redcanary.com Open in urlscan Pro
104.198.136.223 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
Submission: On August 31 via api (August 31st 2023, 6:27:06 pm UTC) from US — Scanned from DE

Summary HTTP 134 Redirects Links 20 Behaviour Indicators

Summary

This website contacted 44 IPs in 7 countries across 34 domains to perform 134 HTTP transactions. The main IP is 104.198.136.223, located in Council Bluffs, United States and belongs to GOOGLE-CLOUD-PLATFORM, US. The main domain is redcanary.com. The Cisco Umbrella rank of the primary domain is 439602.
TLS certificate: Issued by R3 on July 24th 2023. Valid for: 3 months.

This is the only time redcanary.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
23	104.198.136.223 104.198.136.223	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1	2a00:1450:400... 2a00:1450:4001:810::200a	15169 (GOOGLE) (GOOGLE)
1	104.17.72.206 104.17.72.206	13335 (CLOUDFLAR...) (CLOUDFLARENET)
5	152.195.15.58 152.195.15.58	15133 (EDGECAST) (EDGECAST)
6	2606:4700::68... 2606:4700::6813:9308	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	2a00:1450:400... 2a00:1450:4001:809::2008	15169 (GOOGLE) (GOOGLE)
6	2606:4700::68... 2606:4700::6812:1105	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	2606:4700::68... 2606:4700::6811:190e	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	52.92.210.152 52.92.210.152	16509 (AMAZON-02) (AMAZON-02)
2	104.64.124.188 104.64.124.188	16625 (AKAMAI-AS) (AKAMAI-AS)
9	23.38.98.237 23.38.98.237	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	2a00:1450:400... 2a00:1450:4001:830::200a	15169 (GOOGLE) (GOOGLE)
2	2600:1901:1:c... 2600:1901:1:c36::	15169 (GOOGLE) (GOOGLE)
1	192.28.147.68 192.28.147.68	15224 (OMNITURE) (OMNITURE)
18	2a04:4e42:8d:... 2a04:4e42:8d::762	54113 (FASTLY) (FASTLY)
1	2a04:4e42:8d:... 2a04:4e42:8d::760	54113 (FASTLY) (FASTLY)
3	2a02:26f0:280... 2a02:26f0:280:3::213:789e	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
2	2600:1901:0:5... 2600:1901:0:524d::	15169 (GOOGLE) (GOOGLE)
1	2001:4860:480... 2001:4860:4802:32::36	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:400c:c04::9b	15169 (GOOGLE) (GOOGLE)
3	2a00:1450:400... 2a00:1450:4001:82f::2003	15169 (GOOGLE) (GOOGLE)
1	199.232.148.157 199.232.148.157	54113 (FASTLY) (FASTLY)
2	2a02:26f0:480... 2a02:26f0:480:15::213:7e4a	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	2a04:4e42:600... 2a04:4e42:600::396	54113 (FASTLY) (FASTLY)
1	2a00:1450:400... 2a00:1450:4001:812::2002	15169 (GOOGLE) (GOOGLE)
3	2620:1ec:c11:... 2620:1ec:c11::200	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
2	2a03:2880:f08... 2a03:2880:f084:d:face:b00c:0:3	32934 (FACEBOOK) (FACEBOOK)
1 1	68.67.153.60 68.67.153.60	29990 (ASN-APPNEX) (ASN-APPNEX)
2 3	185.89.210.244 185.89.210.244	29990 (ASN-APPNEX) (ASN-APPNEX)
1	2600:9000:225... 2600:9000:2251:1000:12:3734:2a40:93a1	16509 (AMAZON-02) (AMAZON-02)
8	2600:1901:1:81:: 2600:1901:1:81::	15169 (GOOGLE) (GOOGLE)
1	151.101.1.140 151.101.1.140	54113 (FASTLY) (FASTLY)
1	104.244.42.133 104.244.42.133	13414 (TWITTER) (TWITTER)
1	104.244.42.131 104.244.42.131	13414 (TWITTER) (TWITTER)
2	2a00:1450:400... 2a00:1450:4001:829::2004	15169 (GOOGLE) (GOOGLE)
1	52.18.119.10 52.18.119.10	16509 (AMAZON-02) (AMAZON-02)
1	2600:9000:26d... 2600:9000:26db:ea00:2:53b2:240:93a1	16509 (AMAZON-02) (AMAZON-02)
4 4	2620:1ec:21::14 2620:1ec:21::14	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	13.107.42.14 13.107.42.14	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
2	2a03:2880:f17... 2a03:2880:f177:185:face:b00c:0:25de	32934 (FACEBOOK) (FACEBOOK)
1	54.164.227.36 54.164.227.36	14618 (AMAZON-AES) (AMAZON-AES)
2	2606:4700::68... 2606:4700::6812:1005	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	35.186.247.156 35.186.247.156	15169 (GOOGLE) (GOOGLE)
3	2a00:1450:400... 2a00:1450:4001:82a::200e	15169 (GOOGLE) (GOOGLE)
2	52.216.61.74 52.216.61.74	16509 (AMAZON-02) (AMAZON-02)
134	44

23 104.198.136.223 (Council Bluffs, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 223.136.198.104.bc.googleusercontent.com

redcanary.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:810::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

ajax.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.17.72.206 (None, )

ASN13335 (CLOUDFLARENET, US)

resource.redcanary.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 152.195.15.58 (United States)

ASN15133 (EDGECAST, US)

cdn.bizible.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
cdn.bizibly.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2606:4700::6813:9308 (United States)

ASN13335 (CLOUDFLARENET, US)

script.crazyegg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:809::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2606:4700::6812:1105 (United States)

ASN13335 (CLOUDFLARENET, US)

js.qualified.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
assets.qualified.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700::6811:190e (United States)

ASN13335 (CLOUDFLARENET, US)

cdnjs.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.92.210.152 (Boardman, United States)

ASN16509 (AMAZON-02, US)
PTR: s3-us-west-2.amazonaws.com

s3-us-west-2.amazonaws.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 104.64.124.188 (Prague, Czech Republic)

ASN16625 (AKAMAI-AS, US)
PTR: a104-64-124-188.deploy.static.akamaitechnologies.com

munchkin.marketo.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 23.38.98.237 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)
PTR: a23-38-98-237.deploy.static.akamaitechnologies.com

j.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
c.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
b.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:830::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2600:1901:1:c36:: (United States)

ASN15169 (GOOGLE, US)

open.spotify.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 192.28.147.68 (United States)

ASN15224 (OMNITURE, US)

003-yru-314.mktoresp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

18 2a04:4e42:8d::762 (United States)

ASN54113 (FASTLY, US)

embed-cdn.spotifycdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a04:4e42:8d::760 (United States)

ASN54113 (FASTLY, US)

i.scdn.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a02:26f0:280:3::213:789e (Düsseldorf, Germany)

ASN20940 (AKAMAI-ASN1, NL)

encore.scdn.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2600:1901:0:524d:: (Kansas City, United States)

ASN15169 (GOOGLE, US)

apresolve.spotify.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2001:4860:4802:32::36 (United States)

ASN15169 (GOOGLE, US)

region1.analytics.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:400c:c04::9b (Brussels, Belgium)

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:82f::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 199.232.148.157 (Amsterdam, Netherlands)

ASN54113 (FASTLY, US)

static.ads-twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a02:26f0:480:15::213:7e4a (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)

snap.licdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a04:4e42:600::396 (United States)

ASN54113 (FASTLY, US)

www.redditstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:812::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2620:1ec:c11::200 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

bat.bing.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f084:d:face:b00c:0:3 (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 68.67.153.60 (Secaucus, United States) 1 redirects

ASN29990 (ASN-APPNEX, US)
PTR: s.ml-attr.com.pxlsrv.net

s.ml-attr.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 185.89.210.244 (Frankfurt am Main, Germany) 2 redirects

ASN29990 (ASN-APPNEX, US)
PTR: 946.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net

secure.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:2251:1000:12:3734:2a40:93a1 (United States)

ASN16509 (AMAZON-02, US)

attr.ml-api.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 2600:1901:1:81:: (United States)

ASN15169 (GOOGLE, US)

gew4-spclient.spotify.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.1.140 (United States)

ASN54113 (FASTLY, US)

alb.reddit.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.244.42.133 (United States)

ASN13414 (TWITTER, US)

t.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.244.42.131 (United States)

ASN13414 (TWITTER, US)

analytics.twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:829::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.18.119.10 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-18-119-10.eu-west-1.compute.amazonaws.com

tracking.crazyegg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:26db:ea00:2:53b2:240:93a1 (United States)

ASN16509 (AMAZON-02, US)

cdn.linkedin.oribi.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2620:1ec:21::14 (United States) 4 redirects

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

px.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
www.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.107.42.14 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

px4.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f177:185:face:b00c:0:25de (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 54.164.227.36 (United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-164-227-36.compute-1.amazonaws.com

app.qualified.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700::6812:1005 (United States)

ASN13335 (CLOUDFLARENET, US)

assets.qualified.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.186.247.156 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 156.247.186.35.bc.googleusercontent.com

sentry.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:82a::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.216.61.74 (Ashburn, United States)

ASN16509 (AMAZON-02, US)
PTR: s3-us-east-1-r-w.amazonaws.com

qualified-production.s3.us-east-1.amazonaws.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
24	redcanary.com redcanary.com — Cisco Umbrella Rank: 439602 resource.redcanary.com — Cisco Umbrella Rank: 731005	2 MB
18	spotifycdn.com embed-cdn.spotifycdn.com — Cisco Umbrella Rank: 13792	543 KB
12	spotify.com open.spotify.com — Cisco Umbrella Rank: 3592 apresolve.spotify.com — Cisco Umbrella Rank: 898 gew4-spclient.spotify.com — Cisco Umbrella Rank: 9281	6 KB
9	6sc.co j.6sc.co — Cisco Umbrella Rank: 5691 c.6sc.co — Cisco Umbrella Rank: 8562 b.6sc.co — Cisco Umbrella Rank: 3992	17 KB
9	qualified.com js.qualified.com — Cisco Umbrella Rank: 20853 app.qualified.com — Cisco Umbrella Rank: 21652 assets.qualified.com — Cisco Umbrella Rank: 22975	832 KB
7	crazyegg.com script.crazyegg.com — Cisco Umbrella Rank: 2237 tracking.crazyegg.com — Cisco Umbrella Rank: 4119	75 KB
5	linkedin.com 4 redirects px.ads.linkedin.com — Cisco Umbrella Rank: 365 www.linkedin.com — Cisco Umbrella Rank: 625 px4.ads.linkedin.com — Cisco Umbrella Rank: 6371	5 KB
4	scdn.co i.scdn.co — Cisco Umbrella Rank: 1328 encore.scdn.co — Cisco Umbrella Rank: 6604	288 KB
4	bizible.com cdn.bizible.com — Cisco Umbrella Rank: 6623	26 KB
3	google-analytics.com www.google-analytics.com — Cisco Umbrella Rank: 35	69 KB
3	adnxs.com 2 redirects secure.adnxs.com — Cisco Umbrella Rank: 450	2 KB
3	bing.com bat.bing.com — Cisco Umbrella Rank: 374	13 KB
3	google.de www.google.de — Cisco Umbrella Rank: 6457	625 B
3	doubleclick.net stats.g.doubleclick.net — Cisco Umbrella Rank: 87 googleads.g.doubleclick.net — Cisco Umbrella Rank: 40	2 KB
3	google.com region1.analytics.google.com — Cisco Umbrella Rank: 3238 www.google.com — Cisco Umbrella Rank: 2	814 B
3	amazonaws.com s3-us-west-2.amazonaws.com qualified-production.s3.us-east-1.amazonaws.com — Cisco Umbrella Rank: 29787	67 KB
2	facebook.com www.facebook.com — Cisco Umbrella Rank: 109	232 B
2	facebook.net connect.facebook.net — Cisco Umbrella Rank: 169	88 KB
2	licdn.com snap.licdn.com — Cisco Umbrella Rank: 760	6 KB
2	marketo.net munchkin.marketo.net — Cisco Umbrella Rank: 3330	6 KB
2	cloudflare.com cdnjs.cloudflare.com — Cisco Umbrella Rank: 220	34 KB
2	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 47	189 KB
2	googleapis.com ajax.googleapis.com — Cisco Umbrella Rank: 368 fonts.googleapis.com — Cisco Umbrella Rank: 41	32 KB
1	sentry.io sentry.io — Cisco Umbrella Rank: 177	324 B
1	oribi.io cdn.linkedin.oribi.io — Cisco Umbrella Rank: 881	375 B
1	twitter.com analytics.twitter.com — Cisco Umbrella Rank: 742	395 B
1	t.co t.co — Cisco Umbrella Rank: 577	378 B
1	reddit.com alb.reddit.com — Cisco Umbrella Rank: 1523	637 B
1	bizibly.com cdn.bizibly.com — Cisco Umbrella Rank: 12180	203 B
1	ml-api.io attr.ml-api.io — Cisco Umbrella Rank: 20509	233 B
1	ml-attr.com 1 redirects s.ml-attr.com — Cisco Umbrella Rank: 16560	278 B
1	redditstatic.com www.redditstatic.com — Cisco Umbrella Rank: 1344	8 KB
1	ads-twitter.com static.ads-twitter.com — Cisco Umbrella Rank: 758	15 KB
1	mktoresp.com 003-yru-314.mktoresp.com	318 B
134	34

	Domain	Requested by
23	redcanary.com	redcanary.com
18	embed-cdn.spotifycdn.com	open.spotify.com embed-cdn.spotifycdn.com
8	gew4-spclient.spotify.com	embed-cdn.spotifycdn.com
7	assets.qualified.com	redcanary.com app.qualified.com
6	b.6sc.co
6	script.crazyegg.com	redcanary.com script.crazyegg.com
4	cdn.bizible.com	redcanary.com cdn.bizible.com
3	www.google-analytics.com	www.googletagmanager.com cdn.bizible.com
3	px.ads.linkedin.com	3 redirects
3	secure.adnxs.com	2 redirects cdn.bizible.com
3	bat.bing.com	www.googletagmanager.com bat.bing.com redcanary.com
3	www.google.de	redcanary.com
3	encore.scdn.co	embed-cdn.spotifycdn.com
2	qualified-production.s3.us-east-1.amazonaws.com
2	www.facebook.com	redcanary.com
2	www.google.com	redcanary.com
2	connect.facebook.net	redcanary.com connect.facebook.net
2	snap.licdn.com	www.googletagmanager.com snap.licdn.com
2	stats.g.doubleclick.net	www.googletagmanager.com cdn.bizible.com
2	apresolve.spotify.com	embed-cdn.spotifycdn.com
2	open.spotify.com	redcanary.com embed-cdn.spotifycdn.com
2	j.6sc.co	redcanary.com www.googletagmanager.com
2	munchkin.marketo.net	redcanary.com munchkin.marketo.net
2	cdnjs.cloudflare.com	redcanary.com
2	www.googletagmanager.com	redcanary.com
1	c.6sc.co	cdn.bizible.com
1	sentry.io	assets.qualified.com
1	app.qualified.com	js.qualified.com
1	px4.ads.linkedin.com	redcanary.com
1	www.linkedin.com	1 redirects
1	cdn.linkedin.oribi.io	cdn.bizible.com
1	tracking.crazyegg.com	script.crazyegg.com
1	analytics.twitter.com	redcanary.com
1	t.co	redcanary.com
1	alb.reddit.com	redcanary.com
1	cdn.bizibly.com	redcanary.com
1	attr.ml-api.io	redcanary.com
1	s.ml-attr.com	1 redirects
1	googleads.g.doubleclick.net	www.googletagmanager.com
1	www.redditstatic.com	www.googletagmanager.com
1	static.ads-twitter.com	www.googletagmanager.com
1	region1.analytics.google.com	www.googletagmanager.com
1	i.scdn.co	embed-cdn.spotifycdn.com
1	003-yru-314.mktoresp.com	munchkin.marketo.net
1	fonts.googleapis.com	redcanary.com
1	s3-us-west-2.amazonaws.com	redcanary.com
1	js.qualified.com	redcanary.com
1	resource.redcanary.com	redcanary.com
1	ajax.googleapis.com	redcanary.com
134	49

This site contains links to these domains. Also see Links.

Domain
resource.redcanary.com
attack.mitre.org
learn.microsoft.com
docs.microsoft.com
twitter.com
atomicredteam.io
github.com
www.linkedin.com
www.youtube.com
help.redcanary.com

Subject Issuer	Validity	Valid
redcanary.com R3	`2023-07-24` - `2023-10-22`	3 months	crt.sh
upload.video.google.com GTS CA 1C3	`2023-08-07` - `2023-10-30`	3 months	crt.sh
resource.redcanary.com Cloudflare Inc ECC CA-3	`2023-04-02` - `2024-04-01`	a year	crt.sh
io.bizible.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-06-01` - `2024-07-01`	a year	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2023-03-09` - `2024-03-08`	a year	crt.sh
*.google-analytics.com GTS CA 1C3	`2023-08-07` - `2023-10-30`	3 months	crt.sh
*.s3-us-west-2.amazonaws.com Amazon RSA 2048 M01	`2023-04-11` - `2023-12-28`	9 months	crt.sh
*.marketo.net DigiCert TLS RSA SHA256 2020 CA1	`2023-02-06` - `2024-02-05`	a year	crt.sh
6sc.co R3	`2023-08-19` - `2023-11-17`	3 months	crt.sh
*.spotify.com DigiCert TLS RSA SHA256 2020 CA1	`2023-03-07` - `2024-03-06`	a year	crt.sh
*.mktoresp.com DigiCert TLS RSA SHA256 2020 CA1	`2022-10-05` - `2023-11-05`	a year	crt.sh
*.spotifycdn.com GlobalSign Atlas R3 DV TLS CA 2023 Q2	`2023-07-07` - `2024-08-07`	a year	crt.sh
*.scdn.co GlobalSign Atlas R3 DV TLS CA 2023 Q2	`2023-07-07` - `2024-08-07`	a year	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2023-08-07` - `2023-10-30`	3 months	crt.sh
www.google.de GTS CA 1C3	`2023-08-07` - `2023-10-30`	3 months	crt.sh
ads-twitter.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-07-21` - `2024-07-19`	a year	crt.sh
snap.licdn.com DigiCert SHA2 Secure Server CA	`2023-02-01` - `2024-01-31`	a year	crt.sh
www.redditstatic.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-08-25` - `2024-02-21`	6 months	crt.sh
www.bing.com Microsoft Azure TLS Issuing CA 05	`2023-07-26` - `2024-01-22`	6 months	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2023-06-10` - `2023-09-08`	3 months	crt.sh
*.reddit.com DigiCert TLS RSA SHA256 2020 CA1	`2023-04-19` - `2023-10-15`	6 months	crt.sh
t.co DigiCert TLS Hybrid ECC SHA384 2020 CA1	`2023-02-05` - `2024-02-05`	a year	crt.sh
*.twitter.com DigiCert TLS Hybrid ECC SHA384 2020 CA1	`2023-02-05` - `2024-02-05`	a year	crt.sh
www.google.com GTS CA 1C3	`2023-08-07` - `2023-10-30`	3 months	crt.sh
crazyegg.com Amazon RSA 2048 M02	`2023-06-23` - `2024-07-22`	a year	crt.sh
linkedin.oribi.io Amazon RSA 2048 M01	`2023-06-08` - `2024-07-07`	a year	crt.sh
app.qualified.com R3	`2023-07-22` - `2023-10-20`	3 months	crt.sh
sentry.io DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-08-08` - `2024-09-07`	a year	crt.sh
*.adnxs.com GeoTrust ECC CA 2018	`2023-02-13` - `2024-03-15`	a year	crt.sh
*.google.de GTS CA 1C3	`2023-08-07` - `2023-10-30`	3 months	crt.sh
s3.amazonaws.com Amazon RSA 2048 M01	`2023-07-10` - `2024-06-21`	a year	crt.sh

This page contains 5 frames:

Primary Page: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
Frame ID: 46A49E8787B33A838481BAEED83018A2
Requests: 89 HTTP requests in this frame

Frame: https://open.spotify.com/embed/track/56z2qI0gKcPthQF6l8AW3E?si=6ddbfd91d0304aca&utm_source=oembed
Frame ID: 7C54FB2F6A1A26724AF55961BB4E5D3D
Requests: 31 HTTP requests in this frame

Frame: https://tracking.crazyegg.com/clock?t=1693506420112&tk=40ea43635c9a9388c5f9f97df894a565&s=360154&p=%2Fthreat-detection-report%2Ftechniques%2Fwindows-management-instrumentation%2F&u=969416&v=a00b194af33edfebfa8f3ed60f662b54d25458d3&f=redcanary.com%2Fthreat-detection-report%2Ftechniques%2Fwindows-management-instrumentation&ul=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Ftechniques%2Fwindows-management-instrumentation%2F
Frame ID: 2BF3B8D5D6E9A22DD3516C1578AE7A0F
Requests: 1 HTTP requests in this frame

Frame: https://app.qualified.com/w/1/bAEbi2aHVysBKzuy/messenger?uuid=ca38125d-5b3d-4d90-ad86-cef90aee33f4
Frame ID: F1AA431968EAF1D9E14731BBFB563980
Requests: 11 HTTP requests in this frame

Frame: https://www.facebook.com/tr/
Frame ID: 88E8EC2B6AEAE082B85C8D806B959F27
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Windows Management Instrumentation - Red Canary Threat Report

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

/wp-(?:content|includes)/

AppNexus (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

adnxs\.(?:net|com)

Crazy Egg (Analytics) Expand

Overall confidence: 100%
Detected patterns

script\.crazyegg\.com/pages/scripts/\d+/\d+\.js

Facebook (Widgets) Expand

Overall confidence: 100%
Detected patterns

//connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

google-analytics\.com/(?:ga|urchin|analytics)\.js

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtm\.js
googletagmanager\.com/gtag/js

Highlight.js (Miscellaneous) Expand

Overall confidence: 100%
Detected patterns

/(?:([\d.])+/)?highlight(?:\.min)?\.js

Linkedin Insight Tag (Analytics) Expand

Overall confidence: 100%
Detected patterns

snap\.licdn\.com/li\.lms-analytics/insight\.min\.js

Marketo (Marketing Automation) Expand

Overall confidence: 100%
Detected patterns

munchkin\.marketo\.\w+/(?:([\d.]+)/)?munchkin\.js

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

/([\d.]+)/jquery(?:\.min)?\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

134
Requests

96 %
HTTPS

60 %
IPv6

34
Domains

49
Subdomains

44
IPs

7
Countries

3897 kB
Transfer

13936 kB
Size

45
Cookies

20 Outgoing links

These are links going to different origins than the main page.

URL: https://resource.redcanary.com/rs/003-YRU-314/images/2023_ThreatDetectionReport_RedCanary.pdf
Title: Abridged Report PDF

Search URL Search Domain Scan URL

URL: https://resource.redcanary.com/rs/003-YRU-314/images/2023_TDRExecutiveSummary_RedCanary.pdf
Title: Executive Summary

Search URL Search Domain Scan URL

URL: https://attack.mitre.org/techniques/T1047/
Title: WMI

Search URL Search Domain Scan URL

URL: https://attack.mitre.org/techniques/T1220/
Title: XSL Script Processing

Search URL Search Domain Scan URL

URL: https://attack.mitre.org/techniques/T1546/003/
Title: WMI event consumers, filters, and filter-to-consumer bindings

Search URL Search Domain Scan URL

URL: https://learn.microsoft.com/en-us/windows/win32/wmisdk/setting-namespace-security-with-the-wmi-control
Title: WMI namespaces

Search URL Search Domain Scan URL

URL: https://attack.mitre.org/datasources/
Title: data sources and components

Search URL Search Domain Scan URL

URL: https://docs.microsoft.com/en-us/windows/win32/cimwin32prov/create-method-in-class-win32-process
Title: Create method of the Win32_Process class

Search URL Search Domain Scan URL

URL: https://learn.microsoft.com/en-us/windows/win32/wmisdk/running-a-script-based-on-an-event
Title: ActiveScriptEventConsumer

Search URL Search Domain Scan URL

URL: https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4688
Title: process start events (4688)

Search URL Search Domain Scan URL

URL: https://docs.microsoft.com/en-us/sysinternals/downloads/sysmon
Title: 19: WmiEventFilter activity detected, 20: WmiEventConsumer activity detected, and 21: WmiEventConsumerToFilter activity detected

Search URL Search Domain Scan URL

URL: https://twitter.com/mattifestation/status/899646620148539397
Title: Event ID 5861

Search URL Search Domain Scan URL

URL: https://atomicredteam.io/
Title: Atomic Red Team

Search URL Search Domain Scan URL

URL: https://atomicredteam.io/execution/T1047/
Title: View atomic tests for T1047: Windows Management Instrumentation

Search URL Search Domain Scan URL

URL: https://atomicredteam.io/execution/T1047/#atomic-test-9---wmi-execute-rundll32
Title: test

Search URL Search Domain Scan URL

URL: https://github.com/redcanaryco/atomic-red-team/wiki/Getting-Started
Title: create and contribute

Search URL Search Domain Scan URL

URL: https://twitter.com/redcanary

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/company/redcanary/

Search URL Search Domain Scan URL

URL: https://www.youtube.com/channel/UCulDoWwoy0vNvRwl2tVX3-w

Search URL Search Domain Scan URL

URL: https://help.redcanary.com/hc/en-us
Title: Customer Help Center

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 60

https://s.ml-attr.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dredcanary.com%26pId%3d%24UID HTTP 302
https://secure.adnxs.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dredcanary.com%26pId%3d%24UID HTTP 307
https://secure.adnxs.com/bounce?%2Fgetuid%3Fhttps%253a%252f%252fattr.ml-api.io%252f%253fdomain%253dredcanary.com%2526pId%253d%2524UID HTTP 302
https://attr.ml-api.io/?domain=redcanary.com&pId=988735524049751075

Request Chain 101

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=1540753&time=1693506420184&url=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Ftechniques%2Fwindows-management-instrumentation%2F HTTP 302
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=1540753&time=1693506420184&url=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Ftechniques%2Fwindows-management-instrumentation%2F&cookiesTest=true HTTP 302
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D1540753%26time%3D1693506420184%26url%3Dhttps%253A%252F%252Fredcanary.com%252Fthreat-detection-report%252Ftechniques%252Fwindows-management-instrumentation%252F%26cookiesTest%3Dtrue%26liSync%3Dtrue HTTP 302
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=1540753&time=1693506420184&url=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Ftechniques%2Fwindows-management-instrumentation%2F&cookiesTest=true&liSync=true HTTP 302
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=1540753&time=1693506420184&url=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Ftechniques%2Fwindows-management-instrumentation%2F&cookiesTest=true&liSync=true&e_ipv6=AQLWLPwjkRF0ZAAAAYpM2UFXQVGSJxcVxgIKZ3oipFW-qVLEYmrlRXQkewwEW5VIqo8E6Bwp

134 HTTP transactions
3 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/ 359 KB
64 KB 588ms
233ms Document
text/html 104.198.136.223
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.198.136.223 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

223.136.198.104.bc.googleusercontent.com

Software

nginx / WP Engine

Resource Hash

8635f631a35b170f9809857bc49f5c1cbedaa732e0916f4af99573e9e939d8d5

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	"max-age=63072000; includeSubDomains; preload";
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: max-age=600, must-revalidate
content-encoding: br
content-security-policy: upgrade-insecure-requests
content-type: text/html; charset=UTF-8
date: Thu, 31 Aug 2023 18:26:58 GMT
feature-policy: microphone 'none'; geolocation 'none'
link: <https://redcanary.com/?p=33541>; rel=shortlink
referrer-policy: strict-origin-when-cross-origin
server: nginx
strict-transport-security: "max-age=63072000; includeSubDomains; preload";
vary: Accept-Encoding Accept-Encoding Accept-Encoding Accept-Encoding
x-cache: HIT: 10
x-cache-group: normal
x-cacheable: SHORT
x-content-type-options: nosniff
x-frame-options: deny
x-permitted-cross-domain-policies: master-only
x-powered-by: WP Engine
x-wpe-request-id: 49bdf361730377697cb14a4e20150914
x-xss-protection: 1; mode=block

GET
H2 200 jquery.min.js Show response
ajax.googleapis.com/ajax/libs/jquery/3.6.1/ 88 KB
31 KB 118ms
36ms Script
text/javascript 2a00:1450:4001:810::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.googleapis.com/ajax/libs/jquery/3.6.1/jquery.min.js

Requested by

Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a3cf00c109d907e543bc4f6dbc85eb31068f94515251347e9e57509b52ee3d74

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://redcanary.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date: Tue, 29 Aug 2023 18:39:25 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 172053
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 31100
x-xss-protection: 0
last-modified: Thu, 08 Sep 2022 18:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="hosted-libraries-pushers"
vary: Accept-Encoding
report-to: {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 28 Aug 2024 18:39:25 GMT

GET
H2 200 forms2.min.js Show response
resource.redcanary.com/js/forms2/js/ 208 KB
70 KB 49ms
19ms Script
application/x-javascript 104.17.72.206
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://resource.redcanary.com/js/forms2/js/forms2.min.js

Requested by

Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

104.17.72.206 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f244fcb6b0aeadba8f41f30a7f451c0aaa06445ec854c3d9bbef1c485a036424

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://redcanary.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date: Thu, 31 Aug 2023 18:26:58 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
last-modified: Thu, 13 Jul 2023 18:50:22 GMT
server: cloudflare
age: 689
etag: "3340a86-34099-60062cdee3780"
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: public, max-age=14400
cf-ray: 7ff7532b98849162-FRA
expires: Thu, 31 Aug 2023 22:26:58 GMT

GET
H2 200 bizible.js Show response
cdn.bizible.com/scripts/ 67 KB
25 KB 37ms
7ms Script
application/x-javascript 152.195.15.58
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.bizible.com/scripts/bizible.js?account=redcanary.com
Requested by: Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 152.195.15.58 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECS (frb/67D4) /
Resource Hash: 3562dd5ebaf7d001cd283fe325fc4b574e26b053807efb3331dd8fcb5964f559

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://redcanary.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date: Thu, 31 Aug 2023 18:26:58 GMT
content-encoding: gzip
last-modified: Wed, 30 Aug 2023 15:35:31 GMT
server: ECS (frb/67D4)
age: 51390
etag: "b215169c57dbd91:0"
vary: Accept-Encoding
x-cache: HIT
content-type: application/x-javascript
cache-control: max-age=86400
accept-ranges: bytes
content-length: 25470

GET
H2 200 9416.js Show response
script.crazyegg.com/pages/scripts/0096/ 6 KB
2 KB 71ms
18ms Script
text/javascript 2606:4700::6813:9308
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://script.crazyegg.com/pages/scripts/0096/9416.js
Requested by: Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6813:9308 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: a4499f745882700108e60115ea38c28693bf225e861ffa788c30fceac83fb88e

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://redcanary.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date: Thu, 31 Aug 2023 18:26:58 GMT
content-encoding: gzip
cf-cache-status: HIT
age: 8660
cf-polished: origSize=6004
ce-version: 11.5.121
cf-bgj: minify
last-modified: Thu, 31 Aug 2023 16:02:38 GMT
server: cloudflare
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
access-control-expose-headers: CE-Version
cache-control: public, max-age=300, s-maxage=1209600
timing-allow-origin: *
cf-ray: 7ff7532d0eec5c4a-FRA

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 301 KB
94 KB 147ms
66ms Script
application/javascript 2a00:1450:4001:809::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-T3K4MTNQJN

Requested by

Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

e2faba39df418170ae8bf1bd3e2d94c4757ad604e1606db3f572871834a2bdd5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://redcanary.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date: Thu, 31 Aug 2023 18:26:58 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 96162
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Thu, 31 Aug 2023 18:26:58 GMT

GET
H2 200 qualified.js Show response
js.qualified.com/ 329 KB
95 KB 440ms
408ms Script
text/javascript 2606:4700::6812:1105
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://js.qualified.com/qualified.js?token=bAEbi2aHVysBKzuy

Requested by

Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:1105 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d3cffae0a07184a7f41e99ed86654a87129116d1bc4ad30df766400d3953c404

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://redcanary.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date: Thu, 31 Aug 2023 18:26:59 GMT
content-encoding: gzip
via: 1.1 spaces-router (devel)
strict-transport-security: max-age=63072000; includeSubDomains
cf-cache-status: MISS
x-content-type-options: nosniff
x-permitted-cross-domain-policies: none
x-xss-protection: 1; mode=block
x-request-id: 2769389e-4ee5-c2d5-7b4d-9bec1230150f
pragma: no-cache
x-runtime: 0.019857
referrer-policy: strict-origin-when-cross-origin
server: cloudflare
etag: W/"d3cffae0a07184a7f41e99ed86654a87"
x-download-options: noopen
vary: Accept,Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: text/javascript; charset=utf-8
cache-control: public, max-age=14400
cf-ray: 7ff7532cebda1c42-FRA
expires: Thu, 31 Aug 2023 22:26:59 GMT

GET
H2 200 highlight.min.js Show response
cdnjs.cloudflare.com/ajax/libs/highlight.js/10.6.0/ 130 KB
33 KB 57ms
27ms Script
application/javascript 2606:4700::6811:190e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/highlight.js/10.6.0/highlight.min.js

Requested by

Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:190e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d2f545bb226e5bcc1d50af37b345d245dce63bc07aaeba2243e0f1ea87b2dcb9

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://redcanary.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date: Thu, 31 Aug 2023 18:26:58 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
age: 3017501
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 33260
last-modified: Thu, 22 Jun 2023 11:03:48 GMT
server: cloudflare
cf-cdnjs-via: cfworker/r2
etag: "64942a94-81ec"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=CukPYl7HvnpbRLgzpK6yWFRaKwgjmWXqvQ7OlgbnvCFdAuDBX8iWPQmlBNvCmQ%2Fg0w6X57AjmClT0qBVAPi4Y9ow423yxBgKxmrwy8fQkKmJixCAeI4%2BT%2F39ULeiYpZDSrMs43VyS9Nun2%2FL9hdCip0Q"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 7ff7532bacd41a6b-FRA
expires: Tue, 20 Aug 2024 18:26:58 GMT

GET
H/1.1 200
OK teknkl-formsplus-1.0.5.js Show response
s3-us-west-2.amazonaws.com/s.cdpn.io/250687/ 41 KB
41 KB 566ms
191ms Script
application/x-js 52.92.210.152
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://s3-us-west-2.amazonaws.com/s.cdpn.io/250687/teknkl-formsplus-1.0.5.js
Requested by: Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.92.210.152 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-us-west-2.amazonaws.com
Software: AmazonS3 /
Resource Hash: 731fcb30d45f2e35aaa139a7a964410a7c2bcdbfbb48a837c9d56dec7cc3732f

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://redcanary.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

Date: Thu, 31 Aug 2023 18:26:59 GMT
x-amz-version-id: OjXdZ5iYdmgpgEuq0ftytCBc_PO35ThO
Last-Modified: Thu, 26 Apr 2018 08:20:46 GMT
Server: AmazonS3
x-amz-request-id: 114Z5ATE8054MVEE
ETag: "bab0c2b3523f8244564b675fe34db610"
Content-Type: application/x-js
Cache-Control: public
Accept-Ranges: bytes
Content-Length: 41617
x-amz-id-2: jj/ESkuRQ5mpF6ZqWUCAeV0a85RT3Mmcmt9AG6JKvu0OU2BMkzG2fdusqmLNNpwkyZZDP3pUT8w=

GET
H2 200 autoptimize_7b69b65ef8ada1b627de544e100cc1d8.js Show response
redcanary.com/wp-content/cache/autoptimize/js/ 288 KB
82 KB 123ms
122ms Script
application/javascript 104.198.136.223
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://redcanary.com/wp-content/cache/autoptimize/js/autoptimize_7b69b65ef8ada1b627de544e100cc1d8.js

Requested by

Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.198.136.223 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

223.136.198.104.bc.googleusercontent.com

Software

nginx /

Resource Hash

6e0b02e307a08a6384527ffd3c99e8a3d4f83927b855c2ab6836e951337be886

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	"max-age=63072000; includeSubDomains; preload";

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date: Thu, 31 Aug 2023 18:26:58 GMT
content-security-policy: upgrade-insecure-requests
content-encoding: br
strict-transport-security: "max-age=63072000; includeSubDomains; preload";
last-modified: Wed, 16 Aug 2023 15:12:29 GMT
server: nginx
etag: W/"64dce75d-48160"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
x-wpe-request-id: 55b8bf8cb58493a70f5836070a5e211d
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H/1.1 200
OK munchkin.js Show response
munchkin.marketo.net/ 1 KB
1 KB 81ms
28ms Script
application/x-javascript 104.64.124.188
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://munchkin.marketo.net/munchkin.js
Requested by: Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 104.64.124.188 Prague, Czech Republic, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-64-124-188.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 5206536707c84baa892d3c3231b351985ee828cb8b9c0bd8db42cd3363995fc4

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://redcanary.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

Date: Thu, 31 Aug 2023 18:26:58 GMT
Content-Encoding: gzip
Last-Modified: Fri, 17 Mar 2023 01:24:48 GMT
Server: AkamaiNetStorage
ETag: "cb731cc5c2bd9f31d6bfeb19f3c8b1ff:1679016288.730763"
Vary: Accept-Encoding
Content-Type: application/x-javascript
P3P: policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR"
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 729

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 287 KB
95 KB 199ms
119ms Script
application/javascript 2a00:1450:4001:809::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-PXWC8JW

Requested by

Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

811d28b69759119584310f25aec54955bc7a2771829710def29613baeb2a72d1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://redcanary.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date: Thu, 31 Aug 2023 18:26:58 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 97050
x-xss-protection: 0
last-modified: Thu, 31 Aug 2023 18:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Thu, 31 Aug 2023 18:26:58 GMT

GET
H2 200 6si.min.js Show response
j.6sc.co/ 31 KB
10 KB 67ms
8ms Script
application/javascript 23.38.98.237
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://j.6sc.co/6si.min.js

Requested by

Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.38.98.237 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a23-38-98-237.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

eba72b1c1e3e44d5dabff914f59eb15876ae97cef296ddee4afe4821a54f2633

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://redcanary.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 31 Aug 2023 18:26:58 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Thu, 24 Mar 2022 00:01:47 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "623bb4eb-7b41"
vary: Accept-Encoding
content-type: application/javascript
cache-control: private, no-cache, proxy-revalidate
accept-ranges: bytes
content-length: 9853
expires: Thu, 31 Aug 2023 18:26:58 GMT

GET
H2 200 css
fonts.googleapis.com/ 7 KB
1 KB 125ms
46ms Stylesheet
text/css 2a00:1450:4001:830::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Source+Sans+Pro:300,400,500,700&display=swap

Requested by

Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

dd25827c9ad7ac0cbdb3545ed377f0ff5c9d5c1d14282307cf04ac4776d0a572

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://redcanary.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Thu, 31 Aug 2023 18:26:58 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Thu, 31 Aug 2023 18:26:58 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Thu, 31 Aug 2023 18:26:58 GMT

GET
H2 200 autoptimize_7c1b044830350562b8347035fb5ab725.css
redcanary.com/wp-content/cache/autoptimize/css/ 5 MB
253 KB 239ms
238ms Stylesheet
text/css 104.198.136.223
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://redcanary.com/wp-content/cache/autoptimize/css/autoptimize_7c1b044830350562b8347035fb5ab725.css

Requested by

Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.198.136.223 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

223.136.198.104.bc.googleusercontent.com

Software

nginx /

Resource Hash

35134ff1cfb9ea2e3a5d5e63856b1efeba6893a5bcbfb93a73b6e4b671239282

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	"max-age=63072000; includeSubDomains; preload";

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date: Thu, 31 Aug 2023 18:26:58 GMT
content-security-policy: upgrade-insecure-requests
content-encoding: br
strict-transport-security: "max-age=63072000; includeSubDomains; preload";
last-modified: Wed, 16 Aug 2023 15:12:30 GMT
server: nginx
etag: W/"64dce75e-53c907"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
x-wpe-request-id: b312a3386508e017158610852dc2c62e
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 default.min.css
cdnjs.cloudflare.com/ajax/libs/highlight.js/10.6.0/styles/ 763 B
643 B 20ms
19ms Stylesheet
text/css 2606:4700::6811:190e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/highlight.js/10.6.0/styles/default.min.css

Requested by

Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:190e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3cc36c64ef86bed21592653daac82fd7e4c364c32c8344336aa13f7dbf52c90

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://redcanary.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date: Thu, 31 Aug 2023 18:26:58 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
age: 10861730
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 271
last-modified: Mon, 08 Feb 2021 15:10:43 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "60215473-2fb"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=L%2F1mX4DCWXNAZi%2FtfJ8Z5muCsbM6CSPxnzzDElgyd0Nel%2BAIGG49Y%2F0A9LzaDqx4am9fQfInztNB7iimS9PZsi0OghhF5ZApnP5brte%2B%2BeYiDqVbSO0NbDsVrTRu6GiW2NCML%2Fd2PX1xMGQF4Q4sHXnv"}],"group":"cf-nel","max_age":604800}
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 7ff7532cce2b1a6b-FRA
expires: Tue, 20 Aug 2024 18:26:58 GMT

GET
DATA 200
OK truncated
/ 64 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: b6dcc1490a0cc33cdeed8970677b89bbec6fa095675af198b8e923b64563c70a

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 65 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 9edb5c5ef600768db6e8ee027853f2c6f8ab34f615b495faaf114579f8de2e22

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H2 200 bullet-square.svg
redcanary.com/wp-content/themes/redcanary/assets/img/ 443 B
654 B 216ms
215ms Image
image/svg+xml 104.198.136.223
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://redcanary.com/wp-content/themes/redcanary/assets/img/bullet-square.svg

Requested by

Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.198.136.223 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

223.136.198.104.bc.googleusercontent.com

Software

nginx /

Resource Hash

6217f642930c0d2411329fb00cf9a7e2e138a98f56eece6e82b3a7359f20cb11

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	"max-age=63072000; includeSubDomains; preload";

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date: Thu, 31 Aug 2023 18:26:58 GMT
content-security-policy: upgrade-insecure-requests
content-encoding: br
strict-transport-security: "max-age=63072000; includeSubDomains; preload";
last-modified: Mon, 23 Aug 2021 16:46:07 GMT
server: nginx
etag: W/"6123d0cf-1bb"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
x-wpe-request-id: 1ca50b97f510f4bfa2347c95eef8a4be
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 source-sans-pro-v21-latin-regular.woff2
redcanary.com/wp-content/themes/redcanary/assets/fonts/ 13 KB
13 KB 214ms
214ms Font
font/woff2 104.198.136.223
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://redcanary.com/wp-content/themes/redcanary/assets/fonts/source-sans-pro-v21-latin-regular.woff2

Requested by

Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.198.136.223 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

223.136.198.104.bc.googleusercontent.com

Software

nginx /

Resource Hash

c124c88ca4fcb4336e97617647ef0d32441329371120c8eabaea0fea226560b0

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	"max-age=63072000; includeSubDomains; preload";

Request headers

Referer: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
Origin: https://redcanary.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date: Thu, 31 Aug 2023 18:26:58 GMT
content-security-policy: upgrade-insecure-requests
strict-transport-security: "max-age=63072000; includeSubDomains; preload";
last-modified: Thu, 02 Jun 2022 17:26:25 GMT
server: nginx
etag: "6298f2c1-32ec"
vary: Accept-Encoding
x-wpe-request-id: fc2596d2e8176f5e96fded30f584091b
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 13036

GET
H2 200 source-sans-pro-v21-latin-300.woff2
redcanary.com/wp-content/themes/redcanary/assets/fonts/ 13 KB
13 KB 214ms
214ms Font
font/woff2 104.198.136.223
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://redcanary.com/wp-content/themes/redcanary/assets/fonts/source-sans-pro-v21-latin-300.woff2

Requested by

Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.198.136.223 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

223.136.198.104.bc.googleusercontent.com

Software

nginx /

Resource Hash

122854df4f39cf922db317714c2ff0eccab27a1028c14a5aa2211f48b7e0eade

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	"max-age=63072000; includeSubDomains; preload";

Request headers

Referer: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
Origin: https://redcanary.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date: Thu, 31 Aug 2023 18:26:58 GMT
content-security-policy: upgrade-insecure-requests
strict-transport-security: "max-age=63072000; includeSubDomains; preload";
last-modified: Thu, 02 Jun 2022 17:26:22 GMT
server: nginx
etag: "6298f2be-329c"
vary: Accept-Encoding
x-wpe-request-id: 85a10155f459e7be71526fdc2d8a9868
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 12956

GET
H2 200 source-sans-pro-v21-latin-700.woff2
redcanary.com/wp-content/themes/redcanary/assets/fonts/ 13 KB
13 KB 214ms
213ms Font
font/woff2 104.198.136.223
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://redcanary.com/wp-content/themes/redcanary/assets/fonts/source-sans-pro-v21-latin-700.woff2

Requested by

Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.198.136.223 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

223.136.198.104.bc.googleusercontent.com

Software

nginx /

Resource Hash

7348a2eb48c9a681d6178433394c7037144d85b57ee33a11339d3a33fa1001a4

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	"max-age=63072000; includeSubDomains; preload";

Request headers

Referer: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
Origin: https://redcanary.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date: Thu, 31 Aug 2023 18:26:58 GMT
content-security-policy: upgrade-insecure-requests
strict-transport-security: "max-age=63072000; includeSubDomains; preload";
last-modified: Thu, 02 Jun 2022 17:26:24 GMT
server: nginx
etag: "6298f2c0-327c"
vary: Accept-Encoding
x-wpe-request-id: c49139f92d653e3b3d26609d431c142f
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 12924

GET
H2 200 source-sans-pro-v21-latin-600.woff2
redcanary.com/wp-content/themes/redcanary/assets/fonts/ 13 KB
13 KB 214ms
214ms Font
font/woff2 104.198.136.223
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://redcanary.com/wp-content/themes/redcanary/assets/fonts/source-sans-pro-v21-latin-600.woff2

Requested by

Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.198.136.223 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

223.136.198.104.bc.googleusercontent.com

Software

nginx /

Resource Hash

bc9a16cd945457ad9463cdaed95129b01c589466978dfee3d019d9c604b2171a

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	"max-age=63072000; includeSubDomains; preload";

Request headers

Referer: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
Origin: https://redcanary.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date: Thu, 31 Aug 2023 18:26:58 GMT
content-security-policy: upgrade-insecure-requests
strict-transport-security: "max-age=63072000; includeSubDomains; preload";
last-modified: Thu, 02 Jun 2022 17:26:23 GMT
server: nginx
etag: "6298f2bf-32fc"
vary: Accept-Encoding
x-wpe-request-id: 98194d507dc3968f8903b0cbd16ad04e
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 13052

GET
H2 200 56z2qI0gKcPthQF6l8AW3E Show response
open.spotify.com/embed/track/ Frame 7C54 11 KB
5 KB 127ms
84ms Document
text/html 2600:1901:1:c36::
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://open.spotify.com/embed/track/56z2qI0gKcPthQF6l8AW3E?si=6ddbfd91d0304aca&utm_source=oembed

Requested by

Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:1901:1:c36:: , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

envoy / Next.js

Resource Hash

447a24f2612083c24a259b3acde1541e60bc5cc38d51f72eb5bb52baeda8e75c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

Referer: https://redcanary.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, no-cache, no-store, max-age=0, must-revalidate
content-encoding: gzip
content-type: text/html; charset=utf-8
date: Thu, 31 Aug 2023 18:26:58 GMT
etag: "5wo56fi1wv8m3"
server: envoy
sp-trace-id: 02d5b701d7dd2015
strict-transport-security: max-age=31536000
vary: Accept-Encoding
via: HTTP/2 edgeproxy, 1.1 google
x-content-type-options: nosniff
x-powered-by: Next.js

GET
DATA 200
OK truncated
/ 68 B
68 B Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 3a48ba6d11055a2a6f840befa14e603650d8ca3d752e16daccd828d3869fb791

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H2 200 redcanary.com.json Show response
script.crazyegg.com/pages/data-scripts/0096/9416/site/ 5 KB
2 KB 54ms
25ms XHR
application/json 2606:4700::6813:9308
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://script.crazyegg.com/pages/data-scripts/0096/9416/site/redcanary.com.json?t=1
Requested by: Host: script.crazyegg.com
URL: https://script.crazyegg.com/pages/scripts/0096/9416.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6813:9308 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: aff5855b9eea953386c7af491db1ecff00e245e68017864e1bc76fd228efdff3

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://redcanary.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date: Thu, 31 Aug 2023 18:26:58 GMT
content-encoding: gzip
cf-cache-status: HIT
age: 8139
ce-version: 11.5.121
content-length: 1539
last-modified: Thu, 31 Aug 2023 16:11:19 GMT
server: cloudflare
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: *
access-control-expose-headers: CE-Version
cache-control: public, max-age=300, s-maxage=1209600
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 7ff7532d7a614d7c-FRA

GET
H/1.1 200
OK munchkin.js Show response
munchkin.marketo.net/163/ 11 KB
5 KB 28ms
28ms Script
application/x-javascript 104.64.124.188
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://munchkin.marketo.net/163/munchkin.js
Requested by: Host: munchkin.marketo.net
URL: https://munchkin.marketo.net/munchkin.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 104.64.124.188 Prague, Czech Republic, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-64-124-188.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 68cc280ce370c6f1f51a4fc5950103fc38df80a429552c549add04ebd8bd3a23

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://redcanary.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

Date: Thu, 31 Aug 2023 18:26:58 GMT
Content-Encoding: gzip
Last-Modified: Fri, 06 Jan 2023 02:26:40 GMT
Server: AkamaiNetStorage
ETag: "ea7826f34518d7c2295738f39c7640fa:1672972000.238769"
Vary: Accept-Encoding
Content-Type: application/x-javascript
P3P: policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR"
Cache-Control: max-age=8640000
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 4741
Expires: Sat, 09 Dec 2023 18:26:58 GMT

POST
H/1.1 200
OK visitWebPage
003-yru-314.mktoresp.com/webevents/ 2 B
318 B 651ms
163ms Ping
text/plain 192.28.147.68
OMNITURE

General

Check archive.org

Show headers Download Go to

Full URL: https://003-yru-314.mktoresp.com/webevents/visitWebPage?_mchNc=1693506418800&_mchCn=&_mchId=003-YRU-314&_mchTk=_mch-redcanary.com-1693506418798-52230&_mchHo=redcanary.com&_mchPo=&_mchRu=%2Fthreat-detection-report%2Ftechniques%2Fwindows-management-instrumentation%2F&_mchPc=https%3A&_mchVr=163&_mchEcid=&_mchHa=&_mchRe=&_mchQp=
Requested by: Host: munchkin.marketo.net
URL: https://munchkin.marketo.net/163/munchkin.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 192.28.147.68 , United States, ASN15224 (OMNITURE, US),
Reverse DNS
Software: nginx/1.20.1 /
Resource Hash: 565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://redcanary.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

Date: Thu, 31 Aug 2023 18:26:59 GMT
Content-Encoding: gzip
Server: nginx/1.20.1
Transfer-Encoding: chunked
Content-Type: text/plain; charset=UTF-8
Access-Control-Allow-Origin: *
Connection: keep-alive
X-Request-Id: d36f6148-cf48-430d-8411-13514a89ac1c

GET
H2 200 b2625509b46b716ab8df67870a7d87b8.js Show response
script.crazyegg.com/pages/versioned/common-scripts/ 91 KB
31 KB 16ms
16ms Script
text/javascript 2606:4700::6813:9308
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://script.crazyegg.com/pages/versioned/common-scripts/b2625509b46b716ab8df67870a7d87b8.js
Requested by: Host: script.crazyegg.com
URL: https://script.crazyegg.com/pages/scripts/0096/9416.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6813:9308 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6bc9a4bdde5c48a39cabd8840dec8bd11281dcdd167cf4440f383f01ad3ab123

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://redcanary.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date: Thu, 31 Aug 2023 18:26:58 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Thu, 24 Aug 2023 15:03:06 GMT
server: cloudflare
age: 18627
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000, s-maxage=31536000
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 7ff7532dafeb5c4a-FRA
content-length: 31312

GET
H2 200 8cd00e627952ec8a.css
embed-cdn.spotifycdn.com/_next/static/css/ Frame 7C54 26 KB
4 KB 39ms
8ms Stylesheet
text/css 2a04:4e42:8d::762
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://embed-cdn.spotifycdn.com/_next/static/css/8cd00e627952ec8a.css
Requested by: Host: open.spotify.com
URL: https://open.spotify.com/embed/track/56z2qI0gKcPthQF6l8AW3E?si=6ddbfd91d0304aca&utm_source=oembed
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:4e42:8d::762 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 8ec32112354b4493286cb34daa05fa0a49791553bfedb374d7a67c7ad9cb2c9f

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://open.spotify.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date: Thu, 31 Aug 2023 18:26:58 GMT
content-encoding: gzip
age: 4433281
x-amz-meta-goog-reserved-file-mtime: 1689072066
x-cache: HIT, HIT
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
content-length: 4039
x-served-by: cache-chi-kigq8000089-CHI, cache-fra-eddf8230092-FRA
last-modified: Tue, 11 Jul 2023 10:56:36 GMT
etag: "f3d572702831405545a59c2b3c1f6f80"
x-goog-generation: 1689072996772325
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000
x-goog-stored-content-length: 26326
accept-ranges: bytes
x-cache-hits: 6, 26524

GET
H2 200 c47c6e7745a8b455.css
embed-cdn.spotifycdn.com/_next/static/css/ Frame 7C54 34 KB
6 KB 38ms
7ms Stylesheet
text/css 2a04:4e42:8d::762
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://embed-cdn.spotifycdn.com/_next/static/css/c47c6e7745a8b455.css
Requested by: Host: open.spotify.com
URL: https://open.spotify.com/embed/track/56z2qI0gKcPthQF6l8AW3E?si=6ddbfd91d0304aca&utm_source=oembed
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:4e42:8d::762 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 16005d3dd555b3e66dd9ebf840d8b225ee02966d26b62f58aea68e6808ff3c83

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://open.spotify.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date: Thu, 31 Aug 2023 18:26:58 GMT
content-encoding: gzip
age: 108021
x-amz-meta-goog-reserved-file-mtime: 1693397565
x-cache: HIT, HIT
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
content-length: 5946
x-served-by: cache-chi-kigq8000053-CHI, cache-fra-eddf8230092-FRA
last-modified: Wed, 30 Aug 2023 12:25:18 GMT
etag: "fcbec68c9d848190b4c167a8202f2ffd"
x-goog-generation: 1693398318469994
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000
x-goog-stored-content-length: 35014
x-amz-checksum-crc32c: v/JnmQ==
accept-ranges: bytes
x-cache-hits: 2, 4370

GET
H2 200 webpack-3e4f342dbb144246.js Show response
embed-cdn.spotifycdn.com/_next/static/chunks/ Frame 7C54 5 KB
3 KB 36ms
7ms Script
application/javascript 2a04:4e42:8d::762
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://embed-cdn.spotifycdn.com/_next/static/chunks/webpack-3e4f342dbb144246.js
Requested by: Host: open.spotify.com
URL: https://open.spotify.com/embed/track/56z2qI0gKcPthQF6l8AW3E?si=6ddbfd91d0304aca&utm_source=oembed
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:4e42:8d::762 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: f526e42397f6b24d9b2c3cb34f9cec6af49cc7e1eb921f397a2ce7315fd607d1

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://open.spotify.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date: Thu, 31 Aug 2023 18:26:58 GMT
content-encoding: gzip
age: 108022
x-amz-meta-goog-reserved-file-mtime: 1693397565
x-cache: HIT, HIT
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
content-length: 2186
x-served-by: cache-chi-kigq8000089-CHI, cache-fra-eddf8230092-FRA
last-modified: Wed, 30 Aug 2023 12:25:18 GMT
etag: "afb8c163c2105c690dae52a64acf740d"
x-goog-generation: 1693398318516219
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
x-goog-stored-content-length: 4611
x-amz-checksum-crc32c: lAXGCg==
accept-ranges: bytes
x-cache-hits: 5, 16101

GET
H2 200 framework-33d379e787c03ddb.js Show response
embed-cdn.spotifycdn.com/_next/static/chunks/ Frame 7C54 127 KB
41 KB 37ms
9ms Script
application/javascript 2a04:4e42:8d::762
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://embed-cdn.spotifycdn.com/_next/static/chunks/framework-33d379e787c03ddb.js
Requested by: Host: open.spotify.com
URL: https://open.spotify.com/embed/track/56z2qI0gKcPthQF6l8AW3E?si=6ddbfd91d0304aca&utm_source=oembed
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:4e42:8d::762 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: b40d37fbb13b1b903fd3c063523b41c47c57e61ab99cad3bd35881672ea3e3d6

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://open.spotify.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date: Thu, 31 Aug 2023 18:26:58 GMT
content-encoding: gzip
age: 8684561
x-amz-meta-goog-reserved-file-mtime: 1684765243
x-cache: HIT, HIT
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
content-length: 42161
x-served-by: cache-chi-kigq8000070-CHI, cache-fra-eddf8230092-FRA
last-modified: Mon, 22 May 2023 14:27:39 GMT
etag: "124a9f12f15f3120a5ef711a66ba2662"
x-goog-generation: 1684765659849262
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
x-goog-stored-content-length: 129927
accept-ranges: bytes
x-cache-hits: 739, 27235

GET
H2 200 main-0117c27f823659ce.js Show response
embed-cdn.spotifycdn.com/_next/static/chunks/ Frame 7C54 111 KB
33 KB 38ms
9ms Script
application/javascript 2a04:4e42:8d::762
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://embed-cdn.spotifycdn.com/_next/static/chunks/main-0117c27f823659ce.js
Requested by: Host: open.spotify.com
URL: https://open.spotify.com/embed/track/56z2qI0gKcPthQF6l8AW3E?si=6ddbfd91d0304aca&utm_source=oembed
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:4e42:8d::762 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 99e97366cd580fb716ea693b2696808c006d45c6366004db4286156077f20c4f

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://open.spotify.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date: Thu, 31 Aug 2023 18:26:58 GMT
content-encoding: gzip
age: 7184776
x-amz-meta-goog-reserved-file-mtime: 1686222071
x-cache: HIT, HIT
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
content-length: 33612
x-served-by: cache-chi-kigq8000158-CHI, cache-fra-eddf8230092-FRA
last-modified: Thu, 08 Jun 2023 11:07:26 GMT
etag: "81865ede7cdb1740008282943c7855ac"
x-goog-generation: 1686222445991402
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
x-goog-stored-content-length: 113515
accept-ranges: bytes
x-cache-hits: 617, 27182

GET
H2 200 _app-fe44d090509824d5.js Show response
embed-cdn.spotifycdn.com/_next/static/chunks/pages/ Frame 7C54 507 KB
138 KB 37ms
9ms Script
application/javascript 2a04:4e42:8d::762
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://embed-cdn.spotifycdn.com/_next/static/chunks/pages/_app-fe44d090509824d5.js
Requested by: Host: open.spotify.com
URL: https://open.spotify.com/embed/track/56z2qI0gKcPthQF6l8AW3E?si=6ddbfd91d0304aca&utm_source=oembed
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:4e42:8d::762 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: f872315d333981663bad5953d1280c886beab704fa9a9d2abc768352aa71d39a

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://open.spotify.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date: Thu, 31 Aug 2023 18:26:58 GMT
content-encoding: gzip
age: 108021
x-amz-meta-goog-reserved-file-mtime: 1693397565
x-cache: HIT, HIT
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
content-length: 140746
x-served-by: cache-chi-kigq8000132-CHI, cache-fra-eddf8230092-FRA
last-modified: Wed, 30 Aug 2023 12:25:18 GMT
etag: "5686bcaf61d1e15b5f94a8ec151d3215"
x-goog-generation: 1693398318953757
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
x-goog-stored-content-length: 518987
x-amz-checksum-crc32c: ZWKppg==
accept-ranges: bytes
x-cache-hits: 2, 21

GET
H2 200 fec483df-b230338ad030162e.js Show response
embed-cdn.spotifycdn.com/_next/static/chunks/ Frame 7C54 320 KB
99 KB 29ms
28ms Script
application/javascript 2a04:4e42:8d::762
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://embed-cdn.spotifycdn.com/_next/static/chunks/fec483df-b230338ad030162e.js
Requested by: Host: open.spotify.com
URL: https://open.spotify.com/embed/track/56z2qI0gKcPthQF6l8AW3E?si=6ddbfd91d0304aca&utm_source=oembed
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:4e42:8d::762 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 53f545d884abf02ce99f4e0369ffec8be28f1f3f22eb99bf0fab9f4522ea5142

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://open.spotify.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date: Thu, 31 Aug 2023 18:26:58 GMT
content-encoding: gzip
age: 6777951
x-amz-meta-goog-reserved-file-mtime: 1686661750
x-cache: HIT, HIT
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
content-length: 100913
x-served-by: cache-chi-klot8100047-CHI, cache-fra-eddf8230092-FRA
last-modified: Tue, 13 Jun 2023 13:18:59 GMT
etag: "9c4d5b20d500a4646af02cb2e28e11da"
x-goog-generation: 1686662339475826
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
x-goog-stored-content-length: 327829
accept-ranges: bytes
x-cache-hits: 462, 27240

GET
H2 200 415-d009a9159d740903.js Show response
embed-cdn.spotifycdn.com/_next/static/chunks/ Frame 7C54 25 KB
6 KB 27ms
27ms Script
application/javascript 2a04:4e42:8d::762
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://embed-cdn.spotifycdn.com/_next/static/chunks/415-d009a9159d740903.js
Requested by: Host: open.spotify.com
URL: https://open.spotify.com/embed/track/56z2qI0gKcPthQF6l8AW3E?si=6ddbfd91d0304aca&utm_source=oembed
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:4e42:8d::762 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 2fb0db460ef1851e44c7e94a3f1944e299e306def449ed72c30adfb89b25b029

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://open.spotify.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date: Thu, 31 Aug 2023 18:26:58 GMT
content-encoding: gzip
age: 2540641
x-amz-meta-goog-reserved-file-mtime: 1690964677
x-cache: HIT, HIT
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
content-length: 5881
x-served-by: cache-chi-kigq8000020-CHI, cache-fra-eddf8230092-FRA
last-modified: Wed, 02 Aug 2023 08:40:17 GMT
etag: "f45ad0e97a8e71419371027175275215"
x-goog-generation: 1690965617730993
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
x-goog-stored-content-length: 25338
x-amz-checksum-crc32c: I6sMew==
accept-ranges: bytes
x-cache-hits: 7, 25972

GET
H2 200 122-f7d6a526163e333e.js Show response
embed-cdn.spotifycdn.com/_next/static/chunks/ Frame 7C54 262 KB
72 KB 25ms
24ms Script
application/javascript 2a04:4e42:8d::762
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://embed-cdn.spotifycdn.com/_next/static/chunks/122-f7d6a526163e333e.js
Requested by: Host: open.spotify.com
URL: https://open.spotify.com/embed/track/56z2qI0gKcPthQF6l8AW3E?si=6ddbfd91d0304aca&utm_source=oembed
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:4e42:8d::762 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 1486615b34c43bee393a5dd74f110c6f25c5f2d66d8111278f54e77ffcbc63a3

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://open.spotify.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date: Thu, 31 Aug 2023 18:26:58 GMT
content-encoding: gzip
age: 125199
x-amz-meta-goog-reserved-file-mtime: 1693380126
x-cache: HIT, HIT
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
content-length: 73305
x-served-by: cache-chi-kigq8000095-CHI, cache-fra-eddf8230092-FRA
last-modified: Wed, 30 Aug 2023 07:38:06 GMT
etag: "09569bb140037810c364b24b4e3dbfb2"
x-goog-generation: 1693381086734856
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
x-goog-stored-content-length: 267882
x-amz-checksum-crc32c: vgEZdw==
accept-ranges: bytes
x-cache-hits: 64, 18603

GET
H2 200 345-dd05f38d7ac8a99d.js Show response
embed-cdn.spotifycdn.com/_next/static/chunks/ Frame 7C54 96 KB
25 KB 25ms
24ms Script
application/javascript 2a04:4e42:8d::762
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://embed-cdn.spotifycdn.com/_next/static/chunks/345-dd05f38d7ac8a99d.js
Requested by: Host: open.spotify.com
URL: https://open.spotify.com/embed/track/56z2qI0gKcPthQF6l8AW3E?si=6ddbfd91d0304aca&utm_source=oembed
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:4e42:8d::762 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 24b99703cc2b2d010f48778c5700beb1ed63e688c460b7498c911bb4a97e2e23

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://open.spotify.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date: Thu, 31 Aug 2023 18:26:58 GMT
content-encoding: gzip
age: 125199
x-amz-meta-goog-reserved-file-mtime: 1693380126
x-cache: HIT, HIT
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
content-length: 25529
x-served-by: cache-chi-kigq8000078-CHI, cache-fra-eddf8230092-FRA
last-modified: Wed, 30 Aug 2023 07:38:06 GMT
etag: "2ae89e701fdd03960a8a00c1f5dcfa88"
x-goog-generation: 1693381086719715
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
x-goog-stored-content-length: 98413
x-amz-checksum-crc32c: +DCSmw==
accept-ranges: bytes
x-cache-hits: 63, 18447

GET
H2 200 %5Bid%5D-025dca3822d6ecec.js Show response
embed-cdn.spotifycdn.com/_next/static/chunks/pages/track/ Frame 7C54 31 KB
9 KB 28ms
27ms Script
application/javascript 2a04:4e42:8d::762
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://embed-cdn.spotifycdn.com/_next/static/chunks/pages/track/%5Bid%5D-025dca3822d6ecec.js
Requested by: Host: open.spotify.com
URL: https://open.spotify.com/embed/track/56z2qI0gKcPthQF6l8AW3E?si=6ddbfd91d0304aca&utm_source=oembed
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:4e42:8d::762 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 99011a0690be8d013bbf0ba1c7e2921db4c6f9e03d6d78e03ca8e1e826bf5b96

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://open.spotify.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date: Thu, 31 Aug 2023 18:26:58 GMT
content-encoding: gzip
age: 125198
x-amz-meta-goog-reserved-file-mtime: 1693380126
x-cache: HIT, HIT
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
content-length: 8521
x-served-by: cache-chi-kigq8000160-CHI, cache-fra-eddf8230092-FRA
last-modified: Wed, 30 Aug 2023 07:38:06 GMT
etag: "ac10207c64f660116f59fdf475284935"
x-goog-generation: 1693381086898125
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
x-goog-stored-content-length: 31582
x-amz-checksum-crc32c: q2CFuQ==
accept-ranges: bytes
x-cache-hits: 54, 4733

GET
H2 200 _buildManifest.js Show response
embed-cdn.spotifycdn.com/_next/static/860b7926-9444-42a4-a58e-096cebb90b02/ Frame 7C54 2 KB
1 KB 24ms
23ms Script
application/javascript 2a04:4e42:8d::762
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://embed-cdn.spotifycdn.com/_next/static/860b7926-9444-42a4-a58e-096cebb90b02/_buildManifest.js
Requested by: Host: open.spotify.com
URL: https://open.spotify.com/embed/track/56z2qI0gKcPthQF6l8AW3E?si=6ddbfd91d0304aca&utm_source=oembed
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:4e42:8d::762 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: d9e0863aa56b8cba71d458f9491fdca3c7cc6b0eddbc288d0dfe3d41d0a30eef

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://open.spotify.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date: Thu, 31 Aug 2023 18:26:58 GMT
content-encoding: gzip
age: 108022
x-amz-meta-goog-reserved-file-mtime: 1693397565
x-cache: HIT, HIT
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
content-length: 821
x-served-by: cache-chi-klot8100127-CHI, cache-fra-eddf8230092-FRA
last-modified: Wed, 30 Aug 2023 12:25:18 GMT
etag: "e4f2f5f28d975e18a45aa130cfa30f72"
x-goog-generation: 1693398318168737
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
x-goog-stored-content-length: 2163
x-amz-checksum-crc32c: 8Pix6g==
accept-ranges: bytes
x-cache-hits: 5, 16050

GET
H2 200 _ssgManifest.js Show response
embed-cdn.spotifycdn.com/_next/static/860b7926-9444-42a4-a58e-096cebb90b02/ Frame 7C54 77 B
210 B 23ms
22ms Script
application/javascript 2a04:4e42:8d::762
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://embed-cdn.spotifycdn.com/_next/static/860b7926-9444-42a4-a58e-096cebb90b02/_ssgManifest.js
Requested by: Host: open.spotify.com
URL: https://open.spotify.com/embed/track/56z2qI0gKcPthQF6l8AW3E?si=6ddbfd91d0304aca&utm_source=oembed
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:4e42:8d::762 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 6f5b4aa00d2f8d6aed9935b471806bf7acef464d0c1d390260e5fe27f800c67e

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://open.spotify.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date: Thu, 31 Aug 2023 18:26:58 GMT
content-encoding: gzip
age: 108022
x-amz-meta-goog-reserved-file-mtime: 1693397565
x-cache: HIT, HIT
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
content-length: 61
x-served-by: cache-chi-klot8100033-CHI, cache-fra-eddf8230092-FRA
last-modified: Wed, 30 Aug 2023 12:25:18 GMT
etag: "b6652df95db52feb4daf4eca35380933"
x-goog-generation: 1693398318123960
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
x-goog-stored-content-length: 77
x-amz-checksum-crc32c: Ypo4GQ==
accept-ranges: bytes
x-cache-hits: 1, 16079

GET
H/1.1 200
OK ab67616d00001e02ebcc9144c41ae7d42efe6d94
i.scdn.co/image/ Frame 7C54 31 KB
32 KB 49ms
9ms Image
image/jpeg 2a04:4e42:8d::760
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://i.scdn.co/image/ab67616d00001e02ebcc9144c41ae7d42efe6d94
Requested by: Host: embed-cdn.spotifycdn.com
URL: https://embed-cdn.spotifycdn.com/_next/static/css/c47c6e7745a8b455.css
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2a04:4e42:8d::760 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: cc240e36234dec6c472a04a70af52dfa5dce110a2766d9280e19fb12cde54e9d

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://embed-cdn.spotifycdn.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

Date: Thu, 31 Aug 2023 18:26:58 GMT
Age: 726173
X-Cache: HIT, HIT
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
Connection: keep-alive
Content-Length: 31979
X-Served-By: cache-chi-kigq8000117-CHI, cache-fra-eddf8230063-FRA
Last-Modified: Wed, 04 Sep 2019 11:41:29 GMT
ETag: "7684273fe7fc515e237eab3b4c5eef9d"
x-goog-generation: 1567597289264217
Content-Type: image/jpeg
Access-Control-Allow-Origin: *
Cache-Control: max-age=315360000
x-goog-stored-content-length: 31979
x-amz-checksum-crc32c: 1a4KSA==
Accept-Ranges: bytes
Timing-Allow-Origin: *
X-Cache-Hits: 11653, 1993

GET
H2 200 CircularSpTitle-Bold-2fbf72b606d7f0b0f771ea4956a8b4d6.woff2
encore.scdn.co/fonts/ Frame 7C54 85 KB
86 KB 79ms
20ms Font
font/woff2 2a02:26f0:280:3::213:789e
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://encore.scdn.co/fonts/CircularSpTitle-Bold-2fbf72b606d7f0b0f771ea4956a8b4d6.woff2

Requested by

Host: embed-cdn.spotifycdn.com
URL: https://embed-cdn.spotifycdn.com/_next/static/css/8cd00e627952ec8a.css

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:280:3::213:789e Düsseldorf, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Resource Hash

1d752805498ebd36b9c69ad1d3da93b1561ea6b33f58ec89a66a4228a357dfe2

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000

Request headers

Referer: https://embed-cdn.spotifycdn.com/
Origin: https://open.spotify.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date: Thu, 31 Aug 2023 18:26:58 GMT
content-encoding: gzip
strict-transport-security: max-age=15768000
content-length: 87344
last-modified: Thu, 19 May 2022 07:59:23 GMT
etag: "db1a27b35e26398fef4be920ea96078d"
vary: Accept-Encoding
access-control-max-age: 86400
content-type: font/woff2
access-control-allow-origin: *
access-control-allow-methods: GET
cache-control: max-age=31536000
x-amz-checksum-crc32c: r/+ZKQ==
accept-ranges: bytes
access-control-allow-headers: range
expires: Fri, 30 Aug 2024 18:26:58 GMT

GET
H2 200 CircularSp-Book-4eaffdf96f4c6f984686e93d5d9cb325.woff2
encore.scdn.co/fonts/ Frame 7C54 82 KB
82 KB 68ms
9ms Font
font/woff2 2a02:26f0:280:3::213:789e
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://encore.scdn.co/fonts/CircularSp-Book-4eaffdf96f4c6f984686e93d5d9cb325.woff2

Requested by

Host: embed-cdn.spotifycdn.com
URL: https://embed-cdn.spotifycdn.com/_next/static/css/8cd00e627952ec8a.css

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:280:3::213:789e Düsseldorf, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Resource Hash

9b7413f945c8b8bb3f75eb10513c7ad79d386e98494d541e5f1fa9301ffbddd6

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000

Request headers

Referer: https://embed-cdn.spotifycdn.com/
Origin: https://open.spotify.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date: Thu, 31 Aug 2023 18:26:58 GMT
content-encoding: gzip
strict-transport-security: max-age=15768000
content-length: 84027
last-modified: Fri, 13 May 2022 11:38:51 GMT
etag: "f7b12903dd7a2d536ceb2b7cd1dba2c1"
vary: Accept-Encoding
access-control-max-age: 86400
content-type: font/woff2
access-control-allow-origin: *
access-control-allow-methods: GET
cache-control: max-age=31536000
x-amz-checksum-crc32c: rmKVPg==
accept-ranges: bytes
access-control-allow-headers: range
expires: Fri, 30 Aug 2024 18:26:58 GMT

POST
H2 200 monitoring Show response
open.spotify.com/embed/ Frame 7C54 2 B
413 B 55ms
54ms Fetch
application/json 2600:1901:1:c36::
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://open.spotify.com/embed/monitoring?o=22381&p=4505164808585216

Requested by

Host: embed-cdn.spotifycdn.com
URL: https://embed-cdn.spotifycdn.com/_next/static/chunks/pages/_app-fe44d090509824d5.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:1901:1:c36:: , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

envoy /

Resource Hash

44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

Referer: https://open.spotify.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

sp-trace-id: 2c59ffc264aefdc2
date: Thu, 31 Aug 2023 18:26:59 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
via: 1.1 google, HTTP/2 edgeproxy, 1.1 google
server: envoy
vary: origin,access-control-request-method,access-control-request-headers, Accept-Encoding
content-type: application/json
access-control-allow-origin: *
access-control-expose-headers: x-sentry-error,x-sentry-rate-limits,retry-after
x-envoy-upstream-service-time: 0
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000, h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2

GET
H2 200 / Show response
apresolve.spotify.com/ Frame 7C54 273 B
268 B 49ms
19ms XHR
application/json 2600:1901:0:524d::
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://apresolve.spotify.com/?type=dealer&type=spclient
Requested by: Host: embed-cdn.spotifycdn.com
URL: https://embed-cdn.spotifycdn.com/_next/static/chunks/pages/_app-fe44d090509824d5.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:1901:0:524d:: Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: 3756d3b73e7599eb1a072d230dbef6b1d3754e30a61c0e906a872bcf96e3e536

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://open.spotify.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date: Thu, 31 Aug 2023 18:26:59 GMT
content-encoding: gzip
via: 1.1 google
content-type: application/json; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 108

GET
H2 200 CircularSp-Bold-fe1cfc14b7498b187c78fa72fb72d148.woff2
encore.scdn.co/fonts/ Frame 7C54 87 KB
88 KB 13ms
13ms Font
font/woff2 2a02:26f0:280:3::213:789e
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://encore.scdn.co/fonts/CircularSp-Bold-fe1cfc14b7498b187c78fa72fb72d148.woff2

Requested by

Host: embed-cdn.spotifycdn.com
URL: https://embed-cdn.spotifycdn.com/_next/static/css/8cd00e627952ec8a.css

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:280:3::213:789e Düsseldorf, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Resource Hash

039130d456855a745451bff40707bee5512bc4466373224b2258f67cc6c6d879

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000

Request headers

Referer: https://embed-cdn.spotifycdn.com/
Origin: https://open.spotify.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date: Thu, 31 Aug 2023 18:26:59 GMT
content-encoding: gzip
strict-transport-security: max-age=15768000
content-length: 89529
last-modified: Fri, 13 May 2022 11:38:50 GMT
etag: "216b12b5a9657850b1b324e158454f8e"
vary: Accept-Encoding
access-control-max-age: 86400
content-type: font/woff2
access-control-allow-origin: *
access-control-allow-methods: GET
cache-control: max-age=31536000
x-amz-checksum-crc32c: 3OfNxA==
accept-ranges: bytes
access-control-allow-headers: range
expires: Fri, 30 Aug 2024 18:26:59 GMT

POST
H2 204 collect
region1.analytics.google.com/g/ 0
252 B 50ms
17ms Ping
text/plain 2001:4860:4802:32::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://region1.analytics.google.com/g/collect?v=2&tid=G-T3K4MTNQJN&gtm=45je38u0&_p=582935326&_gaz=1&cid=1864958019.1693506419&ul=en-us&sr=1600x1200&ir=1&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_eu=EA&_s=1&sid=1693506419&sct=1&seg=0&dl=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Ftechniques%2Fwindows-management-instrumentation%2F&dt=Windows%20Management%20Instrumentation%20-%20Red%20Canary%20Threat%20Report&en=page_view&_fv=1&_nsi=1&_ss=1&_ee=1
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-T3K4MTNQJN
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:32::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://redcanary.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 31 Aug 2023 18:26:59 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://redcanary.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 collect
stats.g.doubleclick.net/g/ 0
252 B 57ms
18ms Ping
text/plain 2a00:1450:400c:c04::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://stats.g.doubleclick.net/g/collect?v=2&tid=G-T3K4MTNQJN&cid=1864958019.1693506419&gtm=45je38u0&aip=1
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-T3K4MTNQJN
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:400c:c04::9b Brussels, Belgium, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://redcanary.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 31 Aug 2023 18:26:59 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://redcanary.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.de/ads/ 42 B
408 B 154ms
75ms Image
image/gif 2a00:1450:4001:82f::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&tid=G-T3K4MTNQJN&cid=1864958019.1693506419&gtm=45je38u0&aip=1&z=1440154928

Requested by

Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://redcanary.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 31 Aug 2023 18:26:59 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 662.dc13e1cf69424def.js Show response
embed-cdn.spotifycdn.com/_next/static/chunks/ Frame 7C54 56 KB
12 KB 7ms
7ms Script
application/javascript 2a04:4e42:8d::762
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://embed-cdn.spotifycdn.com/_next/static/chunks/662.dc13e1cf69424def.js
Requested by: Host: embed-cdn.spotifycdn.com
URL: https://embed-cdn.spotifycdn.com/_next/static/chunks/webpack-3e4f342dbb144246.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:4e42:8d::762 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: fd7385bd0bc7f291c2370cc63389d132bcac95e8449f516bbd8c0e40c10cdabe

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://open.spotify.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date: Thu, 31 Aug 2023 18:26:59 GMT
content-encoding: gzip
age: 2540640
x-amz-meta-goog-reserved-file-mtime: 1690964677
x-cache: HIT, HIT
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
content-length: 12292
x-served-by: cache-chi-kigq8000034-CHI, cache-fra-eddf8230092-FRA
last-modified: Wed, 02 Aug 2023 08:40:17 GMT
etag: "f63aef00c0a6fb21f8372a038ee41c3a"
x-goog-generation: 1690965617313097
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
x-goog-stored-content-length: 57497
x-amz-checksum-crc32c: yfdB0g==
accept-ranges: bytes
x-cache-hits: 8, 24613

GET
H2 200 90.e174c663531d2840.js Show response
embed-cdn.spotifycdn.com/_next/static/chunks/ Frame 7C54 5 KB
2 KB 6ms
6ms Script
application/javascript 2a04:4e42:8d::762
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://embed-cdn.spotifycdn.com/_next/static/chunks/90.e174c663531d2840.js
Requested by: Host: embed-cdn.spotifycdn.com
URL: https://embed-cdn.spotifycdn.com/_next/static/chunks/webpack-3e4f342dbb144246.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:4e42:8d::762 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 1004dc1b12f999eafe5336d4c92c18af95daf65af8b2bd641d29e697efb56364

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://open.spotify.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date: Thu, 31 Aug 2023 18:26:59 GMT
content-encoding: gzip
age: 2540641
x-amz-meta-goog-reserved-file-mtime: 1690964677
x-cache: HIT, HIT
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
content-length: 1750
x-served-by: cache-chi-klot8100099-CHI, cache-fra-eddf8230092-FRA
last-modified: Wed, 02 Aug 2023 08:40:17 GMT
etag: "9a75e6801ccd6da13a45572ceefe7d6b"
x-goog-generation: 1690965617342176
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
x-goog-stored-content-length: 5117
x-amz-checksum-crc32c: 467rEw==
accept-ranges: bytes
x-cache-hits: 8, 24118

GET
H2 200 / Show response
apresolve.spotify.com/ Frame 7C54 273 B
170 B 19ms
19ms Fetch
application/json 2600:1901:0:524d::
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://apresolve.spotify.com/?type=dealer&type=spclient
Requested by: Host: embed-cdn.spotifycdn.com
URL: https://embed-cdn.spotifycdn.com/_next/static/chunks/pages/_app-fe44d090509824d5.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:1901:0:524d:: Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: 47538fac2adc0804f5e21e74716ce2fdfa6e9795f74a1231c9947c631ea94910

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://open.spotify.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date: Thu, 31 Aug 2023 18:26:59 GMT
content-encoding: gzip
via: 1.1 google
content-type: application/json; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 107

GET
BLOB 200
OK 3d01f3bd-2170-4a3c-9aa8-2cbc364132bd
https://open.spotify.com/ Frame 7C54 46 KB
0 Other
text/plain

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://open.spotify.com/3d01f3bd-2170-4a3c-9aa8-2cbc364132bd
Requested by: Host: open.spotify.com
URL: https://open.spotify.com/embed/track/56z2qI0gKcPthQF6l8AW3E?si=6ddbfd91d0304aca&utm_source=oembed
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 3436a3567df14bd76a0e5b2ab1edba77ff61c49fb811b64de0dd23899103ecdc

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

Content-Length: 46922
Content-Type

GET
H2 200 uwt.js Show response
static.ads-twitter.com/ 56 KB
15 KB 59ms
13ms Script
application/javascript 199.232.148.157
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://static.ads-twitter.com/uwt.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-PXWC8JW
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 199.232.148.157 Amsterdam, Netherlands, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: cf7fcc9f75c8717897bfaef72f303fab423ce1b70c98512aeb3677e4af988dee

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://redcanary.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date: Thu, 31 Aug 2023 18:26:59 GMT
content-encoding: gzip
last-modified: Thu, 27 Oct 2022 16:56:53 GMT
etag: "32ad004436155ec972bc50e6238b5b67+gzip+gzip"
vary: Accept-Encoding,Host
x-cache: HIT, HIT
content-type: application/javascript; charset=utf-8
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
x-tw-cdn: FT
cache-control: no-cache
accept-ranges: bytes
content-length: 15375
x-served-by: cache-iad-kjyo7100081-IAD, cache-ams12724-AMS

GET
H2 200 insight.min.js Show response
snap.licdn.com/li.lms-analytics/ 1 KB
1 KB 54ms
7ms Script
application/javascript 2a02:26f0:480:15::213:7e4a
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://snap.licdn.com/li.lms-analytics/insight.min.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-PXWC8JW

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:480:15::213:7e4a Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Resource Hash

292f853f9ef0e448c5536987fe87197f401bafcde3e0857e17de1f0676f5b2eb

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://redcanary.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date: Thu, 31 Aug 2023 18:26:59 GMT
x-content-type-options: nosniff
last-modified: Wed, 30 Aug 2023 18:41:20 GMT
x-cdn: AKAM
x-amz-server-side-encryption: AES256
content-type: application/javascript;charset=utf-8
cache-control: max-age=78554
accept-ranges: bytes
content-length: 1046

GET
H2 200 pixel.js Show response
www.redditstatic.com/ads/ 23 KB
8 KB 48ms
7ms Script
application/javascript 2a04:4e42:600::396
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://www.redditstatic.com/ads/pixel.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-PXWC8JW
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:4e42:600::396 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: snooserv /
Resource Hash: e803e774c7b59fe74f71ed93acaa875cf9a99947ff8ed7615cd0c93c1667250f

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://redcanary.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date: Thu, 31 Aug 2023 18:26:59 GMT
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish
last-modified: Thu, 15 Jun 2023 20:49:59 GMT
server: snooserv
nel: {"report_to": "w3-reporting-nel", "max_age": 14400, "include_subdomains": false, "success_fraction": 0.02, "failure_fraction": 0.02}
etag: "4a205643a240cb95fa82289d62b5af7e"
x-amz-server-side-encryption: AES256
vary: Accept-Encoding,Origin
report-to: {"group": "w3-reporting-nel", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-nel.reddit.com/reports" }]}, {"group": "w3-reporting", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting.reddit.com/reports" }]}, {"group": "w3-reporting-csp", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-csp.reddit.com/reports" }]}
content-type: application/javascript
cache-control: public, max-age=60
accept-ranges: bytes
content-length: 7409

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/759876114/ 3 KB
2 KB 161ms
81ms Script
text/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/759876114/?random=1693506419293&cv=11&fst=1693506419293&bg=ffffff&guid=ON&async=1&gtm=45He38u0&u_w=1600&u_h=1200&url=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Ftechniques%2Fwindows-management-instrumentation%2F&hn=www.googleadservices.com&frm=0&tiba=Windows%20Management%20Instrumentation%20-%20Red%20Canary%20Threat%20Report&auid=406409531.1693506419&uamb=0&uaw=0&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-PXWC8JW

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8c0eaa0018d1dcc4937144d457960614470ff2447dbf50e18097779d97b43819

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://redcanary.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 31 Aug 2023 18:26:59 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1358
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 bat.js Show response
bat.bing.com/ 42 KB
13 KB 76ms
35ms Script
application/javascript 2620:1ec:c11::200
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://bat.bing.com/bat.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-PXWC8JW

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

2f472251b6b4a4a8d7ceed7539cb6ebea71caf28bccc0beda7a6866a6847b53e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://redcanary.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
date: Thu, 31 Aug 2023 18:26:58 GMT
last-modified: Fri, 28 Jul 2023 18:19:39 GMT
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 0B613CBCF5EF4D44A7A29F4FB855A087 Ref B: FRAEDGE1713 Ref C: 2023-08-31T18:26:59Z
etag: "806f3b1280c1d91:0"
vary: Accept-Encoding
x-cache: CONFIG_NOCACHE
content-type: application/javascript
cache-control: private,max-age=1800
accept-ranges: bytes
content-length: 12469

GET
H2 200 fbevents.js Show response
connect.facebook.net/en_US/ 193 KB
52 KB 42ms
8ms Script
application/x-javascript 2a03:2880:f084:d:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f084:d:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

9e41e783ec4cfc524c1666d1d5a4c805f8e92be52b030d130acfb31105e1e04c

Security Headers

Name	Value
Content-Security-Policy	default-src facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com data: blob: 'self';script-src .fbcdn.net .facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://redcanary.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

content-security-policy: default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; preload; includeSubDomains
date: Thu, 31 Aug 2023 18:26:59 GMT
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 52127
x-xss-protection: 0
pragma: public
x-fb-debug: 3Nn79nccpnuHuLZ+B6lB/sVqqJLzM2IJT5tRuVlUGKH2iAXm1kbP1hRnuf8LzAc+lAHVl7r90l1ildnC55oo/w==
cross-origin-opener-policy: same-origin-allow-popups
vary: Accept-Encoding
x-frame-options: DENY
content-type: application/x-javascript; charset=utf-8
cache-control: public, max-age=1200
permissions-policy: accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(), gyroscope=(), hid=(), idle-detection=(), magnetometer=(), microphone=(), midi=(), payment=(), screen-wake-lock=(), serial=(), usb=()
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2

200

/
attr.ml-api.io/
Redirect Chain

https://s.ml-attr.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dredcanary.com%26pId%3d%24UID
https://secure.adnxs.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dredcanary.com%26pId%3d%24UID
https://secure.adnxs.com/bounce?%2Fgetuid%3Fhttps%253a%252f%252fattr.ml-api.io%252f%253fdomain%253dredcanary.com%2526pId%253d%2524UID
https://attr.ml-api.io/?domain=redcanary.com&pId=988735524049751075

0
233 B

258ms
195ms

Image
application/json

2600:9000:2251:1000:12:3734:2a40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://attr.ml-api.io/?domain=redcanary.com&pId=988735524049751075
Requested by: Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
Protocol: H2
Server: 2600:9000:2251:1000:12:3734:2a40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://redcanary.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date: Thu, 31 Aug 2023 18:27:00 GMT
via: 1.1 231be1c97cc722fa08b64d21072ebfac.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P3
x-cache: Miss from cloudfront
content-type: application/json
x-amz-cf-id: Pa-osnz8lZeBQGmTMkf8Q_lKyHHOOaD6olz224JzgEYFP2N0e_1DFw==
content-length: 0
apigw-requestid: Kic6NjYNoAMESTw=

Redirect headers

pragma: no-cache
date: Thu, 31 Aug 2023 18:27:00 GMT
an-x-request-uuid: 9657aa9d-79b3-46a9-a607-88eeffed928c
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
location: https://attr.ml-api.io/?domain=redcanary.com&pId=988735524049751075
x-proxy-origin: 185.213.155.137; 185.213.155.137; 946.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 redcanary.com.json Show response
script.crazyegg.com/pages/data-scripts/0096/9416/sampling/ 158 B
256 B 25ms
25ms XHR
application/json 2606:4700::6813:9308
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://script.crazyegg.com/pages/data-scripts/0096/9416/sampling/redcanary.com.json?t=470418
Requested by: Host: script.crazyegg.com
URL: https://script.crazyegg.com/pages/versioned/common-scripts/b2625509b46b716ab8df67870a7d87b8.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6813:9308 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5408d95db01e0b235e7f251650932b36f5abfe4f40e8111b74c437826480b8fb

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://redcanary.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date: Thu, 31 Aug 2023 18:26:59 GMT
content-encoding: gzip
cf-cache-status: HIT
age: 8139
ce-version: 11.5.121
content-length: 145
last-modified: Thu, 31 Aug 2023 16:11:20 GMT
server: cloudflare
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: *
access-control-expose-headers: CE-Version
cache-control: public, max-age=300, s-maxage=1209600
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 7ff753311f4b4d7c-FRA

GET
H2 200 ipv
cdn.bizible.com/m/ 43 B
327 B 8ms
8ms Image
image/gif 152.195.15.58
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.bizible.com/m/ipv?_biz_r=&_biz_h=-1906410348&_biz_u=3803cdb6e2304186cb565470781410a2&_biz_s=4fab34&_biz_l=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Ftechniques%2Fwindows-management-instrumentation%2F&_biz_t=1693506418735&_biz_i=Windows%20Management%20Instrumentation%20-%20Red%20Canary%20Threat%20Report&_biz_n=0&a=redcanary.com&rnd=83260&cdn_o=a&_biz_z=1693506419374
Requested by: Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 152.195.15.58 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECS (frb/6760) /
Resource Hash: afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://redcanary.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 31 Aug 2023 18:26:59 GMT
last-modified: Wed, 30 Aug 2023 04:10:18 GMT
server: ECS (frb/6760)
age: 137801
x-cache: HIT
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
content-type: image/gif
cache-control: no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: -1

GET
H2 200 u
cdn.bizibly.com/ 43 B
203 B 17ms
7ms Image
image/gif 152.195.15.58
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.bizibly.com/u?_biz_u=3803cdb6e2304186cb565470781410a2&_biz_s=4fab34&_biz_l=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Ftechniques%2Fwindows-management-instrumentation%2F&_biz_t=1693506419377&_biz_i=Windows%20Management%20Instrumentation%20-%20Red%20Canary%20Threat%20Report&a=redcanary.com&rnd=137619&cdn_o=a&_biz_z=1693506419377
Requested by: Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 152.195.15.58 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECS (frb/67E0) /
Resource Hash: afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://redcanary.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 31 Aug 2023 18:26:59 GMT
last-modified: Wed, 30 Aug 2023 04:10:19 GMT
server: ECS (frb/67E0)
age: 137800
x-cache: HIT
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
content-type: image/gif
cache-control: no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: -1

GET
H2 200 f3744a5e-342b-429c-9d2c-2c1b7b45310a.js Show response
j.6sc.co/j/ 4 KB
4 KB 408ms
408ms Script
application/javascript 23.38.98.237
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://j.6sc.co/j/f3744a5e-342b-429c-9d2c-2c1b7b45310a.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-PXWC8JW
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.38.98.237 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a23-38-98-237.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: 040c6c4b281ea6760e1db7e9f2063e2409f8a2434d95851d85cc535f0ff1f9b5

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://redcanary.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

x-amz-version-id: a5rebSMZ.Kk9yiZR85vsDTngv6hjCogp
date: Thu, 31 Aug 2023 18:26:59 GMT
x-amz-cf-pop: FRA2-C2
x-amz-server-side-encryption: AES256
x-amz-meta-content-type: application/json
content-length: 3771
pragma: no-cache
last-modified: Mon, 22 May 2023 19:07:21 GMT
server: AmazonS3
etag: "9fdd9f5f306ab8eec57207f0e3c1a4e7"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
x-amz-cf-id: RhTtsIVwM8ehKwV8bMs7rjFeQCwR-PQjuwvL02xqxC-aErHrCkg0XQ==
expires: Thu, 31 Aug 2023 18:26:59 GMT

GET
H2 200 239.07bc4bf7922798bd.js Show response
embed-cdn.spotifycdn.com/_next/static/chunks/ Frame 7C54 112 KB
32 KB 8ms
8ms Script
application/javascript 2a04:4e42:8d::762
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://embed-cdn.spotifycdn.com/_next/static/chunks/239.07bc4bf7922798bd.js
Requested by: Host: embed-cdn.spotifycdn.com
URL: https://embed-cdn.spotifycdn.com/_next/static/chunks/webpack-3e4f342dbb144246.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:4e42:8d::762 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 62c59060782cf4822b2598e623b331039dc6e4a1f8ded9c07032eb91f60adc20

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://open.spotify.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date: Thu, 31 Aug 2023 18:26:59 GMT
content-encoding: gzip
age: 2540640
x-amz-meta-goog-reserved-file-mtime: 1690964677
x-cache: HIT, HIT
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
content-length: 32825
x-served-by: cache-chi-klot8100053-CHI, cache-fra-eddf8230092-FRA
last-modified: Wed, 02 Aug 2023 08:40:17 GMT
etag: "754ab6b3cee4b386497a168a8900298e"
x-goog-generation: 1690965617240921
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
x-goog-stored-content-length: 114759
x-amz-checksum-crc32c: Xrafeg==
accept-ranges: bytes
x-cache-hits: 8, 24778

GET
H2 200 70.0c0cdff9477a566b.js Show response
embed-cdn.spotifycdn.com/_next/static/chunks/ Frame 7C54 241 KB
53 KB 7ms
7ms Script
application/javascript 2a04:4e42:8d::762
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://embed-cdn.spotifycdn.com/_next/static/chunks/70.0c0cdff9477a566b.js
Requested by: Host: embed-cdn.spotifycdn.com
URL: https://embed-cdn.spotifycdn.com/_next/static/chunks/webpack-3e4f342dbb144246.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:4e42:8d::762 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 6ea27beb5e90d0b65a769f26f1864df79c97c997cc279952734892eeafd5ab05

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://open.spotify.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date: Thu, 31 Aug 2023 18:26:59 GMT
content-encoding: gzip
age: 2540641
x-amz-meta-goog-reserved-file-mtime: 1690964677
x-cache: HIT, HIT
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
content-length: 54273
x-served-by: cache-chi-kigq8000064-CHI, cache-fra-eddf8230092-FRA
last-modified: Wed, 02 Aug 2023 08:40:17 GMT
etag: "d01bb82fc57aa696eb7a37f25227533f"
x-goog-generation: 1690965617620460
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
x-goog-stored-content-length: 246299
x-amz-checksum-crc32c: 60anbQ==
accept-ranges: bytes
x-cache-hits: 8, 24969

GET
H2 200 spotify_player_o.42e735f526de3a43.js Show response
embed-cdn.spotifycdn.com/_next/static/chunks/ Frame 7C54 25 KB
7 KB 7ms
6ms Script
application/javascript 2a04:4e42:8d::762
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://embed-cdn.spotifycdn.com/_next/static/chunks/spotify_player_o.42e735f526de3a43.js
Requested by: Host: embed-cdn.spotifycdn.com
URL: https://embed-cdn.spotifycdn.com/_next/static/chunks/webpack-3e4f342dbb144246.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:4e42:8d::762 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: ccccfce93233bff70d19b919d1cb552aed5bc6caac3fc76d01ab6f4c757901d9

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://open.spotify.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date: Thu, 31 Aug 2023 18:26:59 GMT
content-encoding: gzip
age: 2540641
x-amz-meta-goog-reserved-file-mtime: 1690964677
x-cache: HIT, HIT
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
content-length: 7328
x-served-by: cache-chi-klot8100155-CHI, cache-fra-eddf8230092-FRA
last-modified: Wed, 02 Aug 2023 08:40:17 GMT
etag: "615db0ae9631539d4b3438ee8a5a68da"
x-goog-generation: 1690965617266128
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
x-goog-stored-content-length: 25627
x-amz-checksum-crc32c: CIvg6w==
accept-ranges: bytes
x-cache-hits: 8, 24096

OPTIONS
H2 200 events
gew4-spclient.spotify.com/gabo-receiver-service/public/v3/ Frame 0
0 64ms
23ms Preflight 2600:1901:1:81::
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://gew4-spclient.spotify.com/gabo-receiver-service/public/v3/events
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:1901:1:81:: , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: envoy /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://open.spotify.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Accept,Authorization,Origin,Content-Type,Spotify-App-Version,App-Platform,X-Spotify-Connection-Id,X-Client-Id,X-Spotify-Quicksilver-Uri,client-token,content-access-token,x-cloud-trace-context
access-control-allow-methods: DELETE,GET,PATCH,POST,PUT,OPTIONS
access-control-allow-origin: https://open.spotify.com
access-control-max-age: 604800
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
date: Thu, 31 Aug 2023 18:26:59 GMT
server: envoy
vary: Accept-Encoding
via: HTTP/2 edgeproxy, 1.1 google

OPTIONS
H2 200 events
gew4-spclient.spotify.com/gabo-receiver-service/public/v3/ Frame 0
0 60ms
20ms Preflight 2600:1901:1:81::
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://gew4-spclient.spotify.com/gabo-receiver-service/public/v3/events
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:1901:1:81:: , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: envoy /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://open.spotify.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Accept,Authorization,Origin,Content-Type,Spotify-App-Version,App-Platform,X-Spotify-Connection-Id,X-Client-Id,X-Spotify-Quicksilver-Uri,client-token,content-access-token,x-cloud-trace-context
access-control-allow-methods: DELETE,GET,PATCH,POST,PUT,OPTIONS
access-control-allow-origin: https://open.spotify.com
access-control-max-age: 604800
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
date: Thu, 31 Aug 2023 18:26:59 GMT
server: envoy
vary: Accept-Encoding
via: HTTP/2 edgeproxy, 1.1 google

POST
H2 200 events Show response
gew4-spclient.spotify.com/gabo-receiver-service/public/v3/ Frame 7C54 13 B
103 B 135ms
135ms Fetch
application/json 2600:1901:1:81::
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://gew4-spclient.spotify.com/gabo-receiver-service/public/v3/events

Requested by

Host: embed-cdn.spotifycdn.com
URL: https://embed-cdn.spotifycdn.com/_next/static/chunks/pages/_app-fe44d090509824d5.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:1901:1:81:: , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

envoy /

Resource Hash

debf84af8d66827e1cbc6791aa686504e3116d8cb20f4697fef23108333061f8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

Referer: https://open.spotify.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36
content-type: application/json

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
date: Thu, 31 Aug 2023 18:26:59 GMT
via: HTTP/2 edgeproxy, 1.1 google
server: envoy
content-type: application/json
access-control-allow-origin: https://open.spotify.com
cache-control: private, max-age=0
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 39

POST
H2 200 events Show response
gew4-spclient.spotify.com/gabo-receiver-service/public/v3/ Frame 7C54 13 B
172 B 137ms
136ms Fetch
application/json 2600:1901:1:81::
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://gew4-spclient.spotify.com/gabo-receiver-service/public/v3/events

Requested by

Host: embed-cdn.spotifycdn.com
URL: https://embed-cdn.spotifycdn.com/_next/static/chunks/pages/_app-fe44d090509824d5.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:1901:1:81:: , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

envoy /

Resource Hash

debf84af8d66827e1cbc6791aa686504e3116d8cb20f4697fef23108333061f8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

Referer: https://open.spotify.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36
content-type: application/json

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
date: Thu, 31 Aug 2023 18:26:59 GMT
via: HTTP/2 edgeproxy, 1.1 google
server: envoy
content-type: application/json
access-control-allow-origin: https://open.spotify.com
cache-control: private, max-age=0
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 39

GET
H2 200 xdc.js Show response
cdn.bizible.com/ 116 B
220 B 222ms
222ms Script
text/javascript 152.195.15.58
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.bizible.com/xdc.js?_biz_u=3803cdb6e2304186cb565470781410a2&_biz_h=-1906410348&cdn_o=a&jsVer=4.23.08.24&a=redcanary.com
Requested by: Host: cdn.bizible.com
URL: https://cdn.bizible.com/scripts/bizible.js?account=redcanary.com
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 152.195.15.58 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECS (frb/6711) /
Resource Hash: 5d53b54c7ea0679e2db9ad67e13899bdd3ae29f54e09f94eef5ff9b08a7352df

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://redcanary.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

content-type: text/javascript; charset=utf-8
date: Thu, 31 Aug 2023 18:26:59 GMT
cache-control: private, must-revalidate, max-age=21600
server: ECS (frb/6711)
etag: EC97F193
content-length: 116
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"

GET
BLOB 200
OK 0964df4d-edc1-4de2-825f-4a491ff8f201
https://redcanary.com/ 45 B
0 Other
text/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://redcanary.com/0964df4d-edc1-4de2-825f-4a491ff8f201
Requested by: Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 86551808dbfbf8bc9b23ab3d0725794c2e1f2b4265c96715f2945638160edc2b

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

Content-Length: 45
Content-Type: text/javascript

GET
H2 200 u
cdn.bizible.com/m/ 43 B
121 B 7ms
7ms Image
image/gif 152.195.15.58
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.bizible.com/m/u?mapType=mkto&mapValue=id%3A003-YRU-314%26token%3A_mch-redcanary.com-1693506418798-52230&_biz_u=3803cdb6e2304186cb565470781410a2&_biz_s=4fab34&_biz_l=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Ftechniques%2Fwindows-management-instrumentation%2F&_biz_t=1693506419378&_biz_i=Windows%20Management%20Instrumentation%20-%20Red%20Canary%20Threat%20Report&_biz_n=1&a=redcanary.com&rnd=584577&cdn_o=a&_biz_z=1693506419745
Requested by: Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 152.195.15.58 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECS (frb/6776) /
Resource Hash: afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://redcanary.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 31 Aug 2023 18:26:59 GMT
last-modified: Wed, 30 Aug 2023 04:10:23 GMT
server: ECS (frb/6776)
age: 137796
x-cache: HIT
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
content-type: image/gif
cache-control: no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: -1

GET
H2 200 tdr-sidenav-grain.png
redcanary.com/wp-content/themes/redcanary/assets/img/ 84 KB
84 KB 124ms
124ms Image
image/png 104.198.136.223
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://redcanary.com/wp-content/themes/redcanary/assets/img/tdr-sidenav-grain.png

Requested by

Host: redcanary.com
URL: https://redcanary.com/wp-content/cache/autoptimize/css/autoptimize_7c1b044830350562b8347035fb5ab725.css

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.198.136.223 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

223.136.198.104.bc.googleusercontent.com

Software

nginx /

Resource Hash

747e9ca7a5f5157e1555dca2f78d780db6a1bef9dc270dcd7a73f571f1391d2b

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	"max-age=63072000; includeSubDomains; preload";

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://redcanary.com/wp-content/cache/autoptimize/css/autoptimize_7c1b044830350562b8347035fb5ab725.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date: Thu, 31 Aug 2023 18:26:59 GMT
content-security-policy: upgrade-insecure-requests
strict-transport-security: "max-age=63072000; includeSubDomains; preload";
last-modified: Mon, 20 Mar 2023 15:41:32 GMT
server: nginx
etag: "64187eac-14f3f"
vary: Accept-Encoding
x-wpe-request-id: 6caf5263a952ace9a2db73538126d091
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 85823

GET
H2 200 tdr-search-icon.svg
redcanary.com/wp-content/themes/redcanary/assets/img/ 773 B
764 B 124ms
123ms Image
image/svg+xml 104.198.136.223
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://redcanary.com/wp-content/themes/redcanary/assets/img/tdr-search-icon.svg

Requested by

Host: redcanary.com
URL: https://redcanary.com/wp-content/cache/autoptimize/css/autoptimize_7c1b044830350562b8347035fb5ab725.css

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.198.136.223 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

223.136.198.104.bc.googleusercontent.com

Software

nginx /

Resource Hash

7bb26544c7c0d00e118860dc125c1bc943201bca5cf780804370732b39210d38

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	"max-age=63072000; includeSubDomains; preload";

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://redcanary.com/wp-content/cache/autoptimize/css/autoptimize_7c1b044830350562b8347035fb5ab725.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date: Thu, 31 Aug 2023 18:26:59 GMT
content-security-policy: upgrade-insecure-requests
content-encoding: br
strict-transport-security: "max-age=63072000; includeSubDomains; preload";
last-modified: Mon, 20 Mar 2023 15:41:32 GMT
server: nginx
etag: W/"64187eac-305"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
x-wpe-request-id: 0264269e6c3db9a12665111b7113bb3d
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 tdr-hero-canaries.png
redcanary.com/wp-content/themes/redcanary/assets/img/ 10 KB
10 KB 125ms
125ms Image
image/png 104.198.136.223
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://redcanary.com/wp-content/themes/redcanary/assets/img/tdr-hero-canaries.png

Requested by

Host: redcanary.com
URL: https://redcanary.com/wp-content/cache/autoptimize/css/autoptimize_7c1b044830350562b8347035fb5ab725.css

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.198.136.223 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

223.136.198.104.bc.googleusercontent.com

Software

nginx /

Resource Hash

7481436346ad777435fe494e87a3d7fa9dc1251ab9a024d5305a90fcc0b44f8c

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	"max-age=63072000; includeSubDomains; preload";

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://redcanary.com/wp-content/cache/autoptimize/css/autoptimize_7c1b044830350562b8347035fb5ab725.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date: Thu, 31 Aug 2023 18:26:59 GMT
content-security-policy: upgrade-insecure-requests
strict-transport-security: "max-age=63072000; includeSubDomains; preload";
last-modified: Mon, 20 Mar 2023 15:41:31 GMT
server: nginx
etag: "64187eab-27ad"
vary: Accept-Encoding
x-wpe-request-id: f4d4c6023a4702dee601a47b2d08903e
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 10157

GET
H2 200 topic-hero.jpg
redcanary.com/wp-content/themes/redcanary/assets/img/ 244 KB
245 KB 231ms
230ms Image
image/jpeg 104.198.136.223
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://redcanary.com/wp-content/themes/redcanary/assets/img/topic-hero.jpg

Requested by

Host: redcanary.com
URL: https://redcanary.com/wp-content/cache/autoptimize/css/autoptimize_7c1b044830350562b8347035fb5ab725.css

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.198.136.223 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

223.136.198.104.bc.googleusercontent.com

Software

nginx /

Resource Hash

36975a27509bf92a53016181456a48ff34220ab524329a013bd2fa486ab19048

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	"max-age=63072000; includeSubDomains; preload";

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://redcanary.com/wp-content/cache/autoptimize/css/autoptimize_7c1b044830350562b8347035fb5ab725.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date: Thu, 31 Aug 2023 18:26:59 GMT
content-security-policy: upgrade-insecure-requests
strict-transport-security: "max-age=63072000; includeSubDomains; preload";
last-modified: Wed, 27 Feb 2019 15:51:15 GMT
server: nginx
etag: "5c76b1f3-3d141"
vary: Accept-Encoding
x-wpe-request-id: 74408a37718fece76c3b29363c6613ae
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 250177

GET
H2 200 graphic-soundwave.svg
redcanary.com/wp-content/themes/redcanary/assets/img/ 3 KB
836 B 232ms
231ms Image
image/svg+xml 104.198.136.223
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://redcanary.com/wp-content/themes/redcanary/assets/img/graphic-soundwave.svg

Requested by

Host: redcanary.com
URL: https://redcanary.com/wp-content/cache/autoptimize/css/autoptimize_7c1b044830350562b8347035fb5ab725.css

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.198.136.223 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

223.136.198.104.bc.googleusercontent.com

Software

nginx /

Resource Hash

1d3d9de6db687e8b9bf3aa08f565dc2db8743147acce6904bf762b7ff56dbf09

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	"max-age=63072000; includeSubDomains; preload";

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://redcanary.com/wp-content/cache/autoptimize/css/autoptimize_7c1b044830350562b8347035fb5ab725.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date: Thu, 31 Aug 2023 18:26:59 GMT
content-security-policy: upgrade-insecure-requests
content-encoding: br
strict-transport-security: "max-age=63072000; includeSubDomains; preload";
last-modified: Mon, 20 Mar 2023 15:41:29 GMT
server: nginx
etag: W/"64187ea9-abb"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
x-wpe-request-id: 69693fd7bf69a0120defeca724c2fd92
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 icon-spotify.svg
redcanary.com/wp-content/themes/redcanary/assets/img/ 2 KB
1 KB 231ms
230ms Image
image/svg+xml 104.198.136.223
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://redcanary.com/wp-content/themes/redcanary/assets/img/icon-spotify.svg

Requested by

Host: redcanary.com
URL: https://redcanary.com/wp-content/cache/autoptimize/css/autoptimize_7c1b044830350562b8347035fb5ab725.css

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.198.136.223 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

223.136.198.104.bc.googleusercontent.com

Software

nginx /

Resource Hash

5a67c844a08bb049379474c28891b836a26d673555f882dd5717beeabf42200f

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	"max-age=63072000; includeSubDomains; preload";

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://redcanary.com/wp-content/cache/autoptimize/css/autoptimize_7c1b044830350562b8347035fb5ab725.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date: Thu, 31 Aug 2023 18:26:59 GMT
content-security-policy: upgrade-insecure-requests
content-encoding: br
strict-transport-security: "max-age=63072000; includeSubDomains; preload";
last-modified: Mon, 20 Mar 2023 15:41:30 GMT
server: nginx
etag: W/"64187eaa-653"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
x-wpe-request-id: 6005919ec0b36df3a566de01265b1ea4
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 tdr-hero-dots.png
redcanary.com/wp-content/themes/redcanary/assets/img/ 11 KB
11 KB 230ms
230ms Image
image/png 104.198.136.223
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://redcanary.com/wp-content/themes/redcanary/assets/img/tdr-hero-dots.png

Requested by

Host: redcanary.com
URL: https://redcanary.com/wp-content/cache/autoptimize/css/autoptimize_7c1b044830350562b8347035fb5ab725.css

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.198.136.223 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

223.136.198.104.bc.googleusercontent.com

Software

nginx /

Resource Hash

af40bad1e1b6415c6d7dfa127a6e8bf4c64111adfca9e4f4c43ade9c39dc9592

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	"max-age=63072000; includeSubDomains; preload";

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://redcanary.com/wp-content/cache/autoptimize/css/autoptimize_7c1b044830350562b8347035fb5ab725.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date: Thu, 31 Aug 2023 18:26:59 GMT
content-security-policy: upgrade-insecure-requests
strict-transport-security: "max-age=63072000; includeSubDomains; preload";
last-modified: Mon, 20 Mar 2023 15:41:31 GMT
server: nginx
etag: "64187eab-2b89"
vary: Accept-Encoding
x-wpe-request-id: 8d27be2d81146dbf95127b1985d8122c
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 11145

GET
H2 200 TDR-Header03-1200w.jpeg
redcanary.com/wp-content/themes/redcanary/assets/img/ 331 KB
332 KB 338ms
338ms Image
image/jpeg 104.198.136.223
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://redcanary.com/wp-content/themes/redcanary/assets/img/TDR-Header03-1200w.jpeg

Requested by

Host: redcanary.com
URL: https://redcanary.com/wp-content/cache/autoptimize/css/autoptimize_7c1b044830350562b8347035fb5ab725.css

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.198.136.223 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

223.136.198.104.bc.googleusercontent.com

Software

nginx /

Resource Hash

f8e765848384e530beac002fc4656b7d54b12ef24564025933981afe76e2ca43

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	"max-age=63072000; includeSubDomains; preload";

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://redcanary.com/wp-content/cache/autoptimize/css/autoptimize_7c1b044830350562b8347035fb5ab725.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date: Thu, 31 Aug 2023 18:26:59 GMT
content-security-policy: upgrade-insecure-requests
strict-transport-security: "max-age=63072000; includeSubDomains; preload";
last-modified: Tue, 21 Mar 2023 18:01:24 GMT
server: nginx
etag: "6419f0f4-52bf0"
vary: Accept-Encoding
x-wpe-request-id: 43a360fa18adf02353082cc0a92cf0be
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 338928

GET
H2 200 search-btn.svg
redcanary.com/wp-content/themes/redcanary/assets/img/ 161 B
472 B 340ms
340ms Image
image/svg+xml 104.198.136.223
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://redcanary.com/wp-content/themes/redcanary/assets/img/search-btn.svg

Requested by

Host: redcanary.com
URL: https://redcanary.com/wp-content/cache/autoptimize/css/autoptimize_7c1b044830350562b8347035fb5ab725.css

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.198.136.223 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

223.136.198.104.bc.googleusercontent.com

Software

nginx /

Resource Hash

0f57969cdf0d61b86fc25ded8a8c5058a5edd346d1845b232610a54f08d0fcb8

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	"max-age=63072000; includeSubDomains; preload";

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://redcanary.com/wp-content/cache/autoptimize/css/autoptimize_7c1b044830350562b8347035fb5ab725.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date: Thu, 31 Aug 2023 18:26:59 GMT
content-security-policy: upgrade-insecure-requests
content-encoding: br
strict-transport-security: "max-age=63072000; includeSubDomains; preload";
last-modified: Wed, 08 Sep 2021 23:08:04 GMT
server: nginx
etag: W/"61394254-a1"
vary: Accept-Encoding, Accept-Encoding
x-wpe-request-id: ebab264d00aeeff98aa1220d5258a232
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 rp.gif
alb.reddit.com/ 42 B
637 B 159ms
115ms Image
image/gif 151.101.1.140
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://alb.reddit.com/rp.gif?ts=1693506419931&id=t2_5kac730w&event=PageVisit&m.itemCount=&m.value=&m.valueDecimal=&m.currency=&m.transactionId=&m.customEventName=&m.products=&m.conversionId=&uuid=4a0fc5c0-09fc-46d5-827c-715b76128383&aaid=&em=&external_id=&idfa=&integration=reddit&opt_out=0&sh=1600&sw=1200&v=rdt_f5bd31b2
Requested by: Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.1.140 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: Varnish /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://redcanary.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date: Thu, 31 Aug 2023 18:27:00 GMT
via: 1.1 varnish
nel: {"report_to": "w3-reporting-nel", "max_age": 14400, "include_subdomains": false, "success_fraction": 0.3, "failure_fraction": 0.3}
server: Varnish
report-to: {"group": "w3-reporting-nel", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-nel.reddit.com/reports" }]}, {"group": "w3-reporting", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting.reddit.com/reports" }]}, {"group": "w3-reporting-csp", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-csp.reddit.com/reports" }]}
content-type: image/gif
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
content-length: 42
retry-after: 0

GET
H2 200 insight.old.min.js Show response
snap.licdn.com/li.lms-analytics/ 13 KB
5 KB 7ms
7ms Script
application/x-javascript 2a02:26f0:480:15::213:7e4a
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://snap.licdn.com/li.lms-analytics/insight.old.min.js

Requested by

Host: snap.licdn.com
URL: https://snap.licdn.com/li.lms-analytics/insight.min.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:480:15::213:7e4a Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Resource Hash

fa53fcd8da139d256c0ca83b69cb37473ca627b6052368ed3327c80d9fb61e25

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://redcanary.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date: Thu, 31 Aug 2023 18:26:59 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Mon, 28 Aug 2023 12:14:15 GMT
x-cdn: AKAM
x-amz-server-side-encryption: AES256
vary: Accept-Encoding
content-type: application/x-javascript;charset=utf-8
cache-control: max-age=38507
accept-ranges: bytes
content-length: 4862

GET
H2 200 1042590016249604 Show response
connect.facebook.net/signals/config/ 137 KB
36 KB 12ms
11ms Script
application/x-javascript 2a03:2880:f084:d:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/1042590016249604?v=2.9.125&r=stable&domain=redcanary.com

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f084:d:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

5d07fef4322254c5ef1217d36478f2493d1dcdea7254b5f35adf231c55588cb4

Security Headers

Name	Value
Content-Security-Policy	default-src facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com data: blob: 'self';script-src .fbcdn.net .facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://redcanary.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

content-security-policy: default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script';
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; preload; includeSubDomains
date: Thu, 31 Aug 2023 18:26:59 GMT
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 35944
x-xss-protection: 0
pragma: public
x-fb-debug: 6TvLHxv2MucLbUzkUKfJmPxLcfeWjnyYaKZ/KzwsAyi5ku7qOWVLomXEis5RmLy6DKmfQ0dYoORmHUsnNNRBLw==
cross-origin-opener-policy: same-origin-allow-popups
vary: Accept-Encoding
x-frame-options: DENY
content-type: application/x-javascript; charset=utf-8
origin-agent-cluster: ?0
cache-control: public, max-age=1200
permissions-policy: accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(), gyroscope=(), hid=(), idle-detection=(), magnetometer=(), microphone=(), midi=(), payment=(), screen-wake-lock=(), serial=(), usb=()
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 adsct
t.co/i/ 43 B
378 B 233ms
178ms Image
image/gif 104.244.42.133
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://t.co/i/adsct?bci=3&eci=2&event_id=aa502de4-ee97-4a24-b9a8-7fe085227a35&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=1f77e6af-abdd-4cbf-8c2f-fefc7f33f2db&tw_document_href=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Ftechniques%2Fwindows-management-instrumentation%2F&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=o015g&type=javascript&version=2.3.29

Requested by

Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.244.42.133 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://redcanary.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

x-response-time: 172
date: Thu, 31 Aug 2023 18:26:59 GMT
strict-transport-security: max-age=0
server: tsa_o
content-type: image/gif;charset=utf-8
x-transaction-id: 481d14df825fd552
cache-control: no-cache, no-store, max-age=0
perf: 7626143928
x-connection-hash: 603c6e8ffd4c51f509ebaf9a5198500df7f88349f0067637d8fad05c987edfab
content-length: 43

GET
H2 200 adsct
analytics.twitter.com/i/ 43 B
395 B 219ms
187ms Image
image/gif 104.244.42.131
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://analytics.twitter.com/i/adsct?bci=3&eci=2&event_id=aa502de4-ee97-4a24-b9a8-7fe085227a35&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=1f77e6af-abdd-4cbf-8c2f-fefc7f33f2db&tw_document_href=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Ftechniques%2Fwindows-management-instrumentation%2F&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=o015g&type=javascript&version=2.3.29

Requested by

Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.244.42.131 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://redcanary.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

x-response-time: 181
date: Thu, 31 Aug 2023 18:26:59 GMT
strict-transport-security: max-age=631138519
server: tsa_o
content-type: image/gif;charset=utf-8
x-transaction-id: 012232120f66deeb
cache-control: no-cache, no-store, max-age=0
perf: 7626143928
x-connection-hash: dfb8ccd5d85c53ce0f29d6b499541bd3bd1ec5f633d0856be534929704bdfce9
content-length: 43

GET
H2 200 button-right-arrow-white.svg
redcanary.com/wp-content/themes/redcanary/assets/img/ 350 B
619 B 238ms
230ms Image
image/svg+xml 104.198.136.223
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://redcanary.com/wp-content/themes/redcanary/assets/img/button-right-arrow-white.svg

Requested by

Host: redcanary.com
URL: https://redcanary.com/wp-content/cache/autoptimize/css/autoptimize_7c1b044830350562b8347035fb5ab725.css

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.198.136.223 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

223.136.198.104.bc.googleusercontent.com

Software

nginx /

Resource Hash

8edbf02936f4bbda931a228bd84f7b668522af07f3dfc33b5caee429e7febb85

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	"max-age=63072000; includeSubDomains; preload";

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://redcanary.com/wp-content/cache/autoptimize/css/autoptimize_7c1b044830350562b8347035fb5ab725.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date: Thu, 31 Aug 2023 18:27:00 GMT
content-security-policy: upgrade-insecure-requests
content-encoding: br
strict-transport-security: "max-age=63072000; includeSubDomains; preload";
last-modified: Wed, 27 Feb 2019 15:51:05 GMT
server: nginx
etag: W/"5c76b1e9-15e"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
x-wpe-request-id: 8bae2cec075d86d8cce7858fda7b0bff
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 spotify-logo-black-8-01.svg
redcanary.com/wp-content/uploads/2021/03/ 898 B
857 B 201ms
199ms Image
image/svg+xml 104.198.136.223
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://redcanary.com/wp-content/uploads/2021/03/spotify-logo-black-8-01.svg

Requested by

Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.198.136.223 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

223.136.198.104.bc.googleusercontent.com

Software

nginx /

Resource Hash

24a9979fff20ad59cba9b4a38af6fba8903c482fa2c390e2f0e82c97a649da98

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	"max-age=63072000; includeSubDomains; preload";

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date: Thu, 31 Aug 2023 18:27:00 GMT
content-security-policy: upgrade-insecure-requests
content-encoding: br
strict-transport-security: "max-age=63072000; includeSubDomains; preload";
last-modified: Mon, 29 Mar 2021 15:22:29 GMT
server: nginx
etag: W/"6061f0b5-382"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
x-wpe-request-id: b528e47aa4140d9abfc5a94ff224c49b
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 /
www.google.com/pagead/1p-user-list/759876114/ 42 B
455 B 140ms
52ms Image
image/gif 2a00:1450:4001:829::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/759876114/?random=1693506419293&cv=11&fst=1693504800000&bg=ffffff&guid=ON&async=1&gtm=45He38u0&u_w=1600&u_h=1200&url=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Ftechniques%2Fwindows-management-instrumentation%2F&frm=0&tiba=Windows%20Management%20Instrumentation%20-%20Red%20Canary%20Threat%20Report&fmt=3&is_vtc=1&random=2852558179&rmt_tld=0&ipr=y

Requested by

Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://redcanary.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 31 Aug 2023 18:27:00 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.de/pagead/1p-user-list/759876114/ 42 B
154 B 48ms
47ms Image
image/gif 2a00:1450:4001:82f::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/759876114/?random=1693506419293&cv=11&fst=1693504800000&bg=ffffff&guid=ON&async=1&gtm=45He38u0&u_w=1600&u_h=1200&url=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Ftechniques%2Fwindows-management-instrumentation%2F&frm=0&tiba=Windows%20Management%20Instrumentation%20-%20Red%20Canary%20Threat%20Report&fmt=3&is_vtc=1&random=2852558179&rmt_tld=1&ipr=y

Requested by

Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://redcanary.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 31 Aug 2023 18:27:00 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 TDR-Logo-Lockup-02.png
redcanary.com/wp-content/uploads/2023/03/ 7 KB
8 KB 173ms
171ms Image
image/png 104.198.136.223
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://redcanary.com/wp-content/uploads/2023/03/TDR-Logo-Lockup-02.png

Requested by

Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.198.136.223 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

223.136.198.104.bc.googleusercontent.com

Software

nginx /

Resource Hash

756b9a05dda5b1afa4e8c3aaa061eccf77460cbd84f4b31f511b675fc9dbacd3

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	"max-age=63072000; includeSubDomains; preload";

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date: Thu, 31 Aug 2023 18:27:00 GMT
content-security-policy: upgrade-insecure-requests
strict-transport-security: "max-age=63072000; includeSubDomains; preload";
last-modified: Tue, 21 Mar 2023 02:03:06 GMT
server: nginx
etag: "6419105a-1d03"
vary: Accept-Encoding
x-wpe-request-id: 627bc16d49ef6478075be4266cdc3d6a
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 7427

GET
H2 200 birdInFlight-flipped-975x975-1.jpg
redcanary.com/wp-content/uploads/2022/03/ 18 KB
18 KB 172ms
170ms Image
image/jpeg 104.198.136.223
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://redcanary.com/wp-content/uploads/2022/03/birdInFlight-flipped-975x975-1.jpg

Requested by

Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.198.136.223 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

223.136.198.104.bc.googleusercontent.com

Software

nginx /

Resource Hash

9dcafe0dd491720f7b4e7168ee159909aba669acbba23ca17e32c9a2174510b0

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	"max-age=63072000; includeSubDomains; preload";

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date: Thu, 31 Aug 2023 18:27:00 GMT
content-security-policy: upgrade-insecure-requests
strict-transport-security: "max-age=63072000; includeSubDomains; preload";
last-modified: Mon, 07 Mar 2022 19:56:58 GMT
server: nginx
etag: "6226638a-460b"
vary: Accept-Encoding
x-wpe-request-id: cf54673b917548585bcd54e22c487f17
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 17931

GET
H2 200 TDR-Header01-1200w.jpg
redcanary.com/wp-content/uploads/2023/03/ 339 KB
340 KB 172ms
171ms Image
image/jpeg 104.198.136.223
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://redcanary.com/wp-content/uploads/2023/03/TDR-Header01-1200w.jpg

Requested by

Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.198.136.223 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

223.136.198.104.bc.googleusercontent.com

Software

nginx /

Resource Hash

6af930f857a9b1c2e3f638e4c2eeae1f5a8d28643db55d6a2f7d99c77e17489f

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	"max-age=63072000; includeSubDomains; preload";

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date: Thu, 31 Aug 2023 18:27:00 GMT
content-security-policy: upgrade-insecure-requests
strict-transport-security: "max-age=63072000; includeSubDomains; preload";
last-modified: Mon, 20 Mar 2023 20:12:02 GMT
server: nginx
etag: "6418be12-54b50"
vary: Accept-Encoding
x-wpe-request-id: d9a75f3ede24f391817fe552b331106f
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 346960

GET
H2 200 Icon_Alert-Center_Investigation.svg
redcanary.com/wp-content/uploads/2020/09/ 4 KB
1 KB 164ms
163ms Image
image/svg+xml 104.198.136.223
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://redcanary.com/wp-content/uploads/2020/09/Icon_Alert-Center_Investigation.svg

Requested by

Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.198.136.223 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

223.136.198.104.bc.googleusercontent.com

Software

nginx /

Resource Hash

1576f47ba50e5433d2efe01986fa43b861bd6a4de15751c35bf606b2a9fed2c9

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	"max-age=63072000; includeSubDomains; preload";

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date: Thu, 31 Aug 2023 18:27:00 GMT
content-security-policy: upgrade-insecure-requests
content-encoding: br
strict-transport-security: "max-age=63072000; includeSubDomains; preload";
last-modified: Thu, 24 Sep 2020 17:12:27 GMT
server: nginx
etag: W/"5f6cd37b-e55"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
x-wpe-request-id: f8efe956ad5b3ad58d6c7b6cbc657285
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 204 56383426.js Show response
bat.bing.com/p/action/ 0
116 B 34ms
34ms Script
text/plain 2620:1ec:c11::200
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://bat.bing.com/p/action/56383426.js

Requested by

Host: bat.bing.com
URL: https://bat.bing.com/bat.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://redcanary.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: private,max-age=1800
date: Thu, 31 Aug 2023 18:26:59 GMT
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 8E822F8E53984136A2DCF920D6B637F4 Ref B: FRAEDGE1713 Ref C: 2023-08-31T18:27:00Z
x-cache: CONFIG_NOCACHE

GET
H2 204 0
bat.bing.com/action/ 0
286 B 75ms
75ms Image
text/plain 2620:1ec:c11::200
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://bat.bing.com/action/0?ti=56383426&tm=gtm002&Ver=2&mid=887c80aa-b2e3-4ab8-8103-6ecdf0350e3a&sid=f9756280482b11eebaeee16a63b15672&vid=f97581f0482b11eeb28609ae2ec488b7&vids=1&msclkid=N&pi=1200101525&lg=en-US&sw=1600&sh=1200&sc=24&tl=Windows%20Management%20Instrumentation%20-%20Red%20Canary%20Threat%20Report&p=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Ftechniques%2Fwindows-management-instrumentation%2F&r=&lt=1752&evt=pageLoad&sv=1&rn=977758

Requested by

Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://redcanary.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Thu, 31 Aug 2023 18:26:59 GMT
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: DD3B943C36F44DBEA82AC964B25CE60F Ref B: FRAEDGE1713 Ref C: 2023-08-31T18:27:00Z
x-cache: CONFIG_NOCACHE
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 clock Show response
tracking.crazyegg.com/ Frame 2BF3 31 B
138 B 148ms
68ms XHR
text/plain 52.18.119.10
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tracking.crazyegg.com/clock?t=1693506420112&tk=40ea43635c9a9388c5f9f97df894a565&s=360154&p=%2Fthreat-detection-report%2Ftechniques%2Fwindows-management-instrumentation%2F&u=969416&v=a00b194af33edfebfa8f3ed60f662b54d25458d3&f=redcanary.com%2Fthreat-detection-report%2Ftechniques%2Fwindows-management-instrumentation&ul=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Ftechniques%2Fwindows-management-instrumentation%2F
Requested by: Host: script.crazyegg.com
URL: https://script.crazyegg.com/pages/versioned/common-scripts/b2625509b46b716ab8df67870a7d87b8.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.18.119.10 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-18-119-10.eu-west-1.compute.amazonaws.com
Software: awselb/2.0 /
Resource Hash: 81df66b8bd2dfc3ec90fda5b51577bd6b027a69b33c413285d6242c46cdc2e1e

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

access-control-allow-origin: *
date: Thu, 31 Aug 2023 18:27:00 GMT
cache-control: no-store
server: awselb/2.0
content-length: 31
content-type: text/plain

GET
H2 200 token Show response
cdn.linkedin.oribi.io/partner/1540753/domain/redcanary.com/ 36 B
375 B 96ms
23ms XHR
application/json 2600:9000:26db:ea00:2:53b2:240:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.linkedin.oribi.io/partner/1540753/domain/redcanary.com/token
Requested by: Host: cdn.bizible.com
URL: https://cdn.bizible.com/scripts/bizible.js?account=redcanary.com
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:26db:ea00:2:53b2:240:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: 7b1eaaaf180a13c29b6dddc3b0ae23333b4397e0f3c065b4c86da2f2530a5f89

Request headers

Accept: *
Referer: https://redcanary.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date: Thu, 31 Aug 2023 18:20:24 GMT
content-encoding: gzip
via: 1.1 bc8243121fd94c5b2714caac07caccde.cloudfront.net (CloudFront)
x-amz-cf-pop: MUC50-P3
age: 396
vary: accept-encoding
x-cache: Hit from cloudfront
content-type: application/json
access-control-allow-origin: *
cache-control: public, max-age=3600
x-amz-cf-id: aVmF25QAuoZlhRTg6ekohbegQep3izxRQjKDGvf6qQ7uBM7S2LR7fQ==

GET
H2

200

collect
px4.ads.linkedin.com/
Redirect Chain

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=1540753&time=1693506420184&url=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Ftechniques%2Fwindows-management-instrumentation%2F
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=1540753&time=1693506420184&url=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Ftechniques%2Fwindows-management-instrumentation%2F&cookiesT...
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D1540753%26time%3D1693506420184%26url%3Dhttps%253A%252F%252Fredcanary.com%252Fthre...
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=1540753&time=1693506420184&url=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Ftechniques%2Fwindows-management-instrumentation%2F&cookiesT...
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=1540753&time=1693506420184&url=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Ftechniques%2Fwindows-management-instrumentation%2F&cookies...

0
265 B

204ms
178ms

Image
application/javascript

13.107.42.14
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=1540753&time=1693506420184&url=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Ftechniques%2Fwindows-management-instrumentation%2F&cookiesTest=true&liSync=true&e_ipv6=AQLWLPwjkRF0ZAAAAYpM2UFXQVGSJxcVxgIKZ3oipFW-qVLEYmrlRXQkewwEW5VIqo8E6Bwp
Requested by: Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
Protocol: H2
Server: 13.107.42.14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://redcanary.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date: Thu, 31 Aug 2023 18:27:00 GMT
x-li-pop: afd-prod-lor1-x
x-msedge-ref: Ref A: ABAF19B6DDA44F658824A9343EEFF1F0 Ref B: FRAEDGE1421 Ref C: 2023-08-31T18:27:01Z
linkedin-action: 1
x-cache: CONFIG_NOCACHE
content-type: application/javascript
x-li-fabric: prod-lor1
x-li-proto: http/2
content-length: 0
x-li-uuid: AAYEPDCqOnQ3eVrnx4Y+5g==

Redirect headers

date: Thu, 31 Aug 2023 18:27:00 GMT
x-li-pop: afd-prod-lor1-x
x-msedge-ref: Ref A: 7F8639EB025D444DA6B8E0A99E17EE5F Ref B: FRAEDGE1213 Ref C: 2023-08-31T18:27:00Z
linkedin-action: 1
x-cache: CONFIG_NOCACHE
x-li-fabric: prod-lor1
location: https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=1540753&time=1693506420184&url=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Ftechniques%2Fwindows-management-instrumentation%2F&cookiesTest=true&liSync=true&e_ipv6=AQLWLPwjkRF0ZAAAAYpM2UFXQVGSJxcVxgIKZ3oipFW-qVLEYmrlRXQkewwEW5VIqo8E6Bwp
x-li-proto: http/2
content-length: 0
x-li-uuid: AAYEPDCnIBEfZi7pE5QoCw==

GET
H2 200 /
www.facebook.com/tr/ 0
185 B 50ms
8ms Image
text/plain 2a03:2880:f177:185:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=1042590016249604&ev=PageView&dl=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Ftechniques%2Fwindows-management-instrumentation%2F&rl=&if=false&ts=1693506420192&sw=1600&sh=1200&v=2.9.125&r=stable&ec=0&o=30&fbp=fb.1.1693506420191.1921232066&it=1693506419947&coo=false&rqm=GET

Requested by

Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f177:185:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://redcanary.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
date: Thu, 31 Aug 2023 18:27:00 GMT
server: proxygen-bolt
content-type: text/plain
access-control-allow-origin
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 0

GET
H/1.1 200
OK messenger Show response
app.qualified.com/w/1/bAEbi2aHVysBKzuy/ Frame F1AA 6 KB
3 KB 387ms
131ms Document
text/html 54.164.227.36
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://app.qualified.com/w/1/bAEbi2aHVysBKzuy/messenger?uuid=ca38125d-5b3d-4d90-ad86-cef90aee33f4

Requested by

Host: js.qualified.com
URL: https://js.qualified.com/qualified.js?token=bAEbi2aHVysBKzuy

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

54.164.227.36 , United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-54-164-227-36.compute-1.amazonaws.com

Software

Resource Hash

e0a9f4c87001cc0f3c478b7ba18689929b5dc8bbfa8c4c8873a62825dd8a112e

Security Headers

Name	Value
Content-Security-Policy
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://redcanary.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Cache-Control: max-age=0, private, must-revalidate
Content-Encoding: gzip
Content-Length: 1829
Content-Security-Policy
Content-Type: text/html; charset=utf-8
Date: Thu, 31 Aug 2023 18:27:00 GMT
Etag: W/"e0a9f4c87001cc0f3c478b7ba1868992"
Link: <https://assets.qualified.com/packs/css/vendors~widget/sandboxed/messenger-94e6eccc.chunk.css>; rel=preload; as=style; nopush,<https://assets.qualified.com/packs/css/widget/sandboxed/messenger-84a66aeb.chunk.css>; rel=preload; as=style; nopush
Referrer-Policy: strict-origin-when-cross-origin
Strict-Transport-Security: max-age=63072000; includeSubDomains
Vary: Accept-Encoding
Via: 1.1 spaces-router (devel)
X-Content-Type-Options: nosniff
X-Download-Options: noopen
X-Permitted-Cross-Domain-Policies: none
X-Request-Id: d5a5ff9c-8667-b7f9-ddd5-cccf55a25884
X-Runtime: 0.023639
X-Xss-Protection: 1; mode=block

GET
H2 200 d9b6b28e3d84db3e4c966a5cf73af402.js Show response
script.crazyegg.com/pages/versioned/trackingpagestate-scripts/ 20 KB
8 KB 19ms
19ms Script
text/javascript 2606:4700::6813:9308
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://script.crazyegg.com/pages/versioned/trackingpagestate-scripts/d9b6b28e3d84db3e4c966a5cf73af402.js
Requested by: Host: script.crazyegg.com
URL: https://script.crazyegg.com/pages/scripts/0096/9416.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6813:9308 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 86f2855487ee0f2a026de07b800d0a191f2d66723011cf5e7bddea4669037b33

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://redcanary.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date: Thu, 31 Aug 2023 18:27:00 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Mon, 28 Aug 2023 18:41:50 GMT
server: cloudflare
age: 18628
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000, s-maxage=31536000
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 7ff75336fc985c4a-FRA
content-length: 8025

GET
BLOB 200
OK bc2cfa57-acc9-45d7-9ed9-3a2d2bc31924
https://redcanary.com/ 241 B
0 Other
text/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://redcanary.com/bc2cfa57-acc9-45d7-9ed9-3a2d2bc31924
Requested by: Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 1cbfcbb81af382110b9d1911b035a8d19b3ca175272555884721d64fb72221c1

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

Content-Length: 241
Content-Type: text/javascript

GET
H2 200 661bb7e9d0e0abee5d7403d3d65553a1.js Show response
script.crazyegg.com/pages/versioned/tracking-scripts/ 98 KB
32 KB 16ms
16ms Script
text/javascript 2606:4700::6813:9308
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://script.crazyegg.com/pages/versioned/tracking-scripts/661bb7e9d0e0abee5d7403d3d65553a1.js
Requested by: Host: script.crazyegg.com
URL: https://script.crazyegg.com/pages/scripts/0096/9416.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6813:9308 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2182476b2f19b36cc23e9bbdb2dd97b84f4d6eddabc117e374b893fe3cd8cdc5

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://redcanary.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date: Thu, 31 Aug 2023 18:27:00 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Mon, 28 Aug 2023 18:41:48 GMT
server: cloudflare
age: 18628
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000, s-maxage=31536000
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 7ff753371cca5c4a-FRA
content-length: 32149

GET
H2 200 messenger-94e6eccc.chunk.css
assets.qualified.com/packs/css/vendors~widget/sandboxed/ Frame F1AA 35 KB
7 KB 25ms
23ms Stylesheet
text/css 2606:4700::6812:1105
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.qualified.com/packs/css/vendors~widget/sandboxed/messenger-94e6eccc.chunk.css
Requested by: Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1105 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: eb3487cae40a55bf31dc6e6191ab0d88ec8c8f85c62bf28ad25ad0a40c16a611

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://app.qualified.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date: Thu, 31 Aug 2023 18:27:00 GMT
x-amz-version-id: AeK_NH5rfGk.Lv2XJ.HRstj6QufMx77b
content-encoding: gzip
cf-cache-status: HIT
x-amz-request-id: Z75Z6HTY5PT93WZB
age: 786
x-amz-server-side-encryption: AES256
x-amz-id-2: uiKWfvkQzRdvuSG2GYowKykvnoDMu9cH6gjgYLlNDIAlueFfCyTiS0q+60FUoSB+mlb2waYVGre7gQK7vHCYpsU4Dic1k4PTGU8/p9ygEEM=
last-modified: Fri, 07 Apr 2023 01:04:50 GMT
server: cloudflare
etag: W/"a788ecf510f83ee517cbaf79306145dd"
vary: Accept-Encoding
content-type: text/css
cache-control: public, max-age=14400
cf-ray: 7ff753390df71c42-FRA
expires: Thu, 31 Aug 2023 22:27:00 GMT

GET
H2 200 messenger-84a66aeb.chunk.css
assets.qualified.com/packs/css/widget/sandboxed/ Frame F1AA 5 KB
1 KB 27ms
25ms Stylesheet
text/css 2606:4700::6812:1105
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.qualified.com/packs/css/widget/sandboxed/messenger-84a66aeb.chunk.css
Requested by: Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1105 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6ec35ab99388f6afab345622a22772619b83b7d63705d98df3c404da782fcabb

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://app.qualified.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date: Thu, 31 Aug 2023 18:27:00 GMT
x-amz-version-id: QqBbrcuqtBTwl_isiJWhWcP6FGILlHz5
content-encoding: gzip
cf-cache-status: HIT
x-amz-request-id: Z75YA82CCCVDZ8CM
age: 5620
x-amz-server-side-encryption: AES256
x-amz-id-2: YiZz2d5dBMI8ZyoOdk0DBjnp3XWT65D1Cugr0KhPbHasWMbaHP2R84ZDS7rdpPQmrNFOWro5yxH3kZBovJDBig==
last-modified: Fri, 07 Apr 2023 01:04:50 GMT
server: cloudflare
etag: W/"22d5f23e695250d3c5a5b1e76a015c5e"
vary: Accept-Encoding
content-type: text/css
cache-control: public, max-age=14400
cf-ray: 7ff753390df61c42-FRA
expires: Thu, 31 Aug 2023 22:27:00 GMT

GET
H2 200 messenger~runtime-f4ac063cf9338bc709b8.js Show response
assets.qualified.com/packs/js/widget/sandboxed/ Frame F1AA 2 KB
1 KB 24ms
22ms Script
application/javascript 2606:4700::6812:1105
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.qualified.com/packs/js/widget/sandboxed/messenger~runtime-f4ac063cf9338bc709b8.js
Requested by: Host: app.qualified.com
URL: https://app.qualified.com/w/1/bAEbi2aHVysBKzuy/messenger?uuid=ca38125d-5b3d-4d90-ad86-cef90aee33f4
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1105 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 977858a0c518ab885051998c26954247bcc67d50bd26c4438d3022aec559c5c8

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://app.qualified.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date: Thu, 31 Aug 2023 18:27:00 GMT
x-amz-version-id: PdfsJsTwxZSJ8tn07cjcyE.BvIAlLvhP
content-encoding: gzip
cf-cache-status: HIT
x-amz-request-id: 0B50Y5RGCGY1G2V2
age: 4908
x-amz-server-side-encryption: AES256
x-amz-id-2: a1yLFbhqKycVdSJiT7/V7jQFYQUE0wzvNswiIBsa1Ygnuv6MAln1ZPzB6lyqv635qc0GoxjPHNA=
last-modified: Thu, 31 Aug 2023 01:01:43 GMT
server: cloudflare
etag: W/"211c830511b7e3f0f42259032f070166"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=14400
cf-ray: 7ff753393e4c1c42-FRA
expires: Thu, 31 Aug 2023 22:27:00 GMT

GET
H2 200 messenger-369223c5490f8cdcf187.chunk.js Show response
assets.qualified.com/packs/js/widget-sandboxed-chunks/vendors~widget/sandboxed/ Frame F1AA 1 MB
362 KB 27ms
25ms Script
application/javascript 2606:4700::6812:1105
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.qualified.com/packs/js/widget-sandboxed-chunks/vendors~widget/sandboxed/messenger-369223c5490f8cdcf187.chunk.js
Requested by: Host: app.qualified.com
URL: https://app.qualified.com/w/1/bAEbi2aHVysBKzuy/messenger?uuid=ca38125d-5b3d-4d90-ad86-cef90aee33f4
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1105 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 15e5827ebf3a8660ccf687d7f208b247f355421bfeeaa572f26913a453acf45e

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://app.qualified.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date: Thu, 31 Aug 2023 18:27:00 GMT
x-amz-version-id: oK9jovqhn.gYLI4zbnGqtErXgbUHzdXb
content-encoding: gzip
cf-cache-status: HIT
x-amz-request-id: 8EF4VPS7HNBAP6G3
age: 5447
x-amz-server-side-encryption: AES256
x-amz-id-2: i9ABf0AEZLTdcHdctc5UMEXNiCOHLAR5677xONEUGN/bTAUF+uHsTeS7xprUJ2SSoD54nihEEGVW3VMU2UqbkQ==
last-modified: Mon, 28 Aug 2023 20:31:37 GMT
server: cloudflare
etag: W/"07365b735e31be744e837d71d12cb7ad"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=14400
cf-ray: 7ff753393e4d1c42-FRA
expires: Thu, 31 Aug 2023 22:27:00 GMT

GET
H2 200 messenger-4dcf43b9b54c3f5764c6.chunk.js Show response
assets.qualified.com/packs/js/widget-sandboxed-chunks/widget/sandboxed/ Frame F1AA 622 KB
162 KB 26ms
24ms Script
application/javascript 2606:4700::6812:1105
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.qualified.com/packs/js/widget-sandboxed-chunks/widget/sandboxed/messenger-4dcf43b9b54c3f5764c6.chunk.js
Requested by: Host: app.qualified.com
URL: https://app.qualified.com/w/1/bAEbi2aHVysBKzuy/messenger?uuid=ca38125d-5b3d-4d90-ad86-cef90aee33f4
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1105 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 263e16f176fddc5af313fa27a6173538c61b5f28db6a4360e9ae9f81504907b1

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://app.qualified.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date: Thu, 31 Aug 2023 18:27:00 GMT
x-amz-version-id: TbFSaWaZouDNzEPRloXQJWsSi3g5kbCP
content-encoding: gzip
cf-cache-status: HIT
x-amz-request-id: 0B52CTDSE5TQR3F8
age: 4908
x-amz-server-side-encryption: AES256
x-amz-id-2: 0BiDmr2+hloZ0JpQ9jUv8nVpGujciDsd7mLww9E0JIn6ZH5XyLFBLwfyWZoLg5E3MTKvvQzXzBA=
last-modified: Thu, 31 Aug 2023 01:01:44 GMT
server: cloudflare
etag: W/"94ddddc8eac8fb41be3179fa9a2943df"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=14400
cf-ray: 7ff753393e4f1c42-FRA
expires: Thu, 31 Aug 2023 22:27:00 GMT

GET
H2 200 Inter-Regular-c8ba52b05a9ef10f47584d08ece2ec5c.woff2
assets.qualified.com/packs/media/fonts/inter/ Frame F1AA 97 KB
97 KB 65ms
40ms Font
font/woff2 2606:4700::6812:1005
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.qualified.com/packs/media/fonts/inter/Inter-Regular-c8ba52b05a9ef10f47584d08ece2ec5c.woff2
Requested by: Host: app.qualified.com
URL: https://app.qualified.com/w/1/bAEbi2aHVysBKzuy/messenger?uuid=ca38125d-5b3d-4d90-ad86-cef90aee33f4
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1005 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d612f1212b452af07f1a5defb2b672e76a91f7139e7499fa48bb9b2b985c22d6

Request headers

Referer: https://app.qualified.com/
Origin: https://app.qualified.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date: Thu, 31 Aug 2023 18:27:00 GMT
x-amz-version-id: Ts0p7fbKsZIFu_VEk6HOvm9iYpTRKuos
cf-cache-status: HIT
x-amz-request-id: 41Z3KJK24K5VH2VW
age: 22956209
content-length: 98868
x-amz-id-2: Ta7QduaUx53oJBC61pF3hnNKwZ0PRiLBlPs9GI8HcAGX1x9nffwkEv3HAik928cdZO2VmzvSgxE=
last-modified: Thu, 08 Dec 2022 23:17:25 GMT
server: cloudflare
etag: "dc131113894217b5031000575d9de002"
access-control-max-age: 3600
access-control-allow-methods: GET
content-type: font/woff2
access-control-allow-origin: *
vary: Origin, Access-Control-Request-Headers, Access-Control-Request-Method, Accept-Encoding
cache-control: public, max-age=31557600
accept-ranges: bytes
cf-ray: 7ff7533958ff922f-FRA
expires: Sat, 31 Aug 2024 00:27:00 GMT

GET
H2 200 Inter-SemiBold-b5f0f109bc88052d4000c58ca615671d.woff2
assets.qualified.com/packs/media/fonts/inter/ Frame F1AA 103 KB
104 KB 43ms
19ms Font
font/woff2 2606:4700::6812:1005
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.qualified.com/packs/media/fonts/inter/Inter-SemiBold-b5f0f109bc88052d4000c58ca615671d.woff2
Requested by: Host: app.qualified.com
URL: https://app.qualified.com/w/1/bAEbi2aHVysBKzuy/messenger?uuid=ca38125d-5b3d-4d90-ad86-cef90aee33f4
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1005 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 152261291c938aa5aad6a56d52b47ffcb893d1c0387e76d7f270a7382ff786d5

Request headers

Referer: https://app.qualified.com/
Origin: https://app.qualified.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date: Thu, 31 Aug 2023 18:27:00 GMT
x-amz-version-id: mi4mtB4aFvR25WPQCmnfUnVk6AWhr_W6
cf-cache-status: HIT
x-amz-request-id: 2HMTVDXWHRZ097M7
age: 10846347
x-amz-server-side-encryption: AES256
content-length: 105804
x-amz-id-2: YD0z6E8yfMvUoX00yyhaPzBel56CXdfQkpFrBSUa2Gb4Y85wQsKNp3wT67eM7XPXdMbk10RgCP0=
last-modified: Fri, 28 Apr 2023 01:11:03 GMT
server: cloudflare
etag: "007ad31a53f4ab3f58ee74f2308482ce"
access-control-max-age: 3600
access-control-allow-methods: GET
content-type: font/woff2
access-control-allow-origin: *
vary: Origin, Access-Control-Request-Headers, Access-Control-Request-Method, Accept-Encoding
cache-control: public, max-age=31557600
accept-ranges: bytes
cf-ray: 7ff753395903922f-FRA
expires: Sat, 31 Aug 2024 00:27:00 GMT

POST
H2 200 / Show response
www.facebook.com/tr/ Frame 88E8 0
47 B 11ms
7ms Document
text/plain 2a03:2880:f177:185:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/tr/

Requested by

Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f177:185:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Content-Type: application/x-www-form-urlencoded
Origin: https://redcanary.com
Referer: https://redcanary.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-origin: https://redcanary.com
alt-svc: h3=":443"; ma=86400
content-length: 0
content-type: text/plain
cross-origin-resource-policy: cross-origin
date: Thu, 31 Aug 2023 18:27:00 GMT
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains

POST
H2 200 / Show response
sentry.io/api/1332833/envelope/ Frame F1AA 2 B
324 B 153ms
116ms Fetch
application/json 35.186.247.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://sentry.io/api/1332833/envelope/?sentry_key=b5158ee3382d49b28a864fb2b91bcaaf&sentry_version=7&sentry_client=sentry.javascript.browser%2F7.11.1

Requested by

Host: assets.qualified.com
URL: https://assets.qualified.com/packs/js/widget-sandboxed-chunks/vendors~widget/sandboxed/messenger-369223c5490f8cdcf187.chunk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

35.186.247.156 Kansas City, United States, ASN15169 (GOOGLE, US),

Reverse DNS

156.247.186.35.bc.googleusercontent.com

Software

nginx /

Resource Hash

44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Referer: https://app.qualified.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

date: Thu, 31 Aug 2023 18:27:00 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
via: 1.1 google
server: nginx
vary: origin,access-control-request-method,access-control-request-headers
content-type: application/json
access-control-allow-origin: *
access-control-expose-headers: x-sentry-error,x-sentry-rate-limits,retry-after
x-envoy-upstream-service-time: 0
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2

GET
H2 200 getuidj Show response
secure.adnxs.com/ 28 B
705 B 14ms
13ms XHR
application/json 185.89.210.244
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.adnxs.com/getuidj

Requested by

Host: cdn.bizible.com
URL: https://cdn.bizible.com/scripts/bizible.js?account=redcanary.com

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.89.210.244 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

946.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net

Software

nginx/1.21.3 /

Resource Hash

d8f62d6348ff5df7ab68876d4b88d84f53880c356763cf1792b65b5318800560

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://redcanary.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 31 Aug 2023 18:27:01 GMT
an-x-request-uuid: 4feb2a0b-da8f-4e22-9d99-fa38a09541b6
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: application/json; charset=utf-8
access-control-allow-origin: https://redcanary.com
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
x-proxy-origin: 185.213.155.137; 185.213.155.137; 946.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
content-length: 28
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 / Show response
c.6sc.co/ 7 B
191 B 8ms
7ms XHR
text/html 23.38.98.237
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://c.6sc.co/
Requested by: Host: cdn.bizible.com
URL: https://cdn.bizible.com/scripts/bizible.js?account=redcanary.com
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.38.98.237 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a23-38-98-237.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: fe04a9dc88d3f3be8d4f6bc63a9a80f45a4c6d8460e7551dab849457c091920a

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://redcanary.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date: Thu, 31 Aug 2023 18:27:01 GMT
access-control-max-age: 86400
access-control-allow-methods: GET,POST
content-type: text/html
access-control-allow-origin: https://redcanary.com
access-control-allow-credentials: true
access-control-allow-headers: *
content-length: 7

GET
H2 200 optimize.js Show response
www.google-analytics.com/gtm/ 124 KB
48 KB 375ms
54ms Script
application/javascript 2a00:1450:4001:82a::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/gtm/optimize.js?id=GTM-KJTKFT3

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-PXWC8JW

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

f538eff9a0c9c118e0fe1b1a654f57f85a2a48179f86451514dbe3c3ce514c44

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://redcanary.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date: Thu, 31 Aug 2023 18:27:01 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 49085
x-xss-protection: 0
last-modified: Thu, 31 Aug 2023 18:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Thu, 31 Aug 2023 18:27:01 GMT

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
484 B 202ms
202ms Image
image/gif 23.38.98.237
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=565ffb1efc5e75f417d1fe1c2134f835&svisitor=null&session=4cc12479-62d8-43b3-87f9-0bb35ec7a0f6&event=a_pageload&q=%7B%22pageLoadTime%22%3A%22Thu%2C%2031%20Aug%202023%2018%3A26%3A58%20GMT%22%7D&isIframe=false&m=%7B%22description%22%3A%22Windows%20Management%20Instrumentation%20(WMI)%20is%20a%20technique%20leveraged%20for%20lateral%20movement%20and%20discovery%20by%20adversaries.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Windows%20Management%20Instrumentation%20-%20Red%20Canary%20Threat%20Report%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Ftechniques%2Fwindows-management-instrumentation%2F&pageViewId=70eaea52-f978-4ea1-8dce-f94a85ef64ac

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.38.98.237 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a23-38-98-237.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://redcanary.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date: Thu, 31 Aug 2023 18:27:01 GMT
x-content-type-options: nosniff
content-length: 43
pragma: no-cache
last-modified: Sat, 18 Feb 2023 00:49:36 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "63f020a0-2b"
access-control-max-age: 86400
access-control-allow-methods: GET,POST
content-type: image/gif
access-control-allow-origin
cache-control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: *
expires: Wed, 19 Apr 2000 11:43:00 GMT

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 52 KB
21 KB 39ms
38ms Script
text/javascript 2a00:1450:4001:82a::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-PXWC8JW

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://redcanary.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
date: Thu, 31 Aug 2023 17:49:43 GMT
last-modified: Mon, 12 Jun 2023 18:23:07 GMT
server: Golfe2
age: 2238
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 20994
expires: Thu, 31 Aug 2023 19:49:43 GMT

POST
H2 200 collect Show response
www.google-analytics.com/j/ 4 B
180 B 46ms
46ms XHR
text/plain 2a00:1450:4001:82a::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j101&a=582935326&t=pageview&_s=1&dl=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Ftechniques%2Fwindows-management-instrumentation%2F&ul=en-us&de=UTF-8&dt=Windows%20Management%20Instrumentation%20-%20Red%20Canary%20Threat%20Report&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YADAAEABQAAAACAAI~&jid=139195852&gjid=1058347093&cid=1864958019.1693506419&tid=UA-52702906-1&_gid=423481891.1693506422&_r=1&_slc=1&gtm=45He38u0n81PXWC8JW&cd18=null&z=1608654017

Requested by

Host: cdn.bizible.com
URL: https://cdn.bizible.com/scripts/bizible.js?account=redcanary.com

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

aec60bc104db041b1512185839f18f52986df7e569e5445f740dd60f763fbca8

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://redcanary.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Thu, 31 Aug 2023 18:27:01 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://redcanary.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 collect Show response
stats.g.doubleclick.net/j/ 4 B
151 B 19ms
18ms XHR
text/plain 2a00:1450:400c:c04::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j101&tid=UA-52702906-1&cid=1864958019.1693506419&jid=139195852&gjid=1058347093&_gid=423481891.1693506422&_u=YADAAEAAQAAAACAAI~&z=1911407245

Requested by

Host: cdn.bizible.com
URL: https://cdn.bizible.com/scripts/bizible.js?account=redcanary.com

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400c:c04::9b Brussels, Belgium, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://redcanary.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
date: Thu, 31 Aug 2023 18:27:01 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://redcanary.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.com/ads/ 42 B
107 B 79ms
78ms Image
image/gif 2a00:1450:4001:829::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j101&tid=UA-52702906-1&cid=1864958019.1693506419&jid=139195852&_u=YADAAEAAQAAAACAAI~&z=1086936092

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://redcanary.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 31 Aug 2023 18:27:01 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ga-audiences
www.google.de/ads/ 42 B
63 B 78ms
78ms Image
image/gif 2a00:1450:4001:82f::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j101&tid=UA-52702906-1&cid=1864958019.1693506419&jid=139195852&_u=YADAAEAAQAAAACAAI~&z=1086936092

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://redcanary.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 31 Aug 2023 18:27:01 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
485 B 201ms
201ms Image
image/gif 23.38.98.237
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=565ffb1efc5e75f417d1fe1c2134f835&svisitor=null&session=4cc12479-62d8-43b3-87f9-0bb35ec7a0f6&event=active_time_track&q=%7B%22currentTime%22%3A%22Thu%2C%2031%20Aug%202023%2018%3A27%3A02%20GMT%22%2C%22lastTrackTime%22%3A%22Thu%2C%2031%20Aug%202023%2018%3A26%3A58%20GMT%22%2C%22timeSpent%22%3A%223612%22%2C%22totalTimeSpent%22%3A%223612%22%7D&isIframe=false&m=%7B%22description%22%3A%22Windows%20Management%20Instrumentation%20(WMI)%20is%20a%20technique%20leveraged%20for%20lateral%20movement%20and%20discovery%20by%20adversaries.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Windows%20Management%20Instrumentation%20-%20Red%20Canary%20Threat%20Report%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Ftechniques%2Fwindows-management-instrumentation%2F&pageViewId=70eaea52-f978-4ea1-8dce-f94a85ef64ac&an_uid=988735524049751075

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.38.98.237 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a23-38-98-237.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://redcanary.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date: Thu, 31 Aug 2023 18:27:02 GMT
x-content-type-options: nosniff
content-length: 43
pragma: no-cache
last-modified: Sat, 18 Feb 2023 01:45:17 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "63f02dad-2b"
access-control-max-age: 86400
access-control-allow-methods: GET,POST
content-type: image/gif
access-control-allow-origin
cache-control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: *
expires: Wed, 19 Apr 2000 11:43:00 GMT

GET
H/1.1 200
OK d23c0c4e194430380ef64982f7fd6ecf318cd5881017bc61dec0ef8955cc0079.png
qualified-production.s3.us-east-1.amazonaws.com/uploads/ Frame F1AA 13 KB
13 KB 350ms
126ms Image
image/png 52.216.61.74
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://qualified-production.s3.us-east-1.amazonaws.com/uploads/d23c0c4e194430380ef64982f7fd6ecf318cd5881017bc61dec0ef8955cc0079.png
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.216.61.74 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-us-east-1-r-w.amazonaws.com
Software: AmazonS3 /
Resource Hash: 9a586f0b3e8add35ad17a2eec2cee97cbe175f48d7c47e34492dd973aa0f8381

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://app.qualified.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

Date: Thu, 31 Aug 2023 18:27:03 GMT
Last-Modified: Thu, 20 Oct 2022 23:47:27 GMT
Server: AmazonS3
x-amz-request-id: GNW3XX72FJ9P8N4K
ETag: "fd481ec600c1b3fad6f9e29aa732a946"
x-amz-server-side-encryption: AES256
Content-Type: image/png
Cache-Control: Cache-Control: public, max-age=31536000
Accept-Ranges: bytes
Content-Length: 12932
x-amz-id-2: LDqKLgaUYao4SVFF/VX7AzSDW8od0eXs8N4woLseB4XmWJ5LgOdCxFbBonidPUekrUXoNQm0XsM=

GET
H/1.1 200
OK b34302d7d25df402909dab75f43c994eaa9697d42e982abeee77e1d6cb8e2697.png
qualified-production.s3.us-east-1.amazonaws.com/uploads/ Frame F1AA 13 KB
13 KB 118ms
118ms Image
image/png 52.216.61.74
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://qualified-production.s3.us-east-1.amazonaws.com/uploads/b34302d7d25df402909dab75f43c994eaa9697d42e982abeee77e1d6cb8e2697.png
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.216.61.74 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-us-east-1-r-w.amazonaws.com
Software: AmazonS3 /
Resource Hash: 00bbc66153e493c73e6ee4448a25fac555d74e1fd957f6f804754ff27bb9884f

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://app.qualified.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

Date: Thu, 31 Aug 2023 18:27:03 GMT
Last-Modified: Thu, 20 Oct 2022 23:48:08 GMT
Server: AmazonS3
x-amz-request-id: GNWCCP9RFGS6KG85
ETag: "7797b96a7f999ac42de528bede3329af"
x-amz-server-side-encryption: AES256
Content-Type: image/png
Cache-Control: Cache-Control: public, max-age=31536000
Accept-Ranges: bytes
Content-Length: 13099
x-amz-id-2: H3MILwyf1xpXSSDHd/WZnw7AiwE1dZH3+su5fvdUx17O/RnJTm7ZnO/TIBXf9V+uNVcttzz+Tr8=

OPTIONS
H3 200 events
gew4-spclient.spotify.com/gabo-receiver-service/public/v3/ Frame 0
0 20ms
19ms Preflight 2600:1901:1:81::
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://gew4-spclient.spotify.com/gabo-receiver-service/public/v3/events
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2600:1901:1:81:: , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: envoy /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://open.spotify.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Accept,Authorization,Origin,Content-Type,Spotify-App-Version,App-Platform,X-Spotify-Connection-Id,X-Client-Id,X-Spotify-Quicksilver-Uri,client-token,content-access-token,x-cloud-trace-context
access-control-allow-methods: DELETE,GET,PATCH,POST,PUT,OPTIONS
access-control-allow-origin: https://open.spotify.com
access-control-max-age: 604800
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
date: Thu, 31 Aug 2023 18:27:02 GMT
server: envoy
vary: Accept-Encoding
via: HTTP/2 edgeproxy, 1.1 google

POST
H3 200 events Show response
gew4-spclient.spotify.com/gabo-receiver-service/public/v3/ Frame 7C54 13 B
58 B 49ms
47ms XHR
application/json 2600:1901:1:81::
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://gew4-spclient.spotify.com/gabo-receiver-service/public/v3/events

Requested by

Host: embed-cdn.spotifycdn.com
URL: https://embed-cdn.spotifycdn.com/_next/static/chunks/pages/_app-fe44d090509824d5.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2600:1901:1:81:: , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

envoy /

Resource Hash

debf84af8d66827e1cbc6791aa686504e3116d8cb20f4697fef23108333061f8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

Referer: https://open.spotify.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36
content-type: application/json

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
date: Thu, 31 Aug 2023 18:27:02 GMT
via: HTTP/2 edgeproxy, 1.1 google
server: envoy
content-type: application/json
access-control-allow-origin: https://open.spotify.com
cache-control: private, max-age=0
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 39

POST
H3 200 events Show response
gew4-spclient.spotify.com/gabo-receiver-service/public/v3/ Frame 7C54 13 B
58 B 134ms
134ms XHR
application/json 2600:1901:1:81::
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://gew4-spclient.spotify.com/gabo-receiver-service/public/v3/events

Requested by

Host: embed-cdn.spotifycdn.com
URL: https://embed-cdn.spotifycdn.com/_next/static/chunks/pages/_app-fe44d090509824d5.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2600:1901:1:81:: , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

envoy /

Resource Hash

debf84af8d66827e1cbc6791aa686504e3116d8cb20f4697fef23108333061f8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

Referer: https://open.spotify.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36
content-type: application/json

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
date: Thu, 31 Aug 2023 18:27:03 GMT
via: HTTP/2 edgeproxy, 1.1 google
server: envoy
content-type: application/json
access-control-allow-origin: https://open.spotify.com
cache-control: private, max-age=0
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 39

OPTIONS
H3 200 events
gew4-spclient.spotify.com/gabo-receiver-service/public/v3/ Frame 0
0 21ms
20ms Preflight 2600:1901:1:81::
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://gew4-spclient.spotify.com/gabo-receiver-service/public/v3/events
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2600:1901:1:81:: , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: envoy /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://open.spotify.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Accept,Authorization,Origin,Content-Type,Spotify-App-Version,App-Platform,X-Spotify-Connection-Id,X-Client-Id,X-Spotify-Quicksilver-Uri,client-token,content-access-token,x-cloud-trace-context
access-control-allow-methods: DELETE,GET,PATCH,POST,PUT,OPTIONS
access-control-allow-origin: https://open.spotify.com
access-control-max-age: 604800
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
date: Thu, 31 Aug 2023 18:27:02 GMT
server: envoy
vary: Accept-Encoding
via: HTTP/2 edgeproxy, 1.1 google

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
484 B 202ms
201ms Image
image/gif 23.38.98.237
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=565ffb1efc5e75f417d1fe1c2134f835&svisitor=null&session=4cc12479-62d8-43b3-87f9-0bb35ec7a0f6&event=active_time_track&q=%7B%22currentTime%22%3A%22Thu%2C%2031%20Aug%202023%2018%3A27%3A03%20GMT%22%2C%22lastTrackTime%22%3A%22Thu%2C%2031%20Aug%202023%2018%3A27%3A02%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%224613%22%7D&isIframe=false&m=%7B%22description%22%3A%22Windows%20Management%20Instrumentation%20(WMI)%20is%20a%20technique%20leveraged%20for%20lateral%20movement%20and%20discovery%20by%20adversaries.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Windows%20Management%20Instrumentation%20-%20Red%20Canary%20Threat%20Report%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Ftechniques%2Fwindows-management-instrumentation%2F&pageViewId=70eaea52-f978-4ea1-8dce-f94a85ef64ac&an_uid=988735524049751075

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.38.98.237 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a23-38-98-237.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://redcanary.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date: Thu, 31 Aug 2023 18:27:03 GMT
x-content-type-options: nosniff
content-length: 43
pragma: no-cache
last-modified: Tue, 05 Oct 2021 22:17:52 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "615ccf10-2b"
access-control-max-age: 86400
access-control-allow-methods: GET,POST
content-type: image/gif
access-control-allow-origin
cache-control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: *
expires: Wed, 19 Apr 2000 11:43:00 GMT

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
485 B 204ms
203ms Image
image/gif 23.38.98.237
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=565ffb1efc5e75f417d1fe1c2134f835&svisitor=null&session=4cc12479-62d8-43b3-87f9-0bb35ec7a0f6&event=active_time_track&q=%7B%22currentTime%22%3A%22Thu%2C%2031%20Aug%202023%2018%3A27%3A04%20GMT%22%2C%22lastTrackTime%22%3A%22Thu%2C%2031%20Aug%202023%2018%3A27%3A03%20GMT%22%2C%22timeSpent%22%3A%221000%22%2C%22totalTimeSpent%22%3A%225613%22%7D&isIframe=false&m=%7B%22description%22%3A%22Windows%20Management%20Instrumentation%20(WMI)%20is%20a%20technique%20leveraged%20for%20lateral%20movement%20and%20discovery%20by%20adversaries.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Windows%20Management%20Instrumentation%20-%20Red%20Canary%20Threat%20Report%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Ftechniques%2Fwindows-management-instrumentation%2F&pageViewId=70eaea52-f978-4ea1-8dce-f94a85ef64ac&an_uid=988735524049751075

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.38.98.237 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a23-38-98-237.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://redcanary.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date: Thu, 31 Aug 2023 18:27:04 GMT
x-content-type-options: nosniff
content-length: 43
pragma: no-cache
last-modified: Sat, 18 Feb 2023 02:04:22 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "63f03226-2b"
access-control-max-age: 86400
access-control-allow-methods: GET,POST
content-type: image/gif
access-control-allow-origin
cache-control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: *
expires: Wed, 19 Apr 2000 11:43:00 GMT

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
484 B 201ms
201ms Image
image/gif 23.38.98.237
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=565ffb1efc5e75f417d1fe1c2134f835&svisitor=null&session=4cc12479-62d8-43b3-87f9-0bb35ec7a0f6&event=active_time_track&q=%7B%22currentTime%22%3A%22Thu%2C%2031%20Aug%202023%2018%3A27%3A05%20GMT%22%2C%22lastTrackTime%22%3A%22Thu%2C%2031%20Aug%202023%2018%3A27%3A04%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%226614%22%7D&isIframe=false&m=%7B%22description%22%3A%22Windows%20Management%20Instrumentation%20(WMI)%20is%20a%20technique%20leveraged%20for%20lateral%20movement%20and%20discovery%20by%20adversaries.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Windows%20Management%20Instrumentation%20-%20Red%20Canary%20Threat%20Report%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Ftechniques%2Fwindows-management-instrumentation%2F&pageViewId=70eaea52-f978-4ea1-8dce-f94a85ef64ac&an_uid=988735524049751075

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.38.98.237 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a23-38-98-237.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://redcanary.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date: Thu, 31 Aug 2023 18:27:05 GMT
x-content-type-options: nosniff
content-length: 43
pragma: no-cache
last-modified: Sat, 18 Feb 2023 00:49:36 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "63f020a0-2b"
access-control-max-age: 86400
access-control-allow-methods: GET,POST
content-type: image/gif
access-control-allow-origin
cache-control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: *
expires: Wed, 19 Apr 2000 11:43:00 GMT

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
485 B 203ms
202ms Image
image/gif 23.38.98.237
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=565ffb1efc5e75f417d1fe1c2134f835&svisitor=null&session=4cc12479-62d8-43b3-87f9-0bb35ec7a0f6&event=active_time_track&q=%7B%22currentTime%22%3A%22Thu%2C%2031%20Aug%202023%2018%3A27%3A06%20GMT%22%2C%22lastTrackTime%22%3A%22Thu%2C%2031%20Aug%202023%2018%3A27%3A05%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%227615%22%7D&isIframe=false&m=%7B%22description%22%3A%22Windows%20Management%20Instrumentation%20(WMI)%20is%20a%20technique%20leveraged%20for%20lateral%20movement%20and%20discovery%20by%20adversaries.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Windows%20Management%20Instrumentation%20-%20Red%20Canary%20Threat%20Report%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Ftechniques%2Fwindows-management-instrumentation%2F&pageViewId=70eaea52-f978-4ea1-8dce-f94a85ef64ac&an_uid=988735524049751075

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.38.98.237 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a23-38-98-237.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://redcanary.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date: Thu, 31 Aug 2023 18:27:06 GMT
x-content-type-options: nosniff
content-length: 43
pragma: no-cache
last-modified: Sat, 05 Jun 2021 07:56:05 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "60bb2e15-2b"
access-control-max-age: 86400
access-control-allow-methods: GET,POST
content-type: image/gif
access-control-allow-origin
cache-control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: *
expires: Wed, 19 Apr 2000 11:43:00 GMT

Verdicts & Comments Add Verdict or Comment

98 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

45 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.resource.redcanary.com/	1970-01-20 14:25:08	Name: __cf_bm Value: pVri5iG19evssX8hYcoWfRCTyK32uo00l1ulAiG.cns-1693506418-0-AQeEuUYhFipiX89DKLz11T5U27qwm36C11skc/u6YMtQFqWqMjTa7r3ANt1pu2NRoEbXC/Czorj7hgQeFQPPIzI=
.redcanary.com/	1970-01-20 23:10:42	Name: _biz_uid Value: 3803cdb6e2304186cb565470781410a2
.redcanary.com/	1970-01-20 14:25:08	Name: _biz_sid Value: 4fab34
.redcanary.com/	1970-01-21 00:01:06	Name: _mkto_trk Value: id:003-YRU-314&token:_mch-redcanary.com-1693506418798-52230
.spotify.com/	1970-01-21 00:01:06	Name: sp_t Value: 2fd0c67275dea89f5f75d2f4946c4150
.spotify.com/	1970-01-21 00:01:06	Name: sp_landing Value: https%3A%2F%2Fredcanary.com%2F%3Fsp_cid%3D2fd0c67275dea89f5f75d2f4946c4150%26device%3Ddesktop
.redcanary.com/	1970-01-21 00:01:06	Name: _ga_T3K4MTNQJN Value: GS1.1.1693506419.1.0.1693506419.60.0.0
.redcanary.com/	1970-01-20 16:34:42	Name: _gcl_au Value: 1.1.406409531.1693506419
.redcanary.com/	1970-01-20 23:10:42	Name: _biz_nA Value: 2
.bizible.com/	1970-01-20 23:10:42	Name: _BUID Value: 3803cdb6e2304186cb565470781410a2
.bizibly.com/	1970-01-20 23:10:42	Name: _BUID Value: d9147bf5579b2a7e0341ab931e4822a6
.doubleclick.net/	1970-01-20 14:25:07	Name: test_cookie Value: CheckForPermission
redcanary.com/	1970-01-20 23:10:42	Name: cookielawinfo-checkbox-necessary Value: yes
redcanary.com/	1970-01-20 23:10:42	Name: cookielawinfo-checkbox-non-necessary Value: yes
.redcanary.com/	1969-12-31 23:59:59	Name: cebs Value: 1
.redcanary.com/	1970-01-20 23:10:42	Name: _ce.s Value: v~a00b194af33edfebfa8f3ed60f662b54d25458d3~lcw~1693506419568~vpv~0~lcw~1693506419569
.adnxs.com/	1970-01-20 16:34:42	Name: uuid2 Value: 988735524049751075
.redcanary.com/	1970-01-20 16:34:42	Name: _rdt_uuid Value: 1693506419930.4a0fc5c0-09fc-46d5-827c-715b76128383
.redcanary.com/	1970-01-20 14:26:32	Name: _uetsid Value: f9756280482b11eebaeee16a63b15672
.redcanary.com/	1970-01-20 23:46:42	Name: _uetvid Value: f97581f0482b11eeb28609ae2ec488b7
.redcanary.com/	1970-01-20 23:10:42	Name: _biz_pendingA Value: %5B%5D
.redcanary.com/	1970-01-20 14:26:32	Name: _ce.clock_event Value: 1
.redcanary.com/	1970-01-20 23:10:42	Name: _biz_flagsA Value: %7B%22Version%22%3A1%2C%22Mkto%22%3A%221%22%2C%22ViewThrough%22%3A%221%22%2C%22XDomain%22%3A%221%22%7D
.twitter.com/	1970-01-21 00:01:06	Name: personalization_id Value: "v1_G5NMhht9rpauUyq++mAwnA=="
.bing.com/	1970-01-20 23:46:42	Name: MUID Value: 356573C9AA5E6B113D0660B7AB5E6A49
.t.co/	1970-01-21 00:01:06	Name: muc_ads Value: d3cf3afb-0d36-4d1d-97d6-c14a77c77d85
.redcanary.com/	1970-01-20 16:34:42	Name: _fbp Value: fb.1.1693506420191.1921232066
.redcanary.com/	1970-01-20 14:26:32	Name: _ce.clock_data Value: 72%2C185.213.155.137%2C1%2C0f286e8f7fa153358c622af13d09b529
.redcanary.com/	1969-12-31 23:59:59	Name: cebsp_ Value: 1
redcanary.com/	1970-01-20 14:26:32	Name: ln_or Value: eyIxNTQwNzUzIjoiZCJ9
.linkedin.com/	1970-01-20 16:34:42	Name: li_sugr Value: 06ce427f-d104-49b1-8075-4c34b3c03e9e
.linkedin.com/	1970-01-20 23:10:42	Name: bcookie Value: "v=2&cc1f8e87-36d5-475a-8a7f-e6fda330fa7f"
.linkedin.com/	1970-01-20 14:26:32	Name: lidc Value: "b=OGST01:s=O:r=O:a=O:p=O:g=3035:u=1:x=1:i=1693506420:t=1693592820:v=2:sig=AQHKnFPkF9SdqTmd4y0wO3W-jewWwj1E"
.linkedin.com/	1970-01-20 15:08:18	Name: UserMatchHistory Value: AQJw3mV8s5GkJAAAAYpM2T8Vc1qcaqoBbIwIt14LH3JOOL0W8TT2TwbHYtt77FyCuNP-TomSY2Z8Ow
.linkedin.com/	1970-01-20 15:08:18	Name: AnalyticsSyncHistory Value: AQKImzmyldP1OgAAAYpM2T8V8kIkrDQmSjBptDOImXRBGNszr6HfQjarbES8LJqMKgJlMP_fqHsUBlEYZUEH8w
.www.linkedin.com/	1970-01-20 23:10:42	Name: bscookie Value: "v=1&2023083118270005b84696-204b-4ed4-81ea-d65701b855eeAQFtAsc1eNd_mG21zNIOVXWpkST2IUIl"
.linkedin.com/	1970-01-20 18:44:18	Name: li_gc Value: MTswOzE2OTM1MDY0MjA7MjswMjF2lTOH0jkJxHCBYsLRK1cEJarSRWQi3SmVazkQX16FwA==
redcanary.com/	1970-01-21 00:01:06	Name: _gd_visitor Value: b9462d63-9d35-4c5c-816e-187a0a6207cd
redcanary.com/	1970-01-20 14:25:20	Name: _gd_session Value: 4cc12479-62d8-43b3-87f9-0bb35ec7a0f6
redcanary.com/	1970-01-20 14:35:11	Name: _an_uid Value: 988735524049751075
.6sc.co/	1970-01-21 00:01:06	Name: 6suuid Value: 2dd53e17b89e010075dbf06408030000f6390000
.redcanary.com/	1970-01-21 00:01:06	Name: _ga Value: GA1.2.1864958019.1693506419
.redcanary.com/	1970-01-20 14:26:32	Name: _gid Value: GA1.2.423481891.1693506422
.redcanary.com/	1970-01-20 14:25:06	Name: _gat_UA-52702906-1 Value: 1
.redcanary.com/	1970-01-21 00:01:06	Name: __q_state_bAEbi2aHVysBKzuy Value: eyJ1dWlkIjoiY2EzODEyNWQtNWIzZC00ZDkwLWFkODYtY2VmOTBhZWUzM2Y0IiwiY29va2llRG9tYWluIjoicmVkY2FuYXJ5LmNvbSIsIm1lc3NlbmdlckV4cGFuZGVkIjpmYWxzZSwicHJvbXB0RGlzbWlzc2VkIjpmYWxzZSwiY29udmVyc2F0aW9uSWQiOiIxMjE0NDAxOTIzOTUxNTc1MjQ3In0=

3 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
other	warning	URL: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/(Line 306) Message: Allow attribute will take precedence over 'allowfullscreen'.
javascript	warning	URL: https://embed-cdn.spotifycdn.com/_next/static/chunks/662.dc13e1cf69424def.js Message: It is recommended that a robustness level be specified. Not specifying the robustness level could result in unexpected behavior.
javascript	verbose	URL: https://assets.qualified.com/packs/js/widget-sandboxed-chunks/vendors~widget/sandboxed/messenger-369223c5490f8cdcf187.chunk.js(Line 1) Message: Rendering was performed in a subtree hidden by content-visibility.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	"max-age=63072000; includeSubDomains; preload";
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

003-yru-314.mktoresp.com
ajax.googleapis.com
alb.reddit.com
analytics.twitter.com
app.qualified.com
apresolve.spotify.com
assets.qualified.com
attr.ml-api.io
b.6sc.co
bat.bing.com
c.6sc.co
cdn.bizible.com
cdn.bizibly.com
cdn.linkedin.oribi.io
cdnjs.cloudflare.com
connect.facebook.net
embed-cdn.spotifycdn.com
encore.scdn.co
fonts.googleapis.com
gew4-spclient.spotify.com
googleads.g.doubleclick.net
i.scdn.co
j.6sc.co
js.qualified.com
munchkin.marketo.net
open.spotify.com
px.ads.linkedin.com
px4.ads.linkedin.com
qualified-production.s3.us-east-1.amazonaws.com
redcanary.com
region1.analytics.google.com
resource.redcanary.com
s.ml-attr.com
s3-us-west-2.amazonaws.com
script.crazyegg.com
secure.adnxs.com
sentry.io
snap.licdn.com
static.ads-twitter.com
stats.g.doubleclick.net
t.co
tracking.crazyegg.com
www.facebook.com
www.google-analytics.com
www.google.com
www.google.de
www.googletagmanager.com
www.linkedin.com
www.redditstatic.com
104.17.72.206
104.198.136.223
104.244.42.131
104.244.42.133
104.64.124.188
13.107.42.14
151.101.1.140
152.195.15.58
185.89.210.244
192.28.147.68
199.232.148.157
2001:4860:4802:32::36
23.38.98.237
2600:1901:0:524d::
2600:1901:1:81::
2600:1901:1:c36::
2600:9000:2251:1000:12:3734:2a40:93a1
2600:9000:26db:ea00:2:53b2:240:93a1
2606:4700::6811:190e
2606:4700::6812:1005
2606:4700::6812:1105
2606:4700::6813:9308
2620:1ec:21::14
2620:1ec:c11::200
2a00:1450:4001:809::2008
2a00:1450:4001:810::200a
2a00:1450:4001:812::2002
2a00:1450:4001:829::2004
2a00:1450:4001:82a::200e
2a00:1450:4001:82f::2003
2a00:1450:4001:830::200a
2a00:1450:400c:c04::9b
2a02:26f0:280:3::213:789e
2a02:26f0:480:15::213:7e4a
2a03:2880:f084:d:face:b00c:0:3
2a03:2880:f177:185:face:b00c:0:25de
2a04:4e42:600::396
2a04:4e42:8d::760
2a04:4e42:8d::762
35.186.247.156
52.18.119.10
52.216.61.74
52.92.210.152
54.164.227.36
68.67.153.60
00bbc66153e493c73e6ee4448a25fac555d74e1fd957f6f804754ff27bb9884f
039130d456855a745451bff40707bee5512bc4466373224b2258f67cc6c6d879
040c6c4b281ea6760e1db7e9f2063e2409f8a2434d95851d85cc535f0ff1f9b5
0f57969cdf0d61b86fc25ded8a8c5058a5edd346d1845b232610a54f08d0fcb8
1004dc1b12f999eafe5336d4c92c18af95daf65af8b2bd641d29e697efb56364
122854df4f39cf922db317714c2ff0eccab27a1028c14a5aa2211f48b7e0eade
1486615b34c43bee393a5dd74f110c6f25c5f2d66d8111278f54e77ffcbc63a3
152261291c938aa5aad6a56d52b47ffcb893d1c0387e76d7f270a7382ff786d5
1576f47ba50e5433d2efe01986fa43b861bd6a4de15751c35bf606b2a9fed2c9
15e5827ebf3a8660ccf687d7f208b247f355421bfeeaa572f26913a453acf45e
16005d3dd555b3e66dd9ebf840d8b225ee02966d26b62f58aea68e6808ff3c83
1cbfcbb81af382110b9d1911b035a8d19b3ca175272555884721d64fb72221c1
1d3d9de6db687e8b9bf3aa08f565dc2db8743147acce6904bf762b7ff56dbf09
1d752805498ebd36b9c69ad1d3da93b1561ea6b33f58ec89a66a4228a357dfe2
2182476b2f19b36cc23e9bbdb2dd97b84f4d6eddabc117e374b893fe3cd8cdc5
24a9979fff20ad59cba9b4a38af6fba8903c482fa2c390e2f0e82c97a649da98
24b99703cc2b2d010f48778c5700beb1ed63e688c460b7498c911bb4a97e2e23
263e16f176fddc5af313fa27a6173538c61b5f28db6a4360e9ae9f81504907b1
292f853f9ef0e448c5536987fe87197f401bafcde3e0857e17de1f0676f5b2eb
2f472251b6b4a4a8d7ceed7539cb6ebea71caf28bccc0beda7a6866a6847b53e
2fb0db460ef1851e44c7e94a3f1944e299e306def449ed72c30adfb89b25b029
3436a3567df14bd76a0e5b2ab1edba77ff61c49fb811b64de0dd23899103ecdc
35134ff1cfb9ea2e3a5d5e63856b1efeba6893a5bcbfb93a73b6e4b671239282
3562dd5ebaf7d001cd283fe325fc4b574e26b053807efb3331dd8fcb5964f559
36975a27509bf92a53016181456a48ff34220ab524329a013bd2fa486ab19048
3756d3b73e7599eb1a072d230dbef6b1d3754e30a61c0e906a872bcf96e3e536
3a48ba6d11055a2a6f840befa14e603650d8ca3d752e16daccd828d3869fb791
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
447a24f2612083c24a259b3acde1541e60bc5cc38d51f72eb5bb52baeda8e75c
47538fac2adc0804f5e21e74716ce2fdfa6e9795f74a1231c9947c631ea94910
5206536707c84baa892d3c3231b351985ee828cb8b9c0bd8db42cd3363995fc4
53f545d884abf02ce99f4e0369ffec8be28f1f3f22eb99bf0fab9f4522ea5142
5408d95db01e0b235e7f251650932b36f5abfe4f40e8111b74c437826480b8fb
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3
5a67c844a08bb049379474c28891b836a26d673555f882dd5717beeabf42200f
5d07fef4322254c5ef1217d36478f2493d1dcdea7254b5f35adf231c55588cb4
5d53b54c7ea0679e2db9ad67e13899bdd3ae29f54e09f94eef5ff9b08a7352df
6217f642930c0d2411329fb00cf9a7e2e138a98f56eece6e82b3a7359f20cb11
62c59060782cf4822b2598e623b331039dc6e4a1f8ded9c07032eb91f60adc20
68cc280ce370c6f1f51a4fc5950103fc38df80a429552c549add04ebd8bd3a23
6af930f857a9b1c2e3f638e4c2eeae1f5a8d28643db55d6a2f7d99c77e17489f
6bc9a4bdde5c48a39cabd8840dec8bd11281dcdd167cf4440f383f01ad3ab123
6e0b02e307a08a6384527ffd3c99e8a3d4f83927b855c2ab6836e951337be886
6ea27beb5e90d0b65a769f26f1864df79c97c997cc279952734892eeafd5ab05
6ec35ab99388f6afab345622a22772619b83b7d63705d98df3c404da782fcabb
6f5b4aa00d2f8d6aed9935b471806bf7acef464d0c1d390260e5fe27f800c67e
731fcb30d45f2e35aaa139a7a964410a7c2bcdbfbb48a837c9d56dec7cc3732f
7348a2eb48c9a681d6178433394c7037144d85b57ee33a11339d3a33fa1001a4
747e9ca7a5f5157e1555dca2f78d780db6a1bef9dc270dcd7a73f571f1391d2b
7481436346ad777435fe494e87a3d7fa9dc1251ab9a024d5305a90fcc0b44f8c
756b9a05dda5b1afa4e8c3aaa061eccf77460cbd84f4b31f511b675fc9dbacd3
7b1eaaaf180a13c29b6dddc3b0ae23333b4397e0f3c065b4c86da2f2530a5f89
7bb26544c7c0d00e118860dc125c1bc943201bca5cf780804370732b39210d38
811d28b69759119584310f25aec54955bc7a2771829710def29613baeb2a72d1
81df66b8bd2dfc3ec90fda5b51577bd6b027a69b33c413285d6242c46cdc2e1e
84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80
8635f631a35b170f9809857bc49f5c1cbedaa732e0916f4af99573e9e939d8d5
86551808dbfbf8bc9b23ab3d0725794c2e1f2b4265c96715f2945638160edc2b
86f2855487ee0f2a026de07b800d0a191f2d66723011cf5e7bddea4669037b33
8c0eaa0018d1dcc4937144d457960614470ff2447dbf50e18097779d97b43819
8ec32112354b4493286cb34daa05fa0a49791553bfedb374d7a67c7ad9cb2c9f
8edbf02936f4bbda931a228bd84f7b668522af07f3dfc33b5caee429e7febb85
977858a0c518ab885051998c26954247bcc67d50bd26c4438d3022aec559c5c8
99011a0690be8d013bbf0ba1c7e2921db4c6f9e03d6d78e03ca8e1e826bf5b96
99e97366cd580fb716ea693b2696808c006d45c6366004db4286156077f20c4f
9a586f0b3e8add35ad17a2eec2cee97cbe175f48d7c47e34492dd973aa0f8381
9b7413f945c8b8bb3f75eb10513c7ad79d386e98494d541e5f1fa9301ffbddd6
9dcafe0dd491720f7b4e7168ee159909aba669acbba23ca17e32c9a2174510b0
9e41e783ec4cfc524c1666d1d5a4c805f8e92be52b030d130acfb31105e1e04c
9edb5c5ef600768db6e8ee027853f2c6f8ab34f615b495faaf114579f8de2e22
a3cf00c109d907e543bc4f6dbc85eb31068f94515251347e9e57509b52ee3d74
a4499f745882700108e60115ea38c28693bf225e861ffa788c30fceac83fb88e
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
aec60bc104db041b1512185839f18f52986df7e569e5445f740dd60f763fbca8
af40bad1e1b6415c6d7dfa127a6e8bf4c64111adfca9e4f4c43ade9c39dc9592
afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277
aff5855b9eea953386c7af491db1ecff00e245e68017864e1bc76fd228efdff3
b40d37fbb13b1b903fd3c063523b41c47c57e61ab99cad3bd35881672ea3e3d6
b6dcc1490a0cc33cdeed8970677b89bbec6fa095675af198b8e923b64563c70a
bc9a16cd945457ad9463cdaed95129b01c589466978dfee3d019d9c604b2171a
c124c88ca4fcb4336e97617647ef0d32441329371120c8eabaea0fea226560b0
cc240e36234dec6c472a04a70af52dfa5dce110a2766d9280e19fb12cde54e9d
ccccfce93233bff70d19b919d1cb552aed5bc6caac3fc76d01ab6f4c757901d9
cf7fcc9f75c8717897bfaef72f303fab423ce1b70c98512aeb3677e4af988dee
d2f545bb226e5bcc1d50af37b345d245dce63bc07aaeba2243e0f1ea87b2dcb9
d3cffae0a07184a7f41e99ed86654a87129116d1bc4ad30df766400d3953c404
d612f1212b452af07f1a5defb2b672e76a91f7139e7499fa48bb9b2b985c22d6
d8f62d6348ff5df7ab68876d4b88d84f53880c356763cf1792b65b5318800560
d9e0863aa56b8cba71d458f9491fdca3c7cc6b0eddbc288d0dfe3d41d0a30eef
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
dd25827c9ad7ac0cbdb3545ed377f0ff5c9d5c1d14282307cf04ac4776d0a572
de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd
debf84af8d66827e1cbc6791aa686504e3116d8cb20f4697fef23108333061f8
e0a9f4c87001cc0f3c478b7ba18689929b5dc8bbfa8c4c8873a62825dd8a112e
e2faba39df418170ae8bf1bd3e2d94c4757ad604e1606db3f572871834a2bdd5
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e3cc36c64ef86bed21592653daac82fd7e4c364c32c8344336aa13f7dbf52c90
e803e774c7b59fe74f71ed93acaa875cf9a99947ff8ed7615cd0c93c1667250f
eb3487cae40a55bf31dc6e6191ab0d88ec8c8f85c62bf28ad25ad0a40c16a611
eba72b1c1e3e44d5dabff914f59eb15876ae97cef296ddee4afe4821a54f2633
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f244fcb6b0aeadba8f41f30a7f451c0aaa06445ec854c3d9bbef1c485a036424
f526e42397f6b24d9b2c3cb34f9cec6af49cc7e1eb921f397a2ce7315fd607d1
f538eff9a0c9c118e0fe1b1a654f57f85a2a48179f86451514dbe3c3ce514c44
f872315d333981663bad5953d1280c886beab704fa9a9d2abc768352aa71d39a
f8e765848384e530beac002fc4656b7d54b12ef24564025933981afe76e2ca43
fa53fcd8da139d256c0ca83b69cb37473ca627b6052368ed3327c80d9fb61e25
fd7385bd0bc7f291c2370cc63389d132bcac95e8449f516bbd8c0e40c10cdabe
fe04a9dc88d3f3be8d4f6bc63a9a80f45a4c6d8460e7551dab849457c091920a

redcanary.com Open in urlscan Pro 104.198.136.223 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

134 Requests

96 %HTTPS

60 %IPv6

34 Domains

49 Subdomains

44 IPs

7 Countries

3897 kBTransfer

13936 kBSize

45 Cookies

20 Outgoing links

Redirected requests

134 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 3 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

redcanary.com Open in urlscan Pro
104.198.136.223 Public Scan

Screenshot
Live screenshot

Full Image

134
Requests

96 %
HTTPS

60 %
IPv6

34
Domains

49
Subdomains

44
IPs

7
Countries

3897 kB
Transfer

13936 kB
Size

45
Cookies

134 HTTP transactions
3 data transactions