=UTF-8&dt=Exploitation%20of%20CVE-2023-46604%20Leading%20to%20Ransomware&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YGBACEABBAAAACAAI~&jid=756751560&gjid=1305253423&cid=1233921805.1699375711&tid=UA-67837305-1&_gid=873750876.1699375711&_r=1&_slc=1&gtm=45He3b60n81PMV4652v78485517&gcd=11l1l1l1l1&z=1824956260

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2001:4860:4802:34::178 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

aec60bc104db041b1512185839f18f52986df7e569e5445f740dd60f763fbca8

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://arcticwolf.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Tue, 07 Nov 2023 16:48:31 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://arcticwolf.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

collect
px4.ads.linkedin.com/
Redirect Chain

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=50605&time=1699375711485&url=https%3A%2F%2Farcticwolf.com%2Fresources%2Fblog%2Ftellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware%2F
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=50605&time=1699375711485&url=https%3A%2F%2Farcticwolf.com%2Fresources%2Fblog%2Ftellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware...
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D50605%26time%3D1699375711485%26url%3Dhttps%253A%252F%252Farcticwolf.com%252Fresou...
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=50605&time=1699375711485&url=https%3A%2F%2Farcticwolf.com%2Fresources%2Fblog%2Ftellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware...
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=50605&time=1699375711485&url=https%3A%2F%2Farcticwolf.com%2Fresources%2Fblog%2Ftellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomwar...

0
264 B

272ms
181ms

Image
application/javascript

13.107.42.14
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=50605&time=1699375711485&url=https%3A%2F%2Farcticwolf.com%2Fresources%2Fblog%2Ftellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware%2F&cookiesTest=true&liSync=true&e_ipv6=AQLD2H3cEUH-qgAAAYuqr4f6Ei0Pm4-awuohQ63Hy-qPNEPvgI2kk1n-0201ONW07HKGAuA
Requested by: Host: arcticwolf.com
URL: https://arcticwolf.com/resources/blog/tellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware/
Protocol: H2
Server: 13.107.42.14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://arcticwolf.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 16:48:32 GMT
x-li-pop: afd-prod-ltx1-x
x-msedge-ref: Ref A: 63967AB675FC4B48AA16D816D80E97CD Ref B: FRAEDGE1516 Ref C: 2023-11-07T16:48:32Z
linkedin-action: 1
x-cache: CONFIG_NOCACHE
content-type: application/javascript
x-li-fabric: prod-ltx1
x-li-proto: http/2
content-length: 0
x-li-uuid: AAYJkr2vlpHnRE1m6Fr/3Q==

Redirect headers

date: Tue, 07 Nov 2023 16:48:32 GMT
x-li-pop: afd-prod-ltx1-x
x-msedge-ref: Ref A: CD6A85E8ED7548DB8A4335EFF7351456 Ref B: DUS30EDGE0918 Ref C: 2023-11-07T16:48:32Z
linkedin-action: 1
x-cache: CONFIG_NOCACHE
x-li-fabric: prod-ltx1
location: https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=50605&time=1699375711485&url=https%3A%2F%2Farcticwolf.com%2Fresources%2Fblog%2Ftellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware%2F&cookiesTest=true&liSync=true&e_ipv6=AQLD2H3cEUH-qgAAAYuqr4f6Ei0Pm4-awuohQ63Hy-qPNEPvgI2kk1n-0201ONW07HKGAuA
x-li-proto: http/2
content-length: 0
x-li-uuid: AAYJkr2q5YO+hpGm/zRnjg==

GET
H2 200 26066703 Show response
www.clarity.ms/tag/uet/ 828 B
1 KB 244ms
132ms Script
application/x-javascript 2620:1ec:bdf::45
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.clarity.ms/tag/uet/26066703
Requested by: Host: bat.bing.com
URL: https://bat.bing.com/p/action/26066703.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:bdf::45 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: 1ff9ef000c51805861082a92c963fe080d3353cc35b1bfe3c3e83304e691284d

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://arcticwolf.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

expires: -1
date: Tue, 07 Nov 2023 16:48:31 GMT
x-azure-ref: 20231107T164831Z-k8xwycsk1d1hfas6p789mkxhu4000000014g000000001udq
x-cache: CONFIG_NOCACHE
content-type: application/x-javascript
cache-control: no-cache, no-store
accept-ranges: bytes
content-length: 828
request-context: appId=cid-v1:593e4080-f032-4d00-a652-e17f01252a9d

GET
H2 200 gif.gif Show response
ibc-flow.techtarget.com/a/ 43 B
455 B 153ms
152ms XHR
image/gif 34.111.208.231
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://ibc-flow.techtarget.com/a/gif.gif?actTypeId=31&cid=2977641&r=1699375711494&ref=https%3A%2F%2Farcticwolf.com%2Fresources%2Fblog%2Ftellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware%2F&version=2.4
Requested by: Host: trk.techtarget.com
URL: https://trk.techtarget.com/tracking.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.111.208.231 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 231.208.111.34.bc.googleusercontent.com
Software: nginx/1.20.2 /
Resource Hash: 2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Request headers

ibc_rate_tier: 2977641
Referer: https://arcticwolf.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 16:48:31 GMT
via: 1.1 google
x-guploader-uploadid: ABPtcPqO2Wi9tNoesmx-Rqpbdt0GeqB1AUpYNJctgPS2XEAIekpZctVYBBjYG6xUC7yBcwkpvBj92N6Leg
x-goog-storage-class: STANDARD
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
last-modified: Thu, 08 Dec 2022 21:19:29 GMT
server: nginx/1.20.2
etag: "fc94fb0c3ed8a8f909dbc7630a0987ff"
vary: Origin
x-goog-generation: 1670534369365034
content-type: image/gif
access-control-allow-origin: *
x-goog-hash: crc32c=7uenZA==, md5=/JT7DD7YqPkJ28djCgmH/w==
cache-control: public, max-age=3600
access-control-allow-methods: GET, POST, OPTIONS
x-goog-stored-content-length: 43
accept-ranges: bytes
access-control-allow-headers: ibc_header,ibc_rate_tier,User-Agent,X-Requested-With,Cache-Control,Content-Type,Range
expires: Tue, 07 Nov 2023 17:48:31 GMT

OPTIONS
H2 200 gif.gif
ibc-flow.techtarget.com/a/ Frame 0
0 231ms
139ms Preflight
text/html 34.111.208.231
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://ibc-flow.techtarget.com/a/gif.gif?actTypeId=31&cid=2977641&r=1699375711494&ref=https%3A%2F%2Farcticwolf.com%2Fresources%2Fblog%2Ftellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware%2F&version=2.4
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.111.208.231 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 231.208.111.34.bc.googleusercontent.com
Software: nginx/1.20.2 /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: ibc_rate_tier
Access-Control-Request-Method: GET
Origin: https://arcticwolf.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

access-control-allow-headers: ibc_header,ibc_rate_tier,User-Agent,X-Requested-With,Cache-Control,Content-Type,Range
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=0
content-length: 0
content-type: text/html; charset=UTF-8
date: Tue, 07 Nov 2023 16:48:31 GMT
expires: Tue, 07 Nov 2023 16:48:31 GMT
server: nginx/1.20.2
vary: Origin
via: 1.1 google
x-guploader-uploadid: ABPtcPpXM5P1t9zZfLFRMM43_t8t9oRuiKtFrtaDzG8xSORrj67MONwPQ3ec5PZ5JxdMhDWJPJE

POST
H/1.1 200
OK visitWebPage
840-osq-661.mktoresp.com/webevents/ 2 B
318 B 1121ms
195ms Ping
text/plain 192.28.147.68
OMNITURE

General

Check archive.org

Show headers Download Go to

Full URL: https://840-osq-661.mktoresp.com/webevents/visitWebPage?_mchNc=1699375711511&_mchCn=&_mchId=840-OSQ-661&_mchTk=_mch-arcticwolf.com-1699375711510-98937&_mchHo=arcticwolf.com&_mchPo=&_mchRu=%2Fresources%2Fblog%2Ftellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware%2F&_mchPc=https%3A&_mchVr=163&_mchEcid=&_mchHa=&_mchRe=&_mchQp=
Requested by: Host: munchkin.marketo.net
URL: https://munchkin.marketo.net/163/munchkin.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 192.28.147.68 , United States, ASN15224 (OMNITURE, US),
Reverse DNS
Software: nginx/1.20.1 /
Resource Hash: 565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://arcticwolf.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

Date: Tue, 07 Nov 2023 16:48:32 GMT
Content-Encoding: gzip
Server: nginx/1.20.1
Transfer-Encoding: chunked
Content-Type: text/plain; charset=UTF-8
Access-Control-Allow-Origin: *
Connection: keep-alive
X-Request-Id: 5ce95f3b-257d-4a7d-ac41-9cf3a8c91d7e

POST
H2 200 pdst-events-prod-sink Show response
us-central1-adaptive-growth.cloudfunctions.net/ 2 B
123 B 202ms
201ms Fetch
text/html 2001:4860:4802:36::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://us-central1-adaptive-growth.cloudfunctions.net/pdst-events-prod-sink
Requested by: Host: cdn.pdst.fm
URL: https://cdn.pdst.fm/ping.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:36::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Google Frontend /
Resource Hash: 565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3

Request headers

Accept: application/json
Referer: https://arcticwolf.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36
Content-Type: application/json

Response headers

date: Tue, 07 Nov 2023 16:48:31 GMT
content-encoding: gzip
server: Google Frontend
access-control-allow-methods: GET, POST
content-type: text/html; charset=utf-8
access-control-allow-origin: *
x-cloud-trace-context: 084d51cb8242491c39d8e6b3dd04224d
cache-control: private
function-execution-id: ka5dynjy39ys
access-control-allow-headers: Content-Type, Accept
content-length: 22
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

OPTIONS
H2 200 pdst-events-prod-sink
us-central1-adaptive-growth.cloudfunctions.net/ Frame 0
0 337ms
217ms Preflight
text/html 2001:4860:4802:36::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://us-central1-adaptive-growth.cloudfunctions.net/pdst-events-prod-sink
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:36::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Google Frontend /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://arcticwolf.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

access-control-allow-headers: Content-Type, Accept
access-control-allow-methods: GET, POST
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: gzip
content-length: 22
content-type: text/html; charset=utf-8
date: Tue, 07 Nov 2023 16:48:31 GMT
function-execution-id: fs1vsjb36o1t
server: Google Frontend
x-cloud-trace-context: 656b6fdabaf1b18e7961b5f000a40730

GET
H2 200 /
www.facebook.com/tr/ 0
185 B 120ms
39ms Image
text/plain 2a03:2880:f176:84:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=480386592743035&ev=PageView&dl=https%3A%2F%2Farcticwolf.com%2Fresources%2Fblog%2Ftellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware%2F&rl=&if=false&ts=1699375711522&sw=1600&sh=1200&v=2.9.138&r=stable&ec=0&o=4126&fbp=fb.1.1699375711520.2070567645&ler=empty&it=1699375711063&coo=false&rqm=GET

Requested by

Host: arcticwolf.com
URL: https://arcticwolf.com/resources/blog/tellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f176:84:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://arcticwolf.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
date: Tue, 07 Nov 2023 16:48:31 GMT
server: proxygen-bolt
content-type: text/plain
access-control-allow-origin
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 0

POST
H2 200 collect Show response
stats.g.doubleclick.net/j/ 4 B
348 B 144ms
48ms XHR
text/plain 2a00:1450:400c:c04::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j101&tid=UA-67837305-1&cid=1233921805.1699375711&jid=756751560&gjid=1305253423&_gid=873750876.1699375711&_u=YGBACEAABAAAACAAI~&z=1372229474

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400c:c04::9b Brussels, Belgium, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://arcticwolf.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
date: Tue, 07 Nov 2023 16:48:31 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://arcticwolf.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ct Show response
obs.robotflowermobile.com/ 5 KB
2 KB 400ms
136ms Script
text/javascript 2600:1f18:e8a:cd00:e7aa:3ac6:9899:87c4
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://obs.robotflowermobile.com/ct?id=13034&url=https%3A%2F%2Farcticwolf.com%2Fresources%2Fblog%2Ftellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware%2F&sf=0&tpi=&ch=cheq4ppc&uvid=&tsf=0&tsfmi=&tsfu=&cb=1699375711715&hl=2&op=0&ag=4093713186&rand=249171928051176107912857150199551450104825102854225071901190039162052120991115205125&fs=1600x1200&fst=1600x1200&np=win32&nv=google%20inc.&ref=&ss=1600x1200&nc=0&at=&di=W1siZWYiLDkyNTldLFsxMiwie1wiY3R4XCI6XCJ3ZWJnbFwiLFwidlwiOlwiaW50ZWwgaW5jLlwiLFwiclwiOlwiaW50ZWwgaXJpcyBvcGVuZ2wgZW5naW5lXCIsXCJzbHZcIjpcIndlYmdsIGdsc2wgZXMgMS4wIChvcGVuZ2wgZXMgZ2xzbCBlcyAxLjAgY2hyb21pdW0pXCIsXCJndmVyXCI6XCJ3ZWJnbCAxLjAgKG9wZW5nbCBlcyAyLjAgY2hyb21pdW0pXCIsXCJndmVuXCI6XCJ3ZWJraXRcIixcImJlblwiOjUsXCJ3Z2xcIjoxLFwiZ3JlblwiOlwid2Via2l0IHdlYmdsXCIsXCJzZWZcIjozNjk4NTE4NzEwLFwic2VjXCI6XCJcIn0iXSxbMzcsIlszMzE2MjI0MDQ5LGZ1bmN0aW9uKG5ld1ZhbHVlKSB7XG4gICAgICAgICAgICAgIGFkZENvbnRlbnRXaW5kb3dQcm94eSh0aGlzKVxuICAgICAgICAgICAgICAvLyBSZXNldCBwcm9wZXJ0eSwgdGhlIGhvb2sgaXMgb25seSBuZWVkZWQgb25jZVxuICAgICAgICAgICAgICBPYmplY3QuZGVmaW5lUHJvcGVydHkoaWZyYW1lLCAnc3JjZG9jJywge1xuICAgICAgICAgICAgICAgIGNvbmZpZ3VyYWJsZTogZmFsc2UsXG4gICAgICAgICAgICAgICAgd3JpdGFibGU6IGZhbHNlLFxuICAgICAgICAgICAgICAgIHZhbHVlOiBfc3JjZG9jXG4gICAgICAgICAgICAgIH0pXG4gICAgICAgICAgICAgIF9pZnJhbWUuc3JjZG9jID0gbmV3VmFsdWVcbiAgICAgICAgICAgIH1dIl0sWyJjYiIsIjAsMCwwLDAsMCwwLDAsMSwwLDIsMCwwLDcsMCwwLDAsMCwwLDAsMCwwLDAsMCwwLDAsMCwwLDAsMTQsMSwwLDAsMCwwLDAsMCwwLDAsMCwwLDAsMCwwLDAsMCwwLDEsMCwwLDAsMCwwLDQsMCwwLDAsMCwwLDAsMSwwLDAsMCwwLDAsMCwwLDAsMCwwLDAsMCwxLDAsNywwLDEsMCwwLDAsMCwwLDIsMCJdLFstMSwiLSJdLFstMiwiNyxlY1hHWDE5bm5ydlZPMkpkbE5oeEJLUWtMdlNGZEFRQkNsaDE0VlVWRkFsRjcrQ0FJcVhSQkZDRTE2Rllrb1ZVcEFXaEFTSUQya1o1TnRVKzY5Yi8xKzU4N2N6V1JKQVBsR2w5Il0sWy0zLCJbXCJpbnRlcm5hbC1wZGYtdmlld2VyXCIsXCJtaGpmYm1kZ2NmamJicGFlb2pvZm9ob2VmZ2llaGphaVwiLFwiaW50ZXJuYWwtbmFjbC1wbHVnaW5cIl0iXSxbLTQsIi0iXSxbLTUsIi0iXSxbLTYsIi0iXSxbLTcsIi0iXSxbLTgsIi0iXSxbLTksIisiXSxbLTEwLCItIl0sWy0xMSwie1widFwiOlwiXCIsXCJtXCI6W1wiZGVzY3JpcHRpb25cIixcIm9nOnRpdGxlXCIsXCJvZzpkZXNjcmlwdGlvblwiXX0iXSxbLTEyLCJudWxsIl0sWy0xMywiLSJdLFstMTQsIi0iXSxbLTE1LCItIl0sWy0xNiwiMCJdLFstMTcsIjQiXSxbLTE4LCJbMCwwLDAsMV0iXSxbLTE5LCJbMCwwLDAsMCwwLDAsMSwyNCwyNCxcIi1cIiwxNjAwLDEyMDAsMTYwMCwxMjAwLDE2MDAsMTIwMCwxNjAwLDEyMDAsMCwwLDAsMCxcIi1cIixcIi1cIiwxNjAwLDEyMDBdIl0sWy0yMCwiMTIzMzkyMTgwNS4xNjk5Mzc1NzExIl0sWy0yMSwiLSJdLFstMjIsIltcIm5cIixcIm5cIl0iXSxbLTIzLCIrIl0sWy0yNCwiW1wic2F5c3dob1wiLDAsMSwxLDFdIl0sWy0yNSwiLSJdLFstMjYsIntcInRqaHNcIjozNTEwMDAwMCxcInVqaHNcIjoyOTQwMDAwMCxcImpoc2xcIjozNzYwMDAwMDAwfSJdLFstMjcsIlswLDEwLDAsXCI0Z1wiLG51bGxdIl0sWy0yOCwiZW4tVVMsZW4iXSxbLTI5LCItIl0sWy0zMCwiW1widlwiLDBdIl0sWy0zMSwiZmFsc2UiXSxbLTMyLCItIl0sWy0zMywiLSJdLFstMzQsIi0iXSxbLTM1LCJbMTY5OTM3NTcxMTY1NiwtMV0iXSxbLTM2LCJbXCI0LzNcIixcIjQvM1wiXSJdLFstMzcsIi0xNDQtNjYtMTgwLSJdLFstMzgsImksLTEsLTEsMCwwLDM5LDAsMCw4OSwxMDgsLTEsMCwxNjY4LjMsMTY2OC4zLDMzNDEsMzM0MSJdLFstMzksIltcIjIwMDMwMTA3XCIsNCxcIkdlY2tvXCIsXCJOZXRzY2FwZVwiLFwiTW96aWxsYVwiLG51bGwsbnVsbCx0cnVlLDgsZmFsc2UsbnVsbCwzLGZhbHNlLHRydWUsbnVsbCwwLHRydWUsdHJ1ZV0iXSxbLTQwLCIzMyJdLFstNDEsIi0iXSxbLTQyLCIxNzI0Mjk3NjUzIl0sWy00MywiMDAwMDAwMDEwMTAwMDAwMTAwMTExMDExMDAxMDExMDEwMDAwMDEiXSxbLTQ0LCIwLDAsMCw1Il0sWy00NSwiNjIwLDY3NywwLDAsMCw1NjIsMCwwLDY0OCwwLDAsMCwwLDAsMCwwLDAsMCwwLDY4NCwwLDAsMCwwLDAsMCwwLDAsMCwwLDAsMCJdLFstNDYsIjAiXSxbLTQ3LCJFdXJvcGUvQmVybGluLGVuLVVTLGxhdG4sZ3JlZ29yeSJdLFstNDgsIjAsMCJdLFstNDksIi0iXSxbLTUwLCItIl0sWy01MSwiLSJdLFstNTIsIi0iXSxbLTUzLCIxMDAiXSxbLTU0LCJ7XCJoXCI6W1wiXzNcIixcIjMyOTk5MTM2OVwiLFwiXzFcIixcIjQxODgwNTUwNzFcIl0sXCJkXCI6W10sXCJiXCI6W1wiMjc3MjE0MzM2OFwiLFwiMjk1NjI5MzI5N1wiXSxcInNcIjoxfSJdLFstNTUsIjEiXSxbLTU2LCJsYW5kc2NhcGUtcHJpbWFyeSJdLFstNTcsIldFMFpWMXhPY1ZoWFhWVmNTeGNGV2xaVVNVeE5YRjBIR1dKWVNobFlTVWxWUUdRWkVWeFBXRlVaV0UwWkJWaFhWbGRBVkZaTVNnY1pFUU1PQXdnTUNRNElBUkFWR1FWWVYxWlhRRlJXVEVvSEF3Z0JBd29KRUJWWVRSbDRTMHRZUUJkY1hCa1JVVTFOU1VvREZoWldXeGRMVmx0V1RWOVZWazVjUzFSV1cxQlZYQmRhVmxRV1VCWUFYVnhhWFFwYkNWOWNERm9KQVEwSVhWME5DbGdNQ2c0TVcxaFlERmdPQ0JkVFNnTUlBdzhQQ1FFUEVCVllUUmxORjF4QlNWWkxUVW9aRVZGTlRVbEtBeFlXVmxzWFMxWmJWazFmVlZaT1hFdFVWbHRRVlZ3WFdsWlVGbEFXQUYxY1dsMEtXd2xmWEF4YUNRRU5DRjFkRFFwWURBb09EQT09Il0sWy01OCwiLSJdLFstNTksImRlZmF1bHQiXSxbLTYwLDE2NV0sWy02MSwie1wid2dzbFwiOlwiMDtcIixcInBjZlwiOlwiYmdyYTh1bm9ybVwifSJdLFstNjIsIjgwIl0sWy02MywiMCJdLFstNjQsIlswLFwiXCIsW11dIl0sWy02NSwiLSJdLFstNjYsImdlb2xvY2F0aW9uLHN0b3JhZ2VhY2Nlc3MsZ2FtZXBhZCxjaGVjdCxtaWRpLGRpc3BsYXljYXB0dXJlLHVzYixsb2NhbGZvbnRzLHBpY3R1cmVpbnBpY3R1cmUscHVibGlja2V5Y3JlZGVudGlhbHNnZXQsb3RwY3JlZGVudGlhbHMsY2h1YWZvcm1mYWN0b3IsZW5jcnlwdGVkbWVkaWEsY2hzYXZlZGF0YSxjaHVhZnVsbHZlcnNpb25saXN0LGNodWF3b3c2NCxjaGRvd25saW5rLGNocHJlZmVyc2NvbG9yc2NoZW1lLHN5bmN4aHIsY2h1YW1vZGVsLGNocHJlZmVyc3JlZHVjZWR0cmFuc3BhcmVuY3ksc2VyaWFsLGNhbWVyYSxjaHByZWZlcnNyZWR1Y2VkbW90aW9uLHByaXZhdGVzdGF0ZXRva2VuaXNzdWFuY2UsaWRlbnRpdHljcmVkZW50aWFsc2dldCxjaHVhZnVsbHZlcnNpb24sZnVsbHNjcmVlbixjaGRwcix1bmxvYWQsa2V5Ym9hcmRtYXAsY2h1YXBsYXRmb3JtLGd5cm9zY29wZSxjaHVhbW9iaWxlLHdpbmRvd21hbmFnZW1lbnQsY2h1YSxtYWduZXRvbWV0ZXIsYWNjZWxlcm9tZXRlcixwcml2YXRlc3RhdGV0b2tlbnJlZGVtcHRpb24sY2h1YWFyY2gseHJzcGF0aWFsdHJhY2tpbmcsaWRsZWRldGVjdGlvbixjaHVhcGxhdGZvcm12ZXJzaW9uLGNod2lkdGgsY2xpcGJvYXJkcmVhZCxjaHZpZXdwb3J0d2lkdGgscGF5bWVudCxjaHZpZXdwb3J0aGVpZ2h0LGNocnR0LGF1dG9wbGF5LGNyb3Nzb3JpZ2luaXNvbGF0ZWQsaGlkLGNodWFiaXRuZXNzLHNjcmVlbndha2Vsb2NrLGNsaXBib2FyZHdyaXRlLGNoZGV2aWNlbWVtb3J5LG1pY3JvcGhvbmUiXSxbLTY3LCIyNTMyMzEyODg4OjIyIl0sWyJkZGIiLCIwLDcsMCwwLDEsMCwwLDAsMCwwLDAsMCwwLDAsMiwwLDAsMCwxLDAsMCwwLDAsMCwwLDAsMCwwLDAsMCwwLDAsMCwwLDAsMSwxLDAsMCwwLDAsMSwwLDIsNywwLDE0LDAsMSwwLDAsMCwwLDEsMCwwLDAsMCwxLDcsMCwwLDAsMCwwLDAsMjIiXSxbImJuY2giLDExMV0sWyJhYm5jaCIsMTEyXV0%3D&dep=0&pre=0&sdd=%7B%7D&cri=KcJJzHHQ4C&pto=3401&ver=57&gac=1233921805.1699375711&mei=&ap=&fe=1&duid=1.1699375711.FLYuqZGsA7fQ9BFY&suid=1.1699375711.qi4lJuWAHSI6tkOH&tuid=1.1699375711.U8eAnp6xsPzZDPtO&fbc=1.1699375711520.2070567645&gtm=WyJPbmVUcnVzdExvYWRlZCIsIk9wdGFub25Mb2FkZWQiLCJPbmVUcnVzdEdyb3Vwc1VwZGF0ZWQiXQ%3D%3D&it=128%2C3023%2C185&fbcl=-&gacl=&gacsd=-&rtic=-&bgc=7ba4f6107d8d11eea52c45b12b36f397&spa=1&urid=0&ab=
Requested by: Host: ob.robotflowermobile.com
URL: https://ob.robotflowermobile.com/i/9decd3b0fe5c0841dd43a5375baa5a71.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2600:1f18:e8a:cd00:e7aa:3ac6:9899:87c4 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: /
Resource Hash: 7f0ab178ba7c6104c1b971d3f81b55be373e2dce84e81b6d1ed017ee977d925b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://arcticwolf.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

content-type: text/javascript
pragma: no-cache
date: Tue, 07 Nov 2023 16:48:32 GMT
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
content-length: 2092
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 image.aspx
6145655.global.siteimproveanalytics.io/ 34 B
479 B 164ms
40ms Image
image/gif 52.57.208.64
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://6145655.global.siteimproveanalytics.io/image.aspx?url=https%3A%2F%2Farcticwolf.com%2Fresources%2Fblog%2Ftellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware%2F&title=Exploitation%20of%20CVE-2023-46604%20Leading%20to%20Ransomware&res=1600x1200&accountid=6145655&rt=3419&prev=77977b30-6456-666e-fa26-d108152fcf07&luid=7c2540e7-208d-f2fa-af7d-9e1ab0889481&rnd=43214
Requested by: Host: arcticwolf.com
URL: https://arcticwolf.com/resources/blog/tellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.57.208.64 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-57-208-64.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: 1e85ec81b9800b4c443d39caca0d0926089a3ac201120db1ceb45b93789480b8

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://arcticwolf.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

content-type: image/gif
date: Tue, 07 Nov 2023 16:48:31 GMT
cache-control: max-age=0
content-length: 34
expires: Tue, 07 Nov 2023 16:48:31 UTC

GET
H2 200 forms2.min.js Show response
cybersecurity.arcticwolf.com/js/forms2/js/ Frame F557 208 KB
69 KB 61ms
61ms Script
application/x-javascript 104.17.74.206
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cybersecurity.arcticwolf.com/js/forms2/js/forms2.min.js

Requested by

Host: cybersecurity.arcticwolf.com
URL: https://cybersecurity.arcticwolf.com/index.php/form/XDFrame

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

104.17.74.206 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e6ff9c0c443a9050137759816c352d43e96a673bb4023c2ba231cdbed6fe6f52

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://cybersecurity.arcticwolf.com/index.php/form/XDFrame
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 16:48:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
last-modified: Wed, 18 Oct 2023 06:07:17 GMT
server: cloudflare
age: 2375
etag: "c0241e-3414b-607f77394c966"
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: public, max-age=14400
cf-ray: 822710768e231994-FRA
expires: Tue, 07 Nov 2023 20:48:31 GMT

GET
H2 200 ga-audiences
www.google.com/ads/ 42 B
107 B 78ms
76ms Image
image/gif 2a00:1450:4001:813::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j101&tid=UA-67837305-1&cid=1233921805.1699375711&jid=756751560&_u=YGBACEAABAAAACAAI~&z=510365445

Requested by

Host: arcticwolf.com
URL: https://arcticwolf.com/resources/blog/tellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://arcticwolf.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 07 Nov 2023 16:48:31 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.de/ads/ 42 B
107 B 79ms
78ms Image
image/gif 2a00:1450:4001:82a::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j101&tid=UA-67837305-1&cid=1233921805.1699375711&jid=756751560&_u=YGBACEAABAAAACAAI~&z=510365445

Requested by

Host: arcticwolf.com
URL: https://arcticwolf.com/resources/blog/tellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://arcticwolf.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 07 Nov 2023 16:48:31 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 AW-Labs-Thumbnail-1500-2.jpg
marvel-b1-cdn.bc0a.com/f00000000241276/arcticwolf.com/wp-content/uploads/2023/02/ 25 KB
25 KB 72ms
72ms Image
image/webp 2600:9000:2250:b000:0:f267:a5c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://marvel-b1-cdn.bc0a.com/f00000000241276/arcticwolf.com/wp-content/uploads/2023/02/AW-Labs-Thumbnail-1500-2.jpg
Requested by: Host: arcticwolf.com
URL: https://arcticwolf.com/resources/blog/tellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2250:b000:0:f267:a5c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 66c3b4aadc62679644c1e23f62e78215d941781bd5d15628ae1ce128a0136f6f

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://arcticwolf.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

x-amz-version-id: 0rBJq5MY3Ey58DGbqG0XGnrh7.M52ECB
date: Tue, 07 Nov 2023 05:50:47 GMT
via: 1.1 0121ceb2efadb6db52d122a8b6b52f90.cloudfront.net (CloudFront)
x-amz-request-id: GB63BGWG2GBSJYSB
x-amz-cf-pop: FRA60-P2
x-amz-server-side-encryption: AES256
age: 39465
x-cache: Hit from cloudfront
content-length: 25280
x-amz-id-2: 0rpPn/8dpbHhIiyC0yPki0d7eSne2rZyKJcViSixrMgzenxBoaEt4CvyUzsHsxKTHfbgRslCbo8=
x-amz-expiration: expiry-date="Mon, 03 Nov 2025 00:00:00 GMT", rule-id="delete-old-images"
last-modified: Mon, 06 Feb 2023 21:43:00 GMT
server: AmazonS3
etag: "2cc59367c9d54090a075332c6cf1997e"
content-type: image/webp
access-control-allow-origin: *
cache-control: max-age=31536000
accept-ranges: bytes
x-amz-cf-id: bj4tM3iTGXvX2kZzhgg0LUiINqWxDKzkGBWfR9zqtpmXk_Kul9zmrA==

GET
H2 200 clarity.js Show response
www.clarity.ms/s/0.7.16/ 59 KB
25 KB 83ms
83ms Script
application/javascript 2620:1ec:bdf::45
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.clarity.ms/s/0.7.16/clarity.js
Requested by: Host: www.clarity.ms
URL: https://www.clarity.ms/tag/uet/26066703
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:bdf::45 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: 354142e53641e1e72a89609e46eff578e69d762290d65d84acaaf380751c20fa

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://arcticwolf.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 16:48:31 GMT
content-encoding: br
last-modified: Sun, 05 Nov 2023 12:30:25 GMT
etag: W/"0x8DBDDFAFCF68A70"
vary: Accept-Encoding
x-azure-ref: 20231107T164831Z-k8xwycsk1d1hfas6p789mkxhu4000000014g000000001uf2
content-type: application/javascript;charset=utf-8
access-control-allow-origin: *
x-ms-request-id: 52d6d129-901e-0036-0fbd-10a3ab000000
cache-control: public, max-age=86400
x-cache: TCP_HIT
x-ms-version: 2018-03-28

GET
H2 200 share-link.min.js Show response
arcticwolf.com/wp-content/plugins/elementor/assets/lib/share-link/ 3 KB
2 KB 370ms
368ms Script
application/javascript 13.224.189.102
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://arcticwolf.com/wp-content/plugins/elementor/assets/lib/share-link/share-link.min.js?ver=3.17.2

Requested by

Host: arcticwolf.com
URL: https://arcticwolf.com/wp-content/plugins/elementor/assets/js/frontend.min.js?ver=3.17.2

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.189.102 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-224-189-102.fra2.r.cloudfront.net

Software

AmazonS3 /

Resource Hash

138154c0deed3326477b9b4909175101070a5a3a95342291b53d8cc9879a5f47

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://arcticwolf.com/resources/blog/tellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 16:48:33 GMT
x-amz-version-id: jT1ocfcCoTZscr0bJrtpL.yBlDtG2hyo
x-content-type-options: nosniff
strict-transport-security: max-age=63072000; includeSubdomains; preload
content-encoding: gzip
x-amz-cf-pop: FRA60-P3, FRA2-C1
via: 1.1 a54cda8ccda3480314f451558e4dd062.cloudfront.net (CloudFront), 1.1 3bf3e75bcb9a86b3eb343a1d4392a6de.cloudfront.net (CloudFront)
x-cache: Miss from cloudfront
last-modified: Fri, 03 Nov 2023 00:58:51 GMT
server: AmazonS3
etag: W/"020e87460ce58802842e34a3aac97d83"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=31536000
x-amz-cf-id: l_ORKShf3_y_2BbIvcGpb5aUSvE84nXZeJl0KKdVl9sn2_JHAyMBjQ==

GET
H/1.1 200
OK st.js Show response
s.swiftypecdn.com/install/v2/ 416 KB
110 KB 142ms
39ms Script
text/javascript 151.101.0.143
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://s.swiftypecdn.com/install/v2/st.js
Requested by: Host: arcticwolf.com
URL: https://arcticwolf.com/resources/blog/tellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.0.143 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 2d7c7930eb39d59cd8c2dc00652977da3ed72347e7cd465f7b540e10e2121c22

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://arcticwolf.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

Date: Tue, 07 Nov 2023 16:48:31 GMT
Content-Encoding: gzip
Via: 1.1 varnish
Age: 30
X-Cache: HIT
Connection: keep-alive
Content-Length: 112326
X-Served-By: cache-fra-etou8220070-FRA
X-Timer: S1699375712.959635,VS0,VE0
ETag: "644bc383-1b6c6"
Vary: Accept-Encoding
Content-Type: text/javascript
Access-Control-Allow-Origin: *
Cache-Control: max-age=300, public, max-age=300, public
Accept-Ranges: bytes
X-Cache-Hits: 3

GET
BLOB 200
OK afcae41e-e6cb-4f55-ad95-83ba1df26c1a
https://arcticwolf.com/ 43 B
0 Image
image/gif

General

Check archive.org

Show headers Download Go to Show image

Full URL: blob:https://arcticwolf.com/afcae41e-e6cb-4f55-ad95-83ba1df26c1a
Requested by: Host: arcticwolf.com
URL: https://arcticwolf.com/resources/blog/tellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware/
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

Content-Length: 43
Content-Type: image/gif

POST
H/1.1 204
No Content collect Show response
v.clarity.ms/ 0
294 B 393ms
131ms XHR
text/plain 20.114.189.135
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://v.clarity.ms/collect
Requested by: Host: www.clarity.ms
URL: https://www.clarity.ms/s/0.7.16/clarity.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 20.114.189.135 Boydton, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: application/x-clarity-gzip
Referer: https://arcticwolf.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

Access-Control-Allow-Origin: https://arcticwolf.com
Date: Tue, 07 Nov 2023 16:48:32 GMT
Access-Control-Allow-Credentials: true
Server: nginx/1.18.0 (Ubuntu)
Connection: keep-alive
Vary: Origin
Request-Context: appId=cid-v1:3f60b293-70d6-4805-b0bb-3484f0a73bf0

GET
H/1.1 200
OK hAHV5duyMncMddL773fq.json Show response
s.swiftypecdn.com/install/v2/config/ 19 KB
5 KB 540ms
451ms XHR
application/json 151.101.0.143
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://s.swiftypecdn.com/install/v2/config/hAHV5duyMncMddL773fq.json

Requested by

Host: s.swiftypecdn.com
URL: https://s.swiftypecdn.com/install/v2/st.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.0.143 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

17184fd3335ad72ab651cd752ec591c5234985af840dbaaec580ac0464343dd1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept: */*
Referer: https://arcticwolf.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

Date: Tue, 07 Nov 2023 16:48:32 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Via: 1.1 varnish
X-Permitted-Cross-Domain-Policies: none
Age: 0
X-Cache: HIT
Connection: keep-alive
Content-Length: 4250
X-XSS-Protection: 1; mode=block
X-Request-Id: 6e87a6e3c694ac7a50febeca0129de69
X-Served-By: cache-fra-etou8220027-FRA
Referrer-Policy: strict-origin-when-cross-origin
Last-Modified: Fri, 29 May 2020 02:15:38 GMT
X-Timer: S1699375712.195508,VS0,VE412
ETag: W/"f8d7acb49f60ab0bf76694cc2dccecad"
X-Download-Options: noopen
X-Frame-Options: SAMEORIGIN
Access-Control-Max-Age: 7200
Access-Control-Allow-Methods: GET, POST
Content-Type: application/json; charset=utf-8
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers
Cache-Control: max-age=300, public
Access-Control-Allow-Credentials: true
Vary: Accept-Encoding, Origin
Accept-Ranges: bytes
X-Cache-Hits: 1

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 305 KB
93 KB 108ms
108ms Script
application/javascript 2a00:1450:4001:802::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-33RYRGB9LX

Requested by

Host: ob.robotflowermobile.com
URL: https://ob.robotflowermobile.com/i/9decd3b0fe5c0841dd43a5375baa5a71.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

82646eceaea52567040cee32d51971f4d9d8217516c98bbb47ab82433851bd5a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://arcticwolf.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 16:48:32 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 95241
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Tue, 07 Nov 2023 16:48:32 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 305 KB
93 KB 93ms
93ms Script
application/javascript 2a00:1450:4001:802::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-33RYRGB9LX&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-PMV4652

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

cbe2fc29e72f63a275cd00904894ac08aeb29e5517d0cc9352330f36dd59bffe

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://arcticwolf.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 16:48:32 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 95217
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Tue, 07 Nov 2023 16:48:32 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 205 KB
73 KB 54ms
54ms Script
application/javascript 2a00:1450:4001:802::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-410966486

Requested by

Host: ob.robotflowermobile.com
URL: https://ob.robotflowermobile.com/i/9decd3b0fe5c0841dd43a5375baa5a71.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

21e1e51e6bdcecfc73beaf750136c6fcd8c19e29cd0e5ef2995de5ff9801196d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://arcticwolf.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 16:48:32 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 75101
x-xss-protection: 0
last-modified: Tue, 07 Nov 2023 15:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Tue, 07 Nov 2023 16:48:32 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 205 KB
73 KB 74ms
74ms Script
application/javascript 2a00:1450:4001:802::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-410966486&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-PMV4652

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

670628ef5307d8685febf9feb94c11c8224247ffe69dacfccb320eb9be1d1719

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://arcticwolf.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 16:48:32 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 75097
x-xss-protection: 0
last-modified: Tue, 07 Nov 2023 15:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Tue, 07 Nov 2023 16:48:32 GMT

GET
H2 200 / Show response
arcticwolf.com/cheq-ppc-invalid-users/ Frame AC87 753 B
1 KB 50ms
49ms Document
text/html 13.224.189.102
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://arcticwolf.com/cheq-ppc-invalid-users/

Requested by

Host: ob.robotflowermobile.com
URL: https://ob.robotflowermobile.com/i/9decd3b0fe5c0841dd43a5375baa5a71.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.189.102 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-224-189-102.fra2.r.cloudfront.net

Software

AmazonS3 /

Resource Hash

639d0d582c4d7e66bddd8a2a18d2f1e0274a0c3b3c5952ad5cf4263e4e71d4fb

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://arcticwolf.com/resources/blog/tellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 469
cache-control: must-revalidate, max-age=0, s-maxage=86400
content-length: 753
content-type: text/html
date: Tue, 07 Nov 2023 16:40:44 GMT
etag: "a677bc49a380e66b9eeaebb822a9a91c"
last-modified: Tue, 18 Jul 2023 17:25:56 GMT
server: AmazonS3
strict-transport-security: max-age=63072000; includeSubdomains; preload
via: 1.1 39e6266db143f6443f194d8c60e22480.cloudfront.net (CloudFront), 1.1 3bf3e75bcb9a86b3eb343a1d4392a6de.cloudfront.net (CloudFront)
x-amz-cf-id: dnwYRzqONHb7y65mMakPrBEDLtufo-pO_cxdNUP6gV5R1WeJJ3yKjA==
x-amz-cf-pop: FRA60-P3 FRA2-C1
x-amz-version-id: pKt7pQ47tjUDPDPdf6HShqbXLB5mIxMD
x-cache: Miss from cloudfront
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN

GET
H2 200 bat.js Show response
bat.bing.com/ Frame 19AA 45 KB
13 KB 2569ms
2568ms Script
application/javascript 2620:1ec:c11::200
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://bat.bing.com/bat.js

Requested by

Host: arcticwolf.com
URL: https://arcticwolf.com/resources/blog/tellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

0dc90421cbf6414c9f1ef5e93af3dbe48a4e51899452330f0ae0b2815e38be94

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://arcticwolf.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
date: Tue, 07 Nov 2023 16:48:33 GMT
last-modified: Fri, 20 Oct 2023 01:13:24 GMT
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 9662B804AD6740D09A1E67F8ACF5C3FC Ref B: FRA31EDGE0721 Ref C: 2023-11-07T16:48:32Z
etag: "0125f9ff22da1:0"
vary: Accept-Encoding
x-cache: CONFIG_NOCACHE
content-type: application/javascript
cache-control: private,max-age=1800
accept-ranges: bytes
content-length: 13079

GET
H2 200 tc_imp.gif
obs.robotflowermobile.com/tracker/ 43 B
79 B 119ms
118ms Image
image/gif 2600:1f18:e8a:cd00:e7aa:3ac6:9899:87c4
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://obs.robotflowermobile.com/tracker/tc_imp.gif?e=37dfbd8ee84e001363e7c432ef408b9f9225c24f567d43d6da1908be6245cad7bd70a976750ef80ed89373bfe70e9c20c1e53e8d5f128d6e2317071a10acf9f29f6748d6d189537e6c18ad797f0c83688e679104645372c251060c665558c2bb3d1b77be26bb25cb43e2916af05365ac097c7a1bdb50ef4ef497d7d63fbb2807ff7ecaa8556d8e0e3143714493d60264f360b3f493a0180dec1edae97dfa2bc8169b1adc597cff3200e714561c4b92177af998ffe4198b6dec06c213f85e162ae7d133722b325f817c99ec59b058609fc6e359143e3dd385293e88864c06513c157a77bb9e70392652b48d1c2ad7f4ec3ee3b8192d4079b4a7a49d8677a0dbde5eee489d583b72aeb9cce4b46d8fd9e16c893008c3e5db6e4d57e56b7da0c11131b8dfff72dc50ae13bb8d19961a9f9a76953b33959d2fdc3393d5bcf69df3f1477fe425b4bafc294d26f9913f82be50eb0102419457459a8193c9d7f78425c524d4d2b48577a36c7c25896f3b9593800327dee576e617e09d439970b977455d44db20b542dbddbc71b58c2ec40aec82d0946a8a164579fa1144012e183191f837e6139bc28027a39569f8df3ad7cdf9fd719ebde84a656e8fa41e0a9bb10e1a5aa7a2a224f16bd9b502fdea2db175bc23c641de06a3dd2edb0875f6a4937a2d7a3111200f4005e8b4da399040e2075c493beaa85d8cc00a06eceb87effd6882adb7ee9aeaf1a00d166baa03dfe9077c89513b09cb710a201faa22fa285dbbbfd3699861d52688a22eccb00d9c650e27290b7f1499c7e5da2e6747cc4a36c98a8ce5f4b3071794a2bc6397c97a72dbd5173b68f894db563fb527825f9a1ce4399f17c9d401bae620e8f095db984763f3e3277e8477a091ada81e9f70371403886b4059adbe5c88e508d79f9bc948d0818737122a44b83db718ac55b09d74973243214126607ee15a8e822f48b86fc0a7f329c4ce4d8c7474b30c7d2c9fe8d91647ef71f58d10c61a30004abf3a309faed768c85522878413a1dbdbe39d43da5d512509ef76255299906140a868a2a7953f85c1ed105c7aab63230f01c81651f8ef927154d1080690e68017a8ddc8b93030a622f8423302de44317ecbd1024882d5e4d3e5b312ff7bff6a895f84e873bc8e812d73b4f938d082acf681aa82df3e508df824539236910d9859e0e535cdc798a42ff2809dbb9b0c11e081a28151dd46ca1240701803a78c2b74983cf857d49624f9466cb311019d61f7d7202ac73227481ac2e6d22c99c90a773b5526d3dcd4a68068cb44a9a6332284c24b4a194b377c63bf3fa1a43804afb5dac4f8b4f9efef8d3ae8abcf437661553b3653262fd6510453acedbae67dbb9c3601dfdb&cri=KcJJzHHQ4C&ts=427&cb=1699375712142
Requested by: Host: arcticwolf.com
URL: https://arcticwolf.com/resources/blog/tellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware/
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2600:1f18:e8a:cd00:e7aa:3ac6:9899:87c4 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: /
Resource Hash: 98b3d9d20e032f90aca49e9b116225d539ff6fbdb7e42c3c363f63896ac03d2a

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://arcticwolf.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

expires: Fri, 01 Jan 1990 00:00:00 GMT
pragma: no-cache
date: Tue, 07 Nov 2023 16:48:32 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 43
content-type: image/gif

GET
BLOB 200
OK 72ae6b03-1927-430a-9fb1-81b77344145b
https://arcticwolf.com/ 261 B
0 Other
text/plain

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://arcticwolf.com/72ae6b03-1927-430a-9fb1-81b77344145b
Requested by: Host: arcticwolf.com
URL: https://arcticwolf.com/resources/blog/tellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware/
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: f431919bb83be2c363666c96f3f7c96e5c1953b3a08c710d00f0562d86faa7ea

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

Content-Length: 261
Content-Type

GET
BLOB 200
OK 2fb33885-61f8-46e9-996b-e3d95c0770bc
https://arcticwolf.com/ 529 B
0 Other
text/plain

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://arcticwolf.com/2fb33885-61f8-46e9-996b-e3d95c0770bc
Requested by: Host: arcticwolf.com
URL: https://arcticwolf.com/resources/blog/tellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware/
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 0f83c5ce15a7c3e5c836c5692bc6f6cbc2114640d6558d0b1f2e2b64973274ed

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

Content-Length: 529
Content-Type

GET
H2 200 insight.min.js Show response
snap.licdn.com/li.lms-analytics/ Frame AC87 12 KB
4 KB 58ms
57ms Script
application/javascript 2a02:26f0:480:f::213:7ec6
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://snap.licdn.com/li.lms-analytics/insight.min.js

Requested by

Host: arcticwolf.com
URL: https://arcticwolf.com/cheq-ppc-invalid-users/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:480:f::213:7ec6 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Resource Hash

4799e6fee2ac082caeb34ece153a76289d6cce1159a3838bccf840970e066e30

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://arcticwolf.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 16:48:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 07 Nov 2023 07:13:07 GMT
x-cdn: AKAM
x-amz-server-side-encryption: AES256
vary: Accept-Encoding
content-type: application/javascript;charset=utf-8
cache-control: max-age=51906
accept-ranges: bytes
content-length: 3839

GET
H2 200 insight.beta.min.js Show response
snap.licdn.com/li.lms-analytics/ Frame AC87 41 KB
15 KB 42ms
41ms Script
application/javascript 2a02:26f0:480:f::213:7ec6
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://snap.licdn.com/li.lms-analytics/insight.beta.min.js

Requested by

Host: snap.licdn.com
URL: https://snap.licdn.com/li.lms-analytics/insight.min.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:480:f::213:7ec6 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Resource Hash

b6131e06fcb9060f687ce48a1c26f52333ba731796ee9bfc9c22589d71bbc859

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://arcticwolf.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 16:48:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 07 Nov 2023 07:13:08 GMT
x-cdn: AKAM
x-amz-server-side-encryption: AES256
vary: Accept-Encoding
content-type: application/javascript;charset=utf-8
cache-control: max-age=51973
accept-ranges: bytes
content-length: 15306

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/410966486/ 3 KB
2 KB 56ms
54ms Script
text/javascript 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/410966486/?random=1699375712337&cv=11&fst=1699375712337&bg=ffffff&guid=ON&async=1&gtm=45be3b60v896750397&gcd=11l1l1l1l1&u_w=1600&u_h=1200&url=https%3A%2F%2Farcticwolf.com%2Fresources%2Fblog%2Ftellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware%2F&hn=www.googleadservices.com&frm=0&tiba=Exploitation%20of%20CVE-2023-46604%20Leading%20to%20Ransomware&auid=1349226205.1699375711&uamb=0&uaw=0&data=event%3Dgtag.config&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-410966486

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9da132e5bd56021d5a70c81b6e6f51e885362b94bddb1a52c883220b6403f070

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://arcticwolf.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 07 Nov 2023 16:48:32 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1352
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 / Show response
www.googleadservices.com/pagead/conversion/410966486/ 3 KB
2 KB 155ms
52ms Script
text/javascript 172.217.18.2
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/conversion/410966486/?random=1699375712354&cv=11&fst=1699375712354&bg=ffffff&guid=ON&async=1&gtm=45be3b60v896750397&gcd=11l1l1l1l1&u_w=1600&u_h=1200&url=https%3A%2F%2Farcticwolf.com%2Fresources%2Fblog%2Ftellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware%2F&label=lzDbCJmv1ocYENaz-8MB&hn=www.googleadservices.com&frm=0&tiba=Exploitation%20of%20CVE-2023-46604%20Leading%20to%20Ransomware&gtm_ee=1&auid=1349226205.1699375711&uamb=0&uaw=0&data=event%3Dconversion&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-410966486

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.18.2 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s22-in-f2.1e100.net

Software

cafe /

Resource Hash

dda5c21702588bb75d10250c4974558875c340b33fed6c691fb03eb4a78b1e16

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://arcticwolf.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 07 Nov 2023 16:48:32 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1641
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 collect
region1.analytics.google.com/g/ 0
253 B 134ms
46ms Ping
text/plain 2001:4860:4802:32::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://region1.analytics.google.com/g/collect?v=2&tid=G-33RYRGB9LX&gtm=45je3b60v882658109&_p=1699375709452&_gaz=1&gcd=11l1l1l1l1&cid=1233921805.1699375711&ul=en-us&sr=1600x1200&ir=1&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_eu=EA&_s=1&sid=1699375712&sct=1&seg=0&dl=https%3A%2F%2Farcticwolf.com%2Fresources%2Fblog%2Ftellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware%2F&dt=Exploitation%20of%20CVE-2023-46604%20Leading%20to%20Ransomware&en=CQ&_fv=1&_ss=1&_ee=1&up.cq_category=bots&tfd=4127
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-33RYRGB9LX&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:32::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://arcticwolf.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 07 Nov 2023 16:48:32 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://arcticwolf.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 collect
stats.g.doubleclick.net/g/ 0
56 B 304ms
303ms Ping
text/plain 2a00:1450:400c:c04::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://stats.g.doubleclick.net/g/collect?v=2&tid=G-33RYRGB9LX&cid=1233921805.1699375711&gtm=45je3b60v882658109&aip=1
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-33RYRGB9LX&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:400c:c04::9b Brussels, Belgium, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://arcticwolf.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 07 Nov 2023 16:48:32 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://arcticwolf.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ga-audiences
www.google.de/ads/ 42 B
63 B 78ms
78ms Image
image/gif 2a00:1450:4001:82a::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&tid=G-33RYRGB9LX&cid=1233921805.1699375711&gtm=45je3b60v882658109&aip=1&z=2073582171

Requested by

Host: arcticwolf.com
URL: https://arcticwolf.com/resources/blog/tellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://arcticwolf.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 07 Nov 2023 16:48:32 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

collect
px4.ads.linkedin.com/ Frame AC87
Redirect Chain

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=50605&time=1699375712461&url=https%3A%2F%2Farcticwolf.com%2Fresources%2Fblog%2Ftellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware%2F
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=50605&time=1699375712461&url=https%3A%2F%2Farcticwolf.com%2Fresources%2Fblog%2Ftellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomwar...

0
144 B

180ms
178ms

Image
application/javascript

13.107.42.14
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=50605&time=1699375712461&url=https%3A%2F%2Farcticwolf.com%2Fresources%2Fblog%2Ftellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware%2F&e_ipv6=AQKCDvqVfPbItgAAAYuqr4kq9wA1IjYtamnwTcOUIfVCtL9wt-xgt1cQQfBbFVv9w14OawE
Requested by: Host: arcticwolf.com
URL: https://arcticwolf.com/cheq-ppc-invalid-users/
Protocol: H2
Server: 13.107.42.14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://arcticwolf.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 16:48:32 GMT
x-li-pop: afd-prod-ltx1-x
x-msedge-ref: Ref A: 98DDDA2C70A248E88930E9BC6B3639C9 Ref B: FRAEDGE1516 Ref C: 2023-11-07T16:48:32Z
linkedin-action: 1
x-cache: CONFIG_NOCACHE
content-type: application/javascript
x-li-fabric: prod-ltx1
x-li-proto: http/2
content-length: 0
x-li-uuid: AAYJkr2ydVvx+ERBzxTz1Q==

Redirect headers

date: Tue, 07 Nov 2023 16:48:32 GMT
x-li-pop: afd-prod-ltx1-x
x-msedge-ref: Ref A: AB7FA89DB0CC4947B6761ECDEF39651D Ref B: DUS30EDGE0918 Ref C: 2023-11-07T16:48:32Z
linkedin-action: 1
x-cache: CONFIG_NOCACHE
x-li-fabric: prod-ltx1
location: https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=50605&time=1699375712461&url=https%3A%2F%2Farcticwolf.com%2Fresources%2Fblog%2Ftellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware%2F&e_ipv6=AQKCDvqVfPbItgAAAYuqr4kq9wA1IjYtamnwTcOUIfVCtL9wt-xgt1cQQfBbFVv9w14OawE
x-li-proto: http/2
content-length: 0
x-li-uuid: AAYJkr2vsodrXc5NGUCK8w==

GET
H3 200 /
www.google.com/pagead/1p-user-list/410966486/ 42 B
64 B 51ms
51ms Image
image/gif 2a00:1450:4001:813::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/410966486/?random=1699375712337&cv=11&fst=1699372800000&bg=ffffff&guid=ON&async=1&gtm=45be3b60v896750397&u_w=1600&u_h=1200&url=https%3A%2F%2Farcticwolf.com%2Fresources%2Fblog%2Ftellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware%2F&frm=0&tiba=Exploitation%20of%20CVE-2023-46604%20Leading%20to%20Ransomware&data=event%3Dgtag.config&fmt=3&is_vtc=1&cid=CAQSKQDICaaNclbAX-pLohEZimxognsgo-gIRcpeuMux0C9gtPslsCyOhNqH&random=4135733083&rmt_tld=0&ipr=y

Requested by

Host: arcticwolf.com
URL: https://arcticwolf.com/resources/blog/tellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://arcticwolf.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 07 Nov 2023 16:48:32 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 /
www.google.de/pagead/1p-user-list/410966486/ 42 B
64 B 55ms
55ms Image
image/gif 2a00:1450:4001:82a::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/410966486/?random=1699375712337&cv=11&fst=1699372800000&bg=ffffff&guid=ON&async=1&gtm=45be3b60v896750397&u_w=1600&u_h=1200&url=https%3A%2F%2Farcticwolf.com%2Fresources%2Fblog%2Ftellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware%2F&frm=0&tiba=Exploitation%20of%20CVE-2023-46604%20Leading%20to%20Ransomware&data=event%3Dgtag.config&fmt=3&is_vtc=1&cid=CAQSKQDICaaNclbAX-pLohEZimxognsgo-gIRcpeuMux0C9gtPslsCyOhNqH&random=4135733083&rmt_tld=1&ipr=y

Requested by

Host: arcticwolf.com
URL: https://arcticwolf.com/resources/blog/tellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://arcticwolf.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 07 Nov 2023 16:48:32 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

/
www.google.de/pagead/1p-conversion/410966486/
Redirect Chain

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/410966486/?random=1976014780&cv=11&fst=1699375712354&bg=ffffff&guid=ON&async=1&gtm=45be3b60v896750397&gcd=11l1l1l1l1&u_w=1600&u_h=12...
https://www.google.com/pagead/1p-conversion/410966486/?random=1976014780&cv=11&fst=1699375712354&bg=ffffff&guid=ON&async=1&gtm=45be3b60v896750397&gcd=11l1l1l1l1&u_w=1600&u_h=1200&url=https%3A%2F%2F...
https://www.google.de/pagead/1p-conversion/410966486/?random=1976014780&cv=11&fst=1699375712354&bg=ffffff&guid=ON&async=1&gtm=45be3b60v896750397&gcd=11l1l1l1l1&u_w=1600&u_h=1200&url=https%3A%2F%2Fa...

42 B
64 B

78ms
77ms

Image
image/gif

2a00:1450:4001:82a::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-conversion/410966486/?random=1976014780&cv=11&fst=1699375712354&bg=ffffff&guid=ON&async=1&gtm=45be3b60v896750397&gcd=11l1l1l1l1&u_w=1600&u_h=1200&url=https%3A%2F%2Farcticwolf.com%2Fresources%2Fblog%2Ftellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware%2F&label=lzDbCJmv1ocYENaz-8MB&hn=www.googleadservices.com&frm=0&tiba=Exploitation%20of%20CVE-2023-46604%20Leading%20to%20Ransomware&gtm_ee=1&auid=1349226205.1699375711&uamb=0&uaw=0&data=event%3Dconversion&fmt=3&ct_cookie_present=false&sscte=1&crd=&pscrd=Ek5DaEFJZ04ybnFnWVFoWk9xNi1pbTk3aGpFaVlBV2ZYR1poeW9INzBoUVpYVHpObThRNEZGeXR5UkJpcURIQTBTMFpqZDVkT29oQy1MU2caV0NnOElnTjJucWdZUXJzTzVuYTZmaFJBU0xnQ0dJd29MTDVSSThnN1NWZ0ZQNDNsbGtfNGphWnlCOEJiYzk0cmxXRjFBelBCTnlOcVBoTlBsalJpZTVFcyITCJmFu-2rsoIDFUaKgwcdJ-kJuA&is_vtc=1&ocp_id=YGpKZZnVHcaUjuwPp9KnwAs&cid=CAQSKQDICaaNWGJZaEfI5u4FQRaMdGQCElH7xzwNht6QOApJyhcxV_pUdUHd&random=1109559659&ipr=y

Requested by

Host: arcticwolf.com
URL: https://arcticwolf.com/resources/blog/tellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware/

Protocol

Server

2a00:1450:4001:82a::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://arcticwolf.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 07 Nov 2023 16:48:32 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 07 Nov 2023 16:48:32 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
location: https://www.google.de/pagead/1p-conversion/410966486/?random=1976014780&cv=11&fst=1699375712354&bg=ffffff&guid=ON&async=1&gtm=45be3b60v896750397&gcd=11l1l1l1l1&u_w=1600&u_h=1200&url=https%3A%2F%2Farcticwolf.com%2Fresources%2Fblog%2Ftellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware%2F&label=lzDbCJmv1ocYENaz-8MB&hn=www.googleadservices.com&frm=0&tiba=Exploitation%20of%20CVE-2023-46604%20Leading%20to%20Ransomware&gtm_ee=1&auid=1349226205.1699375711&uamb=0&uaw=0&data=event%3Dconversion&fmt=3&ct_cookie_present=false&sscte=1&crd=&pscrd=Ek5DaEFJZ04ybnFnWVFoWk9xNi1pbTk3aGpFaVlBV2ZYR1poeW9INzBoUVpYVHpObThRNEZGeXR5UkJpcURIQTBTMFpqZDVkT29oQy1MU2caV0NnOElnTjJucWdZUXJzTzVuYTZmaFJBU0xnQ0dJd29MTDVSSThnN1NWZ0ZQNDNsbGtfNGphWnlCOEJiYzk0cmxXRjFBelBCTnlOcVBoTlBsalJpZTVFcyITCJmFu-2rsoIDFUaKgwcdJ-kJuA&is_vtc=1&ocp_id=YGpKZZnVHcaUjuwPp9KnwAs&cid=CAQSKQDICaaNWGJZaEfI5u4FQRaMdGQCElH7xzwNht6QOApJyhcxV_pUdUHd&random=1109559659&ipr=y
content-type: image/gif
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK new_embed-2552d8d62d9c60f59b3b11a5d083d1ebd090c72de809fc7c76fb339825302241.css
s.swiftypecdn.com/assets/ 89 KB
34 KB 39ms
39ms Stylesheet
text/css 151.101.0.143
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://s.swiftypecdn.com/assets/new_embed-2552d8d62d9c60f59b3b11a5d083d1ebd090c72de809fc7c76fb339825302241.css
Requested by: Host: s.swiftypecdn.com
URL: https://s.swiftypecdn.com/install/v2/st.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.0.143 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 2552d8d62d9c60f59b3b11a5d083d1ebd090c72de809fc7c76fb339825302241

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://arcticwolf.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

X-Cache-Hits: 3232
Date: Tue, 07 Nov 2023 16:48:32 GMT
Content-Encoding: gzip
Via: 1.1 varnish
Age: 430903
X-Cache: HIT
Connection: keep-alive
Content-Length: 33983
X-Served-By: cache-fra-etou8220070-FRA
X-Timer: S1699375713.649163,VS0,VE0
ETag: "62b9d075-84bf"
Vary: Accept-Encoding
Content-Type: text/css
Access-Control-Allow-Origin: *
Cache-Control: max-age=31536000, public
Accept-Ranges: bytes
Expires: Fri, 01 Nov 2024 17:06:49 GMT

POST
H2 204 / Show response
px.ads.linkedin.com/wa/ 0
195 B 190ms
190ms XHR
text/plain 2620:1ec:21::14
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://px.ads.linkedin.com/wa/
Requested by: Host: snap.licdn.com
URL: https://snap.licdn.com/li.lms-analytics/insight.beta.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:21::14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: *
Referer: https://arcticwolf.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

date: Tue, 07 Nov 2023 16:48:32 GMT
x-li-pop: afd-prod-ltx1-x
x-msedge-ref: Ref A: 0DFEB1E31C56484CA9EB17536E25FF36 Ref B: DUS30EDGE0918 Ref C: 2023-11-07T16:48:32Z
linkedin-action: 1
vary: Origin
x-cache: CONFIG_NOCACHE
x-li-fabric: prod-ltx1
access-control-allow-origin: https://arcticwolf.com
x-li-proto: http/2
access-control-allow-credentials: true
x-li-uuid: AAYJkr2yY2l9sHFDeTfHCQ==

GET
H/1.1 200
OK cc.js
cc.swiftype.com/ 43 B
279 B 691ms
160ms Image
image/gif 169.46.32.99
SOFTLAYER

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cc.swiftype.com/cc.js?engine_key=igWoUt9mRmYC3HT9zxHR&url=https%3A%2F%2Farcticwolf.com%2Fresources%2Fblog%2Ftellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware%2F
Requested by: Host: arcticwolf.com
URL: https://arcticwolf.com/resources/blog/tellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 169.46.32.99 Irving, United States, ASN36351 (SOFTLAYER, US),
Reverse DNS: 63.20.2ea9.ip4.static.sl-reverse.com
Software: /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://arcticwolf.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

Content-Type: image/gif
Date: Tue, 07 Nov 2023 16:48:33 GMT
Cache-Control: no-cache
Last-Modified: Mon, 28 Sep 1970 06:00:00 GMT
Connection: keep-alive
Content-Length: 43
Expires: Tue, 07 Nov 2023 16:48:32 GMT

POST
H2 204 / Show response
px.ads.linkedin.com/wa/ Frame AC87 0
145 B 186ms
186ms XHR
text/plain 2620:1ec:21::14
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://px.ads.linkedin.com/wa/
Requested by: Host: snap.licdn.com
URL: https://snap.licdn.com/li.lms-analytics/insight.beta.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:21::14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: *
Referer: https://arcticwolf.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

date: Tue, 07 Nov 2023 16:48:32 GMT
x-li-pop: afd-prod-ltx1-x
x-msedge-ref: Ref A: F7CCF95EDC4749478E95D7316B9640A8 Ref B: DUS30EDGE0918 Ref C: 2023-11-07T16:48:32Z
linkedin-action: 1
vary: Origin
x-cache: CONFIG_NOCACHE
x-li-fabric: prod-ltx1
access-control-allow-origin: https://arcticwolf.com
x-li-proto: http/2
access-control-allow-credentials: true
x-li-uuid: AAYJkr21UE2oteTIhsiwwA==

POST
H/1.1 204
No Content collect Show response
v.clarity.ms/ 0
294 B 961ms
470ms XHR
text/plain 20.114.189.135
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://v.clarity.ms/collect
Requested by: Host: www.clarity.ms
URL: https://www.clarity.ms/s/0.7.16/clarity.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 20.114.189.135 Boydton, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: application/x-clarity-gzip
Referer: https://arcticwolf.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

Access-Control-Allow-Origin: https://arcticwolf.com
Date: Tue, 07 Nov 2023 16:48:33 GMT
Access-Control-Allow-Credentials: true
Server: nginx/1.18.0 (Ubuntu)
Connection: keep-alive
Vary: Origin
Request-Context: appId=cid-v1:3f60b293-70d6-4805-b0bb-3484f0a73bf0

POST
H2 200 mon Show response
obs.robotflowermobile.com/ 0
147 B 119ms
119ms XHR
application/json 2600:1f18:e8a:cd00:e7aa:3ac6:9899:87c4
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://obs.robotflowermobile.com/mon
Requested by: Host: ob.robotflowermobile.com
URL: https://ob.robotflowermobile.com/i/9decd3b0fe5c0841dd43a5375baa5a71.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2600:1f18:e8a:cd00:e7aa:3ac6:9899:87c4 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://arcticwolf.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

access-control-allow-origin: https://arcticwolf.com
date: Tue, 07 Nov 2023 16:48:33 GMT
access-control-allow-credentials: true
content-length: 0
access-control-allow-methods: GET,HEAD,PUT,PATCH,POST,DELETE
content-type: application/json

POST
H2 200 mon Show response
obs.robotflowermobile.com/ 0
16 B 120ms
120ms XHR
application/json 2600:1f18:e8a:cd00:e7aa:3ac6:9899:87c4
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://obs.robotflowermobile.com/mon
Requested by: Host: ob.robotflowermobile.com
URL: https://ob.robotflowermobile.com/i/9decd3b0fe5c0841dd43a5375baa5a71.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2600:1f18:e8a:cd00:e7aa:3ac6:9899:87c4 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://arcticwolf.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

access-control-allow-origin: https://arcticwolf.com
date: Tue, 07 Nov 2023 16:48:33 GMT
access-control-allow-credentials: true
content-length: 0
access-control-allow-methods: GET,HEAD,PUT,PATCH,POST,DELETE
content-type: application/json

GET
H2 200 295006432.js Show response
bat.bing.com/p/action/ Frame 19AA 4 KB
2 KB 64ms
61ms Script
application/javascript 2620:1ec:c11::200
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://bat.bing.com/p/action/295006432.js

Requested by

Host: bat.bing.com
URL: https://bat.bing.com/bat.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

41034890cce103c8bb5af53c090b8431802103e3ef948df4b38d034ebff4f9af

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://arcticwolf.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: br
date: Tue, 07 Nov 2023 16:48:34 GMT
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 33B23B29EB8948898F625C9E53906D81 Ref B: FRA31EDGE0721 Ref C: 2023-11-07T16:48:34Z
vary: Accept-Encoding
x-cache: CONFIG_NOCACHE
content-type: application/javascript; charset=utf-8
cache-control: private,max-age=60

GET
H2 204 0
bat.bing.com/action/ Frame 19AA 0
273 B 609ms
606ms Image
text/plain 2620:1ec:c11::200
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://bat.bing.com/action/0?ti=295006432&Ver=2&mid=c396713b-b5da-4f90-92a1-1669c3ed76f6&sid=7ba4cba07d8d11ee905eb786ef1ec7c2&vid=7ba4f6107d8d11eea52c45b12b36f397&vids=0&msclkid=N&pi=1200101525&lg=en-US&sw=1600&sh=1200&sc=24&p=https%3A%2F%2Farcticwolf.com%2Fresources%2Fblog%2Ftellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware%2F&r=&lt=1&evt=pageLoad&ifm=1&sv=1&rn=38564

Requested by

Host: arcticwolf.com
URL: https://arcticwolf.com/resources/blog/tellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://arcticwolf.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Tue, 07 Nov 2023 16:48:34 GMT
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 00D1213237724807B6339A65E091EF67 Ref B: FRA31EDGE0721 Ref C: 2023-11-07T16:48:34Z
x-cache: CONFIG_NOCACHE
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H/1.1 204
No Content collect Show response
v.clarity.ms/ 0
294 B 130ms
130ms XHR
text/plain 20.114.189.135
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://v.clarity.ms/collect
Requested by: Host: www.clarity.ms
URL: https://www.clarity.ms/s/0.7.16/clarity.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 20.114.189.135 Boydton, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: application/x-clarity-gzip
Referer: https://arcticwolf.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

Access-Control-Allow-Origin: https://arcticwolf.com
Date: Tue, 07 Nov 2023 16:48:35 GMT
Access-Control-Allow-Credentials: true
Server: nginx/1.18.0 (Ubuntu)
Connection: keep-alive
Vary: Origin
Request-Context: appId=cid-v1:3f60b293-70d6-4805-b0bb-3484f0a73bf0

GET
H2 200 295006432 Show response
www.clarity.ms/tag/uet/ Frame 19AA 829 B
1 KB 126ms
126ms Script
application/x-javascript 2620:1ec:bdf::45
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.clarity.ms/tag/uet/295006432
Requested by: Host: bat.bing.com
URL: https://bat.bing.com/p/action/295006432.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:bdf::45 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: 889b78c162a1d4307aa47d4f1ceeff2162a06b4ba080c7b9ee129b9805fba55b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://arcticwolf.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

expires: -1
date: Tue, 07 Nov 2023 16:48:35 GMT
x-azure-ref: 20231107T164835Z-k8xwycsk1d1hfas6p789mkxhu4000000014g000000001vdz
x-cache: CONFIG_NOCACHE
content-type: application/x-javascript
cache-control: no-cache, no-store
accept-ranges: bytes
content-length: 829
request-context: appId=cid-v1:dfa4d45a-f309-4181-9ede-77e6e6c0ecf0

GET
H2 200 clarity.js Show response
www.clarity.ms/s/0.7.13/ Frame 19AA 59 KB
25 KB 79ms
78ms Script
application/javascript 2620:1ec:bdf::45
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.clarity.ms/s/0.7.13/clarity.js
Requested by: Host: www.clarity.ms
URL: https://www.clarity.ms/tag/uet/295006432
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:bdf::45 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: 74e69ccf2f5cb32c175e328707c515fc9116ddd5cb3c92882d9bd53d3a742d63

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://arcticwolf.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 16:48:35 GMT
content-encoding: br
last-modified: Tue, 17 Oct 2023 11:58:02 GMT
etag: W/"0x8DBCF0850CC9F3D"
vary: Accept-Encoding
x-azure-ref: 20231107T164835Z-k8xwycsk1d1hfas6p789mkxhu4000000014g000000001vek
content-type: application/javascript;charset=utf-8
access-control-allow-origin: *
x-ms-request-id: 497c5790-901e-006b-7d07-11a92f000000
cache-control: public, max-age=86400
x-cache: TCP_HIT
x-ms-version: 2018-03-28

GET
H2

200

c.gif
c.clarity.ms/ Frame 19AA
Redirect Chain

https://c.clarity.ms/c.gif
https://c.bing.com/c.gif?ctsa=mr&CtsSyncId=E9145896A9784D4E9511EDBE98EAD5CB&RedC=c.clarity.ms&MXFR=3503D6B96BA76204291FC57B6FA76C5A
https://c.clarity.ms/c.gif?ctsa=mr&CtsSyncId=E9145896A9784D4E9511EDBE98EAD5CB&MUID=1092E828465369190596FBEA47FF6870

42 B
443 B

56ms
56ms

Image
image/gif

68.219.88.97
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://c.clarity.ms/c.gif?ctsa=mr&CtsSyncId=E9145896A9784D4E9511EDBE98EAD5CB&MUID=1092E828465369190596FBEA47FF6870
Requested by: Host: arcticwolf.com
URL: https://arcticwolf.com/resources/blog/tellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware/
Protocol: H2
Server: 68.219.88.97 Dublin, Ireland, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: 99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://arcticwolf.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 07 Nov 2023 16:48:34 GMT
last-modified: Wed, 30 Aug 2023 19:01:41 GMT
server: Microsoft-IIS/10.0
etag: "8d59566974dbd91:0"
x-powered-by: ASP.NET
content-type: image/gif
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
cache-control: private, no-cache, proxy-revalidate, no-store
accept-ranges: bytes
content-length: 42

Redirect headers

pragma: no-cache
date: Tue, 07 Nov 2023 16:48:34 GMT
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 485FB859B47F4B0B8AA583CCEFEDD334 Ref B: FRA31EDGE0721 Ref C: 2023-11-07T16:48:35Z
x-powered-by: ASP.NET
x-cache: CONFIG_NOCACHE
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
location: https://c.clarity.ms/c.gif?ctsa=mr&CtsSyncId=E9145896A9784D4E9511EDBE98EAD5CB&MUID=1092E828465369190596FBEA47FF6870
cache-control: private, no-cache, proxy-revalidate, no-store
content-length: 0

POST
H2 200 mon Show response
obs.robotflowermobile.com/ 0
40 B 129ms
128ms XHR
application/json 2600:1f18:e8a:cd00:e7aa:3ac6:9899:87c4
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://obs.robotflowermobile.com/mon
Requested by: Host: ob.robotflowermobile.com
URL: https://ob.robotflowermobile.com/i/9decd3b0fe5c0841dd43a5375baa5a71.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2600:1f18:e8a:cd00:e7aa:3ac6:9899:87c4 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://arcticwolf.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

access-control-allow-origin: https://arcticwolf.com
date: Tue, 07 Nov 2023 16:48:35 GMT
access-control-allow-credentials: true
content-length: 0
access-control-allow-methods: GET,HEAD,PUT,PATCH,POST,DELETE
content-type: application/json

POST
H/1.1 204
No Content collect Show response
v.clarity.ms/ Frame 19AA 0
294 B 186ms
185ms XHR
text/plain 20.114.189.135
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://v.clarity.ms/collect
Requested by: Host: www.clarity.ms
URL: https://www.clarity.ms/s/0.7.13/clarity.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 20.114.189.135 Boydton, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: application/x-clarity-gzip
Referer: https://arcticwolf.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

Access-Control-Allow-Origin: https://arcticwolf.com
Date: Tue, 07 Nov 2023 16:48:35 GMT
Access-Control-Allow-Credentials: true
Server: nginx/1.18.0 (Ubuntu)
Connection: keep-alive
Vary: Origin
Request-Context: appId=cid-v1:3f60b293-70d6-4805-b0bb-3484f0a73bf0

GET
H2 200 / Show response
c.6sc.co/ 7 B
193 B 42ms
41ms XHR
text/html 23.38.98.66
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://c.6sc.co/
Requested by: Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.38.98.66 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a23-38-98-66.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: fe04a9dc88d3f3be8d4f6bc63a9a80f45a4c6d8460e7551dab849457c091920a

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://arcticwolf.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 16:48:35 GMT
access-control-max-age: 86400
access-control-allow-methods: GET,POST
content-type: text/html
access-control-allow-origin: https://arcticwolf.com
access-control-allow-credentials: true
access-control-allow-headers: *
content-length: 7

GET
H2 200 / Show response
ipv6.6sc.co/ 19 B
308 B 211ms
39ms XHR
text/html 2a02:26f0:7100::210:180
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://ipv6.6sc.co/
Requested by: Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:7100::210:180 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: /
Resource Hash: c0ad39faea959c6452ccf07bbf3c65bf7f5e1afa8df00d05cfbb1087a8aee9ac

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://arcticwolf.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 07 Nov 2023 16:48:35 GMT
vary: Origin
content-type: text/html
access-control-allow-origin: https://arcticwolf.com
cache-control: max-age=0, no-cache, no-store
6si-ipv6: 2a01:4a0:1338:92::6
server-timing: cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="1699375715638_34603388_22404218_19_980_39_90_219";dur=1
content-length: 19
expires: Tue, 07 Nov 2023 16:48:35 GMT

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
486 B 254ms
244ms Image
image/gif 23.38.98.66
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=468ce208ecea2d45efbf04ec75c998b4&svisitor=null&visitor=d8296237-13f5-43c2-8045-4708843062dc&session=2613a055-3ea6-4c91-8478-fc8d45f45f6b&event=a_pageload&q=%7B%22pageLoadTime%22%3A%22Tue%2C%2007%20Nov%202023%2016%3A48%3A31%20GMT%22%7D&isIframe=false&m=%7B%22description%22%3A%22Arctic%20Wolf%20Labs%20observed%20several%20ransomware%20cases%20involving%20a%20remote%20code%20execution%20vulnerability%20in%20Apache%20ActiveMQ.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Exploitation%20of%20CVE-2023-46604%20Leading%20to%20Ransomware%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Farcticwolf.com%2Fresources%2Fblog%2Ftellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware%2F&pageViewId=e09d2748-cc15-4f2a-85d8-c226f4ec3236&v=1.1.7

Requested by

Host: arcticwolf.com
URL: https://arcticwolf.com/resources/blog/tellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.38.98.66 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a23-38-98-66.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://arcticwolf.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 16:48:35 GMT
x-content-type-options: nosniff
content-length: 43
pragma: no-cache
last-modified: Sat, 18 Feb 2023 01:45:17 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "63f02dad-2b"
access-control-max-age: 86400
access-control-allow-methods: GET,POST
content-type: image/gif
access-control-allow-origin
cache-control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: *
expires: Wed, 19 Apr 2000 11:43:00 GMT

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
485 B 252ms
242ms Image
image/gif 23.38.98.66
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=468ce208ecea2d45efbf04ec75c998b4&svisitor=null&visitor=d8296237-13f5-43c2-8045-4708843062dc&session=2613a055-3ea6-4c91-8478-fc8d45f45f6b&event=ni%3AasyncSettingsAudit&q=%7B%22settings%22%3A%22%5B%7B%5C%22name%5C%22%3A%5C%22enableEventTracking%5C%22%2C%5C%22value%5C%22%3A%5C%22true%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Tue%2C%2007%20Nov%202023%2016%3A48%3A31%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setToken%5C%22%2C%5C%22value%5C%22%3A%5C%22468ce208ecea2d45efbf04ec75c998b4%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Tue%2C%2007%20Nov%202023%2016%3A48%3A31%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22enableCompanyDetails%5C%22%2C%5C%22value%5C%22%3A%5C%22%5Btrue%2Cnull%5D%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Tue%2C%2007%20Nov%202023%2016%3A48%3A31%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setEpsilonKey%5C%22%2C%5C%22value%5C%22%3A%5C%2293d84380defe58ab6807a488e1f54b53e6882408%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Tue%2C%2007%20Nov%202023%2016%3A48%3A31%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%5D%22%7D&isIframe=false&m=%7B%22description%22%3A%22Arctic%20Wolf%20Labs%20observed%20several%20ransomware%20cases%20involving%20a%20remote%20code%20execution%20vulnerability%20in%20Apache%20ActiveMQ.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Exploitation%20of%20CVE-2023-46604%20Leading%20to%20Ransomware%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Farcticwolf.com%2Fresources%2Fblog%2Ftellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware%2F&pageViewId=e09d2748-cc15-4f2a-85d8-c226f4ec3236&v=1.1.7

Requested by

Host: arcticwolf.com
URL: https://arcticwolf.com/resources/blog/tellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.38.98.66 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a23-38-98-66.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://arcticwolf.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 16:48:35 GMT
x-content-type-options: nosniff
content-length: 43
pragma: no-cache
last-modified: Tue, 05 Oct 2021 22:17:52 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "615ccf10-2b"
access-control-max-age: 86400
access-control-allow-methods: GET,POST
content-type: image/gif
access-control-allow-origin
cache-control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: *
expires: Wed, 19 Apr 2000 11:43:00 GMT

GET
H2 200 core Show response
js.driftt.com/ Frame CCFA 2 KB
1 KB 355ms
355ms Document
text/html 18.245.86.73
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core?d=1&embedId=zaxd53bdwtvy&eId=zaxd53bdwtvy&region=US&forceShow=false&skipCampaigns=false&sessionId=3746222f-280d-4d84-8ab3-990ff4680b50&sessionStarted=1699375715.546&campaignRefreshToken=959eaf2e-9498-42aa-88c2-83fe2e027f06&hideController=false&pageLoadStartTime=1699375708552&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Farcticwolf.com%2Fresources%2Fblog%2Ftellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware%2F

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/include/1699375800000/zaxd53bdwtvy.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.245.86.73 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-245-86-73.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

d4ce77a1972c9d30713fba68f8f7f883cf72ceeb6311f0c05ff02463c20a59a7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://arcticwolf.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: *
cache-control: no-cache
content-encoding: gzip
content-type: text/html; charset=utf-8
date: Tue, 07 Nov 2023 16:48:35 GMT
etag: W/"a90a231e6851ac9b145db6d2a4739d1c"
last-modified: Fri, 03 Nov 2023 17:04:21 GMT
server: istio-envoy
strict-transport-security: max-age=31536000; includeSubDomains
vary: Accept-Encoding
via: 1.1 1c3c1c03f4bbd4e68725363918cb3454.cloudfront.net (CloudFront)
x-amz-cf-id: CWP_Dwa5WDKQmfs-3_IqPNEMfZ7oUZHjokyqs0_4cjajLQ5Frj391A==
x-amz-cf-pop: FRA60-P6
x-amz-server-side-encryption: AES256
x-amz-version-id: R.hx5A1_3qwP6wsYE_5FH3HFM2wbSV91
x-cache: RefreshHit from cloudfront
x-envoy-upstream-service-time: 20

GET
H2 200 chat Show response
js.driftt.com/core/ Frame 41CD 2 KB
1 KB 148ms
148ms Document
text/html 18.245.86.73
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1699375708552

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/include/1699375800000/zaxd53bdwtvy.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.245.86.73 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-245-86-73.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

d4ce77a1972c9d30713fba68f8f7f883cf72ceeb6311f0c05ff02463c20a59a7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://arcticwolf.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: *
cache-control: no-cache
content-encoding: gzip
content-type: text/html; charset=utf-8
date: Tue, 07 Nov 2023 16:48:35 GMT
etag: W/"a90a231e6851ac9b145db6d2a4739d1c"
last-modified: Fri, 03 Nov 2023 17:04:21 GMT
server: istio-envoy
strict-transport-security: max-age=31536000; includeSubDomains
vary: Accept-Encoding
via: 1.1 1c3c1c03f4bbd4e68725363918cb3454.cloudfront.net (CloudFront)
x-amz-cf-id: SO1IVkrkbqVKQr1e3eGgY1TmnuILPiHj3hGm168N4ZOjfEkFw0ZSSg==
x-amz-cf-pop: FRA60-P6
x-amz-server-side-encryption: AES256
x-amz-version-id: R.hx5A1_3qwP6wsYE_5FH3HFM2wbSV91
x-cache: RefreshHit from cloudfront
x-envoy-upstream-service-time: 13

GET
H2 200 zi-tag.js Show response
js.zi-scripts.com/ 8 KB
3 KB 167ms
61ms Script
application/javascript 104.18.37.212
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js.zi-scripts.com/zi-tag.js
Requested by: Host: arcticwolf.com
URL: https://arcticwolf.com/resources/blog/tellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.37.212 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f9a144d016db30ba861af6f2464d3df7bd55240b2c1b9635d6e2527320ec81ea

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://arcticwolf.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 16:48:35 GMT
x-amz-version-id: E1WmCtCijJ51e17CdkS6A0kAshBxGSzY
content-encoding: gzip
cf-cache-status: DYNAMIC
last-modified: Thu, 19 Oct 2023 07:00:40 GMT
server: cloudflare
via: 1.1 e59bea79ab5f15feda92136bc7b74158.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-P4
etag: W/"d08bc8c5ca973ebe8c18a64c74607654"
age: 55530
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
cf-ray: 8227108f8cae048f-FRA
x-amz-cf-id: 1tH-BuJp8fTAJE9V5JEQiXk31nIkiZxUotikNN_1rCRUx1RCeJADpw==

GET
H2 200 c.gif
c.clarity.ms/ 42 B
105 B 57ms
57ms Image
image/gif 68.219.88.97
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://c.clarity.ms/c.gif
Requested by: Host: www.clarity.ms
URL: https://www.clarity.ms/tag/uet/26066703
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 68.219.88.97 Dublin, Ireland, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: 99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://arcticwolf.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 07 Nov 2023 16:48:35 GMT
last-modified: Wed, 30 Aug 2023 19:01:41 GMT
server: Microsoft-IIS/10.0
etag: "8d59566974dbd91:0"
x-powered-by: ASP.NET
content-type: image/gif
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
cache-control: private, no-cache, proxy-revalidate, no-store
accept-ranges: bytes
content-length: 42

GET
H2 200 industry-analysis-icon-lt-blue-150-150x150.png
marvel-b1-cdn.bc0a.com/f00000000241276/arcticwolf.com/wp-content/uploads/2021/12/ 4 KB
4 KB 71ms
68ms Image
image/webp 2600:9000:2250:b000:0:f267:a5c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://marvel-b1-cdn.bc0a.com/f00000000241276/arcticwolf.com/wp-content/uploads/2021/12/industry-analysis-icon-lt-blue-150-150x150.png
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2250:b000:0:f267:a5c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: b3d36d39115b608d02cd408b59c420c2256829708ca19c8bedc46bf3b51bb2ad

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://arcticwolf.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

x-amz-version-id: WwBvoeouUUVJl3AEV.2d3epLhSyOXm74
date: Tue, 07 Nov 2023 01:20:33 GMT
via: 1.1 0121ceb2efadb6db52d122a8b6b52f90.cloudfront.net (CloudFront)
x-amz-request-id: 6Q9GXJP2FMXNYPJ4
x-amz-cf-pop: FRA60-P2
age: 55683
x-cache: Hit from cloudfront
content-length: 3602
x-amz-id-2: mVBc++AsT0v235E5Qf6vCX0U9w6/A0s/keDaOh7u3Pp3xlManITyF0CB2k1U5fI+94jcc0h78BM=
x-amz-expiration: expiry-date="Fri, 14 Feb 2025 00:00:00 GMT", rule-id="delete-old-images"
last-modified: Fri, 20 May 2022 18:48:01 GMT
server: AmazonS3
etag: "3960958584d4e70afc552b723cff74d9"
content-type: image/webp
access-control-allow-origin: *
cache-control: max-age=31536000
accept-ranges: bytes
x-amz-cf-id: xAOhTwqMRtHjHi3Mdd6WJ4U8Hc35ITrC_gCCYPri05jo83ZWRJaZsw==

GET
H2 200 award-icon-lt-blue-2.png
marvel-b1-cdn.bc0a.com/f00000000241276/arcticwolf.com/wp-content/uploads/2021/12/ 2 KB
2 KB 69ms
67ms Image
image/webp 2600:9000:2250:b000:0:f267:a5c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://marvel-b1-cdn.bc0a.com/f00000000241276/arcticwolf.com/wp-content/uploads/2021/12/award-icon-lt-blue-2.png
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2250:b000:0:f267:a5c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 2c566e98adbf310d99ae43a94b1f6f2ab9b19950ec5986897ed53483c66c5b18

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://arcticwolf.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

x-amz-version-id: QZ09zEuX_WNGZCIZbym6v.1lFEG5B5y3
date: Tue, 07 Nov 2023 01:20:33 GMT
via: 1.1 0121ceb2efadb6db52d122a8b6b52f90.cloudfront.net (CloudFront)
x-amz-request-id: 4DNS2XVXK6669QQX
x-amz-cf-pop: FRA60-P2
age: 55683
x-cache: Hit from cloudfront
content-length: 1694
x-amz-id-2: OOz5XwrWb1o/2f9nB1hnprws6Rw7sFcPMWZn5xjeeq91kJlwiP8/mfp7Qm6qyuVhtRcwrYTZLd0=
x-amz-expiration: expiry-date="Fri, 14 Feb 2025 00:00:00 GMT", rule-id="delete-old-images"
last-modified: Fri, 20 May 2022 18:48:02 GMT
server: AmazonS3
etag: "b1b2bf0400cac33b71b335538917f8c2"
content-type: image/webp
access-control-allow-origin: *
cache-control: max-age=31536000
accept-ranges: bytes
x-amz-cf-id: vf2PTkX-o7OzBHCreGaViwUKL7Ak4_Bb_4Vk3BcIC-IaUom0MTE02A==

GET
H2 200 Case-study-icon-lt-blue.png
marvel-b1-cdn.bc0a.com/f00000000241276/arcticwolf.com/wp-content/uploads/2021/12/ 866 B
1 KB 67ms
66ms Image
image/webp 2600:9000:2250:b000:0:f267:a5c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://marvel-b1-cdn.bc0a.com/f00000000241276/arcticwolf.com/wp-content/uploads/2021/12/Case-study-icon-lt-blue.png
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2250:b000:0:f267:a5c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 9201d355e85a0a2c97cfd63112d7d4d5e81e9311c359f6174031f51b71610f86

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://arcticwolf.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

x-amz-version-id: Olb4Qro43hu2C.9dzlbwSCJokLdYjW0l
date: Tue, 07 Nov 2023 05:11:17 GMT
via: 1.1 0121ceb2efadb6db52d122a8b6b52f90.cloudfront.net (CloudFront)
x-amz-request-id: 6D73YP36DSXTPME4
x-amz-cf-pop: FRA60-P2
age: 41839
x-cache: Hit from cloudfront
content-length: 866
x-amz-id-2: oXWVwPRNStJWmU+HbVrqlkTCzQcIJMxz3/RByY5DHAdn6ZVgbiINLDjzHToTJtaI4oPrrUmYC5Q=
x-amz-expiration: expiry-date="Fri, 14 Feb 2025 00:00:00 GMT", rule-id="delete-old-images"
last-modified: Fri, 20 May 2022 18:48:01 GMT
server: AmazonS3
etag: "113d333ecb96b62d74fc3e92828a2a41"
content-type: image/webp
access-control-allow-origin: *
cache-control: max-age=31536000
accept-ranges: bytes
x-amz-cf-id: _jXUuRjbKy5icciamJbk5XlkvCTWkwaAXGcHiaY_yQEnIepVPL-IoA==

GET
H2 200 runtime~main.2181e5a7.js Show response
js.driftt.com/core/assets/js/ Frame 41CD 6 KB
3 KB 42ms
40ms Script
application/javascript 18.245.86.73
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/runtime~main.2181e5a7.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1699375708552

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.245.86.73 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-245-86-73.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

dc44c31fed9046e1a602efa34cd714bd578742e1341b6e465a060aef588bea94

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1699375708552
Origin: https://js.driftt.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Fri, 03 Nov 2023 17:04:20 GMT
x-amz-version-id: CIDiT98iKAiYvLWJfHx9KvgLiCsSJiUf
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 1c3c1c03f4bbd4e68725363918cb3454.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P6
age: 344655
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 16
last-modified: Fri, 03 Nov 2023 16:05:59 GMT
server: istio-envoy
etag: W/"d61c5e6383646411c77e936a05d1fc4d"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: pcRXgbBf4R_XMSdvHo4797Qsw9KvjFOgU5Th165ioV88ea_m6vozfg==

GET
H2 200 9.4a3e9801.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 41CD 35 KB
13 KB 47ms
45ms Script
application/javascript 18.245.86.73
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/9.4a3e9801.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1699375708552

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.245.86.73 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-245-86-73.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

2a8a441d8086f20a64563edc759aba1de84d932e34ff77b8bb0279a730cdb428

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1699375708552
Origin: https://js.driftt.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Fri, 21 Jul 2023 01:18:07 GMT
x-amz-version-id: q5pTVpOtKy3mkc3tgJvo47OHqvdilate
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 1c3c1c03f4bbd4e68725363918cb3454.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P6
age: 9473427
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 17
last-modified: Thu, 20 Jul 2023 18:22:11 GMT
server: istio-envoy
etag: W/"c6f58dd3d60f07462254b842dd4f9ca1"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: b0Rm7T0S0enD4U2To67PUefGWkv4FPsyE0-dGiOh0v0brfFIL7iVLQ==

GET
H2 200 main~493df0b3.d2a43907.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 41CD 7 KB
3 KB 48ms
46ms Script
application/javascript 18.245.86.73
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/main~493df0b3.d2a43907.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1699375708552

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.245.86.73 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-245-86-73.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

481baffabb9011ae6ffd10103983908ebc2c06e6f6be7797d226ccee04c2172f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1699375708552
Origin: https://js.driftt.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Wed, 20 Sep 2023 08:26:54 GMT
x-amz-version-id: OTiYyuMgyycXvMHseM5MN77RPTRQczpn
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 1c3c1c03f4bbd4e68725363918cb3454.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P6
age: 4177301
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 31
last-modified: Mon, 18 Sep 2023 19:58:07 GMT
server: istio-envoy
etag: W/"e094b276ad2035c3a46871991c258c2d"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: GYK6g-Uo5CVeKG7Gr_DCkH2vgW6PxLtBcUFaHj11zGEzCaqcmMBGWA==

OPTIONS
H2 200 details
epsilon.6sense.com/v3/company/ Frame 0
0 152ms
41ms Preflight 18.194.102.200
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://epsilon.6sense.com/v3/company/details
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.194.102.200 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-194-102-200.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: authorization,x-6s-customid
Access-Control-Request-Method: GET
Origin: https://arcticwolf.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: authorization,x-6s-customid
access-control-allow-methods: OPTIONS,GET
access-control-allow-origin: https://arcticwolf.com
access-control-max-age: 1800
date: Tue, 07 Nov 2023 16:48:35 GMT
server: nginx

GET
H2 200 details Show response
epsilon.6sense.com/v3/company/ 726 B
572 B 312ms
227ms XHR
application/json 18.194.102.200
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://epsilon.6sense.com/v3/company/details
Requested by: Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.194.102.200 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-194-102-200.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 0fe30a881b9d89d4dc8bf8100a8e5550ce4a09232f1cb4c109f105307f77b93b

Request headers

Referer: https://arcticwolf.com/
accept-language: de-DE,de;q=0.9
Authorization: Token 93d84380defe58ab6807a488e1f54b53e6882408
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36
X-6s-CustomID: WebTag1.0 468ce208ecea2d45efbf04ec75c998b4

Response headers

date: Tue, 07 Nov 2023 16:48:36 GMT
content-encoding: gzip
server: nginx
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: https://arcticwolf.com
access-control-allow-credentials: true
content-length: 387

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
485 B 239ms
238ms Image
image/gif 23.38.98.66
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=468ce208ecea2d45efbf04ec75c998b4&svisitor=null&visitor=d8296237-13f5-43c2-8045-4708843062dc&session=2613a055-3ea6-4c91-8478-fc8d45f45f6b&event=ipv6&q=%7B%22address%22%3A%222a01%3A4a0%3A1338%3A92%3A%3A6%22%7D&isIframe=false&m=%7B%22description%22%3A%22Arctic%20Wolf%20Labs%20observed%20several%20ransomware%20cases%20involving%20a%20remote%20code%20execution%20vulnerability%20in%20Apache%20ActiveMQ.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Exploitation%20of%20CVE-2023-46604%20Leading%20to%20Ransomware%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Farcticwolf.com%2Fresources%2Fblog%2Ftellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware%2F&pageViewId=e09d2748-cc15-4f2a-85d8-c226f4ec3236&v=1.1.7

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.38.98.66 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a23-38-98-66.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://arcticwolf.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 16:48:35 GMT
x-content-type-options: nosniff
content-length: 43
pragma: no-cache
last-modified: Fri, 21 Feb 2020 18:57:20 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "5e502810-2b"
access-control-max-age: 86400
access-control-allow-methods: GET,POST
content-type: image/gif
access-control-allow-origin
cache-control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: *
expires: Wed, 19 Apr 2000 11:43:00 GMT

GET
H2 200 51.558be3c5.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 41CD 23 KB
8 KB 46ms
45ms Script
application/javascript 18.245.86.73
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/51.558be3c5.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.2181e5a7.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.245.86.73 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-245-86-73.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

b0af909b7ae6ad2644bfe2a60d939092aaf113b2cbc4ed2981a892869143b98a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1699375708552
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Sun, 24 Sep 2023 02:52:29 GMT
x-amz-version-id: Esj.HZA_tbw6gqPOdguyiXaCinsX9owN
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 1c3c1c03f4bbd4e68725363918cb3454.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P6
age: 3851766
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 19
last-modified: Thu, 21 Sep 2023 18:21:36 GMT
server: istio-envoy
etag: W/"fa281fcbe4b2e35558d60fae3e316367"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: NqCqz6K4Dbc45ICOkuTALcP_VJy8hTsiIlJMGDJQJkeVk73FYeYUjg==

GET
H2 200 35.d0f1ccda.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 41CD 36 KB
10 KB 48ms
47ms Script
application/javascript 18.245.86.73
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/35.d0f1ccda.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.2181e5a7.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.245.86.73 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-245-86-73.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

e0c6f8695589df90e63442fee1c9cf14e60dfc4fd8ce7296515b1d6db41e1d3d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1699375708552
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Wed, 20 Sep 2023 01:19:18 GMT
x-amz-version-id: 28EWWIrfyXnbH9o_fCp_ZuBJ9aAwW8z2
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 1c3c1c03f4bbd4e68725363918cb3454.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P6
age: 4202957
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 33
last-modified: Mon, 18 Sep 2023 19:58:05 GMT
server: istio-envoy
etag: W/"46fa5a7bc37a22544a908e4ad950309c"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: L1Ezk29WZoIGSG4Zv-6M7Vc-MhyF5DiKX8T6MaT_ylpGR62GFa7TtA==

GET
H2 200 22.6b9a301a.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 41CD 32 KB
11 KB 52ms
51ms Script
application/javascript 18.245.86.73
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/22.6b9a301a.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.2181e5a7.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.245.86.73 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-245-86-73.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

8f0f8792237470ee661c6afc32ca68200dd74bcc0d544d0fd54c7777af362eae

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1699375708552
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Sun, 24 Sep 2023 04:06:06 GMT
x-amz-version-id: QdsA1eP5upj.c59gGRUMZlWh3VaRO3QX
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 1c3c1c03f4bbd4e68725363918cb3454.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P6
age: 3847349
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 17
last-modified: Fri, 22 Sep 2023 19:55:10 GMT
server: istio-envoy
etag: W/"d8739a9fe9a3a42936f5cd86c8727494"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: 79ezFRiGFzXhWbzAJLn4J4uBWHx0Huyscnj2ItAZZ-c1iEJdAeLR0A==

GET
H2 200 19.6f85b843.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 41CD 17 KB
6 KB 53ms
52ms Script
application/javascript 18.245.86.73
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/19.6f85b843.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.2181e5a7.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.245.86.73 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-245-86-73.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

afbd41e7209fa3aef6f53c7a5713aa542a7be54c432fec2d690e0dfaccd528d1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1699375708552
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Wed, 20 Sep 2023 08:26:54 GMT
x-amz-version-id: sH9o8YkkibMEUbCvCSPhoXTl_6cFk9oY
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 1c3c1c03f4bbd4e68725363918cb3454.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P6
age: 4177301
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 23
last-modified: Mon, 18 Sep 2023 19:58:05 GMT
server: istio-envoy
etag: W/"e28ebc3391b56e8f01ea063dc089e9d3"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: 6KbMvFBgNOmN1Wv3nbeEs1PmD-252WT65-rFvVB_a5_a1Mm_7nnVEw==

GET
H2 200 41.b4fc4de2.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 41CD 25 KB
8 KB 56ms
55ms Script
application/javascript 18.245.86.73
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/41.b4fc4de2.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.2181e5a7.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.245.86.73 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-245-86-73.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

edf1011ad272d21b66ae82a21a9d029186dc81c9f13972203fc3107f75835d4b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1699375708552
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Wed, 20 Sep 2023 08:26:54 GMT
x-amz-version-id: zY0Ou_sLgA4Cobo6T_PpWO3n4_bhl.BX
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 1c3c1c03f4bbd4e68725363918cb3454.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P6
age: 4177301
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 18
last-modified: Mon, 18 Sep 2023 19:58:06 GMT
server: istio-envoy
etag: W/"a2ace4f65aa7b34dedb884f6cfe9df8d"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: u-AA7JWOymSuyrVA5l3CMd5a1C40YLXmm1NAO8EPv-punTNu82o9-A==

GET
H2 200 20.8c21ea18.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 41CD 74 KB
23 KB 61ms
61ms Script
application/javascript 18.245.86.73
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/20.8c21ea18.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.2181e5a7.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.245.86.73 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-245-86-73.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

19473eebfb0672867a4438e2a015de79fded34b9f5ae5598bade57eb01cf0563

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1699375708552
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Sat, 09 Sep 2023 18:42:47 GMT
x-amz-version-id: koF.ql6S6iU4L3DAmCcO8za68l9Cvk6p
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 1c3c1c03f4bbd4e68725363918cb3454.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P6
age: 5090748
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 19
last-modified: Thu, 07 Sep 2023 15:58:12 GMT
server: istio-envoy
etag: W/"6d77a76055d81227033363af2f18caf8"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: t93-p-qs8e-2crxmuVZMUbUMJGZQPwl9UwdrBSH1rFGVlro_FjS62g==

GET
H2 200 26.04e7f30b.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 41CD 66 KB
20 KB 69ms
69ms Script
application/javascript 18.245.86.73
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/26.04e7f30b.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.2181e5a7.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.245.86.73 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-245-86-73.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

d70fa5dc6c8bfe9d7824be31e669528533d0879a2b1600a7df68b880f4d44296

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1699375708552
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Mon, 07 Aug 2023 10:11:06 GMT
x-amz-version-id: QuflpVsRjQoeLsgyzbb2dO87jCp6veQD
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 1c3c1c03f4bbd4e68725363918cb3454.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P6
age: 7972649
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 32
last-modified: Fri, 28 Jul 2023 18:55:10 GMT
server: istio-envoy
etag: W/"49ce5445ddcf5d24ef3badc4eb1a11dd"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: JF8r3k1RVFJja6wmXXKaYTlTI3St6ZzffVR7udYVXE6HdcAjNZFn6g==

GET
H2 200 14.e24a6190.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 41CD 91 KB
28 KB 76ms
69ms Script
application/javascript 18.245.86.73
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/14.e24a6190.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.2181e5a7.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.245.86.73 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-245-86-73.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

6c9c6406c9bd9814cf84974221433003377b67f071ec5411fddbcba4ec109bca

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1699375708552
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Wed, 20 Sep 2023 08:26:54 GMT
x-amz-version-id: mPHV5tAqPye8LylceWqtCyeRVygMz4fc
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 1c3c1c03f4bbd4e68725363918cb3454.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P6
age: 4177301
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 16
last-modified: Mon, 18 Sep 2023 19:58:05 GMT
server: istio-envoy
etag: W/"16d7ae86e21434a32157d3226ac9bb77"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: PYmPxMHVutcrDALYJkgBK52Mz0y_DP3sIPGwAQrleqDog5Kc6UgjCw==

GET
H2 200 11.639238ba.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 41CD 23 KB
7 KB 83ms
76ms Script
application/javascript 18.245.86.73
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/11.639238ba.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.2181e5a7.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.245.86.73 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-245-86-73.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

c501de88fbb90a445f1754a529bc772e7047071bf653c8c3f0330f7bb736d140

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1699375708552
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Wed, 20 Sep 2023 08:26:54 GMT
x-amz-version-id: XlMxTkRfqAYNG4rhc7QwtAO3yzTax5oV
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 1c3c1c03f4bbd4e68725363918cb3454.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P6
age: 4177301
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 23
last-modified: Mon, 18 Sep 2023 19:58:04 GMT
server: istio-envoy
etag: W/"4049f38c00add1738dc4806148ff8829"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: Yg1H-82-4iWeYpsmEKHud_hMhMtkXIVar83jkYyfnvlvBbeKg6-99A==

GET
H2 200 18.9c1bd1fb.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 41CD 62 KB
20 KB 92ms
85ms Script
application/javascript 18.245.86.73
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/18.9c1bd1fb.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.2181e5a7.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.245.86.73 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-245-86-73.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

e555f4b34b579e6528d6bbd4819620a634c0759b41dfa99520b7ca5aa5117b11

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1699375708552
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Mon, 04 Sep 2023 02:55:15 GMT
x-amz-version-id: 9mpbkuyHmd3DbfSHS5sKR7jluuxgLo9E
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 1c3c1c03f4bbd4e68725363918cb3454.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P6
age: 5579600
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 17
last-modified: Sat, 02 Sep 2023 21:37:07 GMT
server: istio-envoy
etag: W/"02f09379c544befa413d22eb57ed41de"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: R3LTW8-ujR9CuiW7NRf578h0is_lxyZkLOsw9c1eVSmIZeF915Qsbw==

GET
H2 200 49.f7274268.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 41CD 105 KB
34 KB 97ms
91ms Script
application/javascript 18.245.86.73
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/49.f7274268.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.2181e5a7.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.245.86.73 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-245-86-73.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

6861a320271e0fda832800e20d53b858ef409f88d9bc9c1a48953888289d1ea3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1699375708552
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Wed, 26 Jul 2023 17:53:19 GMT
x-amz-version-id: nu5YPPYpbxwbA5KeFnNDvED6qjQ46e.5
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 1c3c1c03f4bbd4e68725363918cb3454.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P6
age: 8981716
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 22
last-modified: Wed, 26 Jul 2023 13:14:43 GMT
server: istio-envoy
etag: W/"e268d36b98f0119a2bb1a15f69fd4ffe"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: bG6OaLX4ncYYNb0FOczxKCW39ZV_GKahNVBYv9UjCWJ4C0UFYfYlzA==

GET
H2 200 40.31ef8dbf.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 41CD 12 KB
4 KB 105ms
99ms Script
application/javascript 18.245.86.73
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/40.31ef8dbf.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.2181e5a7.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.245.86.73 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-245-86-73.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

bba54915db71fc417be4d5852ec7d138d7c3fa90356ddee98b5267a7db7e6b5b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1699375708552
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Mon, 25 Sep 2023 22:50:10 GMT
x-amz-version-id: 4vFIc6iMaOHHRPFul3_EyvJfXUuIcmEs
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 1c3c1c03f4bbd4e68725363918cb3454.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P6
age: 3693505
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 19
last-modified: Thu, 21 Sep 2023 18:21:36 GMT
server: istio-envoy
etag: W/"b0793fa46e8c0ae1846b7be8a833da35"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: g_gY87Y0ZHjeVisez0Rdp_QOsqELz5-5gL8-zlv4_g9ycPV_8y6LZw==

GET
H2 200 29.31d09948.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 41CD 13 KB
6 KB 107ms
101ms Script
application/javascript 18.245.86.73
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/29.31d09948.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.2181e5a7.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.245.86.73 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-245-86-73.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

7641f066c35d0ca15d4897bfe49d640ed4c143ff8f04030c2020cbb2acfa7b0b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1699375708552
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Mon, 02 Oct 2023 04:56:51 GMT
x-amz-version-id: PyawGVolC84hpcWm6OWVT0dG84hVjB6f
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 1c3c1c03f4bbd4e68725363918cb3454.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P6
age: 3153104
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 17
last-modified: Thu, 21 Sep 2023 18:21:36 GMT
server: istio-envoy
etag: W/"455157cb49065fb85fed54901ddaeb0e"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: mL3caI3ZypQ5juNcmwPAnpE1RyTDzi0vtBjtUgzqP_bF9Zu4Bl-TqQ==

GET
H2 200 21.b8c41db9.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 41CD 17 KB
7 KB 108ms
102ms Script
application/javascript 18.245.86.73
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/21.b8c41db9.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.2181e5a7.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.245.86.73 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-245-86-73.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

b84595cc8461bb6e8376fe94f0dd23d6657172103b03653534089c5992b058a1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1699375708552
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Wed, 20 Sep 2023 08:26:54 GMT
x-amz-version-id: g1ri2j1Cjjab.VdRD9o2Qfb0pzjBKg2Y
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 1c3c1c03f4bbd4e68725363918cb3454.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P6
age: 4177301
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 19
last-modified: Mon, 18 Sep 2023 19:58:05 GMT
server: istio-envoy
etag: W/"65e5c965272e021ae33ff8bc39565ef5"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: rSu-7ERjsKdyUNC6fGLmHFYYXBykggMTi_TgToUvNfpLrTJsD1OQSA==

GET
H2 200 8.7602338c.chunk.css
js.driftt.com/core/assets/css/ Frame 41CD 31 KB
4 KB 83ms
78ms Stylesheet
text/css 18.245.86.73
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/css/8.7602338c.chunk.css

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.2181e5a7.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.245.86.73 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-245-86-73.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

310de82ec6ba5948814ab8ec2369aa1d437e84e26ac56967fc79897acaa99a95

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1699375708552
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Sat, 30 Sep 2023 01:16:19 GMT
x-amz-version-id: hjTFQAoU.KAgYbJR7bli92DUId80a05s
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 1c3c1c03f4bbd4e68725363918cb3454.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P6
age: 3339136
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 30
last-modified: Thu, 21 Sep 2023 18:21:34 GMT
server: istio-envoy
etag: W/"76d0343f1f9f445c80d5c68c2a35b6e0"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: qmbGm3pMk8_X5q5wWHuzuUcw84VTLqrB-W6sqebkZUeW8BPeWC3ebQ==

GET
H2 200 8.044769eb.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 41CD 81 KB
26 KB 112ms
106ms Script
application/javascript 18.245.86.73
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/8.044769eb.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.2181e5a7.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.245.86.73 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-245-86-73.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

1a942c4e7372897cb501fba0ddb4b51fb3533d71975bd2d9d3a1f39ac5403831

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1699375708552
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Fri, 03 Nov 2023 17:04:21 GMT
x-amz-version-id: 17DfV7s42f89YbincTHPPVmLUV_bhnjp
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 1c3c1c03f4bbd4e68725363918cb3454.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P6
age: 344654
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 52
last-modified: Fri, 03 Nov 2023 16:05:58 GMT
server: istio-envoy
etag: W/"44b93d3484fa424f7b36b2e344e21e24"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: 9m644dveJ40GkHdeusJ67qWuMZmivp7N8kMDieLaU_NOdlNGK0vtNA==

GET
H2 200 16.22abfce0.chunk.css
js.driftt.com/core/assets/css/ Frame 41CD 24 B
695 B 84ms
78ms Stylesheet
text/css 18.245.86.73
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/css/16.22abfce0.chunk.css

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.2181e5a7.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.245.86.73 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-245-86-73.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

5dbaf0a4ff0f8ac8c1b67550eee84390b089604ffaf71183e417636c7e183ac5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1699375708552
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Sat, 09 Sep 2023 18:42:47 GMT
x-amz-version-id: L7ekVthaAMSAcl7y3LfpvLig..DjHOJ0
via: 1.1 1c3c1c03f4bbd4e68725363918cb3454.cloudfront.net (CloudFront)
strict-transport-security: max-age=31536000; includeSubDomains
x-amz-cf-pop: FRA60-P6
age: 5090748
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 15
content-length: 24
last-modified: Thu, 07 Sep 2023 15:58:10 GMT
server: istio-envoy
etag: "0c5dad92482d9a7c7c253510f5082465"
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: XMshVnsHAVpqmyWT1qwU8mOxxC9aeO_UODM89oM1LQDLNEnDfwol7g==

GET
H2 200 16.2394064c.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 41CD 92 KB
24 KB 116ms
111ms Script
application/javascript 18.245.86.73
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/16.2394064c.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.2181e5a7.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.245.86.73 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-245-86-73.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

1f1af18d64fdcfd9d2191eec42881a3e16a482792ff4d1c4a7da67981a51d899

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1699375708552
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Wed, 01 Nov 2023 18:06:41 GMT
x-amz-version-id: E5klQAQs3D4aAXVjfwX8.j3PQlETJSVe
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 1c3c1c03f4bbd4e68725363918cb3454.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P6
age: 513713
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 42
last-modified: Wed, 01 Nov 2023 17:45:49 GMT
server: istio-envoy
etag: W/"b3fe5876c5b8966c8af8f22496366c99"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: Y7DS748ztkzlQB3ZmO-SXB4_v9LZ3aTNK6RxfUF5FNjZGhM95mkqeg==

GET
H2 200 24.242124cd.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 41CD 50 KB
14 KB 118ms
113ms Script
application/javascript 18.245.86.73
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/24.242124cd.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.2181e5a7.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.245.86.73 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-245-86-73.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

94d2e4711b49d624a5da206ae3eb4b179b55cc4104c2573f267e7bf8cc9f2b81

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1699375708552
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Fri, 03 Nov 2023 17:04:21 GMT
x-amz-version-id: jyh0Af4JB7krs5tZHKSdH033tp359Ndt
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 1c3c1c03f4bbd4e68725363918cb3454.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P6
age: 344654
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 19
last-modified: Fri, 03 Nov 2023 16:05:57 GMT
server: istio-envoy
etag: W/"bd940a8e755918cc81131b844a5d232b"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: F-SX0PsM1naMnSiMdOPwWTYMTGQGYAbNH0HtIzPPCncqDQP_4eI7eA==

GET
H2 200 17.500d5eaf.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 41CD 40 KB
13 KB 120ms
115ms Script
application/javascript 18.245.86.73
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/17.500d5eaf.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.2181e5a7.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.245.86.73 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-245-86-73.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

bdfb013c1a0ae23a6ea0a548957c1aa6d48db8ebf2fe6cf2265fbaaa4f3af08a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1699375708552
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Fri, 03 Nov 2023 17:04:21 GMT
x-amz-version-id: 8AiuZsTmJBu55E3_pJEYac7N60hic2NR
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 1c3c1c03f4bbd4e68725363918cb3454.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P6
age: 344654
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 19
last-modified: Fri, 03 Nov 2023 16:05:57 GMT
server: istio-envoy
etag: W/"ffb40021683e5483974aec57c93884b7"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: 3xj6tmYHO8Lmi1wBst3RbklVHwEG1oUWGEJeffpTQAtFOwIY2yWbtQ==

GET
H2 200 AW_Arctic_Labs_logo_icon_skyblue-150x150.png
marvel-b1-cdn.bc0a.com/f00000000241276/arcticwolf.com/wp-content/uploads/2022/09/ 2 KB
3 KB 74ms
73ms Image
image/webp 2600:9000:2250:b000:0:f267:a5c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://marvel-b1-cdn.bc0a.com/f00000000241276/arcticwolf.com/wp-content/uploads/2022/09/AW_Arctic_Labs_logo_icon_skyblue-150x150.png
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2250:b000:0:f267:a5c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: ced3cd3efe4d2a4b52f805214ea9fdb3bc03b623a91000b074a7f1de548f6313

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://arcticwolf.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

x-amz-version-id: oqV94RG1zZ8RC6e4u5oU6gov_ULtHpFX
date: Tue, 07 Nov 2023 04:50:44 GMT
via: 1.1 0121ceb2efadb6db52d122a8b6b52f90.cloudfront.net (CloudFront)
x-amz-request-id: X1PR9RZE9RXE49QR
x-amz-cf-pop: FRA60-P2
x-amz-server-side-encryption: AES256
age: 43072
x-cache: Hit from cloudfront
content-length: 2348
x-amz-id-2: JpaMW28jgvYfSDngN5tqYH7MsBuE+Tc/00tZRwtI0zXhyNmKTww+XhEeympHxDcD7NSqaVZ3pUw=
x-amz-expiration: expiry-date="Thu, 05 Jun 2025 00:00:00 GMT", rule-id="delete-old-images"
last-modified: Thu, 08 Sep 2022 18:49:49 GMT
server: AmazonS3
etag: "538cac9a56f10814fb8c6ad905568407"
content-type: image/webp
access-control-allow-origin: *
cache-control: max-age=31536000
accept-ranges: bytes
x-amz-cf-id: 0pOlpc0WYDNOvjjTchmTnZs5sMGiWO9v8hsqB9-FfFglHXjMmxVyRQ==

GET
H2 200 AW-service-assurance-logo-lt-blue-279x300.png
marvel-b1-cdn.bc0a.com/f00000000241276/arcticwolf.com/wp-content/uploads/2021/12/ 13 KB
14 KB 73ms
72ms Image
image/webp 2600:9000:2250:b000:0:f267:a5c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://marvel-b1-cdn.bc0a.com/f00000000241276/arcticwolf.com/wp-content/uploads/2021/12/AW-service-assurance-logo-lt-blue-279x300.png
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2250:b000:0:f267:a5c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: d6515002ade1e87b59e9ae857fbd6cd2ece4848ecb0da9788d895c6d3016a882

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://arcticwolf.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

x-amz-version-id: _NkfFykpo9I.7O9lMaB1B.yygmfRCpZ0
date: Tue, 07 Nov 2023 03:02:31 GMT
via: 1.1 0121ceb2efadb6db52d122a8b6b52f90.cloudfront.net (CloudFront)
x-amz-request-id: T6CTC0AX0GVWCCB5
x-amz-cf-pop: FRA60-P2
age: 49565
x-cache: Hit from cloudfront
content-length: 13470
x-amz-id-2: ZUJwX1KQtqTfHAbHYcY+lGg6yCcco5SN5g8yg2EgLUSa+q2UIvKPPKL4OlkIdxs3kT0NfsuJHIk=
x-amz-expiration: expiry-date="Fri, 14 Feb 2025 00:00:00 GMT", rule-id="delete-old-images"
last-modified: Fri, 20 May 2022 18:48:02 GMT
server: AmazonS3
etag: "762d9f3f10dde7cbfca06629c602ac8d"
content-type: image/webp
access-control-allow-origin: *
cache-control: max-age=31536000
accept-ranges: bytes
x-amz-cf-id: BZq6qS5sUozUHGTBo5FOnxXy7aDpG10Qo-bXGP5v3_ntfgQDcmqxrA==

OPTIONS
H2 204 getSubscriptions
js.zi-scripts.com/unified/v1/master/ Frame 0
0 300ms
211ms Preflight 104.18.37.212
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js.zi-scripts.com/unified/v1/master/getSubscriptions
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.37.212 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: authorization,content-type,visited_url
Access-Control-Request-Method: GET
Origin: https://arcticwolf.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

access-control-allow-headers: *
access-control-allow-methods: *
access-control-allow-origin: *
access-control-max-age: 0
apigw-requestid: OCWPrhejPHcEP_A=
cf-cache-status: DYNAMIC
cf-ray: 822710907abd4daa-FRA
date: Tue, 07 Nov 2023 16:48:36 GMT
server: cloudflare
vary: Access-Control-Request-Headers
via: 1.1 94328d2509009edc0657f5c786a93e42.cloudfront.net (CloudFront)
x-amz-cf-id: zUJaH4k_UIw2_MJz1wsU8RgB3yGHtmJYrNAz9_y2vOwroGiX1_o0yg==
x-amz-cf-pop: FRA56-P4
x-cache: Miss from cloudfront
x-powered-by: Express

GET
H2 200 getSubscriptions Show response
js.zi-scripts.com/unified/v1/master/ 195 B
441 B 203ms
202ms Fetch
application/json 104.18.37.212
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js.zi-scripts.com/unified/v1/master/getSubscriptions
Requested by: Host: js.zi-scripts.com
URL: https://js.zi-scripts.com/zi-tag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.37.212 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash: 4012bd9589748b7b55e2916882b8a3c57042758d4d3ffb3b5cc4dc88ae10a6b3

Request headers

Content-Type: application/json
Referer: https://arcticwolf.com/
accept-language: de-DE,de;q=0.9
Authorization: Bearer 66a7a829411679931395
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36
visited_url: https://arcticwolf.com/resources/blog/tellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware/

Response headers

date: Tue, 07 Nov 2023 16:48:36 GMT
via: 1.1 ade2b5e2170ccd4f394b741b27bb0eec.cloudfront.net (CloudFront)
content-encoding: gzip
cf-cache-status: DYNAMIC
server: cloudflare
x-amz-cf-pop: FRA56-P4
x-powered-by: Express
etag: W/"c3-MCmLmvozGYxKi/ZWWqObpzjeG8E"
x-cache: Miss from cloudfront
content-type: application/json; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cf-ray: 82271091dcfd4daa-FRA
x-amz-cf-id: 1XXkbWt6mSsFcnELO7V21Ak54y6FA5XHG38W7jjgjcTo2FoKWy2rMg==
apigw-requestid: OCWPtjA5PHcEMVA=

GET
H2 200 runtime~main.2181e5a7.js Show response
js.driftt.com/core/assets/js/ Frame CCFA 6 KB
3 KB 41ms
40ms Script
application/javascript 18.245.86.73
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/runtime~main.2181e5a7.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core?d=1&embedId=zaxd53bdwtvy&eId=zaxd53bdwtvy&region=US&forceShow=false&skipCampaigns=false&sessionId=3746222f-280d-4d84-8ab3-990ff4680b50&sessionStarted=1699375715.546&campaignRefreshToken=959eaf2e-9498-42aa-88c2-83fe2e027f06&hideController=false&pageLoadStartTime=1699375708552&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Farcticwolf.com%2Fresources%2Fblog%2Ftellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware%2F

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.245.86.73 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-245-86-73.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

dc44c31fed9046e1a602efa34cd714bd578742e1341b6e465a060aef588bea94

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://js.driftt.com/core?d=1&embedId=zaxd53bdwtvy&eId=zaxd53bdwtvy&region=US&forceShow=false&skipCampaigns=false&sessionId=3746222f-280d-4d84-8ab3-990ff4680b50&sessionStarted=1699375715.546&campaignRefreshToken=959eaf2e-9498-42aa-88c2-83fe2e027f06&hideController=false&pageLoadStartTime=1699375708552&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Farcticwolf.com%2Fresources%2Fblog%2Ftellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware%2F
Origin: https://js.driftt.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Fri, 03 Nov 2023 17:04:20 GMT
x-amz-version-id: CIDiT98iKAiYvLWJfHx9KvgLiCsSJiUf
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 1c3c1c03f4bbd4e68725363918cb3454.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P6
age: 344655
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 16
last-modified: Fri, 03 Nov 2023 16:05:59 GMT
server: istio-envoy
etag: W/"d61c5e6383646411c77e936a05d1fc4d"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: V6iE_6X6RwguLZOz4cFlTLPy9lERlp6GxTtBtwEuxV-SVNMOWVORBw==

GET
H2 200 9.4a3e9801.chunk.js Show response
js.driftt.com/core/assets/js/ Frame CCFA 35 KB
13 KB 42ms
42ms Script
application/javascript 18.245.86.73
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/9.4a3e9801.chunk.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.245.86.73 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-245-86-73.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

2a8a441d8086f20a64563edc759aba1de84d932e34ff77b8bb0279a730cdb428

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://js.driftt.com/core?d=1&embedId=zaxd53bdwtvy&eId=zaxd53bdwtvy&region=US&forceShow=false&skipCampaigns=false&sessionId=3746222f-280d-4d84-8ab3-990ff4680b50&sessionStarted=1699375715.546&campaignRefreshToken=959eaf2e-9498-42aa-88c2-83fe2e027f06&hideController=false&pageLoadStartTime=1699375708552&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Farcticwolf.com%2Fresources%2Fblog%2Ftellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware%2F
Origin: https://js.driftt.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Fri, 21 Jul 2023 01:18:07 GMT
x-amz-version-id: q5pTVpOtKy3mkc3tgJvo47OHqvdilate
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 1c3c1c03f4bbd4e68725363918cb3454.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P6
age: 9473427
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 17
last-modified: Thu, 20 Jul 2023 18:22:11 GMT
server: istio-envoy
etag: W/"c6f58dd3d60f07462254b842dd4f9ca1"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: _ceGc6yD5NhXvLbcskXvlQ7uEfiYgYtUwl3Ac_gyh8NGkhFnEuufvw==

GET
H2 200 main~493df0b3.d2a43907.chunk.js Show response
js.driftt.com/core/assets/js/ Frame CCFA 7 KB
3 KB 43ms
43ms Script
application/javascript 18.245.86.73
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/main~493df0b3.d2a43907.chunk.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.245.86.73 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-245-86-73.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

481baffabb9011ae6ffd10103983908ebc2c06e6f6be7797d226ccee04c2172f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://js.driftt.com/core?d=1&embedId=zaxd53bdwtvy&eId=zaxd53bdwtvy&region=US&forceShow=false&skipCampaigns=false&sessionId=3746222f-280d-4d84-8ab3-990ff4680b50&sessionStarted=1699375715.546&campaignRefreshToken=959eaf2e-9498-42aa-88c2-83fe2e027f06&hideController=false&pageLoadStartTime=1699375708552&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Farcticwolf.com%2Fresources%2Fblog%2Ftellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware%2F
Origin: https://js.driftt.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Wed, 20 Sep 2023 08:26:54 GMT
x-amz-version-id: OTiYyuMgyycXvMHseM5MN77RPTRQczpn
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 1c3c1c03f4bbd4e68725363918cb3454.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P6
age: 4177301
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 31
last-modified: Mon, 18 Sep 2023 19:58:07 GMT
server: istio-envoy
etag: W/"e094b276ad2035c3a46871991c258c2d"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: tSSrkrxkrgr2vauMo9g6kJvzuhq9Elz_EloEkHo5Murj8-g794mI_A==

GET
H2 200 37.11d2b6a7.chunk.css
js.driftt.com/core/assets/css/ Frame 41CD 3 KB
1 KB 40ms
39ms Stylesheet
text/css 18.245.86.73
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/css/37.11d2b6a7.chunk.css

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.2181e5a7.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.245.86.73 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-245-86-73.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

e40b6eae9d66c60b9c750da70da6b2bc5d35c2ae9689cc1e9547e300fac4a3ba

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1699375708552
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Sat, 30 Sep 2023 01:16:20 GMT
x-amz-version-id: Hu5iSIFN36zIxSOSUYZtBnss99Os2EQi
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 1c3c1c03f4bbd4e68725363918cb3454.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P6
age: 3339136
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 71
last-modified: Thu, 21 Sep 2023 18:21:33 GMT
server: istio-envoy
etag: W/"87532c4db85f1429fa6d759bc3332f36"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: kjW5O4TGMn9QS0EzIze-uGAWFq7R236E2U6mIIDodfSPr4qPBtLeIQ==

GET
H2 200 37.298cbb69.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 41CD 3 KB
2 KB 41ms
40ms Script
application/javascript 18.245.86.73
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/37.298cbb69.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.2181e5a7.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.245.86.73 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-245-86-73.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

c640d911a58cc3ef31b1a3c2090fa753c948902033b9917ab5daef4fbb33b5d2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1699375708552
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Thu, 21 Sep 2023 00:14:58 GMT
x-amz-version-id: PUAI0__GdQuv9OUrb9AbmioJKXyFo.FH
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 1c3c1c03f4bbd4e68725363918cb3454.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P6
age: 4120418
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 102
last-modified: Fri, 15 Sep 2023 20:51:07 GMT
server: istio-envoy
etag: W/"86b289eeb2bf9d30034f30d9794e8041"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: MrdNeNBeHmFUcpyw1yRHKSPBDxBPLYfsdgLgMIletRW25Jj0du-SxQ==

GET
H2 200 51.558be3c5.chunk.js Show response
js.driftt.com/core/assets/js/ Frame CCFA 23 KB
8 KB 47ms
42ms Script
application/javascript 18.245.86.73
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/51.558be3c5.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.2181e5a7.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.245.86.73 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-245-86-73.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

b0af909b7ae6ad2644bfe2a60d939092aaf113b2cbc4ed2981a892869143b98a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core?d=1&embedId=zaxd53bdwtvy&eId=zaxd53bdwtvy&region=US&forceShow=false&skipCampaigns=false&sessionId=3746222f-280d-4d84-8ab3-990ff4680b50&sessionStarted=1699375715.546&campaignRefreshToken=959eaf2e-9498-42aa-88c2-83fe2e027f06&hideController=false&pageLoadStartTime=1699375708552&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Farcticwolf.com%2Fresources%2Fblog%2Ftellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware%2F
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Sun, 24 Sep 2023 02:52:29 GMT
x-amz-version-id: Esj.HZA_tbw6gqPOdguyiXaCinsX9owN
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 1c3c1c03f4bbd4e68725363918cb3454.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P6
age: 3851767
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 19
last-modified: Thu, 21 Sep 2023 18:21:36 GMT
server: istio-envoy
etag: W/"fa281fcbe4b2e35558d60fae3e316367"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: 3oYkxFfFkKsbcXk7UY7ehT1DW4x11LJ7AzJBh8aQ6nkVAe3Ce06xgw==

GET
H2 200 35.d0f1ccda.chunk.js Show response
js.driftt.com/core/assets/js/ Frame CCFA 36 KB
10 KB 49ms
43ms Script
application/javascript 18.245.86.73
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/35.d0f1ccda.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.2181e5a7.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.245.86.73 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-245-86-73.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

e0c6f8695589df90e63442fee1c9cf14e60dfc4fd8ce7296515b1d6db41e1d3d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core?d=1&embedId=zaxd53bdwtvy&eId=zaxd53bdwtvy&region=US&forceShow=false&skipCampaigns=false&sessionId=3746222f-280d-4d84-8ab3-990ff4680b50&sessionStarted=1699375715.546&campaignRefreshToken=959eaf2e-9498-42aa-88c2-83fe2e027f06&hideController=false&pageLoadStartTime=1699375708552&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Farcticwolf.com%2Fresources%2Fblog%2Ftellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware%2F
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Wed, 20 Sep 2023 01:19:18 GMT
x-amz-version-id: 28EWWIrfyXnbH9o_fCp_ZuBJ9aAwW8z2
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 1c3c1c03f4bbd4e68725363918cb3454.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P6
age: 4202958
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 33
last-modified: Mon, 18 Sep 2023 19:58:05 GMT
server: istio-envoy
etag: W/"46fa5a7bc37a22544a908e4ad950309c"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: iTZSSM2bv5JAolqIdKOijxryQmnM-09W0Co8YtnnT3sGSkTn4skA4A==

GET
H2 200 22.6b9a301a.chunk.js Show response
js.driftt.com/core/assets/js/ Frame CCFA 32 KB
11 KB 50ms
45ms Script
application/javascript 18.245.86.73
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/22.6b9a301a.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.2181e5a7.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.245.86.73 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-245-86-73.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

8f0f8792237470ee661c6afc32ca68200dd74bcc0d544d0fd54c7777af362eae

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core?d=1&embedId=zaxd53bdwtvy&eId=zaxd53bdwtvy&region=US&forceShow=false&skipCampaigns=false&sessionId=3746222f-280d-4d84-8ab3-990ff4680b50&sessionStarted=1699375715.546&campaignRefreshToken=959eaf2e-9498-42aa-88c2-83fe2e027f06&hideController=false&pageLoadStartTime=1699375708552&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Farcticwolf.com%2Fresources%2Fblog%2Ftellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware%2F
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Sun, 24 Sep 2023 04:06:06 GMT
x-amz-version-id: QdsA1eP5upj.c59gGRUMZlWh3VaRO3QX
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 1c3c1c03f4bbd4e68725363918cb3454.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P6
age: 3847350
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 17
last-modified: Fri, 22 Sep 2023 19:55:10 GMT
server: istio-envoy
etag: W/"d8739a9fe9a3a42936f5cd86c8727494"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: _TsKCXQQF-oiPHaiDFrMHD00pCDOKhtbZnRhPMawVhkdroPcwMtAQQ==

GET
H2 200 19.6f85b843.chunk.js Show response
js.driftt.com/core/assets/js/ Frame CCFA 17 KB
6 KB 51ms
47ms Script
application/javascript 18.245.86.73
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/19.6f85b843.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.2181e5a7.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.245.86.73 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-245-86-73.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

afbd41e7209fa3aef6f53c7a5713aa542a7be54c432fec2d690e0dfaccd528d1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core?d=1&embedId=zaxd53bdwtvy&eId=zaxd53bdwtvy&region=US&forceShow=false&skipCampaigns=false&sessionId=3746222f-280d-4d84-8ab3-990ff4680b50&sessionStarted=1699375715.546&campaignRefreshToken=959eaf2e-9498-42aa-88c2-83fe2e027f06&hideController=false&pageLoadStartTime=1699375708552&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Farcticwolf.com%2Fresources%2Fblog%2Ftellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware%2F
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Wed, 20 Sep 2023 08:26:54 GMT
x-amz-version-id: sH9o8YkkibMEUbCvCSPhoXTl_6cFk9oY
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 1c3c1c03f4bbd4e68725363918cb3454.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P6
age: 4177302
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 23
last-modified: Mon, 18 Sep 2023 19:58:05 GMT
server: istio-envoy
etag: W/"e28ebc3391b56e8f01ea063dc089e9d3"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: irzdq5uaoCkN8_Oul0n7PvyOsTgOJmKsBe4Uzn-dIXQ-vKZUwdTfDQ==

GET
H2 200 41.b4fc4de2.chunk.js Show response
js.driftt.com/core/assets/js/ Frame CCFA 25 KB
8 KB 52ms
47ms Script
application/javascript 18.245.86.73
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/41.b4fc4de2.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.2181e5a7.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.245.86.73 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-245-86-73.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

edf1011ad272d21b66ae82a21a9d029186dc81c9f13972203fc3107f75835d4b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core?d=1&embedId=zaxd53bdwtvy&eId=zaxd53bdwtvy&region=US&forceShow=false&skipCampaigns=false&sessionId=3746222f-280d-4d84-8ab3-990ff4680b50&sessionStarted=1699375715.546&campaignRefreshToken=959eaf2e-9498-42aa-88c2-83fe2e027f06&hideController=false&pageLoadStartTime=1699375708552&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Farcticwolf.com%2Fresources%2Fblog%2Ftellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware%2F
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Wed, 20 Sep 2023 08:26:54 GMT
x-amz-version-id: zY0Ou_sLgA4Cobo6T_PpWO3n4_bhl.BX
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 1c3c1c03f4bbd4e68725363918cb3454.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P6
age: 4177302
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 18
last-modified: Mon, 18 Sep 2023 19:58:06 GMT
server: istio-envoy
etag: W/"a2ace4f65aa7b34dedb884f6cfe9df8d"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: _m2axIN4BS4355_2-ArOzvsiEiol75p_sbtBWICoseTL-oja90qH7w==

GET
H2 200 20.8c21ea18.chunk.js Show response
js.driftt.com/core/assets/js/ Frame CCFA 74 KB
23 KB 54ms
50ms Script
application/javascript 18.245.86.73
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/20.8c21ea18.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.2181e5a7.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.245.86.73 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-245-86-73.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

19473eebfb0672867a4438e2a015de79fded34b9f5ae5598bade57eb01cf0563

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core?d=1&embedId=zaxd53bdwtvy&eId=zaxd53bdwtvy&region=US&forceShow=false&skipCampaigns=false&sessionId=3746222f-280d-4d84-8ab3-990ff4680b50&sessionStarted=1699375715.546&campaignRefreshToken=959eaf2e-9498-42aa-88c2-83fe2e027f06&hideController=false&pageLoadStartTime=1699375708552&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Farcticwolf.com%2Fresources%2Fblog%2Ftellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware%2F
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Sat, 09 Sep 2023 18:42:47 GMT
x-amz-version-id: koF.ql6S6iU4L3DAmCcO8za68l9Cvk6p
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 1c3c1c03f4bbd4e68725363918cb3454.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P6
age: 5090749
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 19
last-modified: Thu, 07 Sep 2023 15:58:12 GMT
server: istio-envoy
etag: W/"6d77a76055d81227033363af2f18caf8"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: jUsOqtGfP6h2BzflYHAyxDd03zPwPueWW4uYkcTFJZA2a-9UhoeV_Q==

GET
H2 200 26.04e7f30b.chunk.js Show response
js.driftt.com/core/assets/js/ Frame CCFA 66 KB
20 KB 68ms
63ms Script
application/javascript 18.245.86.73
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/26.04e7f30b.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.2181e5a7.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.245.86.73 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-245-86-73.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

d70fa5dc6c8bfe9d7824be31e669528533d0879a2b1600a7df68b880f4d44296

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core?d=1&embedId=zaxd53bdwtvy&eId=zaxd53bdwtvy&region=US&forceShow=false&skipCampaigns=false&sessionId=3746222f-280d-4d84-8ab3-990ff4680b50&sessionStarted=1699375715.546&campaignRefreshToken=959eaf2e-9498-42aa-88c2-83fe2e027f06&hideController=false&pageLoadStartTime=1699375708552&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Farcticwolf.com%2Fresources%2Fblog%2Ftellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware%2F
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Mon, 07 Aug 2023 10:11:06 GMT
x-amz-version-id: QuflpVsRjQoeLsgyzbb2dO87jCp6veQD
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 1c3c1c03f4bbd4e68725363918cb3454.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P6
age: 7972650
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 32
last-modified: Fri, 28 Jul 2023 18:55:10 GMT
server: istio-envoy
etag: W/"49ce5445ddcf5d24ef3badc4eb1a11dd"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: BVkSwwCi1KR-2BQLLKwJcUi0V21fr767cAuFpgs4RBwuFhPndU_OPA==

GET
H2 200 14.e24a6190.chunk.js Show response
js.driftt.com/core/assets/js/ Frame CCFA 91 KB
28 KB 70ms
66ms Script
application/javascript 18.245.86.73
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/14.e24a6190.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.2181e5a7.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.245.86.73 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-245-86-73.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

6c9c6406c9bd9814cf84974221433003377b67f071ec5411fddbcba4ec109bca

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core?d=1&embedId=zaxd53bdwtvy&eId=zaxd53bdwtvy&region=US&forceShow=false&skipCampaigns=false&sessionId=3746222f-280d-4d84-8ab3-990ff4680b50&sessionStarted=1699375715.546&campaignRefreshToken=959eaf2e-9498-42aa-88c2-83fe2e027f06&hideController=false&pageLoadStartTime=1699375708552&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Farcticwolf.com%2Fresources%2Fblog%2Ftellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware%2F
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Wed, 20 Sep 2023 08:26:54 GMT
x-amz-version-id: mPHV5tAqPye8LylceWqtCyeRVygMz4fc
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 1c3c1c03f4bbd4e68725363918cb3454.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P6
age: 4177302
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 16
last-modified: Mon, 18 Sep 2023 19:58:05 GMT
server: istio-envoy
etag: W/"16d7ae86e21434a32157d3226ac9bb77"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: dYMOUHbbJS8jS7V6yorZEA-NwVSTmRWin9NK4q0UUiQPmEG3S45klw==

GET
H2 200 11.639238ba.chunk.js Show response
js.driftt.com/core/assets/js/ Frame CCFA 23 KB
7 KB 72ms
68ms Script
application/javascript 18.245.86.73
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/11.639238ba.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.2181e5a7.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.245.86.73 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-245-86-73.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

c501de88fbb90a445f1754a529bc772e7047071bf653c8c3f0330f7bb736d140

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core?d=1&embedId=zaxd53bdwtvy&eId=zaxd53bdwtvy&region=US&forceShow=false&skipCampaigns=false&sessionId=3746222f-280d-4d84-8ab3-990ff4680b50&sessionStarted=1699375715.546&campaignRefreshToken=959eaf2e-9498-42aa-88c2-83fe2e027f06&hideController=false&pageLoadStartTime=1699375708552&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Farcticwolf.com%2Fresources%2Fblog%2Ftellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware%2F
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Wed, 20 Sep 2023 08:26:54 GMT
x-amz-version-id: XlMxTkRfqAYNG4rhc7QwtAO3yzTax5oV
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 1c3c1c03f4bbd4e68725363918cb3454.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P6
age: 4177302
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 23
last-modified: Mon, 18 Sep 2023 19:58:04 GMT
server: istio-envoy
etag: W/"4049f38c00add1738dc4806148ff8829"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: deM8yB-4Rh05OLLUwvLVLyc84q8-pSkubMTqqsFTY1Ieg0IAHefFBw==

GET
H2 200 18.9c1bd1fb.chunk.js Show response
js.driftt.com/core/assets/js/ Frame CCFA 62 KB
20 KB 77ms
73ms Script
application/javascript 18.245.86.73
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/18.9c1bd1fb.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.2181e5a7.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.245.86.73 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-245-86-73.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

e555f4b34b579e6528d6bbd4819620a634c0759b41dfa99520b7ca5aa5117b11

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core?d=1&embedId=zaxd53bdwtvy&eId=zaxd53bdwtvy&region=US&forceShow=false&skipCampaigns=false&sessionId=3746222f-280d-4d84-8ab3-990ff4680b50&sessionStarted=1699375715.546&campaignRefreshToken=959eaf2e-9498-42aa-88c2-83fe2e027f06&hideController=false&pageLoadStartTime=1699375708552&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Farcticwolf.com%2Fresources%2Fblog%2Ftellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware%2F
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Mon, 04 Sep 2023 02:55:15 GMT
x-amz-version-id: 9mpbkuyHmd3DbfSHS5sKR7jluuxgLo9E
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 1c3c1c03f4bbd4e68725363918cb3454.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P6
age: 5579601
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 17
last-modified: Sat, 02 Sep 2023 21:37:07 GMT
server: istio-envoy
etag: W/"02f09379c544befa413d22eb57ed41de"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: orXkDxhx7yR3DDresCtKxqKVvpdwH-8BWByJ0TjvPpCt8dAu7STeqQ==

GET
H2 200 49.f7274268.chunk.js Show response
js.driftt.com/core/assets/js/ Frame CCFA 105 KB
34 KB 79ms
76ms Script
application/javascript 18.245.86.73
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/49.f7274268.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.2181e5a7.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.245.86.73 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-245-86-73.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

6861a320271e0fda832800e20d53b858ef409f88d9bc9c1a48953888289d1ea3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core?d=1&embedId=zaxd53bdwtvy&eId=zaxd53bdwtvy&region=US&forceShow=false&skipCampaigns=false&sessionId=3746222f-280d-4d84-8ab3-990ff4680b50&sessionStarted=1699375715.546&campaignRefreshToken=959eaf2e-9498-42aa-88c2-83fe2e027f06&hideController=false&pageLoadStartTime=1699375708552&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Farcticwolf.com%2Fresources%2Fblog%2Ftellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware%2F
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Wed, 26 Jul 2023 17:53:19 GMT
x-amz-version-id: nu5YPPYpbxwbA5KeFnNDvED6qjQ46e.5
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 1c3c1c03f4bbd4e68725363918cb3454.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P6
age: 8981717
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 22
last-modified: Wed, 26 Jul 2023 13:14:43 GMT
server: istio-envoy
etag: W/"e268d36b98f0119a2bb1a15f69fd4ffe"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: 0RHkeZGZIHZASQYNNS7dm1amkpw1bthkCz6PviSjFisRU1h5ZKbXuw==

GET
H2 200 40.31ef8dbf.chunk.js Show response
js.driftt.com/core/assets/js/ Frame CCFA 12 KB
4 KB 81ms
77ms Script
application/javascript 18.245.86.73
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/40.31ef8dbf.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.2181e5a7.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.245.86.73 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-245-86-73.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

bba54915db71fc417be4d5852ec7d138d7c3fa90356ddee98b5267a7db7e6b5b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core?d=1&embedId=zaxd53bdwtvy&eId=zaxd53bdwtvy&region=US&forceShow=false&skipCampaigns=false&sessionId=3746222f-280d-4d84-8ab3-990ff4680b50&sessionStarted=1699375715.546&campaignRefreshToken=959eaf2e-9498-42aa-88c2-83fe2e027f06&hideController=false&pageLoadStartTime=1699375708552&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Farcticwolf.com%2Fresources%2Fblog%2Ftellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware%2F
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Mon, 25 Sep 2023 22:50:10 GMT
x-amz-version-id: 4vFIc6iMaOHHRPFul3_EyvJfXUuIcmEs
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 1c3c1c03f4bbd4e68725363918cb3454.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P6
age: 3693506
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 19
last-modified: Thu, 21 Sep 2023 18:21:36 GMT
server: istio-envoy
etag: W/"b0793fa46e8c0ae1846b7be8a833da35"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: qsGc6YGew13EGLvtTFb9Y5ZrAAz-3m1z7ulAWVj5HOXO4w57ZhsN9Q==

GET
H2 200 29.31d09948.chunk.js Show response
js.driftt.com/core/assets/js/ Frame CCFA 13 KB
6 KB 82ms
78ms Script
application/javascript 18.245.86.73
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/29.31d09948.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.2181e5a7.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.245.86.73 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-245-86-73.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

7641f066c35d0ca15d4897bfe49d640ed4c143ff8f04030c2020cbb2acfa7b0b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core?d=1&embedId=zaxd53bdwtvy&eId=zaxd53bdwtvy&region=US&forceShow=false&skipCampaigns=false&sessionId=3746222f-280d-4d84-8ab3-990ff4680b50&sessionStarted=1699375715.546&campaignRefreshToken=959eaf2e-9498-42aa-88c2-83fe2e027f06&hideController=false&pageLoadStartTime=1699375708552&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Farcticwolf.com%2Fresources%2Fblog%2Ftellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware%2F
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Mon, 02 Oct 2023 04:56:51 GMT
x-amz-version-id: PyawGVolC84hpcWm6OWVT0dG84hVjB6f
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 1c3c1c03f4bbd4e68725363918cb3454.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P6
age: 3153105
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 17
last-modified: Thu, 21 Sep 2023 18:21:36 GMT
server: istio-envoy
etag: W/"455157cb49065fb85fed54901ddaeb0e"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: WwO8bvrmZEPYmx9J7jft5m2U9I70Zi01LjnQzv-CmFiW2Z0lVn_0uQ==

GET
H2 200 21.b8c41db9.chunk.js Show response
js.driftt.com/core/assets/js/ Frame CCFA 17 KB
7 KB 82ms
79ms Script
application/javascript 18.245.86.73
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/21.b8c41db9.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.2181e5a7.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.245.86.73 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-245-86-73.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

b84595cc8461bb6e8376fe94f0dd23d6657172103b03653534089c5992b058a1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core?d=1&embedId=zaxd53bdwtvy&eId=zaxd53bdwtvy&region=US&forceShow=false&skipCampaigns=false&sessionId=3746222f-280d-4d84-8ab3-990ff4680b50&sessionStarted=1699375715.546&campaignRefreshToken=959eaf2e-9498-42aa-88c2-83fe2e027f06&hideController=false&pageLoadStartTime=1699375708552&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Farcticwolf.com%2Fresources%2Fblog%2Ftellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware%2F
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Wed, 20 Sep 2023 08:26:54 GMT
x-amz-version-id: g1ri2j1Cjjab.VdRD9o2Qfb0pzjBKg2Y
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 1c3c1c03f4bbd4e68725363918cb3454.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P6
age: 4177302
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 19
last-modified: Mon, 18 Sep 2023 19:58:05 GMT
server: istio-envoy
etag: W/"65e5c965272e021ae33ff8bc39565ef5"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: Xd48Fg7OKHcngDs9BuXgEgO0FFZmac9pYJrdhmB5XWA3YtmU5aZYXA==

GET
H2 200 8.7602338c.chunk.css
js.driftt.com/core/assets/css/ Frame CCFA 31 KB
4 KB 43ms
40ms Stylesheet
text/css 18.245.86.73
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/css/8.7602338c.chunk.css

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.2181e5a7.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.245.86.73 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-245-86-73.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

310de82ec6ba5948814ab8ec2369aa1d437e84e26ac56967fc79897acaa99a95

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core?d=1&embedId=zaxd53bdwtvy&eId=zaxd53bdwtvy&region=US&forceShow=false&skipCampaigns=false&sessionId=3746222f-280d-4d84-8ab3-990ff4680b50&sessionStarted=1699375715.546&campaignRefreshToken=959eaf2e-9498-42aa-88c2-83fe2e027f06&hideController=false&pageLoadStartTime=1699375708552&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Farcticwolf.com%2Fresources%2Fblog%2Ftellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware%2F
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Sat, 30 Sep 2023 01:16:19 GMT
x-amz-version-id: hjTFQAoU.KAgYbJR7bli92DUId80a05s
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 1c3c1c03f4bbd4e68725363918cb3454.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P6
age: 3339137
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 30
last-modified: Thu, 21 Sep 2023 18:21:34 GMT
server: istio-envoy
etag: W/"76d0343f1f9f445c80d5c68c2a35b6e0"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: EL8HKLD5US1SLa2Ny7tE5vI3NTI-CFKb_ay2X6rjMB26T9eazvq3Ew==

GET
H2 200 8.044769eb.chunk.js Show response
js.driftt.com/core/assets/js/ Frame CCFA 81 KB
26 KB 83ms
80ms Script
application/javascript 18.245.86.73
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/8.044769eb.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.2181e5a7.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.245.86.73 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-245-86-73.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

1a942c4e7372897cb501fba0ddb4b51fb3533d71975bd2d9d3a1f39ac5403831

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core?d=1&embedId=zaxd53bdwtvy&eId=zaxd53bdwtvy&region=US&forceShow=false&skipCampaigns=false&sessionId=3746222f-280d-4d84-8ab3-990ff4680b50&sessionStarted=1699375715.546&campaignRefreshToken=959eaf2e-9498-42aa-88c2-83fe2e027f06&hideController=false&pageLoadStartTime=1699375708552&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Farcticwolf.com%2Fresources%2Fblog%2Ftellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware%2F
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Fri, 03 Nov 2023 17:04:21 GMT
x-amz-version-id: 17DfV7s42f89YbincTHPPVmLUV_bhnjp
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 1c3c1c03f4bbd4e68725363918cb3454.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P6
age: 344655
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 52
last-modified: Fri, 03 Nov 2023 16:05:58 GMT
server: istio-envoy
etag: W/"44b93d3484fa424f7b36b2e344e21e24"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: OT303AO_xwQZ1YeGEjuktLlV0fsFYmoDp4dy7P6_rDYOmivUI_f1IA==

GET
H2 200 16.22abfce0.chunk.css
js.driftt.com/core/assets/css/ Frame CCFA 24 B
695 B 44ms
41ms Stylesheet
text/css 18.245.86.73
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/css/16.22abfce0.chunk.css

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.2181e5a7.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.245.86.73 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-245-86-73.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

5dbaf0a4ff0f8ac8c1b67550eee84390b089604ffaf71183e417636c7e183ac5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core?d=1&embedId=zaxd53bdwtvy&eId=zaxd53bdwtvy&region=US&forceShow=false&skipCampaigns=false&sessionId=3746222f-280d-4d84-8ab3-990ff4680b50&sessionStarted=1699375715.546&campaignRefreshToken=959eaf2e-9498-42aa-88c2-83fe2e027f06&hideController=false&pageLoadStartTime=1699375708552&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Farcticwolf.com%2Fresources%2Fblog%2Ftellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware%2F
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Sat, 09 Sep 2023 18:42:47 GMT
x-amz-version-id: L7ekVthaAMSAcl7y3LfpvLig..DjHOJ0
via: 1.1 1c3c1c03f4bbd4e68725363918cb3454.cloudfront.net (CloudFront)
strict-transport-security: max-age=31536000; includeSubDomains
x-amz-cf-pop: FRA60-P6
age: 5090749
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 15
content-length: 24
last-modified: Thu, 07 Sep 2023 15:58:10 GMT
server: istio-envoy
etag: "0c5dad92482d9a7c7c253510f5082465"
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: -YVnEwD-v1AkVNw7m3vVZiltpgmkNc8aYSGn47YA8SSj26v6ivIk6Q==

GET
H2 200 16.2394064c.chunk.js Show response
js.driftt.com/core/assets/js/ Frame CCFA 92 KB
24 KB 84ms
82ms Script
application/javascript 18.245.86.73
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/16.2394064c.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.2181e5a7.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.245.86.73 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-245-86-73.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

1f1af18d64fdcfd9d2191eec42881a3e16a482792ff4d1c4a7da67981a51d899

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core?d=1&embedId=zaxd53bdwtvy&eId=zaxd53bdwtvy&region=US&forceShow=false&skipCampaigns=false&sessionId=3746222f-280d-4d84-8ab3-990ff4680b50&sessionStarted=1699375715.546&campaignRefreshToken=959eaf2e-9498-42aa-88c2-83fe2e027f06&hideController=false&pageLoadStartTime=1699375708552&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Farcticwolf.com%2Fresources%2Fblog%2Ftellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware%2F
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Wed, 01 Nov 2023 18:06:41 GMT
x-amz-version-id: E5klQAQs3D4aAXVjfwX8.j3PQlETJSVe
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 1c3c1c03f4bbd4e68725363918cb3454.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P6
age: 513714
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 42
last-modified: Wed, 01 Nov 2023 17:45:49 GMT
server: istio-envoy
etag: W/"b3fe5876c5b8966c8af8f22496366c99"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: bElnr_qvj_6fMzoCX9gUvRYTAVMQNwRRJfNilYcsaHX1k2fJM-kgrQ==

GET
H2 200 24.242124cd.chunk.js Show response
js.driftt.com/core/assets/js/ Frame CCFA 50 KB
14 KB 85ms
82ms Script
application/javascript 18.245.86.73
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/24.242124cd.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.2181e5a7.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.245.86.73 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-245-86-73.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

94d2e4711b49d624a5da206ae3eb4b179b55cc4104c2573f267e7bf8cc9f2b81

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core?d=1&embedId=zaxd53bdwtvy&eId=zaxd53bdwtvy&region=US&forceShow=false&skipCampaigns=false&sessionId=3746222f-280d-4d84-8ab3-990ff4680b50&sessionStarted=1699375715.546&campaignRefreshToken=959eaf2e-9498-42aa-88c2-83fe2e027f06&hideController=false&pageLoadStartTime=1699375708552&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Farcticwolf.com%2Fresources%2Fblog%2Ftellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware%2F
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Fri, 03 Nov 2023 17:04:21 GMT
x-amz-version-id: jyh0Af4JB7krs5tZHKSdH033tp359Ndt
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 1c3c1c03f4bbd4e68725363918cb3454.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P6
age: 344655
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 19
last-modified: Fri, 03 Nov 2023 16:05:57 GMT
server: istio-envoy
etag: W/"bd940a8e755918cc81131b844a5d232b"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: 1XwUP-UV9bfPlD1HTWbIGRhhHDGejbI91RDfIxbE8GnS-r9Qvj_BWQ==

GET
H2 200 17.500d5eaf.chunk.js Show response
js.driftt.com/core/assets/js/ Frame CCFA 40 KB
13 KB 85ms
84ms Script
application/javascript 18.245.86.73
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/17.500d5eaf.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.2181e5a7.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.245.86.73 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-245-86-73.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

bdfb013c1a0ae23a6ea0a548957c1aa6d48db8ebf2fe6cf2265fbaaa4f3af08a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core?d=1&embedId=zaxd53bdwtvy&eId=zaxd53bdwtvy&region=US&forceShow=false&skipCampaigns=false&sessionId=3746222f-280d-4d84-8ab3-990ff4680b50&sessionStarted=1699375715.546&campaignRefreshToken=959eaf2e-9498-42aa-88c2-83fe2e027f06&hideController=false&pageLoadStartTime=1699375708552&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Farcticwolf.com%2Fresources%2Fblog%2Ftellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware%2F
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Fri, 03 Nov 2023 17:04:21 GMT
x-amz-version-id: 8AiuZsTmJBu55E3_pJEYac7N60hic2NR
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 1c3c1c03f4bbd4e68725363918cb3454.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P6
age: 344655
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 19
last-modified: Fri, 03 Nov 2023 16:05:57 GMT
server: istio-envoy
etag: W/"ffb40021683e5483974aec57c93884b7"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: LukHb-64FSKL_k6ExAN4PYJY92Y5HyCqfG4ispdFL_YpFbmC0wPc9w==

GET
H2 200 0.0b2ebd4a.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 41CD 9 KB
3 KB 60ms
57ms Script
application/javascript 18.245.86.73
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/0.0b2ebd4a.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.2181e5a7.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.245.86.73 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-245-86-73.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

862bae5c822d87db86d0b893f474177ca1d9a51309354f12cc0ab85cd9bd9cf7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1699375708552
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Sat, 30 Sep 2023 01:16:20 GMT
x-amz-version-id: N.P1rsR6Ulh0hyhpF1x45w2GtJbK5a1j
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 1c3c1c03f4bbd4e68725363918cb3454.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P6
age: 3339136
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 17
last-modified: Fri, 29 Sep 2023 23:27:53 GMT
server: istio-envoy
etag: W/"c5efcdc9e465604f32cf24af10fd6c13"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: ZNvp6O4xX6Jh5heOkyLGEdxd1tU4o8g1LlA6IvB3k7AmaLF-pJ_aNA==

GET
H2 200 3.07aa08a5.chunk.css
js.driftt.com/core/assets/css/ Frame 41CD 7 KB
2 KB 59ms
56ms Stylesheet
text/css 18.245.86.73
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/css/3.07aa08a5.chunk.css

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.2181e5a7.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.245.86.73 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-245-86-73.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

dd09e3ba26066abe27c4dad57c8e0c8a63fe23a0bc87e63bcab94f25e9096459

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1699375708552
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Wed, 26 Jul 2023 17:53:21 GMT
x-amz-version-id: Ov831I2a5yEZEgVNkzjL3jR4iYT4qeoU
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 1c3c1c03f4bbd4e68725363918cb3454.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P6
age: 8981715
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 40
last-modified: Wed, 26 Jul 2023 13:12:09 GMT
server: istio-envoy
etag: W/"189aeffd571884559dababa22c66d75a"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: oMXetw663TB6u1lCMTk6Qd_cEazC0YFlqZBI7JYMA277sYfZfWGUuQ==

GET
H2 200 3.f50b964b.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 41CD 54 KB
15 KB 62ms
60ms Script
application/javascript 18.245.86.73
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/3.f50b964b.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.2181e5a7.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.245.86.73 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-245-86-73.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

d14e287ddae470b06c4639e73260ca21a4c9b7cfdf56e02965a8f50fb5333b42

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1699375708552
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Wed, 20 Sep 2023 08:26:55 GMT
x-amz-version-id: Kynz7_sRLMeatVgI4HEORmIIXnKig1_t
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 1c3c1c03f4bbd4e68725363918cb3454.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P6
age: 4177301
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 37
last-modified: Mon, 18 Sep 2023 19:58:05 GMT
server: istio-envoy
etag: W/"1ac37bf2b93050f29058b66a9ad43e10"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: GhGzk_16yyyPFIhX_Q61FIs8NplI21HE9UQqto4Hzxb1LtNvcW0eKg==

GET
H2 200 1.12ba17b6.chunk.css
js.driftt.com/core/assets/css/ Frame 41CD 44 KB
7 KB 60ms
58ms Stylesheet
text/css 18.245.86.73
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/css/1.12ba17b6.chunk.css

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.2181e5a7.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.245.86.73 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-245-86-73.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

58fdb03fac3e89e51525a5a45eb777395d1b499bf4483e96201b6becddbe516f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1699375708552
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Mon, 07 Aug 2023 11:27:15 GMT
x-amz-version-id: eSNvdp0yfhg_hVHGVV1T0Cg9aS8M1FwM
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 1c3c1c03f4bbd4e68725363918cb3454.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P6
age: 7968081
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 20
last-modified: Fri, 28 Jul 2023 18:55:08 GMT
server: istio-envoy
etag: W/"3b8ba82e1bac13ee29e9764a55620d99"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: n0g8vh1NB6DKyA7NhWF8gV67wIjf1IQ9I_l1tOStANLhTW23jRKhhA==

GET
H2 200 1.2aebee2c.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 41CD 54 KB
18 KB 63ms
61ms Script
application/javascript 18.245.86.73
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/1.2aebee2c.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.2181e5a7.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.245.86.73 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-245-86-73.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

60409946ec37f5d25bf3516bd3fbc347358e60feaf168a3d578b323cb750860b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1699375708552
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Sat, 30 Sep 2023 01:16:20 GMT
x-amz-version-id: njKFRQMyITptDyb8dy9pniiadoNlCW6r
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 1c3c1c03f4bbd4e68725363918cb3454.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P6
age: 3339136
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 45
last-modified: Fri, 15 Sep 2023 20:51:05 GMT
server: istio-envoy
etag: W/"8dec138e62d799d028f8c7ed0cc19058"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: RFZrW8-VC86TULgrEBQaEA8rsiOQLEZfTIQTAm9hH42Bcg60t3IPmw==

GET
H2 200 4.9d776499.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 41CD 23 KB
10 KB 63ms
62ms Script
application/javascript 18.245.86.73
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/4.9d776499.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.2181e5a7.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.245.86.73 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-245-86-73.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

622373f59cdda9ea36f307c5f7bef0cfd8e140018c995b6394468a26ef499dec

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1699375708552
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 25 Jul 2023 18:55:58 GMT
x-amz-version-id: uGJ36CDXFf5jc7zFgfXUohqg1i8mPHWM
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 1c3c1c03f4bbd4e68725363918cb3454.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P6
age: 9064358
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 17
last-modified: Tue, 25 Jul 2023 18:08:15 GMT
server: istio-envoy
etag: W/"cc02ad980b6b04f3bba61e68883356d4"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: 0slBsVOcEHGssZcrbVgwzd_UuR9NeC8TFRTXU_1zVWisTr6kq8LoPw==

GET
H2 200 34.d13ab69b.chunk.css
js.driftt.com/core/assets/css/ Frame 41CD 16 KB
3 KB 60ms
59ms Stylesheet
text/css 18.245.86.73
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/css/34.d13ab69b.chunk.css

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.2181e5a7.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.245.86.73 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-245-86-73.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

7c8b113cce07a87ca4cb9dc4f1c55d701efd44834430e1939c27b2e5e1c12ac1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1699375708552
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Fri, 03 Nov 2023 17:04:21 GMT
x-amz-version-id: pFWMvJB2j2wrLwpXYClAbSTx9Ncr0bnJ
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 1c3c1c03f4bbd4e68725363918cb3454.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P6
age: 344655
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 19
last-modified: Fri, 03 Nov 2023 16:05:55 GMT
server: istio-envoy
etag: W/"cd2168c34ad30fc16e40bb8888419c0b"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: sofQw2xz4PtsA7hvXQjXLN8PW--yib6Vv-pYQFdDk9PNfcu36Ja5ig==

GET
H2 200 34.565cc93a.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 41CD 13 KB
5 KB 64ms
63ms Script
application/javascript 18.245.86.73
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/34.565cc93a.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.2181e5a7.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.245.86.73 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-245-86-73.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

08b15334412c5f3ad02391af96b4068d23b85e63c63fa8d78ee9bb7e78ce752d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1699375708552
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 19 Sep 2023 19:13:34 GMT
x-amz-version-id: Vj75Ma3SPAXLgnv1oVNlXdl73AwytxU2
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 1c3c1c03f4bbd4e68725363918cb3454.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P6
age: 4224902
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 58
last-modified: Fri, 15 Sep 2023 20:51:07 GMT
server: istio-envoy
etag: W/"57c0a57c3cf808c4592182b4c490b3a0"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: B1Cp89Xt_GEICnb5_zgCkGx7Jqh12Fwei0iQUGft_PMy-KjclvLLCw==

GET
H2 200 0.0b2ebd4a.chunk.js Show response
js.driftt.com/core/assets/js/ Frame CCFA 9 KB
3 KB 45ms
43ms Script
application/javascript 18.245.86.73
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/0.0b2ebd4a.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.2181e5a7.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.245.86.73 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-245-86-73.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

862bae5c822d87db86d0b893f474177ca1d9a51309354f12cc0ab85cd9bd9cf7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core?d=1&embedId=zaxd53bdwtvy&eId=zaxd53bdwtvy&region=US&forceShow=false&skipCampaigns=false&sessionId=3746222f-280d-4d84-8ab3-990ff4680b50&sessionStarted=1699375715.546&campaignRefreshToken=959eaf2e-9498-42aa-88c2-83fe2e027f06&hideController=false&pageLoadStartTime=1699375708552&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Farcticwolf.com%2Fresources%2Fblog%2Ftellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware%2F
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Sat, 30 Sep 2023 01:16:20 GMT
x-amz-version-id: N.P1rsR6Ulh0hyhpF1x45w2GtJbK5a1j
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 1c3c1c03f4bbd4e68725363918cb3454.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P6
age: 3339136
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 17
last-modified: Fri, 29 Sep 2023 23:27:53 GMT
server: istio-envoy
etag: W/"c5efcdc9e465604f32cf24af10fd6c13"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: OZHWzskJzLH_Krp-dnovxWs6_0NB7LCXe2hbklRCTKfQF-zB431B7w==

GET
H2 200 27.01c2bea5.chunk.js Show response
js.driftt.com/core/assets/js/ Frame CCFA 35 KB
10 KB 46ms
44ms Script
application/javascript 18.245.86.73
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/27.01c2bea5.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.2181e5a7.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.245.86.73 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-245-86-73.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

b13c9311dec3f49821d88065299e95cc1c4e6c26acc4b27b4ebdb380d40d8788

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core?d=1&embedId=zaxd53bdwtvy&eId=zaxd53bdwtvy&region=US&forceShow=false&skipCampaigns=false&sessionId=3746222f-280d-4d84-8ab3-990ff4680b50&sessionStarted=1699375715.546&campaignRefreshToken=959eaf2e-9498-42aa-88c2-83fe2e027f06&hideController=false&pageLoadStartTime=1699375708552&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Farcticwolf.com%2Fresources%2Fblog%2Ftellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware%2F
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Wed, 13 Sep 2023 23:54:28 GMT
x-amz-version-id: YMtskddlt_BynGDwl8_lx2.1Au5P.Zy_
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 1c3c1c03f4bbd4e68725363918cb3454.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P6
age: 4726448
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 40
last-modified: Wed, 13 Sep 2023 15:34:32 GMT
server: istio-envoy
etag: W/"04a233a42dcf8c50a83bfecea8ba552d"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: nkBqrvuWLhtrNHAbfOePQoWT3_mqZ-TAGWE527CG02nbaX1MUyUoYQ==

GET
H2 200 28.b5e8f5e1.chunk.css
js.driftt.com/core/assets/css/ Frame CCFA 8 KB
2 KB 43ms
41ms Stylesheet
text/css 18.245.86.73
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/css/28.b5e8f5e1.chunk.css

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.2181e5a7.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.245.86.73 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-245-86-73.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

7849ba1748f8188749df28e9d59ca4e570a8495684353d8df4715fa70a81e787

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core?d=1&embedId=zaxd53bdwtvy&eId=zaxd53bdwtvy&region=US&forceShow=false&skipCampaigns=false&sessionId=3746222f-280d-4d84-8ab3-990ff4680b50&sessionStarted=1699375715.546&campaignRefreshToken=959eaf2e-9498-42aa-88c2-83fe2e027f06&hideController=false&pageLoadStartTime=1699375708552&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Farcticwolf.com%2Fresources%2Fblog%2Ftellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware%2F
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Mon, 04 Sep 2023 23:24:26 GMT
x-amz-version-id: dWp9miJXOVmUTXcain7mZ7aJqiAGjznQ
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 1c3c1c03f4bbd4e68725363918cb3454.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P6
age: 5505850
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 41
last-modified: Mon, 04 Sep 2023 22:45:58 GMT
server: istio-envoy
etag: W/"e7107bc29ccb3c6d928f0f8f10a0f22d"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: 5EAzpSdoX4rgTTGr0AbsXyJqu8F1nSE9DQ5dwcVNDcghaicyEK-37g==

GET
H2 200 28.bdd92ff2.chunk.js Show response
js.driftt.com/core/assets/js/ Frame CCFA 14 KB
6 KB 46ms
45ms Script
application/javascript 18.245.86.73
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/28.bdd92ff2.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.2181e5a7.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.245.86.73 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-245-86-73.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

6eabf982ec86c7a2d08d260cdd257c9d1f1d9b589cb52a812be0dc5c7cf1af9a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core?d=1&embedId=zaxd53bdwtvy&eId=zaxd53bdwtvy&region=US&forceShow=false&skipCampaigns=false&sessionId=3746222f-280d-4d84-8ab3-990ff4680b50&sessionStarted=1699375715.546&campaignRefreshToken=959eaf2e-9498-42aa-88c2-83fe2e027f06&hideController=false&pageLoadStartTime=1699375708552&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Farcticwolf.com%2Fresources%2Fblog%2Ftellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware%2F
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Sat, 30 Sep 2023 01:11:07 GMT
x-amz-version-id: 6o.8mkxiaRsFl_owIpE1sA3Ubz4dTFIZ
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 1c3c1c03f4bbd4e68725363918cb3454.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P6
age: 3339449
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 37
last-modified: Fri, 15 Sep 2023 20:51:06 GMT
server: istio-envoy
etag: W/"260fbabe310bd2cae5c44538f3d833ad"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: WjpnDnw-uiJ43oaGl-5Xn88r5YU8zuWGC39NNnaS61tWcI7C-8g5RA==

GET
H2 200 25.c695453b.chunk.css
js.driftt.com/core/assets/css/ Frame CCFA 365 B
1 KB 44ms
42ms Stylesheet
text/css 18.245.86.73
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/css/25.c695453b.chunk.css

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.2181e5a7.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.245.86.73 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-245-86-73.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

ec3a84e593065a50cd77ce9fba273b4196936940c0813ca248b045df2e2c8eff

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core?d=1&embedId=zaxd53bdwtvy&eId=zaxd53bdwtvy&region=US&forceShow=false&skipCampaigns=false&sessionId=3746222f-280d-4d84-8ab3-990ff4680b50&sessionStarted=1699375715.546&campaignRefreshToken=959eaf2e-9498-42aa-88c2-83fe2e027f06&hideController=false&pageLoadStartTime=1699375708552&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Farcticwolf.com%2Fresources%2Fblog%2Ftellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware%2F
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Wed, 20 Sep 2023 06:06:36 GMT
x-amz-version-id: I8MJvRD6MTh126AnSPBNc7JG7IhkzIAO
via: 1.1 1c3c1c03f4bbd4e68725363918cb3454.cloudfront.net (CloudFront)
strict-transport-security: max-age=31536000; includeSubDomains
x-amz-cf-pop: FRA60-P6
age: 4185719
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 64
content-length: 365
last-modified: Mon, 18 Sep 2023 19:58:03 GMT
server: istio-envoy
etag: "06b2963b029c0824382815165bfea73e"
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: DrXH97Ld4JyH5ON_1aJKepfX6lIgHp7sl3d0GmfSpCUDB6kaqVvnjA==

GET
H2 200 25.257fb178.chunk.js Show response
js.driftt.com/core/assets/js/ Frame CCFA 91 KB
25 KB 47ms
46ms Script
application/javascript 18.245.86.73
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/25.257fb178.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.2181e5a7.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.245.86.73 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-245-86-73.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

7b0c85ad25e63ace10fd6b2f7bcf14143b559247650f9368ac5cea4c8224096e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core?d=1&embedId=zaxd53bdwtvy&eId=zaxd53bdwtvy&region=US&forceShow=false&skipCampaigns=false&sessionId=3746222f-280d-4d84-8ab3-990ff4680b50&sessionStarted=1699375715.546&campaignRefreshToken=959eaf2e-9498-42aa-88c2-83fe2e027f06&hideController=false&pageLoadStartTime=1699375708552&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Farcticwolf.com%2Fresources%2Fblog%2Ftellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware%2F
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 31 Oct 2023 14:09:47 GMT
x-amz-version-id: 51Tg6oXUbhjUfmCoC3Rz4J5pRlDm8QqK
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 1c3c1c03f4bbd4e68725363918cb3454.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P6
age: 614329
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 37
last-modified: Mon, 30 Oct 2023 17:24:51 GMT
server: istio-envoy
etag: W/"a9ecc7ad7347a98c56cf05a021eaadc7"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: iRY18MsTQBoOoY6yZE_Yq0xqegD2om0IqI-pXI6HE62RzEYZDViB3Q==

POST
H2 200 v2 Show response
bootstrap.api.drift.com/widget_bootstrap/ping/ Frame CCFA 207 B
647 B 393ms
131ms XHR
application/json 50.16.7.188
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://bootstrap.api.drift.com/widget_bootstrap/ping/v2

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/51.558be3c5.chunk.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

50.16.7.188 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-50-16-7-188.compute-1.amazonaws.com

Software

istio-envoy /

Resource Hash

94d994c6f0db021016fd8fb66caa72767cf51b540faaeb8753672d59a5502904

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept: application/json, text/plain, */*
Referer: https://js.driftt.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Tue, 07 Nov 2023 16:48:36 GMT
strict-transport-security: max-age=31536000; includeSubDomains
server: istio-envoy
requestid: 1343ca7aee5a9e02
access-control-max-age: 1209600
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS, HEAD, PATCH
content-type: application/json;charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: X-Results-Total-Count,X-Page-Info
vary: Accept-Encoding
access-control-allow-credentials: true
x-envoy-upstream-service-time: 9
access-control-allow-headers: origin, content-type, accept, authorization, auth-token, uber-trace-id, x-amzn-oidc-data, x-version
content-length: 207

GET
H2 200 formcomplete.js Show response
ws-assets.zoominfo.com/ 86 KB
26 KB 115ms
95ms Script
application/javascript 2606:4700::6810:890f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ws-assets.zoominfo.com/formcomplete.js
Requested by: Host: js.zi-scripts.com
URL: https://js.zi-scripts.com/zi-tag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6810:890f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: fe92edba1f5990d76e1817f250ee4aae144f4efa95b676733bdd4391f2b74cf1

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://arcticwolf.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 16:48:36 GMT
content-encoding: gzip
cf-cache-status: DYNAMIC
age: 2148
x-guploader-uploadid: ABPtcPpTRPjJGUfKo4oZE3am3EHyTWpTz_2cGrEk83vubMOG2_NygsAXZ0UWO4vcTCeSCJlJGnqSVSg1lg
x-goog-storage-class: STANDARD
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
alt-svc: h3=":443"; ma=86400
last-modified: Thu, 02 Nov 2023 11:05:05 GMT
server: cloudflare
etag: W/"bbabfd4493e8cf8aafea99a2f70825c0"
x-goog-hash: crc32c=4scEgA==, md5=u6v9RJPoz4qv6pmi9wglwA==
x-goog-generation: 1698923105172059
content-type: application/javascript
cache-control: public, max-age=3600
x-goog-stored-content-length: 87554
cf-ray: 8227109339141e33-FRA
expires: Tue, 07 Nov 2023 17:12:48 GMT

GET
H2 200 / Show response
ws.zoominfo.com/pixel/uWhJBalAQeFpeNitJUHH/ 3 KB
1 KB 264ms
263ms Fetch
text/javascript 2606:4700::6810:890f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://ws.zoominfo.com/pixel/uWhJBalAQeFpeNitJUHH/?iszitag=true

Requested by

Host: js.zi-scripts.com
URL: https://js.zi-scripts.com/zi-tag.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:890f , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / Express

Resource Hash

e127a19a6941ffa460929836f1b02457816f1282c5bb26acb12806cd3d7bc8c5

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

visited-url: https://arcticwolf.com/resources/blog/tellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware/
Referer: https://arcticwolf.com/resources/blog/tellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware/
_vtok: ODAuMjU1LjcuMTAz
_zitok: 91dddfbf9df78bdebc191699375716
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36
Content-Type: text/javascript

Response headers

date: Tue, 07 Nov 2023 16:48:36 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
via: 1.1 google
server: cloudflare
x-powered-by: Express
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: https://arcticwolf.com
access-control-allow-credentials: true
cf-ray: 822710948b1a1e33-FRA
access-control-allow-headers: Content-Type,cf-ipcountry,service-version,x-appengine-user-ip,x-forwarded-for, x-ws-collect-type,requestFromZITag,unifiedScriptVerified,_zitok,_vtok,visited-url
alt-svc: h3=":443"; ma=86400

OPTIONS
H3 200 /
ws.zoominfo.com/pixel/uWhJBalAQeFpeNitJUHH/ Frame 0
0 223ms
178ms Preflight
text/html 2606:4700::6810:890f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://ws.zoominfo.com/pixel/uWhJBalAQeFpeNitJUHH/?iszitag=true

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6810:890f , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / Express

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept: */*
Access-Control-Request-Headers: _vtok,_zitok,content-type,visited-url
Access-Control-Request-Method: GET
Origin: https://arcticwolf.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Content-Type,cf-ipcountry,service-version,x-appengine-user-ip,x-forwarded-for,x-ws-collect-type,requestFromZITag,unifiedScriptVerified,_zitok,_vtok,visited-url
access-control-allow-origin: https://arcticwolf.com
allow: GET,HEAD
alt-svc: h3=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 822710936b586931-FRA
content-encoding: gzip
content-type: text/html; charset=utf-8
date: Tue, 07 Nov 2023 16:48:36 GMT
server: cloudflare
via: 1.1 google
x-content-type-options: nosniff
x-powered-by: Express

OPTIONS
H3 200 forms
ws.zoominfo.com/formcomplete-v2/ Frame 0
0 180ms
179ms Preflight
text/html 2606:4700::6810:890f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://ws.zoominfo.com/formcomplete-v2/forms

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6810:890f , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / Express

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept: */*
Access-Control-Request-Headers: authorization,content-type
Access-Control-Request-Method: POST
Origin: https://arcticwolf.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Content-Type,cf-ipcountry,service-version,x-appengine-user-ip,x-forwarded-for,x-ws-collect-type,Authorization,visitorId,_zitok
access-control-allow-origin: https://arcticwolf.com
allow: POST
alt-svc: h3=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 82271093ec216931-FRA
content-encoding: gzip
content-type: text/html; charset=utf-8
date: Tue, 07 Nov 2023 16:48:36 GMT
server: cloudflare
via: 1.1 google
x-content-type-options: nosniff
x-powered-by: Express

POST
H3 200 forms Show response
ws.zoominfo.com/formcomplete-v2/ 951 B
725 B 187ms
186ms Fetch
application/json 2606:4700::6810:890f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://ws.zoominfo.com/formcomplete-v2/forms

Requested by

Host: ws-assets.zoominfo.com
URL: https://ws-assets.zoominfo.com/formcomplete.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6810:890f , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / Express

Resource Hash

89f2c719a1ca89c3c911fcab385679f58369f959385b695eb2a9abeddd93d355

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://arcticwolf.com/
accept-language: de-DE,de;q=0.9
Authorization: bearer 0a190541422eb542fed35325908f47
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36
Content-Type: application/json

Response headers

date: Tue, 07 Nov 2023 16:48:36 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
via: 1.1 google
server: cloudflare
x-powered-by: Express
etag: W/"3b7-V1cmFMUAtHW8w+RqNPr9/9kBTb4"
vary: Accept-Encoding
content-type: application/json; charset=utf-8
access-control-allow-origin: https://arcticwolf.com
access-control-allow-credentials: true
cf-ray: 822710950fb49a23-FRA
access-control-allow-headers: Content-Type,cf-ipcountry,service-version,x-appengine-user-ip,x-forwarded-for, x-ws-collect-type,Authorization, visitorId, _zitok
alt-svc: h3=":443"; ma=86400

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
486 B 237ms
236ms Image
image/gif 23.38.98.66
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=468ce208ecea2d45efbf04ec75c998b4&svisitor=null&visitor=d8296237-13f5-43c2-8045-4708843062dc&session=2613a055-3ea6-4c91-8478-fc8d45f45f6b&event=active_time_track&q=%7B%22currentTime%22%3A%22Tue%2C%2007%20Nov%202023%2016%3A48%3A36%20GMT%22%2C%22lastTrackTime%22%3A%22Tue%2C%2007%20Nov%202023%2016%3A48%3A31%20GMT%22%2C%22timeSpent%22%3A%225493%22%2C%22totalTimeSpent%22%3A%225493%22%7D&isIframe=false&m=%7B%22description%22%3A%22Arctic%20Wolf%20Labs%20observed%20several%20ransomware%20cases%20involving%20a%20remote%20code%20execution%20vulnerability%20in%20Apache%20ActiveMQ.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Exploitation%20of%20CVE-2023-46604%20Leading%20to%20Ransomware%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Farcticwolf.com%2Fresources%2Fblog%2Ftellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware%2F&pageViewId=e09d2748-cc15-4f2a-85d8-c226f4ec3236&v=1.1.7

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.38.98.66 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a23-38-98-66.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://arcticwolf.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 16:48:36 GMT
x-content-type-options: nosniff
content-length: 43
pragma: no-cache
last-modified: Sat, 05 Jun 2021 07:56:05 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "60bb2e15-2b"
access-control-max-age: 86400
access-control-allow-methods: GET,POST
content-type: image/gif
access-control-allow-origin
cache-control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: *
expires: Wed, 19 Apr 2000 11:43:00 GMT

POST
H/1.1 204
No Content collect Show response
v.clarity.ms/ Frame 19AA 0
294 B 179ms
178ms XHR
text/plain 20.114.189.135
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://v.clarity.ms/collect
Requested by: Host: www.clarity.ms
URL: https://www.clarity.ms/s/0.7.13/clarity.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 20.114.189.135 Boydton, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: application/x-clarity-gzip
Referer: https://arcticwolf.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

Access-Control-Allow-Origin: https://arcticwolf.com
Date: Tue, 07 Nov 2023 16:48:36 GMT
Access-Control-Allow-Credentials: true
Server: nginx/1.18.0 (Ubuntu)
Connection: keep-alive
Vary: Origin
Request-Context: appId=cid-v1:3f60b293-70d6-4805-b0bb-3484f0a73bf0

POST
H2 200 v3 Show response
metrics.api.drift.com/monitoring/metrics/widget/init/ Frame CCFA 25 B
89 B 170ms
129ms XHR
application/json 50.16.7.188
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://metrics.api.drift.com/monitoring/metrics/widget/init/v3

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/51.558be3c5.chunk.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

50.16.7.188 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-50-16-7-188.compute-1.amazonaws.com

Software

istio-envoy /

Resource Hash

f8c91e009d219173c41b4c0b6e43ad28081f7580df6cb99a76aa0a476390ca47

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept: application/json, text/plain, */*
Referer: https://js.driftt.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Tue, 07 Nov 2023 16:48:36 GMT
strict-transport-security: max-age=31536000; includeSubDomains
server: istio-envoy
requestid: 545493dacec184f0
access-control-max-age: 1209600
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS, HEAD, PATCH
content-type: application/json;charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: X-Results-Total-Count,X-Page-Info
vary: Accept-Encoding
access-control-allow-credentials: true
x-envoy-upstream-service-time: 11
access-control-allow-headers: origin, content-type, accept, authorization, auth-token, uber-trace-id, x-amzn-oidc-data, x-version
content-length: 25

POST widget_bootstrap
bootstrap.api.drift.com/ Frame CCFA 0
0

POST
H2 200 mon Show response
obs.robotflowermobile.com/ 0
40 B 120ms
119ms XHR
application/json 2600:1f18:e8a:cd00:e7aa:3ac6:9899:87c4
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://obs.robotflowermobile.com/mon
Requested by: Host: ob.robotflowermobile.com
URL: https://ob.robotflowermobile.com/i/9decd3b0fe5c0841dd43a5375baa5a71.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2600:1f18:e8a:cd00:e7aa:3ac6:9899:87c4 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://arcticwolf.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

access-control-allow-origin: https://arcticwolf.com
date: Tue, 07 Nov 2023 16:48:37 GMT
access-control-allow-credentials: true
content-length: 0
access-control-allow-methods: GET,HEAD,PUT,PATCH,POST,DELETE
content-type: application/json

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
486 B 256ms
256ms Image
image/gif 23.38.98.66
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=468ce208ecea2d45efbf04ec75c998b4&svisitor=null&visitor=d8296237-13f5-43c2-8045-4708843062dc&session=2613a055-3ea6-4c91-8478-fc8d45f45f6b&event=active_time_track&q=%7B%22currentTime%22%3A%22Tue%2C%2007%20Nov%202023%2016%3A48%3A37%20GMT%22%2C%22lastTrackTime%22%3A%22Tue%2C%2007%20Nov%202023%2016%3A48%3A36%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%226494%22%7D&isIframe=false&m=%7B%22description%22%3A%22Arctic%20Wolf%20Labs%20observed%20several%20ransomware%20cases%20involving%20a%20remote%20code%20execution%20vulnerability%20in%20Apache%20ActiveMQ.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Exploitation%20of%20CVE-2023-46604%20Leading%20to%20Ransomware%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Farcticwolf.com%2Fresources%2Fblog%2Ftellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware%2F&pageViewId=e09d2748-cc15-4f2a-85d8-c226f4ec3236&v=1.1.7

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.38.98.66 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a23-38-98-66.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://arcticwolf.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 16:48:37 GMT
x-content-type-options: nosniff
content-length: 43
pragma: no-cache
last-modified: Sat, 05 Jun 2021 07:56:05 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "60bb2e15-2b"
access-control-max-age: 86400
access-control-allow-methods: GET,POST
content-type: image/gif
access-control-allow-origin
cache-control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: *
expires: Wed, 19 Apr 2000 11:43:00 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: bootstrap.api.drift.com
URL: https://bootstrap.api.drift.com/widget_bootstrap

Verdicts & Comments Add Verdict or Comment

173 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

54 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.cybersecurity.arcticwolf.com/	1970-01-20 16:02:57	Name: __cf_bm Value: Le6CdT6a5aclKeDeiucnBoqEn.fkuF4.JECn5oSRa_4-1699375709-0-AQgXHvx5kPDLrafLnsH+NsUhmAegG8rcINaSmCC+mSx1XOIwDGG2qzQN8hc6P201K3lGKN+tUh66BEz8SvKaWGA=
.arcticwolf.com/	1970-01-20 18:12:31	Name: _gcl_au Value: 1.1.1349226205.1699375711
.youtube.com/	1969-12-31 23:59:59	Name: YSC Value: i6An0quBhiU
.youtube.com/	1970-01-20 20:22:07	Name: VISITOR_INFO1_LIVE Value: XhfDfOcUoH0
tracking.g2crowd.com/	1970-01-20 16:23:05	Name: _session_id Value: e816e7028b880a3d2dc7160b73aaae49
.g2crowd.com/	1970-01-20 16:02:57	Name: __cf_bm Value: 14Ksyh73Bp.00KQBO2_aDDuR96w229BhBHK9Adg9udw-1699375710-0-ASCslljGo/8DcXJmtn5C2r3gqGbS9JW4th3/6qlO1WORmD51exAL2A2ZnN4ErO54tqeN3YSs0Bw+Y0OE36FJhpo=
.arcticwolf.com/	1970-01-20 18:12:31	Name: _rdt_uuid Value: 1699375711036.a8afca71-abad-446e-89f2-b25da6e551fc
.techtarget.com/	1970-01-20 16:02:57	Name: __cf_bm Value: ZIw5vidlFOdhWlkzkAq5yLylL9UNBp.4jZ9twJZiwIk-1699375711-0-AVof+bFMSrw7ttLxrciDkLiNPtP+TrLkNBXsD2NTUusunluo+6eZk4BuR3PruUSVU5bMufC0tBdz40Hhag1AIjk=
.arcticwolf.com/	1970-01-20 20:22:07	Name: dpi_utmOrigVals Value: %7B%22utm_orig_medium__c%22%3A%22none%22%2C%22utm_orig_source__c%22%3A%22none%22%7D
.zoominfo.com/	1970-01-20 16:02:57	Name: __cf_bm Value: HHz6PX0gfmGmLq.DqInqcaFTcNgSDqEQOh_aMuJm2qc-1699375711-0-AeTI0SbAJ8BqKMND5ShHXYFqfbK2rLR6E62vKbIQKCLcQO8CHhkW0DnB9MkKE47ylpRxJJrjWbmxTBcoLqz0HHQ=
.zoominfo.com/	1969-12-31 23:59:59	Name: _cfuvid Value: TJtALVf7ivFFSSQ13Uv2vLnXUy43eVg4LGcqCSiiBGE-1699375711150-0-604800000
.arcticwolf.com/	1970-01-21 00:48:31	Name: OptanonConsent Value: isGpcEnabled=0&datestamp=Tue+Nov+07+2023+17%3A48%3A31+GMT%2B0100+(Central+European+Standard+Time)&version=202307.1.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=071c223c-2d17-4982-8adc-65d01434e1df&interactionCount=0&landingPath=https%3A%2F%2Farcticwolf.com%2Fresources%2Fblog%2Ftellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware%2F&groups=C0005%3A0%2CC0001%3A1%2CC0002%3A0%2CC0004%3A0%2CC0003%3A0
.t.co/	1970-01-21 01:38:55	Name: muc_ads Value: a972f767-136e-4ed4-a9a3-919b72d5ece7
.twitter.com/	1970-01-21 01:38:55	Name: personalization_id Value: "v1_592e9BsLynWexLewxkzPRA=="
.arcticwolf.com/	1970-01-20 16:04:22	Name: _gid Value: GA1.2.873750876.1699375711
.arcticwolf.com/	1970-01-20 16:02:55	Name: _gat_UA-67837305-1 Value: 1
arcticwolf.com/	1970-01-21 00:48:31	Name: __pdst Value: 927d25d5be73457dbd884778a69ed681
.arcticwolf.com/	1970-01-21 01:38:55	Name: _mkto_trk Value: id:840-OSQ-661&token:_mch-arcticwolf.com-1699375711510-98937
.arcticwolf.com/	1970-01-20 18:12:31	Name: _fbp Value: fb.1.1699375711520.2070567645
cybersecurity.arcticwolf.com/	1969-12-31 23:59:59	Name: BIGipServersj21web-nginx-app_https Value: !5mB2XFdMSieqlp+6vCJNuEQ8FVxgEAXJj8xBf+RYmrBBmMhQuPA3nHSqamFbJTUdE/8bMbAJ9UOlOMo=
.arcticwolf.com/	1970-01-20 18:14:19	Name: _cq_duid Value: 1.1699375711.FLYuqZGsA7fQ9BFY
.arcticwolf.com/	1969-12-31 23:59:59	Name: _cq_suid Value: 1.1699375711.qi4lJuWAHSI6tkOH
.arcticwolf.com/	1970-01-21 01:38:55	Name: nmstat Value: 77977b30-6456-666e-fa26-d108152fcf07
www.clarity.ms/	1970-01-21 00:48:31	Name: CLID Value: 964d8664b817422dbdc9a0068ef0f7b3.20231107.20241106
.linkedin.com/	1970-01-20 18:12:31	Name: li_sugr Value: 1306ded1-5ef0-4646-a648-baca86299385
.linkedin.com/	1970-01-21 00:48:31	Name: bcookie Value: "v=2&6304ad0e-6fb3-44ce-889a-e2f1985dba8d"
.linkedin.com/	1970-01-20 16:04:22	Name: lidc Value: "b=TGST02:s=T:r=T:a=T:p=T:g=3120:u=1:x=1:i=1699375711:t=1699462111:v=2:sig=AQEiOYFmWyzxk4RFeSgTHG4EkI-2F3Q5"
.arcticwolf.com/	1970-01-21 00:48:31	Name: _clck Value: 334y5m\|2\|fgi\|0\|1406
6145655.global.siteimproveanalytics.io/	1970-01-20 16:13:00	Name: AWSALBCORS Value: gE/vJbLS7B44/V/KROfpo/SMgJFbtRQPMSYMWdZgAwGI+fnfK9G4Qm+Y3wTdLbXXK1glp52vc/1TTh5BWCdWe49vD2u3HCDI+UeOr7NGXtQH5CatWnPJgaA35vQP
.linkedin.com/	1970-01-20 16:46:07	Name: UserMatchHistory Value: AQJeUMHSS9D3hgAAAYuqr4Zsrsey1pS5GLdzZtQFPkkkUWyP7GSoyzfQ4thCggrw6NfNQzLcY3EFfQ
.linkedin.com/	1970-01-20 16:46:07	Name: AnalyticsSyncHistory Value: AQLW9UOggcwihwAAAYuqr4ZsbazqNcuIQUXXDs1rp-vD9jy6MmJNgxmVVwx8_dXnmvXZkeqodGZHD5y0rp0AyQ
obs.robotflowermobile.com/	1970-01-21 00:06:46	Name: cg_uuid Value: 1db0dbc3c1884ca5f0dfaa36cca745fd
.www.linkedin.com/	1970-01-21 00:48:31	Name: bscookie Value: "v=1&2023110716483210ede273-3970-47bf-8207-faf3229208e8AQG3X8rgeRN0kdc4PdmdQ3sgSdS7SXpT"
.linkedin.com/	1970-01-20 20:22:07	Name: li_gc Value: MTswOzE2OTkzNzU3MTI7MjswMjGUhdSBKJWXqG0RnRIrF8XfD8Zi4mPzF2oHDdLIsyydMQ==
.doubleclick.net/	1970-01-21 01:24:31	Name: IDE Value: AHWqTUkATUGEnSYmv4GkU432JZestlT5SGL64NOwG33WVPoEPsyjWl6RwebN8Yia
.arcticwolf.com/	1970-01-21 01:38:55	Name: _ga Value: GA1.1.1233921805.1699375711
.arcticwolf.com/	1970-01-20 16:04:22	Name: _uetsid Value: 7ba4cba07d8d11ee905eb786ef1ec7c2
.arcticwolf.com/	1970-01-21 01:24:31	Name: _uetvid Value: 7ba4f6107d8d11eea52c45b12b36f397
.c.bing.com/	1970-01-20 16:13:00	Name: MR Value: 0
.c.bing.com/	1970-01-21 01:24:31	Name: SRM_B Value: 1092E828465369190596FBEA47FF6870
.c.clarity.ms/	1969-12-31 23:59:59	Name: SM Value: C
.clarity.ms/	1970-01-21 01:24:31	Name: MUID Value: 1092E828465369190596FBEA47FF6870
.c.clarity.ms/	1970-01-20 16:13:00	Name: MR Value: 0
.c.clarity.ms/	1970-01-20 16:02:56	Name: ANONCHK Value: 0
.arcticwolf.com/	1970-01-20 16:04:22	Name: _clsk Value: 60upzh\|1699375715495\|2\|1\|v.clarity.ms/collect
.bing.com/	1970-01-21 01:24:31	Name: MUID Value: 018D08DBB49267073AE11B19B53E6648
arcticwolf.com/	1970-01-21 01:38:55	Name: _gd_visitor Value: d8296237-13f5-43c2-8045-4708843062dc
arcticwolf.com/	1970-01-20 16:03:10	Name: _gd_session Value: 2613a055-3ea6-4c91-8478-fc8d45f45f6b
arcticwolf.com/	1970-01-20 16:02:57	Name: drift_campaign_refresh Value: 959eaf2e-9498-42aa-88c2-83fe2e027f06
.arcticwolf.com/	1970-01-21 01:38:55	Name: _ga_33RYRGB9LX Value: GS1.1.1699375712.1.1.1699375715.57.0.0
.6sc.co/	1970-01-21 01:38:55	Name: 6suuid Value: 82632617c87c2700636a4a65cb030000af225100
.arcticwolf.com/	1970-01-21 01:38:55	Name: _zitok Value: 91dddfbf9df78bdebc191699375716
arcticwolf.com/	1970-01-21 01:38:55	Name: drift_aid Value: 393f5bca-0967-4119-90d5-86901ed052ab
arcticwolf.com/	1970-01-21 01:38:55	Name: driftt_aid Value: 393f5bca-0967-4119-90d5-86901ed052ab

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
worker	verbose	URL: blob:https://arcticwolf.com/72ae6b03-1927-430a-9fb1-81b77344145b(Line 1) Message: Error

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

6145655.global.siteimproveanalytics.io
840-osq-661.mktoresp.com
alb.reddit.com
analytics.twitter.com
app.cdn.lookbookhq.com
arcticwolf.com
b.6sc.co
bat.bing.com
bootstrap.api.drift.com
c.6sc.co
c.bing.com
c.clarity.ms
cc.swiftype.com
cdn-app.pathfactory.com
cdn.cookielaw.org
cdn.pdst.fm
connect.facebook.net
cybersecurity.arcticwolf.com
epsilon.6sense.com
fonts.googleapis.com
fonts.gstatic.com
geolocation.onetrust.com
googleads.g.doubleclick.net
ibc-flow.techtarget.com
ipv6.6sc.co
j.6sc.co
js.driftt.com
js.zi-scripts.com
jukebox.pathfactory.com
marvel-b1-cdn.bc0a.com
marvel-b2-cdn.bc0a.com
marvel-processor.bc0a.com
metrics.api.drift.com
munchkin.marketo.net
ob.robotflowermobile.com
obs.robotflowermobile.com
px.ads.linkedin.com
px4.ads.linkedin.com
region1.analytics.google.com
s.swiftypecdn.com
siteimproveanalytics.com
snap.licdn.com
static.ads-twitter.com
stats.g.doubleclick.net
t.co
tracking.g2crowd.com
trk.techtarget.com
us-central1-adaptive-growth.cloudfunctions.net
v.clarity.ms
ws-assets.zoominfo.com
ws.zoominfo.com
www.clarity.ms
www.facebook.com
www.google-analytics.com
www.google.com
www.google.de
www.googleadservices.com
www.googletagmanager.com
www.linkedin.com
www.redditstatic.com
www.youtube.com
bootstrap.api.drift.com
104.17.74.206
104.18.37.212
104.244.42.131
104.244.42.133
13.107.42.14
13.224.189.102
13.32.99.6
146.75.120.157
151.101.0.143
151.101.129.140
169.46.32.99
172.217.18.2
18.194.102.200
18.245.86.73
192.28.147.68
2.23.65.88
20.114.189.135
2001:4860:4802:32::36
2001:4860:4802:34::178
2001:4860:4802:36::36
23.38.98.66
2600:1f18:e8a:cd00:e7aa:3ac6:9899:87c4
2600:9000:2057:f800:1c:f10a:ad80:93a1
2600:9000:2250:b000:0:f267:a5c0:93a1
2606:4700:4400::6812:2089
2606:4700:4400::6812:24c4
2606:4700:4400::6812:2b1f
2606:4700::6810:890f
2606:4700::6812:82ec
2606:4700:e6::ac40:c11b
2620:1ec:21::14
2620:1ec:bdf::45
2620:1ec:c11::200
2a00:1450:4001:802::2008
2a00:1450:4001:809::200e
2a00:1450:4001:810::200a
2a00:1450:4001:813::2004
2a00:1450:4001:828::2003
2a00:1450:4001:82a::2003
2a00:1450:4001:82f::2002
2a00:1450:400c:c04::9b
2a02:26f0:480:f::213:7ec6
2a02:26f0:7100::210:180
2a03:2880:f083:9:face:b00c:0:3
2a03:2880:f176:84:face:b00c:0:25de
2a04:4e42::396
34.111.208.231
35.201.125.192
35.201.70.94
35.244.142.80
44.218.211.184
50.16.7.188
52.57.208.64
68.219.88.97
021f984ada81db0d517746f9748ffabbfa799e3a5d2958e07ea9139dce030c41
040e7b516a60105fbbd09dfba5e37c49539ce6b22b78aab284468c1185530f3d
04c4d305cf0edc83607305a34cd1e0d6c627e073dfc399ede6ac6729f6c508f3
08b15334412c5f3ad02391af96b4068d23b85e63c63fa8d78ee9bb7e78ce752d
0934b1fc0d3a766d41d3adf5e7a115875e66e98ebba408d965a41cf3d2cb4ab5
0b35f88d468214d1e8ea6b50a1161cddd4984b46d3c9b13d05f00438bf894083
0c07b854855b0e2bd7839c3659defa45307e96e281b3c00571d09f213eb6a76e
0dc90421cbf6414c9f1ef5e93af3dbe48a4e51899452330f0ae0b2815e38be94
0f83c5ce15a7c3e5c836c5692bc6f6cbc2114640d6558d0b1f2e2b64973274ed
0fe30a881b9d89d4dc8bf8100a8e5550ce4a09232f1cb4c109f105307f77b93b
138154c0deed3326477b9b4909175101070a5a3a95342291b53d8cc9879a5f47
1442bd1e775db156e5e8dfdac18d3363e323fe5dcaa648224124fb898b97b441
17184fd3335ad72ab651cd752ec591c5234985af840dbaaec580ac0464343dd1
190db2ea37186511e3cdfaeb6e37e68830c90647a9c18840f33ce00c03a05bd0
19473eebfb0672867a4438e2a015de79fded34b9f5ae5598bade57eb01cf0563
1a942c4e7372897cb501fba0ddb4b51fb3533d71975bd2d9d3a1f39ac5403831
1aeb9107928bb523947c28e17358efb50a07b942e15ed0a72259a5794ea2ca96
1e85ec81b9800b4c443d39caca0d0926089a3ac201120db1ceb45b93789480b8
1ec113f46304f75ff44544a25a9116a3798709d10a07c52c5f87c15b8e0f9f43
1f1af18d64fdcfd9d2191eec42881a3e16a482792ff4d1c4a7da67981a51d899
1ff9ef000c51805861082a92c963fe080d3353cc35b1bfe3c3e83304e691284d
214674cc77aba35ab3567b88e2739fd08e8e96c61d279559ad61874069683ea0
2157361193375a79ade3559e960f982daa8d599cf7f4a92d36e3eef257738f16
21e1e51e6bdcecfc73beaf750136c6fcd8c19e29cd0e5ef2995de5ff9801196d
2552d8d62d9c60f59b3b11a5d083d1ebd090c72de809fc7c76fb339825302241
256e42104f48a5fa80b031da12dc56acde224fba3f9810f8f8192b39136d365a
261774a6aad24d6e79e6998664f830b37bf553aee6bbb28526d119808b9bf3f8
2a8a441d8086f20a64563edc759aba1de84d932e34ff77b8bb0279a730cdb428
2bd9df0ec0cb10f973c964c67a07e827482efd9c0a6c831d5ebfd7b2cc8d03c5
2c566e98adbf310d99ae43a94b1f6f2ab9b19950ec5986897ed53483c66c5b18
2d7c7930eb39d59cd8c2dc00652977da3ed72347e7cd465f7b540e10e2121c22
2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363
310de82ec6ba5948814ab8ec2369aa1d437e84e26ac56967fc79897acaa99a95
31d95100c99a4bf5539f91f40bf5394d8655bd217c641ee8635f1c2ca355d1a8
31f7d8113ce6f90108d916a4d35c15a1ee50fe171224ff0d122e310005e08960
3321757433351762495ef3452adf0fcefa179583f4409dd04815c710c5e45f6f
344d11a2807ba0c7d963b062a5cfa5c3423204ff01cce22fdbe696c464fd0058
354142e53641e1e72a89609e46eff578e69d762290d65d84acaaf380751c20fa
37bab6cd583982e8eff58501a99d7c5c4d63664c1ca34f9e3b7cf526c5b73ae2
3c08dbd48249fa7ed7d32a4ea1688e9892b432ed60ceb04e97325a3b67e97346
3d0a742c9613bf7bb6797f4cf0568f031c40de94b40a3ba2b6df5938a76aa5c0
3dae93a05edd9dcfc1864b87178a31e0bfa93e1a9b1c486c6e9cbf73cae87862
3e136e77083bfc6ef14ffc5abd19da89a82bf12fc0cda3c603e01582b93303c8
3e584003b5c6df9bc2854b2775e527ef7240f3d1cae4047e9aa504cdfbc109f9
4012bd9589748b7b55e2916882b8a3c57042758d4d3ffb3b5cc4dc88ae10a6b3
41034890cce103c8bb5af53c090b8431802103e3ef948df4b38d034ebff4f9af
42e75f4dd3477b364ab00bac4c00e3aeb82e4f9cb848bf5afe95bf714172ec81
43c072c16c9ee6d67acdfa6c6d6685ff1e74eb4237b7cc3c1348ab1c108b26af
453cb806084fdabec32e286af2e88899f79022125c2527afffbec507975d2c22
458a0bfc433743487169403d4a82cfe6f703c488619ad7bd9568930ba95d5cc2
465654367d23cf09659d2a2ac381addef4d04a2b613f4c62073b98e248ac4f48
4799e6fee2ac082caeb34ece153a76289d6cce1159a3838bccf840970e066e30
481baffabb9011ae6ffd10103983908ebc2c06e6f6be7797d226ccee04c2172f
4c0ced2cb3830d045cdd74f745fd4d6dcb082d8edd3a9fe46e39295e30cb8032
4cd62f7068c73edc7f160882c315aa7aed6df4740fba5cb504f9c413400c093c
4f79a89d16a5f717110fe080c0bf90b7e05ff95a4c4983f64d33110bf5f9c230
4fab723e3b03f2720de214570b06da183b1591c142d72588252cd924bbc5bca0
4fc815561f5badd8bcd806002e2bc8411a6f154679f9bd8bec287fa5685279ed
509f2e49500fbaeb5d7e1959071f2922b693d0135080e2871e124ec8bdd08bb2
5156dff19f3da0b22f54fae9883fdc4a140ab79ec89aac752751e9fc643159bc
5206536707c84baa892d3c3231b351985ee828cb8b9c0bd8db42cd3363995fc4
5274f11e6fb32ae0cf2dfb9f8043272865c397a7c4223b4cfa7d50ea52fbde89
54b504a934b8cc1b8bf548c18b209e1f490a9ed03e7d6905935743d488e02344
54ea57786634bfa60c34643638a57868ab254fcde1c47b6e2b30813eff03adbf
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3
57cd46adbabd6c40823602b4513aecbe89320a769572255272abe9f008de69fa
58c855e7eb9b917e71e6b733e73c542c25bacb986f3ba7df2be1570200312135
58fdb03fac3e89e51525a5a45eb777395d1b499bf4483e96201b6becddbe516f
59a173f8b6cb9f95f090a5358f2bcb59a4abfafdfe04ef47932312cfe6a14eb1
5a84d09e92e25d2c3f4c66621d3ccc47b9ea6c943e83b8e283817a7920b45bab
5c93f77799d122fb5255ee24da285f9f228cc118cba11e6ceb2b6bda8cdf4164
5dbaf0a4ff0f8ac8c1b67550eee84390b089604ffaf71183e417636c7e183ac5
5df7062ba2bdba128e66405b62616576717b6d3506c58d54081f2715a42ce84d
5fa00d047acd959697b9d7772c31dcd37bec33c70c6fbf80ab8316205d1d286d
60409946ec37f5d25bf3516bd3fbc347358e60feaf168a3d578b323cb750860b
60a6db28503da0b2c2f4e39da485b7649425cd481da5dee9ff33f6c68e9cb480
622373f59cdda9ea36f307c5f7bef0cfd8e140018c995b6394468a26ef499dec
639d0d582c4d7e66bddd8a2a18d2f1e0274a0c3b3c5952ad5cf4263e4e71d4fb
66c3b4aadc62679644c1e23f62e78215d941781bd5d15628ae1ce128a0136f6f
670628ef5307d8685febf9feb94c11c8224247ffe69dacfccb320eb9be1d1719
6861a320271e0fda832800e20d53b858ef409f88d9bc9c1a48953888289d1ea3
68cc280ce370c6f1f51a4fc5950103fc38df80a429552c549add04ebd8bd3a23
691dcdb24853a0f5ce4e6597e5713dea66799b57ffe2c2a10f28f98e0b569b19
6974bfd8fa06b7831f05cb4b25860c851a5ad3f02a6699ebe688987dd7a6ebe6
698e93fe491cc7bbf07a470579a33dbd0db53c19142b7be41ebfd39a23aef11f
6b1fc966c38b12c845f9fd8bdb76027106b776783fd44eeed917663942b5fd16
6c9c6406c9bd9814cf84974221433003377b67f071ec5411fddbcba4ec109bca
6e27fdad460fa326d0d3e8f311c5c22e6b28a34a93c58220d93f98357f08c058
6eabf982ec86c7a2d08d260cdd257c9d1f1d9b589cb52a812be0dc5c7cf1af9a
7046172ae59943e9a78dee86bb214d3d892dc01a8ee4b0fcd2fdb1c20a8612b2
70473bd0b0e7e7184f687732de1aecf333cd42fea1bd239d95d9319b3fe7cd7c
71d07479f4b2b809e5769a352f4f55b84690289026ace7ed5395230002551a11
74e69ccf2f5cb32c175e328707c515fc9116ddd5cb3c92882d9bd53d3a742d63
7641f066c35d0ca15d4897bfe49d640ed4c143ff8f04030c2020cbb2acfa7b0b
7849ba1748f8188749df28e9d59ca4e570a8495684353d8df4715fa70a81e787
7868467c94a5aa0b3f11ef542f45287967f9627b3b5acdc86e47f8f77a126596
7a7b726b264b8fc017eaf3f94de7fb9f47cc162b781f2806d4b8b9a371c6f8ff
7b0c85ad25e63ace10fd6b2f7bcf14143b559247650f9368ac5cea4c8224096e
7c8b113cce07a87ca4cb9dc4f1c55d701efd44834430e1939c27b2e5e1c12ac1
7f0ab178ba7c6104c1b971d3f81b55be373e2dce84e81b6d1ed017ee977d925b
82646eceaea52567040cee32d51971f4d9d8217516c98bbb47ab82433851bd5a
84d61e7247b5194fedf074ca201a7bbc68d3ee141236b4e7cb5030abf9ab58c5
84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80
862bae5c822d87db86d0b893f474177ca1d9a51309354f12cc0ab85cd9bd9cf7
889b78c162a1d4307aa47d4f1ceeff2162a06b4ba080c7b9ee129b9805fba55b
89f2c719a1ca89c3c911fcab385679f58369f959385b695eb2a9abeddd93d355
8f0f8792237470ee661c6afc32ca68200dd74bcc0d544d0fd54c7777af362eae
901bb0e03b8c3c0a1cf4c487a177417328bb7d8c94106ecefceedd7d7f6c4ddc
916baea92eb9094e106e44c8d6de06469c6f446ae5ff8550767587489b80304c
918b7dc3e2e2d015c16ce08b57bcb64d2253bafc1707658f361e72865498e537
92007e698ebe04dda7f339497a7154271b384db07dc5588465c2e02b84643ed0
9201d355e85a0a2c97cfd63112d7d4d5e81e9311c359f6174031f51b71610f86
93782ddf0e56d9337912140c04414253fd17fac6ed1520ea517dfce09975f83c
941b1493157dfb7316bcb3c7357a94e9ba173607d80559408620f4ab4c39c88d
948240da929defbe2f377b6a2173cf7c0988edc05972424cb3872abc739aa024
94d2e4711b49d624a5da206ae3eb4b179b55cc4104c2573f267e7bf8cc9f2b81
94d994c6f0db021016fd8fb66caa72767cf51b540faaeb8753672d59a5502904
97cf1307c16a437b77b5f7f5c9bc0b985d0745a14be5a279019aca5a3432e264
98b3d9d20e032f90aca49e9b116225d539ff6fbdb7e42c3c363f63896ac03d2a
98e8251688b86ed104b49c547b53408315fa196773ba220faf4f2945010eeedc
99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12
9b6b1e260630ae98e454c1b77daffdb3e5dfd3af1693290a9a13f2a6217bf4cd
9babe27bc02fe4d0b02c5119b7257a15a4cc31ebdc2e25580197a61a184c7b38
9c637b699240b1c90cdfc30198a397159051cb59db4ab6e49f9d231992824b93
9cc67772363e342ed79e99b9c01f3825ac7b282d6721bb67d77acc4ae37183af
9cd63b8cea25045c14623c538d26752518a58c0c682795ce6ad3078976c65a37
9da132e5bd56021d5a70c81b6e6f51e885362b94bddb1a52c883220b6403f070
9ed6388d56fc9f2044791e0559ab4a283381791e359dc2981449955e702de56d
a0013b499303da60cc6f7ae92351c6ce49a02ca2121992127d743b7610bed991
a4070c8c1e9a3ec5f00c5072b23a70a87e32f2c336956bb4d12f515bc05b8196
a526f7e1a82516f99f2639fc48cd8033545c9d1ddae99c01942dede8116d4ee5
a75d3df8572f228732ea3d2011fbee4e7cf12d8ccd075eab6d420eb7f5550ae6
abfb1822ca408cb63bb0404e5c2d835d873893f4fb7cefebc3ae00f6d889cf9c
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
ad35c96a8104ac3ccd60c7ce3cd073f9804e816c496c48b90197672e87ab7623
aec60bc104db041b1512185839f18f52986df7e569e5445f740dd60f763fbca8
afbd41e7209fa3aef6f53c7a5713aa542a7be54c432fec2d690e0dfaccd528d1
b0af909b7ae6ad2644bfe2a60d939092aaf113b2cbc4ed2981a892869143b98a
b13c9311dec3f49821d88065299e95cc1c4e6c26acc4b27b4ebdb380d40d8788
b3d36d39115b608d02cd408b59c420c2256829708ca19c8bedc46bf3b51bb2ad
b6131e06fcb9060f687ce48a1c26f52333ba731796ee9bfc9c22589d71bbc859
b84595cc8461bb6e8376fe94f0dd23d6657172103b03653534089c5992b058a1
b84e1123de812ccdb8a44854c47dce5c52e0ccc663c263031a10ce253506c376
bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96
bba54915db71fc417be4d5852ec7d138d7c3fa90356ddee98b5267a7db7e6b5b
bc0b140691452cb2f725b9cb77f5ada4759ca70a384071eeec68828469b7a174
bc9c387b513b4d43675910f780fa03e92b9a4b58432b402a8f0a801a0d5ae855
bdfb013c1a0ae23a6ea0a548957c1aa6d48db8ebf2fe6cf2265fbaaa4f3af08a
c0ad39faea959c6452ccf07bbf3c65bf7f5e1afa8df00d05cfbb1087a8aee9ac
c1a9a3e223bad631dff12d33b5499eb145cb08d8621c20d9d73870e78d97afe4
c21e5a2b32c47bc5f9d9efc97bc0e29fd081946d1d3ebffc5621cfafb1d3960e
c375e284cb478a8f21e391c99fb79c9174682d0c21e13a3ed69aa0afa6fa073b
c4047043368afb4baf1aed25d358a5c2a333842a3b436b58491ab36aeee65b9d
c447dd7677b419db7b21dbdfc6277c7816a913ffda76fd2e52702df538de0e49
c501de88fbb90a445f1754a529bc772e7047071bf653c8c3f0330f7bb736d140
c55902832fb84522d02ea1a60a30747403a140d8651fa748f13ba398b0c0df3a
c5904cf8f871eff63432d228df275b03148a0f5e8cc30abfed54f8a8dac1966a
c640d911a58cc3ef31b1a3c2090fa753c948902033b9917ab5daef4fbb33b5d2
c7267d9f9b72944e2b3772a521fd1b8882ca17b124de63549fbf591167efbd25
ca7dce2391845e8aec7da135f33fabd10f74eed28a532ac66fd01f761fcfb42f
cb8d40d1eb7e2dc885affcf0012d9e1a73c270d843e8b890d36538e52d0a0342
cbe2fc29e72f63a275cd00904894ac08aeb29e5517d0cc9352330f36dd59bffe
ced3cd3efe4d2a4b52f805214ea9fdb3bc03b623a91000b074a7f1de548f6313
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
cf48573e140a266c7f3f7143927609cce8e0ddb49f35172c2f51f75bfbf742e1
cf7fcc9f75c8717897bfaef72f303fab423ce1b70c98512aeb3677e4af988dee
d01a2ba2805c78957e15a2958135de0f3cb88e95159dd0f6c0a032bd76b1b0e9
d0b4256abed72481585662971262eabee345c19f837af00d7ce24239d3b40eef
d14e287ddae470b06c4639e73260ca21a4c9b7cfdf56e02965a8f50fb5333b42
d2fed8e15746b8f841e6ca76b690a83fd254e038616529e81e38c0d9f36f3ca0
d4ce77a1972c9d30713fba68f8f7f883cf72ceeb6311f0c05ff02463c20a59a7
d55ad3bc35664e6ce9dc3e6a71bb6d3a4c8fddeb6af1a195727c0361ddd92a2e
d58038106e94ae0e80e0a6528a9c5ec528fbe725fe618d80be2a1f5f48db705e
d622534d53d3ac1095af275f0b30274fcd835785577df2dde6d9398e6f7a2c8f
d6515002ade1e87b59e9ae857fbd6cd2ece4848ecb0da9788d895c6d3016a882
d70fa5dc6c8bfe9d7824be31e669528533d0879a2b1600a7df68b880f4d44296
d87ddf917b7a1449ab45e2b8e3c98354629bdd65b6659c37e6023bbea1ce1386
d9755b7eff734eeb6267db6515f0267fc66622cd873cd37f65761b3fcc94cac2
d9ef036ab51db2ff3702420a2f297920ff435fc8d3caf12b3e687b56288a4e78
dc44c31fed9046e1a602efa34cd714bd578742e1341b6e465a060aef588bea94
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
dd09e3ba26066abe27c4dad57c8e0c8a63fe23a0bc87e63bcab94f25e9096459
dda5c21702588bb75d10250c4974558875c340b33fed6c691fb03eb4a78b1e16
de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd
e0c6f8695589df90e63442fee1c9cf14e60dfc4fd8ce7296515b1d6db41e1d3d
e127a19a6941ffa460929836f1b02457816f1282c5bb26acb12806cd3d7bc8c5
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e40b6eae9d66c60b9c750da70da6b2bc5d35c2ae9689cc1e9547e300fac4a3ba
e555f4b34b579e6528d6bbd4819620a634c0759b41dfa99520b7ca5aa5117b11
e5d70d017ac28db5708fb5e9fd340202dfb4cb8c9b06b3de7af06e7b99ae60b2
e6ff9c0c443a9050137759816c352d43e96a673bb4023c2ba231cdbed6fe6f52
e803e774c7b59fe74f71ed93acaa875cf9a99947ff8ed7615cd0c93c1667250f
e819900615c03aaca57d3acfd08960f3a4d88a538d2bcfa5a2a8747a2136fd3f
e8a99c16a581c4e69330699d00aa4a7763158ed99194087bceebd232d53eb42f
eb91e77384f9aff2e81a868ae4f2ae6fb5940c573d0e39088ff637414b4ffed9
ec3a84e593065a50cd77ce9fba273b4196936940c0813ca248b045df2e2c8eff
ed5b5df9ceacfe76857ac51964972b0b417a215b2f50e837fd6b64bad7339c40
edf1011ad272d21b66ae82a21a9d029186dc81c9f13972203fc3107f75835d4b
eea3d6ccda7f6503078cce9dc41176c1357af1c93a5b3625131ef7cf21c9d7c4
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f431919bb83be2c363666c96f3f7c96e5c1953b3a08c710d00f0562d86faa7ea
f65784e5e7332dc1e4bbeacbec70fdeef4a1bea84f16ce2ee144999719d195ce
f7bb442b06bfb13ecfee3c3ec2b6b19440a33e080ca9378f8d6f161281bd01ed
f8c91e009d219173c41b4c0b6e43ad28081f7580df6cb99a76aa0a476390ca47
f9a144d016db30ba861af6f2464d3df7bd55240b2c1b9635d6e2527320ec81ea
f9f8a2c12a04d9ac4408a2e31569abedeac96e4817b3e3b25e10a80cff9fc200
fd286663cd94d01fd93d5a6e9e397341593939340afeb76e2ee54ee8f5a4be37
fd44e0aa8a3a221018e8d2e8a05adadc50a642b86c621a8223b26c7fda681162
fe04a9dc88d3f3be8d4f6bc63a9a80f45a4c6d8460e7551dab849457c091920a
fe513ef974b767510d0a2b9f1b4d3afa53185b89ab617c869e5e3d6db960192c
fe92edba1f5990d76e1817f250ee4aae144f4efa95b676733bdd4391f2b74cf1
ff4bd34aa98a0214833619d3d751838db015722dfbbec15cd14dadc66cd67869

arcticwolf.com Open in urlscan Pro 13.224.189.102 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

282 Requests

96 %HTTPS

52 %IPv6

43 Domains

61 Subdomains

54 IPs

5 Countries

3587 kBTransfer

13230 kBSize

54 Cookies

15 Outgoing links

Redirected requests

282 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 2 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

arcticwolf.com Open in urlscan Pro
13.224.189.102 Public Scan

Screenshot
Live screenshot

Full Image

282
Requests

96 %
HTTPS

52 %
IPv6

43
Domains

61
Subdomains

54
IPs

5
Countries

3587 kB
Transfer

13230 kB
Size

54
Cookies

282 HTTP transactions
2 data transactions