www.oodaloop.com Open in urlscan Pro
141.193.213.20 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://www.oodaloop.com/archive/2024/05/14/the-social-engineering-tactics-of-ransomware-as-a-service-operator-black-basta/
Submission: On May 21 via api (May 21st 2024, 4:27:07 pm UTC) from US — Scanned from DE

Summary HTTP 64 Redirects Links 9 Behaviour Indicators

Summary

This website contacted 26 IPs in 4 countries across 16 domains to perform 64 HTTP transactions. The main IP is 141.193.213.20, located in United States and belongs to CLOUDFLARESPECTRUM Cloudflare, Inc., US. The main domain is www.oodaloop.com.
TLS certificate: Issued by E1 on May 20th 2024. Valid for: 3 months.

This is the only time www.oodaloop.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
10	141.193.213.20 141.193.213.20	209242 (CLOUDFLAR...) (CLOUDFLARESPECTRUM Cloudflare)
2	2a00:1450:400... 2a00:1450:4001:80f::200a	15169 (GOOGLE) (GOOGLE)
2 4	2606:4700::68... 2606:4700::6811:f7cb	13335 (CLOUDFLAR...) (CLOUDFLARENET)
3	2606:4700:303... 2606:4700:3036::6815:1b98	13335 (CLOUDFLAR...) (CLOUDFLARENET)
3	2a00:1450:400... 2a00:1450:4001:82f::2008	15169 (GOOGLE) (GOOGLE)
7	2600:9000:225... 2600:9000:225e:e400:4:c961:9640:93a1	16509 (AMAZON-02) (AMAZON-02)
4	216.58.206.66 216.58.206.66	15169 (GOOGLE) (GOOGLE)
1 3	142.250.74.196 142.250.74.196	15169 (GOOGLE) (GOOGLE)
3	192.0.76.3 192.0.76.3	2635 (AUTOMATTIC) (AUTOMATTIC)
1	2606:4700::68... 2606:4700::6810:5517	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a00:1450:400... 2a00:1450:4001:812::2003	15169 (GOOGLE) (GOOGLE)
6	2a00:1450:400... 2a00:1450:4001:802::2003	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:81c::200a	15169 (GOOGLE) (GOOGLE)
1	2a03:2880:f08... 2a03:2880:f084:d:face:b00c:0:3	32934 (FACEBOOK) (FACEBOOK)
2	2606:2800:234... 2606:2800:234:46c:e8b:1e2f:2bd:694	15133 (EDGECAST) (EDGECAST)
1	157.240.252.13 157.240.252.13	32934 (FACEBOOK) (FACEBOOK)
1	54.162.128.250 54.162.128.250	14618 (AMAZON-AES) (AMAZON-AES)
1	2001:4860:480... 2001:4860:4802:32::36	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:400c:c1d::9a	15169 (GOOGLE) (GOOGLE)
2	142.250.186.35 142.250.186.35	15169 (GOOGLE) (GOOGLE)
1 1	142.250.186.34 142.250.186.34	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:811::200e	15169 (GOOGLE) (GOOGLE)
1	142.250.185.202 142.250.185.202	15169 (GOOGLE) (GOOGLE)
3	216.58.206.67 216.58.206.67	15169 (GOOGLE) (GOOGLE)
2	142.250.185.174 142.250.185.174	15169 (GOOGLE) (GOOGLE)
1	2404:6800:400... 2404:6800:4007:827::2003	15169 (GOOGLE) (GOOGLE)
64	26

10 141.193.213.20 (United States)

ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US)

www.oodaloop.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:80f::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2606:4700::6811:f7cb (United States) 2 redirects

ASN13335 (CLOUDFLARENET, US)

unpkg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2606:4700:3036::6815:1b98 (United States)

ASN13335 (CLOUDFLARENET, US)

use.fontawesome.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:82f::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 2600:9000:225e:e400:4:c961:9640:93a1 (United States)

ASN16509 (AMAZON-02, US)

a.mailmunch.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 216.58.206.66 (United States)

ASN15169 (GOOGLE, US)
PTR: lhr35s11-in-f2.1e100.net

pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
www.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 142.250.74.196 (Plainview, United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: fra24s02-in-f4.1e100.net

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 192.0.76.3 (San Francisco, United States)

ASN2635 (AUTOMATTIC, US)

stats.wp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
pixel.wp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6810:5517 (United States)

ASN13335 (CLOUDFLARENET, US)

js.memberful.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:812::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2a00:1450:4001:802::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:81c::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

ajax.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a03:2880:f084:d:face:b00c:0:3 (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:2800:234:46c:e8b:1e2f:2bd:694 (United States)

ASN15133 (EDGECAST, US)

platform.twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 157.240.252.13 (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)
PTR: xx-fbcdn-shv-01-fra3.fbcdn.net

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 54.162.128.250 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-162-128-250.compute-1.amazonaws.com

forms.mailmunch.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2001:4860:4802:32::36 (United States)

ASN15169 (GOOGLE, US)

region1.analytics.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:400c:c1d::9a (Brussels, Belgium)

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 142.250.186.35 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s04-in-f3.1e100.net

www.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.186.34 (United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: fra24s04-in-f2.1e100.net

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:811::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fundingchoicesmessages.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.185.202 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s52-in-f10.1e100.net

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 216.58.206.67 (United States)

ASN15169 (GOOGLE, US)
PTR: lhr35s11-in-f3.1e100.net

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 142.250.185.174 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s51-in-f14.1e100.net

fundingchoicesmessages.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2404:6800:4007:827::2003 (Australia)

ASN15169 (GOOGLE, US)

csi.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
11	gstatic.com www.gstatic.com fonts.gstatic.com csi.gstatic.com	535 KB
10	oodaloop.com www.oodaloop.com	405 KB
8	google.com 1 redirects www.google.com — Cisco Umbrella Rank: 2 region1.analytics.google.com — Cisco Umbrella Rank: 3095 fundingchoicesmessages.google.com — Cisco Umbrella Rank: 646	124 KB
8	mailmunch.co a.mailmunch.co — Cisco Umbrella Rank: 23505 forms.mailmunch.co — Cisco Umbrella Rank: 24049	104 KB
4	unpkg.com 2 redirects unpkg.com — Cisco Umbrella Rank: 771	57 KB
4	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 33 ajax.googleapis.com — Cisco Umbrella Rank: 380	43 KB
3	wp.com stats.wp.com — Cisco Umbrella Rank: 2906 pixel.wp.com — Cisco Umbrella Rank: 2883	3 KB
3	googlesyndication.com pagead2.googlesyndication.com — Cisco Umbrella Rank: 103	214 KB
3	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 39	285 KB
3	fontawesome.com use.fontawesome.com — Cisco Umbrella Rank: 1230	133 KB
2	google.de www.google.de — Cisco Umbrella Rank: 7810	127 B
2	doubleclick.net 1 redirects stats.g.doubleclick.net — Cisco Umbrella Rank: 89 googleads.g.doubleclick.net — Cisco Umbrella Rank: 35	279 B
2	twitter.com platform.twitter.com — Cisco Umbrella Rank: 1357	28 KB
2	facebook.net connect.facebook.net — Cisco Umbrella Rank: 183	89 KB
1	googleadservices.com www.googleadservices.com — Cisco Umbrella Rank: 126	2 KB
1	memberful.com js.memberful.com — Cisco Umbrella Rank: 32578	23 KB
64	16

	Domain	Requested by
10	www.oodaloop.com	www.oodaloop.com
9	fonts.gstatic.com	fonts.googleapis.com www.oodaloop.com
7	a.mailmunch.co	www.oodaloop.com a.mailmunch.co ajax.googleapis.com
4	fundingchoicesmessages.google.com	pagead2.googlesyndication.com
4	unpkg.com	2 redirects www.oodaloop.com unpkg.com
3	www.google.com	1 redirects www.oodaloop.com www.gstatic.com
3	pagead2.googlesyndication.com	www.oodaloop.com pagead2.googlesyndication.com
3	www.googletagmanager.com	www.oodaloop.com www.googletagmanager.com
3	use.fontawesome.com	www.oodaloop.com use.fontawesome.com
3	fonts.googleapis.com	www.oodaloop.com a.mailmunch.co
2	www.google.de	www.oodaloop.com
2	platform.twitter.com	www.oodaloop.com platform.twitter.com
2	connect.facebook.net	www.oodaloop.com connect.facebook.net
2	pixel.wp.com	www.oodaloop.com
1	csi.gstatic.com	pagead2.googlesyndication.com
1	googleads.g.doubleclick.net	1 redirects
1	stats.g.doubleclick.net	www.googletagmanager.com
1	region1.analytics.google.com	www.googletagmanager.com
1	forms.mailmunch.co	a.mailmunch.co
1	www.googleadservices.com	www.googletagmanager.com
1	ajax.googleapis.com	a.mailmunch.co
1	www.gstatic.com	www.google.com
1	js.memberful.com	www.oodaloop.com
1	stats.wp.com	www.oodaloop.com
64	24

This site contains links to these domains. Also see Links.

Domain
www.linkedin.com
twitter.com
www.youtube.com
www.helpnetsecurity.com
en.wikipedia.org
ooda.memberful.com
listen.oodacast.com

Subject Issuer	Validity	Valid
www.oodaloop.com E1	`2024-05-20` - `2024-08-18`	3 months	crt.sh
upload.video.google.com WR2	`2024-05-06` - `2024-07-29`	3 months	crt.sh
use.fontawesome.com Cloudflare Inc ECC CA-3	`2023-10-12` - `2024-10-10`	a year	crt.sh
*.google-analytics.com WR2	`2024-05-06` - `2024-07-29`	3 months	crt.sh
*.mailmunch.co Amazon RSA 2048 M02	`2024-05-03` - `2025-06-01`	a year	crt.sh
*.g.doubleclick.net WR2	`2024-05-06` - `2024-07-29`	3 months	crt.sh
*.google.com WR2	`2024-05-06` - `2024-07-29`	3 months	crt.sh
*.wp.com Sectigo ECC Domain Validation Secure Server CA	`2023-11-28` - `2024-12-28`	a year	crt.sh
memberful.com Cloudflare Inc ECC CA-3	`2024-02-29` - `2024-12-31`	10 months	crt.sh
*.gstatic.com WR2	`2024-05-06` - `2024-07-29`	3 months	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2024-02-29` - `2024-05-29`	3 months	crt.sh
*.twimg.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-07-28` - `2024-07-26`	a year	crt.sh
*.googleadservices.com WR2	`2024-05-06` - `2024-07-29`	3 months	crt.sh
forms.mailmunch.co R3	`2024-05-15` - `2024-08-13`	3 months	crt.sh
*.google.de WR2	`2024-05-06` - `2024-07-29`	3 months	crt.sh

This page contains 4 frames:

Primary Page: https://www.oodaloop.com/archive/2024/05/14/the-social-engineering-tactics-of-ransomware-as-a-service-operator-black-basta/
Frame ID: AB387F4586106C17AEC60F258AACC706
Requests: 60 HTTP requests in this frame

Frame: https://platform.twitter.com/widgets/widget_iframe.2f70fb173b9000da126c79afe2098f02.html?origin=https%3A%2F%2Fwww.oodaloop.com
Frame ID: 9B3DDD6CDA0FB98D419E006CAB54E923
Requests: 1 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LcH1bkZAAAAAO-WJqF6eGOWMIKKB5g-0CA5H-4H&co=aHR0cHM6Ly93d3cub29kYWxvb3AuY29tOjQ0Mw..&hl=de&v=8k85QBI-qzxmenDv318AZH30&size=invisible&cb=kjb5m5s5yba2
Frame ID: D4E58AC6A7DF556F60053ACC59234A69
Requests: 1 HTTP requests in this frame

Frame: https://a.mailmunch.co/v2/themes/mailmunch/expressions/popover/index.css
Frame ID: 2097564CA625BCE0951A6CE63E06CF28
Requests: 6 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

OODA Loop - The Social Engineering Tactics of Ransomware-as-a-Service Operator Black Basta

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

<link rel=["']stylesheet["'] [^>]+/wp-(?:content|includes)/
/wp-(?:content|includes)/

Facebook (Widgets) Expand

Overall confidence: 100%
Detected patterns

//connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js

Font Awesome (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)

Google AdSense (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

googlesyndication\.com/

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtag/js

Ionicons (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]+ionicons(?:\.min)?\.css

Twitter (Widgets) Expand

Overall confidence: 100%
Detected patterns

//platform\.twitter\.com/widgets\.js

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

/([\d.]+)/jquery(?:\.min)?\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

reCAPTCHA (Captchas) Expand

Overall confidence: 100%
Detected patterns

/recaptcha/api\.js

Page Statistics

64
Requests

94 %
HTTPS

58 %
IPv6

16
Domains

24
Subdomains

26
IPs

4
Countries

2044 kB
Transfer

5017 kB
Size

6
Cookies

9 Outgoing links

These are links going to different origins than the main page.

URL: https://www.linkedin.com/company/ooda-llc/

Search URL Search Domain Scan URL

URL: https://twitter.com/ooda

Search URL Search Domain Scan URL

URL: https://www.youtube.com/oodaloop

Search URL Search Domain Scan URL

URL: https://www.helpnetsecurity.com/2024/05/13/black-basta-social-engineering/#:~:text=and%20phone%20calls).-,Who%20is%20Black%20Basta%3F,-The%20Russian%2Dspeaking
Title: Who is Black Basta?

Search URL Search Domain Scan URL

URL: https://en.wikipedia.org/wiki/.onion
Title: .onion

Search URL Search Domain Scan URL

URL: https://ooda.memberful.com/
Title: Sign In.

Search URL Search Domain Scan URL

URL: https://ooda.memberful.com/checkout?plan=105277
Title: Subscribe

Search URL Search Domain Scan URL

URL: https://ooda.memberful.com/checkout?plan=105278
Title: Subscribe

Search URL Search Domain Scan URL

URL: http://listen.oodacast.com/
Title: Podcast

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 3

https://unpkg.com/ionicons@4.1.2/dist/css/ionicons.min.css?ver=1.5.1 HTTP 302
https://unpkg.com/ionicons@4.1.2/dist/css/ionicons.min.css

Request Chain 23

https://unpkg.com/ionicons@4.1.2/dist/fonts/ionicons.woff2?v=4.1.1 HTTP 302
https://unpkg.com/ionicons@4.1.2/dist/fonts/ionicons.woff2

Request Chain 45

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/10855864883/?random=1487805552&cv=11&fst=1716308822548&bg=ffffff&guid=ON&async=1&gtm=45be45f0v9119397723za200&gcd=13l3l3l2l1&dma_cps=sypham&dma=1&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.oodaloop.com%2Farchive%2F2024%2F05%2F14%2Fthe-social-engineering-tactics-of-ransomware-as-a-service-operator-black-basta%2F&label=m8haCJKrvKMDELO0vbgo&hn=www.googleadservices.com&frm=0&tiba=OODA%20Loop%20-%20The%20Social%20Engineering%20Tactics%20of%20Ransomware-as-a-Service%20Operator%20Black%20Basta&did=dZTNiMT&gdid=dZTNiMT&gtm_ee=1&npa=1&pscdl=noapi&auid=1411967436.1716308823&uaa=x86&uab=64&uafvl=Chromium%3B124.0.6367.207%7CGoogle%2520Chrome%3B124.0.6367.207%7CNot-A.Brand%3B99.0.0.0&uamb=0&uam=&uap=Win32&uapv=10.0.0&uaw=0&fdr=SA&data=event%3Dconversion&fmt=3&ct_cookie_present=false&sscte=1&crd=CJW3sQIIscGxAgiwwbECCLnBsQI&pscrd=IhMIibjJzZSfhgMVL0gdCR0ReA3CMgIIAzICCAQyAggHMgIICDICCAkyAggKMgIIAjICCAs6GWh0dHBzOi8vd3d3Lm9vZGFsb29wLmNvbS8 HTTP 302
https://www.google.com/pagead/1p-conversion/10855864883/?random=1487805552&cv=11&fst=1716308822548&bg=ffffff&guid=ON&async=1&gtm=45be45f0v9119397723za200&gcd=13l3l3l2l1&dma_cps=sypham&dma=1&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.oodaloop.com%2Farchive%2F2024%2F05%2F14%2Fthe-social-engineering-tactics-of-ransomware-as-a-service-operator-black-basta%2F&label=m8haCJKrvKMDELO0vbgo&hn=www.googleadservices.com&frm=0&tiba=OODA%20Loop%20-%20The%20Social%20Engineering%20Tactics%20of%20Ransomware-as-a-Service%20Operator%20Black%20Basta&did=dZTNiMT&gdid=dZTNiMT&gtm_ee=1&npa=1&pscdl=noapi&auid=1411967436.1716308823&uaa=x86&uab=64&uafvl=Chromium%3B124.0.6367.207%7CGoogle%2520Chrome%3B124.0.6367.207%7CNot-A.Brand%3B99.0.0.0&uamb=0&uam=&uap=Win32&uapv=10.0.0&uaw=0&fdr=SA&data=event%3Dconversion&fmt=3&ct_cookie_present=false&sscte=1&crd=CJW3sQIIscGxAgiwwbECCLnBsQI&pscrd=IhMIibjJzZSfhgMVL0gdCR0ReA3CMgIIAzICCAQyAggHMgIICDICCAkyAggKMgIIAjICCAs6GWh0dHBzOi8vd3d3Lm9vZGFsb29wLmNvbS8&is_vtc=1&cid=CAQSGwDaQooL4MXE3ke44RelK2gtm5lWQRFf9IVw-A&random=3740452500 HTTP 302
https://www.google.de/pagead/1p-conversion/10855864883/?random=1487805552&cv=11&fst=1716308822548&bg=ffffff&guid=ON&async=1&gtm=45be45f0v9119397723za200&gcd=13l3l3l2l1&dma_cps=sypham&dma=1&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.oodaloop.com%2Farchive%2F2024%2F05%2F14%2Fthe-social-engineering-tactics-of-ransomware-as-a-service-operator-black-basta%2F&label=m8haCJKrvKMDELO0vbgo&hn=www.googleadservices.com&frm=0&tiba=OODA%20Loop%20-%20The%20Social%20Engineering%20Tactics%20of%20Ransomware-as-a-Service%20Operator%20Black%20Basta&did=dZTNiMT&gdid=dZTNiMT&gtm_ee=1&npa=1&pscdl=noapi&auid=1411967436.1716308823&uaa=x86&uab=64&uafvl=Chromium%3B124.0.6367.207%7CGoogle%2520Chrome%3B124.0.6367.207%7CNot-A.Brand%3B99.0.0.0&uamb=0&uam=&uap=Win32&uapv=10.0.0&uaw=0&fdr=SA&data=event%3Dconversion&fmt=3&ct_cookie_present=false&sscte=1&crd=CJW3sQIIscGxAgiwwbECCLnBsQI&pscrd=IhMIibjJzZSfhgMVL0gdCR0ReA3CMgIIAzICCAQyAggHMgIICDICCAkyAggKMgIIAjICCAs6GWh0dHBzOi8vd3d3Lm9vZGFsb29wLmNvbS8&is_vtc=1&cid=CAQSGwDaQooL4MXE3ke44RelK2gtm5lWQRFf9IVw-A&random=3740452500&ipr=y

64 HTTP transactions
4 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
www.oodaloop.com/archive/2024/05/14/the-social-engineering-tactics-of-ransomware-as-a-service-operator-black-basta/ 106 KB
37 KB 241ms
203ms Document
text/html 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.oodaloop.com/archive/2024/05/14/the-social-engineering-tactics-of-ransomware-as-a-service-operator-black-basta/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare / WP Engine
Resource Hash: e7c7a472ce9006131bc534695e5c0ca99024d1b627cbab481b1c165150ef026a

Request headers

Accept-Language: de-DE,de;q=0.9;q=0.9
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Win32"

Response headers

alt-svc: h3=":443"; ma=86400
cache-control: max-age=600, must-revalidate
cf-cache-status: DYNAMIC
cf-ray: 8875ee78b80a71df-FRA
content-encoding: br
content-type: text/html; charset=UTF-8
date: Tue, 21 May 2024 16:27:02 GMT
last-modified: Tue, 14 May 2024 10:10:10 GMT
link: <https://www.oodaloop.com/wp-json/>; rel="https://api.w.org/" <https://www.oodaloop.com/wp-json/wp/v2/posts/265404>; rel="alternate"; type="application/json" <https://www.oodaloop.com/?p=265404>; rel=shortlink
server: cloudflare
vary: Accept-Encoding Accept-Encoding Accept-Encoding Accept-Encoding,Cookie
x-cache: HIT: 4
x-cache-group: normal
x-cacheable: YES:600.000
x-orig-cache-control: max-age=600, must-revalidate
x-powered-by: WP Engine

GET
H2 200 autoptimize_05123d80aac85c805bce601e612fb33d.css
www.oodaloop.com/wp-content/cache/autoptimize/css/ 365 KB
59 KB 90ms
87ms Stylesheet
text/css 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.oodaloop.com/wp-content/cache/autoptimize/css/autoptimize_05123d80aac85c805bce601e612fb33d.css
Requested by: Host: www.oodaloop.com
URL: https://www.oodaloop.com/archive/2024/05/14/the-social-engineering-tactics-of-ransomware-as-a-service-operator-black-basta/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 704be67365fbb4ebba6cacbda38743bff2e339c9a5c6312791b9e4146124bfef

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.oodaloop.com/archive/2024/05/14/the-social-engineering-tactics-of-ransomware-as-a-service-operator-black-basta/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 21 May 2024 16:27:02 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Tue, 14 May 2024 01:36:46 GMT
server: cloudflare
age: 43413
etag: W/"6642c02e-5b403"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000
cf-ray: 8875ee7a09e171df-FRA
alt-svc: h3=":443"; ma=86400

GET
H2 200 dashicons.min.css
www.oodaloop.com/wp-includes/css/ 58 KB
35 KB 129ms
127ms Stylesheet
text/css 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.oodaloop.com/wp-includes/css/dashicons.min.css?ver=c02e8f71ce4983e8c93fcd97f62c5b55
Requested by: Host: www.oodaloop.com
URL: https://www.oodaloop.com/archive/2024/05/14/the-social-engineering-tactics-of-ransomware-as-a-service-operator-black-basta/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: c21e5a2b32c47bc5f9d9efc97bc0e29fd081946d1d3ebffc5621cfafb1d3960e

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.oodaloop.com/archive/2024/05/14/the-social-engineering-tactics-of-ransomware-as-a-service-operator-black-basta/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 21 May 2024 16:27:02 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Wed, 03 Mar 2021 21:16:22 GMT
server: cloudflare
age: 60986
etag: W/"603ffca6-e688"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000
cf-ray: 8875ee7a09e571df-FRA
alt-svc: h3=":443"; ma=86400

GET
H2 200 css
fonts.googleapis.com/ 16 KB
2 KB 140ms
48ms Stylesheet
text/css 2a00:1450:4001:80f::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Alegreya+Sans%3A400%2C400i%2C700%7CLora%3A400%2C700&display=swap&ver=1.5.1

Requested by

Host: www.oodaloop.com
URL: https://www.oodaloop.com/archive/2024/05/14/the-social-engineering-tactics-of-ransomware-as-a-service-operator-black-basta/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

eeaf04a8533df6f86cdbed425641ca8156f5fe1278820c19adca7414beda8d66

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.oodaloop.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

strict-transport-security: max-age=31536000
date: Tue, 21 May 2024 16:27:02 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Tue, 21 May 2024 16:27:02 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Tue, 21 May 2024 16:27:02 GMT

GET
H2

200

ionicons.min.css
unpkg.com/ionicons@4.1.2/dist/css/
Redirect Chain

https://unpkg.com/ionicons@4.1.2/dist/css/ionicons.min.css?ver=1.5.1
https://unpkg.com/ionicons@4.1.2/dist/css/ionicons.min.css

45 KB
7 KB

33ms
33ms

Stylesheet
text/css

2606:4700::6811:f7cb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://unpkg.com/ionicons@4.1.2/dist/css/ionicons.min.css

Requested by

Host: www.oodaloop.com
URL: https://www.oodaloop.com/archive/2024/05/14/the-social-engineering-tactics-of-ransomware-as-a-service-operator-black-basta/

Protocol

Server

2606:4700::6811:f7cb , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

48603ddd070422856ca75db4ad323ea234a4a50b03a5a6614a4427f1834f6e4d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9;q=0.9
Referer: https://www.oodaloop.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36

Response headers

date: Tue, 21 May 2024 16:27:02 GMT
via: 1.1 fly.io
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains; preload
age: 5951135
last-modified: Sat, 26 Oct 1985 08:15:00 GMT
fly-request-id: 01HRWM68KXGWP6GN0NY1XZQXBY-fra
server: cloudflare
etag: W/"b5ff-RGwHkRi/UwJOTtMwcy9S4BEE5d4"
vary: Accept-Encoding
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
cf-ray: 8875ee7a9db04d28-FRA

Redirect headers

date: Tue, 21 May 2024 16:27:02 GMT
content-encoding: br
via: 1.1 fly.io
cf-cache-status: HIT
fly-request-id: 01HYDYYW5PWVMBAS1JBQ7154D5-fra
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
age: 711
server: cloudflare
vary: Accept, Accept-Encoding
content-type: text/plain; charset=utf-8
access-control-allow-origin: *
location: /ionicons@4.1.2/dist/css/ionicons.min.css
cf-ray: 8875ee7a4d484d28-FRA

GET
H2 200 all.css
use.fontawesome.com/releases/v6.2.1/css/ 100 KB
23 KB 76ms
38ms Stylesheet
text/css 2606:4700:3036::6815:1b98
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://use.fontawesome.com/releases/v6.2.1/css/all.css
Requested by: Host: www.oodaloop.com
URL: https://www.oodaloop.com/archive/2024/05/14/the-social-engineering-tactics-of-ransomware-as-a-service-operator-black-basta/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3036::6815:1b98 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6752b9ba151a25703b2e5d17ad9ff42615f8940b591694fa8e42ab1034f476b5

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.oodaloop.com/
Origin: https://www.oodaloop.com
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 21 May 2024 16:27:02 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Fri, 22 Sep 2023 01:46:21 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 2497851
etag: W/"8bb6644125ddeee7a27732e86f65fa05"
vary: Origin, Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=uODNqVxBpFe7mKKHHnEFPuSJ90yLJYW0PiFn42VUn4mTHVmunc8I7QXgWuaGUa96RotLEEoSVc3zkmVbVpB4aCt9JbVgG7t9kzNE643yZhc7yMoh5sM34onFGajIKqHCll3x8rlAJpht0dIdJSo8uK5u"}],"group":"cf-nel","max_age":604800}
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=31556926
cf-ray: 8875ee7a4edf65c3-FRA
alt-svc: h3=":443"; ma=86400

GET
H2 200 v4-shims.css
use.fontawesome.com/releases/v6.2.1/css/ 27 KB
5 KB 75ms
37ms Stylesheet
text/css 2606:4700:3036::6815:1b98
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://use.fontawesome.com/releases/v6.2.1/css/v4-shims.css
Requested by: Host: www.oodaloop.com
URL: https://www.oodaloop.com/archive/2024/05/14/the-social-engineering-tactics-of-ransomware-as-a-service-operator-black-basta/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3036::6815:1b98 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 081ac69ac1c26248a32f4c811f6da10c47bd32f65885774088e8de666f4e912f

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.oodaloop.com/
Origin: https://www.oodaloop.com
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 21 May 2024 16:27:02 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Fri, 22 Sep 2023 01:46:21 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 2483875
etag: W/"1568e812cde85e014a6a0faf629ff2f9"
vary: Origin, Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=zDxqWF8l2ecdafcBIIndj6m3lOvUk37PJbB%2BZA9hlWU8oDAbCgq%2BrAq8DRef%2BYW4vVjC4H4eAoRUlMjEGVCTKv3b1FzVYGOriPzIrwPToq3vwxj25LtcYMExia6StB%2FE7L73H28zjVkZUZGyqZh%2FSnxu"}],"group":"cf-nel","max_age":604800}
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=31556926
cf-ray: 8875ee7a4eef65c3-FRA
alt-svc: h3=":443"; ma=86400

GET
H2 200 jquery.min.js Show response
www.oodaloop.com/wp-includes/js/jquery/ 86 KB
31 KB 50ms
49ms Script
application/javascript 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.oodaloop.com/wp-includes/js/jquery/jquery.min.js?ver=3.7.1
Requested by: Host: www.oodaloop.com
URL: https://www.oodaloop.com/archive/2024/05/14/the-social-engineering-tactics-of-ransomware-as-a-service-operator-black-basta/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: cb6f2d32c49d1c2b25e9ffc9aaafa3f83075346c01bcd4ae6eb187392a4292cf

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.oodaloop.com/archive/2024/05/14/the-social-engineering-tactics-of-ransomware-as-a-service-operator-black-basta/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 21 May 2024 16:27:02 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Mon, 28 Aug 2023 17:14:23 GMT
server: cloudflare
age: 60986
etag: W/"64ecd5ef-15601"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
cf-ray: 8875ee7a09e871df-FRA
alt-svc: h3=":443"; ma=86400

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 306 KB
101 KB 150ms
67ms Script
application/javascript 2a00:1450:4001:82f::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=GT-NFPTPRX

Requested by

Host: www.oodaloop.com
URL: https://www.oodaloop.com/archive/2024/05/14/the-social-engineering-tactics-of-ransomware-as-a-service-operator-black-basta/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

617455141e3440795156407841063af4a97062b10c1b7538260fa146967121d0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.oodaloop.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 21 May 2024 16:27:02 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 102988
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Tue, 21 May 2024 16:27:02 GMT

GET
H2 200 site.js Show response
a.mailmunch.co/app/v1/ 25 KB
9 KB 60ms
13ms Script
text/javascript 2600:9000:225e:e400:4:c961:9640:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://a.mailmunch.co/app/v1/site.js
Requested by: Host: www.oodaloop.com
URL: https://www.oodaloop.com/archive/2024/05/14/the-social-engineering-tactics-of-ransomware-as-a-service-operator-black-basta/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:225e:e400:4:c961:9640:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 159043fcb16dd5c9a4b6a80581f7a91dc5987665ea5f7851da6c29fba0615a64

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.oodaloop.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 21 May 2024 03:26:30 GMT
content-encoding: gzip
via: 1.1 a962efd99fafcdb81ca24e0e8140a67c.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P4
age: 46833
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 8416
last-modified: Mon, 20 May 2024 19:30:10 GMT
server: AmazonS3
etag: "1ee50552193b403c4a1c7c3354800d0a"
access-control-max-age: 3000
access-control-allow-methods: HEAD, GET, POST, PUT, DELETE
content-type: text/javascript
access-control-allow-origin: *
access-control-expose-headers: ETag
cache-control: max-age=172800
accept-ranges: bytes
x-amz-cf-id: 5YysIPo6OgOfMttdQ2rYScMQPVciFtFrHVuELzVgROPG86v2mLJonA==

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 232 KB
83 KB 150ms
78ms Script
application/javascript 2a00:1450:4001:82f::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-10855864883

Requested by

Host: www.oodaloop.com
URL: https://www.oodaloop.com/archive/2024/05/14/the-social-engineering-tactics-of-ransomware-as-a-service-operator-black-basta/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

381dc11d7c7d3b9adc3db82512d3d81683b49db6ae6a2bf24ec04cf3da813cc8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.oodaloop.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 21 May 2024 16:27:02 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 84758
x-xss-protection: 0
last-modified: Tue, 21 May 2024 15:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Tue, 21 May 2024 16:27:02 GMT

GET
H3 200 adsbygoogle.js Show response
pagead2.googlesyndication.com/pagead/js/ 151 KB
51 KB 167ms
90ms Script
text/javascript 216.58.206.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js?client=ca-pub-6397933982550253

Requested by

Host: www.oodaloop.com
URL: https://www.oodaloop.com/archive/2024/05/14/the-social-engineering-tactics-of-ransomware-as-a-service-operator-black-basta/

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.206.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lhr35s11-in-f2.1e100.net

Software

cafe /

Resource Hash

51be7f465c85cfe6d4f652c038711ca45c04f65fea1cdd4056a3e249529cc98d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.oodaloop.com/
Origin: https://www.oodaloop.com
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 21 May 2024 16:27:02 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 52188
x-xss-protection: 0
server: cafe
etag: 18244025429474976652
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
link: <https://googleads.g.doubleclick.net>; rel="preconnect"; crossorigin
expires: Tue, 21 May 2024 16:27:02 GMT

GET
H3 200 lazysizes.min.js Show response
www.oodaloop.com/wp-content/plugins/autoptimize/classes/external/js/ 10 KB
4 KB 94ms
93ms Script
application/javascript 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.oodaloop.com/wp-content/plugins/autoptimize/classes/external/js/lazysizes.min.js?ao_version=3.1.11
Requested by: Host: www.oodaloop.com
URL: https://www.oodaloop.com/archive/2024/05/14/the-social-engineering-tactics-of-ransomware-as-a-service-operator-black-basta/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: c4fada4accfa24704b54248bc5ce84acac50b6a059828b7714fe3006786c80c1

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.oodaloop.com/archive/2024/05/14/the-social-engineering-tactics-of-ransomware-as-a-service-operator-black-basta/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 21 May 2024 16:27:02 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Mon, 25 Mar 2024 20:36:58 GMT
server: cloudflare
age: 60985
etag: W/"6601e06a-2655"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
cf-ray: 8875ee7afc789731-FRA
alt-svc: h3=":443"; ma=86400

GET
H3 200 api.js Show response
www.google.com/recaptcha/ 1 KB
975 B 133ms
52ms Script
text/javascript 142.250.74.196
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api.js?render=6LcH1bkZAAAAAO-WJqF6eGOWMIKKB5g-0CA5H-4H&ver=1.5.0

Requested by

Host: www.oodaloop.com
URL: https://www.oodaloop.com/archive/2024/05/14/the-social-engineering-tactics-of-ransomware-as-a-service-operator-black-basta/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.74.196 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s02-in-f4.1e100.net

Software

GSE /

Resource Hash

d0960c1bb4516a7fb635268bef895f81408bc432fd7c4d0737fccfce8a66f74a

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.oodaloop.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 21 May 2024 16:27:02 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy: frame-ancestors 'self'
server: GSE
x-frame-options: SAMEORIGIN
content-type: text/javascript; charset=utf-8
cache-control: private, max-age=300
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 1; mode=block
expires: Tue, 21 May 2024 16:27:02 GMT

GET
H2 200 e-202421.js Show response
stats.wp.com/ 7 KB
3 KB 28ms
7ms Script
application/javascript 192.0.76.3
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://stats.wp.com/e-202421.js
Requested by: Host: www.oodaloop.com
URL: https://www.oodaloop.com/archive/2024/05/14/the-social-engineering-tactics-of-ransomware-as-a-service-operator-black-basta/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.76.3 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 4f9f4e2e225088f9cf3b6b54aa421e0f776d1802255505d2f752e1f83f441641

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.oodaloop.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-minify-cache: hit
x-nc: HIT hhn
date: Tue, 21 May 2024 16:27:02 GMT
content-encoding: br
server: nginx
x-minify: t
etag: W/14377-1704402356563.6672
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=31536000
alt-svc: h3=":443"; ma=86400
expires: Tue, 13 May 2025 13:19:18 GMT

GET
H3 200 autoptimize_f3f254e58786e7c0e5c37fc1b0eb30d0.js Show response
www.oodaloop.com/wp-content/cache/autoptimize/js/ 25 KB
9 KB 95ms
94ms Script
application/javascript 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.oodaloop.com/wp-content/cache/autoptimize/js/autoptimize_f3f254e58786e7c0e5c37fc1b0eb30d0.js
Requested by: Host: www.oodaloop.com
URL: https://www.oodaloop.com/archive/2024/05/14/the-social-engineering-tactics-of-ransomware-as-a-service-operator-black-basta/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7ee94ef3aa7fd1a31dd1158b333ed82d41eed96790b59cfa1d4bf96fb0c648c1

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.oodaloop.com/archive/2024/05/14/the-social-engineering-tactics-of-ransomware-as-a-service-operator-black-basta/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 21 May 2024 16:27:02 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Wed, 01 May 2024 19:05:51 GMT
server: cloudflare
age: 60985
etag: W/"6632928f-6438"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
cf-ray: 8875ee7afc7e9731-FRA
alt-svc: h3=":443"; ma=86400

GET
BLOB 200
OK 52ba789c-e651-4e13-9186-6b7d0669d7ca
https://www.oodaloop.com/ 1 KB
0 Other
text/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://www.oodaloop.com/52ba789c-e651-4e13-9186-6b7d0669d7ca
Requested by: Host: www.oodaloop.com
URL: https://www.oodaloop.com/archive/2024/05/14/the-social-engineering-tactics-of-ransomware-as-a-service-operator-black-basta/
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 5b9f9afe7621ec465573f58064f5bef3a229e5e19362351168fd211f6a28bb5c

Request headers

Accept-Language: de-DE,de;q=0.9;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36

Response headers

Content-Length: 1185
Content-Type: text/javascript

GET
H2 200 embed.js Show response
js.memberful.com/ 42 KB
23 KB 82ms
41ms Script
application/javascript 2606:4700::6810:5517
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://js.memberful.com/embed.js

Requested by

Host: www.oodaloop.com
URL: https://www.oodaloop.com/archive/2024/05/14/the-social-engineering-tactics-of-ransomware-as-a-service-operator-black-basta/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:5517 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0621eb72d5d6f1ba4cbcc02004542ef29ef5df7bacd8333b998748c023932413

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.oodaloop.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 21 May 2024 16:27:02 GMT
content-encoding: gzip
via: 1.1 vegur
strict-transport-security: max-age=15552000
nel: {"report_to":"heroku-nel","max_age":3600,"success_fraction":0.005,"failure_fraction":0.05,"response_headers":["Via"]}
cf-cache-status: HIT
age: 2763
content-length: 22390
reporting-endpoints: heroku-nel=https://nel.heroku.com/reports?ts=1716262853&sid=c46efe9b-d3d2-4a0c-8c76-bfafa16c5add&s=2PvJYP6z7ejRfDKa7p6%2BUjPAC1EzufHjVpWCWcpiwK8%3D
last-modified: Tue, 21 May 2024 01:59:51 GMT
server: cloudflare
vary: accept-encoding
report-to: {"group":"heroku-nel","max_age":3600,"endpoints":[{"url":"https://nel.heroku.com/reports?ts=1716262853&sid=c46efe9b-d3d2-4a0c-8c76-bfafa16c5add&s=2PvJYP6z7ejRfDKa7p6%2BUjPAC1EzufHjVpWCWcpiwK8%3D"}]}
content-type: application/javascript
cache-control: public, max-age=14400
accept-ranges: bytes
cf-ray: 8875ee7b3ecf5c2c-FRA

GET
DATA 200
OK truncated
/ 67 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 0d2d86f777e0d337003688892e001abea8d2491bc41e19b6567680d26a442f57

Request headers

Accept-Language: de-DE,de;q=0.9;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 68 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: a7ae4f4e313e150000175511c29ca19ae2948eb663987253d19a9372cc20e3fe

Request headers

Accept-Language: de-DE,de;q=0.9;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 66 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: cae4ee013f217f9c449fe04eb87cb87fd2790a80a8021afdf97575eb65479b2f

Request headers

Accept-Language: de-DE,de;q=0.9;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H2 200 recaptcha__de.js Show response
www.gstatic.com/recaptcha/releases/8k85QBI-qzxmenDv318AZH30/ 519 KB
207 KB 124ms
38ms Script
text/javascript 2a00:1450:4001:812::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/recaptcha/releases/8k85QBI-qzxmenDv318AZH30/recaptcha__de.js

Requested by

Host: www.google.com
URL: https://www.google.com/recaptcha/api.js?render=6LcH1bkZAAAAAO-WJqF6eGOWMIKKB5g-0CA5H-4H&ver=1.5.0

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e92f0b552deffbf207cee5389713056c7c3d27e4b9b9edaf29338d01a83c5962

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.oodaloop.com/
Origin: https://www.oodaloop.com
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 21 May 2024 14:47:36 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 5966
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 210834
x-xss-protection: 0
last-modified: Mon, 13 May 2024 17:44:43 GMT
server: sffe
cross-origin-opener-policy: same-origin-allow-popups; report-to="recaptcha"
vary: Accept-Encoding
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 21 May 2025 14:47:36 GMT

GET
H2 200 g.gif
pixel.wp.com/ 50 B
177 B 17ms
6ms Image
image/gif 192.0.76.3
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.wp.com/g.gif?v=ext&blog=34662112&post=265404&tz=-4&srv=www.oodaloop.com&j=1%3A13.3.1&host=www.oodaloop.com&ref=&fcp=0&rand=0.6462508820747248
Requested by: Host: www.oodaloop.com
URL: https://www.oodaloop.com/archive/2024/05/14/the-social-engineering-tactics-of-ransomware-as-a-service-operator-black-basta/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.76.3 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: f3a8992acb9ab911e0fa4ae12f4b85ef8e61008619f13ee51c7a121ff87f63b1

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.oodaloop.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

access-control-allow-origin: *
date: Tue, 21 May 2024 16:27:02 GMT
cache-control: no-cache
server: nginx
alt-svc: h3=":443"; ma=86400
content-length: 50
content-type: image/gif

GET
H3 200 ransomware-attack-healthcare-prescription-medicine-supply.jpg
www.oodaloop.com/wp-content/uploads/2024/04/ 218 KB
218 KB 64ms
62ms Image
image/jpeg 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.oodaloop.com/wp-content/uploads/2024/04/ransomware-attack-healthcare-prescription-medicine-supply.jpg
Requested by: Host: www.oodaloop.com
URL: https://www.oodaloop.com/archive/2024/05/14/the-social-engineering-tactics-of-ransomware-as-a-service-operator-black-basta/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: dc9203252638485975559a30ad40d172a908b502713fae818dcae0bf1d4927f0

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.oodaloop.com/archive/2024/05/14/the-social-engineering-tactics-of-ransomware-as-a-service-operator-black-basta/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 21 May 2024 16:27:02 GMT
cf-cache-status: HIT
age: 18573
cf-polished: origSize=250536
alt-svc: h3=":443"; ma=86400
content-length: 222960
cf-bgj: imgq:100,h2pri
last-modified: Thu, 11 Apr 2024 13:35:13 GMT
server: cloudflare
etag: "6617e711-3d2a8"
vary: Accept-Encoding
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
cf-ray: 8875ee7b0ccc9731-FRA

GET
H2

200

ionicons.woff2
unpkg.com/ionicons@4.1.2/dist/fonts/
Redirect Chain

https://unpkg.com/ionicons@4.1.2/dist/fonts/ionicons.woff2?v=4.1.1
https://unpkg.com/ionicons@4.1.2/dist/fonts/ionicons.woff2

49 KB
50 KB

33ms
32ms

Font
font/woff2

2606:4700::6811:f7cb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://unpkg.com/ionicons@4.1.2/dist/fonts/ionicons.woff2

Requested by

Host: unpkg.com
URL: https://unpkg.com/ionicons@4.1.2/dist/css/ionicons.min.css

Protocol

Server

2606:4700::6811:f7cb , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

92bd8b6080ab6c3f23202c8206287cadbd8d4f243e3c63899f5a2aca52b36730

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9;q=0.9
Referer: https://unpkg.com/ionicons@4.1.2/dist/css/ionicons.min.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36

Response headers

date: Tue, 21 May 2024 16:27:02 GMT
via: 1.1 fly.io
x-content-type-options: nosniff
cf-cache-status: HIT
strict-transport-security: max-age=31536000; includeSubDomains; preload
age: 5956008
content-length: 50448
last-modified: Sat, 26 Oct 1985 08:15:00 GMT
fly-request-id: 01HRWFHJFT6FM69BKA5P968GKH-fra
server: cloudflare
etag: "c510-Xf8sU1U56TF4rHzU+s8UyF3XV9I"
vary: Accept-Encoding
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
cf-ray: 8875ee7be9513609-FRA

Redirect headers

date: Tue, 21 May 2024 16:27:02 GMT
content-encoding: br
via: 1.1 fly.io
cf-cache-status: HIT
fly-request-id: 01HYDZBK4XCQTMJTCY52GRDEW9-fra
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
age: 294
server: cloudflare
vary: Accept, Accept-Encoding
content-type: text/plain; charset=utf-8
access-control-allow-origin: *
location: /ionicons@4.1.2/dist/fonts/ionicons.woff2
cf-ray: 8875ee7ba8dd3609-FRA

GET
H2 200 5aUz9_-1phKLFgshYDvh6Vwt7VptvQ.woff2
fonts.gstatic.com/s/alegreyasans/v24/ 21 KB
22 KB 131ms
42ms Font
font/woff2 2a00:1450:4001:802::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/alegreyasans/v24/5aUz9_-1phKLFgshYDvh6Vwt7VptvQ.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Alegreya+Sans%3A400%2C400i%2C700%7CLora%3A400%2C700&display=swap&ver=1.5.1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:802::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

358b77e66f715be7f5676feec15e05ec8292a165f99ea95b345cf87adc075ede

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://fonts.googleapis.com/
Origin: https://www.oodaloop.com
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 21 May 2024 14:29:19 GMT
x-content-type-options: nosniff
age: 7063
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 21820
x-xss-protection: 0
last-modified: Wed, 07 Dec 2022 17:51:09 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 21 May 2025 14:29:19 GMT

GET
H2 200 5aUu9_-1phKLFgshYDvh6Vwt5eFIqEp2iw.woff2
fonts.gstatic.com/s/alegreyasans/v24/ 21 KB
22 KB 206ms
118ms Font
font/woff2 2a00:1450:4001:802::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/alegreyasans/v24/5aUu9_-1phKLFgshYDvh6Vwt5eFIqEp2iw.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Alegreya+Sans%3A400%2C400i%2C700%7CLora%3A400%2C700&display=swap&ver=1.5.1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:802::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

839b1145547ce6dcba32c1aeb4f578ed46847751fe8f5c7d2e427be44b9e03c2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://fonts.googleapis.com/
Origin: https://www.oodaloop.com
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 21 May 2024 02:29:08 GMT
x-content-type-options: nosniff
age: 50274
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 21904
x-xss-protection: 0
last-modified: Wed, 07 Dec 2022 17:51:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 21 May 2025 02:29:08 GMT

GET
H2 200 fa-brands-400.woff2
use.fontawesome.com/releases/v6.2.1/webfonts/ 105 KB
106 KB 33ms
31ms Font
font/woff2 2606:4700:3036::6815:1b98
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://use.fontawesome.com/releases/v6.2.1/webfonts/fa-brands-400.woff2
Requested by: Host: use.fontawesome.com
URL: https://use.fontawesome.com/releases/v6.2.1/css/all.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3036::6815:1b98 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c61287c2fa9863b5fb5844c683a168ac6520c94d822bb43d5eae35c3a2a82166

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://use.fontawesome.com/releases/v6.2.1/css/all.css
Origin: https://www.oodaloop.com
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 21 May 2024 16:27:02 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 2497850
alt-svc: h3=":443"; ma=86400
content-length: 107656
last-modified: Fri, 22 Sep 2023 01:46:26 GMT
server: cloudflare
etag: "e2f5b365c7d3d4497da73148ddfae997"
vary: Origin, Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ZwaE22MmgNhG1btuxiIsbhxCRAngLV3COB5TM63ioQ%2FowTp385dgj2CG8ZF%2BdFIcFKH2G2W0OGSVP9nZv7q7rEb%2BdBfdWbwXnywKoVVh%2FCjfVCRCkFvOw43hfRNWa8A%2B%2FYITHSWzv11f6ydvSnwg071y"}],"group":"cf-nel","max_age":604800}
content-type: font/woff2
access-control-allow-origin: *
cache-control: max-age=31556926
accept-ranges: bytes
cf-ray: 8875ee7b88d665c3-FRA

GET
H2 200 0QIvMX1D_JOuMwr7Iw.woff2
fonts.gstatic.com/s/lora/v35/ 37 KB
37 KB 164ms
76ms Font
font/woff2 2a00:1450:4001:802::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/lora/v35/0QIvMX1D_JOuMwr7Iw.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Alegreya+Sans%3A400%2C400i%2C700%7CLora%3A400%2C700&display=swap&ver=1.5.1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:802::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

16a2619b4d831694734838f42d825eb871ee5160d241900b780ad523404b1c50

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://fonts.googleapis.com/
Origin: https://www.oodaloop.com
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 21 May 2024 05:03:12 GMT
x-content-type-options: nosniff
age: 41030
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 37764
x-xss-protection: 0
last-modified: Wed, 31 Jan 2024 23:11:20 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 21 May 2025 05:03:12 GMT

GET
H2 200 5aUt9_-1phKLFgshYDvh6Vwt7V9dv21T.woff2
fonts.gstatic.com/s/alegreyasans/v24/ 22 KB
22 KB 190ms
102ms Font
font/woff2 2a00:1450:4001:802::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/alegreyasans/v24/5aUt9_-1phKLFgshYDvh6Vwt7V9dv21T.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Alegreya+Sans%3A400%2C400i%2C700%7CLora%3A400%2C700&display=swap&ver=1.5.1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:802::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e47ef21c70a3d03dc1bb7a44a728e7aa0e7c767c2d44a69c7baa52366effd113

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://fonts.googleapis.com/
Origin: https://www.oodaloop.com
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Sat, 18 May 2024 04:43:56 GMT
x-content-type-options: nosniff
age: 301386
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 22404
x-xss-protection: 0
last-modified: Wed, 07 Dec 2022 18:04:03 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 18 May 2025 04:43:56 GMT

GET
H2 200 jquery.min.js Show response
ajax.googleapis.com/ajax/libs/jquery/1.11.3/ 94 KB
33 KB 131ms
41ms Script
text/javascript 2a00:1450:4001:81c::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.googleapis.com/ajax/libs/jquery/1.11.3/jquery.min.js

Requested by

Host: a.mailmunch.co
URL: https://a.mailmunch.co/app/v1/site.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

aec3d419d50f05781a96f223e18289aeb52598b5db39be82a7b71dc67d6a7947

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.oodaloop.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 21 May 2024 14:27:39 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 7163
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 33507
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 19:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="hosted-libraries-pushers"
vary: Accept-Encoding
report-to: {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 21 May 2025 14:27:39 GMT

GET
H3 200 cropped-ooda-loop-logo-2015-3.png
www.oodaloop.com/wp-content/uploads/2022/10/ 5 KB
6 KB 111ms
111ms Image
image/webp 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.oodaloop.com/wp-content/uploads/2022/10/cropped-ooda-loop-logo-2015-3.png
Requested by: Host: www.oodaloop.com
URL: https://www.oodaloop.com/archive/2024/05/14/the-social-engineering-tactics-of-ransomware-as-a-service-operator-black-basta/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2c828a6328d08ad192f383f0b5416e7877ee0e29126a77f59361efc4d0bcd159

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.oodaloop.com/archive/2024/05/14/the-social-engineering-tactics-of-ransomware-as-a-service-operator-black-basta/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 21 May 2024 16:27:02 GMT
cf-cache-status: HIT
age: 39786
cf-polished: origFmt=png, origSize=11582
content-disposition: inline; filename="cropped-ooda-loop-logo-2015-3.webp"
alt-svc: h3=":443"; ma=86400
content-length: 5524
cf-bgj: imgq:100,h2pri
last-modified: Mon, 25 Mar 2024 20:36:43 GMT
server: cloudflare
etag: "6601e05b-2d3e"
vary: Accept
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
cf-ray: 8875ee7b9ddd9731-FRA

GET
H2 200 sdk.js Show response
connect.facebook.net/en_US/ 3 KB
4 KB 53ms
13ms Script
application/x-javascript 2a03:2880:f084:d:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/sdk.js

Requested by

Host: www.oodaloop.com
URL: https://www.oodaloop.com/wp-content/cache/autoptimize/js/autoptimize_f3f254e58786e7c0e5c37fc1b0eb30d0.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f084:d:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

1ffbb287a98de3687cd33154fab1663fe694c4ee8ea0dc3ce9de5755e4bdc4ef

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.oodaloop.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
date: Tue, 21 May 2024 16:27:02 GMT
content-md5: mJ5yg4RCFuOZn/eHaOTasA==
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 1686
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
x-fb-connection-quality: EXCELLENT; q=0.9, rtt=7, rtx=0, c=12, mss=1326, tbw=2783, tp=-1, tpl=-1, uplat=0, ullat=-1
x-fb-debug: RoBAyIEl5hzssR1HoyZE+DwVjga5hzaqj4sUe515qORo2SZdeHSIk/yMWMcpSH6wj0Z2Et/q2sAb4MC1gver9g==
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
x-fb-content-md5: 90194bab835dda532aded5c15371b897
cross-origin-opener-policy: same-origin-allow-popups;report-to="coop_report"
etag: "18d21c36cb7a912af2c951800ea937d2"
vary: Accept-Encoding
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: *
origin-agent-cluster: ?0
access-control-expose-headers: X-FB-Content-MD5
cache-control: public,max-age=1200,stale-while-revalidate=3600
permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), battery=(self), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), usb-unrestricted=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
x-frame-options: DENY
timing-allow-origin: *
expires: Tue, 21 May 2024 16:29:22 GMT

GET
H/1.1 200
OK widgets.js Show response
platform.twitter.com/ 91 KB
28 KB 54ms
15ms Script
application/javascript 2606:2800:234:46c:e8b:1e2f:2bd:694
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/widgets.js
Requested by: Host: www.oodaloop.com
URL: https://www.oodaloop.com/wp-content/cache/autoptimize/js/autoptimize_f3f254e58786e7c0e5c37fc1b0eb30d0.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:234:46c:e8b:1e2f:2bd:694 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECS (frb/674D) /
Resource Hash: 173460e89e6a7244218badae2016f65c48a3eae9d400802273eeca18b07336f1

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.oodaloop.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Tue, 21 May 2024 16:27:02 GMT
Content-Encoding: gzip
Age: 75
x-amz-server-side-encryption: AES256
X-Cache: HIT
P3P: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Server-Timing: x-cache;desc= HIT,x-tw-cdn;desc=VZ
Content-Length: 27597
Last-Modified: Mon, 11 Dec 2023 17:20:28 GMT
Server: ECS (frb/674D)
Etag: "824beb891744db98ccbd3a456e59e0f7+gzip"
Access-Control-Max-Age: 3000
Access-Control-Allow-Methods: GET
Content-Type: application/javascript; charset=utf-8
Access-Control-Allow-Origin: *
x-tw-cdn: VZ
Cache-Control: public, max-age=1800
Vary: Accept-Encoding

GET
H3 200 wp-emoji-release.min.js Show response
www.oodaloop.com/wp-includes/js/ 18 KB
5 KB 99ms
99ms Script
application/javascript 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.oodaloop.com/wp-includes/js/wp-emoji-release.min.js?ver=c02e8f71ce4983e8c93fcd97f62c5b55
Requested by: Host: www.oodaloop.com
URL: https://www.oodaloop.com/archive/2024/05/14/the-social-engineering-tactics-of-ransomware-as-a-service-operator-black-basta/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4e6ce5444c7f396cef0eb1fa3611034151e485dd06fbe5573a5583e1eebc98c3

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.oodaloop.com/archive/2024/05/14/the-social-engineering-tactics-of-ransomware-as-a-service-operator-black-basta/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 21 May 2024 16:27:02 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Tue, 13 Feb 2024 14:36:07 GMT
server: cloudflare
age: 60985
etag: W/"65cb7e57-4926"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
cf-ray: 8875ee7b9de19731-FRA
alt-svc: h3=":443"; ma=86400

GET
H3 200 sdk.js Show response
connect.facebook.net/en_US/ 299 KB
86 KB 32ms
18ms Script
application/x-javascript 157.240.252.13
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/sdk.js?hash=3d284f1e69c0c41a6ace8079af543c3c

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/sdk.js

Protocol

Security

QUIC, , AES_128_GCM

Server

157.240.252.13 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

xx-fbcdn-shv-01-fra3.fbcdn.net

Software

Resource Hash

f7d8ba11d0a3a5a385bc7f6289a8f3c53109d8ee3a87d705152c21fa26f60cd2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.oodaloop.com/
Origin: https://www.oodaloop.com
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
date: Tue, 21 May 2024 16:27:02 GMT
content-md5: a37CS9Y0tsEJ7Bq0oQZ+pQ==
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 87612
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
x-fb-connection-quality: EXCELLENT; q=0.9, rtt=11, rtx=0, c=23, mss=1232, tbw=4300, tp=9, tpl=0, uplat=1, ullat=-1
x-fb-debug: 6fRnnyfLfBHFtHAtoxxN6ehrLKHLwwIJKxJEVdzWq283xc+t0fXWieSgwUMOvmep3oNpTJmN5Q9sDi7zf5gqCg==
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
x-fb-content-md5: 6e8e1136de3d49b4056f188bdf3a54dd
cross-origin-opener-policy: same-origin-allow-popups;report-to="coop_report"
etag: "b0a5a035d50aabcdc1fddecbb2745ae5"
vary: Accept-Encoding
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: *
origin-agent-cluster: ?0
access-control-expose-headers: X-FB-Content-MD5
cache-control: public,max-age=31536000,stale-while-revalidate=3600,immutable
permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), battery=(self), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), usb-unrestricted=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
x-frame-options: DENY
timing-allow-origin: *
priority: u=3,i
expires: Wed, 21 May 2025 13:14:40 GMT

GET
H/1.1 200
OK widget_iframe.2f70fb173b9000da126c79afe2098f02.html
platform.twitter.com/widgets/ Frame 9B3D 0
0 40ms
11ms Document
text/html 2606:2800:234:46c:e8b:1e2f:2bd:694
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/widgets/widget_iframe.2f70fb173b9000da126c79afe2098f02.html?origin=https%3A%2F%2Fwww.oodaloop.com
Requested by: Host: platform.twitter.com
URL: https://platform.twitter.com/widgets.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:234:46c:e8b:1e2f:2bd:694 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECS (frb/67BA) /
Resource Hash

Request headers

Accept-Language: de-DE,de;q=0.9;q=0.9
Referer: https://www.oodaloop.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Win32"

Response headers

Access-Control-Allow-Methods: GET
Access-Control-Allow-Origin: *
Age: 4966491
Cache-Control: public, max-age=315360000
Content-Encoding: gzip
Content-Length: 105429
Content-Type: text/html; charset=utf-8
Date: Tue, 21 May 2024 16:27:02 GMT
Etag: "81267302efdfb3e4524a22631a8fc99e+gzip"
Last-Modified: Mon, 11 Dec 2023 17:19:49 GMT
P3P: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Server: ECS (frb/67BA)
Server-Timing: x-cache;desc= HIT,x-tw-cdn;desc=VZ
Vary: Accept-Encoding
X-Cache: HIT
x-amz-server-side-encryption: AES256
x-tw-cdn: VZ

GET
H3 200 show_ads_impl_with_ama_fy2021.js Show response
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202405150101/ 415 KB
140 KB 171ms
94ms Script
text/javascript 216.58.206.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202405150101/show_ads_impl_with_ama_fy2021.js?client=ca-pub-6397933982550253&plah=www.oodaloop.com&aplac=true

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js?client=ca-pub-6397933982550253

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.206.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lhr35s11-in-f2.1e100.net

Software

cafe /

Resource Hash

a9df188b784b6ee44c3aa3a155f289c4e9990a61dc3d79f41041540e9168b831

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.oodaloop.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 21 May 2024 16:27:02 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 143650
x-xss-protection: 0
server: cafe
etag: 13374222594058296898
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
expires: Tue, 21 May 2024 16:27:02 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 306 KB
101 KB 81ms
80ms Script
application/javascript 2a00:1450:4001:82f::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=GT-NFPTPRX&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-10855864883

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

226f20ef48a03fe5227af3a439134e218b7d90c21c898dea9d863b6ff6ee1bc9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.oodaloop.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 21 May 2024 16:27:02 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 103000
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Tue, 21 May 2024 16:27:02 GMT

GET
H3 200 / Show response
www.googleadservices.com/pagead/conversion/10855864883/ 3 KB
2 KB 97ms
52ms Script
text/javascript 216.58.206.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/conversion/10855864883/?random=1716308822548&cv=11&fst=1716308822548&bg=ffffff&guid=ON&async=1&gtm=45be45f0v9119397723za200&gcd=13l3l3l2l1&dma_cps=sypham&dma=1&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.oodaloop.com%2Farchive%2F2024%2F05%2F14%2Fthe-social-engineering-tactics-of-ransomware-as-a-service-operator-black-basta%2F&label=m8haCJKrvKMDELO0vbgo&hn=www.googleadservices.com&frm=0&tiba=OODA%20Loop%20-%20The%20Social%20Engineering%20Tactics%20of%20Ransomware-as-a-Service%20Operator%20Black%20Basta&did=dZTNiMT&gdid=dZTNiMT&gtm_ee=1&npa=1&pscdl=noapi&auid=1411967436.1716308823&uaa=x86&uab=64&uafvl=Chromium%3B124.0.6367.207%7CGoogle%2520Chrome%3B124.0.6367.207%7CNot-A.Brand%3B99.0.0.0&uamb=0&uam=&uap=Win32&uapv=10.0.0&uaw=0&fdr=SA&data=event%3Dconversion&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-10855864883

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.206.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lhr35s11-in-f2.1e100.net

Software

cafe /

Resource Hash

b15252e033a8cb7de71e1d26972637a6197579e95d5819dde74dea1a580763f5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.oodaloop.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Tue, 21 May 2024 16:27:02 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1670
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 anchor
www.google.com/recaptcha/api2/ Frame D4E5 0
0 135ms
66ms Document
text/html 142.250.74.196
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LcH1bkZAAAAAO-WJqF6eGOWMIKKB5g-0CA5H-4H&co=aHR0cHM6Ly93d3cub29kYWxvb3AuY29tOjQ0Mw..&hl=de&v=8k85QBI-qzxmenDv318AZH30&size=invisible&cb=kjb5m5s5yba2

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/8k85QBI-qzxmenDv318AZH30/recaptcha__de.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.74.196 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s02-in-f4.1e100.net

Software

GSE /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-lkzssWTzRpLdWB7MO7pdhQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9;q=0.9
Referer: https://www.oodaloop.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Win32"

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, no-store, max-age=0, must-revalidate
content-encoding: gzip
content-security-policy: script-src 'report-sample' 'nonce-lkzssWTzRpLdWB7MO7pdhQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Tue, 21 May 2024 16:27:02 GMT
expires: Mon, 01 Jan 1990 00:00:00 GMT
pragma: no-cache
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server: GSE
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

GET
H2 200 styles.css
a.mailmunch.co/app/v1/ 21 KB
3 KB 9ms
8ms Stylesheet
text/css 2600:9000:225e:e400:4:c961:9640:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://a.mailmunch.co/app/v1/styles.css
Requested by: Host: a.mailmunch.co
URL: https://a.mailmunch.co/app/v1/site.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:225e:e400:4:c961:9640:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 437e6e23bb4219f1dd245da75b1729666e71fbf31985189fa35be75702b8cab9

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.oodaloop.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 21 May 2024 01:06:39 GMT
content-encoding: gzip
via: 1.1 a962efd99fafcdb81ca24e0e8140a67c.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P4
age: 55224
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 2274
last-modified: Mon, 20 May 2024 19:30:16 GMT
server: AmazonS3
etag: "dec34a60856955868b068b6062060e4c"
access-control-max-age: 3000
access-control-allow-methods: HEAD, GET, POST, PUT, DELETE
content-type: text/css
access-control-allow-origin: *
access-control-expose-headers: ETag
cache-control: max-age=172800
accept-ranges: bytes
x-amz-cf-id: evkK6_m7-y6d5nSIv0Bqil2MDn9UPSG3PPhaP9mUb8gH5HHoPrOi3Q==

GET
H/1.1 200
OK 713512 Show response
forms.mailmunch.co/sites/ 130 B
1 KB 360ms
113ms XHR
application/json 54.162.128.250
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://forms.mailmunch.co/sites/713512
Requested by: Host: a.mailmunch.co
URL: https://a.mailmunch.co/app/v1/site.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 54.162.128.250 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-162-128-250.compute-1.amazonaws.com
Software: Cowboy / Express
Resource Hash: 7d8431943537d379a7549f66f782ea8b0cf1948fc64a0d7cf7c571ffa4e00272

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.oodaloop.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Tue, 21 May 2024 16:27:02 GMT
Via: 1.1 vegur
Nel: {"report_to":"heroku-nel","max_age":3600,"success_fraction":0.005,"failure_fraction":0.05,"response_headers":["Via"]}
Server: Cowboy
X-Powered-By: Express
Etag: W/"82-NPTdjypfiMQhmoqs/Fa03ikkomA"
Vary: Accept-Encoding
Report-To: {"group":"heroku-nel","max_age":3600,"endpoints":[{"url":"https://nel.heroku.com/reports?ts=1716308822&sid=c46efe9b-d3d2-4a0c-8c76-bfafa16c5add&s=ftDZnCiD%2BaFR8VMXwaE3IX3mlcolKMHkYufacGfLK7w%3D"}]}
Content-Type: application/json; charset=utf-8
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: X-MM-Comp-Tracking, X-MM-EU-Continent, X-MM-T
Connection: keep-alive
Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept, X-MM-Form-Tool, X-MM-Coupons
Content-Length: 130
Reporting-Endpoints: heroku-nel=https://nel.heroku.com/reports?ts=1716308822&sid=c46efe9b-d3d2-4a0c-8c76-bfafa16c5add&s=ftDZnCiD%2BaFR8VMXwaE3IX3mlcolKMHkYufacGfLK7w%3D

POST
H2 204 collect
region1.analytics.google.com/g/ 0
246 B 65ms
18ms Ping
text/plain 2001:4860:4802:32::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://region1.analytics.google.com/g/collect?v=2&tid=G-V7HG71D9F4&gtm=45Pe45f0v9119409757za200&_p=1716308822229&_gaz=1&gcd=13l3l3l2l1&npa=1&dma_cps=sypham&dma=1&gdid=dZTNiMT&cid=1189250238.1716308823&ecid=771786229&ul=de-de&sr=1600x1200&uaa=x86&uab=64&uafvl=Chromium%3B124.0.6367.207%7CGoogle%2520Chrome%3B124.0.6367.207%7CNot-A.Brand%3B99.0.0.0&uamb=0&uam=&uap=Win32&uapv=10.0.0&uaw=0&frm=0&pscdl=noapi&ec_mode=a&_s=1&sid=1716308822&sct=1&seg=0&dl=https%3A%2F%2Fwww.oodaloop.com%2Farchive%2F2024%2F05%2F14%2Fthe-social-engineering-tactics-of-ransomware-as-a-service-operator-black-basta%2F&dt=OODA%20Loop%20-%20The%20Social%20Engineering%20Tactics%20of%20Ransomware-as-a-Service%20Operator%20Black%20Basta&en=page_view&_fv=1&_nsi=1&_ss=1&_ee=1&tfd=818
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=GT-NFPTPRX
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:32::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.oodaloop.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Tue, 21 May 2024 16:27:02 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.oodaloop.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 collect
stats.g.doubleclick.net/g/ 0
255 B 57ms
19ms Ping
text/plain 2a00:1450:400c:c1d::9a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://stats.g.doubleclick.net/g/collect?v=2&tid=G-V7HG71D9F4&cid=1189250238.1716308823&gtm=45Pe45f0v9119409757za200&aip=1&dma=1&dma_cps=sypham&gcd=13l3l3l2l1&npa=1&frm=0
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=GT-NFPTPRX
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:400c:c1d::9a Brussels, Belgium, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.oodaloop.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Tue, 21 May 2024 16:27:02 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.oodaloop.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ga-audiences
www.google.de/ads/ 42 B
63 B 119ms
73ms Image
image/gif 142.250.186.35
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&tid=G-V7HG71D9F4&cid=1189250238.1716308823&gtm=45Pe45f0v9119409757za200&aip=1&dma=1&dma_cps=sypham&gcd=13l3l3l2l1&npa=1&frm=0&z=1127333207

Requested by

Host: www.oodaloop.com
URL: https://www.oodaloop.com/archive/2024/05/14/the-social-engineering-tactics-of-ransomware-as-a-service-operator-black-basta/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.35 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f3.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.oodaloop.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Tue, 21 May 2024 16:27:02 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

/
www.google.de/pagead/1p-conversion/10855864883/
Redirect Chain

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/10855864883/?random=1487805552&cv=11&fst=1716308822548&bg=ffffff&guid=ON&async=1&gtm=45be45f0v9119397723za200&gcd=13l3l3l2l1&dma_cps...
https://www.google.com/pagead/1p-conversion/10855864883/?random=1487805552&cv=11&fst=1716308822548&bg=ffffff&guid=ON&async=1&gtm=45be45f0v9119397723za200&gcd=13l3l3l2l1&dma_cps=sypham&dma=1&u_w=160...
https://www.google.de/pagead/1p-conversion/10855864883/?random=1487805552&cv=11&fst=1716308822548&bg=ffffff&guid=ON&async=1&gtm=45be45f0v9119397723za200&gcd=13l3l3l2l1&dma_cps=sypham&dma=1&u_w=1600...

42 B
64 B

49ms
49ms

Image
image/gif

142.250.186.35
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-conversion/10855864883/?random=1487805552&cv=11&fst=1716308822548&bg=ffffff&guid=ON&async=1&gtm=45be45f0v9119397723za200&gcd=13l3l3l2l1&dma_cps=sypham&dma=1&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.oodaloop.com%2Farchive%2F2024%2F05%2F14%2Fthe-social-engineering-tactics-of-ransomware-as-a-service-operator-black-basta%2F&label=m8haCJKrvKMDELO0vbgo&hn=www.googleadservices.com&frm=0&tiba=OODA%20Loop%20-%20The%20Social%20Engineering%20Tactics%20of%20Ransomware-as-a-Service%20Operator%20Black%20Basta&did=dZTNiMT&gdid=dZTNiMT&gtm_ee=1&npa=1&pscdl=noapi&auid=1411967436.1716308823&uaa=x86&uab=64&uafvl=Chromium%3B124.0.6367.207%7CGoogle%2520Chrome%3B124.0.6367.207%7CNot-A.Brand%3B99.0.0.0&uamb=0&uam=&uap=Win32&uapv=10.0.0&uaw=0&fdr=SA&data=event%3Dconversion&fmt=3&ct_cookie_present=false&sscte=1&crd=CJW3sQIIscGxAgiwwbECCLnBsQI&pscrd=IhMIibjJzZSfhgMVL0gdCR0ReA3CMgIIAzICCAQyAggHMgIICDICCAkyAggKMgIIAjICCAs6GWh0dHBzOi8vd3d3Lm9vZGFsb29wLmNvbS8&is_vtc=1&cid=CAQSGwDaQooL4MXE3ke44RelK2gtm5lWQRFf9IVw-A&random=3740452500&ipr=y

Requested by

Host: www.oodaloop.com
URL: https://www.oodaloop.com/archive/2024/05/14/the-social-engineering-tactics-of-ransomware-as-a-service-operator-black-basta/

Protocol

Server

142.250.186.35 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f3.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9;q=0.9
Referer: https://www.oodaloop.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 21 May 2024 16:27:02 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 21 May 2024 16:27:02 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
location: https://www.google.de/pagead/1p-conversion/10855864883/?random=1487805552&cv=11&fst=1716308822548&bg=ffffff&guid=ON&async=1&gtm=45be45f0v9119397723za200&gcd=13l3l3l2l1&dma_cps=sypham&dma=1&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.oodaloop.com%2Farchive%2F2024%2F05%2F14%2Fthe-social-engineering-tactics-of-ransomware-as-a-service-operator-black-basta%2F&label=m8haCJKrvKMDELO0vbgo&hn=www.googleadservices.com&frm=0&tiba=OODA%20Loop%20-%20The%20Social%20Engineering%20Tactics%20of%20Ransomware-as-a-Service%20Operator%20Black%20Basta&did=dZTNiMT&gdid=dZTNiMT&gtm_ee=1&npa=1&pscdl=noapi&auid=1411967436.1716308823&uaa=x86&uab=64&uafvl=Chromium%3B124.0.6367.207%7CGoogle%2520Chrome%3B124.0.6367.207%7CNot-A.Brand%3B99.0.0.0&uamb=0&uam=&uap=Win32&uapv=10.0.0&uaw=0&fdr=SA&data=event%3Dconversion&fmt=3&ct_cookie_present=false&sscte=1&crd=CJW3sQIIscGxAgiwwbECCLnBsQI&pscrd=IhMIibjJzZSfhgMVL0gdCR0ReA3CMgIIAzICCAQyAggHMgIICDICCAkyAggKMgIIAjICCAs6GWh0dHBzOi8vd3d3Lm9vZGFsb29wLmNvbS8&is_vtc=1&cid=CAQSGwDaQooL4MXE3ke44RelK2gtm5lWQRFf9IVw-A&random=3740452500&ipr=y
content-type: image/gif
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ca-pub-6397933982550253 Show response
fundingchoicesmessages.google.com/i/ 182 KB
61 KB 156ms
72ms Script
application/javascript 2a00:1450:4001:811::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/i/ca-pub-6397933982550253?href=https%3A%2F%2Fwww.oodaloop.com%2Farchive%2F2024%2F05%2F14%2Fthe-social-engineering-tactics-of-ransomware-as-a-service-operator-black-basta&ers=2

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202405150101/show_ads_impl_with_ama_fy2021.js?client=ca-pub-6397933982550253&plah=www.oodaloop.com&aplac=true

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

61565ff0d456c5828881060c0e3911afdf55ca581f692a864b84f967339d6606

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport, script-src 'report-sample' 'nonce-ru4maXP3Ec7hk-M5G0hpEg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.oodaloop.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 21 May 2024 16:27:02 GMT
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport, script-src 'report-sample' 'nonce-ru4maXP3Ec7hk-M5G0hpEg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
reporting-endpoints: default="/_/ContributorServingWebSwitchboardHttp/web-reports?context=eJzjytDikmLw15BiOO90h-k6EBtoPGeyAGKJry-ZNIA45vl01hQgdkqfwRoExD71M1hjgLj15jnWqUCc9O88axEQ71x8gfUgEK86coF1ExC3f77AOh2Iv7FfZP0HxEI8HNembd7EJjBj9YVVzEoaSfmF8cn5eSVFmUmlJflFaclpqcWpRWWpRfFGBkYmBqaGlnoG5vEFBgCMc0Nq"
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
x-frame-options: SAMEORIGIN
content-type: application/javascript; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
timing-allow-origin: *
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 200 rum_fy2021.js Show response
pagead2.googlesyndication.com/pagead/js/r20240516/r20110914/ 60 KB
23 KB 35ms
35ms Script
text/javascript 216.58.206.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20240516/r20110914/rum_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.206.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lhr35s11-in-f2.1e100.net

Software

cafe /

Resource Hash

d2dc56e246b992bd88e572e9c94963f5ddaa9919254cdcb66c3156fc32171f1f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.oodaloop.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 21 May 2024 14:37:11 GMT
content-encoding: br
x-content-type-options: nosniff
age: 6591
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 23120
x-xss-protection: 0
server: cafe
etag: 4870173243350855795
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 04 Jun 2024 14:37:11 GMT

GET
H2 200 AGSKWxULsDfIwzIDdG3j2uY4vH0btHt9ukManTIl-bwz2t8N_0k3EFF8x_2P6RX0E7cJMuCkbC-9Woo6jatDWD8aorCRx6uZ_u09lXoEWLVCMoO6KltTUrNlhrahsCQlENjDWQ8GeFH-ng== Show response
fundingchoicesmessages.google.com/f/ 401 KB
61 KB 152ms
151ms Script
application/javascript 2a00:1450:4001:811::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/f/AGSKWxULsDfIwzIDdG3j2uY4vH0btHt9ukManTIl-bwz2t8N_0k3EFF8x_2P6RX0E7cJMuCkbC-9Woo6jatDWD8aorCRx6uZ_u09lXoEWLVCMoO6KltTUrNlhrahsCQlENjDWQ8GeFH-ng==?fccs=W251bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLFsxNzE2MzA4ODIzLDkwMDAwMDBdLG51bGwsbnVsbCxudWxsLFtudWxsLFs3XV0sImh0dHBzOi8vd3d3Lm9vZGFsb29wLmNvbS9hcmNoaXZlLzIwMjQvMDUvMTQvdGhlLXNvY2lhbC1lbmdpbmVlcmluZy10YWN0aWNzLW9mLXJhbnNvbXdhcmUtYXMtYS1zZXJ2aWNlLW9wZXJhdG9yLWJsYWNrLWJhc3RhLyIsbnVsbCxbWzgsIndTbkxaNzNhWkE4Il0sWzksImRlIl0sWzE4LCJbW1swXV1dIl0sWzE5LCIxIl0sWzE3LCJbMF0iXV1d

Requested by

Host:
URL: /_/mss/boq-content-ads-contributor/_/js/k=boq-content-ads-contributor.ContributorServingResponseClientJs.de.wSnLZ73aZA8.es5.O/am=AgM/d=1/rs=AJlcJMxeKgdi-f7jXnY428K6uLgpXRKHTQ/m=kernel_loader,loader_js_executable

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

a65a7256816c7117d334b6e374fc322ca719524a7f0e1a90e78bc257fc6ebc93

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-zz3zK_9pMS7LgQShrfsjig' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.oodaloop.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 21 May 2024 16:27:03 GMT
content-security-policy: script-src 'report-sample' 'nonce-zz3zK_9pMS7LgQShrfsjig' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
reporting-endpoints: default="/_/ContributorGlobalRouterHttp/web-reports?context=eJzjytDikmII1JBiOO90h-k6EBtoPGeyAGKJry-ZNIA45vl01hQgdkqfwRoExD71M1hjgLj15jnWqUCc9O88axEQ71x8gfUgEK86coF1ExC3f77AOh2Iv7FfZP0HxELcHNenbd7EJnDg821bJY2k_ML45Py8kqLMpNKS_KK05LTU4tSistSieCMDIxMDU0NLPQPz-AIDAFuHQ3c"
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
x-frame-options: SAMEORIGIN
content-type: application/javascript; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
timing-allow-origin: *
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H2 200 settings-1716230621.json Show response
a.mailmunch.co/forms-cache/713512/ 1 KB
1 KB 23ms
8ms XHR
application/json 2600:9000:225e:e400:4:c961:9640:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://a.mailmunch.co/forms-cache/713512/settings-1716230621.json
Requested by: Host: a.mailmunch.co
URL: https://a.mailmunch.co/app/v1/site.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:225e:e400:4:c961:9640:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: e302aa44f78b7463c3032a2527ac6cfd80efc88a8e08cb4b0756661495f95c78

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.oodaloop.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Mon, 20 May 2024 18:52:42 GMT
content-encoding: gzip
via: 1.1 307395f1eb3989f15e6f525475291c86.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P4
age: 77662
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
last-modified: Mon, 20 May 2024 18:43:47 GMT
server: AmazonS3
etag: W/"5907a89baebe8e2b1a3cd260faf0cf58"
access-control-max-age: 3000
access-control-allow-methods: HEAD, GET, POST, PUT, DELETE
content-type: application/json; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: ETag
cache-control: max-age=31556952
vary: Accept-Encoding
x-amz-cf-id: 0YvBzDywRoceaswg7-k21ovzgZAILKuojOvvzskfb7C6h-lSF1JJZQ==

GET
H2 200 popover.js Show response
a.mailmunch.co/app/v1/ 9 KB
3 KB 12ms
9ms Script
text/javascript 2600:9000:225e:e400:4:c961:9640:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://a.mailmunch.co/app/v1/popover.js
Requested by: Host: ajax.googleapis.com
URL: https://ajax.googleapis.com/ajax/libs/jquery/1.11.3/jquery.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:225e:e400:4:c961:9640:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 81a7d8a047857c04f34dee91793ff2474128f76e8339511607f80a27179fc65b

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.oodaloop.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Mon, 20 May 2024 05:17:48 GMT
content-encoding: gzip
via: 1.1 a962efd99fafcdb81ca24e0e8140a67c.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P4
age: 126556
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 2274
last-modified: Mon, 20 May 2024 01:51:12 GMT
server: AmazonS3
etag: "7c235d6428b5bf36d8e8a88b9659acd8"
access-control-max-age: 3000
access-control-allow-methods: HEAD, GET, POST, PUT, DELETE
content-type: text/javascript
access-control-allow-origin: *
access-control-expose-headers: ETag
cache-control: max-age=172800
accept-ranges: bytes
x-amz-cf-id: Vlv6BYiDRXT23rJJwwoy2T1ecvZGgUtMep0zm__2YnmRBWpZWwggSQ==

GET
H2 200 index-1714592127.html Show response
a.mailmunch.co/forms-cache/713512/847257/ 111 KB
39 KB 9ms
9ms XHR
text/html 2600:9000:225e:e400:4:c961:9640:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://a.mailmunch.co/forms-cache/713512/847257/index-1714592127.html
Requested by: Host: a.mailmunch.co
URL: https://a.mailmunch.co/app/v1/site.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:225e:e400:4:c961:9640:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: e476e40fbff7eef8d7e080548bd4311844a27df1e2c6563ae3cde43b75b1d3cf

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.oodaloop.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 01 May 2024 19:38:29 GMT
content-encoding: gzip
via: 1.1 307395f1eb3989f15e6f525475291c86.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P4
age: 1716515
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
last-modified: Wed, 01 May 2024 19:35:35 GMT
server: AmazonS3
etag: W/"42efffa1b1b8c3079f42dc8956c701a9"
access-control-max-age: 3000
access-control-allow-methods: HEAD, GET, POST, PUT, DELETE
content-type: text/html; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: ETag
cache-control: max-age=31556952
vary: Accept-Encoding
x-amz-cf-id: SKzVYo_U9RNoJSQTYrTT2tfGlBBCZoEQLv8M8C1mEb6uezMUjO4rIw==

GET
H2 200 index.css
a.mailmunch.co/v2/themes/mailmunch/expressions/popover/ Frame 2097 12 KB
5 KB 7ms
7ms Stylesheet
text/css 2600:9000:225e:e400:4:c961:9640:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://a.mailmunch.co/v2/themes/mailmunch/expressions/popover/index.css
Requested by: Host: a.mailmunch.co
URL: https://a.mailmunch.co/app/v1/site.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:225e:e400:4:c961:9640:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 86b1fbee69e8dd74e41ecca14a73e529082f9a8a79d5cfb44ffc434b728cae0b

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.oodaloop.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Mon, 20 May 2024 06:11:17 GMT
content-encoding: gzip
via: 1.1 a962efd99fafcdb81ca24e0e8140a67c.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P4
age: 123837
x-cache: Hit from cloudfront
last-modified: Wed, 08 Jan 2020 12:11:36 GMT
server: AmazonS3
etag: W/"4a3cd82ff542ebab8c044fb7e17cf149"
access-control-max-age: 3000
access-control-allow-methods: HEAD, GET, POST, PUT, DELETE
content-type: text/css
access-control-allow-origin: *
access-control-expose-headers: ETag
cache-control: max-age=172800
vary: Accept-Encoding
x-amz-cf-id: MzTYuSHcrOTnY6BwI2cw3xhN4sBO2-svGak3RJiVRi0Y4ku07arAOQ==

GET
H2 200 css
fonts.googleapis.com/ Frame 2097 9 KB
2 KB 46ms
46ms Stylesheet
text/css 2a00:1450:4001:80f::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Maven+Pro:400,500,700|Open+Sans

Requested by

Host: a.mailmunch.co
URL: https://a.mailmunch.co/v2/themes/mailmunch/expressions/popover/index.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

fd06ca64dc53efba33a0e25fc2f3edca4b5d3b29364eb1b6226dde2b17dd2722

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://a.mailmunch.co/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

strict-transport-security: max-age=31536000
date: Tue, 21 May 2024 16:27:03 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Tue, 21 May 2024 16:27:03 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Tue, 21 May 2024 16:27:03 GMT

GET
DATA 200
OK truncated
/ Frame 2097 2 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: dc14bd28f43f549eda3f6d6aebffd558265d6ac82a42024322bbe567c3034908

Request headers

Accept-Language: de-DE,de;q=0.9;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 OODA-Facebook-PDB.jpg
a.mailmunch.co/attachments/assets/000/229/696/large/ Frame 2097 44 KB
44 KB 9ms
9ms Image
image/jpeg 2600:9000:225e:e400:4:c961:9640:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://a.mailmunch.co/attachments/assets/000/229/696/large/OODA-Facebook-PDB.jpg?1575390434
Requested by: Host: www.oodaloop.com
URL: https://www.oodaloop.com/archive/2024/05/14/the-social-engineering-tactics-of-ransomware-as-a-service-operator-black-basta/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:225e:e400:4:c961:9640:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 6655088452ef85873b726502df4b37108a3cdfab3371ff8de76064070ed4526f

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.oodaloop.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Sun, 29 Oct 2023 08:54:21 GMT
via: 1.1 a962efd99fafcdb81ca24e0e8140a67c.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P4
age: 17739163
x-cache: Hit from cloudfront
content-length: 44810
last-modified: Tue, 03 Dec 2019 16:27:16 GMT
server: AmazonS3
etag: "ac52c4baa0ba89cc326aa206c8411fe6"
access-control-max-age: 3000
access-control-allow-methods: HEAD, GET, POST, PUT, DELETE
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: ETag
cache-control: max-age=31556952
accept-ranges: bytes
x-amz-cf-id: 8FryBn6VuatPW0eEUZMoVu7jilkefJiSIOHBZbZ0_RmhzlXPP7BLqg==
expires: Thu, 03 Dec 2020 16:27:14 GMT

GET
H2 200 7Au9p_AqnyWWAxW2Wk3GzWQI.woff2
fonts.gstatic.com/s/mavenpro/v36/ Frame 2097 20 KB
20 KB 41ms
40ms Font
font/woff2 2a00:1450:4001:802::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/mavenpro/v36/7Au9p_AqnyWWAxW2Wk3GzWQI.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Maven+Pro:400,500,700|Open+Sans

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:802::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8adeed9f90d6d8d483a208f54d5733a0336ee6888436fe8e2e5fb1c41433eaec

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://fonts.googleapis.com/
Origin: https://www.oodaloop.com
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 21 May 2024 04:05:59 GMT
x-content-type-options: nosniff
age: 44464
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 20064
x-xss-protection: 0
last-modified: Thu, 11 Apr 2024 18:32:51 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 21 May 2025 04:05:59 GMT

GET
H2 200 memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsjZ0B4gaVI.woff2
fonts.gstatic.com/s/opensans/v40/ Frame 2097 18 KB
18 KB 36ms
36ms Font
font/woff2 2a00:1450:4001:802::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v40/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsjZ0B4gaVI.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Maven+Pro:400,500,700|Open+Sans

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:802::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e7af9d60d875eb1c1b1037bbbfdec41fcb096d0ebcf98a48717ad8b07906ced6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://fonts.googleapis.com/
Origin: https://www.oodaloop.com
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 21 May 2024 14:40:14 GMT
x-content-type-options: nosniff
age: 6409
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 18668
x-xss-protection: 0
last-modified: Thu, 14 Dec 2023 02:00:39 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 21 May 2025 14:40:14 GMT

GET
H3 200 css
fonts.googleapis.com/ 109 KB
6 KB 50ms
50ms Stylesheet
text/css 142.250.185.202
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host:
URL: /_/mss/boq-content-ads-contributor/_/js/k=boq-content-ads-contributor.ContributorServingResponseClientJs.de.wSnLZ73aZA8.es5.O/d=1/exm=kernel_loader,loader_js_executable/ed=1/rs=AJlcJMz1hbaazwb7qJTda4GQvZjDWfjCYg/m=web_iab_tcf_v2_wall_executable

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.202 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s52-in-f10.1e100.net

Software

ESF /

Resource Hash

6b7dfb79b63e4202eaad4d930a87c85325776c5b800a672363283ad3dc73af1c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.oodaloop.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

strict-transport-security: max-age=31536000
date: Tue, 21 May 2024 16:27:03 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Tue, 21 May 2024 16:27:03 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Tue, 21 May 2024 16:27:03 GMT

GET
H3 200 KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v18/ 15 KB
15 KB 36ms
36ms Font
font/woff2 216.58.206.67
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v18/KFOmCnqEu92Fr1Mu4mxK.woff2

Requested by

Host: www.oodaloop.com
URL: https://www.oodaloop.com/archive/2024/05/14/the-social-engineering-tactics-of-ransomware-as-a-service-operator-black-basta/

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.206.67 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lhr35s11-in-f3.1e100.net

Software

sffe /

Resource Hash

3e253b66056519aa065b00a453bac37ac5ed8f3e6fe7b542e93a9dcdcc11d0bc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.oodaloop.com/
Origin: https://www.oodaloop.com
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Fri, 17 May 2024 23:56:39 GMT
x-content-type-options: nosniff
age: 318624
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15344
x-xss-protection: 0
last-modified: Mon, 16 Oct 2017 17:32:55 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 17 May 2025 23:56:39 GMT

GET
H3 200 memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2
fonts.gstatic.com/s/opensans/v40/ 47 KB
47 KB 36ms
36ms Font
font/woff2 216.58.206.67
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2

Requested by

Host: www.oodaloop.com
URL: https://www.oodaloop.com/archive/2024/05/14/the-social-engineering-tactics-of-ransomware-as-a-service-operator-black-basta/

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.206.67 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lhr35s11-in-f3.1e100.net

Software

sffe /

Resource Hash

3c4d6a1421c7ddb7e404521fe8c4cd5be5af446d7689cd880be26612eaad3cfa

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.oodaloop.com/
Origin: https://www.oodaloop.com
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 21 May 2024 00:50:53 GMT
x-content-type-options: nosniff
age: 56170
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 48236
x-xss-protection: 0
last-modified: Thu, 14 Dec 2023 02:08:40 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 21 May 2025 00:50:53 GMT

GET
H3 200 flUhRq6tzZclQEJ-Vdg-IuiaDsNc.woff2
fonts.gstatic.com/s/materialicons/v142/ 125 KB
125 KB 51ms
51ms Font
font/woff2 216.58.206.67
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/materialicons/v142/flUhRq6tzZclQEJ-Vdg-IuiaDsNc.woff2

Requested by

Host: www.oodaloop.com
URL: https://www.oodaloop.com/archive/2024/05/14/the-social-engineering-tactics-of-ransomware-as-a-service-operator-black-basta/

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.206.67 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lhr35s11-in-f3.1e100.net

Software

sffe /

Resource Hash

8265f64786397d6b832d1ca0aafdf149ad84e72759fffa9f7272e91a0fb015d1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.oodaloop.com/
Origin: https://www.oodaloop.com
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 21 May 2024 14:16:48 GMT
x-content-type-options: nosniff
age: 7815
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 128352
x-xss-protection: 0
last-modified: Mon, 08 Apr 2024 19:04:47 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 21 May 2025 14:16:48 GMT

POST
H3 204 AGSKWxVHEnlD1kD2bmsS8i19QaXt3Jz4M53qQQhwVlHHRVFoCg2TfiOGYQD0x7PizsDzJM3KX8n_b2WccHvHS1JaIRHXDTAkeooRJhdpwsYKX6mFFQ4YhF6JE7PJBgC4YvqAfT9SARbhwQ== Show response
fundingchoicesmessages.google.com/el/ 0
29 B 118ms
46ms XHR
text/html 142.250.185.174
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxVHEnlD1kD2bmsS8i19QaXt3Jz4M53qQQhwVlHHRVFoCg2TfiOGYQD0x7PizsDzJM3KX8n_b2WccHvHS1JaIRHXDTAkeooRJhdpwsYKX6mFFQ4YhF6JE7PJBgC4YvqAfT9SARbhwQ==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.174 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s51-in-f14.1e100.net

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-MstUf2KTnqs4Af_IO_KA5g' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
sec-ch-ua-platform: "Win32"
Referer: https://www.oodaloop.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Content-Type: text/plain

Response headers

date: Tue, 21 May 2024 16:27:03 GMT
content-security-policy: script-src 'report-sample' 'nonce-MstUf2KTnqs4Af_IO_KA5g' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
reporting-endpoints: default="/_/ContributorLoggingHttp/web-reports?context=eJzjEtDikmJw05BicEqfwRoCxEI8HNenbd7EJrDg_cFpjEouSfmF8cn5eSWpeSW6iSnFuiB2UWZSaUl-EQo7tQykIic_PT0zLz3eyMDIxMDU0FLPwDy-wAAAvhQiqA"
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
access-control-max-age: 86400
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
content-type: text/html; charset=utf-8
access-control-allow-origin: https://www.oodaloop.com
access-control-allow-methods: POST, GET, OPTIONS
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
x-frame-options: SAMEORIGIN
expires: Mon, 01 Jan 1990 00:00:00 GMT

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxVHEnlD1kD2bmsS8i19QaXt3Jz4M53qQQhwVlHHRVFoCg2TfiOGYQD0x7PizsDzJM3KX8n_b2WccHvHS1JaIRHXDTAkeooRJhdpwsYKX6mFFQ4YhF6JE7PJBgC4YvqAfT9SARbhwQ==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.174 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s51-in-f14.1e100.net

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-kAmYw7ulOrNwTqD0VTGVHg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
sec-ch-ua-platform: "Win32"
Referer: https://www.oodaloop.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Content-Type: text/plain

Response headers

date: Tue, 21 May 2024 16:27:03 GMT
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-kAmYw7ulOrNwTqD0VTGVHg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
reporting-endpoints: default="/_/ContributorLoggingHttp/web-reports?context=eJzjEtDikmJw05BicEqfwRoCxEI8HNenbd7EJjDh7YnljEouSfmF8cn5eSWpeSW6iSnFuiB2UWZSaUl-EQo7tQykIic_PT0zLz3eyMDIxMDU0FLPwDy-wAAAv5cirg"
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
access-control-max-age: 86400
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
content-type: text/html; charset=utf-8
access-control-allow-origin: https://www.oodaloop.com
access-control-allow-methods: POST, GET, OPTIONS
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
x-frame-options: SAMEORIGIN
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 200 cropped-ooda-512x512-32x32.png
www.oodaloop.com/wp-content/uploads/2018/12/ 964 B
1 KB 79ms
78ms Other
image/webp 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.oodaloop.com/wp-content/uploads/2018/12/cropped-ooda-512x512-32x32.png
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 96fba69581fe3f01aed64a7a9a9ce7063529a812767ac550eb986085df784b4c

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.oodaloop.com/archive/2024/05/14/the-social-engineering-tactics-of-ransomware-as-a-service-operator-black-basta/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 21 May 2024 16:27:03 GMT
cf-cache-status: HIT
age: 39819
cf-polished: origFmt=png, origSize=1816
content-disposition: inline; filename="cropped-ooda-512x512-32x32.webp"
alt-svc: h3=":443"; ma=86400
content-length: 964
cf-bgj: imgq:100,h2pri
last-modified: Mon, 25 Mar 2024 20:36:48 GMT
server: cloudflare
etag: "6601e060-718"
vary: Accept
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
cf-ray: 8875ee82194d9731-FRA

GET
H2 200 t.gif
pixel.wp.com/ 43 B
170 B 6ms
6ms Image
image/gif 192.0.76.3
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.wp.com/t.gif?blog=34662112&post=265404&blog_id=34662112&jetpack_version=13.3.1&_ui=U3uVeb0GahQhhCIkf3Pr6HV%2B&_ut=anon&_en=jetpack_pageview_timing&_ts=1716308823462&_tz=-2&_lg=de-DE&_pf=Win32&_ht=1200&_wd=1600&_sx=0&_sy=0&_dl=https%3A%2F%2Fwww.oodaloop.com%2Farchive%2F2024%2F05%2F14%2Fthe-social-engineering-tactics-of-ransomware-as-a-service-operator-black-basta%2F&_dr=&conn_type=4g&conn_rtt=50&conn_downlink=10&protocol=h2&dns_latency=0&conn_latency=30&resp_latency=203&resp_duration=5&dom_interact=481&dom_load=498&page_load=1527&files_origin=16&files_ext=34&files_ssl=50&files_http1=25&files_http2=8&files_js=17&files_css=8&files_img=4&files_font=4&files_other=17&duration_js=2371&duration_css=704&duration_img=343&duration_font=397&duration_other=3263&first_paint=523&first_cf_paint=523&rand=0.6634871272169778
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.76.3 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.oodaloop.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

access-control-allow-origin: *
date: Tue, 21 May 2024 16:27:03 GMT
cache-control: no-cache
server: nginx
alt-svc: h3=":443"; ma=86400
content-length: 43
content-type: image/gif

POST
H2 204 csi
csi.gstatic.com/ 0
234 B 1075ms
368ms Ping
image/gif 2404:6800:4007:827::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://csi.gstatic.com/csi?v=2&s=pagead&action=csi_pagead&dmc=8&top=1&puid=1~lwglyja3&c=3435391302796566&e=44759875%2C44759926%2C44759842%2C42532242%2C44795922%2C95331690%2C95331983%2C31061691%2C31061693&ctx=1&met.3=782.hx~1001.hv_2__1~164.hy~165.hu_4~166.hk_e~1032.p7~326.q1~832.q2~868.q2~216.p7_v~215.p7_v~843.p6_w~112.r4_1~113.16o&met.7=CBsQCMAB7vayhQw~CBsQByD4AThcwAG5lotJ~CBsQByD4ATiDAcABvc3B_Ak~CBsQByD4ATh6wAHtuqjDAQ~CBIQBxgBIPgBKPgBMIUDOI0BUPsBWNQCYJ4CaNQCcIQDeJEQgAHlDYgB53-qASoKGkFsZWdyZXlhK1NhbnM6NDAwLDQwMGksNzAwCgxMb3JhOjQwMCw3MDCwAQG4AQPAAdbHu8gK~CBsQByD4AThNwAGqpqOBBw~CBsQByD4AThOwAGc_M8L~CBsQCiD4ATg4wAGEj8i1BA~CBsQCiD4ATjKAcAB97muggw~CBsQChgBIPgBKPgBMI4FOJYDwAGM1djrBA~CBsQChgBIPgBKPgBMJYFOJ4DwAGM1djrBA~CBsQChgBIPgBKPgBMIADOIcBwAHVi72SDA~CBsQCiD4ATj0AcAB0aWCHA~CAEQChgBIPgBKPgBMOsEOPMCQIwDSIwDUIwDWNkDYIwDaNkDcLMEeIiaA4AB3JcDiAHAugmwAQG4AQPAAd6Ov5sB~CBsQCiD4ATgfwAGoz86WDA~CBsQCiD4ATj0AcABgsjvmA8~CBsQCiCLAzhVwAHT_86tCQ~CBsQChgBIJIDKJIDMJAFOP4BwAGBlNbVDg~CBsQBiCTAzgSwAHx0LWSDA~CBsQAiCYAziFAcABiI2gzwo~CBsQAiCaAzh6wAHSraChBg~CBsQChgBIOcDKOcDMJ8FOLgBUOgDWMEEYI8EaMIEcOoEeI-IAoAB44UCiAH47QWwAQG4AQPAAbyAgrYH~CBsQBiDvAzhxwAGfxOqFDQ~CBsQCiDyAzg3wAHdntqpCg~CBsQCiDyAzg4wAHd0suSBA~CBsQCiDyAzhlwAH42fzWCw~CBsQCiCtBDgvwAHdntqpCg~CBsQBSC0BDhTwAGJ8v2dBw~CAMQChgBIIMFKIMFMIMHOIACUIQFWNAFYIQFaNEFcK8GeM7kCIABouIIiAGR-RmwAQG4AQPAAa-A-b8O~CBsQChgBILUFKLUFMKgGOHTAAYzV2OsE~CBsQChgBIMwFKMwFMLUGOGlA0AVI0AVQ0AVY_AVg0AVo_QVwsQZ4sg-AAYYNiAGfF7ABAbgBA8AB-qe8zQs~CBsQByCdBjgKwAHVv-mZAw~CBsQARgBILMGKLMGMPUGOELAAYCw2fQC~CCgQARgBILMGKLMGMO4GODvAAdPno8oF~CBsQBhgBILMGKLMGMKwHOHlAtAZItQZQtQZY4gZgtQZo4gZwqwd41gKAASqIASqwAQG4AQPAAf23jOYB~CBwQChgBIKkHKKkHMM4HOCVoqQdwzQd4_LYBgAHQtAGIAe7cA7ABAbgBA8ABwfvejAo~CCgQBhgBIMEGKPQHMKYIOOUBaPUHcKUIeNYCgAEqiAEqkAHBBpgB9AewAQG4AQPAAf2f-84P~CD8QChgBIKgHKKgHMIMJONoBUK4HWPwHYNEHaPwHcMMIeN3fA4ABsd0DiAGurQuwAQG4AQPAAaaSqO8B~CBsQDSCeBjjpAsABuoL0gAU~CBsQDSCYCTgYwAGnj-XKDA~CBsQCiCyCTgNwAGthuPiAQ~CBsQDSDGCTgMwAGYhN_9AQ~CBsQBRgBINwFKNwFMLMKONcEwAH7vKLmAQ~CD8QChgBIJYJKJYJMMgKOLIBaJcJcK4KeJXnA4AB6eQDiAGVhhmwAQG4AQPAAbHqkZwG~CBIQBxgBINgKKNgKMIsLODRo2Apwigt43S6AAbEsiAHb6waqAYcECg9BcmNoaXZvOjQwMCw1MDAKDUFyaW1vOjQwMCw1MDAKDkJpdHRlcjo0MDAsNTAwChNFQitHYXJhbW9uZDo0MDAsNTAwCgRMYXRvChBMaWJyZStCYXNrZXJ2aWxsChZMaWJyZStGcmFua2xpbjo0MDAsNTAwCgxMb3JhOjQwMCw1MDAKIkdvb2dsZStTYW5zOnJlZ3VsYXIsbWVkaXVtOjQwMCw1MDAKDk1hdGVyaWFsK0ljb25zCg5Hb29nbGUrU3ltYm9scwoMTWVycml3ZWF0aGVyChJNb250c2VycmF0OjQwMCw1MDAKDU11a3RhOjQwMCw1MDAKDE11bGk6NDAwLDUwMAoOTnVuaXRvOjQwMCw1MDAKFU9wZW4rU2Fuczo0MDAsNTAwLDYwMAobT3BlbitTYW5zK0NvbmRlbnNlZDo0MDAsNjAwCgpPc3dhbGQ6NTAwChhQbGF5ZmFpcitEaXNwbGF5OjQwMCw1MDAKD1BvcHBpbnM6NDAwLDUwMAoPUmFsZXdheTo0MDAsNTAwCg5Sb2JvdG86NDAwLDUwMAoYUm9ib3RvK0NvbmRlbnNlZDo0MDAsNTAwChNSb2JvdG8rU2xhYjo0MDAsNTAwCgpTbGFibysyN3B4Cg9Tb3VyY2UrU2FucytQcm8KDlVidW50dTo0MDAsNTAwCgdWb2xraG92sAEBuAEDwAHWx7vICg~CBMQAhgBIOYKKOYKMI4LOCho6ApwjAt4nHqAAfB3iAHwd6oBDAoGcm9ib3RvEBIYArABAbgBA8ABuL_25wo~CBMQAhgBIOwKKOwKMNALOGRo8wpwlwt4mPsCgAHs-AKIAez4AqoBDgoIb3BlbnNhbnMQKBgCsAEBuAEDwAGQr5TSDw~CD8QDRgBIPEKKPEKMOgLOHfAAdz765EB~CBsQCDj-C8AB7vayhQw~CBMQAhgBIOwKKOwKMPMLOIcBaPQKcKcLeIztB4AB4OoHiAHg6geqARQKDW1hdGVyaWFsaWNvbnMQjgEYArABAbgBA8ABmqG8zQo~CD8QDRgBIPEKKPEKMIsMOJoBwAHc--uRAQ~CBsggQw4UMABiryFtwY~CBsQBiDcDDgHwAHFvf3GDA&met.1=1.lwglyiiz~6.1~7.9~8.9~9.9~10.13~11.g~12.13~13.6q~14.6v~15.6u~16.dd~17.du~18.dv~19.16f~20.16f~21.16m~22.ej~23.ej
Requested by: Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20240516/r20110914/rum_fy2021.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2404:6800:4007:827::2003 , Australia, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.oodaloop.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Tue, 21 May 2024 16:27:05 GMT
last-modified: Wed, 21 Jan 2004 19:51:30 GMT
server: Golfe2
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Verdicts & Comments Add Verdict or Comment

102 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

6 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.www.oodaloop.com/	1970-01-20 20:45:10	Name: __cf_bm Value: NZRPT2WJgSxRZuPEmZ9Sc.iqzd0gzrXRHW2aZsGrmz0-1716308822-1.0.1.1-PqQjxNxk_QsklSqo.u1UPkO5OefIKJrKgt.ktGKbY6E0INisH6ytdGAfIsJ7J65mmLvQoqZqQqYnxoqmAcIGDw
.memberful.com/	1970-01-20 20:45:10	Name: __cf_bm Value: WPO2w1uik73AXy5LQT1RszPjiW3DBby7rHyvly8qlhg-1716308822-1.0.1.1-dsKTGUgP3AvKl8ZYAS2ASdzOcOJMxB9PprwYbpwef0wC_foscR4SugWpGb_pZVuspmP0Ua8BQiT96f1ykElc_g
.oodaloop.com/	1970-01-20 22:54:44	Name: _gcl_au Value: 1.1.1411967436.1716308823
.oodaloop.com/	1970-01-21 06:21:08	Name: _ga_V7HG71D9F4 Value: GS1.1.1716308822.1.0.1716308822.60.0.771786229
.oodaloop.com/	1970-01-21 06:21:08	Name: _ga Value: GA1.1.1189250238.1716308823
.doubleclick.net/	1970-01-20 20:45:09	Name: test_cookie Value: CheckForPermission

2 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
other	warning	URL: https://www.oodaloop.com/archive/2024/05/14/the-social-engineering-tactics-of-ransomware-as-a-service-operator-black-basta/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.oodaloop.com/archive/2024/05/14/the-social-engineering-tactics-of-ransomware-as-a-service-operator-black-basta/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

a.mailmunch.co
ajax.googleapis.com
connect.facebook.net
csi.gstatic.com
fonts.googleapis.com
fonts.gstatic.com
forms.mailmunch.co
fundingchoicesmessages.google.com
googleads.g.doubleclick.net
js.memberful.com
pagead2.googlesyndication.com
pixel.wp.com
platform.twitter.com
region1.analytics.google.com
stats.g.doubleclick.net
stats.wp.com
unpkg.com
use.fontawesome.com
www.google.com
www.google.de
www.googleadservices.com
www.googletagmanager.com
www.gstatic.com
www.oodaloop.com
141.193.213.20
142.250.185.174
142.250.185.202
142.250.186.34
142.250.186.35
142.250.74.196
157.240.252.13
192.0.76.3
2001:4860:4802:32::36
216.58.206.66
216.58.206.67
2404:6800:4007:827::2003
2600:9000:225e:e400:4:c961:9640:93a1
2606:2800:234:46c:e8b:1e2f:2bd:694
2606:4700:3036::6815:1b98
2606:4700::6810:5517
2606:4700::6811:f7cb
2a00:1450:4001:802::2003
2a00:1450:4001:80f::200a
2a00:1450:4001:811::200e
2a00:1450:4001:812::2003
2a00:1450:4001:81c::200a
2a00:1450:4001:82f::2008
2a00:1450:400c:c1d::9a
2a03:2880:f084:d:face:b00c:0:3
54.162.128.250
0621eb72d5d6f1ba4cbcc02004542ef29ef5df7bacd8333b998748c023932413
081ac69ac1c26248a32f4c811f6da10c47bd32f65885774088e8de666f4e912f
0d2d86f777e0d337003688892e001abea8d2491bc41e19b6567680d26a442f57
159043fcb16dd5c9a4b6a80581f7a91dc5987665ea5f7851da6c29fba0615a64
16a2619b4d831694734838f42d825eb871ee5160d241900b780ad523404b1c50
173460e89e6a7244218badae2016f65c48a3eae9d400802273eeca18b07336f1
1ffbb287a98de3687cd33154fab1663fe694c4ee8ea0dc3ce9de5755e4bdc4ef
226f20ef48a03fe5227af3a439134e218b7d90c21c898dea9d863b6ff6ee1bc9
2c828a6328d08ad192f383f0b5416e7877ee0e29126a77f59361efc4d0bcd159
358b77e66f715be7f5676feec15e05ec8292a165f99ea95b345cf87adc075ede
381dc11d7c7d3b9adc3db82512d3d81683b49db6ae6a2bf24ec04cf3da813cc8
3c4d6a1421c7ddb7e404521fe8c4cd5be5af446d7689cd880be26612eaad3cfa
3e253b66056519aa065b00a453bac37ac5ed8f3e6fe7b542e93a9dcdcc11d0bc
437e6e23bb4219f1dd245da75b1729666e71fbf31985189fa35be75702b8cab9
48603ddd070422856ca75db4ad323ea234a4a50b03a5a6614a4427f1834f6e4d
4e6ce5444c7f396cef0eb1fa3611034151e485dd06fbe5573a5583e1eebc98c3
4f9f4e2e225088f9cf3b6b54aa421e0f776d1802255505d2f752e1f83f441641
51be7f465c85cfe6d4f652c038711ca45c04f65fea1cdd4056a3e249529cc98d
5b9f9afe7621ec465573f58064f5bef3a229e5e19362351168fd211f6a28bb5c
61565ff0d456c5828881060c0e3911afdf55ca581f692a864b84f967339d6606
617455141e3440795156407841063af4a97062b10c1b7538260fa146967121d0
6655088452ef85873b726502df4b37108a3cdfab3371ff8de76064070ed4526f
6752b9ba151a25703b2e5d17ad9ff42615f8940b591694fa8e42ab1034f476b5
6b7dfb79b63e4202eaad4d930a87c85325776c5b800a672363283ad3dc73af1c
704be67365fbb4ebba6cacbda38743bff2e339c9a5c6312791b9e4146124bfef
7d8431943537d379a7549f66f782ea8b0cf1948fc64a0d7cf7c571ffa4e00272
7ee94ef3aa7fd1a31dd1158b333ed82d41eed96790b59cfa1d4bf96fb0c648c1
81a7d8a047857c04f34dee91793ff2474128f76e8339511607f80a27179fc65b
8265f64786397d6b832d1ca0aafdf149ad84e72759fffa9f7272e91a0fb015d1
839b1145547ce6dcba32c1aeb4f578ed46847751fe8f5c7d2e427be44b9e03c2
86b1fbee69e8dd74e41ecca14a73e529082f9a8a79d5cfb44ffc434b728cae0b
8adeed9f90d6d8d483a208f54d5733a0336ee6888436fe8e2e5fb1c41433eaec
92bd8b6080ab6c3f23202c8206287cadbd8d4f243e3c63899f5a2aca52b36730
96fba69581fe3f01aed64a7a9a9ce7063529a812767ac550eb986085df784b4c
a65a7256816c7117d334b6e374fc322ca719524a7f0e1a90e78bc257fc6ebc93
a7ae4f4e313e150000175511c29ca19ae2948eb663987253d19a9372cc20e3fe
a9df188b784b6ee44c3aa3a155f289c4e9990a61dc3d79f41041540e9168b831
aec3d419d50f05781a96f223e18289aeb52598b5db39be82a7b71dc67d6a7947
b15252e033a8cb7de71e1d26972637a6197579e95d5819dde74dea1a580763f5
c21e5a2b32c47bc5f9d9efc97bc0e29fd081946d1d3ebffc5621cfafb1d3960e
c4fada4accfa24704b54248bc5ce84acac50b6a059828b7714fe3006786c80c1
c61287c2fa9863b5fb5844c683a168ac6520c94d822bb43d5eae35c3a2a82166
cae4ee013f217f9c449fe04eb87cb87fd2790a80a8021afdf97575eb65479b2f
cb6f2d32c49d1c2b25e9ffc9aaafa3f83075346c01bcd4ae6eb187392a4292cf
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
d0960c1bb4516a7fb635268bef895f81408bc432fd7c4d0737fccfce8a66f74a
d2dc56e246b992bd88e572e9c94963f5ddaa9919254cdcb66c3156fc32171f1f
dc14bd28f43f549eda3f6d6aebffd558265d6ac82a42024322bbe567c3034908
dc9203252638485975559a30ad40d172a908b502713fae818dcae0bf1d4927f0
e302aa44f78b7463c3032a2527ac6cfd80efc88a8e08cb4b0756661495f95c78
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e476e40fbff7eef8d7e080548bd4311844a27df1e2c6563ae3cde43b75b1d3cf
e47ef21c70a3d03dc1bb7a44a728e7aa0e7c767c2d44a69c7baa52366effd113
e7af9d60d875eb1c1b1037bbbfdec41fcb096d0ebcf98a48717ad8b07906ced6
e7c7a472ce9006131bc534695e5c0ca99024d1b627cbab481b1c165150ef026a
e92f0b552deffbf207cee5389713056c7c3d27e4b9b9edaf29338d01a83c5962
eeaf04a8533df6f86cdbed425641ca8156f5fe1278820c19adca7414beda8d66
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f3a8992acb9ab911e0fa4ae12f4b85ef8e61008619f13ee51c7a121ff87f63b1
f7d8ba11d0a3a5a385bc7f6289a8f3c53109d8ee3a87d705152c21fa26f60cd2
fd06ca64dc53efba33a0e25fc2f3edca4b5d3b29364eb1b6226dde2b17dd2722

www.oodaloop.com Open in urlscan Pro 141.193.213.20 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

64 Requests

94 %HTTPS

58 %IPv6

16 Domains

24 Subdomains

26 IPs

4 Countries

2044 kBTransfer

5017 kBSize

6 Cookies

9 Outgoing links

Redirected requests

64 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 4 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

www.oodaloop.com Open in urlscan Pro
141.193.213.20 Public Scan

Screenshot
Live screenshot

Full Image

64
Requests

94 %
HTTPS

58 %
IPv6

16
Domains

24
Subdomains

26
IPs

4
Countries

2044 kB
Transfer

5017 kB
Size

6
Cookies

64 HTTP transactions
4 data transactions