urlscan.io logo urlscan.io
SecurityTrails logo

www.cybereason.com Open in urlscan Pro
199.60.103.226  Public Scan

Go To Rescan Add Verdict Report
URL: https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms?blaid=2123744
Submission: On October 07 via api from GB — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 64 IPs in 6 countries across 51 domains to perform 155 HTTP transactions. The main IP is 199.60.103.226, located in United States and belongs to CLOUDFLARESPECTRUM Cloudflare, Inc., US. The main domain is www.cybereason.com.
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on July 16th 2021. Valid for: a year.
This is the only time www.cybereason.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
44 199.60.103.226 209242 (CLOUDFLAR...)
9 2.16.186.58 20940 (AKAMAI-ASN1)
1 2.16.186.24 20940 (AKAMAI-ASN1)
1 104.17.244.204 13335 (CLOUDFLAR...)
2 104.16.19.94 13335 (CLOUDFLAR...)
3 142.250.184.202 15169 (GOOGLE)
10 216.58.212.131 15169 (GOOGLE)
4 31.13.92.14 32934 (FACEBOOK)
2 93.184.220.66 15133 (EDGECAST)
2 104.19.154.83 13335 (CLOUDFLAR...)
1 104.17.230.204 13335 (CLOUDFLAR...)
1 104.18.21.191 13335 (CLOUDFLAR...)
1 104.17.70.176 13335 (CLOUDFLAR...)
1 104.111.215.74 16625 (AKAMAI-AS)
1 104.244.42.200 13414 (TWITTER)
4 142.250.185.174 15169 (GOOGLE)
2 142.250.184.232 15169 (GOOGLE)
1 104.19.155.83 13335 (CLOUDFLAR...)
2 74.125.140.157 15169 (GOOGLE)
2 172.217.23.98 15169 (GOOGLE)
1 2.16.186.19 20940 (AKAMAI-ASN1)
1 199.232.136.157 54113 (FASTLY)
3 13.107.21.200 8068 (MICROSOFT...)
2 6 142.250.185.230 15169 (GOOGLE)
1 18.66.97.53 16509 (AMAZON-02)
1 151.101.65.140 54113 (FASTLY)
1 104.16.168.82 13335 (CLOUDFLAR...)
1 104.17.210.204 13335 (CLOUDFLAR...)
1 104.18.1.92 13335 (CLOUDFLAR...)
1 35.244.142.80 15169 (GOOGLE)
1 178.79.242.16 22822 (LLNW)
4 2.18.233.201 16625 (AKAMAI-AS)
1 151.101.66.110 54113 (FASTLY)
1 18.213.169.209 14618 (AMAZON-AES)
1 18.66.122.73 16509 (AMAZON-02)
1 13.32.99.30 16509 (AMAZON-02)
1 1 68.67.153.60 29990 (ASN-APPNEX)
3 3 185.33.223.178 29990 (ASN-APPNEX)
1 13.32.99.42 16509 (AMAZON-02)
1 142.250.186.174 15169 (GOOGLE)
5 142.250.186.100 15169 (GOOGLE)
1 151.101.193.140 54113 (FASTLY)
1 2 108.174.11.37 14413 (LINKEDIN)
1 1 13.107.42.14 8068 (MICROSOFT...)
1 52.222.236.74 ()
1 206.19.49.24 17225 (ATT-CERFN...)
1 3 142.250.185.66 15169 (GOOGLE)
1 108.177.15.157 15169 (GOOGLE)
2 216.239.36.54 15169 (GOOGLE)
1 104.244.42.3 13414 (TWITTER)
1 104.244.42.133 13414 (TWITTER)
1 18.66.139.40 16509 (AMAZON-02)
2 31.13.92.36 32934 (FACEBOOK)
1 2 18.196.93.253 16509 (AMAZON-02)
2 2 52.49.53.128 16509 (AMAZON-02)
1 2 52.222.214.8 16509 (AMAZON-02)
1 35.244.174.68 15169 (GOOGLE)
2 4 66.155.71.149 13768 (COGECO-PEER1)
1 18.66.97.17 16509 (AMAZON-02)
2 142.250.186.162 15169 (GOOGLE)
1 54.75.159.38 16509 (AMAZON-02)
1 18.66.122.85 16509 (AMAZON-02)
1 2 52.210.80.7 16509 (AMAZON-02)
1 2 35.227.248.159 15169 (GOOGLE)
1 54.78.254.47 16509 (AMAZON-02)
1 104.111.242.245 16625 (AKAMAI-AS)
1 2 34.253.111.115 16509 (AMAZON-02)
155 64
44    199.60.103.226 (United States)

ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US)
www.cybereason.com
9    2.16.186.58 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)
PTR: a2-16-186-58.deploy.static.akamaitechnologies.com
use.typekit.net
1    2.16.186.24 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)
PTR: a2-16-186-24.deploy.static.akamaitechnologies.com
platform.linkedin.com
1    104.17.244.204 (None, )

ASN13335 (CLOUDFLARENET, US)
cdn2.hubspot.net
2    104.16.19.94 (None, )

ASN13335 (CLOUDFLARENET, US)
cdnjs.cloudflare.com
3    142.250.184.202 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s11-in-f10.1e100.net
fonts.googleapis.com
10    216.58.212.131 (Mountain View, United States)

ASN15169 (GOOGLE, US)
PTR: ams15s21-in-f131.1e100.net
fonts.gstatic.com
4    31.13.92.14 (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)
PTR: xx-fbcdn-shv-01-frt3.fbcdn.net
connect.facebook.net
2    93.184.220.66 (London, United Kingdom)

ASN15133 (EDGECAST, US)
platform.twitter.com
2    104.19.154.83 (None, )

ASN13335 (CLOUDFLARENET, US)
app.hubspot.com
track.hubspot.com
1    104.17.230.204 (None, )

ASN13335 (CLOUDFLARENET, US)
js.hsleadflows.net
1    104.18.21.191 (None, )

ASN13335 (CLOUDFLARENET, US)
js.hs-banner.com
1    104.17.70.176 (None, )

ASN13335 (CLOUDFLARENET, US)
js.hs-analytics.net
1    104.111.215.74 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a104-111-215-74.deploy.static.akamaitechnologies.com
p.typekit.net
1    104.244.42.200 (United States)

ASN13414 (TWITTER, US)
syndication.twitter.com
4    142.250.185.174 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s51-in-f14.1e100.net
www.google-analytics.com
2    142.250.184.232 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s12-in-f8.1e100.net
www.googletagmanager.com
1    104.19.155.83 (None, )

ASN13335 (CLOUDFLARENET, US)
forms.hubspot.com
2    74.125.140.157 (United States)

ASN15169 (GOOGLE, US)
PTR: wq-in-f157.1e100.net
stats.g.doubleclick.net
2    172.217.23.98 (United States)

ASN15169 (GOOGLE, US)
PTR: mil04s23-in-f98.1e100.net
www.googleadservices.com
1    2.16.186.19 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)
PTR: a2-16-186-19.deploy.static.akamaitechnologies.com
snap.licdn.com
1    199.232.136.157 (Frankfurt am Main, Germany)

ASN54113 (FASTLY, US)
static.ads-twitter.com
3    13.107.21.200 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
bat.bing.com
6    142.250.185.230 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s53-in-f6.1e100.net
10272547.fls.doubleclick.net
10428681.fls.doubleclick.net
1    18.66.97.53 (United States)

ASN16509 (AMAZON-02, US)
static.hotjar.com
1    151.101.65.140 (United States)

ASN54113 (FASTLY, US)
www.redditstatic.com
1    104.16.168.82 (None, )

ASN13335 (CLOUDFLARENET, US)
ws.zoominfo.com
1    104.17.210.204 (None, )

ASN13335 (CLOUDFLARENET, US)
js.hs-scripts.com
1    104.18.1.92 (None, )

ASN13335 (CLOUDFLARENET, US)
trk.techtarget.com
1    35.244.142.80 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 80.142.244.35.bc.googleusercontent.com
cdn.pdst.fm
1    178.79.242.16 (United States)

ASN22822 (LLNW, US)
PTR: https-178-79-242-16.fra.llnw.net
up.pixel.ad
4    2.18.233.201 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a2-18-233-201.deploy.static.akamaitechnologies.com
pixel.mathtag.com
1    151.101.66.110 (United States)

ASN54113 (FASTLY, US)
fast.wistia.com
1    18.213.169.209 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-18-213-169-209.compute-1.amazonaws.com
lltrck.com
1    18.66.122.73 (United States)

ASN16509 (AMAZON-02, US)
tag.demandbase.com
1    13.32.99.30 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-32-99-30.fra60.r.cloudfront.net
px.airpr.com
1    68.67.153.60 (Secaucus, United States)

ASN29990 (ASN-APPNEX, US)
PTR: s.ml-attr.com.pxlsrv.net
s.ml-attr.com
3    185.33.223.178 (Amsterdam, Netherlands)

ASN29990 (ASN-APPNEX, US)
PTR: 824.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net
secure.adnxs.com
1    13.32.99.42 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-32-99-42.fra60.r.cloudfront.net
attr.ml-api.io
1    142.250.186.174 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s08-in-f14.1e100.net
analytics.google.com
5    142.250.186.100 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s06-in-f4.1e100.net
www.google.com
1    151.101.193.140 (United States)

ASN54113 (FASTLY, US)
alb.reddit.com
2    108.174.11.37 (United States)

ASN14413 (LINKEDIN, US)
PTR: 108-174-11-37.fwd.linkedin.com
px.ads.linkedin.com
1    13.107.42.14 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
www.linkedin.com
1    52.222.236.74 (United States)

ASN- ()
PTR: server-52-222-236-74.fra56.r.cloudfront.net
script.hotjar.com
1    206.19.49.24 (United States)

ASN17225 (ATT-CERFNET-BLOCK, US)
apt.techtarget.com
3    142.250.185.66 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s48-in-f2.1e100.net
googleads.g.doubleclick.net
1    108.177.15.157 (United States)

ASN15169 (GOOGLE, US)
PTR: wr-in-f157.1e100.net
bid.g.doubleclick.net
2    216.239.36.54 (United States)

ASN15169 (GOOGLE, US)
us-central1-adaptive-growth.cloudfunctions.net
1    104.244.42.3 (United States)

ASN13414 (TWITTER, US)
analytics.twitter.com
1    104.244.42.133 (United States)

ASN13414 (TWITTER, US)
t.co
1    18.66.139.40 (United States)

ASN16509 (AMAZON-02, US)
vars.hotjar.com
2    31.13.92.36 (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)
PTR: edge-star-mini-shv-01-frt3.facebook.com
www.facebook.com
2    18.196.93.253 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-18-196-93-253.eu-central-1.compute.amazonaws.com
dpx.airpr.com
2    52.49.53.128 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-49-53-128.eu-west-1.compute.amazonaws.com
match.prod.bidr.io
2    52.222.214.8 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-52-222-214-8.fra56.r.cloudfront.net
segments.company-target.com
1    35.244.174.68 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 68.174.244.35.bc.googleusercontent.com
id.rlcdn.com
4    66.155.71.149 (Portsmouth, United Kingdom)

ASN13768 (COGECO-PEER1, CA)
pixel.sitescout.com
1    18.66.97.17 (United States)

ASN16509 (AMAZON-02, US)
api.company-target.com
2    142.250.186.162 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s08-in-f2.1e100.net
adservice.google.com
1    54.75.159.38 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-54-75-159-38.eu-west-1.compute.amazonaws.com
in.hotjar.com
1    18.66.122.85 (United States)

ASN16509 (AMAZON-02, US)
vc.hotjar.io
2    52.210.80.7 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-210-80-7.eu-west-1.compute.amazonaws.com
dpm.demdex.net
2    35.227.248.159 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 159.248.227.35.bc.googleusercontent.com
pixel.tapad.com
1    54.78.254.47 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-54-78-254-47.eu-west-1.compute.amazonaws.com
loadm.exelator.com
1    104.111.242.245 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a104-111-242-245.deploy.static.akamaitechnologies.com
sync.teads.tv
2    34.253.111.115 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-34-253-111-115.eu-west-1.compute.amazonaws.com
bcp.crwdcntrl.net
Apex Domain
Subdomains		 Transfer
44 cybereason.com
www.cybereason.com
2 MB
12 doubleclick.net
stats.g.doubleclick.net
10272547.fls.doubleclick.net
10428681.fls.doubleclick.net
googleads.g.doubleclick.net
bid.g.doubleclick.net
5 KB
10 gstatic.com
fonts.gstatic.com
252 KB
10 typekit.net
use.typekit.net
p.typekit.net
143 KB
8 google.com
analytics.google.com
www.google.com
adservice.google.com
1 KB
4 sitescout.com
pixel.sitescout.com
3 KB
4 mathtag.com
pixel.mathtag.com
4 KB
4 hotjar.com
static.hotjar.com
script.hotjar.com
vars.hotjar.com
in.hotjar.com
63 KB
4 google-analytics.com
www.google-analytics.com
20 KB
4 twitter.com
platform.twitter.com
syndication.twitter.com
analytics.twitter.com
133 KB
4 facebook.net
connect.facebook.net
245 KB
4 linkedin.com
platform.linkedin.com
px.ads.linkedin.com
www.linkedin.com
64 KB
3 company-target.com
segments.company-target.com
api.company-target.com
3 KB
3 adnxs.com
secure.adnxs.com
3 KB
3 airpr.com
px.airpr.com
dpx.airpr.com
3 KB
3 bing.com
bat.bing.com
10 KB
3 hubspot.com
app.hubspot.com
track.hubspot.com
forms.hubspot.com
2 KB
3 googleapis.com
fonts.googleapis.com
4 KB
2 crwdcntrl.net
bcp.crwdcntrl.net
1 KB
2 tapad.com
pixel.tapad.com
898 B
2 demdex.net
dpm.demdex.net
2 KB
2 bidr.io
match.prod.bidr.io
1019 B
2 facebook.com
www.facebook.com
404 B
2 cloudfunctions.net
us-central1-adaptive-growth.cloudfunctions.net
2 techtarget.com
trk.techtarget.com
apt.techtarget.com
2 KB
2 googleadservices.com
www.googleadservices.com
16 KB
2 googletagmanager.com
www.googletagmanager.com
135 KB
2 cloudflare.com
cdnjs.cloudflare.com
11 KB
1 teads.tv
sync.teads.tv
172 B
1 exelator.com
loadm.exelator.com
324 B
1 hotjar.io
vc.hotjar.io
258 B
1 rlcdn.com
id.rlcdn.com
66 B
1 t.co
t.co
455 B
1 reddit.com
alb.reddit.com
125 B
1 ml-api.io
attr.ml-api.io
242 B
1 ml-attr.com
s.ml-attr.com
279 B
1 demandbase.com
tag.demandbase.com
19 KB
1 lltrck.com
lltrck.com
1 wistia.com
fast.wistia.com
118 KB
1 pixel.ad
up.pixel.ad
1 KB
1 pdst.fm
cdn.pdst.fm
6 KB
1 hs-scripts.com
js.hs-scripts.com
892 B
1 zoominfo.com
ws.zoominfo.com
689 B
1 redditstatic.com
www.redditstatic.com
7 KB
1 ads-twitter.com
static.ads-twitter.com
6 KB
1 licdn.com
snap.licdn.com
2 KB
1 hs-analytics.net
js.hs-analytics.net
20 KB
1 hs-banner.com
js.hs-banner.com
16 KB
1 hsleadflows.net
js.hsleadflows.net
87 KB
1 hubspot.net
cdn2.hubspot.net
2 KB
0 driftt.com Failed
js.driftt.com Failed
155 51
Domain Requested by
44 www.cybereason.com www.cybereason.com
10 fonts.gstatic.com fonts.googleapis.com
9 use.typekit.net www.cybereason.com
5 www.google.com
4 pixel.sitescout.com 2 redirects www.cybereason.com
4 pixel.mathtag.com www.googletagmanager.com
pixel.mathtag.com
4 www.google-analytics.com www.cybereason.com
www.google-analytics.com
4 connect.facebook.net www.cybereason.com
connect.facebook.net
3 googleads.g.doubleclick.net 1 redirects www.googleadservices.com
3 secure.adnxs.com 3 redirects
3 10428681.fls.doubleclick.net 1 redirects www.googletagmanager.com
3 10272547.fls.doubleclick.net 1 redirects www.googletagmanager.com
3 bat.bing.com www.googletagmanager.com
bat.bing.com
3 fonts.googleapis.com www.cybereason.com
2 bcp.crwdcntrl.net 1 redirects
2 pixel.tapad.com 1 redirects
2 dpm.demdex.net 1 redirects
2 adservice.google.com 10272547.fls.doubleclick.net
10428681.fls.doubleclick.net
2 segments.company-target.com 1 redirects
2 match.prod.bidr.io 2 redirects
2 dpx.airpr.com 1 redirects
2 www.facebook.com
2 us-central1-adaptive-growth.cloudfunctions.net cdn.pdst.fm
2 px.ads.linkedin.com 1 redirects
2 www.googleadservices.com www.googletagmanager.com
www.googleadservices.com
2 stats.g.doubleclick.net www.google-analytics.com
www.googletagmanager.com
2 www.googletagmanager.com www.cybereason.com
www.googletagmanager.com
2 platform.twitter.com www.cybereason.com
platform.twitter.com
2 cdnjs.cloudflare.com www.cybereason.com
1 sync.teads.tv
1 loadm.exelator.com
1 vc.hotjar.io script.hotjar.com
1 in.hotjar.com script.hotjar.com
1 api.company-target.com tag.demandbase.com
1 id.rlcdn.com
1 vars.hotjar.com static.hotjar.com
1 t.co
1 analytics.twitter.com static.ads-twitter.com
1 bid.g.doubleclick.net www.googleadservices.com
1 apt.techtarget.com
1 script.hotjar.com static.hotjar.com
1 www.linkedin.com 1 redirects
1 alb.reddit.com
1 analytics.google.com www.googletagmanager.com
1 attr.ml-api.io
1 s.ml-attr.com 1 redirects
1 px.airpr.com www.cybereason.com
1 tag.demandbase.com www.cybereason.com
1 lltrck.com www.cybereason.com
1 fast.wistia.com www.googletagmanager.com
1 up.pixel.ad www.googletagmanager.com
1 cdn.pdst.fm www.cybereason.com
1 trk.techtarget.com www.cybereason.com
1 js.hs-scripts.com www.googletagmanager.com
1 ws.zoominfo.com www.cybereason.com
1 www.redditstatic.com www.googletagmanager.com
1 static.hotjar.com www.googletagmanager.com
1 static.ads-twitter.com www.googletagmanager.com
1 snap.licdn.com www.googletagmanager.com
1 forms.hubspot.com js.hsleadflows.net
1 track.hubspot.com
1 syndication.twitter.com platform.twitter.com
1 p.typekit.net www.cybereason.com
1 js.hs-analytics.net www.cybereason.com
1 js.hs-banner.com www.cybereason.com
1 js.hsleadflows.net www.cybereason.com
1 app.hubspot.com www.cybereason.com
1 cdn2.hubspot.net www.cybereason.com
1 platform.linkedin.com www.cybereason.com
0 js.driftt.com Failed www.cybereason.com
155 70
Subject Issuer Validity Valid
www.cybereason.com
Cloudflare Inc ECC CA-3		 2021-07-16 -
2022-07-15		 a year crt.sh
use.typekit.net
DigiCert TLS RSA SHA256 2020 CA1		 2021-08-16 -
2022-08-16		 a year crt.sh
platform.linkedin.com
DigiCert SHA2 Secure Server CA		 2020-07-03 -
2022-07-08		 2 years crt.sh
hubspot.net
Cloudflare Inc ECC CA-3		 2021-06-04 -
2022-06-03		 a year crt.sh
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3		 2021-09-21 -
2022-09-20		 a year crt.sh
upload.video.google.com
GTS CA 1C3		 2021-09-13 -
2021-11-20		 2 months crt.sh
*.gstatic.com
GTS CA 1C3		 2021-09-13 -
2021-11-20		 2 months crt.sh
*.facebook.com
DigiCert SHA2 High Assurance Server CA		 2021-09-09 -
2021-12-08		 3 months crt.sh
*.twimg.com
DigiCert TLS RSA SHA256 2020 CA1		 2020-11-05 -
2021-11-09		 a year crt.sh
hubspot.com
Cloudflare Inc ECC CA-3		 2021-06-26 -
2022-06-25		 a year crt.sh
*.typekit.net
DigiCert TLS RSA SHA256 2020 CA1		 2021-07-16 -
2022-07-21		 a year crt.sh
syndication.twitter.com
DigiCert TLS RSA SHA256 2020 CA1		 2021-02-05 -
2022-02-04		 a year crt.sh
*.google-analytics.com
GTS CA 1C3		 2021-09-13 -
2021-11-20		 2 months crt.sh
*.g.doubleclick.net
GTS CA 1C3		 2021-09-13 -
2021-11-20		 2 months crt.sh
www.googleadservices.com
GTS CA 1C3		 2021-09-13 -
2021-11-20		 2 months crt.sh
*.licdn.com
DigiCert SHA2 Secure Server CA		 2021-07-15 -
2022-07-20		 a year crt.sh
ads-twitter.com
DigiCert TLS RSA SHA256 2020 CA1		 2021-07-21 -
2022-07-26		 a year crt.sh
www.bing.com
Microsoft RSA TLS CA 02		 2021-09-30 -
2022-03-30		 6 months crt.sh
*.doubleclick.net
GTS CA 1C3		 2021-09-13 -
2021-11-20		 2 months crt.sh
*.hotjar.com
Amazon		 2020-12-25 -
2022-01-23		 a year crt.sh
www.redditstatic.com
DigiCert TLS RSA SHA256 2020 CA1		 2021-10-05 -
2022-04-02		 6 months crt.sh
zoominfo.com
Cloudflare Inc ECC CA-3		 2021-06-04 -
2022-06-03		 a year crt.sh
cdn.pdst.fm
GTS CA 1D4		 2021-08-28 -
2021-11-26		 3 months crt.sh
*.pixel.ad
RapidSSL RSA CA 2018		 2020-01-15 -
2022-02-02		 2 years crt.sh
pixel.mathtag.com
DigiCert SHA2 Secure Server CA		 2021-06-29 -
2022-07-07		 a year crt.sh
fast.wistia.com
GlobalSign Atlas R3 DV TLS CA 2020		 2021-03-22 -
2022-04-23		 a year crt.sh
lltrck.com
Go Daddy Secure Certificate Authority - G2		 2021-07-25 -
2022-08-26		 a year crt.sh
tag.demandbase.com
Go Daddy Secure Certificate Authority - G2		 2020-10-14 -
2021-11-15		 a year crt.sh
*.airpr.com
Amazon		 2021-01-10 -
2022-02-07		 a year crt.sh
*.ml-api.io
Amazon		 2021-01-20 -
2022-02-17		 a year crt.sh
*.google.com
GTS CA 1C3		 2021-09-13 -
2021-11-20		 2 months crt.sh
www.google.com
GTS CA 1C3		 2021-09-13 -
2021-11-20		 2 months crt.sh
*.reddit.com
DigiCert TLS RSA SHA256 2020 CA1		 2021-10-05 -
2022-04-02		 6 months crt.sh
px.ads.linkedin.com
DigiCert SHA2 Secure Server CA		 2021-09-16 -
2022-03-16		 6 months crt.sh
*.techtarget.com
Sectigo RSA Domain Validation Secure Server CA		 2019-10-25 -
2021-10-24		 2 years crt.sh
*.googleadservices.com
GTS CA 1C3		 2021-09-13 -
2021-11-20		 2 months crt.sh
misc.google.com
GTS CA 1C3		 2021-09-13 -
2021-11-20		 2 months crt.sh
*.twitter.com
DigiCert TLS RSA SHA256 2020 CA1		 2021-02-05 -
2022-02-04		 a year crt.sh
t.co
DigiCert TLS RSA SHA256 2020 CA1		 2021-02-05 -
2022-02-04		 a year crt.sh
*.company-target.com
Amazon		 2021-08-31 -
2022-09-29		 a year crt.sh
*.rlcdn.com
Sectigo RSA Domain Validation Secure Server CA		 2021-02-25 -
2022-03-28		 a year crt.sh
*.sitescout.com
RapidSSL RSA CA 2018		 2020-01-15 -
2022-02-02		 2 years crt.sh
api.demandbase.com
Go Daddy Secure Certificate Authority - G2		 2020-10-09 -
2021-10-28		 a year crt.sh
*.hotjar.io
Amazon		 2021-08-17 -
2022-09-15		 a year crt.sh
*.demdex.net
DigiCert TLS RSA SHA256 2020 CA1		 2020-12-02 -
2022-01-02		 a year crt.sh
*.tapad.com
DigiCert SHA2 Secure Server CA		 2020-10-05 -
2021-11-06		 a year crt.sh
*.exelator.com
DigiCert TLS RSA SHA256 2020 CA1		 2021-06-02 -
2022-06-07		 a year crt.sh
teads.tv
R3		 2021-08-23 -
2021-11-21		 3 months crt.sh
*.crwdcntrl.net
Go Daddy Secure Certificate Authority - G2		 2021-04-29 -
2022-05-31		 a year crt.sh

This page contains 8 frames:

Primary Page: https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms?blaid=2123744
Frame ID: E4CBE20D2D8F4326EC7AFE9412FFAD60
Requests: 138 HTTP requests in this frame

Frame: https://platform.twitter.com/widgets/widget_iframe.58065ae230495f5d9e4b6a916472b2c1.html?origin=https%3A%2F%2Fwww.cybereason.com
Frame ID: A5B2004E5BA294E8C0A9DA44BD49CD33
Requests: 2 HTTP requests in this frame

Frame: https://10272547.fls.doubleclick.net/activityi;dc_pre=CK2ip5jEt_MCFaJEHQkdMosGug;src=10272547;type=landing;cat=allsite;ord=6730628086635;gtm=2wga40;auiddc=1638032237.1633583346;ps=1;~oref=https%3A%2F%2Fwww.cybereason.com%2Fblog%2Foperation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms%3Fblaid%3D2123744
Frame ID: 022776609923FF1FD55033855DF8E0C2
Requests: 2 HTTP requests in this frame

Frame: https://10428681.fls.doubleclick.net/activityi;dc_pre=CNu9p5jEt_MCFZpEHQkdQOQCEQ;src=10428681;type=cyber0;cat=cyber0;ord=9150648955961;gtm=2wga40;auiddc=1638032237.1633583346;ps=1;~oref=https%3A%2F%2Fwww.cybereason.com%2Fblog%2Foperation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms%3Fblaid%3D2123744
Frame ID: 9934ED796D9DF5A9C6AF883A605E9525
Requests: 2 HTTP requests in this frame

Frame: https://bid.g.doubleclick.net/xbbe/pixel?d=KAE
Frame ID: 327976687589D99368671EC97B33F349
Requests: 1 HTTP requests in this frame

Frame: https://vars.hotjar.com/box-dfc01efbdc94bb0936d9a35a502b0b64.html
Frame ID: E8439C64AEDB83A6C1564D4104303317
Requests: 1 HTTP requests in this frame

Frame: https://pixel.sitescout.com/dmp/asyncPixelSync?cookieQ=1
Frame ID: 39CD03D13C0FEC7DE0DEEFB3F28C8416
Requests: 6 HTTP requests in this frame

Frame: https://pixel.mathtag.com/sync/iframe?mt_uuid=41be615e-80f1-4b00-800a-e2f6ae71b975&no_iframe=1&mt_adid=241675&source=mathtag
Frame ID: 8AC57E4F5D97F5D7F02737D708A4E4DB
Requests: 2 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Operation GhostShell: Novel RAT Targets Global Aerospace and Telecoms Firms

Detected technologies

Overall confidence: 100%
Detected patterns
  • <link[^>]+?href="[^"]+bulma(?:\.min)?\.css
Overall confidence: 100%
Detected patterns
  • <link rel="amphtml"
Overall confidence: 100%
Detected patterns
  • //connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js
Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]+(?:([\d.]+)/)?(?:css/)?font-awesome(?:\.min)?\.css
  • <link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
  • (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
Overall confidence: 100%
Detected patterns
  • google-analytics\.com/(?:ga|urchin|analytics)\.js
Overall confidence: 100%
Detected patterns
  • googletagmanager\.com/ns\.html[^>]+></iframe>
  • googletagmanager\.com/gtm\.js
  • googletagmanager\.com/gtag/js
Overall confidence: 100%
Detected patterns
  • //static\.hotjar\.com/
Overall confidence: 100%
Detected patterns
  • js\.hs-analytics\.net/analytics
Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]+ionicons(?:\.min)?\.css
Overall confidence: 100%
Detected patterns
  • //platform\.linkedin\.com/in\.js
Overall confidence: 100%
Detected patterns
  • snap\.licdn\.com/li\.lms-analytics/insight\.min\.js
Overall confidence: 100%
Detected patterns
  • //platform\.twitter\.com/widgets\.js
Overall confidence: 100%
Detected patterns
  • jquery[.-]([\d.]*\d)[^/]*\.js
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

155
Requests

99 %
HTTPS

0 %
IPv6

51
Domains

70
Subdomains

64
IPs

6
Countries

2970 kB
Transfer

6396 kB
Size

54
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 89
  • https://10272547.fls.doubleclick.net/activityi;src=10272547;type=landing;cat=allsite;ord=6730628086635;gtm=2wga40;auiddc=1638032237.1633583346;ps=1;~oref=https%3A%2F%2Fwww.cybereason.com%2Fblog%2Foperation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms%3Fblaid%3D2123744 HTTP 302
  • https://10272547.fls.doubleclick.net/activityi;dc_pre=CK2ip5jEt_MCFaJEHQkdMosGug;src=10272547;type=landing;cat=allsite;ord=6730628086635;gtm=2wga40;auiddc=1638032237.1633583346;ps=1;~oref=https%3A%2F%2Fwww.cybereason.com%2Fblog%2Foperation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms%3Fblaid%3D2123744
Request Chain 92
  • https://10428681.fls.doubleclick.net/activityi;src=10428681;type=cyber0;cat=cyber0;ord=9150648955961;gtm=2wga40;auiddc=1638032237.1633583346;ps=1;~oref=https%3A%2F%2Fwww.cybereason.com%2Fblog%2Foperation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms%3Fblaid%3D2123744 HTTP 302
  • https://10428681.fls.doubleclick.net/activityi;dc_pre=CNu9p5jEt_MCFZpEHQkdQOQCEQ;src=10428681;type=cyber0;cat=cyber0;ord=9150648955961;gtm=2wga40;auiddc=1638032237.1633583346;ps=1;~oref=https%3A%2F%2Fwww.cybereason.com%2Fblog%2Foperation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms%3Fblaid%3D2123744
Request Chain 107
  • https://s.ml-attr.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dcybereason.com%26pId%3d%24UID HTTP 302
  • https://secure.adnxs.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dcybereason.com%26pId%3d%24UID HTTP 307
  • https://secure.adnxs.com/bounce?%2Fgetuid%3Fhttps%253a%252f%252fattr.ml-api.io%252f%253fdomain%253dcybereason.com%2526pId%253d%2524UID HTTP 302
  • https://attr.ml-api.io/?domain=cybereason.com&pId=2003287067430329871
Request Chain 113
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=72596&time=1633583345890&url=https%3A%2F%2Fwww.cybereason.com%2Fblog%2Foperation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms%3Fblaid%3D2123744 HTTP 302
  • https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D72596%26time%3D1633583345890%26url%3Dhttps%253A%252F%252Fwww.cybereason.com%252Fblog%252Foperation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms%253Fblaid%253D2123744%26liSync%3Dtrue HTTP 302
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=72596&time=1633583345890&url=https%3A%2F%2Fwww.cybereason.com%2Fblog%2Foperation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms%3Fblaid%3D2123744&liSync=true
Request Chain 129
  • https://dpx.airpr.com/px?hostname=www.cybereason.com&profile=660386&ga_account_id=UA-56367941-1&ga_account_type=UA&ga_c=770505642.1633583345&an=true HTTP 302
  • https://secure.adnxs.com/getuid?https://dpx.airpr.com/anpx?adnxs_uid=$UID&airpr_id=4104940508 HTTP 302
  • https://dpx.airpr.com/anpx?adnxs_uid=2003287067430329871&airpr_id=4104940508
Request Chain 130
  • https://match.prod.bidr.io/cookie-sync/demandbase HTTP 303
  • https://match.prod.bidr.io/cookie-sync/demandbase?_bee_ppp=1 HTTP 303
  • https://segments.company-target.com/log?vendor=choca&user_id=AAEUNE7CvQIAABjqijTDHw HTTP 303
  • https://segments.company-target.com/validateCookie?vendor=choca&user_id=AAEUNE7CvQIAABjqijTDHw&verifyHash=8b448520b9d75f543a3ba3a004592afee9db9f8d
Request Chain 132
  • https://pixel.sitescout.com/dmp/asyncPixelSync HTTP 302
  • https://pixel.sitescout.com/dmp/asyncPixelSync?cookieQ=1
Request Chain 133
  • https://pixel.sitescout.com/up/6f002ab8596ff067?cntr_url=https%3A%2F%2Fwww.cybereason.com%2Fblog%2Foperation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms%3Fblaid%3D2123744 HTTP 302
  • https://pixel.sitescout.com/up/6f002ab8596ff067?cookieQ=1&cntr_url=https%3A%2F%2Fwww.cybereason.com%2Fblog%2Foperation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms%3Fblaid%3D2123744
Request Chain 141
  • https://googleads.g.doubleclick.net/pagead/viewthroughconversion/401574070/?random=1265835270&cv=9&fst=1633583345928&num=1&value=0&label=6wPaCOv09oACELaRvr8B&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2wga40&sendb=1&ig=1&frm=0&url=https%3A%2F%2Fwww.cybereason.com%2Fblog%2Foperation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms%3Fblaid%3D2123744&tiba=Operation%20GhostShell%3A%20Novel%20RAT%20Targets%20Global%20Aerospace%20and%20Telecoms%20Firms&auid=1638032237.1633583346&capi=1&hn=www.googleadservices.com&async=1&fmt=3&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&ocp_id=8oBeYbz2CfCZx_AP18atmA4&sscte=1&crd=&eitems=ChEI8JL1igYQ6K3F7e7DgaTSARIdAE_D85m-rhlr7n5inHawwGb4m7y3raAWAWa46yo HTTP 302
  • https://www.google.com/pagead/1p-conversion/401574070/?random=1265835270&cv=9&fst=1633583345928&num=1&value=0&label=6wPaCOv09oACELaRvr8B&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2wga40&sendb=1&ig=1&frm=0&url=https%3A%2F%2Fwww.cybereason.com%2Fblog%2Foperation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms%3Fblaid%3D2123744&tiba=Operation%20GhostShell%3A%20Novel%20RAT%20Targets%20Global%20Aerospace%20and%20Telecoms%20Firms&auid=1638032237.1633583346&capi=1&hn=www.googleadservices.com&async=1&fmt=3&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&sscte=1&crd=&is_vtc=1&ocp_id=8oBeYbz2CfCZx_AP18atmA4&cid=CAQSKQCNIrLMDXzGfLbstf1G7LtKcFW5h7dYjc4yCiurElPKbb8Ap78Pp9kt&eitems=ChEI8JL1igYQ6K3F7e7DgaTSARIdAE_D85l3AG9fdTf88bqEDG26npEWogqvPZGvRJA&random=4227900526&resp=GooglemKTybQhCsO
Request Chain 147
  • https://dpm.demdex.net/ibs:dpid=82530&dpuuid=ad8eb495-740e-424c-9d04-0a19c5d760ff-615e80f2-5553&gdpr=0&gdpr_consent= HTTP 302
  • https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=82530&dpuuid=ad8eb495-740e-424c-9d04-0a19c5d760ff-615e80f2-5553&gdpr=0&gdpr_consent=
Request Chain 148
  • https://pixel.tapad.com/idsync/ex/receive?partner_id=2499&partner_device_id=ad8eb495-740e-424c-9d04-0a19c5d760ff-615e80f2-5553 HTTP 302
  • https://pixel.tapad.com/idsync/ex/receive/check?partner_id=2499&partner_device_id=ad8eb495-740e-424c-9d04-0a19c5d760ff-615e80f2-5553
Request Chain 151
  • https://bcp.crwdcntrl.net/map/c=1389/tp=STSC/tpid=ad8eb495-740e-424c-9d04-0a19c5d760ff-615e80f2-5553 HTTP 302
  • https://bcp.crwdcntrl.net/map/ct=y/c=1389/tp=STSC/tpid=ad8eb495-740e-424c-9d04-0a19c5d760ff-615e80f2-5553

155 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms
www.cybereason.com/blog/ 		134 KB
29 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms?blaid=2123744
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
199.60.103.226 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare / HubSpot
Resource Hash
2ade3aa1d89865ba159dcd2d025c1e4e380101d6e192ae0f0d88b22bf3569f5e
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security max-age=31536000

Request headers

:method
GET
:authority
www.cybereason.com
:scheme
https
:path
/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms?blaid=2123744
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language
de-DE,de;q=0.9
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
none
sec-fetch-mode
navigate
sec-fetch-user
?1
sec-fetch-dest
document
accept-encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language
de-DE,de;q=0.9

Response headers

date
Thu, 07 Oct 2021 05:09:04 GMT
content-type
text/html; charset=UTF-8
cache-control
s-maxage=10800, max-age=0
etag
W/"9c7899278fda00f0853832ac298b7d83"
last-modified
Wed, 06 Oct 2021 23:10:42 GMT
link
</hs/hsstatic/HubspotToolsMenu/static-1.109/js/index.js>; rel=preload; as=script,</hs/hsstatic/cos-i18n/static-1.37/bundles/project.js>; rel=preload; as=script
strict-transport-security
max-age=31536000
cache-tag
CT-56540216169,CG-5272851739,P-3354902,L-42870461961,CW-34473990280,CW-41681847227,CW-41682410610,CW-42867014566,CW-43300360745,CW-44252461159,CW-48386556055,E-34470223313,E-34470224480,E-34470477360,E-35275979682,E-35291999472,E-42363645447,E-42507089303,E-42507091846,E-42760289143,PGS-ALL,SW-0,GC-36042052587
content-security-policy
upgrade-insecure-requests
edge-cache-tag
CT-56540216169,CG-5272851739,P-3354902,L-42870461961,CW-34473990280,CW-41681847227,CW-41682410610,CW-42867014566,CW-43300360745,CW-44252461159,CW-48386556055,E-34470223313,E-34470224480,E-34470477360,E-35275979682,E-35291999472,E-42363645447,E-42507089303,E-42507091846,E-42760289143,PGS-ALL,SW-0,GC-36042052587
referrer-policy
no-referrer-when-downgrade
x-hs-cache-config
BrowserCache-5s-EdgeCache-180s
x-hs-cf-cache-status
HIT
x-hs-combine-css
Disabled
x-hs-content-campaign-id
9d0f7a4c-be0b-46ea-b708-005916cbdaae
x-hs-content-id
56540216169
x-hs-hub-id
3354902
x-hs-prerendered
Wed, 06 Oct 2021 23:10:42 GMT
x-powered-by
HubSpot
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=x8RG0CfpgmsECdkE8HaBHvTY7IVrca7wx6kZj%2FcTdmfWVxRAGIAxk1yHwJfzMas6Tc5UTTL%2B9hqnjL9mrUr3whbL6tB3z7Q%2Fz8Pf%2Byq%2F466ZIf0T%2FyFPNPp7Mn8TYxDWTZXWDQ%3D%3D"}],"group":"cf-nel","max_age":604800}
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary
Accept-Encoding
set-cookie
__cfruid=649f615bd690efb862dbcff90d2cb8293e32c367-1633583344; path=/; domain=.www.cybereason.com; HttpOnly; Secure; SameSite=None
server
cloudflare
cf-ray
69a49d7bde744303-FRA
content-encoding
br
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
cf-h2-pushed
</hs/hsstatic/HubspotToolsMenu/static-1.109/js/index.js>,</hs/hsstatic/cos-i18n/static-1.37/bundles/project.js>
index.js
www.cybereason.com/hs/hsstatic/HubspotToolsMenu/static-1.109/js/ 		52 KB
20 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.cybereason.com/hs/hsstatic/HubspotToolsMenu/static-1.109/js/index.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
199.60.103.226 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
43ac0ae9e90f01a0afabe35cc0aaa377336aac90759e74770251de89db0af44c
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms?blaid=2123744
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Thu, 07 Oct 2021 05:09:04 GMT
via
1.1 9ab847fabb8c9edbd39cff57c2a2f4c0.cloudfront.net (CloudFront)
vary
Accept-Encoding
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
5046315
x-amz-server-side-encryption
AES256
cf-ray
69a49d7d18bf4303-FRA
x-cache
Miss from cloudfront
x-amz-replication-status
COMPLETED
x-amz-cf-pop
FRA50-C1
content-encoding
br
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
last-modified
Fri, 06 Aug 2021 19:39:07 GMT
server
cloudflare
etag
W/"d0801ffff23e81a99fd8046c0846ba93"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=31536000; includeSubDomains; preload
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=m07L4tIN5gXdSTVNL6xaCIGXc%2FiSbvw%2BV5YnZn806%2BNNYpJo6Q5j3in5dmnfekllzpuSetCldRr99dh7jHelB7JiIrRpN9%2BlBruaIDm1wdy8lJxbAg59ruL2ad%2F2Txj1yx3PpQ%3D%3D"}],"group":"cf-nel","max_age":604800}
x-amz-version-id
WCB.Owk3aP2vvRplDI.5pUwB8LkSH.e_
cache-control
public, max-age=31536000
set-cookie
__cfruid=649f615bd690efb862dbcff90d2cb8293e32c367-1633583344; path=/; domain=.www.cybereason.com; HttpOnly; Secure; SameSite=None
content-type
application/javascript
x-amz-cf-id
pSsLw65tntFDEdA1Wfzw2gZ1r1sYewn82AJ23gwJ4tbHPJEd6QN2gQ==
expires
Fri, 07 Oct 2022 05:09:04 GMT
project.js
www.cybereason.com/hs/hsstatic/cos-i18n/static-1.37/bundles/ 		1 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.cybereason.com/hs/hsstatic/cos-i18n/static-1.37/bundles/project.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
199.60.103.226 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
69aea70ed00c6297e407afc0b1ccf6db9629eedc412bf0779467f3e462d346e3
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms?blaid=2123744
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Thu, 07 Oct 2021 05:09:04 GMT
via
1.1 e1e056e45a0f8d6bc22b223900511170.cloudfront.net (CloudFront)
vary
Accept-Encoding
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
9554582
x-amz-server-side-encryption
AES256
cf-ray
69a49d7d18c14303-FRA
x-cache
Hit from cloudfront
x-amz-replication-status
COMPLETED
x-amz-cf-pop
FRA2-C2
content-encoding
br
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
last-modified
Mon, 14 Jun 2021 16:41:38 GMT
server
cloudflare
etag
W/"6c562b3f1d6a0148fda97d4847422c6f"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=31536000; includeSubDomains; preload
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=mzmfZGIOhnAJQCiSaWnnPP9n3D7IjqdVzh3fQ%2B0%2BdN5txNyUoz8YxhBiLS6PwliC2gEAuso4idkffzyy7XOx8di6p1jsB7N0Kp%2FtwLQ3gaeLfRPB1w6YlyUct%2BTWB8rOh1TkLA%3D%3D"}],"group":"cf-nel","max_age":604800}
x-amz-version-id
M9oUePGbwt7hrJpARSIQzQLaIi7kmGEy
cache-control
public, max-age=31536000
set-cookie
__cfruid=649f615bd690efb862dbcff90d2cb8293e32c367-1633583344; path=/; domain=.www.cybereason.com; HttpOnly; Secure; SameSite=None
content-type
application/javascript
x-amz-cf-id
DUXbRLuhPxzxlhKqx2KMF2WMfvTtTR6IQDORvdAyUi-gNVGhIKhf-Q==
expires
Fri, 07 Oct 2022 05:09:04 GMT
jquery-1.11.2.js
www.cybereason.com/hs/hsstatic/jquery-libs/static-1.4/jquery/ 		94 KB
36 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.cybereason.com/hs/hsstatic/jquery-libs/static-1.4/jquery/jquery-1.11.2.js
Requested by
Host: www.cybereason.com
URL: https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms?blaid=2123744
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
199.60.103.226 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
2ecd295d295bec062cedebe177e54b9d6b19fc0a841dc5c178c654c9ccff09c0
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

:path
/hs/hsstatic/jquery-libs/static-1.4/jquery/jquery-1.11.2.js
pragma
no-cache
cookie
__cfruid=649f615bd690efb862dbcff90d2cb8293e32c367-1633583344
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
script
:authority
www.cybereason.com
referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms?blaid=2123744
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms?blaid=2123744
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Thu, 07 Oct 2021 05:09:04 GMT
via
1.1 355e7d579c41c1dcc2113e41403be663.cloudfront.net (CloudFront)
vary
Accept-Encoding
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
3814538
cf-ray
69a49d7d5b481f19-FRA
x-cache
Hit from cloudfront
content-encoding
br
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
last-modified
Thu, 08 Jan 2015 18:08:00 GMT
server
cloudflare
etag
W/"5790ead7ad3ba27397aedfa3d263b867"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=31536000; includeSubDomains; preload
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=1VqA7tW9TPrwdeuDeSlup1rrkFNI4yOQBG9LQEn9FQhdaJ%2FPmB3e8eWbyd%2FELubG4SQ2RdlRugGhfQKK%2F6p1LWCkSJTNQXTgtQk46r4gjqgzo0LvC7Jh27d%2BCEYkR%2BKswkYMXQ%3D%3D"}],"group":"cf-nel","max_age":604800}
x-amz-version-id
null
cache-control
public, max-age=31536000
x-amz-cf-pop
FRA56-C2
content-type
application/javascript
x-amz-cf-id
qQSCbF1GTkm4UX9jvZEdkLnuHq_b3XC4AH51fb0t-odVZOZshEnuLw==
expires
Fri, 07 Oct 2022 05:09:04 GMT
module_41681847227_CR_-_Malicious_Life_Network_--_Tier_One_Header.min.css
www.cybereason.com/hs-fs/hub/3354902/hub_generated/module_assets/41681847227/1619109182781/ 		3 KB
2 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.cybereason.com/hs-fs/hub/3354902/hub_generated/module_assets/41681847227/1619109182781/module_41681847227_CR_-_Malicious_Life_Network_--_Tier_One_Header.min.css
Requested by
Host: www.cybereason.com
URL: https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms?blaid=2123744
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
199.60.103.226 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
835866cae4df18da17dc4e3f4d6ae62967b3e344cc0bfe029fe529ed94ae7dff

Request headers

:path
/hs-fs/hub/3354902/hub_generated/module_assets/41681847227/1619109182781/module_41681847227_CR_-_Malicious_Life_Network_--_Tier_One_Header.min.css
pragma
no-cache
cookie
__cfruid=649f615bd690efb862dbcff90d2cb8293e32c367-1633583344
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
text/css,*/*;q=0.1
cache-control
no-cache
sec-fetch-dest
style
:authority
www.cybereason.com
referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms?blaid=2123744
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms?blaid=2123744
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

x-amz-meta-created-unix-time-millis
1619109182781
date
Thu, 07 Oct 2021 05:09:04 GMT
via
1.1 5eb5e19c1a78889d10ff38f1551ed2aa.cloudfront.net (CloudFront)
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
3098
x-hs-alternate-content-type
text/plain
x-amz-server-side-encryption
AES256
x-cache
RefreshHit from cloudfront
x-edge-origin-shield-skipped
0
x-amz-replication-status
COMPLETED
x-hs-cf-lambda
us-east-1.enforceAclForReadsProd 12
content-encoding
br
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
x-amz-request-id
KEZH7TPKPRG5Y6CS
x-amz-id-2
UUAo77WwzMnQPxIfLDj8JWy6Tdu3/TLMHyo8qoZUbq3F3yDC3Ltj3rc8dT0RVaPqB6kkvi0S0yA=
last-modified
Thu, 22 Apr 2021 16:33:03 GMT
server
cloudflare
etag
W/"f58fd8f67a47c0e890657f936f29799b"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ckrGhP5IyMWdf%2BtvtyIyyOi5RA%2B%2B3c7qEJqvQqtK86X9SNjdG8Y%2FNBQBjau%2FrpcQOLK4XNzB3rYzhz7LXQJBM1Xq%2B9BwBst8xbVVyIU7Fk8ebuzABq0yrzXrO40Oc%2Bu3Ll7Idw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
cache-control
s-maxage=1814400, max-age=1209600, stale-while-revalidate=900, s-maxage=31536000, max-age=31536000
access-control-allow-credentials
false
x-amz-version-id
OrCGPw.DheqgcreVeofegnxXE_xFGg.y
x-amz-cf-pop
IAD89-C1
cf-ray
69a49d7d5b491f19-FRA
x-amz-cf-id
phVjjJ4SO3_XpiAaYqRdnUgZ_Wz-etVF8_4dxJq1Gy_gEJ9dHkD4IA==
x-hs-cf-lambda-enforce
us-east-1.enforceAclForReadsProd 12
module_41682410610_CR_-_Malicious_Life_Network_--_Main_Hero.min.css
www.cybereason.com/hs-fs/hub/3354902/hub_generated/module_assets/41682410610/1618194603032/ 		6 KB
3 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.cybereason.com/hs-fs/hub/3354902/hub_generated/module_assets/41682410610/1618194603032/module_41682410610_CR_-_Malicious_Life_Network_--_Main_Hero.min.css
Requested by
Host: www.cybereason.com
URL: https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms?blaid=2123744
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
199.60.103.226 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
f903f416e22249cfab4769b65c97a216746ff7d579fc7fa983740943240a9362

Request headers

:path
/hs-fs/hub/3354902/hub_generated/module_assets/41682410610/1618194603032/module_41682410610_CR_-_Malicious_Life_Network_--_Main_Hero.min.css
pragma
no-cache
cookie
__cfruid=649f615bd690efb862dbcff90d2cb8293e32c367-1633583344
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
text/css,*/*;q=0.1
cache-control
no-cache
sec-fetch-dest
style
:authority
www.cybereason.com
referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms?blaid=2123744
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms?blaid=2123744
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

x-amz-meta-created-unix-time-millis
1618194603032
date
Thu, 07 Oct 2021 05:09:04 GMT
via
1.1 417c242b19212928b079740e6dd8f54c.cloudfront.net (CloudFront)
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
3098
x-hs-alternate-content-type
text/plain
x-amz-server-side-encryption
AES256
x-cache
RefreshHit from cloudfront
x-edge-origin-shield-skipped
0
x-amz-replication-status
COMPLETED
x-hs-cf-lambda
us-east-1.enforceAclForReadsProd 12
content-encoding
br
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
x-amz-request-id
KEZQEEZMF64B3CNP
x-amz-id-2
Op9Nz0nf/jO2gsGGuQsWbbRtytMaVeKTaCaop0VomKak2EuP7bSnBUOVB19Ex4IHuBqRh5zM6MI=
last-modified
Mon, 12 Apr 2021 02:30:04 GMT
server
cloudflare
etag
W/"594d3cef98509b9461f429bf5b0e356d"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=gm2nhyjxsMjZdbxPNRAOyxageovMsVYE4LBCJKrLk%2F%2F5N5mJHPAEr1tlla2csHUJVN7f9droKU5eBKBURKl5%2FkuSR9%2BYqa712RtnCSmbYB9ifp0I5WEjwcwaWpeOYfq5AArIFg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
cache-control
s-maxage=1814400, max-age=1209600, stale-while-revalidate=900, s-maxage=31536000, max-age=31536000
access-control-allow-credentials
false
x-amz-version-id
cKpLd9F2Ix7k.Jqar0.eA5KbwB2erQU.
x-amz-cf-pop
IAD89-C1
cf-ray
69a49d7d5b4a1f19-FRA
x-amz-cf-id
28Qn-POPOPvf-EmBsXXxH_BveUm_HKpGmordLV9gJZngmRMiTSHkDg==
x-hs-cf-lambda-enforce
us-east-1.enforceAclForReadsProd 12
module_48386556055_CR_-_HTML_PopUp_Window_--_IOCs.css
www.cybereason.com/hs-fs/hub/3354902/hub_generated/module_assets/1622817551130/ 		3 KB
2 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.cybereason.com/hs-fs/hub/3354902/hub_generated/module_assets/1622817551130/module_48386556055_CR_-_HTML_PopUp_Window_--_IOCs.css
Requested by
Host: www.cybereason.com
URL: https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms?blaid=2123744
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
199.60.103.226 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
53f18426c8904b99d089e01c894d6cc5f2bbcb5416eab34cb134978d6e70cca5

Request headers

:path
/hs-fs/hub/3354902/hub_generated/module_assets/1622817551130/module_48386556055_CR_-_HTML_PopUp_Window_--_IOCs.css
pragma
no-cache
cookie
__cfruid=649f615bd690efb862dbcff90d2cb8293e32c367-1633583344
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
text/css,*/*;q=0.1
cache-control
no-cache
sec-fetch-dest
style
:authority
www.cybereason.com
referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms?blaid=2123744
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms?blaid=2123744
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

x-amz-meta-created-unix-time-millis
1622817551130
date
Thu, 07 Oct 2021 05:09:04 GMT
via
1.1 041a4887d523cabe8177e269cc358163.cloudfront.net (CloudFront)
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
3098
x-hs-alternate-content-type
text/plain
x-amz-server-side-encryption
AES256
x-cache
RefreshHit from cloudfront
x-edge-origin-shield-skipped
0
x-amz-replication-status
COMPLETED
x-hs-cf-lambda
us-east-1.enforceAclForReadsProd 12
content-encoding
br
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
x-amz-request-id
EMY204DKP2KC22ES
x-amz-id-2
r+wlbJyQi2J6iYTyFGJ5xhoI7bKSETDkPcLOpHaMD6m9d5/4ujTu3Qd1tLRxPKl2W8gj3nuYvy8=
last-modified
Fri, 04 Jun 2021 14:39:12 GMT
server
cloudflare
etag
W/"5a717c2929bb1377ac7a62cf72240a63"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=CIjdM6hHM5M0mvh%2FgV2k8quzKfSR%2BWvRbTFM21OhLtXcXioeMwCDncouucIYPWQ12ycUmOukA64y8B4XH2EYFj3e2vDpsNZkuHMLYO2uEqfX20kgNLYXp%2FR9bK4rL8Fmpq6hhg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
cache-control
s-maxage=1814400, max-age=1209600, stale-while-revalidate=900, s-maxage=31536000, max-age=31536000
access-control-allow-credentials
false
x-amz-version-id
POb_wh14yuPWmS90kW6Ma3KUAATvNjwi
x-amz-cf-pop
IAD89-C1
cf-ray
69a49d7d5b4c1f19-FRA
x-amz-cf-id
MlCWcRpNkQizTWEwI3ub5e07FYEpicbZKUVxFeQfG7PCzN4TxxNk1A==
x-hs-cf-lambda-enforce
us-east-1.enforceAclForReadsProd 12
module_43300360745_CR_-_Malicious_Life_Network_--_Related_Posts.min.css
www.cybereason.com/hs-fs/hub/3354902/hub_generated/module_assets/43300360745/1617857458537/ 		105 B
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.cybereason.com/hs-fs/hub/3354902/hub_generated/module_assets/43300360745/1617857458537/module_43300360745_CR_-_Malicious_Life_Network_--_Related_Posts.min.css
Requested by
Host: www.cybereason.com
URL: https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms?blaid=2123744
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
199.60.103.226 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
735e44959f60192ae3b93cfafd034f89a1cd8a95510fbac7aabaf9fa05d9465a

Request headers

:path
/hs-fs/hub/3354902/hub_generated/module_assets/43300360745/1617857458537/module_43300360745_CR_-_Malicious_Life_Network_--_Related_Posts.min.css
pragma
no-cache
cookie
__cfruid=649f615bd690efb862dbcff90d2cb8293e32c367-1633583344
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
text/css,*/*;q=0.1
cache-control
no-cache
sec-fetch-dest
style
:authority
www.cybereason.com
referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms?blaid=2123744
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms?blaid=2123744
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

x-amz-meta-created-unix-time-millis
1617857458537
date
Thu, 07 Oct 2021 05:09:04 GMT
via
1.1 55b6418a8a2f714a67d8e4d292154ef3.cloudfront.net (CloudFront)
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
3098
x-hs-alternate-content-type
text/plain
x-amz-server-side-encryption
AES256
x-cache
RefreshHit from cloudfront
x-edge-origin-shield-skipped
0
x-amz-replication-status
COMPLETED
x-hs-cf-lambda
us-east-1.enforceAclForReadsProd 12
content-encoding
br
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
x-amz-request-id
8579VJZ6AJCP0F0P
x-amz-id-2
TkhGxl+u0Veq8Hpr3Gcrz5bPEg4EnUqZC7oBw6XtrO29K/JN1RJzMNU1Vv9Kggumyq+z/Q+lrL0=
last-modified
Thu, 08 Apr 2021 04:50:59 GMT
server
cloudflare
etag
W/"b794f1cb3242ba801fcfb92cfc192f88"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=lSIULf6d2yCDajHfNIi%2Fx4%2B9olXrdUGs%2BKHII7brM1aQMw4ppZMZc1ORDGvykYaZs5oqDIHflottZrDHgKB%2F%2F40i9BfChtq7VoACZEvgvfLTog0x7D%2FpFtk4RspXn0y0SjOjCg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
cache-control
s-maxage=1814400, max-age=1209600, stale-while-revalidate=900, s-maxage=31536000, max-age=31536000
access-control-allow-credentials
false
x-amz-version-id
MJQ97OPQTN2vmCTXTBA96VHUt3wDMqMb
x-amz-cf-pop
IAD89-C1
cf-ray
69a49d7d5b4d1f19-FRA
x-amz-cf-id
C38io8TvjSHh0Vgaw-PmdKJApZHKEROi3QXSHhyOCortGQtuiQDjzw==
x-hs-cf-lambda-enforce
us-east-1.enforceAclForReadsProd 12
module_34473990280_CR_-_Footer_Full__en_US.min.css
www.cybereason.com/hs-fs/hub/3354902/hub_generated/module_assets/34473990280/1632494173098/ 		3 KB
2 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.cybereason.com/hs-fs/hub/3354902/hub_generated/module_assets/34473990280/1632494173098/module_34473990280_CR_-_Footer_Full__en_US.min.css
Requested by
Host: www.cybereason.com
URL: https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms?blaid=2123744
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
199.60.103.226 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
97831ff4832c4f000e924a97b5730bebd91816c3282cc2502fca83feebd993a8

Request headers

:path
/hs-fs/hub/3354902/hub_generated/module_assets/34473990280/1632494173098/module_34473990280_CR_-_Footer_Full__en_US.min.css
pragma
no-cache
cookie
__cfruid=649f615bd690efb862dbcff90d2cb8293e32c367-1633583344
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
text/css,*/*;q=0.1
cache-control
no-cache
sec-fetch-dest
style
:authority
www.cybereason.com
referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms?blaid=2123744
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms?blaid=2123744
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

x-amz-meta-created-unix-time-millis
1632494173098
date
Thu, 07 Oct 2021 05:09:04 GMT
via
1.1 88b63cb2f8aab28c7291262ffc15282f.cloudfront.net (CloudFront)
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
2131
x-hs-alternate-content-type
text/plain
x-amz-server-side-encryption
AES256
x-cache
RefreshHit from cloudfront
x-edge-origin-shield-skipped
0
x-amz-replication-status
COMPLETED
x-hs-cf-lambda
us-east-1.enforceAclForReadsProd 12
content-encoding
br
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
x-amz-request-id
ES5VJDKC4NJC5X9Y
x-amz-id-2
bafGYq/lIrZAlvfkGwqTUivoA7PMB+mOjet5UgNEo9CbwdJ3JhewuJdUkn0kO92pWVvCRXhMiQk=
last-modified
Fri, 24 Sep 2021 14:36:14 GMT
server
cloudflare
etag
W/"62e33551763d4b79d6470cf52ea33112"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=fSD5UVE5x7ix6vOcybStbxpdQOc79bivYliry2iv3o6A%2BY8wN1FLsVsbqaDy35jM%2FEN1GliVXXpIrjvBzNIIeLjOD3aYdPGJAAohe5AEzlipSBW%2BNjtGQJTcgXoHQRFdOfmHZA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
cache-control
s-maxage=1814400, max-age=1209600, stale-while-revalidate=900, s-maxage=31536000, max-age=31536000
access-control-allow-credentials
false
x-amz-version-id
a7WhmcS1dHt_u7SlDB3hQxnXv9M9H_7R
x-amz-cf-pop
IAD89-C1
cf-ray
69a49d7d5b4f1f19-FRA
x-amz-cf-id
boRbxJbJzGLZNQAUy5gJZlZtkLNxG-h2oTG1cRapfJxAiQMe-GtWOQ==
x-hs-cf-lambda-enforce
us-east-1.enforceAclForReadsProd 12
vyv2ljd.js
use.typekit.net/ 		19 KB
7 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://use.typekit.net/vyv2ljd.js
Requested by
Host: www.cybereason.com
URL: https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms?blaid=2123744
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.16.186.58 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a2-16-186-58.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
3548fdd09c76e6d1a78dc0890d0da250339a5021ef499ac8b61f9d1bfae1a43b
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains;

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms?blaid=2123744
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains;
content-encoding
gzip
server
nginx
date
Thu, 07 Oct 2021 05:09:04 GMT
vary
Accept-Encoding
content-type
text/javascript;charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=600, stale-while-revalidate=604800
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
content-length
7011
in.js
platform.linkedin.com/ 		201 KB
61 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://platform.linkedin.com/in.js
Requested by
Host: www.cybereason.com
URL: https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms?blaid=2123744
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2.16.186.24 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a2-16-186-24.deploy.static.akamaitechnologies.com
Software
Play /
Resource Hash
6cbb1738fe282734c8ddc440165f5debb94786a1ee3cecc6e625d77736cfdb60

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms?blaid=2123744
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

X-LI-UUID
pxXvuu+mqxbAMWxWXCsAAA==
Date
Thu, 07 Oct 2021 05:09:04 GMT
Content-Encoding
gzip
X-CDN-CLIENT-IP-VERSION
IPV4
Server
Play
X-Li-Pop
prod-eda6
Vary
Accept-Encoding
Content-Type
text/javascript; charset=UTF-8
Cache-Control
public, max-age=3600
Connection
keep-alive
X-LI-Proto
http/1.1
Content-Length
62393
X-CDN
AKAM
X-Li-Fabric
prod-ltx1
Expires
Thu, 7 Oct 2021 06:00:38 GMT
layout.min.css
cdn2.hubspot.net/hub/7052064/hub_generated/template_assets/1633550986204/hubspot/hubspot_default/shared/responsive/ 		5 KB
2 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://cdn2.hubspot.net/hub/7052064/hub_generated/template_assets/1633550986204/hubspot/hubspot_default/shared/responsive/layout.min.css
Requested by
Host: www.cybereason.com
URL: https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms?blaid=2123744
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.17.244.204 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
341a4d40ad1b2560db940f906716d0e9539d4c0785399d7e0348fd0d3af00170

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms?blaid=2123744
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

x-amz-meta-created-unix-time-millis
1633550986282
date
Thu, 07 Oct 2021 05:09:04 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
32248
x-hs-alternate-content-type
text/plain
x-amz-server-side-encryption
AES256
x-edge-origin-shield-skipped
0
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=R7xWCicb9aEgxIW%2B8h9q9YSN3kA1IMbCdfIiKg7vQyHET26ss%2FwWTalQzmNvs%2FKcel12a7A7Tub3CaVgUeELyyWt6RhWhqw3JZhhNUo1eKLSLglDeUoT9t6SFGO0yng4eMs%3D"}],"group":"cf-nel","max_age":604800}
x-amz-replication-status
COMPLETED
x-hs-cf-lambda
us-east-1.enforceAclForReadsProd 12
last-modified
Wed, 06 Oct 2021 20:09:47 GMT
server
cloudflare
etag
W/"0b0c633d59ab0af9553a98c0e7d97349"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
access-control-allow-methods
GET
content-type
text/css
access-control-allow-origin
*
cache-control
s-maxage=1814400, max-age=1209600, stale-while-revalidate=900
x-amz-cf-pop
IAD89-C1
cf-ray
69a49d7d8e8b42f1-FRA
x-hs-cf-lambda-enforce
us-east-1.enforceAclForReadsProd 12
cr-master__cta.min.css
www.cybereason.com/hs-fs/hub/3354902/hub_generated/template_assets/34470223313/1627492001587/__CR_Web_Platform_2020/CSS/ 		2 KB
2 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.cybereason.com/hs-fs/hub/3354902/hub_generated/template_assets/34470223313/1627492001587/__CR_Web_Platform_2020/CSS/cr-master__cta.min.css
Requested by
Host: www.cybereason.com
URL: https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms?blaid=2123744
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
199.60.103.226 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
e4d41fad643257f1b89daa37cbe8d9c0ce35a9d39a465e126a11311c03c703c2

Request headers

:path
/hs-fs/hub/3354902/hub_generated/template_assets/34470223313/1627492001587/__CR_Web_Platform_2020/CSS/cr-master__cta.min.css
pragma
no-cache
cookie
__cfruid=649f615bd690efb862dbcff90d2cb8293e32c367-1633583344
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
text/css,*/*;q=0.1
cache-control
no-cache
sec-fetch-dest
style
:authority
www.cybereason.com
referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms?blaid=2123744
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms?blaid=2123744
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

x-amz-meta-created-unix-time-millis
1627492001673
date
Thu, 07 Oct 2021 05:09:04 GMT
via
1.1 85fc1201a1918facbeb30836e7391661.cloudfront.net (CloudFront)
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
3098
x-hs-alternate-content-type
text/plain
x-amz-server-side-encryption
AES256
x-cache
RefreshHit from cloudfront
x-edge-origin-shield-skipped
0
x-amz-replication-status
COMPLETED
x-hs-cf-lambda
us-east-1.enforceAclForReadsProd 12
content-encoding
br
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
x-amz-request-id
ES5PP1PD4H465HBE
x-amz-id-2
APQtHyJb6joy4ddq1A5xcX1qhifTZiZ2ESp9c8wQEiPCReQQayGbRXdqKiJ5f7K/hpYV/nZZjNE=
last-modified
Wed, 28 Jul 2021 17:06:42 GMT
server
cloudflare
etag
W/"89ac76f7f2d4099077234fa1f66eb594"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=rjyyTW0%2FerrHMvMasxGYsxtK1USPI5Efi1DI85eA1M%2FNtxnhXFRKUG6O63GvUj4Ql7Yyd7S%2BlqDTHMUOu1pnuWwe1DJhuAL2poM0enUeK55AI3ViO3nUSI2E%2Bf1VwgatSsDrRQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
cache-control
s-maxage=1814400, max-age=1209600, stale-while-revalidate=900, s-maxage=31536000, max-age=31536000
access-control-allow-credentials
false
x-amz-version-id
DwYN0wc2E8h77jnC2saxPkBPwAxtxVqR
x-amz-cf-pop
IAD89-C1
cf-ray
69a49d7d5b521f19-FRA
x-amz-cf-id
fBZFL7Gq-gsGCdU9CdSRVYgzQJkrL3IYdscvQwg_7LImVx_ORn7cAw==
x-hs-cf-lambda-enforce
us-east-1.enforceAclForReadsProd 12
cr-master__main.min.css
www.cybereason.com/hs-fs/hub/3354902/hub_generated/template_assets/34470477360/1632935872906/__CR_Web_Platform_2020/CSS/ 		44 KB
10 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.cybereason.com/hs-fs/hub/3354902/hub_generated/template_assets/34470477360/1632935872906/__CR_Web_Platform_2020/CSS/cr-master__main.min.css
Requested by
Host: www.cybereason.com
URL: https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms?blaid=2123744
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
199.60.103.226 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
5f0957fb43888099a11b4be327296643a4d9c6889303d02a0240b3b341855a9c

Request headers

:path
/hs-fs/hub/3354902/hub_generated/template_assets/34470477360/1632935872906/__CR_Web_Platform_2020/CSS/cr-master__main.min.css
pragma
no-cache
cookie
__cfruid=649f615bd690efb862dbcff90d2cb8293e32c367-1633583344
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
text/css,*/*;q=0.1
cache-control
no-cache
sec-fetch-dest
style
:authority
www.cybereason.com
referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms?blaid=2123744
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms?blaid=2123744
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

x-amz-meta-created-unix-time-millis
1632935873022
date
Thu, 07 Oct 2021 05:09:04 GMT
via
1.1 5195de19cbc5ce842ac6538e9a6850cb.cloudfront.net (CloudFront)
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
3098
x-hs-alternate-content-type
text/plain
x-amz-server-side-encryption
AES256
x-cache
RefreshHit from cloudfront
x-edge-origin-shield-skipped
0
x-amz-replication-status
COMPLETED
x-hs-cf-lambda
us-east-1.enforceAclForReadsProd 12
content-encoding
br
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
x-amz-request-id
ES5QHKQYSRJBN3Z7
x-amz-id-2
gr2pwkcIRD/goXr8U9NEqnYau4vI3kcKKvPJJv+/LCTesxeWa5gzx6V2ItfIm5x/sdfRdPt5G6M=
last-modified
Wed, 29 Sep 2021 17:17:54 GMT
server
cloudflare
etag
W/"8dffe180304436c8890e4deb45900016"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=dUJrNJYsc5Eb%2F6gIFCBgtk%2Bi%2BXPNXrDHUMZv1uTHvNp2TJ0wbYLfFd3uslvH2wIZ1KB8uN8RzYWH0HX%2BgravSNVi5FeV9%2FgSf7RY80W7qebwDylOwmkNBQy0u4PT0Uw9iaHg2w%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
cache-control
s-maxage=1814400, max-age=1209600, stale-while-revalidate=900, s-maxage=31536000, max-age=31536000
access-control-allow-credentials
false
x-amz-version-id
X_8IoxVRV2kLtsLT671XeGqCxkaiEaey
x-amz-cf-pop
IAD89-C1
cf-ray
69a49d7d5b531f19-FRA
x-amz-cf-id
sEl1mJk46etW-WQTfATeawpsenvi6Tdsw4xyISvlIKCldSbSLf4QUQ==
x-hs-cf-lambda-enforce
us-east-1.enforceAclForReadsProd 12
ionicons.min.css
www.cybereason.com/hs-fs/hub/3354902/hub_generated/template_assets/35275979682/1600880367101/__CR_Web_Platform_2020/CSS/ 		50 KB
9 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.cybereason.com/hs-fs/hub/3354902/hub_generated/template_assets/35275979682/1600880367101/__CR_Web_Platform_2020/CSS/ionicons.min.css
Requested by
Host: www.cybereason.com
URL: https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms?blaid=2123744
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
199.60.103.226 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
72fe18777ebf37b44d58c82be9b67edceefb88c2c6984c614c72991d6e3b8853

Request headers

:path
/hs-fs/hub/3354902/hub_generated/template_assets/35275979682/1600880367101/__CR_Web_Platform_2020/CSS/ionicons.min.css
pragma
no-cache
cookie
__cfruid=649f615bd690efb862dbcff90d2cb8293e32c367-1633583344
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
text/css,*/*;q=0.1
cache-control
no-cache
sec-fetch-dest
style
:authority
www.cybereason.com
referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms?blaid=2123744
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms?blaid=2123744
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

x-amz-meta-created-unix-time-millis
1600880367101
date
Thu, 07 Oct 2021 05:09:04 GMT
via
1.1 b5e757a7da6f6fe6261f56a8a9646881.cloudfront.net (CloudFront)
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
3098
x-hs-alternate-content-type
text/plain
x-amz-server-side-encryption
AES256
x-cache
RefreshHit from cloudfront
x-edge-origin-shield-skipped
0
x-amz-replication-status
COMPLETED
x-hs-cf-lambda
us-east-1.enforceAclForReadsProd 12
content-encoding
br
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
x-amz-request-id
ES5VJHPCDVH4J28Z
x-amz-id-2
ekYo/wua2mdPnRQlvF58JGgoQM06R4+IHNqRbv2YpG7utG+hZYYh/JHuh0TH1w75yQgIPh5Umzs=
last-modified
Wed, 23 Sep 2020 16:59:28 GMT
server
cloudflare
etag
W/"71c8c946791f3411c42a4cb1e9cdb5ed"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=dGuIzhgmeANgC42L%2Fa9ySZYxam1RADMIQ5Lxv5TIO79lcoNQnur1Hpr0Z9GUoh9taMLpnGxWJNKrioMD7NXTkJmHle%2FPnhRc1fWmg42E2n1A2Bi%2BvnHK%2BZp1K%2B7DkgSbsrHzMw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
cache-control
s-maxage=1814400, max-age=1209600, stale-while-revalidate=900, s-maxage=31536000, max-age=31536000
access-control-allow-credentials
false
x-amz-version-id
sBk0NTXt5JC0boW_cB8Js8IeL5M2sXdU
x-amz-cf-pop
IAD89-C1
cf-ray
69a49d7d5b541f19-FRA
x-amz-cf-id
UGlcas-G0lShQzNkdykIITg0CXKxQpeg3qphZN5llxgBzCTCfdfg5Q==
x-hs-cf-lambda-enforce
us-east-1.enforceAclForReadsProd 12
cr-mln__build.min.css
www.cybereason.com/hs-fs/hub/3354902/hub_generated/template_assets/42760289143/1624557581500/__CR_Web_Platform_2020/CSS/ 		13 KB
4 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.cybereason.com/hs-fs/hub/3354902/hub_generated/template_assets/42760289143/1624557581500/__CR_Web_Platform_2020/CSS/cr-mln__build.min.css
Requested by
Host: www.cybereason.com
URL: https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms?blaid=2123744
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
199.60.103.226 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
a939b9fcb8cdec877464e6131704ef19effd6279467d48bd42afe7af8558391c

Request headers

:path
/hs-fs/hub/3354902/hub_generated/template_assets/42760289143/1624557581500/__CR_Web_Platform_2020/CSS/cr-mln__build.min.css
pragma
no-cache
cookie
__cfruid=649f615bd690efb862dbcff90d2cb8293e32c367-1633583344
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
text/css,*/*;q=0.1
cache-control
no-cache
sec-fetch-dest
style
:authority
www.cybereason.com
referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms?blaid=2123744
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms?blaid=2123744
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

x-amz-meta-created-unix-time-millis
1624557581580
date
Thu, 07 Oct 2021 05:09:04 GMT
via
1.1 5eb5e19c1a78889d10ff38f1551ed2aa.cloudfront.net (CloudFront)
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
3098
x-hs-alternate-content-type
text/plain
x-amz-server-side-encryption
AES256
x-cache
RefreshHit from cloudfront
x-edge-origin-shield-skipped
0
x-amz-replication-status
COMPLETED
x-hs-cf-lambda
us-east-1.enforceAclForReadsProd 12
content-encoding
br
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
x-amz-request-id
8PB19XKPJ796KE54
x-amz-id-2
aiA8ODy7TkQfPwLsaGyVAxGMH61YnDDazXRBu4/EkMppjgYi2iiDLMdFMLUyPQv6c8uOQzrsMdQ=
last-modified
Thu, 24 Jun 2021 17:59:42 GMT
server
cloudflare
etag
W/"badac49ceb808e0da5626ecf98b71573"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=JuzyRiie9YqZR4d5LDn8nmOBs43WWoWvJrm6TwP43UkK5bLcr2%2FvHUiPvwZE0airxma09GdPtvcO730jVA6VxfJPTQcRmX8kNmYMxTVIm7FAkezOhiKyLNUrBnZJrzgOYGgBxA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
cache-control
s-maxage=1814400, max-age=1209600, stale-while-revalidate=900, s-maxage=31536000, max-age=31536000
access-control-allow-credentials
false
x-amz-version-id
AuAOSI.b8qeNmiOriOmPI0duibPKybLM
x-amz-cf-pop
IAD89-C1
cf-ray
69a49d7d5b561f19-FRA
x-amz-cf-id
hEsI3DcA42KkAUjL51S_FICAi-M88G0KXxrYmnCKmDCMEC0F4u61mg==
x-hs-cf-lambda-enforce
us-east-1.enforceAclForReadsProd 12
cr-framework__bulma-columns.min.css
www.cybereason.com/hs-fs/hub/3354902/hub_generated/template_assets/34470224480/1633108735922/__CR_Web_Platform_2020/CSS/bulma/ 		19 KB
4 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.cybereason.com/hs-fs/hub/3354902/hub_generated/template_assets/34470224480/1633108735922/__CR_Web_Platform_2020/CSS/bulma/cr-framework__bulma-columns.min.css
Requested by
Host: www.cybereason.com
URL: https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms?blaid=2123744
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
199.60.103.226 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
81c836c05ab1f2d37b7aa60d509a656c7a441e2a4fabf035c1b0666a4daa50fa

Request headers

:path
/hs-fs/hub/3354902/hub_generated/template_assets/34470224480/1633108735922/__CR_Web_Platform_2020/CSS/bulma/cr-framework__bulma-columns.min.css
pragma
no-cache
cookie
__cfruid=649f615bd690efb862dbcff90d2cb8293e32c367-1633583344
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
text/css,*/*;q=0.1
cache-control
no-cache
sec-fetch-dest
style
:authority
www.cybereason.com
referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms?blaid=2123744
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms?blaid=2123744
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

x-amz-meta-created-unix-time-millis
1633108736047
date
Thu, 07 Oct 2021 05:09:04 GMT
via
1.1 2ad0cde89ab58d454177893ae4447f50.cloudfront.net (CloudFront)
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
3098
x-hs-alternate-content-type
text/plain
x-amz-server-side-encryption
AES256
x-cache
RefreshHit from cloudfront
x-edge-origin-shield-skipped
0
x-amz-replication-status
PENDING
x-hs-cf-lambda
us-east-1.enforceAclForReadsProd 12
content-encoding
br
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
x-amz-request-id
DMNVP5KWK7P2A8JE
x-amz-id-2
meIyduAFtCSAgJNpnOhtvP91j4JHP/nkJxyK7OLmK8wqUIuBizI0gRnq5CpLNOsVHP7KlLzrdEc=
last-modified
Fri, 01 Oct 2021 17:18:57 GMT
server
cloudflare
etag
W/"636c18615b58fca9536b2e1c578c6db7"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=xEVHAkofjptUKkBxaZf2DWKzjRGrsiTy%2FgaZrjQYrBPxUzlSAq92b7G89mxBUPv9afCfcs6Q5NDcdy3yz3EN%2FnU66mOq5rpeVomMpGKF8WwNC88GUnTrHRGC5kMi5l8DtvIwiQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
cache-control
s-maxage=1814400, max-age=1209600, stale-while-revalidate=900, s-maxage=31536000, max-age=31536000
access-control-allow-credentials
false
x-amz-version-id
Yad_57oe8BCKtK5OVbjoaVEXuSXjLBHB
x-amz-cf-pop
IAD89-C1
cf-ray
69a49d7d5b571f19-FRA
x-amz-cf-id
_tl2LKOhSS25htfE_iB9noReusIXt_CNrGgamuoRyWCqyUrQH3AWNg==
x-hs-cf-lambda-enforce
us-east-1.enforceAclForReadsProd 12
cr-framework__bulma.min.css
www.cybereason.com/hs-fs/hub/3354902/hub_generated/template_assets/35291999472/1614661129976/__CR_Web_Platform_2020/CSS/bulma/ 		64 KB
10 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.cybereason.com/hs-fs/hub/3354902/hub_generated/template_assets/35291999472/1614661129976/__CR_Web_Platform_2020/CSS/bulma/cr-framework__bulma.min.css
Requested by
Host: www.cybereason.com
URL: https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms?blaid=2123744
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
199.60.103.226 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
0a1db8e6cb7ae20e5ac308a25943b94734e7ad0f794b26eb778c7e38ae2b51e0

Request headers

:path
/hs-fs/hub/3354902/hub_generated/template_assets/35291999472/1614661129976/__CR_Web_Platform_2020/CSS/bulma/cr-framework__bulma.min.css
pragma
no-cache
cookie
__cfruid=649f615bd690efb862dbcff90d2cb8293e32c367-1633583344
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
text/css,*/*;q=0.1
cache-control
no-cache
sec-fetch-dest
style
:authority
www.cybereason.com
referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms?blaid=2123744
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms?blaid=2123744
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

x-amz-meta-created-unix-time-millis
1614661129976
date
Thu, 07 Oct 2021 05:09:04 GMT
via
1.1 d1cde188ada6755fe03b8541b71fce4a.cloudfront.net (CloudFront)
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
3098
x-hs-alternate-content-type
text/plain
x-amz-server-side-encryption
AES256
x-cache
RefreshHit from cloudfront
x-edge-origin-shield-skipped
0
x-amz-replication-status
COMPLETED
x-hs-cf-lambda
us-east-1.enforceAclForReadsProd 12
content-encoding
br
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
x-amz-request-id
ES5VPPH6QHN724J0
x-amz-id-2
Ah14ucVpE7M3/+rkd/O8UAkjMw8T8LSCnwpUdkDDr7zfaMNocqluGOrW5RivF/LB8pGjknKIXeg=
last-modified
Tue, 02 Mar 2021 04:58:50 GMT
server
cloudflare
etag
W/"88605a5e2df657681a0605d62c89a631"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=VGvmSNB5R84zA%2B%2FfDMSsKd5bSh%2FNeykGyViJuTAuAl%2BCP6NUCoTqBJi5JpihkX2Qs9Mvo9bgFdePqws8rHWbBbdnjOGKiGcn8t%2BAPeJVZuB7VwL2ru386d7wBUHYDMjxOdHSPA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
cache-control
s-maxage=1814400, max-age=1209600, stale-while-revalidate=900, s-maxage=31536000, max-age=31536000
access-control-allow-credentials
false
x-amz-version-id
tAd3t.xCRJ6C07U_zCfDzg5hCYB7E5P1
x-amz-cf-pop
IAD89-C1
cf-ray
69a49d7d5b581f19-FRA
x-amz-cf-id
ArrKwJRCOOQ-pEa-1Jmv5zXZjGVpYSPqERe6tM8dK4nkZr2Xo1VvSw==
x-hs-cf-lambda-enforce
us-east-1.enforceAclForReadsProd 12
hamburger-animation.min.css
www.cybereason.com/hs-fs/hub/3354902/hub_generated/template_assets/42363645447/1614911253070/__CR_Web_Platform_2020/CSS/ 		22 KB
4 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.cybereason.com/hs-fs/hub/3354902/hub_generated/template_assets/42363645447/1614911253070/__CR_Web_Platform_2020/CSS/hamburger-animation.min.css
Requested by
Host: www.cybereason.com
URL: https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms?blaid=2123744
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
199.60.103.226 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
c9130ee8c979a74ab038cf5e8a06db5cb94253eab35ea5242f515d605f4781ad

Request headers

:path
/hs-fs/hub/3354902/hub_generated/template_assets/42363645447/1614911253070/__CR_Web_Platform_2020/CSS/hamburger-animation.min.css
pragma
no-cache
cookie
__cfruid=649f615bd690efb862dbcff90d2cb8293e32c367-1633583344
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
text/css,*/*;q=0.1
cache-control
no-cache
sec-fetch-dest
style
:authority
www.cybereason.com
referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms?blaid=2123744
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms?blaid=2123744
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

x-amz-meta-created-unix-time-millis
1614911253070
date
Thu, 07 Oct 2021 05:09:04 GMT
via
1.1 041a4887d523cabe8177e269cc358163.cloudfront.net (CloudFront)
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
3098
x-hs-alternate-content-type
text/plain
x-amz-server-side-encryption
AES256
x-cache
RefreshHit from cloudfront
x-edge-origin-shield-skipped
0
x-amz-replication-status
COMPLETED
x-hs-cf-lambda
us-east-1.enforceAclForReadsProd 12
content-encoding
br
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
x-amz-request-id
KEZY2B41Q2FQSJ35
x-amz-id-2
RL9J5tXTz6H/jT4eCW/bzBwkyUmASFjeufyKBnHKdJw+kAnvSxnzhL2TLsrgLa0n/zxq20CYzQ4=
last-modified
Fri, 05 Mar 2021 02:27:34 GMT
server
cloudflare
etag
W/"a0b451fd96744fa455495e022542ab86"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=bbdzje7Vm%2BbeCqKMuhzx4ZhvitUEkQAybN5bsHomgvLhyXkrGtBVILGV72tdrnR5Fm%2FtgjOcEOYYU6wI6%2BXPYUVQ4coJ9VSMsFqpfk%2FFocWbUwvnwDwJ3GCohN6ZgoCQC9umqw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
cache-control
s-maxage=1814400, max-age=1209600, stale-while-revalidate=900, s-maxage=31536000, max-age=31536000
access-control-allow-credentials
false
x-amz-version-id
48HHzBt1ZAHNHDF25QKABbh_JsEPbDqv
x-amz-cf-pop
IAD89-C1
cf-ray
69a49d7d5b5a1f19-FRA
x-amz-cf-id
tmX46PWS9YY_n3DxHan7ptIIlZRF7VkBHcU3Wfanb8X7Tn7_2tfZDQ==
x-hs-cf-lambda-enforce
us-east-1.enforceAclForReadsProd 12
animate.min.min.css
www.cybereason.com/hs-fs/hub/3354902/hub_generated/template_assets/42507091846/1614920868925/__CR_Web_Platform_2020/CSS/ 		52 KB
5 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.cybereason.com/hs-fs/hub/3354902/hub_generated/template_assets/42507091846/1614920868925/__CR_Web_Platform_2020/CSS/animate.min.min.css
Requested by
Host: www.cybereason.com
URL: https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms?blaid=2123744
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
199.60.103.226 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
267c1ae37916b433b1515b4687883dbc2fef448a533e33bbe97085d42c7738d5

Request headers

:path
/hs-fs/hub/3354902/hub_generated/template_assets/42507091846/1614920868925/__CR_Web_Platform_2020/CSS/animate.min.min.css
pragma
no-cache
cookie
__cfruid=649f615bd690efb862dbcff90d2cb8293e32c367-1633583344
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
text/css,*/*;q=0.1
cache-control
no-cache
sec-fetch-dest
style
:authority
www.cybereason.com
referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms?blaid=2123744
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms?blaid=2123744
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

x-amz-meta-created-unix-time-millis
1614920868925
date
Thu, 07 Oct 2021 05:09:04 GMT
via
1.1 ef6762d67d012a06d2761f42352c9e53.cloudfront.net (CloudFront)
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
3098
x-hs-alternate-content-type
text/plain
x-amz-server-side-encryption
AES256
x-cache
RefreshHit from cloudfront
x-edge-origin-shield-skipped
0
x-amz-replication-status
COMPLETED
x-hs-cf-lambda
us-east-1.enforceAclForReadsProd 12
content-encoding
br
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
x-amz-request-id
KEZKW7KY4EGQDVPW
x-amz-id-2
5yZBUiccKVI2Uczf4kYclwxOPielXbddneIN1rRqiaw5/6KBQgKpcJBioovKIQ6fR/QGLEdZ9vk=
last-modified
Fri, 05 Mar 2021 05:07:49 GMT
server
cloudflare
etag
W/"a091d6db21bd52764bd7a33e2944a606"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Ec4TiXdC46hJCsyQWc1NS6KBwAhVr7V2LhGWaJWD4NTTm9hvnAwsMcQ7%2FfglEJzqeQSriJF87VapC1ufZv2QONR5r%2BSmQT8x%2Bu5YRZ151LJTLy8oLNTPj59TrCvTFi97sz8A6A%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
cache-control
s-maxage=1814400, max-age=1209600, stale-while-revalidate=900, s-maxage=31536000, max-age=31536000
access-control-allow-credentials
false
x-amz-version-id
N.0JvpMrNL6R6ApQYx9Po1pYOHB20NAT
x-amz-cf-pop
IAD89-C1
cf-ray
69a49d7d5b5c1f19-FRA
x-amz-cf-id
oqHOKxsHUKkUvp0a1lrycQqy9tW5P3sDiaB_N2AHzT5mngVH8Mu-vg==
x-hs-cf-lambda-enforce
us-east-1.enforceAclForReadsProd 12
font-awesome.min.css
cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/css/ 		30 KB
6 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/css/font-awesome.min.css
Requested by
Host: www.cybereason.com
URL: https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms?blaid=2123744
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.16.19.94 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd
Security Headers
Name Value
Strict-Transport-Security max-age=15780000
X-Content-Type-Options nosniff

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms?blaid=2123744
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Thu, 07 Oct 2021 05:09:04 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age
3814561
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length
5631
timing-allow-origin
*
last-modified
Mon, 04 May 2020 16:10:07 GMT
server
cloudflare
cf-cdnjs-via
cfworker/kv
etag
"5eb03e5f-7918"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=15780000
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=2uTmgk4e0A0dJWJXUzJif0HtDZJOcqePtDj%2F7wtTCAL7U1r3%2F9ErPGvH7D1x31z82s%2BORpOtvTTpDeVX4R0gIqWAEI6StmJc%2BEC5dQPOlq4gbVXqSVTvA96TioiBWMeCVMjmZdOx"}],"group":"cf-nel","max_age":604800}
content-type
text/css; charset=utf-8
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=30672000
accept-ranges
bytes
cf-ray
69a49d7d7fb35bed-FRA
expires
Tue, 27 Sep 2022 05:09:04 GMT
marker-animation.js
www.cybereason.com/hubfs/dam/plugins/ 		6 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.cybereason.com/hubfs/dam/plugins/marker-animation.js
Requested by
Host: www.cybereason.com
URL: https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms?blaid=2123744
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
199.60.103.226 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
843803aeba82f94da6f1cbe1f853ccd12f5d7cc6a3afa20923e57e5df60c412d

Request headers

:path
/hubfs/dam/plugins/marker-animation.js
pragma
no-cache
cookie
__cfruid=649f615bd690efb862dbcff90d2cb8293e32c367-1633583344
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
script
:authority
www.cybereason.com
referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms?blaid=2123744
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms?blaid=2123744
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

content-encoding
br
x-amz-meta-cache-tag
F-36714670113,FD-35651288461,P-3354902,FLS-ALL
age
549046
x-amz-server-side-encryption
AES256
edge-cache-tag
F-36714670113,FD-35651288461,P-3354902,FLS-ALL
x-edge-origin-shield-skipped
0
x-amz-replication-status
COMPLETED
x-hs-cf-lambda
us-east-1.enforceAclForReadsProd 12
x-amz-request-id
FQA1XHSY9C99CDV2
etag
W/"c789451d244987df6815383a74c748e9"
vary
Accept-Encoding
access-control-allow-methods
GET
content-type
application/javascript
access-control-allow-origin
*
cache-control
s-maxage=1814400, max-age=1209600, stale-while-revalidate=900
x-robots-tag
all
x-hs-cf-lambda-enforce
us-east-1.enforceAclForReadsProd 12
x-amz-meta-created-unix-time-millis
1603818553593
date
Thu, 07 Oct 2021 05:09:04 GMT
via
1.1 0f538ee832e1105649039b38ce89e883.cloudfront.net (CloudFront)
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-amz-cf-pop
FRA2-C1
x-hs-alternate-content-type
text/plain
x-cache
RefreshHit from cloudfront
x-amz-meta-index-tag
all
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
x-amz-id-2
4P8Ev2lXdmcURmTm2fvacKCJu1ATinEAakJYaZDcnzoLWutORL/cI+xpEPNEMXEX/OZLZEw4D2U=
last-modified
Tue, 27 Oct 2020 17:09:14 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Glmmu%2FMgqLAFgOVWCPVdaSyqd0dawE6hh2Aqb8jwzSfZbllq0TuSPjCcHgAHybE5cLsB%2BbpXQiHeBbVOx%2Fl2g0whrcpk%2BMCT7%2BIewZ4j4aKajn7SeUEnaREuoeSshCnTqOGOdg%3D%3D"}],"group":"cf-nel","max_age":604800}
x-amz-version-id
sJPPhJRtfwkomYz4StFq0KxvBmQZgdrG
cf-ray
69a49d7d5b5d1f19-FRA
x-amz-cf-id
B1mldmortL764QVKIlMpQPM4hypX3FvHqJPDFduoD9GPivDBuKyoyA==
cr-logo-web-horizontal-black-500px.png
www.cybereason.com/hubfs/dam/images/images-web/logos/ 		5 KB
6 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.cybereason.com/hubfs/dam/images/images-web/logos/cr-logo-web-horizontal-black-500px.png
Requested by
Host: www.cybereason.com
URL: https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms?blaid=2123744
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
199.60.103.226 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
2311b7d2f30a6ab89191098f12c99253267df7219477c0702d58bf4999f4a703

Request headers

:path
/hubfs/dam/images/images-web/logos/cr-logo-web-horizontal-black-500px.png
pragma
no-cache
cookie
__cfruid=649f615bd690efb862dbcff90d2cb8293e32c367-1633583344
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
www.cybereason.com
referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms?blaid=2123744
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms?blaid=2123744
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

x-amz-meta-cache-tag
F-36668407494,FD-35695393279,P-3354902,FLS-ALL
age
551052
x-amz-server-side-encryption
AES256
edge-cache-tag
F-36668407494,FD-35695393279,P-3354902,FLS-ALL
x-edge-origin-shield-skipped
0
x-amz-replication-status
COMPLETED
content-disposition
inline; filename="cr-logo-web-horizontal-black-500px.webp"
x-hs-cf-lambda
us-east-1.enforceAclForReadsProd 12
x-amz-request-id
1V70ZRXDNKBMDRH1
cf-bgj
imgq:85,h2pri
etag
"acbeba65a7e33212196b1386c365e1fb"
vary
Accept, Accept-Encoding
access-control-allow-methods
GET
content-type
image/webp
access-control-allow-origin
*
cache-control
s-maxage=1814400, max-age=1209600, stale-while-revalidate=900
x-robots-tag
all
x-hs-cf-lambda-enforce
us-east-1.enforceAclForReadsProd 12
x-amz-meta-created-unix-time-millis
1603732670207
date
Thu, 07 Oct 2021 05:09:04 GMT
via
1.1 e39402e2cf62b31f7774452c905f38f3.cloudfront.net (CloudFront)
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-amz-cf-pop
FRA56-C1
x-hs-alternate-content-type
text/plain
cf-polished
origFmt=png, origSize=9553
x-cache
RefreshHit from cloudfront
x-amz-meta-index-tag
all
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length
5062
x-amz-id-2
pQsw8nJKxB7Yr6VAQixTI79/PMNDB9v2LimBZhJmgOKOW0cvukUIiJcS2mMXrAuEtlNkfmvjzz8=
last-modified
Mon, 26 Oct 2020 17:18:08 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=KwpoEvPGL7px3F%2Blt7nRUnsY5Kl1HMofTm04dScP6OptQfm4piFGXRxmAyw0HklZ4MxhJCs6GQ1NOBu1U44946AAqgiB2pFvVd6fHgBe0%2BqpYZW4D%2BblTwpd847LNErEnculQQ%3D%3D"}],"group":"cf-nel","max_age":604800}
x-amz-version-id
Fi99aeAoW1lKCRBa1uJA0OV6mR9Vcx_U
accept-ranges
bytes
cf-ray
69a49d7eac5c1f19-FRA
x-amz-cf-id
CHJjUPe586yB4lXdQjUqTQceTWm_smkVhe7QdNnAZK1eW4__w0xwIA==
cr-malicious-life-network-logo.svg
www.cybereason.com/hubfs/dam/images/images-web/blog-images/template-images/ 		23 KB
8 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.cybereason.com/hubfs/dam/images/images-web/blog-images/template-images/cr-malicious-life-network-logo.svg
Requested by
Host: www.cybereason.com
URL: https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms?blaid=2123744
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
199.60.103.226 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
59d91999b3e0f1e6191f29f73b2b079ee1aa1350f3d88795db7518ca40a9be60

Request headers

:path
/hubfs/dam/images/images-web/blog-images/template-images/cr-malicious-life-network-logo.svg
pragma
no-cache
cookie
__cfruid=649f615bd690efb862dbcff90d2cb8293e32c367-1633583344
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
www.cybereason.com
referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms?blaid=2123744
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms?blaid=2123744
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

content-encoding
br
x-amz-meta-cache-tag
F-41718939860,FD-41718904629,P-3354902,FLS-ALL
age
549046
x-amz-server-side-encryption
AES256
edge-cache-tag
F-41718939860,FD-41718904629,P-3354902,FLS-ALL
x-edge-origin-shield-skipped
0
x-amz-replication-status
COMPLETED
x-hs-cf-lambda
us-east-1.enforceAclForReadsProd 12
x-amz-request-id
YQVKTS0KWKAK7JX8
etag
W/"559d4455bd1fe5c187804bc088e7c79f"
vary
Accept-Encoding
access-control-allow-methods
GET
content-type
image/svg+xml
access-control-allow-origin
*
cache-control
s-maxage=1814400, max-age=1209600, stale-while-revalidate=900
x-robots-tag
all
x-hs-cf-lambda-enforce
us-east-1.enforceAclForReadsProd 12
x-amz-meta-created-unix-time-millis
1613708849844
date
Thu, 07 Oct 2021 05:09:04 GMT
via
1.1 d8eef512ab23f23f549b4cd25ac5328d.cloudfront.net (CloudFront)
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-amz-cf-pop
FRA2-C1
x-hs-alternate-content-type
text/plain
x-cache
RefreshHit from cloudfront
x-amz-meta-index-tag
all
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
x-amz-id-2
DsADWxg7wYPHE0HK2oR97x0UQK7C4SE3SENU5dOdftmGwjJZ0fU/SeCPH2m8dynWewlwu/Okvs4=
last-modified
Fri, 19 Feb 2021 04:27:30 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=zQViaZFUuaUgR8xrHtsRfeyXjXVsrapoDMURcY5s8ZuDdEP4dGLAxzqLowHE45dV9LY99c2jUpiWUNjKw3Zg%2BYCqaCq%2FrrM2zNxDW%2BOQEeOi6Ok0XPoMD6WpcGLy2luBkNjVbw%3D%3D"}],"group":"cf-nel","max_age":604800}
x-amz-version-id
jV508h77cVNLHNUYKWw1EBxVoCqSOv_T
cf-ray
69a49d7eac5d1f19-FRA
x-amz-cf-id
Huh05HHtPs6IL3TYBfNJoTWvS1uVLA10nJ57Bv4DPX15N8uKIkJu_w==
cr-blog-icon--search-dark-gray.png
www.cybereason.com/hubfs/dam/images/images-web/blog-images/template-images/ 		282 B
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.cybereason.com/hubfs/dam/images/images-web/blog-images/template-images/cr-blog-icon--search-dark-gray.png
Requested by
Host: www.cybereason.com
URL: https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms?blaid=2123744
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
199.60.103.226 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
91b667b9d0de69583ee16753496325f38b91e7f77dcb34a5e49bdca3b670002a

Request headers

:path
/hubfs/dam/images/images-web/blog-images/template-images/cr-blog-icon--search-dark-gray.png
pragma
no-cache
cookie
__cfruid=649f615bd690efb862dbcff90d2cb8293e32c367-1633583344
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
www.cybereason.com
referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms?blaid=2123744
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms?blaid=2123744
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

x-amz-meta-cache-tag
F-42360212094,FD-41718904629,P-3354902,FLS-ALL
age
549046
x-amz-server-side-encryption
AES256
edge-cache-tag
F-42360212094,FD-41718904629,P-3354902,FLS-ALL
x-edge-origin-shield-skipped
0
x-amz-replication-status
COMPLETED
content-disposition
inline; filename="cr-blog-icon--search-dark-gray.webp"
x-hs-cf-lambda
us-east-1.enforceAclForReadsProd 12
x-amz-request-id
YQVVMKCSZZZ852W1
cf-bgj
imgq:85,h2pri
etag
"5285e68f20ece59da650da19c81751e2"
vary
Accept, Accept-Encoding
access-control-allow-methods
GET
content-type
image/webp
access-control-allow-origin
*
cache-control
s-maxage=1814400, max-age=1209600, stale-while-revalidate=900
x-robots-tag
all
x-hs-cf-lambda-enforce
us-east-1.enforceAclForReadsProd 12
x-amz-meta-created-unix-time-millis
1614741596040
date
Thu, 07 Oct 2021 05:09:04 GMT
via
1.1 8002c303d4f2295f77566a349deba122.cloudfront.net (CloudFront)
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-amz-cf-pop
FRA2-C1
x-hs-alternate-content-type
text/plain
cf-polished
origFmt=png, origSize=583
x-cache
RefreshHit from cloudfront
x-amz-meta-index-tag
all
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length
282
x-amz-id-2
W9Cci3SaAZl5jZrfEK7aXFKww+HU1AKHevZnwYszYNH9X4KdPbG6idDhEfax+G+NLCwLzKoNZmk=
last-modified
Wed, 03 Mar 2021 03:19:57 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=DmSzTW5yEPu3IazaTL6JZIAtjzpwxlHJvIUMXpCw1%2BYXrtncbCj9nkGPgQU34fX%2Fcisa%2FJAOhbKISitnxx%2Bm2oKrBXxU6t6ZyPO6Q0HpSHVsfJUFJDobkbEA6ojZKgZh9tvvRg%3D%3D"}],"group":"cf-nel","max_age":604800}
x-amz-version-id
Z9.dvET4DoUMSJH5gPgUuVYnyNsIiNYh
accept-ranges
bytes
cf-ray
69a49d7eac5e1f19-FRA
x-amz-cf-id
sEw66opS5BEPz2AVa9VVi3Q-R-cAE_y8Ak9MSCL8dySv_QNEarvGfg==
BLOG%20%20SOCIAL%20SET%20-%20News%20%281%29-1.png
www.cybereason.com/hubfs/ 		740 KB
742 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.cybereason.com/hubfs/BLOG%20%20SOCIAL%20SET%20-%20News%20%281%29-1.png
Requested by
Host: www.cybereason.com
URL: https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms?blaid=2123744
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
199.60.103.226 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
06de1d03905fa3708f8beb3b281211ec8c5dd7fcc903649f458bb6bce9241707

Request headers

:path
/hubfs/BLOG%20%20SOCIAL%20SET%20-%20News%20%281%29-1.png
pragma
no-cache
cookie
__cfruid=649f615bd690efb862dbcff90d2cb8293e32c367-1633583344
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
www.cybereason.com
referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms?blaid=2123744
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms?blaid=2123744
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

x-amz-meta-cache-tag
F-56558657366,P-3354902,FLS-ALL
age
68811
x-amz-server-side-encryption
AES256
edge-cache-tag
F-56558657366,P-3354902,FLS-ALL
x-edge-origin-shield-skipped
0
x-amz-replication-status
COMPLETED
content-disposition
inline; filename="BLOG%20%20SOCIAL%20SET%20-%20News%20(1)-1.webp"
x-hs-cf-lambda
us-east-1.enforceAclForReadsProd 12
x-amz-request-id
BHSWNYJD0CZKZ9C1
cf-bgj
imgq:85,h2pri
etag
"3750f1f7146100947a68743a34d5c33c"
vary
Accept, Accept-Encoding
access-control-allow-methods
GET
content-type
image/webp
access-control-allow-origin
*
cache-control
s-maxage=1814400, max-age=1209600, stale-while-revalidate=900
x-robots-tag
all
x-hs-cf-lambda-enforce
us-east-1.enforceAclForReadsProd 12
x-amz-meta-created-unix-time-millis
1633117706908
date
Thu, 07 Oct 2021 05:09:04 GMT
via
1.1 c6702f5f3b6e77da6f394e67ef1a6aab.cloudfront.net (CloudFront)
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-amz-cf-pop
FRA50-C1
x-hs-alternate-content-type
text/plain
cf-polished
origFmt=png, origSize=1130259
x-cache
RefreshHit from cloudfront
x-amz-meta-index-tag
all
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length
758124
x-amz-id-2
9zEc0vBkLG/2Tb/x5qG6zvnL9R2RE0qKp7xtgrjGnHsqp6V2xSvPEFnRWeF6SbgrvMPTsTzHHLU=
last-modified
Fri, 01 Oct 2021 19:48:28 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=T5S27YVHS5c81kwUQAdtzBiiwuFEX%2BJamTDBOS7VRYlhD8TE%2F0RQOYLl6gYEchtZrxVyPiV69D3uP9yqOGT113MlqGb135RIc4pOAfJP%2FOsodp1rV9Aj7Son1t%2FfYgcO4IET6Q%3D%3D"}],"group":"cf-nel","max_age":604800}
x-amz-version-id
yA9dKCyghsU1I2ZZNS1jjABJZ0i4WhOC
accept-ranges
bytes
cf-ray
69a49d7eac611f19-FRA
x-amz-cf-id
NMYbWDzrZNpwZMaIxcG4c_ROzrjIvO8HbArgD702xmYZcI3e2JRNag==
twitter-gray.svg
www.cybereason.com/hubfs/dam/images/images-web/blog-images/template-images/ 		749 B
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.cybereason.com/hubfs/dam/images/images-web/blog-images/template-images/twitter-gray.svg
Requested by
Host: www.cybereason.com
URL: https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms?blaid=2123744
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
199.60.103.226 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
f9db6465a204cc4186368b72a0ba4f063e64569aa4fc96e0f40c7ac69423121b

Request headers

:path
/hubfs/dam/images/images-web/blog-images/template-images/twitter-gray.svg
pragma
no-cache
cookie
__cfruid=649f615bd690efb862dbcff90d2cb8293e32c367-1633583344
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
www.cybereason.com
referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms?blaid=2123744
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms?blaid=2123744
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

content-encoding
br
x-amz-meta-cache-tag
F-44251289646,FD-41718904629,P-3354902,FLS-ALL
age
549046
x-amz-server-side-encryption
AES256
edge-cache-tag
F-44251289646,FD-41718904629,P-3354902,FLS-ALL
x-edge-origin-shield-skipped
0
x-amz-replication-status
COMPLETED
x-hs-cf-lambda
us-east-1.enforceAclForReadsProd 12
x-amz-request-id
YQVPFWP3SAEZNQAV
etag
W/"5c103d0cd978b3a8d7ccab6bff714599"
vary
Accept-Encoding
access-control-allow-methods
GET
content-type
image/svg+xml
access-control-allow-origin
*
cache-control
s-maxage=1814400, max-age=1209600, stale-while-revalidate=900
x-robots-tag
all
x-hs-cf-lambda-enforce
us-east-1.enforceAclForReadsProd 12
x-amz-meta-created-unix-time-millis
1617243822112
date
Thu, 07 Oct 2021 05:09:04 GMT
via
1.1 69f13f852a135432abb1b7bfc5a8b421.cloudfront.net (CloudFront)
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-amz-cf-pop
FRA2-C1
x-hs-alternate-content-type
text/plain
x-cache
RefreshHit from cloudfront
x-amz-meta-index-tag
all
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
x-amz-id-2
NgFclnoRmLYE/V6zeQC7s4yZL+ZnfXTNJczUST+Y4NdnbkNL5z0EDDNBgBYzuTx7CjJon2S+Twc=
last-modified
Thu, 01 Apr 2021 02:23:43 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=kjB6vErVqazSTzS3ExYsPqB4wtplUapzqK00lnEnSeiIpNqdHuwTnhrPRIeY5tEGPr57eDIeDgy2GEb4OMV3EUi7sxkM0XcVeNmPuXCeuBTuubFuuaQhOK8kqwfuoMWwSntZuA%3D%3D"}],"group":"cf-nel","max_age":604800}
x-amz-version-id
IqbJNdLSXrwowOx5nKBNqqtBOZO91Biv
cf-ray
69a49d7eac631f19-FRA
x-amz-cf-id
IS0pksxhd6uEonJwNma7JYUDdHaMsG7968u0GuApb7-NyitBG4Vwfg==
facebook-gray.svg
www.cybereason.com/hubfs/dam/images/images-web/blog-images/template-images/ 		372 B
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.cybereason.com/hubfs/dam/images/images-web/blog-images/template-images/facebook-gray.svg
Requested by
Host: www.cybereason.com
URL: https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms?blaid=2123744
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
199.60.103.226 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
d82231820461c83d1b0966caae71bd2732bd89e9a910fdb90d193c3dca16dbc7

Request headers

:path
/hubfs/dam/images/images-web/blog-images/template-images/facebook-gray.svg
pragma
no-cache
cookie
__cfruid=649f615bd690efb862dbcff90d2cb8293e32c367-1633583344
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
www.cybereason.com
referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms?blaid=2123744
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms?blaid=2123744
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

content-encoding
br
x-amz-meta-cache-tag
F-44251209055,FD-41718904629,P-3354902,FLS-ALL
age
549046
x-amz-server-side-encryption
AES256
edge-cache-tag
F-44251209055,FD-41718904629,P-3354902,FLS-ALL
x-edge-origin-shield-skipped
0
x-amz-replication-status
COMPLETED
x-hs-cf-lambda
us-east-1.enforceAclForReadsProd 12
x-amz-request-id
221M1AHT19TGAD8J
etag
W/"8c22d0d78005c386bf29edacfdd2360d"
vary
Accept-Encoding
access-control-allow-methods
GET
content-type
image/svg+xml
access-control-allow-origin
*
cache-control
s-maxage=1814400, max-age=1209600, stale-while-revalidate=900
x-robots-tag
all
x-hs-cf-lambda-enforce
us-east-1.enforceAclForReadsProd 12
x-amz-meta-created-unix-time-millis
1617243822102
date
Thu, 07 Oct 2021 05:09:04 GMT
via
1.1 8f20db43ba7579b7216cf908572d5054.cloudfront.net (CloudFront)
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-amz-cf-pop
FRA2-C1
x-hs-alternate-content-type
text/plain
x-cache
RefreshHit from cloudfront
x-amz-meta-index-tag
all
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
x-amz-id-2
C+AUWGEFpk1BXj5vyy9P8o862b/vDMkxHr5UclDeMnl3NzHB+wEp1AqP5FvevA5ezhbzaAXpaN0=
last-modified
Thu, 01 Apr 2021 02:23:43 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=0Ut28T0FLJvTXmC0%2Ft%2B%2FR41jVN9%2FSwHx%2BTnGbsKoDz%2FlwB1HjoMX6ylL8p9XJTopZ9ivKm9KrEi4SbJXi9ANWSNk9JrWSyZNu6toKzM5nG%2BZjprmA24l2UjlAFi3tX%2BcZUXB6A%3D%3D"}],"group":"cf-nel","max_age":604800}
x-amz-version-id
j7TMxqcLHA18llA46ti9t98ENVzeqi8u
cf-ray
69a49d7eac641f19-FRA
x-amz-cf-id
f7lWL7Nm_NMbwBgpa0SoTzdb3a9iW1WC61LOcmcWMiTsHxtb6p9Hgw==
linkedin-gray.svg
www.cybereason.com/hubfs/dam/images/images-web/blog-images/template-images/ 		742 B
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.cybereason.com/hubfs/dam/images/images-web/blog-images/template-images/linkedin-gray.svg
Requested by
Host: www.cybereason.com
URL: https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms?blaid=2123744
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
199.60.103.226 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
12127e3110351f54262db955bafe353593dd58c89c7f6b6fc159c10515e93c61

Request headers

:path
/hubfs/dam/images/images-web/blog-images/template-images/linkedin-gray.svg
pragma
no-cache
cookie
__cfruid=649f615bd690efb862dbcff90d2cb8293e32c367-1633583344
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
www.cybereason.com
referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms?blaid=2123744
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms?blaid=2123744
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

content-encoding
br
x-amz-meta-cache-tag
F-44570599712,FD-41718904629,P-3354902,FLS-ALL
age
549046
x-amz-server-side-encryption
AES256
edge-cache-tag
F-44570599712,FD-41718904629,P-3354902,FLS-ALL
x-edge-origin-shield-skipped
0
x-amz-replication-status
COMPLETED
x-hs-cf-lambda
us-east-1.enforceAclForReadsProd 12
x-amz-request-id
YQVYCPQWSEM6KN8B
etag
W/"446340b1a8e73ee28b1a47837a13fdf3"
vary
Accept-Encoding
access-control-allow-methods
GET
content-type
image/svg+xml
access-control-allow-origin
*
cache-control
s-maxage=1814400, max-age=1209600, stale-while-revalidate=900
x-robots-tag
all
x-hs-cf-lambda-enforce
us-east-1.enforceAclForReadsProd 12
x-amz-meta-created-unix-time-millis
1617758009375
date
Thu, 07 Oct 2021 05:09:04 GMT
via
1.1 8f20db43ba7579b7216cf908572d5054.cloudfront.net (CloudFront)
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-amz-cf-pop
FRA2-C1
x-hs-alternate-content-type
text/plain
x-cache
RefreshHit from cloudfront
x-amz-meta-index-tag
all
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
x-amz-id-2
DoKxaJwGHIWMboEIxiFAC9G+UEWG2hAirqg0OPuxOxBueak/I3drSWjDW/vsbJOOCpYY1OaW1qw=
last-modified
Wed, 07 Apr 2021 01:13:30 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=gw6%2FF6pj5A8c61WNtoNkS1Pa5AboDE8gzpRI5V%2FGni8au96W5WGaQPyRZD9Lq9iaIpAjkhMtJqc7B6ZrT0%2BhqdmaXlqgLrjQ0wrTE4Rw7rnh1McR%2BUtLn3Zczu6n9Ot%2F90jr8A%3D%3D"}],"group":"cf-nel","max_age":604800}
x-amz-version-id
cNQVyvptDzpT8RxIUtNpIf4tWlwMEFMh
cf-ray
69a49d7eac671f19-FRA
x-amz-cf-id
KTLcP7VEPmAMgOAndfblI0D-mvS4c1EA_nKrqqnj3VIlYRcu3RCKHg==
CR_Owl_Web_Mono@3x%202.png
www.cybereason.com/hubfs/ 		7 KB
8 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.cybereason.com/hubfs/CR_Owl_Web_Mono@3x%202.png
Requested by
Host: www.cybereason.com
URL: https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms?blaid=2123744
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
199.60.103.226 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
8292049c0f7e7fc6406874e976ed7e4134d3e34c16a790084b51f48595848aa0

Request headers

:path
/hubfs/CR_Owl_Web_Mono@3x%202.png
pragma
no-cache
cookie
__cfruid=649f615bd690efb862dbcff90d2cb8293e32c367-1633583344
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
www.cybereason.com
referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms?blaid=2123744
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms?blaid=2123744
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

x-amz-meta-cache-tag
F-11216732180,P-3354902,FLS-ALL
age
549021
edge-cache-tag
F-11216732180,P-3354902,FLS-ALL
x-edge-origin-shield-skipped
0
content-disposition
inline; filename="CR_Owl_Web_Mono@3x%202.webp"
x-hs-cf-lambda
us-east-1.enforceAclForReadsProd 12
x-amz-request-id
1M05GM4H4RNFRK6H
cf-bgj
imgq:85,h2pri
etag
"5830fe3ad7045c6e2f662e6cb8ea7db9"
vary
Accept, Accept-Encoding
access-control-allow-methods
GET
content-type
image/webp
access-control-allow-origin
*
cache-control
s-maxage=1814400, max-age=1209600, stale-while-revalidate=900
x-hs-cf-lambda-enforce
us-east-1.enforceAclForReadsProd 12
date
Thu, 07 Oct 2021 05:09:04 GMT
via
1.1 1ac3fd533bf6be1b511077f8b8e23bfd.cloudfront.net (CloudFront)
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-amz-cf-pop
FRA2-C1
cf-polished
origFmt=png, origSize=18281
x-cache
RefreshHit from cloudfront
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length
7120
x-amz-id-2
FWVDbG/0nGtIF3SkxsiPK29rzCUKQ54jRDtSPovIYLnFVB6U53FVO5E8hHi98a0D9NnmHpfZ1E4=
last-modified
Fri, 12 Jul 2019 13:47:40 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=J8vuVgwfFDSeOgFsZMkQs4H8uxfzWSaDE7WxNxt2jSmF8S5fTj7KAfD39Y1%2Fn5sUZKlC56R2ZbYptUDnvlmH8%2Br%2FxM9wCqZ0fZUSW%2FEzFB9Zd8%2Fp9ODE%2F1Cp%2FXw0FB3rWB6FNA%3D%3D"}],"group":"cf-nel","max_age":604800}
x-amz-version-id
nZ4bmwWnKhcTbz9EkpvMbukUoI6WISi.
accept-ranges
bytes
cf-ray
69a49d7eac681f19-FRA
x-amz-cf-id
YNV2iW3Eeb4Psi-dyYqNfKqNCcRMFlW2YkpRE0MAKzT2vXpniLGdmQ==
icon-social-gray-linkedin.png
www.cybereason.com/hubfs/dam/images/images-web/blog-images/template-images/ 		154 B
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.cybereason.com/hubfs/dam/images/images-web/blog-images/template-images/icon-social-gray-linkedin.png
Requested by
Host: www.cybereason.com
URL: https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms?blaid=2123744
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
199.60.103.226 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
9586d0fb1354dd56116ff8e2bf4c54bb5e283cf33abd801f338ef6054c501978

Request headers

:path
/hubfs/dam/images/images-web/blog-images/template-images/icon-social-gray-linkedin.png
pragma
no-cache
cookie
__cfruid=649f615bd690efb862dbcff90d2cb8293e32c367-1633583344
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
www.cybereason.com
referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms?blaid=2123744
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms?blaid=2123744
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

x-amz-meta-cache-tag
F-44556752913,FD-41718904629,P-3354902,FLS-ALL
age
499907
x-amz-server-side-encryption
AES256
edge-cache-tag
F-44556752913,FD-41718904629,P-3354902,FLS-ALL
x-edge-origin-shield-skipped
0
x-amz-replication-status
COMPLETED
content-disposition
inline; filename="icon-social-gray-linkedin.webp"
x-hs-cf-lambda
us-east-1.enforceAclForReadsProd 12
x-amz-request-id
NE93M8FVTMKNWHE2
cf-bgj
imgq:85,h2pri
etag
"5b58aca254cf940946a8b643ac56bc3b"
vary
Accept, Accept-Encoding
access-control-allow-methods
GET
content-type
image/webp
access-control-allow-origin
*
cache-control
s-maxage=1814400, max-age=1209600, stale-while-revalidate=900
x-robots-tag
all
x-hs-cf-lambda-enforce
us-east-1.enforceAclForReadsProd 12
x-amz-meta-created-unix-time-millis
1617740300009
date
Thu, 07 Oct 2021 05:09:04 GMT
via
1.1 bb3ac1595bb014e3b09608a0358d33da.cloudfront.net (CloudFront)
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-amz-cf-pop
FRA56-P4
x-hs-alternate-content-type
text/plain
cf-polished
origFmt=png, origSize=228
x-cache
RefreshHit from cloudfront
x-amz-meta-index-tag
all
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length
154
x-amz-id-2
r1T7lHKETDyQ3VRMs+TEy0Kp46bLRQgxU1WwwdkYhRVRLbXBAKI1kJuyFNidVsW5b+IJi0qTJ6I=
last-modified
Tue, 06 Apr 2021 20:18:21 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=K7lsyPtgCRnnD4h1XEAqEFGLqH9WphNtq0t7O%2BdXejHWyLFFRmCjUpUSSD3JH3dIBhGdGMkFPFcCG7nYh2lGGKKK1NMK4qw%2Bl0Rau8tX8WKzztxoVS9e0M8Ynw%2BSwAMKxqO%2BYw%3D%3D"}],"group":"cf-nel","max_age":604800}
x-amz-version-id
QKZGjr11n8RfLL1jJfRJGaNCWnmOz1y4
accept-ranges
bytes
cf-ray
69a49d7eac6b1f19-FRA
x-amz-cf-id
I6LHsb2iUPNRqs3LcYkNXQXam5QKXNE03ROhItcw6LkmE4LwDF8bJg==
icon-social-gray-twitter.svg
www.cybereason.com/hubfs/dam/images/images-web/blog-images/template-images/ 		749 B
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.cybereason.com/hubfs/dam/images/images-web/blog-images/template-images/icon-social-gray-twitter.svg
Requested by
Host: www.cybereason.com
URL: https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms?blaid=2123744
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
199.60.103.226 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
f9db6465a204cc4186368b72a0ba4f063e64569aa4fc96e0f40c7ac69423121b

Request headers

:path
/hubfs/dam/images/images-web/blog-images/template-images/icon-social-gray-twitter.svg
pragma
no-cache
cookie
__cfruid=649f615bd690efb862dbcff90d2cb8293e32c367-1633583344
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
www.cybereason.com
referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms?blaid=2123744
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms?blaid=2123744
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

content-encoding
br
x-amz-meta-cache-tag
F-43294710828,FD-41718904629,P-3354902,FLS-ALL
age
549046
x-amz-server-side-encryption
AES256
edge-cache-tag
F-43294710828,FD-41718904629,P-3354902,FLS-ALL
x-edge-origin-shield-skipped
0
x-amz-replication-status
COMPLETED
x-hs-cf-lambda
us-east-1.enforceAclForReadsProd 12
x-amz-request-id
1M0CVWMACWETB0N2
etag
W/"5c103d0cd978b3a8d7ccab6bff714599"
vary
Accept-Encoding
access-control-allow-methods
GET
content-type
image/svg+xml
access-control-allow-origin
*
cache-control
s-maxage=1814400, max-age=1209600, stale-while-revalidate=900
x-robots-tag
all
x-hs-cf-lambda-enforce
us-east-1.enforceAclForReadsProd 12
x-amz-meta-created-unix-time-millis
1616007053027
date
Thu, 07 Oct 2021 05:09:04 GMT
via
1.1 b6d1611761652d7a383651f2bf480596.cloudfront.net (CloudFront)
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-amz-cf-pop
FRA2-C1
x-hs-alternate-content-type
text/plain
x-cache
RefreshHit from cloudfront
x-amz-meta-index-tag
all
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
x-amz-id-2
slGParxjmFR85417Qakm39rYVwNbUR7Ijuu1HXyMlvZVTa4J9x8K+1uLDy+UHi7CeArKFpD9k1Y=
last-modified
Wed, 17 Mar 2021 18:50:54 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=j6Tn%2FAxlabqXSGQ%2BoUH%2B075e7%2BwAB9KR2S%2Fm6r5OgD8fkJZ1UuzpkeHEvplMMD8lDPeih0YinTW6q0m7G0DehJgZaWktOiCpQOfUgKGEcKUnPW8mWymr6IAcGYGLQDxhU5ux7Q%3D%3D"}],"group":"cf-nel","max_age":604800}
x-amz-version-id
NF3dgF5tFLaoFoVElEGWcy105X0OE1GX
cf-ray
69a49d7eac6c1f19-FRA
x-amz-cf-id
2d51YMuNEDSsFWETWDmgAs00ZpCgYpBu4sE51Y19AQj5Quemq-SVWg==
cr-logo-web-horizontal-white-500px.png
www.cybereason.com/hubfs/dam/images/images-web/logos/ 		5 KB
6 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.cybereason.com/hubfs/dam/images/images-web/logos/cr-logo-web-horizontal-white-500px.png
Requested by
Host: www.cybereason.com
URL: https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms?blaid=2123744
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
199.60.103.226 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
e25be07e98d8af6966a317f09b01392cce60447ed768a034ec1b18843ee6dcbc

Request headers

:path
/hubfs/dam/images/images-web/logos/cr-logo-web-horizontal-white-500px.png
pragma
no-cache
cookie
__cfruid=649f615bd690efb862dbcff90d2cb8293e32c367-1633583344
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
www.cybereason.com
referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms?blaid=2123744
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms?blaid=2123744
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

x-amz-meta-cache-tag
F-36665664687,FD-35695393279,P-3354902,FLS-ALL
age
551052
x-amz-server-side-encryption
AES256
edge-cache-tag
F-36665664687,FD-35695393279,P-3354902,FLS-ALL
x-edge-origin-shield-skipped
0
x-amz-replication-status
COMPLETED
content-disposition
inline; filename="cr-logo-web-horizontal-white-500px.webp"
x-hs-cf-lambda
us-east-1.enforceAclForReadsProd 12
x-amz-request-id
VWAW1C3V2J1HQKVT
cf-bgj
imgq:85,h2pri
etag
"767db0928e354898ad0d5be0b8913d27"
vary
Accept, Accept-Encoding
access-control-allow-methods
GET
content-type
image/webp
access-control-allow-origin
*
cache-control
s-maxage=1814400, max-age=1209600, stale-while-revalidate=900
x-robots-tag
all
x-hs-cf-lambda-enforce
us-east-1.enforceAclForReadsProd 12
x-amz-meta-created-unix-time-millis
1603732670178
date
Thu, 07 Oct 2021 05:09:04 GMT
via
1.1 ba5b5e2e7fd98c4a472633bc4c1d4480.cloudfront.net (CloudFront)
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-amz-cf-pop
FRA2-C1
x-hs-alternate-content-type
text/plain
cf-polished
origFmt=png, origSize=9464
x-cache
Miss from cloudfront
x-amz-meta-index-tag
all
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length
5068
x-amz-id-2
Xhonwn+GSdSmIFSwvVejCsmdB1EpkvNNa+uOfdP/4x+l2Ell/Vh3cRDiLMIGgrefrQBfJrnTjaI=
last-modified
Mon, 26 Oct 2020 17:18:29 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=QXBI1QG5dR5vxnqvJeLES1A4y8a7I9Os6HL935jgWUTpUWoJ0FIbt0qPpeAuWo727rv7wBHO4W%2FYrrv2Oz2Q8E9X7vayMJISOiNQ591MlqxZztFveV8OQ5J6NW1lWl1h0ggFiQ%3D%3D"}],"group":"cf-nel","max_age":604800}
x-amz-version-id
rUG6Di0oDG3X0PJdHQ7Od_mXd6h0OgSj
accept-ranges
bytes
cf-ray
69a49d7eac6f1f19-FRA
x-amz-cf-id
Wmf_V6jR7zd5vIj0Zs4hRRm7dPP0cHzl8JdtYoAZN6dHwGc1pl5lCQ==
animatedModal.min.js
www.cybereason.com/hs-fs/hub/3354902/hub_generated/template_assets/42507089303/1614944819152/__CR_Web_Platform_2020/JS/animatedModal/ 		2 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.cybereason.com/hs-fs/hub/3354902/hub_generated/template_assets/42507089303/1614944819152/__CR_Web_Platform_2020/JS/animatedModal/animatedModal.min.js
Requested by
Host: www.cybereason.com
URL: https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms?blaid=2123744
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
199.60.103.226 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
9ee63a2ce9251063533d17d87c6a2d7f06f0a3c0e38d8c9f107131ce580c057b

Request headers

:path
/hs-fs/hub/3354902/hub_generated/template_assets/42507089303/1614944819152/__CR_Web_Platform_2020/JS/animatedModal/animatedModal.min.js
pragma
no-cache
cookie
__cfruid=649f615bd690efb862dbcff90d2cb8293e32c367-1633583344
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
script
:authority
www.cybereason.com
referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms?blaid=2123744
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms?blaid=2123744
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

x-amz-meta-created-unix-time-millis
1614944819152
date
Thu, 07 Oct 2021 05:09:04 GMT
via
1.1 99baebf4b5bb631267dcfa82456151cc.cloudfront.net (CloudFront)
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
3098
x-hs-alternate-content-type
text/plain
x-amz-server-side-encryption
AES256
x-cache
RefreshHit from cloudfront
x-edge-origin-shield-skipped
0
x-amz-replication-status
COMPLETED
x-hs-cf-lambda
us-east-1.enforceAclForReadsProd 12
content-encoding
br
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
x-amz-request-id
YBPBWN5DC79NJJ8V
x-amz-id-2
14PF4IwtUv1Thi8lcawBUqjn2mvRUD4lolkMSYxlN0JERHgpjWg6A/I0hpjCSRbs/ulX9DSMO5o=
last-modified
Fri, 05 Mar 2021 11:47:00 GMT
server
cloudflare
etag
W/"7d1fd84ca69684424460a51e51bc07ff"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=fjhwkf8r5zNBx3b0xd8EGeK61yXn3%2FZEAjjPPmAu1kQaekH9JuSF7%2FlGsMQ%2BErTTs%2BryEZWvYzCj5ncQLUvT%2Bm6jpoRxXsd7rr%2BrXL1e6Bq5wx0EAsgW9NQioPBhylBy89AjNA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript; charset=utf-8
cache-control
s-maxage=1814400, max-age=1209600, stale-while-revalidate=900, s-maxage=31536000, max-age=31536000
access-control-allow-credentials
false
x-amz-version-id
LoBDDMrdwgRqzOSnwGaf7mylhX0UQKlT
x-amz-cf-pop
IAD89-C1
cf-ray
69a49d7e1bef1f19-FRA
x-amz-cf-id
lFVH0XNnV8i7i9f87i9CeGJKo6D5iWGTSk8Jkz_vPbMMPNokLoY-GQ==
x-hs-cf-lambda-enforce
us-east-1.enforceAclForReadsProd 12
module_41681847227_CR_-_Malicious_Life_Network_--_Tier_One_Header.min.js
www.cybereason.com/hs-fs/hub/3354902/hub_generated/module_assets/41681847227/1619109182704/ 		374 B
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.cybereason.com/hs-fs/hub/3354902/hub_generated/module_assets/41681847227/1619109182704/module_41681847227_CR_-_Malicious_Life_Network_--_Tier_One_Header.min.js
Requested by
Host: www.cybereason.com
URL: https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms?blaid=2123744
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
199.60.103.226 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
119bf322a2ce6d2a82422b51404bc54b375c881f12a120205598d1691fa48820

Request headers

:path
/hs-fs/hub/3354902/hub_generated/module_assets/41681847227/1619109182704/module_41681847227_CR_-_Malicious_Life_Network_--_Tier_One_Header.min.js
pragma
no-cache
cookie
__cfruid=649f615bd690efb862dbcff90d2cb8293e32c367-1633583344
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
script
:authority
www.cybereason.com
referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms?blaid=2123744
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms?blaid=2123744
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

x-amz-meta-created-unix-time-millis
1619109182704
date
Thu, 07 Oct 2021 05:09:04 GMT
via
1.1 824fe21e467658628899bdd8725649ee.cloudfront.net (CloudFront)
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
3098
x-hs-alternate-content-type
text/plain
x-amz-server-side-encryption
AES256
x-cache
RefreshHit from cloudfront
x-edge-origin-shield-skipped
0
x-amz-replication-status
COMPLETED
x-hs-cf-lambda
us-east-1.enforceAclForReadsProd 12
content-encoding
br
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
x-amz-request-id
N4M9EA064HQ5DXKP
x-amz-id-2
EFtfRQ4ZrNjbJm6DbHCIb5re8LP1DyAUWrkwTOb3sZbi/2Nms3M4qbkIjQ3LF6GvEjLHugSmBKY=
last-modified
Thu, 22 Apr 2021 16:33:03 GMT
server
cloudflare
etag
W/"1d7f81aaf24568ea5d90a82b829960fd"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=TSnxtR7CfDMB2PPJlXfjCjmjNvTst3f5GZDNCIwEWC7xs6u161C2bG2kYULXA9A8xqoCrM2GE6G46wViJnwpwLwIz8aKa2a%2BnNAMTRhUtUGsV3l%2BudEjJUQE5NQsQZXjTbsq1w%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript; charset=utf-8
cache-control
s-maxage=1814400, max-age=1209600, stale-while-revalidate=900, s-maxage=31536000, max-age=31536000
access-control-allow-credentials
false
x-amz-version-id
C.P0pbD1NccRhx0he3pMJ4DTBrrAsMcC
x-amz-cf-pop
IAD89-C1
cf-ray
69a49d7e9c501f19-FRA
x-amz-cf-id
YIoCAEOYjhgcu2JxwafKyuMARVtfx1F-akEUDBvPrZ6lSuNjAKEFTw==
x-hs-cf-lambda-enforce
us-east-1.enforceAclForReadsProd 12
module_41682410610_CR_-_Malicious_Life_Network_--_Main_Hero.min.js
www.cybereason.com/hs-fs/hub/3354902/hub_generated/module_assets/41682410610/1618194602937/ 		305 B
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.cybereason.com/hs-fs/hub/3354902/hub_generated/module_assets/41682410610/1618194602937/module_41682410610_CR_-_Malicious_Life_Network_--_Main_Hero.min.js
Requested by
Host: www.cybereason.com
URL: https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms?blaid=2123744
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
199.60.103.226 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
66ba9d76c09ad6dd52135d52c368f6d87ac40b5b4ce418e41a105fb221c7e470

Request headers

:path
/hs-fs/hub/3354902/hub_generated/module_assets/41682410610/1618194602937/module_41682410610_CR_-_Malicious_Life_Network_--_Main_Hero.min.js
pragma
no-cache
cookie
__cfruid=649f615bd690efb862dbcff90d2cb8293e32c367-1633583344
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
script
:authority
www.cybereason.com
referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms?blaid=2123744
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms?blaid=2123744
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

x-amz-meta-created-unix-time-millis
1618194602937
date
Thu, 07 Oct 2021 05:09:04 GMT
via
1.1 fba666ceffdeb316c8edf476d8994bd5.cloudfront.net (CloudFront)
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
3098
x-hs-alternate-content-type
text/plain
x-amz-server-side-encryption
AES256
x-cache
RefreshHit from cloudfront
x-edge-origin-shield-skipped
0
x-amz-replication-status
COMPLETED
x-hs-cf-lambda
us-east-1.enforceAclForReadsProd 12
content-encoding
br
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
x-amz-request-id
A3X1QJ5SPYSVTYAV
x-amz-id-2
TSyRagnsS5ELIWpgoWVIy204BrBatLwGB0OFlLN8v0xpttdZcmj5wAo0unTcNhSlSWdnjyKkG1A=
last-modified
Mon, 12 Apr 2021 02:30:03 GMT
server
cloudflare
etag
W/"86f1ecf1077302d6bd359676a0142438"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2BKOe%2B%2B0AQoo7tsmVTYXo9P%2B%2Fea9DErab%2BvCsv0yr7B5aZLc1fskmOjcCQcMicAkuTkJufUof%2BxRk4zGJmt325ii1Og6Da8Z5RZYkbSjzsYxcZmXo5MC0p4UKCEudm3ErsVq6Kg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript; charset=utf-8
cache-control
s-maxage=1814400, max-age=1209600, stale-while-revalidate=900, s-maxage=31536000, max-age=31536000
access-control-allow-credentials
false
x-amz-version-id
04Ptd8a.kuxBPTQD52G.SU7PbmihQEv1
x-amz-cf-pop
IAD89-C1
cf-ray
69a49d7eac561f19-FRA
x-amz-cf-id
Q7cZ5KJ_gledGr9lFu9jczTjgEK_6zRCyQlEkxYphUdWZA5E4wqtLw==
x-hs-cf-lambda-enforce
us-east-1.enforceAclForReadsProd 12
module_48386556055_CR_-_HTML_PopUp_Window_--_IOCs.min.js
www.cybereason.com/hs-fs/hub/3354902/hub_generated/module_assets/48386556055/1622817551100/ 		417 B
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.cybereason.com/hs-fs/hub/3354902/hub_generated/module_assets/48386556055/1622817551100/module_48386556055_CR_-_HTML_PopUp_Window_--_IOCs.min.js
Requested by
Host: www.cybereason.com
URL: https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms?blaid=2123744
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
199.60.103.226 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
0a2eec7f18edeaecb0a4bbefcdfbb8abfcea0afd260fc4c4c0ae20e65241a093

Request headers

:path
/hs-fs/hub/3354902/hub_generated/module_assets/48386556055/1622817551100/module_48386556055_CR_-_HTML_PopUp_Window_--_IOCs.min.js
pragma
no-cache
cookie
__cfruid=649f615bd690efb862dbcff90d2cb8293e32c367-1633583344
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
script
:authority
www.cybereason.com
referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms?blaid=2123744
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms?blaid=2123744
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

x-amz-meta-created-unix-time-millis
1622817551100
date
Thu, 07 Oct 2021 05:09:04 GMT
via
1.1 50f5f6b4e0025748bb74dce1db44c750.cloudfront.net (CloudFront)
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
3098
x-hs-alternate-content-type
text/plain
x-amz-server-side-encryption
AES256
x-cache
RefreshHit from cloudfront
x-edge-origin-shield-skipped
0
x-amz-replication-status
COMPLETED
x-hs-cf-lambda
us-east-1.enforceAclForReadsProd 12
content-encoding
br
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
x-amz-request-id
3C3E4J3K9JJPQAKQ
x-amz-id-2
CwmIoobaARFTLCqnXClS3kqwy1vm2ecebyUCbWJf4FLEOHiZ9ez2N+VY4gZp7piXTteWRJtBY7I=
last-modified
Fri, 04 Jun 2021 14:39:12 GMT
server
cloudflare
etag
W/"7f22b2578e1adaedfb3994df89b8adfd"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=BNDIDH9l0Kii23rHj3wR5ioACF7eGynnfP5fITAthPI%2BOid4TXzD7N4LdzewdzcoaN7p38d9Lgsem0%2Byi2PLr4qHu3veHoKyubWmYJgyQQHGXpIgahgtKwZrXb2HWCwvTLnvRA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript; charset=utf-8
cache-control
s-maxage=1814400, max-age=1209600, stale-while-revalidate=900, s-maxage=31536000, max-age=31536000
access-control-allow-credentials
false
x-amz-version-id
94DGu_PVrqJKQbRfd1EopDHUO9qOpdwo
x-amz-cf-pop
IAD89-C1
cf-ray
69a49d7eac5b1f19-FRA
x-amz-cf-id
ucU2gL2fLshaEsNML_eft05n1pYmCTS6q7kiNMlfmJPVlX6yut21Gw==
x-hs-cf-lambda-enforce
us-east-1.enforceAclForReadsProd 12
3354902.js
www.cybereason.com/hs/scriptloader/ 		1 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.cybereason.com/hs/scriptloader/3354902.js
Requested by
Host: www.cybereason.com
URL: https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms?blaid=2123744
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
199.60.103.226 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
dcf9e1d0e7154542773c2fa4d03411173ccbbae60e640cdfb96dda80aff0d78a

Request headers

:path
/hs/scriptloader/3354902.js
pragma
no-cache
cookie
__cfruid=649f615bd690efb862dbcff90d2cb8293e32c367-1633583344
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
script
:authority
www.cybereason.com
referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms?blaid=2123744
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms?blaid=2123744
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Thu, 07 Oct 2021 05:09:04 GMT
content-encoding
br
vary
Accept-Encoding
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
22
cf-polished
origSize=1513
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
x-hubspot-correlation-id
242aba8b-72d8-419c-a963-3ca8d162ceb6
cf-bgj
minify
server
cloudflare
x-trace
2B80F8047EC4356E4948C69D762E2C88D9A1FFCCB1000000000000000000
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
access-control-max-age
3600
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=xgT4AVQRTDfXVe10w5voQ8nhH6gfxWC70udLFRQkbiAh4hA6mHAVXjoe%2FixxRsXyIua2QW%2FBRA0E4J0Bvom%2Fo7K4YjPCOw4S5O0dB1axdpgviC%2FQynrf7Zl1tA99MzZteR175w%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript;charset=utf-8
cache-control
public, max-age=60
access-control-allow-credentials
true
cf-ray
69a49d7eac711f19-FRA
expires
Thu, 07 Oct 2021 05:10:04 GMT
animate.min.css
cdnjs.cloudflare.com/ajax/libs/animate.css/4.1.1/ 		70 KB
5 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://cdnjs.cloudflare.com/ajax/libs/animate.css/4.1.1/animate.min.css
Requested by
Host: www.cybereason.com
URL: https://www.cybereason.com/hs-fs/hub/3354902/hub_generated/template_assets/34470477360/1632935872906/__CR_Web_Platform_2020/CSS/cr-master__main.min.css
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.16.19.94 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
5fbaeb9f8e25d7e0143bae61d4b1802c16ce7390b96ceb2d498b0d96ff4c853f
Security Headers
Name Value
Strict-Transport-Security max-age=15780000
X-Content-Type-Options nosniff

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.cybereason.com/hs-fs/hub/3354902/hub_generated/template_assets/34470477360/1632935872906/__CR_Web_Platform_2020/CSS/cr-master__main.min.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Thu, 07 Oct 2021 05:09:04 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age
1255000
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length
4216
timing-allow-origin
*
last-modified
Mon, 07 Sep 2020 12:33:38 GMT
server
cloudflare
cf-cdnjs-via
cfworker/kv
etag
"5f5628a2-11846"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=15780000
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2FO9HlkFaQ%2BO8vUGZu2uEPLrU1%2B0A0lxgPtaMWIzNTkk%2B7Om2HztBMMDGjQmjApdLXR9GyYk0jfQsJmut%2FE9RLL3WUiDdWzitee2Ubou42lhShyml05MVkKx%2FkDlIN5xLxEnKf14p"}],"group":"cf-nel","max_age":604800}
content-type
text/css; charset=utf-8
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=30672000
accept-ranges
bytes
cf-ray
69a49d7e5b292b95-FRA
expires
Tue, 27 Sep 2022 05:09:04 GMT
css2
fonts.googleapis.com/ 		19 KB
973 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://fonts.googleapis.com/css2?family=Barlow:ital,wght@0,100;0,200;0,300;0,400;0,500;0,600;0,700;0,800;0,900;1,100;1,200;1,300;1,400;1,500;1,600;1,700;1,800;1,900&display=swap
Requested by
Host: www.cybereason.com
URL: https://www.cybereason.com/hs-fs/hub/3354902/hub_generated/template_assets/34470477360/1632935872906/__CR_Web_Platform_2020/CSS/cr-master__main.min.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.184.202 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s11-in-f10.1e100.net
Software
ESF /
Resource Hash
6af036a4ec23088a2e702e364d84320dbcd420a0c8c5ef82bac37006554e3ea6
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.cybereason.com/hs-fs/hub/3354902/hub_generated/template_assets/34470477360/1632935872906/__CR_Web_Platform_2020/CSS/cr-master__main.min.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection
0
last-modified
Thu, 07 Oct 2021 05:09:04 GMT
server
ESF
date
Thu, 07 Oct 2021 05:09:04 GMT
x-frame-options
SAMEORIGIN
report-to
{"group":"AZM8iraMxxUfRnRum-EGst9UuHcPNVSf9Kp1_90wIgU","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/encsid_AZM8iraMxxUfRnRum-EGst9UuHcPNVSf9Kp1_90wIgU"}]}
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
cross-origin-opener-policy-report-only
same-origin; report-to="AZM8iraMxxUfRnRum-EGst9UuHcPNVSf9Kp1_90wIgU"
expires
Thu, 07 Oct 2021 05:09:04 GMT
css2
fonts.googleapis.com/ 		20 KB
2 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://fonts.googleapis.com/css2?family=Barlow+Condensed:ital,wght@0,100;0,200;0,300;0,400;0,500;0,600;0,700;0,800;0,900;1,100;1,200;1,300;1,400;1,500;1,600;1,700;1,800;1,900&display=swap
Requested by
Host: www.cybereason.com
URL: https://www.cybereason.com/hs-fs/hub/3354902/hub_generated/template_assets/34470477360/1632935872906/__CR_Web_Platform_2020/CSS/cr-master__main.min.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.184.202 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s11-in-f10.1e100.net
Software
ESF /
Resource Hash
0ea7d23d55fdda4f42a373f9a16ddb9a744c682714a9516dc95e9acdc5b3ce40
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.cybereason.com/hs-fs/hub/3354902/hub_generated/template_assets/34470477360/1632935872906/__CR_Web_Platform_2020/CSS/cr-master__main.min.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection
0
last-modified
Thu, 07 Oct 2021 04:56:33 GMT
server
ESF
date
Thu, 07 Oct 2021 05:09:04 GMT
x-frame-options
SAMEORIGIN
report-to
{"group":"AZM8iraMxxUfRnRum-EGst9UuHcPNVSf9Kp1_90wIgU","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/encsid_AZM8iraMxxUfRnRum-EGst9UuHcPNVSf9Kp1_90wIgU"}]}
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
cross-origin-opener-policy-report-only
same-origin; report-to="AZM8iraMxxUfRnRum-EGst9UuHcPNVSf9Kp1_90wIgU"
expires
Thu, 07 Oct 2021 05:09:04 GMT
css2
fonts.googleapis.com/ 		46 KB
2 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://fonts.googleapis.com/css2?family=Barlow:ital,wght@0,100;0,200;0,300;0,400;0,500;0,600;0,700;0,800;0,900;1,100;1,200;1,300;1,400;1,500;1,600;1,700;1,800;1,900&family=Open+Sans:ital,wght@0,300;0,400;0,600;0,700;0,800;1,300;1,400;1,600;1,700;1,800&display=swap
Requested by
Host: www.cybereason.com
URL: https://www.cybereason.com/hs-fs/hub/3354902/hub_generated/template_assets/34470477360/1632935872906/__CR_Web_Platform_2020/CSS/cr-master__main.min.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.184.202 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s11-in-f10.1e100.net
Software
ESF /
Resource Hash
5df981fec90b8eaea5545cd73ff279821506b668644df536419881bc07653ba3
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.cybereason.com/hs-fs/hub/3354902/hub_generated/template_assets/34470477360/1632935872906/__CR_Web_Platform_2020/CSS/cr-master__main.min.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection
0
last-modified
Thu, 07 Oct 2021 05:09:04 GMT
server
ESF
date
Thu, 07 Oct 2021 05:09:04 GMT
x-frame-options
SAMEORIGIN
report-to
{"group":"AZM8iraMxxUfRnRum-EGst9UuHcPNVSf9Kp1_90wIgU","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/encsid_AZM8iraMxxUfRnRum-EGst9UuHcPNVSf9Kp1_90wIgU"}]}
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
cross-origin-opener-policy-report-only
same-origin; report-to="AZM8iraMxxUfRnRum-EGst9UuHcPNVSf9Kp1_90wIgU"
expires
Thu, 07 Oct 2021 05:09:04 GMT
cr-blog-hero-owl-transparent.png
www.cybereason.com/hubfs/dam/images/images-web/blog-images/template-images/ 		464 KB
466 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.cybereason.com/hubfs/dam/images/images-web/blog-images/template-images/cr-blog-hero-owl-transparent.png
Requested by
Host: www.cybereason.com
URL: https://www.cybereason.com/hs-fs/hub/3354902/hub_generated/module_assets/41682410610/1618194603032/module_41682410610_CR_-_Malicious_Life_Network_--_Main_Hero.min.css
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
199.60.103.226 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
51443fc1aa325f301b39d89ffeae8f8a7833ed59491b89419902b32ef30b3b39

Request headers

:path
/hubfs/dam/images/images-web/blog-images/template-images/cr-blog-hero-owl-transparent.png
pragma
no-cache
cookie
__cfruid=649f615bd690efb862dbcff90d2cb8293e32c367-1633583344
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
www.cybereason.com
referer
https://www.cybereason.com/hs-fs/hub/3354902/hub_generated/module_assets/41682410610/1618194603032/module_41682410610_CR_-_Malicious_Life_Network_--_Main_Hero.min.css
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://www.cybereason.com/hs-fs/hub/3354902/hub_generated/module_assets/41682410610/1618194603032/module_41682410610_CR_-_Malicious_Life_Network_--_Main_Hero.min.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

x-amz-meta-cache-tag
F-41719333184,FD-41718904629,P-3354902,FLS-ALL
age
549045
x-amz-server-side-encryption
AES256
edge-cache-tag
F-41719333184,FD-41718904629,P-3354902,FLS-ALL
x-edge-origin-shield-skipped
0
x-amz-replication-status
COMPLETED
content-disposition
inline; filename="cr-blog-hero-owl-transparent.webp"
x-hs-cf-lambda
us-east-1.enforceAclForReadsProd 12
x-amz-request-id
0D2JN7YYHJZ5919B
cf-bgj
imgq:85,h2pri
etag
"cd208635457bf65f33aa7c8849efcf21"
vary
Accept, Accept-Encoding
access-control-allow-methods
GET
content-type
image/webp
access-control-allow-origin
*
cache-control
s-maxage=1814400, max-age=1209600, stale-while-revalidate=900
x-robots-tag
all
x-hs-cf-lambda-enforce
us-east-1.enforceAclForReadsProd 12
x-amz-meta-created-unix-time-millis
1613708850431
date
Thu, 07 Oct 2021 05:09:04 GMT
via
1.1 41f60102fc29156bc5001d6646f75c02.cloudfront.net (CloudFront)
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-amz-cf-pop
FRA2-C1
x-hs-alternate-content-type
text/plain
cf-polished
origFmt=png, origSize=685987
x-cache
RefreshHit from cloudfront
x-amz-meta-index-tag
all
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length
475630
x-amz-id-2
VMKaVs3CoiNxvO9uDU3G1e2Yei2z8pHddn/VQ5tmETV0kE5OXzx0ttLMZbaSqMcuuGm9oUmDq+w=
last-modified
Fri, 19 Feb 2021 04:27:31 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=bYTy1JZGpUpWhQZsPds2OXrvPCXOKgA83eRIjSPkeZdCgiV6nHKfISKCDA7g1wE16Aeb8JWnmLbsHHC%2FLQUFDGE7cGsNNyRWKuQ3dBAXdWptfQ%2FYdAYrIbkkRI2DiZj8RV1edg%3D%3D"}],"group":"cf-nel","max_age":604800}
x-amz-version-id
pMBSD6mHHoba7vVAwnZHReLD9ID8b41e
accept-ranges
bytes
cf-ray
69a49d7ecc841f19-FRA
x-amz-cf-id
_oY5z62GC4nhCaFRqXG_or82G2_tulcEUirQxLlsEmM8Qg8YfyX5FA==
cr-mln-network__footer-subscribe-bg.png
www.cybereason.com/hubfs/dam/images/images-web/blog-images/template-images/ 		17 KB
18 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.cybereason.com/hubfs/dam/images/images-web/blog-images/template-images/cr-mln-network__footer-subscribe-bg.png
Requested by
Host: www.cybereason.com
URL: https://www.cybereason.com/hs-fs/hub/3354902/hub_generated/template_assets/42760289143/1624557581500/__CR_Web_Platform_2020/CSS/cr-mln__build.min.css
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
199.60.103.226 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
218877f60296297dec8266377083291f36d46f2980c1ff027471904470d14f49

Request headers

:path
/hubfs/dam/images/images-web/blog-images/template-images/cr-mln-network__footer-subscribe-bg.png
pragma
no-cache
cookie
__cfruid=649f615bd690efb862dbcff90d2cb8293e32c367-1633583344
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
www.cybereason.com
referer
https://www.cybereason.com/hs-fs/hub/3354902/hub_generated/template_assets/42760289143/1624557581500/__CR_Web_Platform_2020/CSS/cr-mln__build.min.css
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://www.cybereason.com/hs-fs/hub/3354902/hub_generated/template_assets/42760289143/1624557581500/__CR_Web_Platform_2020/CSS/cr-mln__build.min.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

x-amz-meta-cache-tag
F-42844750665,FD-41718904629,P-3354902,FLS-ALL
age
549045
x-amz-server-side-encryption
AES256
edge-cache-tag
F-42844750665,FD-41718904629,P-3354902,FLS-ALL
x-edge-origin-shield-skipped
0
x-amz-replication-status
COMPLETED
content-disposition
inline; filename="cr-mln-network__footer-subscribe-bg.webp"
x-hs-cf-lambda
us-east-1.enforceAclForReadsProd 12
x-amz-request-id
PCB40S46HGBFTDBV
cf-bgj
imgq:85,h2pri
etag
"c28026bc6a6d55f395e2227b7b19c8c9"
vary
Accept, Accept-Encoding
access-control-allow-methods
GET
content-type
image/webp
access-control-allow-origin
*
cache-control
s-maxage=1814400, max-age=1209600, stale-while-revalidate=900
x-robots-tag
all
x-hs-cf-lambda-enforce
us-east-1.enforceAclForReadsProd 12
x-amz-meta-created-unix-time-millis
1615403417467
date
Thu, 07 Oct 2021 05:09:04 GMT
via
1.1 dde0b4b1e223fa23670e93078a04c116.cloudfront.net (CloudFront)
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-amz-cf-pop
FRA2-C1
x-hs-alternate-content-type
text/plain
cf-polished
origFmt=png, origSize=76527
x-cache
RefreshHit from cloudfront
x-amz-meta-index-tag
all
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length
17430
x-amz-id-2
McQVLbOhPw2AeVUwMicslop4XKbiTw4B0ZgwVh45moZX9w575aYN8IKx4srBwIvMQgGgqrYinM8=
last-modified
Wed, 10 Mar 2021 19:10:18 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=IdfPILDUF%2FVou753mwFudoXAxSRqs%2BlaInTSW7saRn6mBi2HxvJ4u0%2FMrVkKTWcEyPnyGlwIHSRIBkFSef44nhNWvSkKoD%2B7puSK1wKyN8EUofaGxjWRpFZD%2F89lnXLtL1pnug%3D%3D"}],"group":"cf-nel","max_age":604800}
x-amz-version-id
re8UAqBG9Z9r42hnTIwXdZAL52u2VF_w
accept-ranges
bytes
cf-ray
69a49d7f0cc81f19-FRA
x-amz-cf-id
T2lCbdzUg7PbUGD6x1VYIfkJAJQPixi-_LZdlSg015XfzTkIiM_yng==
memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2
fonts.gstatic.com/s/opensans/v26/ 		44 KB
44 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/opensans/v26/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Barlow:ital,wght@0,100;0,200;0,300;0,400;0,500;0,600;0,700;0,800;0,900;1,100;1,200;1,300;1,400;1,500;1,600;1,700;1,800;1,900&family=Open+Sans:ital,wght@0,300;0,400;0,600;0,700;0,800;1,300;1,400;1,600;1,700;1,800&display=swap
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
216.58.212.131 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
ams15s21-in-f131.1e100.net
Software
sffe /
Resource Hash
538dd4ff6e384a44155168326ac40a6c20a93cd212b1fbf88ae7b0c44f9ab0bd
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://www.cybereason.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Thu, 30 Sep 2021 17:04:31 GMT
x-content-type-options
nosniff
age
561873
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
44760
x-xss-protection
0
last-modified
Thu, 23 Sep 2021 16:50:17 GMT
server
sffe
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="apps-themes"
expires
Fri, 30 Sep 2022 17:04:31 GMT
ionicons.ttf
www.cybereason.com/hubfs/__dam/fonts/ 		184 KB
107 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://www.cybereason.com/hubfs/__dam/fonts/ionicons.ttf
Requested by
Host: www.cybereason.com
URL: https://www.cybereason.com/hs-fs/hub/3354902/hub_generated/template_assets/35275979682/1600880367101/__CR_Web_Platform_2020/CSS/ionicons.min.css
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
199.60.103.226 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
2ba7f20b1d8990e17a47fe3d88e4c766628aaa2baf1dd30fca0a0db59836f5f9

Request headers

sec-fetch-mode
cors
origin
https://www.cybereason.com
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
sec-fetch-dest
font
cookie
__cfruid=649f615bd690efb862dbcff90d2cb8293e32c367-1633583344
:path
/hubfs/__dam/fonts/ionicons.ttf
pragma
no-cache
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept
*/*
cache-control
no-cache
:authority
www.cybereason.com
referer
https://www.cybereason.com/hs-fs/hub/3354902/hub_generated/template_assets/35275979682/1600880367101/__CR_Web_Platform_2020/CSS/ionicons.min.css
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://www.cybereason.com/hs-fs/hub/3354902/hub_generated/template_assets/35275979682/1600880367101/__CR_Web_Platform_2020/CSS/ionicons.min.css
Origin
https://www.cybereason.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

content-encoding
br
x-amz-meta-cache-tag
F-35275624221,FD-35275624214,P-3354902,FLS-ALL
age
551050
x-amz-server-side-encryption
AES256
edge-cache-tag
F-35275624221,FD-35275624214,P-3354902,FLS-ALL
x-edge-origin-shield-skipped
0
x-amz-replication-status
COMPLETED
x-hs-cf-lambda
us-east-1.enforceAclForReadsProd 12
x-amz-request-id
HD5F0YW69P9QPJG3
etag
W/"24712f6c47821394fba7942fbb52c3b2"
vary
Accept-Encoding
access-control-allow-methods
GET
content-type
font/ttf
access-control-allow-origin
*
cache-control
s-maxage=1814400, max-age=1209600, stale-while-revalidate=900
x-robots-tag
all
x-hs-cf-lambda-enforce
us-east-1.enforceAclForReadsProd 12
x-amz-meta-created-unix-time-millis
1600860540619
date
Thu, 07 Oct 2021 05:09:04 GMT
via
1.1 96283be49fd5bce30b3a0e9559bd2d9e.cloudfront.net (CloudFront)
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-amz-cf-pop
FRA2-C1
x-hs-alternate-content-type
text/plain
x-cache
RefreshHit from cloudfront
x-amz-meta-index-tag
all
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
x-amz-id-2
Yb65YVqHnoMRvpjqsIwmr+8h2RudqeGK3unJ7DbcwNTMpesVMRf/qyOloNd1YMZovMoGKqI5H0Y=
last-modified
Fri, 25 Sep 2020 09:38:00 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=HsaVcVp20BuTQ9F1PrvfZhEneaFqWzoTiUq72sQfMd6V4SWI1EVJ35zWg2OhqWgSXD4wXnVNLSf9ssrGis4vaYAAZ6OXZlIytmyIivN%2Bl9BnG7je8iNyOL5HhP%2BI9vXU7XMS8w%3D%3D"}],"group":"cf-nel","max_age":604800}
x-amz-version-id
jxZ9WTKM12FAq58JViQDodht0EN9wNZx
cf-ray
69a49d7f0cc91f19-FRA
x-amz-cf-id
0oO8--K2V89t8kPPt_kY2gd4V94OHZF1ulFjW8zcmHGIcNpV-YIkLg==
7cHqv4kjgoGqM7E3_-gs51os.woff2
fonts.gstatic.com/s/barlow/v5/ 		20 KB
20 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/barlow/v5/7cHqv4kjgoGqM7E3_-gs51os.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Barlow:ital,wght@0,100;0,200;0,300;0,400;0,500;0,600;0,700;0,800;0,900;1,100;1,200;1,300;1,400;1,500;1,600;1,700;1,800;1,900&display=swap
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
216.58.212.131 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
ams15s21-in-f131.1e100.net
Software
sffe /
Resource Hash
bf6c1e2f8c250b7efeb5d250181599880b1c17efc3c94466aa5d847454bf14ef
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://www.cybereason.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Tue, 05 Oct 2021 08:46:54 GMT
x-content-type-options
nosniff
age
159730
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
20348
x-xss-protection
0
last-modified
Thu, 10 Sep 2020 17:07:49 GMT
server
sffe
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Wed, 05 Oct 2022 08:46:54 GMT
7cHqv4kjgoGqM7E30-8s51os.woff2
fonts.gstatic.com/s/barlow/v5/ 		21 KB
21 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/barlow/v5/7cHqv4kjgoGqM7E30-8s51os.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Barlow:ital,wght@0,100;0,200;0,300;0,400;0,500;0,600;0,700;0,800;0,900;1,100;1,200;1,300;1,400;1,500;1,600;1,700;1,800;1,900&display=swap
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
216.58.212.131 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
ams15s21-in-f131.1e100.net
Software
sffe /
Resource Hash
46710f0509008ad4a31212927e35441764b757d672b2ed4f892ee4e2f0804abb
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://www.cybereason.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Mon, 04 Oct 2021 10:50:25 GMT
x-content-type-options
nosniff
age
238719
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
21072
x-xss-protection
0
last-modified
Thu, 10 Sep 2020 17:05:33 GMT
server
sffe
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="apps-themes"
expires
Tue, 04 Oct 2022 10:50:25 GMT
7cHqv4kjgoGqM7E3t-4s51os.woff2
fonts.gstatic.com/s/barlow/v5/ 		21 KB
21 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/barlow/v5/7cHqv4kjgoGqM7E3t-4s51os.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Barlow:ital,wght@0,100;0,200;0,300;0,400;0,500;0,600;0,700;0,800;0,900;1,100;1,200;1,300;1,400;1,500;1,600;1,700;1,800;1,900&display=swap
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
216.58.212.131 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
ams15s21-in-f131.1e100.net
Software
sffe /
Resource Hash
4c52e4274ebdbe29cd5b4983d888c247496b6d3bb55e05d4c0769d1b946d14f8
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://www.cybereason.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Mon, 04 Oct 2021 04:26:44 GMT
x-content-type-options
nosniff
age
261740
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
21080
x-xss-protection
0
last-modified
Thu, 10 Sep 2020 17:05:19 GMT
server
sffe
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Tue, 04 Oct 2022 04:26:44 GMT
7cHpv4kjgoGqM7E_DMs5.woff2
fonts.gstatic.com/s/barlow/v5/ 		20 KB
20 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/barlow/v5/7cHpv4kjgoGqM7E_DMs5.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Barlow:ital,wght@0,100;0,200;0,300;0,400;0,500;0,600;0,700;0,800;0,900;1,100;1,200;1,300;1,400;1,500;1,600;1,700;1,800;1,900&display=swap
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
216.58.212.131 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
ams15s21-in-f131.1e100.net
Software
sffe /
Resource Hash
023694a0472dde38c6600bf88e6330765839e53f64f94edb63714aeab3de7e51
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://www.cybereason.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Wed, 06 Oct 2021 13:29:55 GMT
x-content-type-options
nosniff
age
56349
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
20444
x-xss-protection
0
last-modified
Thu, 10 Sep 2020 17:04:46 GMT
server
sffe
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="apps-themes"
expires
Thu, 06 Oct 2022 13:29:55 GMT
memtYaGs126MiZpBA-UFUIcVXSCEkx2cmqvXlWqWuU6F.woff2
fonts.gstatic.com/s/opensans/v26/ 		47 KB
47 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/opensans/v26/memtYaGs126MiZpBA-UFUIcVXSCEkx2cmqvXlWqWuU6F.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Barlow:ital,wght@0,100;0,200;0,300;0,400;0,500;0,600;0,700;0,800;0,900;1,100;1,200;1,300;1,400;1,500;1,600;1,700;1,800;1,900&family=Open+Sans:ital,wght@0,300;0,400;0,600;0,700;0,800;1,300;1,400;1,600;1,700;1,800&display=swap
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
216.58.212.131 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
ams15s21-in-f131.1e100.net
Software
sffe /
Resource Hash
d8dee5bb67e8a759f73dfbaeadba9220ad478a8187f58a59a50f906b0e51f65b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://www.cybereason.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Wed, 06 Oct 2021 20:32:05 GMT
x-content-type-options
nosniff
age
31019
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
47804
x-xss-protection
0
last-modified
Thu, 23 Sep 2021 16:51:13 GMT
server
sffe
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="apps-themes"
expires
Thu, 06 Oct 2022 20:32:05 GMT
HTxwL3I-JCGChYJ8VI-L6OO_au7B46r2z3bWuQ.woff2
fonts.gstatic.com/s/barlowcondensed/v5/ 		20 KB
20 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/barlowcondensed/v5/HTxwL3I-JCGChYJ8VI-L6OO_au7B46r2z3bWuQ.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Barlow+Condensed:ital,wght@0,100;0,200;0,300;0,400;0,500;0,600;0,700;0,800;0,900;1,100;1,200;1,300;1,400;1,500;1,600;1,700;1,800;1,900&display=swap
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
216.58.212.131 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
ams15s21-in-f131.1e100.net
Software
sffe /
Resource Hash
63e0d1cf0ded40281f4b4c439d8c6e6630e3b31acf44d0d198e2513680c4bac9
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://www.cybereason.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Fri, 01 Oct 2021 10:23:18 GMT
x-content-type-options
nosniff
age
499546
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
20676
x-xss-protection
0
last-modified
Thu, 10 Sep 2020 17:03:52 GMT
server
sffe
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="apps-themes"
expires
Sat, 01 Oct 2022 10:23:18 GMT
HTxwL3I-JCGChYJ8VI-L6OO_au7B4873z3bWuQ.woff2
fonts.gstatic.com/s/barlowcondensed/v5/ 		20 KB
20 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/barlowcondensed/v5/HTxwL3I-JCGChYJ8VI-L6OO_au7B4873z3bWuQ.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Barlow+Condensed:ital,wght@0,100;0,200;0,300;0,400;0,500;0,600;0,700;0,800;0,900;1,100;1,200;1,300;1,400;1,500;1,600;1,700;1,800;1,900&display=swap
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
216.58.212.131 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
ams15s21-in-f131.1e100.net
Software
sffe /
Resource Hash
604f11b1aa0c94217abb80eb7a5c7de728f9463e4f045fe8a34339f438a50cec
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://www.cybereason.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Mon, 04 Oct 2021 04:43:41 GMT
x-content-type-options
nosniff
age
260723
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
20500
x-xss-protection
0
last-modified
Thu, 10 Sep 2020 17:03:29 GMT
server
sffe
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Tue, 04 Oct 2022 04:43:41 GMT
HTxwL3I-JCGChYJ8VI-L6OO_au7B4-Lwz3bWuQ.woff2
fonts.gstatic.com/s/barlowcondensed/v5/ 		19 KB
19 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/barlowcondensed/v5/HTxwL3I-JCGChYJ8VI-L6OO_au7B4-Lwz3bWuQ.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Barlow+Condensed:ital,wght@0,100;0,200;0,300;0,400;0,500;0,600;0,700;0,800;0,900;1,100;1,200;1,300;1,400;1,500;1,600;1,700;1,800;1,900&display=swap
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
216.58.212.131 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
ams15s21-in-f131.1e100.net
Software
sffe /
Resource Hash
979ddb6f0c77e6744b104f96e9d7ab0f8fc56d7f24ab10d853e4e96fa425e9c5
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://www.cybereason.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Wed, 06 Oct 2021 13:29:59 GMT
x-content-type-options
nosniff
age
56345
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
19724
x-xss-protection
0
last-modified
Thu, 10 Sep 2020 17:03:43 GMT
server
sffe
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="apps-themes"
expires
Thu, 06 Oct 2022 13:29:59 GMT
HTxwL3I-JCGChYJ8VI-L6OO_au7B47rxz3bWuQ.woff2
fonts.gstatic.com/s/barlowcondensed/v5/ 		19 KB
19 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/barlowcondensed/v5/HTxwL3I-JCGChYJ8VI-L6OO_au7B47rxz3bWuQ.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Barlow+Condensed:ital,wght@0,100;0,200;0,300;0,400;0,500;0,600;0,700;0,800;0,900;1,100;1,200;1,300;1,400;1,500;1,600;1,700;1,800;1,900&display=swap
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
216.58.212.131 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
ams15s21-in-f131.1e100.net
Software
sffe /
Resource Hash
bb40a0a0cec6732e3ed3fb49ad3933f72f441e28585dfaea5e58035f5520709c
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://www.cybereason.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Tue, 05 Oct 2021 09:13:29 GMT
x-content-type-options
nosniff
age
158135
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
19468
x-xss-protection
0
last-modified
Thu, 10 Sep 2020 17:03:05 GMT
server
sffe
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Wed, 05 Oct 2022 09:13:29 GMT
image35-3.png
www.cybereason.com/hs-fs/hubfs/ 		9 KB
10 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.cybereason.com/hs-fs/hubfs/image35-3.png?width=609&name=image35-3.png
Requested by
Host: www.cybereason.com
URL: https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms?blaid=2123744
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
199.60.103.226 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
e6b6cd7a4fc13d7fd71a9b17195f51e5888ba257d487fc6bdde79690fe5f955e

Request headers

:path
/hs-fs/hubfs/image35-3.png?width=609&name=image35-3.png
pragma
no-cache
cookie
__cfruid=649f615bd690efb862dbcff90d2cb8293e32c367-1633583344
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
www.cybereason.com
referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms?blaid=2123744
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms?blaid=2123744
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

age
334215
x-amz-server-side-encryption
AES256
edge-cache-tag
F-56556607860,P-3354902,FLS-ALL
x-edge-origin-shield-skipped
0
x-amz-replication-status
COMPLETED
content-disposition
inline; filename="image35-3.webp"
x-hs-cf-lambda
us-east-1.enforceAclForReadsProd 12
cf-bgj
imgq:85,h2pri
etag
"90b3ec7231882349cde010e185d2d567"
vary
Accept, Accept-Encoding
x-amz-meta-created-unix-time-millis
1633114224441
content-type
image/webp
cache-control
s-maxage=1814400, max-age=1209600, stale-while-revalidate=900
x-robots-tag
all
x-hs-cf-lambda-enforce
us-east-1.enforceAclForReadsProd 12
date
Thu, 07 Oct 2021 05:09:04 GMT
via
1.1 824fe21e467658628899bdd8725649ee.cloudfront.net (CloudFront)
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-amz-cf-pop
IAD89-C1
x-hs-alternate-content-type
text/plain
cf-polished
origFmt=png, origSize=18784
x-cache
RefreshHit from cloudfront
x-amz-meta-index-tag
all
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length
9174
last-modified
Fri, 01 Oct 2021 18:50:25 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=iljn15jDntmQskQDh0eVJJA2p1Y6sIs6fx7n4EVf%2BbAbyqrIoYnkIY49Gp3tBugc7%2Frz4p9zboCeGA3m7scxL%2FSphYj7UnP8wsRCb7lAfQvPs2KVHvhB9AO67431vXBybow90Q%3D%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-credentials
false
accept-ranges
bytes
cf-ray
69a49d7fcd571f19-FRA
x-amz-cf-id
_91sG_5bhoVZCEy06bznrI61rA75OdbvSqTpqMv_uezqxEvSPK7Tjg==
image5-Oct-01-2021-06-01-05-16-PM.png
www.cybereason.com/hs-fs/hubfs/ 		8 KB
9 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.cybereason.com/hs-fs/hubfs/image5-Oct-01-2021-06-01-05-16-PM.png?width=676&name=image5-Oct-01-2021-06-01-05-16-PM.png
Requested by
Host: www.cybereason.com
URL: https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms?blaid=2123744
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
199.60.103.226 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
520be9aa9d6c5a6b301f92ba52999af829167a848052975840193aaf1d0ced1e

Request headers

:path
/hs-fs/hubfs/image5-Oct-01-2021-06-01-05-16-PM.png?width=676&name=image5-Oct-01-2021-06-01-05-16-PM.png
pragma
no-cache
cookie
__cfruid=649f615bd690efb862dbcff90d2cb8293e32c367-1633583344
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
www.cybereason.com
referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms?blaid=2123744
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms?blaid=2123744
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

age
334215
x-amz-server-side-encryption
AES256
edge-cache-tag
F-56551976499,P-3354902,FLS-ALL
x-edge-origin-shield-skipped
0
x-amz-replication-status
COMPLETED
content-disposition
inline; filename="image5-Oct-01-2021-06-01-05-16-PM.webp"
x-hs-cf-lambda
us-east-1.enforceAclForReadsProd 12
cf-bgj
imgq:85,h2pri
etag
"7bf5bcb6ba7cc1b5109d88c6e3e41c31"
vary
Accept, Accept-Encoding
x-amz-meta-created-unix-time-millis
1633111265215
content-type
image/webp
cache-control
s-maxage=1814400, max-age=1209600, stale-while-revalidate=900
x-robots-tag
all
x-hs-cf-lambda-enforce
us-east-1.enforceAclForReadsProd 12
date
Thu, 07 Oct 2021 05:09:04 GMT
via
1.1 b4346add631a498bf6cdbf88cbc5ff13.cloudfront.net (CloudFront)
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-amz-cf-pop
IAD89-C1
x-hs-alternate-content-type
text/plain
cf-polished
origFmt=png, origSize=25359
x-cache
Miss from cloudfront
x-amz-meta-index-tag
all
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length
8244
last-modified
Fri, 01 Oct 2021 18:01:06 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=N1PHOVvpXSwKn0rojN2g4bqLkvlz3L%2FZPJdKwYDwV1mXerZftus4r1cMii6YdXoHWkJWMpVJHS4bmw84R4t5JrAZPVRc98wuIKEXv4so%2FznfXdaBYIUFo7oQgn4aYz934hi40Q%3D%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-credentials
false
accept-ranges
bytes
cf-ray
69a49d7fcd591f19-FRA
x-amz-cf-id
uj2fRjoFDUuOQm9Fv6AkaxC347R9eMSRQCGfOrC097bwkaSaeHBohA==
image28-3.png
www.cybereason.com/hs-fs/hubfs/ 		2 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.cybereason.com/hs-fs/hubfs/image28-3.png?width=404&name=image28-3.png
Requested by
Host: www.cybereason.com
URL: https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms?blaid=2123744
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
199.60.103.226 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
936bceef72b48206aa1f56e46495f40fbe6f271189ff009c360eedddfcd401f1

Request headers

:path
/hs-fs/hubfs/image28-3.png?width=404&name=image28-3.png
pragma
no-cache
cookie
__cfruid=649f615bd690efb862dbcff90d2cb8293e32c367-1633583344
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
www.cybereason.com
referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms?blaid=2123744
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms?blaid=2123744
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

age
68428
x-amz-server-side-encryption
AES256
edge-cache-tag
F-56551732152,P-3354902,FLS-ALL
x-edge-origin-shield-skipped
0
x-amz-replication-status
COMPLETED
content-disposition
inline; filename="image28-3.webp"
x-hs-cf-lambda
us-east-1.enforceAclForReadsProd 12
cf-bgj
imgq:85,h2pri
etag
"7217c1b7168dca34a02a65d5a157c213"
vary
Accept, Accept-Encoding
x-amz-meta-created-unix-time-millis
1633111391796
content-type
image/webp
cache-control
s-maxage=1814400, max-age=1209600, stale-while-revalidate=900
x-robots-tag
all
x-hs-cf-lambda-enforce
us-east-1.enforceAclForReadsProd 12
date
Thu, 07 Oct 2021 05:09:04 GMT
via
1.1 7e9d74c81117937f0703aa3977d2d999.cloudfront.net (CloudFront)
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-amz-cf-pop
IAD89-C1
x-hs-alternate-content-type
text/plain
cf-polished
origFmt=png, origSize=2808
x-cache
RefreshHit from cloudfront
x-amz-meta-index-tag
all
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length
1842
last-modified
Fri, 01 Oct 2021 18:03:12 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=7gTNgSh4UxK6iFaqQhIDHsUTi0KYonGFnNnwfT2jjQZescWGOcCilfmqrfJbMNsaFQ92Jccmh2WRhVZjiDkFq%2FDHUusJTAaLHFx0bz5RTAwo2fXddJpJYYJAYkI9NbiH3hPLrA%3D%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-credentials
false
accept-ranges
bytes
cf-ray
69a49d7fcd5a1f19-FRA
x-amz-cf-id
swDyDgVTbjB21gcaNYqjzsDW0QKWQH3xucCH-3I2H8z6lKy2Fl0fGQ==
image25-3.png
www.cybereason.com/hs-fs/hubfs/ 		4 KB
6 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.cybereason.com/hs-fs/hubfs/image25-3.png?width=380&name=image25-3.png
Requested by
Host: www.cybereason.com
URL: https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms?blaid=2123744
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
199.60.103.226 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
6643689ff2163b6279edbf3aed8b99f3106da59a96aff78e1fce94a3675777e2

Request headers

:path
/hs-fs/hubfs/image25-3.png?width=380&name=image25-3.png
pragma
no-cache
cookie
__cfruid=649f615bd690efb862dbcff90d2cb8293e32c367-1633583344
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
www.cybereason.com
referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms?blaid=2123744
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms?blaid=2123744
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

age
333905
x-amz-server-side-encryption
AES256
edge-cache-tag
F-56553219845,P-3354902,FLS-ALL
x-edge-origin-shield-skipped
0
x-amz-replication-status
COMPLETED
content-disposition
inline; filename="image25-3.webp"
x-hs-cf-lambda
us-east-1.enforceAclForReadsProd 12
cf-bgj
imgq:85,h2pri
etag
"4742d02497807bcd9efd156c54fbb331"
vary
Accept, Accept-Encoding
x-amz-meta-created-unix-time-millis
1633111481964
content-type
image/webp
cache-control
s-maxage=1814400, max-age=1209600, stale-while-revalidate=900
x-robots-tag
all
x-hs-cf-lambda-enforce
us-east-1.enforceAclForReadsProd 12
date
Thu, 07 Oct 2021 05:09:04 GMT
via
1.1 824fe21e467658628899bdd8725649ee.cloudfront.net (CloudFront)
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-amz-cf-pop
IAD89-C1
x-hs-alternate-content-type
text/plain
cf-polished
origFmt=png, origSize=8097
x-cache
RefreshHit from cloudfront
x-amz-meta-index-tag
all
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length
4596
last-modified
Fri, 01 Oct 2021 18:04:43 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ELlJMnc3kOVtWRp6rk%2BhEAGB0h8tSdtJnCms%2FnNRmRggfRUbCVoTwg0O%2B%2FFpGXqr1RrGdABiRj1jitimv2UxzCPbK0%2FJOtbUF0tcvUuMsq0FG1Gv0KDQn5jdFcCA%2Fm6KZJJREw%3D%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-credentials
false
accept-ranges
bytes
cf-ray
69a49d7fcd5c1f19-FRA
x-amz-cf-id
0aFF9gl8SBtkiIekmXM81ZvUbwWJlvFEJU9zJfC3srkHe6xKtL0gYQ==
image7-Oct-01-2021-06-06-36-68-PM.png
www.cybereason.com/hs-fs/hubfs/ 		8 KB
9 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.cybereason.com/hs-fs/hubfs/image7-Oct-01-2021-06-06-36-68-PM.png?width=870&name=image7-Oct-01-2021-06-06-36-68-PM.png
Requested by
Host: www.cybereason.com
URL: https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms?blaid=2123744
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
199.60.103.226 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
26c4f84717b932188a5f1b3dfbc9ed2166d27c84b7f763f5ca218258996b78fe

Request headers

:path
/hs-fs/hubfs/image7-Oct-01-2021-06-06-36-68-PM.png?width=870&name=image7-Oct-01-2021-06-06-36-68-PM.png
pragma
no-cache
cookie
__cfruid=649f615bd690efb862dbcff90d2cb8293e32c367-1633583344
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
www.cybereason.com
referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms?blaid=2123744
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms?blaid=2123744
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

age
333904
x-amz-server-side-encryption
AES256
edge-cache-tag
F-56552812849,P-3354902,FLS-ALL
x-edge-origin-shield-skipped
0
x-amz-replication-status
COMPLETED
content-disposition
inline; filename="image7-Oct-01-2021-06-06-36-68-PM.webp"
x-hs-cf-lambda
us-east-1.enforceAclForReadsProd 12
cf-bgj
imgq:85,h2pri
etag
"373c334a8b1fe66aec71daf64e82e9c0"
vary
Accept, Accept-Encoding
x-amz-meta-created-unix-time-millis
1633111596691
content-type
image/webp
cache-control
s-maxage=1814400, max-age=1209600, stale-while-revalidate=900
x-robots-tag
all
x-hs-cf-lambda-enforce
us-east-1.enforceAclForReadsProd 12
date
Thu, 07 Oct 2021 05:09:04 GMT
via
1.1 7f7e359e1c06a914d3d305785359b84d.cloudfront.net (CloudFront)
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-amz-cf-pop
IAD89-C1
x-hs-alternate-content-type
text/plain
cf-polished
origFmt=png, origSize=24930
x-cache
Miss from cloudfront
x-amz-meta-index-tag
all
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length
7772
last-modified
Fri, 01 Oct 2021 18:06:37 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=RbsqljL6yI57mEYzJjx2hwRfZyGuiEMF01Tm8DA6tycB6kyoFPP816lLp2dbsHcSo3N3hQohGmE97gXxkPJjpaFcG8BaWyAai%2FPbm0UvY%2BDmRVWjrlKuIn%2BWzJXjqqiiVwaFhA%3D%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-credentials
false
accept-ranges
bytes
cf-ray
69a49d7fcd5d1f19-FRA
x-amz-cf-id
8dKKgJfqivNOFNXi8egxEI3xktHFYj_-0qpZc4QZpNHMf18TfL4dvA==
image16-Oct-01-2021-06-08-59-58-PM.png
www.cybereason.com/hs-fs/hubfs/ 		4 KB
5 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.cybereason.com/hs-fs/hubfs/image16-Oct-01-2021-06-08-59-58-PM.png?width=514&name=image16-Oct-01-2021-06-08-59-58-PM.png
Requested by
Host: www.cybereason.com
URL: https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms?blaid=2123744
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
199.60.103.226 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
e5414240e1b04e9d52490a3a54b3fc05978f47ae60cd01e8a61ba799ef0f80df

Request headers

:path
/hs-fs/hubfs/image16-Oct-01-2021-06-08-59-58-PM.png?width=514&name=image16-Oct-01-2021-06-08-59-58-PM.png
pragma
no-cache
cookie
__cfruid=649f615bd690efb862dbcff90d2cb8293e32c367-1633583344
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
www.cybereason.com
referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms?blaid=2123744
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms?blaid=2123744
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

age
68664
x-amz-server-side-encryption
AES256
edge-cache-tag
F-56551977343,P-3354902,FLS-ALL
x-edge-origin-shield-skipped
0
x-amz-replication-status
COMPLETED
content-disposition
inline; filename="image16-Oct-01-2021-06-08-59-58-PM.webp"
x-hs-cf-lambda
us-east-1.enforceAclForReadsProd 12
cf-bgj
imgq:85,h2pri
etag
"0488a579a292e5798dc758e6283a33af"
vary
Accept, Accept-Encoding
x-amz-meta-created-unix-time-millis
1633111739630
content-type
image/webp
cache-control
s-maxage=1814400, max-age=1209600, stale-while-revalidate=900
x-robots-tag
all
x-hs-cf-lambda-enforce
us-east-1.enforceAclForReadsProd 12
date
Thu, 07 Oct 2021 05:09:04 GMT
via
1.1 baddfcb4f2a6876b4fcc03bcd62427ef.cloudfront.net (CloudFront)
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-amz-cf-pop
IAD89-C1
x-hs-alternate-content-type
text/plain
cf-polished
origFmt=png, origSize=9027
x-cache
RefreshHit from cloudfront
x-amz-meta-index-tag
all
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length
3984
last-modified
Fri, 01 Oct 2021 18:09:00 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=dBcxKoJWketWE%2BenPtWcR2x4wDRIyfeKbRMvQQAF6WIeW6HumF0oAdr8GnUbpml3SqVb%2FE1zigLqxi%2FlnSC6gx%2FGQ6DoqHdRid8NdsmbS1%2B10ynKrReOae3FW1CaA0O%2BRK9aCw%3D%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-credentials
false
accept-ranges
bytes
cf-ray
69a49d7fdd5e1f19-FRA
x-amz-cf-id
DmjIu3r-XEkQW9bAnBbPFi3BlnlZyDHsPlTAtSG1R5o_y1rXa06yLw==
all.js
connect.facebook.net/en_GB/ 		3 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://connect.facebook.net/en_GB/all.js
Requested by
Host: www.cybereason.com
URL: https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms?blaid=2123744
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
31.13.92.14 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
xx-fbcdn-shv-01-frt3.fbcdn.net
Software
/
Resource Hash
a41b715cf79c77013461b52b6114c3ed16bcef2bc03d729afd46d5530a3476f4
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms?blaid=2123744
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; preload; includeSubDomains
content-encoding
gzip
x-content-type-options
nosniff
content-md5
bUCg+FY7WgMG14Ep4hjW2w==
cross-origin-resource-policy
cross-origin
expires
Thu, 07 Oct 2021 05:26:38 GMT
alt-svc
h3=":443"; ma=3600,h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length
1687
x-fb-rlafr
0
x-fb-debug
XCE+6/yjfTm/qNuj9ar7qt/a/nRcLljhwVnulSNj9Ifq2s2x1jp04M5gwNGiLhlQNY2KsZToAiO/0BRkNf2qcA==
x-fb-trip-id
686109401
x-fb-content-md5
057e8a0cba3f2df206fa47d58788b5b5
cross-origin-opener-policy
same-origin-allow-popups
cross-origin-embedder-policy-report-only
require-corp;report-to="coep_report"
date
Thu, 07 Oct 2021 05:09:04 GMT
x-frame-options
DENY
report-to
{"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/?minimize=0"}],"group":"coep_report"}
content-type
application/x-javascript; charset=utf-8
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public,max-age=1200,stale-while-revalidate=3600
etag
"b650bb87e00076883c1a516dff6129b9"
timing-allow-origin
*
access-control-expose-headers
X-FB-Content-MD5
widgets.js
platform.twitter.com/ 		96 KB
29 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://platform.twitter.com/widgets.js
Requested by
Host: www.cybereason.com
URL: https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms?blaid=2123744
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
93.184.220.66 London, United Kingdom, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECS (frb/669F) /
Resource Hash
cfd3099998b0c37ace8024cbd802160585ba9be1c0047fefc172035184f074df

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms?blaid=2123744
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date
Thu, 07 Oct 2021 05:09:04 GMT
Content-Encoding
gzip
Last-Modified
Thu, 30 Sep 2021 19:09:26 GMT
Server
ECS (frb/669F)
Age
322
Etag
"f9ab884058c9d8de47075baa622f0e7e+gzip"
Vary
Accept-Encoding
x-tw-cdn
VZ
P3P
CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin
*
Cache-Control
public, max-age=1800
X-Cache
HIT
Access-Control-Allow-Methods
GET
Content-Type
application/javascript; charset=utf-8
Content-Length
28869
l
use.typekit.net/af/343335/00000000000000003b9b0ad0/27/ 		16 KB
16 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://use.typekit.net/af/343335/00000000000000003b9b0ad0/27/l?primer=7cdcb44be4a7db8877ffa5c0007b8dd865b3bbc383831fe2ea177f62257a9191&fvd=n3&v=3
Requested by
Host: www.cybereason.com
URL: https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms?blaid=2123744
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.16.186.58 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a2-16-186-58.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
2e96bf761583273e370136ed0b934a38ad1e08b386accb37277252b37b9c9961

Request headers

Referer
https://www.cybereason.com/
Origin
https://www.cybereason.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Thu, 07 Oct 2021 05:09:04 GMT
server
nginx
etag
"eedb93b5a9ba82f97df21a2548066c304a8baad8"
content-type
application/font-woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
content-length
16112
l
use.typekit.net/af/4b34d2/00000000000000003b9b0acf/27/ 		16 KB
16 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://use.typekit.net/af/4b34d2/00000000000000003b9b0acf/27/l?primer=7cdcb44be4a7db8877ffa5c0007b8dd865b3bbc383831fe2ea177f62257a9191&fvd=i4&v=3
Requested by
Host: www.cybereason.com
URL: https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms?blaid=2123744
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.16.186.58 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a2-16-186-58.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
7219936e6e56b9932b2f1dd06cfff09b655a729bb17d0aa6d757e14184512384

Request headers

Referer
https://www.cybereason.com/
Origin
https://www.cybereason.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Thu, 07 Oct 2021 05:09:04 GMT
server
nginx
etag
"2d91046573f0e4458e7737f18f00bb9c13388e11"
content-type
application/font-woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
content-length
16252
l
use.typekit.net/af/cb6232/00000000000000003b9b0ad8/27/ 		15 KB
15 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://use.typekit.net/af/cb6232/00000000000000003b9b0ad8/27/l?primer=7cdcb44be4a7db8877ffa5c0007b8dd865b3bbc383831fe2ea177f62257a9191&fvd=n4&v=3
Requested by
Host: www.cybereason.com
URL: https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms?blaid=2123744
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.16.186.58 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a2-16-186-58.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
9607506688417bb09b8d6c29362c2fe29bc1b047b793cccddfce876d927fa57b

Request headers

Referer
https://www.cybereason.com/
Origin
https://www.cybereason.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Thu, 07 Oct 2021 05:09:04 GMT
server
nginx
etag
"865da7d2ecc4da3cb6bd5574f01738cfc5c8bb11"
content-type
application/font-woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
content-length
15448
l
use.typekit.net/af/abc1c3/00000000000000003b9b0ac9/27/ 		16 KB
16 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://use.typekit.net/af/abc1c3/00000000000000003b9b0ac9/27/l?primer=7cdcb44be4a7db8877ffa5c0007b8dd865b3bbc383831fe2ea177f62257a9191&fvd=n6&v=3
Requested by
Host: www.cybereason.com
URL: https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms?blaid=2123744
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.16.186.58 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a2-16-186-58.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
359197d1e7ab63fe678db88914f31f1f9f6a37bd182e0de565fc7a68302a1f50

Request headers

Referer
https://www.cybereason.com/
Origin
https://www.cybereason.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Thu, 07 Oct 2021 05:09:04 GMT
server
nginx
etag
"8c3ee2b4e977df4e0f73e1b985c24fba9611fc49"
content-type
application/font-woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
content-length
16652
l
use.typekit.net/af/62203f/00000000000000003b9b0ac8/27/ 		17 KB
17 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://use.typekit.net/af/62203f/00000000000000003b9b0ac8/27/l?primer=7cdcb44be4a7db8877ffa5c0007b8dd865b3bbc383831fe2ea177f62257a9191&fvd=i7&v=3
Requested by
Host: www.cybereason.com
URL: https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms?blaid=2123744
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.16.186.58 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a2-16-186-58.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
66b4fac9494bbeda177f4637fa3e7423fc8ef54b11a6875e68cdf3e472293b2a

Request headers

Referer
https://www.cybereason.com/
Origin
https://www.cybereason.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Thu, 07 Oct 2021 05:09:04 GMT
server
nginx
etag
"7b5be73a29b093f7ae3c099f5a521c9274f6db28"
content-type
application/font-woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
content-length
17148
l
use.typekit.net/af/19a2f0/00000000000000003b9b0ac7/27/ 		16 KB
16 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://use.typekit.net/af/19a2f0/00000000000000003b9b0ac7/27/l?primer=7cdcb44be4a7db8877ffa5c0007b8dd865b3bbc383831fe2ea177f62257a9191&fvd=n7&v=3
Requested by
Host: www.cybereason.com
URL: https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms?blaid=2123744
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.16.186.58 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a2-16-186-58.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
97829f8a6f2a471117ed06d0b06a81d543b091a262192369c531380779148c5c

Request headers

Referer
https://www.cybereason.com/
Origin
https://www.cybereason.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Thu, 07 Oct 2021 05:09:04 GMT
server
nginx
etag
"b9e1ecdf0fe601a7e9dfc362b400290203e7b31c"
content-type
application/font-woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
content-length
16456
l
use.typekit.net/af/cfbead/0000000000000000000146b3/27/ 		23 KB
23 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://use.typekit.net/af/cfbead/0000000000000000000146b3/27/l?primer=7cdcb44be4a7db8877ffa5c0007b8dd865b3bbc383831fe2ea177f62257a9191&fvd=n4&v=3
Requested by
Host: www.cybereason.com
URL: https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms?blaid=2123744
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.16.186.58 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a2-16-186-58.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
365a7ca6f52df29efedfdac2e08a9d0f03e4e2122dd9a49803bf8dacd58480fc

Request headers

Referer
https://www.cybereason.com/
Origin
https://www.cybereason.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Thu, 07 Oct 2021 05:09:04 GMT
server
nginx
etag
"122498e3424e674610da39fb441d661549879239"
content-type
application/font-woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
content-length
23248
l
use.typekit.net/af/f50d41/00000000000000003b9b2c84/27/ 		15 KB
15 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://use.typekit.net/af/f50d41/00000000000000003b9b2c84/27/l?primer=7cdcb44be4a7db8877ffa5c0007b8dd865b3bbc383831fe2ea177f62257a9191&fvd=n3&v=3
Requested by
Host: www.cybereason.com
URL: https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms?blaid=2123744
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.16.186.58 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a2-16-186-58.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
765097740b7490e6ab6a2d8624199ab7b147e8c6cec064b6cce257750fdb1985

Request headers

Referer
https://www.cybereason.com/
Origin
https://www.cybereason.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Thu, 07 Oct 2021 05:09:04 GMT
server
nginx
etag
"13c2813ff67959226aaa4eccfcdd1399bd756b8d"
content-type
application/font-woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
content-length
15336
has-permission
app.hubspot.com/content-tools-menu/api/v1/tools-menu/ 		0
768 B 		Script
General
Check archive.org
Download Go to
Full URL
https://app.hubspot.com/content-tools-menu/api/v1/tools-menu/has-permission?portalId=3354902&callback=jsonpHandler
Requested by
Host: www.cybereason.com
URL: https://www.cybereason.com/hs/hsstatic/HubspotToolsMenu/static-1.109/js/index.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.19.154.83 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms?blaid=2123744
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
x-hs-worker-debug-mode
false
server
cloudflare
x-hubspot-correlation-id
200cb472-6ba0-4bad-a849-e5e655b367cd
x-trace
2B06A8F85BF7E6EF1BE8B001E919503040D541E4BF000000000000000000
date
Thu, 07 Oct 2021 05:09:05 GMT
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
access-control-allow-methods
GET
cf-cache-status
DYNAMIC
report-to
{"group":"default","max_age":86400,"endpoints":[{"url":"https://exceptions.hubspot.com/csp/reports"}]}
cache-control
max-age=0
access-control-allow-credentials
true
cf-ray
69a49d81af49d6f5-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
leadflows.js
js.hsleadflows.net/ 		537 KB
87 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://js.hsleadflows.net/leadflows.js
Requested by
Host: www.cybereason.com
URL: https://www.cybereason.com/hs/scriptloader/3354902.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.17.230.204 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
b38803f733f36ff943399e6539b7fe1fa26611706ce6878b5b21c6a4f96ec862

Request headers

Referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms?blaid=2123744
Origin
https://www.cybereason.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Thu, 07 Oct 2021 05:09:04 GMT
via
1.1 8aad346c495a4d92f652a000a22d62fa.cloudfront.net (CloudFront)
cf-cache-status
HIT
age
69936
x-amz-server-side-encryption
AES256
content-security-policy-report-only
frame-ancestors 'self'; report-uri https://exceptions.hubspot.com/csp/report?resource=lead-flows-js/static-1.1056/bundle/main/lead-flows-release.js&cfRay=699df2138957692d-IAD
x-cache
RefreshHit from cloudfront
access-control-max-age
3000
x-amz-replication-status
COMPLETED
content-encoding
br
cf-ray
69a49d81ddc54e50-FRA
last-modified
Thu, 23 Sep 2021 09:11:54 UTC
server
cloudflare
etag
W/"9af442c5acbde436228f228f7502bfc8"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Origin,Access-Control-Request-Headers,Access-Control-Request-Method, Accept-Encoding
access-control-allow-methods
GET
x-amz-version-id
BdP6Nyyw4.FdbyHhgb7cfRPPJ2MC6STP
access-control-allow-origin
*
cache-control
s-maxage=86400, max-age=0
x-hs-cache-status
MISS
x-amz-cf-pop
IAD66-C2
content-type
application/javascript; charset=utf-8
x-amz-cf-id
alHC4uKDLRJvotIGhpOZKr3QmcbQeAJULRtaVDOsurRIzoCvETxNog==
x-hs-target-asset
lead-flows-js/static-1.1056/bundle/main/lead-flows-release.js
3354902.js
js.hs-banner.com/ 		61 KB
16 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://js.hs-banner.com/3354902.js
Requested by
Host: www.cybereason.com
URL: https://www.cybereason.com/hs/scriptloader/3354902.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.21.191 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
58ae09d221b5622f041fd635235b28202750a8c2c48a02524e45c555d99c2375

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms?blaid=2123744
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Thu, 07 Oct 2021 05:09:04 GMT
content-encoding
br
cf-cache-status
HIT
age
21
x-amz-server-side-encryption
AES256
content-type
text/javascript; charset=UTF-8
access-control-max-age
604800
x-amz-request-id
FFTA9V2MRDTXHYB7
x-amz-id-2
iKtuS1VeaNdsh281wHHt3nJGU5NicOHInMKVcK2fRkwxNcW5SCZsWD2vFiqV9W+nvHw4uDPqGIM=
timing-allow-origin
*
last-modified
Fri, 03 Sep 2021 19:44:53 GMT
server
cloudflare
etag
W/"262edf6402d173215ad086fd56b83c6a"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
access-control-allow-methods
GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD
x-amz-version-id
ix.FHnPBRxwsiIHn.9ar513BayFgawqc
access-control-allow-origin
https://jobs.cybereason.com
access-control-expose-headers
x-last-modified-timestamp, X-HubSpot-NotFound, X-HS-User-Request, Link, Server-Timing
cache-control
max-age=300, public
access-control-allow-credentials
true
cf-ray
69a49d81dcd24eb0-FRA
access-control-allow-headers
Origin, X-Requested-With, Content-Type, Accept, Accept-Charset, Accept-Encoding, X-Override-Internal-Permissions, X-Properties-Source, X-Properties-SourceId, X-Properties-Flag, X-Hubspot-User-Id, X-Hubspot-Trace, X-Hubspot-Callee, X-Hubspot-Offset, X-Hubspot-No-Trace, X-HubSpot-Static-App-Info, X-HubSpot-Messages-Uri, X-HubSpot-Request-Source, X-HubSpot-Request-Reason, Subscription-Billing-Auth-Token, X-App-CSRF, X-Tools-CSRF, Online-Payment-Signing-UUID, X-Source, X-SourceId, X-Origin-UserId, X-Biden-Request-Source, X-HubSpot-CSRF-hubspotapi, X-Force-Cookie-Refresh, X-Force-Cookie-Refresh-No-Cache, X-HS-User-Request, X-Application-Id, X-HS-Referer, X-HubSpot-Correlation-Id
expires
Thu, 07 Oct 2021 05:13:43 GMT
3354902.js
js.hs-analytics.net/analytics/1633583100000/ 		63 KB
20 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://js.hs-analytics.net/analytics/1633583100000/3354902.js
Requested by
Host: www.cybereason.com
URL: https://www.cybereason.com/hs/scriptloader/3354902.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.17.70.176 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
42d9f880279b211f36a978ee81979fa382507c6428865a3e863cb91366284003

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms?blaid=2123744
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Thu, 07 Oct 2021 05:09:04 GMT
content-encoding
br
cf-cache-status
HIT
age
21
x-amz-server-side-encryption
AES256
x-amz-request-id
9A715AQBCDX9KACH
x-amz-id-2
2VpRdRvy+0UzSZy/To1lW21hEXh/kbbxb249hSPub7tHOmZ346f9Gs7rDCB8rXdvjiOxFE5oALg=
last-modified
Wed, 01 Sep 2021 14:09:56 GMT
server
cloudflare
etag
W/"4d19489cdf419e3b44657d58f5ba356a"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
text/javascript
cache-control
max-age=300, public
access-control-allow-credentials
false
x-amz-version-id
null
cf-ray
69a49d81f924dfd3-FRA
expires
Thu, 07 Oct 2021 05:13:43 GMT
all.js
connect.facebook.net/en_GB/ 		263 KB
74 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://connect.facebook.net/en_GB/all.js?hash=93c4a24c88b4be692907d21de7501dca
Requested by
Host: connect.facebook.net
URL: https://connect.facebook.net/en_GB/all.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
31.13.92.14 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
xx-fbcdn-shv-01-frt3.fbcdn.net
Software
/
Resource Hash
5d7981c67ed27bc03b22521bd82582f3933875ac9818754fc8bd0507b4e56da2
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

Referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms?blaid=2123744
Origin
https://www.cybereason.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; preload; includeSubDomains
content-encoding
gzip
x-content-type-options
nosniff
content-md5
kUUUPYNDsRzKPPc++orbIw==
cross-origin-resource-policy
cross-origin
expires
Fri, 07 Oct 2022 05:06:38 GMT
alt-svc
h3=":443"; ma=3600,h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length
75948
x-fb-rlafr
0
x-fb-debug
N0/8FWlUCRktAu5k1KSZ+HpSmzCMVOrIfxGWfUhIqRKG90/7cdxgKKPvkk+hw0m1MS9L/dSFAilbCYCD+XZJLw==
cross-origin-embedder-policy-report-only
require-corp;report-to="coep_report"
x-fb-content-md5
9e4d19c6fce1c5ccc86d35d0abf1b7fb
cross-origin-opener-policy
same-origin-allow-popups
date
Thu, 07 Oct 2021 05:09:04 GMT
x-frame-options
DENY
report-to
{"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/?minimize=0"}],"group":"coep_report"}
content-type
application/x-javascript; charset=utf-8
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public,max-age=31536000,stale-while-revalidate=3600,immutable
etag
"ad7665de9fa328fe3d89271486e2d67e"
timing-allow-origin
*
priority
u=3,i
access-control-expose-headers
X-FB-Content-MD5
p.gif
p.typekit.net/ 		35 B
214 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://p.typekit.net/p.gif?s=1&k=vyv2ljd&ht=tk&h=www.cybereason.com&f=32224.32226.32227.32228.32230.32231.10875.32265&a=657783&js=1.20.0&app=typekit&e=js&_=1633583345079
Requested by
Host: www.cybereason.com
URL: https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms?blaid=2123744
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.111.215.74 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-111-215-74.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
9b9265c69a5cc295d1ab0d04e0273b3677db1a6216ce2ccf4efc8c277ed84b39

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms?blaid=2123744
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Thu, 07 Oct 2021 05:09:05 GMT
last-modified
Wed, 02 Sep 2020 03:58:21 GMT
server
nginx
etag
"5f4f185d-23"
content-type
image/gif
access-control-allow-origin
*
cache-control
public, max-age=604800
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
content-length
35
widget_iframe.58065ae230495f5d9e4b6a916472b2c1.html
platform.twitter.com/widgets/ Frame A5B2 		319 KB
103 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://platform.twitter.com/widgets/widget_iframe.58065ae230495f5d9e4b6a916472b2c1.html?origin=https%3A%2F%2Fwww.cybereason.com
Requested by
Host: platform.twitter.com
URL: https://platform.twitter.com/widgets.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
93.184.220.66 London, United Kingdom, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECS (frb/67D5) /
Resource Hash
c6d03b7a5561687268e57b13d9d4a6a4c71ee570ea74718040ce9227676e3e5e

Request headers

Host
platform.twitter.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
cross-site
Sec-Fetch-Mode
navigate
Sec-Fetch-Dest
iframe
Referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms?blaid=2123744
Accept-Encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms?blaid=2123744

Response headers

Content-Encoding
gzip
Access-Control-Allow-Methods
GET
Access-Control-Allow-Origin
*
Age
203231
Cache-Control
public, max-age=315360000
Content-Type
text/html; charset=utf-8
Date
Thu, 07 Oct 2021 05:09:05 GMT
Etag
"8321d7cf58d70200c1423dfa0bca40f6+gzip"
Last-Modified
Thu, 30 Sep 2021 18:56:47 GMT
P3P
CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Server
ECS (frb/67D5)
Vary
Accept-Encoding
X-Cache
HIT
x-tw-cdn
VZ
Content-Length
105433
settings
syndication.twitter.com/ Frame A5B2 		232 B
432 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://syndication.twitter.com/settings?session_id=943309e9052755d7806e7000e2244bb7390af8a8
Requested by
Host: platform.twitter.com
URL: https://platform.twitter.com/widgets/widget_iframe.58065ae230495f5d9e4b6a916472b2c1.html?origin=https%3A%2F%2Fwww.cybereason.com
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.244.42.200 , United States, ASN13414 (TWITTER, US),
Reverse DNS
Software
tsa_o /
Resource Hash
726906ee6ce6dfe1b6e35ddad151196c50277e31520de30e916e9cd9affc0ef3
Security Headers
Name Value
Strict-Transport-Security max-age=631138519

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://platform.twitter.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Thu, 07 Oct 2021 05:09:04 GMT
content-encoding
gzip
last-modified
Thu, 07 Oct 2021 05:09:05 GMT
server
tsa_o
vary
Origin
strict-transport-security
max-age=631138519
content-type
application/json; charset=utf-8
access-control-allow-origin
https://platform.twitter.com
cache-control
must-revalidate, max-age=600
access-control-allow-credentials
true
x-connection-hash
47650352bfd4d5dfcd120d43e47c226ff8049cc63093b80772556f6da97036d4
content-length
166
analytics.js
www.google-analytics.com/ 		48 KB
20 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/analytics.js
Requested by
Host: www.cybereason.com
URL: https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms?blaid=2123744
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.185.174 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s51-in-f14.1e100.net
Software
Golfe2 /
Resource Hash
fd222137f245c06ddb4c4d44db41f12138dad6cf8ef5d4d4a5e500f38f0c8c62
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms?blaid=2123744
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Wed, 11 Aug 2021 00:32:57 GMT
server
Golfe2
age
1328
date
Thu, 07 Oct 2021 04:46:57 GMT
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=7200
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
19747
expires
Thu, 07 Oct 2021 06:46:57 GMT
gtm.js
www.googletagmanager.com/ 		328 KB
75 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtm.js?id=GTM-TJVVB7C
Requested by
Host: www.cybereason.com
URL: https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms?blaid=2123744
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.184.232 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s12-in-f8.1e100.net
Software
Google Tag Manager /
Resource Hash
2b371f984ea3f8b08479ddb334c6ec6447a31249073a16b4208d06b884cf0ddc
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms?blaid=2123744
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Thu, 07 Oct 2021 05:09:05 GMT
content-encoding
br
vary
Accept-Encoding
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
76265
x-xss-protection
0
last-modified
Thu, 07 Oct 2021 03:00:00 GMT
server
Google Tag Manager
strict-transport-security
max-age=31536000; includeSubDomains
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Thu, 07 Oct 2021 05:09:05 GMT
__ptq.gif
track.hubspot.com/ 		45 B
488 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://track.hubspot.com/__ptq.gif?k=1&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=en-us&bfp=3169173831&v=1.1&a=3354902&pi=56540216169&ct=blog-post&ccu=https%3A%2F%2Fwww.cybereason.com%2Fblog%2Foperation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms&cpi=56540216169&cgi=5272851739&lpi=56540216169&lvi=56540216169&lvc=en&pu=https%3A%2F%2Fwww.cybereason.com%2Fblog%2Foperation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms%3Fblaid%3D2123744&t=Operation+GhostShell%3A+Novel+RAT+Targets+Global+Aerospace+and+Telecoms+Firms&cts=1633583345352&vi=57fe850b69eb716b128fe6d57754eece&nc=true&u=85683782.57fe850b69eb716b128fe6d57754eece.1633583345345.1633583345345.1633583345345.1&b=85683782.1.1633583345345&pt=0&cc=15
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.19.154.83 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms?blaid=2123744
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Thu, 07 Oct 2021 05:09:05 GMT
vary
Accept-Encoding
cf-cache-status
DYNAMIC
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-hubspot-correlation-id
a823d27f-c9c8-4596-b464-e17b58ffc0cd
cf-ray
69a49d8489b3d6f5-FRA
p3p
CP="NOI CUR ADM OUR NOR STA NID"
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length
45
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=31536000; includeSubDomains; preload
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=sT2DMkfInlap97Jdhgi6x0%2F9beC1BrRTH5WQDJN7V7fMZdHXAWV6z1Hzv5H4iMeKu433mzvzR2W1KBR2%2FEz5Fey6HOUxPizqSapZ4f5RT%2F1VbOWhQNd77GhDh4mNztK%2F4ceR"}],"group":"cf-nel","max_age":604800}
content-type
image/gif
cache-control
no-cache, no-store, no-transform
access-control-allow-credentials
false
x-robots-tag
none
json
forms.hubspot.com/lead-flows-config/v1/config/ 		167 B
1 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://forms.hubspot.com/lead-flows-config/v1/config/json?portalId=3354902&utk=57fe850b69eb716b128fe6d57754eece&__hstc=85683782.57fe850b69eb716b128fe6d57754eece.1633583345345.1633583345345.1633583345345.1&__hssc=85683782.1.1633583345345&contentId=56540216169&currentUrl=https%3A%2F%2Fwww.cybereason.com%2Fblog%2Foperation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms%3Fblaid%3D2123744
Requested by
Host: js.hsleadflows.net
URL: https://js.hsleadflows.net/leadflows.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.19.155.83 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
803d863cb5984a133a2eda9a6a9b73af5c486f57f1ea53e9e2cb81b50cdf513a
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms?blaid=2123744
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Thu, 07 Oct 2021 05:09:05 GMT
content-encoding
br
vary
Accept-Encoding
cf-cache-status
DYNAMIC
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-hubspot-correlation-id
c46120de-9195-4a79-9a46-c26c88e6e391
access-control-allow-methods
GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD
strict-transport-security
max-age=31536000; includeSubDomains; preload
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
x-robots-tag
none
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
access-control-max-age
180
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=bqTTXjyU0oOD%2BdHMosezgxJKrsskLmZrVesJdXE1pu1PAfsNxqVtjYLV7STgWBEy5AMJvHCTpZ3MxUqr%2BfPSkvQs9i2b5tZmfhgp6BVU0dAjPphrjYaZ7Del2KbDogLACtG1"}],"group":"cf-nel","max_age":604800}
content-type
application/json;charset=utf-8
access-control-allow-origin
https://www.cybereason.com
cache-control
max-age=0, no-cache, no-store
access-control-allow-credentials
false
cf-ray
69a49d853a034aa9-FRA
access-control-allow-headers
Accept, Accept-Charset, Accept-Encoding, Accept-Language, Content-Type, Host, Origin, Referer, User-Agent
collect
www.google-analytics.com/j/ 		4 B
24 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/j/collect?v=1&_v=j93&a=965426915&t=pageview&_s=1&dl=https%3A%2F%2Fwww.cybereason.com%2Fblog%2Foperation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms%3Fblaid%3D2123744&ul=en-us&de=UTF-8&dt=Operation%20GhostShell%3A%20Novel%20RAT%20Targets%20Global%20Aerospace%20and%20Telecoms%20Firms&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=IEBAAEABAAAAAC~&jid=1778494072&gjid=1616991847&cid=770505642.1633583345&tid=UA-56367941-1&_gid=1703564295.1633583345&_r=1&_slc=1&z=407241553
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.185.174 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s51-in-f14.1e100.net
Software
Golfe2 /
Resource Hash
aec60bc104db041b1512185839f18f52986df7e569e5445f740dd60f763fbca8
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms?blaid=2123744
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Thu, 07 Oct 2021 05:09:05 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://www.cybereason.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
4
expires
Fri, 01 Jan 1990 00:00:00 GMT
collect
stats.g.doubleclick.net/j/ 		2 B
463 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j93&tid=UA-56367941-1&cid=770505642.1633583345&jid=1778494072&gjid=1616991847&_gid=1703564295.1633583345&_u=IEBAAEAAAAAAAC~&z=367521599
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
74.125.140.157 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
wq-in-f157.1e100.net
Software
Golfe2 /
Resource Hash
6068f86ff5e6d3a3e100e95fd0ab03a5fb9ebfca9386b2c0ee131361a62526c2
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms?blaid=2123744
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
strict-transport-security
max-age=10886400; includeSubDomains; preload
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
date
Thu, 07 Oct 2021 05:09:05 GMT
content-type
text/plain
access-control-allow-origin
https://www.cybereason.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
2
expires
Fri, 01 Jan 1990 00:00:00 GMT
js
www.googletagmanager.com/gtag/ 		162 KB
60 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtag/js?id=G-SSF38JVRVJ&l=dataLayer&cx=c
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TJVVB7C
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.184.232 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s12-in-f8.1e100.net
Software
Google Tag Manager /
Resource Hash
067bdbb396e338c6d6ae1154aa9f609a282f225c8cc5c1156048d174a913b661
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms?blaid=2123744
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Thu, 07 Oct 2021 05:09:05 GMT
content-encoding
br
server
Google Tag Manager
access-control-allow-headers
Cache-Control
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
strict-transport-security
max-age=31536000; includeSubDomains
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
61433
x-xss-protection
0
expires
Thu, 07 Oct 2021 05:09:05 GMT
conversion_async.js
www.googleadservices.com/pagead/ 		37 KB
15 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googleadservices.com/pagead/conversion_async.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TJVVB7C
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.23.98 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
mil04s23-in-f98.1e100.net
Software
cafe /
Resource Hash
03b8f9e258f69727a11fc81ce93fbc8d0d5ca96489a1e84463af819efedf0782
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms?blaid=2123744
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Thu, 07 Oct 2021 05:09:05 GMT
content-encoding
gzip
x-content-type-options
nosniff
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
14399
x-xss-protection
0
server
cafe
etag
3154747477907843336
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=3600
timing-allow-origin
*
expires
Thu, 07 Oct 2021 05:09:05 GMT
insight.min.js
snap.licdn.com/li.lms-analytics/ 		5 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://snap.licdn.com/li.lms-analytics/insight.min.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TJVVB7C
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2.16.186.19 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a2-16-186-19.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
fed785a6a8ca96fb67230fec5d85f9c508db49f4075aa0ef284af56cd89813e3

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms?blaid=2123744
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date
Thu, 07 Oct 2021 05:09:05 GMT
Content-Encoding
gzip
Last-Modified
Wed, 29 Sep 2021 19:17:49 GMT
X-CDN
AKAM
Vary
Accept-Encoding
Content-Type
application/x-javascript;charset=utf-8
Cache-Control
max-age=30382
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
2036
uwt.js
static.ads-twitter.com/ 		14 KB
6 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://static.ads-twitter.com/uwt.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TJVVB7C
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
199.232.136.157 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
4da3e3aa30b5b06390d7e7e3fcfb16d648909eb429d161c2748bd6d79a7ec5fb

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms?blaid=2123744
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Thu, 07 Oct 2021 05:09:05 GMT
content-encoding
gzip
last-modified
Mon, 20 Sep 2021 23:58:10 GMT
etag
"8dc11b7ca1d5ed9ec3b1ab1beb621c75+gzip+gzip"
vary
Accept-Encoding,Host
x-tw-cdn
FT
p3p
CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
x-tw-geo-cc_and_ra
DE-HE
cache-control
no-cache
x-cache
HIT, HIT
accept-ranges
bytes
content-type
application/javascript; charset=utf-8
content-length
5410
x-served-by
cache-iad-kiad7000043-IAD, cache-hhn11555-HHN
bat.js
bat.bing.com/ 		34 KB
10 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://bat.bing.com/bat.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TJVVB7C
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
13.107.21.200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
d891455e32c9a425e36e190047b1f58abeb7e3709eff687134ddea7ac9cfdd3b

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms?blaid=2123744
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Thu, 07 Oct 2021 05:09:04 GMT
content-encoding
gzip
last-modified
Wed, 06 Oct 2021 19:11:47 GMT
x-msedge-ref
Ref A: 47FF90C2FF804EFA88A0C63C300F8198 Ref B: PRG01EDGE0718 Ref C: 2021-10-07T05:09:05Z
etag
"805b72e6bad71:0"
vary
Accept-Encoding
x-cache
CONFIG_NOCACHE
content-type
application/javascript
access-control-allow-origin
*
cache-control
private,max-age=1800
accept-ranges
bytes
content-length
10001
activityi;dc_pre=CK2ip5jEt_MCFaJEHQkdMosGug;src=10272547;type=landing;cat=allsite;ord=6730628086635;gtm=2wga40;auiddc=1638032237.1633583346;ps=1;~oref=https%3A%2F%2Fwww.cybereason.com%2Fblog%2Foper...
10272547.fls.doubleclick.net/ Frame 0227
Redirect Chain
  • https://10272547.fls.doubleclick.net/activityi;src=10272547;type=landing;cat=allsite;ord=6730628086635;gtm=2wga40;auiddc=1638032237.1633583346;ps=1;~oref=https%3A%2F%2Fwww.cybereason.com%2Fblog%2Fo...
  • https://10272547.fls.doubleclick.net/activityi;dc_pre=CK2ip5jEt_MCFaJEHQkdMosGug;src=10272547;type=landing;cat=allsite;ord=6730628086635;gtm=2wga40;auiddc=1638032237.1633583346;ps=1;~oref=https%3A%...
501 B
427 B 		Document
General
Check archive.org
Download Go to
Full URL
https://10272547.fls.doubleclick.net/activityi;dc_pre=CK2ip5jEt_MCFaJEHQkdMosGug;src=10272547;type=landing;cat=allsite;ord=6730628086635;gtm=2wga40;auiddc=1638032237.1633583346;ps=1;~oref=https%3A%2F%2Fwww.cybereason.com%2Fblog%2Foperation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms%3Fblaid%3D2123744?
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TJVVB7C
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.185.230 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s53-in-f6.1e100.net
Software
cafe /
Resource Hash
5f20636fb964286edb8aa1c68e72619291ceebbcf8de6ceca71e0bf7ee915203
Security Headers
Name Value
Strict-Transport-Security max-age=21600
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
10272547.fls.doubleclick.net
:scheme
https
:path
/activityi;dc_pre=CK2ip5jEt_MCFaJEHQkdMosGug;src=10272547;type=landing;cat=allsite;ord=6730628086635;gtm=2wga40;auiddc=1638032237.1633583346;ps=1;~oref=https%3A%2F%2Fwww.cybereason.com%2Fblog%2Foperation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms%3Fblaid%3D2123744?
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language
de-DE,de;q=0.9
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms?blaid=2123744
accept-encoding
gzip, deflate, br
cookie
test_cookie=CheckForPermission
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
about:blank

Response headers

p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin
*
cross-origin-resource-policy
cross-origin
date
Thu, 07 Oct 2021 05:09:05 GMT
expires
Thu, 07 Oct 2021 05:09:05 GMT
cache-control
private, max-age=0
strict-transport-security
max-age=21600
content-type
text/html; charset=UTF-8
x-content-type-options
nosniff
content-encoding
gzip
server
cafe
content-length
402
x-xss-protection
0
set-cookie
IDE=AHWqTUn0YZsgmCM0P3dpYZAFphLLaltuqGYQ8ixua7_sUhzhgrXswlqCeCh0XoSC--M; expires=Sat, 07-Oct-2023 05:09:05 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none test_cookie=; expires=Fri, 01-Aug-2008 22:45:55 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

Redirect headers

p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin
*
cross-origin-resource-policy
cross-origin
date
Thu, 07 Oct 2021 05:09:05 GMT
pragma
no-cache
expires
Fri, 01 Jan 1990 00:00:00 GMT
cache-control
no-cache, must-revalidate
follow-only-when-prerender-shown
1
strict-transport-security
max-age=21600
location
https://10272547.fls.doubleclick.net/activityi;dc_pre=CK2ip5jEt_MCFaJEHQkdMosGug;src=10272547;type=landing;cat=allsite;ord=6730628086635;gtm=2wga40;auiddc=1638032237.1633583346;ps=1;~oref=https%3A%2F%2Fwww.cybereason.com%2Fblog%2Foperation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms%3Fblaid%3D2123744?
content-type
text/html; charset=UTF-8
x-content-type-options
nosniff
server
cafe
content-length
0
x-xss-protection
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
hotjar-704918.js
static.hotjar.com/c/ 		4 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://static.hotjar.com/c/hotjar-704918.js?sv=7
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TJVVB7C
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.97.53 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
/
Resource Hash
3422589f0cabdab96a1787e2517942f65707470ac02f966548828f80139a550a
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms?blaid=2123744
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Thu, 07 Oct 2021 05:08:45 GMT
content-encoding
br
x-content-type-options
nosniff
cache-control
max-age=60
age
20
etag
W/28e6215005cbd9f3a9170263142a0380
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
x-cache-hit
1
x-amz-cf-pop
FRA56-P2
x-amz-cf-id
ZnjWBLP4-hBBO4CvJAgQpm4IwnyTH4BD2i_PD1uK9Fz6S4gtFXxNKw==
via
1.1 c2e56cd54e2593df95ccca8a6d98c958.cloudfront.net (CloudFront)
pixel.js
www.redditstatic.com/ads/ 		22 KB
7 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.redditstatic.com/ads/pixel.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TJVVB7C
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.65.140 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
snooserv /
Resource Hash
7125a66456daa35dd3e3e8cca4b9523e05caf0b4fa5bd5874676e7c6db40f3aa

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms?blaid=2123744
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Thu, 07 Oct 2021 05:09:05 GMT
via
1.1 varnish, 1.1 varnish
last-modified
Wed, 14 Jul 2021 17:50:00 GMT
server
snooserv
etag
"912f60c72fda50b2f21068c65115175d"
vary
Accept-Encoding,Origin
content-type
application/javascript
cache-control
public, max-age=60
accept-ranges
bytes
content-encoding
gzip
content-length
7018
activityi;dc_pre=CNu9p5jEt_MCFZpEHQkdQOQCEQ;src=10428681;type=cyber0;cat=cyber0;ord=9150648955961;gtm=2wga40;auiddc=1638032237.1633583346;ps=1;~oref=https%3A%2F%2Fwww.cybereason.com%2Fblog%2Foperat...
10428681.fls.doubleclick.net/ Frame 9934
Redirect Chain
  • https://10428681.fls.doubleclick.net/activityi;src=10428681;type=cyber0;cat=cyber0;ord=9150648955961;gtm=2wga40;auiddc=1638032237.1633583346;ps=1;~oref=https%3A%2F%2Fwww.cybereason.com%2Fblog%2Fope...
  • https://10428681.fls.doubleclick.net/activityi;dc_pre=CNu9p5jEt_MCFZpEHQkdQOQCEQ;src=10428681;type=cyber0;cat=cyber0;ord=9150648955961;gtm=2wga40;auiddc=1638032237.1633583346;ps=1;~oref=https%3A%2F...
499 B
421 B 		Document
General
Check archive.org
Download Go to
Full URL
https://10428681.fls.doubleclick.net/activityi;dc_pre=CNu9p5jEt_MCFZpEHQkdQOQCEQ;src=10428681;type=cyber0;cat=cyber0;ord=9150648955961;gtm=2wga40;auiddc=1638032237.1633583346;ps=1;~oref=https%3A%2F%2Fwww.cybereason.com%2Fblog%2Foperation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms%3Fblaid%3D2123744?
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TJVVB7C
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.185.230 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s53-in-f6.1e100.net
Software
cafe /
Resource Hash
106c245c18fe02ebd1b9a26411dda09a9ecc5196ae9db48a322e765fe042b0fb
Security Headers
Name Value
Strict-Transport-Security max-age=21600
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
10428681.fls.doubleclick.net
:scheme
https
:path
/activityi;dc_pre=CNu9p5jEt_MCFZpEHQkdQOQCEQ;src=10428681;type=cyber0;cat=cyber0;ord=9150648955961;gtm=2wga40;auiddc=1638032237.1633583346;ps=1;~oref=https%3A%2F%2Fwww.cybereason.com%2Fblog%2Foperation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms%3Fblaid%3D2123744?
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language
de-DE,de;q=0.9
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms?blaid=2123744
accept-encoding
gzip, deflate, br
cookie
test_cookie=CheckForPermission
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
about:blank

Response headers

p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin
*
cross-origin-resource-policy
cross-origin
date
Thu, 07 Oct 2021 05:09:05 GMT
expires
Thu, 07 Oct 2021 05:09:05 GMT
cache-control
private, max-age=0
strict-transport-security
max-age=21600
content-type
text/html; charset=UTF-8
x-content-type-options
nosniff
content-encoding
gzip
server
cafe
content-length
396
x-xss-protection
0
set-cookie
IDE=AHWqTUnkHBJPvLV6__RViFJLuWrj1uqhKdvk--CP19eXfR_MAh5sa9PFJefCyUILMFY; expires=Sat, 07-Oct-2023 05:09:05 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none test_cookie=; expires=Fri, 01-Aug-2008 22:45:55 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

Redirect headers

p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin
*
cross-origin-resource-policy
cross-origin
date
Thu, 07 Oct 2021 05:09:05 GMT
pragma
no-cache
expires
Fri, 01 Jan 1990 00:00:00 GMT
cache-control
no-cache, must-revalidate
follow-only-when-prerender-shown
1
strict-transport-security
max-age=21600
location
https://10428681.fls.doubleclick.net/activityi;dc_pre=CNu9p5jEt_MCFZpEHQkdQOQCEQ;src=10428681;type=cyber0;cat=cyber0;ord=9150648955961;gtm=2wga40;auiddc=1638032237.1633583346;ps=1;~oref=https%3A%2F%2Fwww.cybereason.com%2Fblog%2Foperation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms%3Fblaid%3D2123744?
content-type
text/html; charset=UTF-8
x-content-type-options
nosniff
server
cafe
content-length
0
x-xss-protection
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
fbevents.js
connect.facebook.net/en_US/ 		98 KB
25 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://connect.facebook.net/en_US/fbevents.js
Requested by
Host: www.cybereason.com
URL: https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms?blaid=2123744
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
31.13.92.14 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
xx-fbcdn-shv-01-frt3.fbcdn.net
Software
/
Resource Hash
2bc2179dbcac09de834853fc91b815d3bea8112276b7b789f610078d399bcb47
Security Headers
Name Value
Content-Security-Policy default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms?blaid=2123744
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

content-security-policy
default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=3600,h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length
25967
x-xss-protection
0
pragma
public
x-fb-debug
L3v8C5C1tpRkH16yB04LER7fIDVX0nvNEQgFRz45BY/822Mv1HSQ20Bs2TCHYlC70eemqm4wSr/VQyPDQlMjzw==
x-frame-options
DENY
date
Thu, 07 Oct 2021 05:09:05 GMT
strict-transport-security
max-age=31536000; preload; includeSubDomains
content-type
application/x-javascript; charset=utf-8
vary
Accept-Encoding
cache-control
public, max-age=1200
x-fb-rlafr
0
priority
u=3,i
expires
Sat, 01 Jan 2000 00:00:00 GMT
1cwYCUDAYD26hHzYzki9
ws.zoominfo.com/pixel/ 		0
689 B 		Script
General
Check archive.org
Download Go to
Full URL
https://ws.zoominfo.com/pixel/1cwYCUDAYD26hHzYzki9
Requested by
Host: www.cybereason.com
URL: https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms?blaid=2123744
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.16.168.82 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / Express
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms?blaid=2123744
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Thu, 07 Oct 2021 05:09:07 GMT
via
1.1 google
x-content-type-options
nosniff
cf-cache-status
DYNAMIC
server
cloudflare
x-powered-by
Express
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
text/javascript
access-control-allow-origin
*
access-control-allow-credentials
true
cf-ray
69a49d872cf55b5c-FRA
access-control-allow-headers
Content-Type,cf-ipcountry,service-version,x-appengine-user-ip,x-forwarded-for
content-length
0
3354902.js
js.hs-scripts.com/ 		1 KB
892 B 		Script
General
Check archive.org
Download Go to
Full URL
https://js.hs-scripts.com/3354902.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TJVVB7C
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.17.210.204 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
dcf9e1d0e7154542773c2fa4d03411173ccbbae60e640cdfb96dda80aff0d78a

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms?blaid=2123744
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Thu, 07 Oct 2021 05:09:05 GMT
content-encoding
br
vary
Accept-Encoding
cf-cache-status
HIT
age
23
cf-polished
origSize=1513
x-hubspot-correlation-id
242aba8b-72d8-419c-a963-3ca8d162ceb6
cf-bgj
minify
server
cloudflare
x-trace
2B80F8047EC4356E4948C69D762E2C88D9A1FFCCB1000000000000000000
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
access-control-max-age
3600
content-type
application/javascript;charset=utf-8
cache-control
public, max-age=60
access-control-allow-credentials
true
cf-ray
69a49d872c286919-FRA
expires
Thu, 07 Oct 2021 05:10:05 GMT
tracking.js
trk.techtarget.com/ 		2 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://trk.techtarget.com/tracking.js
Requested by
Host: www.cybereason.com
URL: https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms?blaid=2123744
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.1.92 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
ac5000602bb127a5a07be117df96c48667d2e2a9fb1bb33d5ebb7c50e4480a88

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms?blaid=2123744
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Thu, 07 Oct 2021 05:09:05 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Thu, 30 Sep 2021 16:16:59 GMT
server
cloudflare
age
140
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
text/javascript
expires
Thu, 07 Oct 2021 05:16:45 GMT
cache-control
max-age=1200
cf-ray
69a49d872fa942ee-FRA
cf-bgj
minify
ping.min.js
cdn.pdst.fm/ 		26 KB
6 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.pdst.fm/ping.min.js
Requested by
Host: www.cybereason.com
URL: https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms?blaid=2123744
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.244.142.80 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
80.142.244.35.bc.googleusercontent.com
Software
UploadServer /
Resource Hash
cb8d40d1eb7e2dc885affcf0012d9e1a73c270d843e8b890d36538e52d0a0342

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms?blaid=2123744
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Thu, 07 Oct 2021 04:47:31 GMT
content-encoding
gzip
age
1294
x-guploader-uploadid
ADPycdueZlr4RrVNbbOz7PlJ19E78WL_i6QX8EYG0coITiAkE34NDUlVdYefLhlrzaCcFWy6-AZjsx5U53YWH2V1Rl0
x-goog-storage-class
MULTI_REGIONAL
x-goog-metageneration
3
x-goog-stored-content-encoding
gzip
alt-svc
clear
content-length
5774
last-modified
Fri, 28 May 2021 20:34:03 GMT
server
UploadServer
etag
"d001d1c9f5a942fa5524eeacb047e819"
vary
Accept-Encoding
x-goog-hash
crc32c=oKoi/w==, md5=0AHRyfWpQvpVJO6ssEfoGQ==
x-goog-generation
1622234043862937
access-control-allow-origin
*
access-control-expose-headers
Content-Type
cache-control
public, max-age=3600
x-goog-stored-content-length
5774
accept-ranges
bytes
content-type
application/javascript;
expires
Thu, 07 Oct 2021 05:47:31 GMT
up.js
up.pixel.ad/assets/ 		2 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://up.pixel.ad/assets/up.js?um=1
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TJVVB7C
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
178.79.242.16 , United States, ASN22822 (LLNW, US),
Reverse DNS
https-178-79-242-16.fra.llnw.net
Software
AC1.1 /
Resource Hash
5bdf1120c4df8c868092d0bcb7f2540a85456fd94cd1e1a5570c9b63906b1a5b

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms?blaid=2123744
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Thu, 07 Oct 2021 05:09:05 GMT
content-encoding
gzip
last-modified
Mon, 24 Aug 2020 15:06:26 GMT
server
AC1.1
age
2415
vary
Accept-Encoding
content-type
application/javascript
accept-ranges
bytes
content-length
1041
x-llid
4ae09e9446b8bd57773a36e2add9fe09
js
pixel.mathtag.com/event/ 		1 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pixel.mathtag.com/event/js?mt_id=1506452&mt_adid=241675&mt_exem=&mt_excl=&v1=&v2=&v3=&s1=&s2=&s3=
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TJVVB7C
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.233.201 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a2-18-233-201.deploy.static.akamaitechnologies.com
Software
MT3 3984 0e3af3b master cdg-pixel-x14 config:1.0.0 /
Resource Hash
0857223030ff4c0a4ff84c1598ab2bf2b4f58eb7b9b278cddf05798dfde898e8

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms?blaid=2123744
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date
Thu, 07 Oct 2021 05:09:05 GMT
Server
MT3 3984 0e3af3b master cdg-pixel-x14 config:1.0.0
P3P
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Cache-Control
no-cache
Connection
keep-alive
Content-Type
text/javascript
Content-Length
1411
Expires
Thu, 07 Oct 2021 05:09:04 GMT
zdcd6x8yhg85.js
js.driftt.com/include/1633583400000/ 		0
0
E-v1.js
fast.wistia.com/assets/external/ 		619 KB
118 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://fast.wistia.com/assets/external/E-v1.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TJVVB7C
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.66.110 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
28f00815d1d718764b0e6059d1e5b9f7d64a05c648bd1d182b6d8ecb7d15c225
Security Headers
Name Value
Strict-Transport-Security max-age=0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms?blaid=2123744
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Thu, 07 Oct 2021 05:09:05 GMT
content-encoding
br
vary
Accept-Encoding
age
1672
x-cache
HIT, HIT
content-length
120086
x-served-by
cache-dca17731-DCA, cache-hhn4049-HHN
access-control-allow-origin
*
x-browser-version
93
last-modified
Mon, 04 Oct 2021 17:52:09 GMT
x-timer
S1633583346.815648,VS0,VE0
etag
"615b3f49-1d516"
strict-transport-security
max-age=0
content-type
application/javascript
via
1.1 varnish, 1.1 varnish
cache-control
public, max-age=3600
x-browser
chrome
x-ecma-v
modern
accept-ranges
bytes
timing-allow-origin
*
x-cache-hits
1, 188
lt-v2.min.js
lltrck.com/ 		0
0 		Script
General
Check archive.org
Download Go to
Full URL
https://lltrck.com/lt-v2.min.js
Requested by
Host: www.cybereason.com
URL: https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms?blaid=2123744
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
18.213.169.209 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-18-213-169-209.compute-1.amazonaws.com
Software
/
Resource Hash

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms?blaid=2123744
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers
6e1424cff90e9cd4.min.js
tag.demandbase.com/ 		67 KB
19 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tag.demandbase.com/6e1424cff90e9cd4.min.js
Requested by
Host: www.cybereason.com
URL: https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms?blaid=2123744
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.122.73 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
4139f0b62005cf3f07a86b399774246fd14ff78729116737cf47df1b6b8dd1fc

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms?blaid=2123744
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

x-amz-version-id
J0tQY0rsg4xE57tUfGSGBXYXZV_t3ais
content-encoding
gzip
last-modified
Tue, 10 Aug 2021 07:54:24 GMT
server
AmazonS3
age
1198
etag
W/"a9291860616c83d5d0a3dd7a66e4d368"
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
application/javascript; charset=utf-8
via
1.1 f49c99d2326b14738507e1c2ddcae1dc.cloudfront.net (CloudFront)
cache-control
public, max-age=3600
date
Thu, 07 Oct 2021 05:08:46 GMT
x-amz-cf-pop
FRA60-P2
x-amz-cf-id
5zAlqeiyPx7lFyQn8STY4Ni6WXj7rUCBxhdy9MQTjlhXxy2vOxnBfg==
airpr.js
px.airpr.com/ 		7 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://px.airpr.com/airpr.js
Requested by
Host: www.cybereason.com
URL: https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms?blaid=2123744
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.32.99.30 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-32-99-30.fra60.r.cloudfront.net
Software
nginx /
Resource Hash
529b9c583e6cf8da02c9cadf8c38b5714198f0fde2dcde01da2d5ee681228738

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms?blaid=2123744
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Thu, 07 Oct 2021 02:09:01 GMT
content-encoding
gzip
last-modified
Sat, 21 Apr 2018 18:03:55 GMT
server
nginx
age
10806
etag
"5adb7d0b-853"
x-cache
Hit from cloudfront
content-type
application/javascript; charset=utf-8
via
1.1 74c5b19a4695b76162adbf07ed9ef371.cloudfront.net (CloudFront)
cache-control
max-age=43200
x-amz-cf-pop
FRA60-P3
content-length
2131
x-amz-cf-id
BAkpX6kWS6HOx0ywm4r7S-I6KMdOaJT0CRqpHwEY7QHG7Mek4TVHKw==
expires
Thu, 07 Oct 2021 14:24:04 GMT
activityi;register_conversion=1;src=10272547;type=landing;cat=allsite;ord=6730628086635;gtm=2wga40;auiddc=1638032237.1633583346;ps=1;~oref=https%3A%2F%2Fwww.cybereason.com%2Fblog%2Foperation-ghosts...
10272547.fls.doubleclick.net/ 		0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://10272547.fls.doubleclick.net/activityi;register_conversion=1;src=10272547;type=landing;cat=allsite;ord=6730628086635;gtm=2wga40;auiddc=1638032237.1633583346;ps=1;~oref=https%3A%2F%2Fwww.cybereason.com%2Fblog%2Foperation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms%3Fblaid%3D2123744?
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.185.230 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s53-in-f6.1e100.net
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms?blaid=2123744
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers
activityi;register_conversion=1;src=10428681;type=cyber0;cat=cyber0;ord=9150648955961;gtm=2wga40;auiddc=1638032237.1633583346;ps=1;~oref=https%3A%2F%2Fwww.cybereason.com%2Fblog%2Foperation-ghostshe...
10428681.fls.doubleclick.net/ 		0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://10428681.fls.doubleclick.net/activityi;register_conversion=1;src=10428681;type=cyber0;cat=cyber0;ord=9150648955961;gtm=2wga40;auiddc=1638032237.1633583346;ps=1;~oref=https%3A%2F%2Fwww.cybereason.com%2Fblog%2Foperation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms%3Fblaid%3D2123744?
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.185.230 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s53-in-f6.1e100.net
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms?blaid=2123744
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers
/
attr.ml-api.io/
Redirect Chain
  • https://s.ml-attr.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dcybereason.com%26pId%3d%24UID
  • https://secure.adnxs.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dcybereason.com%26pId%3d%24UID
  • https://secure.adnxs.com/bounce?%2Fgetuid%3Fhttps%253a%252f%252fattr.ml-api.io%252f%253fdomain%253dcybereason.com%2526pId%253d%2524UID
  • https://attr.ml-api.io/?domain=cybereason.com&pId=2003287067430329871
0
242 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://attr.ml-api.io/?domain=cybereason.com&pId=2003287067430329871
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.32.99.42 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-32-99-42.fra60.r.cloudfront.net
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms?blaid=2123744
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Thu, 07 Oct 2021 05:09:06 GMT
via
1.1 7251dede1ac94066b27bcd33919b30c6.cloudfront.net (CloudFront)
apigw-requestid
G0kV9jiyIAMESlw=
x-amz-cf-pop
FRA60-P3
x-cache
Miss from cloudfront
content-type
application/json
content-length
0
x-amz-cf-id
Q7editN9k58q9kA_ZDMKszn7XtqAsN4zBm_ozqRet_bLUBkUEvJ4mg==

Redirect headers

Pragma
no-cache
Date
Thu, 07 Oct 2021 05:09:06 GMT
X-Proxy-Origin
216.131.114.25; 216.131.114.25; 824.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid
2281b8af-2d4e-4645-983b-a6caeec66504
Server
nginx/1.17.9
Access-Control-Allow-Origin
*
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location
https://attr.ml-api.io/?domain=cybereason.com&pId=2003287067430329871
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
116645602292181
connect.facebook.net/signals/config/ 		490 KB
143 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://connect.facebook.net/signals/config/116645602292181?v=2.9.47&r=stable
Requested by
Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
31.13.92.14 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
xx-fbcdn-shv-01-frt3.fbcdn.net
Software
/
Resource Hash
5f9208947e343c28851472d721d14c93a91ee132a1978f1d3e07b692586a3727
Security Headers
Name Value
Content-Security-Policy default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms?blaid=2123744
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

content-security-policy
default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=3600,h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
x-xss-protection
0
pragma
public
x-fb-debug
CA/3hv3djdDrPU3VnDkV8tgXz7RydrJCE2R2tpwDA4HSyrbDpZQDEExGV+kyRJV8WpQIpccsa2o1GaxfBNBRnw==
cross-origin-embedder-policy-report-only
require-corp;report-to="coep_report"
cross-origin-opener-policy
same-origin-allow-popups
x-frame-options
DENY
date
Thu, 07 Oct 2021 05:09:05 GMT
strict-transport-security
max-age=31536000; preload; includeSubDomains
report-to
{"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/?minimize=0"}],"group":"coep_report"}
content-type
application/x-javascript; charset=utf-8
vary
Accept-Encoding
cache-control
public, max-age=1200
x-fb-rlafr
0
priority
u=3,i
expires
Sat, 01 Jan 2000 00:00:00 GMT
collect
analytics.google.com/g/ 		0
370 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://analytics.google.com/g/collect?v=2&tid=G-SSF38JVRVJ&gtm=2oea40&_p=965426915&sr=1600x1200&_gaz=1&ul=en-us&cid=770505642.1633583345&_s=1&dl=https%3A%2F%2Fwww.cybereason.com%2Fblog%2Foperation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms%3Fblaid%3D2123744&dt=Operation%20GhostShell%3A%20Novel%20RAT%20Targets%20Global%20Aerospace%20and%20Telecoms%20Firms&sid=1633583345&sct=1&seg=0&en=page_view&_fv=1&_ss=1
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-SSF38JVRVJ&l=dataLayer&cx=c
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.186.174 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s08-in-f14.1e100.net
Software
Golfe2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms?blaid=2123744
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

pragma
no-cache
date
Thu, 07 Oct 2021 05:09:05 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://www.cybereason.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
collect
stats.g.doubleclick.net/g/ 		0
17 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://stats.g.doubleclick.net/g/collect?v=2&tid=G-SSF38JVRVJ&cid=770505642.1633583345&gtm=2oea40&aip=1
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-SSF38JVRVJ&l=dataLayer&cx=c
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
74.125.140.157 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
wq-in-f157.1e100.net
Software
Golfe2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms?blaid=2123744
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

pragma
no-cache
date
Thu, 07 Oct 2021 05:09:05 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://www.cybereason.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
ga-audiences
www.google.com/ads/ 		42 B
180 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j93&tid=UA-56367941-1&cid=770505642.1633583345&jid=1778494072&_u=IEBAAEAAAAAAAC~&z=8971498
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.186.100 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s06-in-f4.1e100.net
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms?blaid=2123744
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 07 Oct 2021 05:09:05 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
rp.gif
alb.reddit.com/ 		42 B
125 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://alb.reddit.com/rp.gif?ts=1633583345885&id=t2_32cbm2fl&event=PageVisit&m.itemCount=&m.value=&m.currency=&m.transactionId=&m.customEventName=&uuid=d40da328-0087-422d-a60c-72d75ff0a524&aaid=&em=&external_id=&idfa=&integration=reddit&opt_out=0&sh=1600&sw=1200&v=rdt_a797b96e
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.193.140 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
Varnish /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms?blaid=2123744
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Thu, 07 Oct 2021 05:09:06 GMT
via
1.1 varnish
server
Varnish
accept-ranges
bytes
content-length
42
retry-after
0
content-type
image/gif
collect
px.ads.linkedin.com/
Redirect Chain
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=72596&time=1633583345890&url=https%3A%2F%2Fwww.cybereason.com%2Fblog%2Foperation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms%...
  • https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D72596%26time%3D1633583345890%26url%3Dhttps%253A%252F%252Fwww.cybereason.com%252Fb...
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=72596&time=1633583345890&url=https%3A%2F%2Fwww.cybereason.com%2Fblog%2Foperation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms%...
0
59 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=72596&time=1633583345890&url=https%3A%2F%2Fwww.cybereason.com%2Fblog%2Foperation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms%3Fblaid%3D2123744&liSync=true
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
108.174.11.37 , United States, ASN14413 (LINKEDIN, US),
Reverse DNS
108-174-11-37.fwd.linkedin.com
Software
Play /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms?blaid=2123744
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Thu, 07 Oct 2021 05:09:06 GMT
server
Play
linkedin-action
1
x-li-fabric
prod-lor1
x-li-proto
http/2
x-li-pop
prod-esv5
content-type
application/javascript
content-length
0
x-li-uuid
KD5+IWanqxbwZIZJPCsAAA==

Redirect headers

strict-transport-security
max-age=31536000
x-content-type-options
nosniff
linkedin-action
1
x-cache
CONFIG_NOCACHE
content-length
0
x-li-uuid
AAXNvEMYLuMmllKtsEv5RA==
pragma
no-cache
x-li-pop
afd-prod-lor1-x
x-msedge-ref
Ref A: BC9C7A8E843A4CBFAA75147C6E623FC0 Ref B: PRG01EDGE1117 Ref C: 2021-10-07T05:09:06Z
date
Thu, 07 Oct 2021 05:09:06 GMT
expect-ct
max-age=86400, report-uri="https://www.linkedin.com/platform-telemetry/ct"
x-frame-options
sameorigin
x-li-fabric
prod-lor1
location
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=72596&time=1633583345890&url=https%3A%2F%2Fwww.cybereason.com%2Fblog%2Foperation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms%3Fblaid%3D2123744&liSync=true
cache-control
no-cache, no-store
content-security-policy
default-src *; connect-src 'self' https://media-src.linkedin.com/media/ www.linkedin.com s.c.lnkd.licdn.com m.c.lnkd.licdn.com wss://*.linkedin.com dms.licdn.com https://dpm.demdex.net/id lnkd.demdex.net blob: https://accounts.google.com/gsi/status https://linkedin.sc.omtrdc.net/b/ss/ www.google-analytics.com static.licdn.com static-exp1.licdn.com static-exp2.licdn.com static-exp3.licdn.com media.licdn.com media-exp1.licdn.com media-exp2.licdn.com media-exp3.licdn.com; img-src data: blob: *; font-src data: *; style-src 'unsafe-inline' 'self' static-src.linkedin.com *.licdn.com; script-src 'report-sample' 'unsafe-inline' 'unsafe-eval' 'self' spdy.linkedin.com static-src.linkedin.com *.ads.linkedin.com *.licdn.com static.chartbeat.com www.google-analytics.com ssl.google-analytics.com bcvipva02.rightnowtech.com www.bizographics.com sjs.bizographics.com js.bizographics.com d.la4-c1-was.salesforceliveagent.com https://snap.licdn.com/li.lms-analytics/ platform.linkedin.com platform-akam.linkedin.com platform-ecst.linkedin.com platform-azur.linkedin.com; object-src 'none'; media-src blob: *; child-src blob: lnkd-communities: voyager: *; frame-ancestors 'self'; report-uri /security/csp?f=l
x-li-proto
http/2
expires
Thu, 01 Jan 1970 00:00:00 GMT
modules.e95f6e2deb67f1b24d8e.js
script.hotjar.com/ 		221 KB
59 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://script.hotjar.com/modules.e95f6e2deb67f1b24d8e.js
Requested by
Host: static.hotjar.com
URL: https://static.hotjar.com/c/hotjar-704918.js?sv=7
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
52.222.236.74 , United States, ASN (),
Reverse DNS
server-52-222-236-74.fra56.r.cloudfront.net
Software
/
Resource Hash
3e4dcf5d937c6cd9bd580358e83d9bff9769f73cc2364ed9af22c88571959adb
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms?blaid=2123744
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Tue, 28 Sep 2021 08:27:05 GMT
content-encoding
br
x-content-type-options
nosniff
age
765720
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
content-length
59787
access-control-allow-origin
*
last-modified
Tue, 28 Sep 2021 08:26:22 GMT
etag
"4c2c45df8457d0c2a07b3285a23cd7a4"
vary
Accept-Encoding
content-type
application/javascript
via
1.1 ade2b5e2170ccd4f394b741b27bb0eed.cloudfront.net (CloudFront)
cache-control
max-age=31536000
x-amz-cf-pop
FRA56-P4
accept-ranges
bytes
x-robots-tag
none
x-amz-cf-id
LPNUjoW2N81MmLNgeZ5UA2ZIiCv9AEC-Qn-f4_bRy85q3tPKGwGFcg==
activity.gif
apt.techtarget.com/activity/ 		43 B
464 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://apt.techtarget.com/activity/activity.gif?activityTypeId=31&cid=16570449&version=2.1.1&ref=https%3A%2F%2Fwww.cybereason.com%2Fblog%2Foperation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms%3Fblaid%3D2123744&r=1633583345917
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
206.19.49.24 , United States, ASN17225 (ATT-CERFNET-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms?blaid=2123744
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date
Thu, 07 Oct 2021 05:09:06 GMT
Last-Modified
Tue, 26 Mar 2019 18:30:29 GMT
ETag
"2b-5850384023492"
Content-Type
image/gif
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=19
Content-Length
43
/
googleads.g.doubleclick.net/pagead/viewthroughconversion/561371164/ 		2 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/viewthroughconversion/561371164/?random=1633583345920&cv=9&fst=1633583345920&num=1&guid=ON&resp=GooglemKTybQhCsO&eid=376635471&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2wga40&sendb=1&ig=1&frm=0&url=https%3A%2F%2Fwww.cybereason.com%2Fblog%2Foperation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms%3Fblaid%3D2123744&tiba=Operation%20GhostShell%3A%20Novel%20RAT%20Targets%20Global%20Aerospace%20and%20Telecoms%20Firms&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4
Requested by
Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.185.66 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s48-in-f2.1e100.net
Software
cafe /
Resource Hash
a361dc3431c9d2fe94dee0d4a1b67a57be8fc6ba75dabcfe923e615956277fc2
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms?blaid=2123744
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 07 Oct 2021 05:09:06 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
text/javascript; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1087
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
pixel
bid.g.doubleclick.net/xbbe/ Frame 3279 		0
446 B 		Document
General
Check archive.org
Download Go to
Full URL
https://bid.g.doubleclick.net/xbbe/pixel?d=KAE
Requested by
Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
108.177.15.157 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
wr-in-f157.1e100.net
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
bid.g.doubleclick.net
:scheme
https
:path
/xbbe/pixel?d=KAE
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language
de-DE,de;q=0.9
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms?blaid=2123744
accept-encoding
gzip, deflate, br
cookie
IDE=AHWqTUnkHBJPvLV6__RViFJLuWrj1uqhKdvk--CP19eXfR_MAh5sa9PFJefCyUILMFY
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms?blaid=2123744

Response headers

p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin
*
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
x-content-type-options
nosniff
date
Thu, 07 Oct 2021 05:09:06 GMT
server
cafe
content-length
0
x-xss-protection
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
/
googleads.g.doubleclick.net/pagead/viewthroughconversion/934771702/ 		2 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/viewthroughconversion/934771702/?random=1633583345926&cv=9&fst=1633583345926&num=1&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2wga40&sendb=1&ig=1&frm=0&url=https%3A%2F%2Fwww.cybereason.com%2Fblog%2Foperation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms%3Fblaid%3D2123744&tiba=Operation%20GhostShell%3A%20Novel%20RAT%20Targets%20Global%20Aerospace%20and%20Telecoms%20Firms&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4
Requested by
Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.185.66 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s48-in-f2.1e100.net
Software
cafe /
Resource Hash
a8114c77566a7ad15f3e5d9c0812df87648ea047dbd5cd8fc7e81a9901282fdd
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms?blaid=2123744
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 07 Oct 2021 05:09:06 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
text/javascript; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1080
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.googleadservices.com/pagead/conversion/401574070/ 		2 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googleadservices.com/pagead/conversion/401574070/?random=1633583345928&cv=9&fst=1633583345928&num=1&value=0&label=6wPaCOv09oACELaRvr8B&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2wga40&sendb=1&ig=1&frm=0&url=https%3A%2F%2Fwww.cybereason.com%2Fblog%2Foperation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms%3Fblaid%3D2123744&tiba=Operation%20GhostShell%3A%20Novel%20RAT%20Targets%20Global%20Aerospace%20and%20Telecoms%20Firms&auid=1638032237.1633583346&capi=1&hn=www.googleadservices.com&bttype=purchase&async=1&rfmt=3&fmt=4
Requested by
Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.217.23.98 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
mil04s23-in-f98.1e100.net
Software
cafe /
Resource Hash
927a4dfeaf290340058fa5d8750e811f5646bded97e8aa8911023a4d02128a11
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms?blaid=2123744
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 07 Oct 2021 05:09:06 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
text/javascript; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1299
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.com/pagead/privacysandbox/conversion/401574070/ 		0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.com/pagead/privacysandbox/conversion/401574070/?random=1633583345928&cv=9&fst=1633583345928&num=1&fmt=3&value=0&label=6wPaCOv09oACELaRvr8B&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2wga40&sendb=1&ig=1&frm=0&url=https%3A%2F%2Fwww.cybereason.com%2Fblog%2Foperation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms%3Fblaid%3D2123744&tiba=Operation%20GhostShell%3A%20Novel%20RAT%20Targets%20Global%20Aerospace%20and%20Telecoms%20Firms&auid=1638032237.1633583346&capi=1&hn=www.googleadservices.com&bttype=purchase&async=1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.186.100 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s06-in-f4.1e100.net
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms?blaid=2123744
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers
pdst-events-prod-sink
us-central1-adaptive-growth.cloudfunctions.net/ 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://us-central1-adaptive-growth.cloudfunctions.net/pdst-events-prod-sink
Requested by
Host: cdn.pdst.fm
URL: https://cdn.pdst.fm/ping.min.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
216.239.36.54 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Frontend / Express
Resource Hash

Request headers

Accept
application/json
Referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms?blaid=2123744
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type
application/json

Response headers

date
Thu, 07 Oct 2021 05:09:06 GMT
etag
W/"2-nOO9QiTIwXgNtWtBJezz8kv3SLc"
server
Google Frontend
access-control-allow-headers
Content-Type, Accept
x-powered-by
Express
access-control-allow-methods
GET, POST
content-type
text/html
access-control-allow-origin
*
x-cloud-trace-context
667fc10bdccfadf438bd5c12fb0cae1d
function-execution-id
iie5ct8zbt50
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
adsct
analytics.twitter.com/i/ 		31 B
658 B 		Script
General
Check archive.org
Download Go to
Full URL
https://analytics.twitter.com/i/adsct?type=javascript&version=2.0.4&p_id=Twitter&p_user_id=0&txn_id=ny0ol&events=%5B%5B%22pageview%22%2Cnull%5D%5D&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=0&event_id=35e88d53-aace-48c5-80ee-40e31251cea9&tw_document_href=https%3A%2F%2Fwww.cybereason.com%2Fblog%2Foperation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms%3Fblaid%3D2123744&tpx_cb=twttr.conversion.loadPixels
Requested by
Host: static.ads-twitter.com
URL: https://static.ads-twitter.com/uwt.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.244.42.3 , United States, ASN13414 (TWITTER, US),
Reverse DNS
Software
tsa_o /
Resource Hash
df3e003cc30e9bdd0313100e8ee5d468070b4b34d11ad355f276a356d4b9c7bf
Security Headers
Name Value
Strict-Transport-Security max-age=631138519
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms?blaid=2123744
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Thu, 07 Oct 2021 05:09:06 GMT
content-encoding
gzip
x-content-type-options
nosniff
p3p
CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
status
200 OK
x-twitter-response-tags
BouncerCompliant
content-length
57
x-xss-protection
0
pragma
no-cache
last-modified
Thu, 07 Oct 2021 05:09:06 GMT
server
tsa_o
x-frame-options
SAMEORIGIN
strict-transport-security
max-age=631138519
content-type
application/javascript;charset=utf-8
cache-control
no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash
99804cb015fa8002b2e5399d6d81e1afdb1a2e1455291256c331c7efc98a9908
x-transaction
bf3963dc6d54ecc1
expires
Tue, 31 Mar 1981 05:00:00 GMT
adsct
t.co/i/ 		43 B
455 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://t.co/i/adsct?type=javascript&version=2.0.4&p_id=Twitter&p_user_id=0&txn_id=ny0ol&events=%5B%5B%22pageview%22%2Cnull%5D%5D&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=0&event_id=35e88d53-aace-48c5-80ee-40e31251cea9&tw_document_href=https%3A%2F%2Fwww.cybereason.com%2Fblog%2Foperation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms%3Fblaid%3D2123744
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.244.42.133 , United States, ASN13414 (TWITTER, US),
Reverse DNS
Software
tsa_o /
Resource Hash
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
Security Headers
Name Value
Strict-Transport-Security max-age=0
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms?blaid=2123744
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Thu, 07 Oct 2021 05:09:06 GMT
content-encoding
gzip
x-content-type-options
nosniff
status
200 OK
x-twitter-response-tags
BouncerCompliant
content-length
65
x-xss-protection
0
pragma
no-cache
last-modified
Thu, 07 Oct 2021 05:09:06 GMT
server
tsa_o
x-frame-options
SAMEORIGIN
strict-transport-security
max-age=0
content-type
image/gif;charset=utf-8
cache-control
no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash
fa6f48c7c3e085e7763fa350e044abba6e8961fd5fabaab38bf04b22494031d2
x-transaction
fda161f2357de4ca
expires
Tue, 31 Mar 1981 05:00:00 GMT
56273944.js
bat.bing.com/p/action/ 		0
151 B 		Script
General
Check archive.org
Download Go to
Full URL
https://bat.bing.com/p/action/56273944.js
Requested by
Host: bat.bing.com
URL: https://bat.bing.com/bat.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
13.107.21.200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/ ARR/3.0
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms?blaid=2123744
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

access-control-allow-origin
*
date
Thu, 07 Oct 2021 05:09:05 GMT
cache-control
private,max-age=86400
x-msedge-ref
Ref A: 7E7493DE58094C719F7834A4771524D3 Ref B: PRG01EDGE0718 Ref C: 2021-10-07T05:09:05Z
x-powered-by
ARR/3.0
x-cache
CONFIG_NOCACHE
0
bat.bing.com/action/ 		0
151 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://bat.bing.com/action/0?ti=56273944&tm=gtm002&Ver=2&mid=ee307057-6e69-40a5-b06f-6341cd756e6e&sid=b1fd0e20272c11ec9ed65bbbfa317a50&vid=b1fdd690272c11ec90e6bd43590e1127&vids=1&pi=1200101525&lg=en-US&sw=1600&sh=1200&sc=24&tl=Operation%20GhostShell%3A%20Novel%20RAT%20Targets%20Global%20Aerospace%20and%20Telecoms%20Firms&p=https%3A%2F%2Fwww.cybereason.com%2Fblog%2Foperation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms%3Fblaid%3D2123744&r=&lt=1448&evt=pageLoad&msclkid=N&sv=1&rn=815292
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
13.107.21.200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms?blaid=2123744
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

access-control-allow-origin
*
pragma
no-cache
date
Thu, 07 Oct 2021 05:09:05 GMT
cache-control
no-cache, must-revalidate
x-msedge-ref
Ref A: 8E6E8E0F710C4C3498CE5B705CC07636 Ref B: PRG01EDGE0718 Ref C: 2021-10-07T05:09:05Z
x-cache
CONFIG_NOCACHE
expires
Fri, 01 Jan 1990 00:00:00 GMT
box-dfc01efbdc94bb0936d9a35a502b0b64.html
vars.hotjar.com/ Frame E843 		2 KB
1 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://vars.hotjar.com/box-dfc01efbdc94bb0936d9a35a502b0b64.html
Requested by
Host: static.hotjar.com
URL: https://static.hotjar.com/c/hotjar-704918.js?sv=7
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.139.40 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
/
Resource Hash
88ca677c14d4217c2f6b8c8964a1d172027974c4c0839e4d531ad7d3d6de1987

Request headers

:method
GET
:authority
vars.hotjar.com
:scheme
https
:path
/box-dfc01efbdc94bb0936d9a35a502b0b64.html
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language
de-DE,de;q=0.9
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms?blaid=2123744
accept-encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms?blaid=2123744

Response headers

content-type
text/html
content-length
1044
date
Tue, 20 Jul 2021 13:05:05 GMT
accept-ranges
bytes
cache-control
max-age=31536000
content-encoding
br
etag
"10714b84569172431728622d7c8098e4"
last-modified
Tue, 20 Jul 2021 13:04:43 GMT
x-amz-server-side-encryption
AES256
x-robots-tag
none
vary
Accept-Encoding
x-cache
Hit from cloudfront
via
1.1 24fc4e03b1de2a14f79be2422e46a318.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA60-P4
x-amz-cf-id
s0zDA6BfwgusJCQJtdoWnU4m78n4C_9kzIqe9siyCQXhLcc40DbRwA==
age
6797041
/
www.facebook.com/tr/ 		44 B
313 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.facebook.com/tr/?id=116645602292181&ev=PageView&dl=https%3A%2F%2Fwww.cybereason.com%2Fblog%2Foperation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms%3Fblaid%3D2123744&rl=&if=false&ts=1633583346048&sw=1600&sh=1200&v=2.9.47&r=stable&a=tmgoogletagmanager&ec=0&o=30&fbp=fb.1.1633583346042.1361837594&it=1633583345782&coo=false&rqm=GET
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
31.13.92.36 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
edge-star-mini-shv-01-frt3.facebook.com
Software
proxygen-bolt /
Resource Hash
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms?blaid=2123744
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Thu, 07 Oct 2021 05:09:06 GMT
last-modified
Fri, 21 Dec 2012 00:00:01 GMT
server
proxygen-bolt
strict-transport-security
max-age=31536000; includeSubDomains
content-type
image/gif
cache-control
no-cache, must-revalidate, max-age=0
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=3600, h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length
44
expires
Thu, 07 Oct 2021 05:09:06 GMT
collect
www.google-analytics.com/ 		35 B
55 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google-analytics.com/collect?v=1&_v=j93&a=965426915&t=event&ni=1&_s=2&dl=https%3A%2F%2Fwww.cybereason.com%2Fblog%2Foperation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms%3Fblaid%3D2123744&ul=en-us&de=UTF-8&dt=Operation%20GhostShell%3A%20Novel%20RAT%20Targets%20Global%20Aerospace%20and%20Telecoms%20Firms&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=airpr&ea=visitor%20hit&_u=KHBAAEABAAAAAC~&jid=&gjid=&cid=770505642.1633583345&tid=UA-56367941-1&_gid=1703564295.1633583345&cd16=770505642.1633583345&z=830870520
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.185.174 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s51-in-f14.1e100.net
Software
Golfe2 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms?blaid=2123744
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 06 Oct 2021 08:06:37 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
age
75749
content-type
image/gif
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
35
expires
Mon, 01 Jan 1990 00:00:00 GMT
anpx
dpx.airpr.com/
Redirect Chain
  • https://dpx.airpr.com/px?hostname=www.cybereason.com&profile=660386&ga_account_id=UA-56367941-1&ga_account_type=UA&ga_c=770505642.1633583345&an=true
  • https://secure.adnxs.com/getuid?https://dpx.airpr.com/anpx?adnxs_uid=$UID&airpr_id=4104940508
  • https://dpx.airpr.com/anpx?adnxs_uid=2003287067430329871&airpr_id=4104940508
0
63 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dpx.airpr.com/anpx?adnxs_uid=2003287067430329871&airpr_id=4104940508
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
18.196.93.253 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-196-93-253.eu-central-1.compute.amazonaws.com
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms?blaid=2123744
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Thu, 07 Oct 2021 05:09:06 GMT
cache-control
private
server
nginx

Redirect headers

Pragma
no-cache
Date
Thu, 07 Oct 2021 05:09:06 GMT
X-Proxy-Origin
216.131.114.25; 216.131.114.25; 824.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid
5283ada1-12f2-4aa9-9811-eda623c65b90
Server
nginx/1.17.9
Access-Control-Allow-Origin
*
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location
https://dpx.airpr.com/anpx?adnxs_uid=2003287067430329871&airpr_id=4104940508
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
validateCookie
segments.company-target.com/
Redirect Chain
  • https://match.prod.bidr.io/cookie-sync/demandbase
  • https://match.prod.bidr.io/cookie-sync/demandbase?_bee_ppp=1
  • https://segments.company-target.com/log?vendor=choca&user_id=AAEUNE7CvQIAABjqijTDHw
  • https://segments.company-target.com/validateCookie?vendor=choca&user_id=AAEUNE7CvQIAABjqijTDHw&verifyHash=8b448520b9d75f543a3ba3a004592afee9db9f8d
26 B
409 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://segments.company-target.com/validateCookie?vendor=choca&user_id=AAEUNE7CvQIAABjqijTDHw&verifyHash=8b448520b9d75f543a3ba3a004592afee9db9f8d
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
52.222.214.8 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-52-222-214-8.fra56.r.cloudfront.net
Software
/
Resource Hash
3b7b8a4b411ddf8db9bacc2f3aabf406f8e4c0c087829b336ca331c40adfdff1

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms?blaid=2123744
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date
Thu, 07 Oct 2021 05:09:06 GMT
Via
1.1 d79861a030d3421826a919f9c2b00147.cloudfront.net (CloudFront)
X-Amz-Cf-Pop
FRA56-P3
Vary
Origin
X-Cache
Miss from cloudfront
Content-Type
image/gif
Transfer-Encoding
chunked
Connection
keep-alive
trace-id
61590fd257e321ee
X-Amz-Cf-Id
PrGxrH941KxzVDZg-qeZ9MhF4NLFdBmLlEGzdf3Yu74ukaqur4abXA==

Redirect headers

Date
Thu, 07 Oct 2021 05:09:06 GMT
Via
1.1 d79861a030d3421826a919f9c2b00147.cloudfront.net (CloudFront)
X-Amz-Cf-Pop
FRA56-P3
Vary
Origin
X-Cache
Miss from cloudfront
Location
/validateCookie?vendor=choca&user_id=AAEUNE7CvQIAABjqijTDHw&verifyHash=8b448520b9d75f543a3ba3a004592afee9db9f8d
Connection
keep-alive
trace-id
830eb1e1fecd1121
Content-Length
0
X-Amz-Cf-Id
9dJU0cYbK3bPlEaalRHJ6CIfQAFJt97FA0YIc3IoRFNgJnl3-B5mzA==
464526.gif
id.rlcdn.com/ 		0
66 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://id.rlcdn.com/464526.gif
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.244.174.68 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
68.174.244.35.bc.googleusercontent.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms?blaid=2123744
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Thu, 07 Oct 2021 05:09:06 GMT
via
1.1 google
alt-svc
clear
content-length
0
asyncPixelSync
pixel.sitescout.com/dmp/ Frame 39CD
Redirect Chain
  • https://pixel.sitescout.com/dmp/asyncPixelSync
  • https://pixel.sitescout.com/dmp/asyncPixelSync?cookieQ=1
1 KB
2 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://pixel.sitescout.com/dmp/asyncPixelSync?cookieQ=1
Requested by
Host: www.cybereason.com
URL: https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms?blaid=2123744
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server
66.155.71.149 Portsmouth, United Kingdom, ASN13768 (COGECO-PEER1, CA),
Reverse DNS
Software
AC1.1 /
Resource Hash
7209fd168e275adfd11e796e6f7c016890672801090ac0e1b3d9b20634b86bf3

Request headers

:method
GET
:authority
pixel.sitescout.com
:scheme
https
:path
/dmp/asyncPixelSync?cookieQ=1
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language
de-DE,de;q=0.9
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms?blaid=2123744
accept-encoding
gzip, deflate, br
cookie
ssi=ad8eb495-740e-424c-9d04-0a19c5d760ff#1633583346388
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms?blaid=2123744

Response headers

cache-control
max-age=0,no-cache,no-store
pragma
no-cache
expires
Tue, 11 Oct 1977 12:34:56 GMT
p3p
CP="NON DEVa PSAa PSDa OUR NOR NAV",policyref="/w3c/p3p.xml"
set-cookie
ssi=ad8eb495-740e-424c-9d04-0a19c5d760ff#1633583346388; Domain=.sitescout.com; Expires=Fri, 07-Oct-2022 05:09:06 GMT; Path=/; Secure; SameSite=None _ssuma=eyIzNCI6MTYzMzU4MzM0NjQyOSwiMiI6MTYzMzU4MzM0NjQyOSwiNCI6MTYzMzU4MzM0NjQyOSwiMzkiOjE2MzM1ODMzNDY0MjksIjciOjE2MzM1ODMzNDY0Mjl9; Domain=.sitescout.com; Expires=Sat, 06-Nov-2021 05:09:06 GMT; Path=/; Secure; SameSite=None
content-type
text/html;charset=UTF-8
content-length
1139
date
Thu, 07 Oct 2021 05:09:05 GMT
server
AC1.1

Redirect headers

set-cookie
ssi=ad8eb495-740e-424c-9d04-0a19c5d760ff#1633583346388; Domain=.sitescout.com; Expires=Fri, 07-Oct-2022 05:09:06 GMT; Path=/; Secure; SameSite=None
location
https://pixel.sitescout.com/dmp/asyncPixelSync?cookieQ=1
content-length
0
date
Thu, 07 Oct 2021 05:09:06 GMT
server
AC1.1
6f002ab8596ff067
pixel.sitescout.com/up/
Redirect Chain
  • https://pixel.sitescout.com/up/6f002ab8596ff067?cntr_url=https%3A%2F%2Fwww.cybereason.com%2Fblog%2Foperation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms%3Fblaid%3D2123744
  • https://pixel.sitescout.com/up/6f002ab8596ff067?cookieQ=1&cntr_url=https%3A%2F%2Fwww.cybereason.com%2Fblog%2Foperation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms%3Fblaid%3D212...
43 B
417 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pixel.sitescout.com/up/6f002ab8596ff067?cookieQ=1&cntr_url=https%3A%2F%2Fwww.cybereason.com%2Fblog%2Foperation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms%3Fblaid%3D2123744
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server
66.155.71.149 Portsmouth, United Kingdom, ASN13768 (COGECO-PEER1, CA),
Reverse DNS
Software
AC1.1 /
Resource Hash
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms?blaid=2123744
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 07 Oct 2021 05:09:05 GMT
server
AC1.1
p3p
CP="NON DEVa PSAa PSDa OUR NOR NAV",policyref="/w3c/p3p.xml"
cache-control
max-age=0,no-cache,no-store
content-type
image/gif
content-length
43
expires
Tue, 11 Oct 1977 12:34:56 GMT

Redirect headers

location
https://pixel.sitescout.com/up/6f002ab8596ff067?cookieQ=1&cntr_url=https%3A%2F%2Fwww.cybereason.com%2Fblog%2Foperation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms%3Fblaid%3D2123744
date
Thu, 07 Oct 2021 05:09:05 GMT
server
AC1.1
content-length
0
iframe
pixel.mathtag.com/sync/ Frame 8AC5 		631 B
962 B 		Document
General
Check archive.org
Download Go to
Full URL
https://pixel.mathtag.com/sync/iframe?mt_uuid=41be615e-80f1-4b00-800a-e2f6ae71b975&no_iframe=1&mt_adid=241675&source=mathtag
Requested by
Host: pixel.mathtag.com
URL: https://pixel.mathtag.com/event/js?mt_id=1506452&mt_adid=241675&mt_exem=&mt_excl=&v1=&v2=&v3=&s1=&s2=&s3=
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.233.201 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a2-18-233-201.deploy.static.akamaitechnologies.com
Software
MT3 3984 0e3af3b master cdg-pixel-x13 config:1.0.0 /
Resource Hash
304a0259406001319e10acd097537e33bbc0157670417a48fdd527a889951f65

Request headers

Host
pixel.mathtag.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
cross-site
Sec-Fetch-Mode
navigate
Sec-Fetch-Dest
iframe
Referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms?blaid=2123744
Accept-Encoding
gzip, deflate, br
Cookie
uuid=41be615e-80f1-4b00-800a-e2f6ae71b975
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms?blaid=2123744

Response headers

Content-Type
text/html
Content-Length
631
Server
MT3 3984 0e3af3b master cdg-pixel-x13 config:1.0.0
Cache-Control
no-cache
P3P
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Expires
Thu, 07 Oct 2021 05:09:05 GMT
Date
Thu, 07 Oct 2021 05:09:06 GMT
Connection
keep-alive
ip.json
api.company-target.com/api/v2/ 		3 KB
1 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://api.company-target.com/api/v2/ip.json?referrer=&page=https%3A%2F%2Fwww.cybereason.com%2Fblog%2Foperation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms%3Fblaid%3D2123744&page_title=Operation%20GhostShell%3A%20Novel%20RAT%20Targets%20Global%20Aerospace%20and%20Telecoms%20Firms&src=tag&auth=MOftAmbp2Aha4tkNEmeyvcipKYfCUyVJMXpCWBMS
Requested by
Host: tag.demandbase.com
URL: https://tag.demandbase.com/6e1424cff90e9cd4.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.97.17 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
nginx /
Resource Hash
a4346365d50101106141c16779cf78ea0d9d80f2dca2955c16b6f976580ba568

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms?blaid=2123744
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Thu, 07 Oct 2021 05:09:06 GMT
identification-source
CENTRAL
vary
Accept-Encoding, Origin
x-amz-cf-pop
FRA56-P2
x-cache
Miss from cloudfront
request-id
34d3051b-5640-4487-8d8e-881a902d0a32
content-encoding
gzip
pragma
no-cache
access-control-allow-origin
https://www.cybereason.com
server
nginx
access-control-max-age
7200
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/json;charset=utf-8
via
1.1 84294257ed643a88ee54d2e3f7d7ccea.cloudfront.net (CloudFront)
access-control-expose-headers
cache-control
no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials
true
api-version
v2
access-control-allow-headers
DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
PqBBMiSfx2Avh4x7R6zwYnZxhLlRlvligCOor97grLnYbn3WJ19H9A==
expires
Wed, 06 Oct 2021 05:09:06 GMT
img
pixel.mathtag.com/misc/ 		43 B
493 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pixel.mathtag.com/misc/img?mm_bnc&bcdv=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.233.201 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a2-18-233-201.deploy.static.akamaitechnologies.com
Software
MT3 3984 0e3af3b master cdg-pixel-x12 config:1.0.0 /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms?blaid=2123744
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date
Thu, 07 Oct 2021 05:09:06 GMT
Server
MT3 3984 0e3af3b master cdg-pixel-x12 config:1.0.0
P3P
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Cache-Control
no-cache
Connection
keep-alive
Content-Type
image/gif
Content-Length
43
Expires
Thu, 07 Oct 2021 05:09:05 GMT
pdst-events-prod-sink
us-central1-adaptive-growth.cloudfunctions.net/ Frame 		0
0 		Preflight
General
Check archive.org
Download Go to
Full URL
https://us-central1-adaptive-growth.cloudfunctions.net/pdst-events-prod-sink
Protocol
H2
Server
216.239.36.54 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Frontend / Express
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Method
POST
Access-Control-Request-Headers
content-type
Origin
https://www.cybereason.com
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Sec-Fetch-Mode
cors

Response headers

access-control-allow-headers
Content-Type, Accept
access-control-allow-methods
GET, POST
access-control-allow-origin
*
content-type
text/html; charset=utf-8
etag
W/"2-ROqGvmcGDXooyAXFZHZ+i4au1yQ"
function-execution-id
wxky4qkf1cr4
x-powered-by
Express
x-cloud-trace-context
c54b9b3516d70495b6a406372793a3c4
content-encoding
gzip
date
Thu, 07 Oct 2021 05:09:06 GMT
server
Google Frontend
cache-control
private
content-length
22
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
collect
www.google-analytics.com/ 		35 B
55 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google-analytics.com/collect?v=1&_v=j93&a=965426915&t=event&ni=1&_s=3&dl=https%3A%2F%2Fwww.cybereason.com%2Fblog%2Foperation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms%3Fblaid%3D2123744&ul=en-us&de=UTF-8&dt=Operation%20GhostShell%3A%20Novel%20RAT%20Targets%20Global%20Aerospace%20and%20Telecoms%20Firms&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=Demandbase&ea=API%20Resolution&el=IP%20API&_u=aHBAAEABAAAAAC~&jid=&gjid=&cid=770505642.1633583345&tid=UA-56367941-1&_gid=1703564295.1633583345&cd3=10256319&cd4=Netprotect%20AS&cd5=Manufacturing&cd6=Chemicals&cd7=Small&cd8=%241M%20-%20%245M&cd9=SMB&cd10=Manufacturing&cd11=(Non-Company%20Visitor)&cd12=Nesttun&cd13=12&cd14=Norway&z=700431036
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.185.174 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s51-in-f14.1e100.net
Software
Golfe2 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms?blaid=2123744
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 06 Oct 2021 08:06:37 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
age
75749
content-type
image/gif
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
35
expires
Mon, 01 Jan 1990 00:00:00 GMT
dc_pre=CK2ip5jEt_MCFaJEHQkdMosGug;src=10272547;type=landing;cat=allsite;ord=6730628086635;gtm=2wga40;auiddc=*;ps=1;~oref=https%3A%2F%2Fwww.cybereason.com%2Fblog%2Foperation-ghostshell-novel-rat-tar...
adservice.google.com/ddm/fls/z/ Frame 0227 		42 B
107 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://adservice.google.com/ddm/fls/z/dc_pre=CK2ip5jEt_MCFaJEHQkdMosGug;src=10272547;type=landing;cat=allsite;ord=6730628086635;gtm=2wga40;auiddc=*;ps=1;~oref=https%3A%2F%2Fwww.cybereason.com%2Fblog%2Foperation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms%3Fblaid%3D2123744
Requested by
Host: 10272547.fls.doubleclick.net
URL: https://10272547.fls.doubleclick.net/activityi;dc_pre=CK2ip5jEt_MCFaJEHQkdMosGug;src=10272547;type=landing;cat=allsite;ord=6730628086635;gtm=2wga40;auiddc=1638032237.1633583346;ps=1;~oref=https%3A%2F%2Fwww.cybereason.com%2Fblog%2Foperation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms%3Fblaid%3D2123744?
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.186.162 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s08-in-f2.1e100.net
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://10272547.fls.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 07 Oct 2021 05:09:06 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
dc_pre=CNu9p5jEt_MCFZpEHQkdQOQCEQ;src=10428681;type=cyber0;cat=cyber0;ord=9150648955961;gtm=2wga40;auiddc=*;ps=1;~oref=https%3A%2F%2Fwww.cybereason.com%2Fblog%2Foperation-ghostshell-novel-rat-targe...
adservice.google.com/ddm/fls/z/ Frame 9934 		42 B
515 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://adservice.google.com/ddm/fls/z/dc_pre=CNu9p5jEt_MCFZpEHQkdQOQCEQ;src=10428681;type=cyber0;cat=cyber0;ord=9150648955961;gtm=2wga40;auiddc=*;ps=1;~oref=https%3A%2F%2Fwww.cybereason.com%2Fblog%2Foperation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms%3Fblaid%3D2123744
Requested by
Host: 10428681.fls.doubleclick.net
URL: https://10428681.fls.doubleclick.net/activityi;dc_pre=CNu9p5jEt_MCFZpEHQkdQOQCEQ;src=10428681;type=cyber0;cat=cyber0;ord=9150648955961;gtm=2wga40;auiddc=1638032237.1633583346;ps=1;~oref=https%3A%2F%2Fwww.cybereason.com%2Fblog%2Foperation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms%3Fblaid%3D2123744?
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.186.162 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s08-in-f2.1e100.net
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://10428681.fls.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 07 Oct 2021 05:09:06 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.com/pagead/1p-conversion/401574070/
Redirect Chain
  • https://googleads.g.doubleclick.net/pagead/viewthroughconversion/401574070/?random=1265835270&cv=9&fst=1633583345928&num=1&value=0&label=6wPaCOv09oACELaRvr8B&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&...
  • https://www.google.com/pagead/1p-conversion/401574070/?random=1265835270&cv=9&fst=1633583345928&num=1&value=0&label=6wPaCOv09oACELaRvr8B&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_...
42 B
64 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.com/pagead/1p-conversion/401574070/?random=1265835270&cv=9&fst=1633583345928&num=1&value=0&label=6wPaCOv09oACELaRvr8B&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2wga40&sendb=1&ig=1&frm=0&url=https%3A%2F%2Fwww.cybereason.com%2Fblog%2Foperation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms%3Fblaid%3D2123744&tiba=Operation%20GhostShell%3A%20Novel%20RAT%20Targets%20Global%20Aerospace%20and%20Telecoms%20Firms&auid=1638032237.1633583346&capi=1&hn=www.googleadservices.com&async=1&fmt=3&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&sscte=1&crd=&is_vtc=1&ocp_id=8oBeYbz2CfCZx_AP18atmA4&cid=CAQSKQCNIrLMDXzGfLbstf1G7LtKcFW5h7dYjc4yCiurElPKbb8Ap78Pp9kt&eitems=ChEI8JL1igYQ6K3F7e7DgaTSARIdAE_D85l3AG9fdTf88bqEDG26npEWogqvPZGvRJA&random=4227900526&resp=GooglemKTybQhCsO
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.186.100 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s06-in-f4.1e100.net
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms?blaid=2123744
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 07 Oct 2021 05:09:06 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-security-policy
script-src 'none'; object-src 'none'
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma
no-cache
date
Thu, 07 Oct 2021 05:09:06 GMT
x-content-type-options
nosniff
server
cafe
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-type
image/gif
location
https://www.google.com/pagead/1p-conversion/401574070/?random=1265835270&cv=9&fst=1633583345928&num=1&value=0&label=6wPaCOv09oACELaRvr8B&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2wga40&sendb=1&ig=1&frm=0&url=https%3A%2F%2Fwww.cybereason.com%2Fblog%2Foperation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms%3Fblaid%3D2123744&tiba=Operation%20GhostShell%3A%20Novel%20RAT%20Targets%20Global%20Aerospace%20and%20Telecoms%20Firms&auid=1638032237.1633583346&capi=1&hn=www.googleadservices.com&async=1&fmt=3&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&sscte=1&crd=&is_vtc=1&ocp_id=8oBeYbz2CfCZx_AP18atmA4&cid=CAQSKQCNIrLMDXzGfLbstf1G7LtKcFW5h7dYjc4yCiurElPKbb8Ap78Pp9kt&eitems=ChEI8JL1igYQ6K3F7e7DgaTSARIdAE_D85l3AG9fdTf88bqEDG26npEWogqvPZGvRJA&random=4227900526&resp=GooglemKTybQhCsO
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.com/pagead/1p-user-list/561371164/ 		42 B
64 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.com/pagead/1p-user-list/561371164/?random=1633583345920&cv=9&fst=1633582800000&num=1&guid=ON&eid=376635471&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2wga40&sendb=1&frm=0&url=https%3A%2F%2Fwww.cybereason.com%2Fblog%2Foperation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms%3Fblaid%3D2123744&tiba=Operation%20GhostShell%3A%20Novel%20RAT%20Targets%20Global%20Aerospace%20and%20Telecoms%20Firms&async=1&fmt=3&is_vtc=1&random=1619242126&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.186.100 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s06-in-f4.1e100.net
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms?blaid=2123744
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 07 Oct 2021 05:09:06 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-security-policy
script-src 'none'; object-src 'none'
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.com/pagead/1p-user-list/934771702/ 		42 B
64 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.com/pagead/1p-user-list/934771702/?random=1633583345926&cv=9&fst=1633582800000&num=1&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2wga40&sendb=1&frm=0&url=https%3A%2F%2Fwww.cybereason.com%2Fblog%2Foperation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms%3Fblaid%3D2123744&tiba=Operation%20GhostShell%3A%20Novel%20RAT%20Targets%20Global%20Aerospace%20and%20Telecoms%20Firms&async=1&fmt=3&is_vtc=1&random=3433785957&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.186.100 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s06-in-f4.1e100.net
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms?blaid=2123744
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 07 Oct 2021 05:09:06 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-security-policy
script-src 'none'; object-src 'none'
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
img
pixel.mathtag.com/misc/ Frame 8AC5 		43 B
493 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pixel.mathtag.com/misc/img?mm_bnc&bcdv=0
Requested by
Host: pixel.mathtag.com
URL: https://pixel.mathtag.com/sync/iframe?mt_uuid=41be615e-80f1-4b00-800a-e2f6ae71b975&no_iframe=1&mt_adid=241675&source=mathtag
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.233.201 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a2-18-233-201.deploy.static.akamaitechnologies.com
Software
MT3 4033 f73cd20 master cdg-pixel-x28 config:1.0.0 /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://pixel.mathtag.com/sync/iframe?mt_uuid=41be615e-80f1-4b00-800a-e2f6ae71b975&no_iframe=1&mt_adid=241675&source=mathtag
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date
Thu, 07 Oct 2021 05:09:06 GMT
Server
MT3 4033 f73cd20 master cdg-pixel-x28 config:1.0.0
P3P
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Cache-Control
no-cache
Connection
keep-alive
Content-Type
image/gif
Content-Length
43
Expires
Thu, 07 Oct 2021 05:09:05 GMT
visit-data
in.hotjar.com/api/v2/client/sites/704918/ 		146 B
323 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://in.hotjar.com/api/v2/client/sites/704918/visit-data?sv=7
Requested by
Host: script.hotjar.com
URL: https://script.hotjar.com/modules.e95f6e2deb67f1b24d8e.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.75.159.38 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-54-75-159-38.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
ab95872c4726727a3b09b1f8c28490c70b7e407e97fd93bbfb75a2ecc5faac36

Request headers

Referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms?blaid=2123744
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type
text/plain; charset=UTF-8

Response headers

date
Thu, 07 Oct 2021 05:09:06 GMT
content-encoding
br
vary
Accept-Encoding
content-type
application/json
access-control-allow-origin
*
access-control-max-age
86400
cache-control
no-cache, no-store
access-control-allow-credentials
true
704918
vc.hotjar.io/sessions/ 		0
258 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://vc.hotjar.io/sessions/704918?s=0.25&r=0.17029572837251883
Requested by
Host: script.hotjar.com
URL: https://script.hotjar.com/modules.e95f6e2deb67f1b24d8e.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.122.85 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Python/3.7 aiohttp/3.5.4 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms?blaid=2123744
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Thu, 07 Oct 2021 05:09:06 GMT
via
1.1 1d087f24771eb6834b16162f1bb01660.cloudfront.net (CloudFront)
server
Python/3.7 aiohttp/3.5.4
x-amz-cf-pop
FRA60-P2
x-cache
Miss from cloudfront
access-control-allow-origin
*
cache-control
no-store
x-amz-cf-id
XR5lIRxcoGGW3bC1iyA0FV6VJ-lQABXrztt9RjywjR1DgDYGVlzcOw==
demconf.jpg
dpm.demdex.net/ Frame 39CD
Redirect Chain
  • https://dpm.demdex.net/ibs:dpid=82530&dpuuid=ad8eb495-740e-424c-9d04-0a19c5d760ff-615e80f2-5553&gdpr=0&gdpr_consent=
  • https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=82530&dpuuid=ad8eb495-740e-424c-9d04-0a19c5d760ff-615e80f2-5553&gdpr=0&gdpr_consent=
42 B
943 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=82530&dpuuid=ad8eb495-740e-424c-9d04-0a19c5d760ff-615e80f2-5553&gdpr=0&gdpr_consent=
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.210.80.7 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-210-80-7.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://pixel.sitescout.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

DCS
dcs-prod-irl1-2-v018-0807da26f.edge-irl1.demdex.com UNKNOWN
Pragma
no-cache
Strict-Transport-Security
max-age=31536000; includeSubDomains
content-encoding
gzip
X-Content-Type-Options
nosniff
X-TID
j8NsOLQbQM4=
P3P
policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Cache-Control
no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection
keep-alive
Content-Type
image/gif
Content-Length
59
Expires
Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

DCS
dcs-prod-irl1-1-v018-0b11b7be7.edge-irl1.demdex.com UNKNOWN
Pragma
no-cache
Strict-Transport-Security
max-age=31536000; includeSubDomains
X-TID
GznADPfUSdA=
P3P
policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Location
https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=82530&dpuuid=ad8eb495-740e-424c-9d04-0a19c5d760ff-615e80f2-5553&gdpr=0&gdpr_consent=
Cache-Control
no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection
keep-alive
Content-Length
0
Expires
Thu, 01 Jan 1970 00:00:00 UTC
check
pixel.tapad.com/idsync/ex/receive/ Frame 39CD
Redirect Chain
  • https://pixel.tapad.com/idsync/ex/receive?partner_id=2499&partner_device_id=ad8eb495-740e-424c-9d04-0a19c5d760ff-615e80f2-5553
  • https://pixel.tapad.com/idsync/ex/receive/check?partner_id=2499&partner_device_id=ad8eb495-740e-424c-9d04-0a19c5d760ff-615e80f2-5553
95 B
425 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pixel.tapad.com/idsync/ex/receive/check?partner_id=2499&partner_device_id=ad8eb495-740e-424c-9d04-0a19c5d760ff-615e80f2-5553
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.227.248.159 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
159.248.227.35.bc.googleusercontent.com
Software
/
Resource Hash
3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://pixel.sitescout.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Thu, 07 Oct 2021 05:09:06 GMT
via
1.1 google
content-type
image/png
alt-svc
clear
content-length
95
strict-transport-security
max-age=31536000
p3p
policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

Redirect headers

location
https://pixel.tapad.com/idsync/ex/receive/check?partner_id=2499&partner_device_id=ad8eb495-740e-424c-9d04-0a19c5d760ff-615e80f2-5553
date
Thu, 07 Oct 2021 05:09:06 GMT
via
1.1 google
alt-svc
clear
content-length
0
strict-transport-security
max-age=31536000
p3p
policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
/
loadm.exelator.com/load/ Frame 39CD 		0
324 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://loadm.exelator.com/load/?p=204&g=700&j=0&buid=ad8eb495-740e-424c-9d04-0a19c5d760ff-615e80f2-5553&gdpr=0&gdpr_consent=
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.78.254.47 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-54-78-254-47.eu-west-1.compute.amazonaws.com
Software
nginx / Undertow/1
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://pixel.sitescout.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Thu, 07 Oct 2021 05:09:06 GMT
cache-control
no-cache
access-control-allow-credentials
true
server
nginx
x-powered-by
Undertow/1
p3p
policyref=/w3c/p3p.xml, CP=NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA, policyref=/w3c/p3p.xml, CP=NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA
um
sync.teads.tv/ Frame 39CD 		23 B
172 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://sync.teads.tv/um?eid=73&uid=ad8eb495-740e-424c-9d04-0a19c5d760ff-615e80f2-5553&gdpr=0&gdpr_consent=
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.111.242.245 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-111-242-245.deploy.static.akamaitechnologies.com
Software
akka-http/10.2.6 /
Resource Hash
328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://pixel.sitescout.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 07 Oct 2021 05:09:06 GMT
cache-control
max-age=0, no-cache, no-store
expires
Thu, 07 Oct 2021 05:09:06 GMT
server
akka-http/10.2.6
content-length
23
content-type
image/gif
tpid=ad8eb495-740e-424c-9d04-0a19c5d760ff-615e80f2-5553
bcp.crwdcntrl.net/map/ct=y/c=1389/tp=STSC/ Frame 39CD
Redirect Chain
  • https://bcp.crwdcntrl.net/map/c=1389/tp=STSC/tpid=ad8eb495-740e-424c-9d04-0a19c5d760ff-615e80f2-5553
  • https://bcp.crwdcntrl.net/map/ct=y/c=1389/tp=STSC/tpid=ad8eb495-740e-424c-9d04-0a19c5d760ff-615e80f2-5553
49 B
736 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://bcp.crwdcntrl.net/map/ct=y/c=1389/tp=STSC/tpid=ad8eb495-740e-424c-9d04-0a19c5d760ff-615e80f2-5553
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.253.111.115 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-34-253-111-115.eu-west-1.compute.amazonaws.com
Software
Jetty(9.4.38.v20210224) /
Resource Hash
2f561b02a49376e3679acd5975e3790abdff09ecbadfa1e1858c7ba26e3ffcef

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://pixel.sitescout.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 07 Oct 2021 05:09:06 GMT
server
Jetty(9.4.38.v20210224)
p3p
CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
access-control-allow-origin
*
cache-control
no-cache
x-server
10.45.21.38
content-type
image/gif
content-length
49
expires
0

Redirect headers

pragma
no-cache
date
Thu, 07 Oct 2021 05:09:06 GMT
server
Jetty(9.4.38.v20210224)
p3p
CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
location
https://bcp.crwdcntrl.net/map/ct=y/c=1389/tp=STSC/tpid=ad8eb495-740e-424c-9d04-0a19c5d760ff-615e80f2-5553
cache-control
no-cache
x-server
10.45.21.8
content-length
0
expires
0
/
www.facebook.com/tr/ 		44 B
91 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.facebook.com/tr/?id=116645602292181&ev=Microdata&dl=https%3A%2F%2Fwww.cybereason.com%2Fblog%2Foperation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms%3Fblaid%3D2123744&rl=&if=false&ts=1633583346551&cd[DataLayer]=%5B%5D&cd[Meta]=%7B%22title%22%3A%22Operation%20GhostShell%3A%20Novel%20RAT%20Targets%20Global%20Aerospace%20and%20Telecoms%20Firms%22%2C%22meta%3Adescription%22%3A%22The%20highly-targeted%20attacks%20against%20aerospace%20and%20telecoms%20firms%20by%20new%20Iranian%20threat%20actor%20MalKamak%20includes%20newly%20discovered%20malware%20that%20evaded%20security%20tools%20since%202018%20and%20abuses%20Dropbox%20services%20for%20command%20and%20control...%22%7D&cd[OpenGraph]=%7B%22og%3Adescription%22%3A%22The%20highly-targeted%20attacks%20against%20aerospace%20and%20telecoms%20firms%20by%20new%20Iranian%20threat%20actor%20MalKamak%20includes%20newly%20discovered%20malware%20that%20evaded%20security%20tools%20since%202018%20and%20abuses%20Dropbox%20services%20for%20command%20and%20control...%22%2C%22og%3Atitle%22%3A%22Operation%20GhostShell%3A%20Novel%20RAT%20Targets%20Global%20Aerospace%20and%20Telecoms%20Firms%22%2C%22og%3Aimage%22%3A%22https%3A%2F%2Fwww.cybereason.com%2Fhubfs%2FBLOG%2520%2520SOCIAL%2520SET%2520-%2520News%2520%25281%2529-1.png%23keepProtocol%22%2C%22og%3Aimage%3Awidth%22%3A%221200%22%2C%22og%3Aimage%3Aheight%22%3A%22627%22%2C%22og%3Aurl%22%3A%22https%3A%2F%2Fwww.cybereason.com%2Fblog%2Foperation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms%22%2C%22og%3Atype%22%3A%22article%22%7D&cd[Schema.org]=%5B%5D&cd[JSON-LD]=%5B%5D&sw=1600&sh=1200&v=2.9.47&r=stable&a=tmgoogletagmanager&ec=1&o=30&fbp=fb.1.1633583346042.1361837594&it=1633583345782&coo=false&es=automatic&tm=3&rqm=GET
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
31.13.92.36 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
edge-star-mini-shv-01-frt3.facebook.com
Software
proxygen-bolt /
Resource Hash
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms?blaid=2123744
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Thu, 07 Oct 2021 05:09:06 GMT
last-modified
Fri, 21 Dec 2012 00:00:01 GMT
server
proxygen-bolt
strict-transport-security
max-age=31536000; includeSubDomains
content-type
image/gif
cache-control
no-cache, must-revalidate, max-age=0
cross-origin-resource-policy
cross-origin
content-length
44
alt-svc
h3=":443"; ma=3600, h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
priority
u=3,i
expires
Thu, 07 Oct 2021 05:09:06 GMT
perf
www.cybereason.com/_hcms/ 		2 B
664 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://www.cybereason.com/_hcms/perf
Requested by
Host: www.cybereason.com
URL: https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms?blaid=2123744
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
199.60.103.226 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3

Request headers

sec-fetch-mode
cors
origin
https://www.cybereason.com
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
sec-fetch-dest
empty
cookie
__cfruid=649f615bd690efb862dbcff90d2cb8293e32c367-1633583344; __hstc=85683782.57fe850b69eb716b128fe6d57754eece.1633583345345.1633583345345.1633583345345.1; hubspotutk=57fe850b69eb716b128fe6d57754eece; __hssrc=1; __hssc=85683782.1.1633583345345; _gid=GA1.2.1703564295.1633583345; _gat=1; _gcl_au=1.1.1638032237.1633583346; _ga_SSF38JVRVJ=GS1.1.1633583345.1.0.1633583345.60; _ga=GA1.1.770505642.1633583345; _rdt_uuid=1633583345878.d40da328-0087-422d-a60c-72d75ff0a524; __pdst=8dce13dbc4664d5b8c288997088a4b01; _uetsid=b1fd0e20272c11ec9ed65bbbfa317a50; _uetvid=b1fdd690272c11ec90e6bd43590e1127; _fbp=fb.1.1633583346042.1361837594; _hjid=1b9e95a7-1fce-4650-8786-c878499a4c88; _hjFirstSeen=1; _hjIncludedInPageviewSample=1; _hjAbsoluteSessionInProgress=1; _hjIncludedInSessionSample=0
content-length
859
:path
/_hcms/perf
pragma
no-cache
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
content-type
application/json
accept
*/*
cache-control
no-cache
:authority
www.cybereason.com
referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms?blaid=2123744
:scheme
https
sec-fetch-site
same-origin
:method
POST
Referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms?blaid=2123744
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-type
application/json

Response headers

cf-ray
69a49d9708f71f19-FRA
date
Thu, 07 Oct 2021 05:09:08 GMT
cf-cache-status
DYNAMIC
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
x-hubspot-correlation-id
e6c4aeb5-b358-4217-91d8-1d8e20e6687b
x-trace
2B934D3420CCC4AD227E682459508AAE7AD0CE01AE000000000000000000
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=jitT4x0aqawjRGJg8sSrgw3urJ3LXUrHlZo%2Fp6QZFMgkXKl63L95dDI6iTwMY8FyvUA5iIx7aEu8GEIvFG%2F%2BC1IJ79tzCs78M7%2BMgi9V3e5MtFisTpVUULAN%2Fp3O52eP8goYuA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/plain; charset=utf-8
access-control-allow-credentials
false
x-robots-tag
none
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length
2

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
js.driftt.com
URL
https://js.driftt.com/include/1633583400000/zdcd6x8yhg85.js

Verdicts & Comments Add Verdict or Comment

117 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| 1 object| 2 object| 3 object| 4 object| 5 object| 6 object| 7 object| onbeforexrselect boolean| originAgentCluster function| $ function| jQuery function| hsjQuery object| _hsp object| Typekit object| __core-js_shared__ object| Sslac object| IN object| jQuery111202567385501131454 object| MarkerAnimation function| hs_i18n_log function| hs_i18n_substituteStrings function| hs_i18n_insertPlaceholders function| hs_i18n_getMessage undefined| module_41681847227 function| i18n_getmessage function| i18n_getlanguage undefined| module_41682410610 undefined| module_48386556055 object| _hsq object| hsVars undefined| myInterval function| sticky_relocate object| hubspot function| jsonpHandler object| FB boolean| _hspb_loaded object| __twttrll object| twttr object| __twttr object| _paq function| sanitizeKey boolean| _hstc_loaded object| globalRoot undefined| hns function| bindToWindowOnError function| defineProperties object| leadflows function| OutpostErrorReporter boolean| popupPoliceActive undefined| hns2 undefined| jade undefined| I18n undefined| hubspot_mailcheck undefined| Pikaday undefined| reqwest undefined| exports undefined| define boolean| LEAD_FLOWS_RAN boolean| COMMON_SETUP_RAN string| GoogleAnalyticsObject function| ga object| dataLayer boolean| _hspb_ran boolean| _hstc_ran string| __hsUserToken number| expireDateTime object| google_tag_data object| gaplugins object| gaGlobal object| gaData object| google_tag_manager string| _linkedin_data_partner_id function| twq function| hj object| _hjSettings function| rdt function| fbq function| _fbq object| techtargetic function| pdst object| drift object| driftt boolean| llcookieless number| sf14gv object| _airpr boolean| LEAD_FLOW_DOCUMENT_READY_RAN function| onYouTubeIframeAPIReady object| configArgs number| pixelRatio number| width number| height object| screenSize object| labels function| lintrk boolean| _already_called_lintrk object| hjSiteSettings function| hjBootstrap object| hjBootstrapCalled object| hjLazyModules function| GooglemKTybQhCsO function| google_trackConversion object| GooglebQhCsO function| UET function| UET_init function| UET_push object| uetq object| regeneratorRuntime object| JSON3 object| _airpr_ns object| Demandbase object| cntrUpTag function| metric object| Wistia string| _wistiaElemId object| _wq object| wistiaEmbeds

54 Cookies

Domain/Path Name / Value
.www.cybereason.com/ Name: __cfruid
Value: 649f615bd690efb862dbcff90d2cb8293e32c367-1633583344
.hubspot.com/ Name: __cf_bm
Value: hmmXgrleOKEQ6JFo9pt.fE7pbzN2iraRTjEu2TEKyUg-1633583345-0-AWKgxG/j1NAaBUqe1IpZULi/7z0R+F/IscivdDkjsBsGRcoW7/XMmbRL8I/+tF5tTGdqD/k9kfOrWkqgPlrRFys=
.cybereason.com/ Name: __hstc
Value: 85683782.57fe850b69eb716b128fe6d57754eece.1633583345345.1633583345345.1633583345345.1
.cybereason.com/ Name: hubspotutk
Value: 57fe850b69eb716b128fe6d57754eece
.cybereason.com/ Name: __hssrc
Value: 1
.cybereason.com/ Name: __hssc
Value: 85683782.1.1633583345345
.cybereason.com/ Name: _gid
Value: GA1.2.1703564295.1633583345
.cybereason.com/ Name: _gat
Value: 1
.cybereason.com/ Name: _gcl_au
Value: 1.1.1638032237.1633583346
.techtarget.com/ Name: __cf_bm
Value: 5AvvnnFT9BZVijf1au6mOSz9HbdJ_3s5N2zO7B6ELmg-1633583345-0-AcxdfNt3vgOryzo3vbtdetoFORUbmIJeODFvzFSxcbeMn7HuGtNzazTkEaxsKQ0wLXi1YpLmlQELPbyAmLcgK5Q=
.cybereason.com/ Name: _ga_SSF38JVRVJ
Value: GS1.1.1633583345.1.0.1633583345.60
.cybereason.com/ Name: _ga
Value: GA1.1.770505642.1633583345
.bing.com/ Name: MUID
Value: 0719A404094F6F8B19CDB4CD080A6EA7
.mathtag.com/ Name: uuid
Value: 41be615e-80f1-4b00-800a-e2f6ae71b975
.cybereason.com/ Name: _rdt_uuid
Value: 1633583345878.d40da328-0087-422d-a60c-72d75ff0a524
www.cybereason.com/ Name: __pdst
Value: 8dce13dbc4664d5b8c288997088a4b01
.doubleclick.net/ Name: IDE
Value: AHWqTUnkHBJPvLV6__RViFJLuWrj1uqhKdvk--CP19eXfR_MAh5sa9PFJefCyUILMFY
.cybereason.com/ Name: _uetsid
Value: b1fd0e20272c11ec9ed65bbbfa317a50
.cybereason.com/ Name: _uetvid
Value: b1fdd690272c11ec90e6bd43590e1127
.cybereason.com/ Name: _fbp
Value: fb.1.1633583346042.1361837594
.cybereason.com/ Name: _hjid
Value: 1b9e95a7-1fce-4650-8786-c878499a4c88
.cybereason.com/ Name: _hjFirstSeen
Value: 1
.twitter.com/ Name: personalization_id
Value: "v1_OJuYt0yCa/ddXcd6+JCEQw=="
apt.techtarget.com/ Name: TS01fac3f6
Value: 012c664659105e0a8aaa8685d0990496e6538efdb10e6e94af56404fb7c1f4ed9e4ae63ee396f53714b6053445d6bae2c6bc747bd8
www.cybereason.com/ Name: _hjIncludedInPageviewSample
Value: 1
.cybereason.com/ Name: _hjAbsoluteSessionInProgress
Value: 1
dpx.airpr.com/ Name: an_airpr_recent_visit
Value: 1
.adnxs.com/ Name: uuid2
Value: 2003287067430329871
www.cybereason.com/ Name: _hjIncludedInSessionSample
Value: 0
.mathtag.com/ Name: mt_misc
Value: mt_bt:1
.sitescout.com/ Name: ssi
Value: ad8eb495-740e-424c-9d04-0a19c5d760ff#1633583346388
.sitescout.com/ Name: _ssuma
Value: eyIzNCI6MTYzMzU4MzM0NjQyOSwiMiI6MTYzMzU4MzM0NjQyOSwiNCI6MTYzMzU4MzM0NjQyOSwiMzkiOjE2MzM1ODMzNDY0MjksIjciOjE2MzM1ODMzNDY0Mjl9
.bidr.io/ Name: bito
Value: AAEUNE7CvQIAABjqijTDHw
.bidr.io/ Name: bitoIsSecure
Value: ok
.linkedin.com/ Name: UserMatchHistory
Value: AQJlpjy8uA1_egAAAXxZJ7MsiztQmjaTT0m9sAW5QXxsfrfRWiehSQGlbaRaUelpseIYS3TUahciUw
.linkedin.com/ Name: AnalyticsSyncHistory
Value: AQL6Mq3HbEYoWAAAAXxZJ7Msq9bs96luk5oI-h-ktSqYech9O8UhD_udQffOrSR3wuQnLARqb8x3oD2x96I-Gg
.ads.linkedin.com/ Name: lang
Value: v=2&lang=en-us
.linkedin.com/ Name: bcookie
Value: "v=2&f1ca6002-8b02-4785-8768-3d16a353f7c7"
.linkedin.com/ Name: lidc
Value: "b=OGST09:s=O:r=O:a=O:p=O:g=2092:u=1:x=1:i=1633583346:t=1633669746:v=2:sig=AQHLbpGbnRVR5HoMAGqEaqI9JfAgRg-k"
.tapad.com/ Name: TapAd_TS
Value: 1633583346668
.tapad.com/ Name: TapAd_DID
Value: b2708ba1-a5a9-45f3-a6a1-905f5fbabf1c
.tapad.com/ Name: TapAd_3WAY_SYNCS
Value:
.demdex.net/ Name: demdex
Value: 48695999623075761760728598186937341399
.crwdcntrl.net/ Name: _cc_dc
Value: 1
.crwdcntrl.net/ Name: _cc_id
Value: d19cbbed88e73d28c747009f1171d4ed
.crwdcntrl.net/ Name: _cc_cc
Value: "ACZ4XmNQSDG0TE5KSk2xsEg1N04xskg2NzE3MLBMMzQ0N0wxSU1hAILEuIZPIBoKAGcmC0w%3D"
.crwdcntrl.net/ Name: _cc_aud
Value: "ABR4XmNgYGBIjGv4BKSgAAAajAIy"
.company-target.com/ Name: tuuid
Value: 758207b7-56dd-4c71-beca-d204424501b1
.company-target.com/ Name: tuuid_lu
Value: 1633583346
.dpm.demdex.net/ Name: dpm
Value: 48695999623075761760728598186937341399
.linkedin.com/ Name: lang
Value: v=2&lang=de-de
.www.linkedin.com/ Name: bscookie
Value: "v=1&202110070509067ff16a07-b582-4bdf-803e-4967f500b06eAQFxYdGJfnqjxcRsETuo_EaJz90SeitT"
.ws.zoominfo.com/ Name: visitorId
Value: fafd2f7062ab800dc35267448c5416ec5f77a1f635ce3286a0bb422c1d19fc42
.zoominfo.com/ Name: __cf_bm
Value: dEMp0kjgHWZTe6ZM9RSuGH972PYGfX1OjMLK2yQAcjg-1633583347-0-AQt+80rt0w3cd0G1Ja3xJHgsK7aE5LSrcAAtVs7+mDUD0Lb/UyfFs7fRpPfci7Vz4pLXANsYi0ZY4ZLAF6Pz/Ks=

2 Console Messages

Source Level URL
Text
network error URL: https://lltrck.com/lt-v2.min.js
Message:
Failed to load resource: the server responded with a status of 403 ()
network error URL: https://id.rlcdn.com/464526.gif
Message:
Failed to load resource: the server responded with a status of 451 ()

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security max-age=31536000

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

10272547.fls.doubleclick.net
10428681.fls.doubleclick.net
adservice.google.com
alb.reddit.com
analytics.google.com
analytics.twitter.com
api.company-target.com
app.hubspot.com
apt.techtarget.com
attr.ml-api.io
bat.bing.com
bcp.crwdcntrl.net
bid.g.doubleclick.net
cdn.pdst.fm
cdn2.hubspot.net
cdnjs.cloudflare.com
connect.facebook.net
dpm.demdex.net
dpx.airpr.com
fast.wistia.com
fonts.googleapis.com
fonts.gstatic.com
forms.hubspot.com
googleads.g.doubleclick.net
id.rlcdn.com
in.hotjar.com
js.driftt.com
js.hs-analytics.net
js.hs-banner.com
js.hs-scripts.com
js.hsleadflows.net
lltrck.com
loadm.exelator.com
match.prod.bidr.io
p.typekit.net
pixel.mathtag.com
pixel.sitescout.com
pixel.tapad.com
platform.linkedin.com
platform.twitter.com
px.ads.linkedin.com
px.airpr.com
s.ml-attr.com
script.hotjar.com
secure.adnxs.com
segments.company-target.com
snap.licdn.com
static.ads-twitter.com
static.hotjar.com
stats.g.doubleclick.net
sync.teads.tv
syndication.twitter.com
t.co
tag.demandbase.com
track.hubspot.com
trk.techtarget.com
up.pixel.ad
us-central1-adaptive-growth.cloudfunctions.net
use.typekit.net
vars.hotjar.com
vc.hotjar.io
ws.zoominfo.com
www.cybereason.com
www.facebook.com
www.google-analytics.com
www.google.com
www.googleadservices.com
www.googletagmanager.com
www.linkedin.com
www.redditstatic.com
js.driftt.com
104.111.215.74
104.111.242.245
104.16.168.82
104.16.19.94
104.17.210.204
104.17.230.204
104.17.244.204
104.17.70.176
104.18.1.92
104.18.21.191
104.19.154.83
104.19.155.83
104.244.42.133
104.244.42.200
104.244.42.3
108.174.11.37
108.177.15.157
13.107.21.200
13.107.42.14
13.32.99.30
13.32.99.42
142.250.184.202
142.250.184.232
142.250.185.174
142.250.185.230
142.250.185.66
142.250.186.100
142.250.186.162
142.250.186.174
151.101.193.140
151.101.65.140
151.101.66.110
172.217.23.98
178.79.242.16
18.196.93.253
18.213.169.209
18.66.122.73
18.66.122.85
18.66.139.40
18.66.97.17
18.66.97.53
185.33.223.178
199.232.136.157
199.60.103.226
2.16.186.19
2.16.186.24
2.16.186.58
2.18.233.201
206.19.49.24
216.239.36.54
216.58.212.131
31.13.92.14
31.13.92.36
34.253.111.115
35.227.248.159
35.244.142.80
35.244.174.68
52.210.80.7
52.222.214.8
52.222.236.74
52.49.53.128
54.75.159.38
54.78.254.47
66.155.71.149
68.67.153.60
74.125.140.157
93.184.220.66
023694a0472dde38c6600bf88e6330765839e53f64f94edb63714aeab3de7e51
03b8f9e258f69727a11fc81ce93fbc8d0d5ca96489a1e84463af819efedf0782
067bdbb396e338c6d6ae1154aa9f609a282f225c8cc5c1156048d174a913b661
06de1d03905fa3708f8beb3b281211ec8c5dd7fcc903649f458bb6bce9241707
0857223030ff4c0a4ff84c1598ab2bf2b4f58eb7b9b278cddf05798dfde898e8
0a1db8e6cb7ae20e5ac308a25943b94734e7ad0f794b26eb778c7e38ae2b51e0
0a2eec7f18edeaecb0a4bbefcdfbb8abfcea0afd260fc4c4c0ae20e65241a093
0ea7d23d55fdda4f42a373f9a16ddb9a744c682714a9516dc95e9acdc5b3ce40
106c245c18fe02ebd1b9a26411dda09a9ecc5196ae9db48a322e765fe042b0fb
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
119bf322a2ce6d2a82422b51404bc54b375c881f12a120205598d1691fa48820
12127e3110351f54262db955bafe353593dd58c89c7f6b6fc159c10515e93c61
218877f60296297dec8266377083291f36d46f2980c1ff027471904470d14f49
2311b7d2f30a6ab89191098f12c99253267df7219477c0702d58bf4999f4a703
267c1ae37916b433b1515b4687883dbc2fef448a533e33bbe97085d42c7738d5
26c4f84717b932188a5f1b3dfbc9ed2166d27c84b7f763f5ca218258996b78fe
28f00815d1d718764b0e6059d1e5b9f7d64a05c648bd1d182b6d8ecb7d15c225
2ade3aa1d89865ba159dcd2d025c1e4e380101d6e192ae0f0d88b22bf3569f5e
2b371f984ea3f8b08479ddb334c6ec6447a31249073a16b4208d06b884cf0ddc
2ba7f20b1d8990e17a47fe3d88e4c766628aaa2baf1dd30fca0a0db59836f5f9
2bc2179dbcac09de834853fc91b815d3bea8112276b7b789f610078d399bcb47
2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363
2e96bf761583273e370136ed0b934a38ad1e08b386accb37277252b37b9c9961
2ecd295d295bec062cedebe177e54b9d6b19fc0a841dc5c178c654c9ccff09c0
2f561b02a49376e3679acd5975e3790abdff09ecbadfa1e1858c7ba26e3ffcef
304a0259406001319e10acd097537e33bbc0157670417a48fdd527a889951f65
328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7
341a4d40ad1b2560db940f906716d0e9539d4c0785399d7e0348fd0d3af00170
3422589f0cabdab96a1787e2517942f65707470ac02f966548828f80139a550a
3548fdd09c76e6d1a78dc0890d0da250339a5021ef499ac8b61f9d1bfae1a43b
359197d1e7ab63fe678db88914f31f1f9f6a37bd182e0de565fc7a68302a1f50
365a7ca6f52df29efedfdac2e08a9d0f03e4e2122dd9a49803bf8dacd58480fc
3b7b8a4b411ddf8db9bacc2f3aabf406f8e4c0c087829b336ca331c40adfdff1
3e4dcf5d937c6cd9bd580358e83d9bff9769f73cc2364ed9af22c88571959adb
3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517
4139f0b62005cf3f07a86b399774246fd14ff78729116737cf47df1b6b8dd1fc
42d9f880279b211f36a978ee81979fa382507c6428865a3e863cb91366284003
43ac0ae9e90f01a0afabe35cc0aaa377336aac90759e74770251de89db0af44c
46710f0509008ad4a31212927e35441764b757d672b2ed4f892ee4e2f0804abb
4c52e4274ebdbe29cd5b4983d888c247496b6d3bb55e05d4c0769d1b946d14f8
4da3e3aa30b5b06390d7e7e3fcfb16d648909eb429d161c2748bd6d79a7ec5fb
51443fc1aa325f301b39d89ffeae8f8a7833ed59491b89419902b32ef30b3b39
520be9aa9d6c5a6b301f92ba52999af829167a848052975840193aaf1d0ced1e
529b9c583e6cf8da02c9cadf8c38b5714198f0fde2dcde01da2d5ee681228738
538dd4ff6e384a44155168326ac40a6c20a93cd212b1fbf88ae7b0c44f9ab0bd
53f18426c8904b99d089e01c894d6cc5f2bbcb5416eab34cb134978d6e70cca5
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3
58ae09d221b5622f041fd635235b28202750a8c2c48a02524e45c555d99c2375
59d91999b3e0f1e6191f29f73b2b079ee1aa1350f3d88795db7518ca40a9be60
5bdf1120c4df8c868092d0bcb7f2540a85456fd94cd1e1a5570c9b63906b1a5b
5d7981c67ed27bc03b22521bd82582f3933875ac9818754fc8bd0507b4e56da2
5df981fec90b8eaea5545cd73ff279821506b668644df536419881bc07653ba3
5f0957fb43888099a11b4be327296643a4d9c6889303d02a0240b3b341855a9c
5f20636fb964286edb8aa1c68e72619291ceebbcf8de6ceca71e0bf7ee915203
5f9208947e343c28851472d721d14c93a91ee132a1978f1d3e07b692586a3727
5fbaeb9f8e25d7e0143bae61d4b1802c16ce7390b96ceb2d498b0d96ff4c853f
604f11b1aa0c94217abb80eb7a5c7de728f9463e4f045fe8a34339f438a50cec
6068f86ff5e6d3a3e100e95fd0ab03a5fb9ebfca9386b2c0ee131361a62526c2
63e0d1cf0ded40281f4b4c439d8c6e6630e3b31acf44d0d198e2513680c4bac9
6643689ff2163b6279edbf3aed8b99f3106da59a96aff78e1fce94a3675777e2
66b4fac9494bbeda177f4637fa3e7423fc8ef54b11a6875e68cdf3e472293b2a
66ba9d76c09ad6dd52135d52c368f6d87ac40b5b4ce418e41a105fb221c7e470
69aea70ed00c6297e407afc0b1ccf6db9629eedc412bf0779467f3e462d346e3
6af036a4ec23088a2e702e364d84320dbcd420a0c8c5ef82bac37006554e3ea6
6cbb1738fe282734c8ddc440165f5debb94786a1ee3cecc6e625d77736cfdb60
7125a66456daa35dd3e3e8cca4b9523e05caf0b4fa5bd5874676e7c6db40f3aa
7209fd168e275adfd11e796e6f7c016890672801090ac0e1b3d9b20634b86bf3
7219936e6e56b9932b2f1dd06cfff09b655a729bb17d0aa6d757e14184512384
726906ee6ce6dfe1b6e35ddad151196c50277e31520de30e916e9cd9affc0ef3
72fe18777ebf37b44d58c82be9b67edceefb88c2c6984c614c72991d6e3b8853
735e44959f60192ae3b93cfafd034f89a1cd8a95510fbac7aabaf9fa05d9465a
765097740b7490e6ab6a2d8624199ab7b147e8c6cec064b6cce257750fdb1985
799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd
803d863cb5984a133a2eda9a6a9b73af5c486f57f1ea53e9e2cb81b50cdf513a
81c836c05ab1f2d37b7aa60d509a656c7a441e2a4fabf035c1b0666a4daa50fa
8292049c0f7e7fc6406874e976ed7e4134d3e34c16a790084b51f48595848aa0
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
835866cae4df18da17dc4e3f4d6ae62967b3e344cc0bfe029fe529ed94ae7dff
843803aeba82f94da6f1cbe1f853ccd12f5d7cc6a3afa20923e57e5df60c412d
88ca677c14d4217c2f6b8c8964a1d172027974c4c0839e4d531ad7d3d6de1987
91b667b9d0de69583ee16753496325f38b91e7f77dcb34a5e49bdca3b670002a
927a4dfeaf290340058fa5d8750e811f5646bded97e8aa8911023a4d02128a11
936bceef72b48206aa1f56e46495f40fbe6f271189ff009c360eedddfcd401f1
9586d0fb1354dd56116ff8e2bf4c54bb5e283cf33abd801f338ef6054c501978
9607506688417bb09b8d6c29362c2fe29bc1b047b793cccddfce876d927fa57b
97829f8a6f2a471117ed06d0b06a81d543b091a262192369c531380779148c5c
97831ff4832c4f000e924a97b5730bebd91816c3282cc2502fca83feebd993a8
979ddb6f0c77e6744b104f96e9d7ab0f8fc56d7f24ab10d853e4e96fa425e9c5
9b9265c69a5cc295d1ab0d04e0273b3677db1a6216ce2ccf4efc8c277ed84b39
9ee63a2ce9251063533d17d87c6a2d7f06f0a3c0e38d8c9f107131ce580c057b
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7
a361dc3431c9d2fe94dee0d4a1b67a57be8fc6ba75dabcfe923e615956277fc2
a41b715cf79c77013461b52b6114c3ed16bcef2bc03d729afd46d5530a3476f4
a4346365d50101106141c16779cf78ea0d9d80f2dca2955c16b6f976580ba568
a8114c77566a7ad15f3e5d9c0812df87648ea047dbd5cd8fc7e81a9901282fdd
a939b9fcb8cdec877464e6131704ef19effd6279467d48bd42afe7af8558391c
ab95872c4726727a3b09b1f8c28490c70b7e407e97fd93bbfb75a2ecc5faac36
ac5000602bb127a5a07be117df96c48667d2e2a9fb1bb33d5ebb7c50e4480a88
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
aec60bc104db041b1512185839f18f52986df7e569e5445f740dd60f763fbca8
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b38803f733f36ff943399e6539b7fe1fa26611706ce6878b5b21c6a4f96ec862
bb40a0a0cec6732e3ed3fb49ad3933f72f441e28585dfaea5e58035f5520709c
bf6c1e2f8c250b7efeb5d250181599880b1c17efc3c94466aa5d847454bf14ef
c6d03b7a5561687268e57b13d9d4a6a4c71ee570ea74718040ce9227676e3e5e
c9130ee8c979a74ab038cf5e8a06db5cb94253eab35ea5242f515d605f4781ad
cb8d40d1eb7e2dc885affcf0012d9e1a73c270d843e8b890d36538e52d0a0342
cfd3099998b0c37ace8024cbd802160585ba9be1c0047fefc172035184f074df
d82231820461c83d1b0966caae71bd2732bd89e9a910fdb90d193c3dca16dbc7
d891455e32c9a425e36e190047b1f58abeb7e3709eff687134ddea7ac9cfdd3b
d8dee5bb67e8a759f73dfbaeadba9220ad478a8187f58a59a50f906b0e51f65b
dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4
dcf9e1d0e7154542773c2fa4d03411173ccbbae60e640cdfb96dda80aff0d78a
df3e003cc30e9bdd0313100e8ee5d468070b4b34d11ad355f276a356d4b9c7bf
e25be07e98d8af6966a317f09b01392cce60447ed768a034ec1b18843ee6dcbc
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e4d41fad643257f1b89daa37cbe8d9c0ce35a9d39a465e126a11311c03c703c2
e5414240e1b04e9d52490a3a54b3fc05978f47ae60cd01e8a61ba799ef0f80df
e6b6cd7a4fc13d7fd71a9b17195f51e5888ba257d487fc6bdde79690fe5f955e
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f903f416e22249cfab4769b65c97a216746ff7d579fc7fa983740943240a9362
f9db6465a204cc4186368b72a0ba4f063e64569aa4fc96e0f40c7ac69423121b
fd222137f245c06ddb4c4d44db41f12138dad6cf8ef5d4d4a5e500f38f0c8c62
fed785a6a8ca96fb67230fec5d85f9c508db49f4075aa0ef284af56cd89813e3