www.seqrite.com Open in urlscan Pro
103.228.50.20 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://www.seqrite.com/blog/uncovering-lockbit-blacks-attack-chain-and-anti-forensic-activity/
Submission: On March 22 via api (March 22nd 2023, 2:05:43 am UTC) from DE — Scanned from DE

Summary HTTP 63 Redirects Links 9 Behaviour Indicators

Summary

This website contacted 10 IPs in 4 countries across 7 domains to perform 63 HTTP transactions. The main IP is 103.228.50.20, located in India and belongs to BALASAINET-AS Balasai Net Pvt. Ltd., IN. The main domain is www.seqrite.com.
TLS certificate: Issued by RapidSSL Global TLS RSA4096 SHA256 20... on December 12th 2022. Valid for: a year.

This is the only time www.seqrite.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
52	103.228.50.20 103.228.50.20	133288 (BALASAINE...) (BALASAINET-AS Balasai Net Pvt. Ltd.)
1	2a00:1450:400... 2a00:1450:4001:827::2008	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:80b::200a	15169 (GOOGLE) (GOOGLE)
2	2606:2800:234... 2606:2800:234:59:254c:406:2366:268c	15133 (EDGECAST) (EDGECAST)
1	2a00:1450:400... 2a00:1450:4001:828::200a	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:813::200e	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:808::2003	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:400c:c0c::9c	15169 (GOOGLE) (GOOGLE)
1	104.244.42.200 104.244.42.200	13414 (TWITTER) (TWITTER)
63	10

52 103.228.50.20 (India)

ASN133288 (BALASAINET-AS Balasai Net Pvt. Ltd., IN)
PTR: 50-20.static-pnq.balasai.com

www.seqrite.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:827::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:80b::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

ajax.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:2800:234:59:254c:406:2366:268c (United States)

ASN15133 (EDGECAST, US)

platform.twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:828::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:813::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:808::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:400c:c0c::9c (Brussels, Belgium)

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.244.42.200 (United States)

ASN13414 (TWITTER, US)

syndication.twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
52	seqrite.com www.seqrite.com	1 MB
3	twitter.com platform.twitter.com — Cisco Umbrella Rank: 771 syndication.twitter.com — Cisco Umbrella Rank: 1148	132 KB
2	google-analytics.com www.google-analytics.com — Cisco Umbrella Rank: 25	20 KB
2	googleapis.com ajax.googleapis.com — Cisco Umbrella Rank: 305 fonts.googleapis.com — Cisco Umbrella Rank: 34	8 KB
1	doubleclick.net stats.g.doubleclick.net — Cisco Umbrella Rank: 76	346 B
1	gstatic.com fonts.gstatic.com	44 KB
1	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 42	44 KB
63	7

	Domain	Requested by
52	www.seqrite.com	www.seqrite.com
2	www.google-analytics.com	www.googletagmanager.com www.google-analytics.com
2	platform.twitter.com	www.seqrite.com platform.twitter.com
1	syndication.twitter.com	platform.twitter.com
1	stats.g.doubleclick.net	www.google-analytics.com
1	fonts.gstatic.com	fonts.googleapis.com
1	fonts.googleapis.com	ajax.googleapis.com
1	ajax.googleapis.com	www.seqrite.com
1	www.googletagmanager.com	www.seqrite.com
63	9

This site contains links to these domains. Also see Links.

Domain
www.facebook.com
twitter.com
www.linkedin.com
plus.google.com
www.youtube.com
api.whatsapp.com
sebsauvage.net
blogs.quickheal.com

Subject Issuer	Validity	Valid
*.seqrite.com RapidSSL Global TLS RSA4096 SHA256 2022 CA1	`2022-12-12` - `2024-01-08`	a year	crt.sh
*.google-analytics.com GTS CA 1C3	`2023-03-06` - `2023-05-29`	3 months	crt.sh
upload.video.google.com GTS CA 1C3	`2023-03-06` - `2023-05-29`	3 months	crt.sh
*.twimg.com DigiCert TLS RSA SHA256 2020 CA1	`2022-10-06` - `2023-11-06`	a year	crt.sh
*.gstatic.com GTS CA 1C3	`2023-03-06` - `2023-05-29`	3 months	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2023-03-02` - `2023-05-25`	3 months	crt.sh
syndication.twitter.com DigiCert TLS Hybrid ECC SHA384 2020 CA1	`2023-02-05` - `2024-02-05`	a year	crt.sh

This page contains 2 frames:

Primary Page: https://www.seqrite.com/blog/uncovering-lockbit-blacks-attack-chain-and-anti-forensic-activity/
Frame ID: 8DE9F2CBA91FABF5228323ECF95C0128
Requests: 65 HTTP requests in this frame

Frame: https://platform.twitter.com/widgets/widget_iframe.2b2d73daf636805223fb11d48f3e94f7.html?origin=https%3A%2F%2Fwww.seqrite.com
Frame ID: 3C88D43FEA495FC09952F818686BFB82
Requests: 2 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Uncovering LockBit Black’s Attack Chain and Anti-forensic activity

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

<link rel=["']stylesheet["'] [^>]+/wp-(?:content|includes)/
/wp-(?:content|includes)/
wp-embed\.min\.js\?ver=([\d.]+)

Yoast SEO (SEO) Expand

Overall confidence: 100%
Detected patterns

<!-- This site is optimized with the Yoast (?:WordPress )?SEO plugin v([\d.]+) -

Font Awesome (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]+(?:([\d.]+)/)?(?:css/)?font-awesome(?:\.min)?\.css
<link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

google-analytics\.com/(?:ga|urchin|analytics)\.js

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

googleapis\.com/.+webfont

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtag/js

Twitter (Widgets) Expand

Overall confidence: 100%
Detected patterns

//platform\.twitter\.com/widgets\.js

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

jQuery Migrate (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]migrate(?:-([\d.]+))?(?:\.min)?\.js(?:\?ver=([\d.]+))?

Page Statistics

63
Requests

98 %
HTTPS

78 %
IPv6

7
Domains

9
Subdomains

10
IPs

4
Countries

1723 kB
Transfer

2589 kB
Size

4
Cookies

9 Outgoing links

These are links going to different origins than the main page.

URL: https://www.facebook.com/seqrite

Search URL Search Domain Scan URL

URL: https://twitter.com/Seqrite

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/company/seqrite

Search URL Search Domain Scan URL

URL: https://plus.google.com/114969253508422817802/posts

Search URL Search Domain Scan URL

URL: https://www.youtube.com/channel/UCPgS-p40ag_l8i3mhMWW7Gg

Search URL Search Domain Scan URL

URL: https://api.whatsapp.com/send?text=Uncovering%20LockBit%20Black%27s%20Attack%20Chain%20and%20Anti-forensic%20activity%20https%3A%2F%2Fwww.seqrite.com%2Fblog%2Funcovering-lockbit-blacks-attack-chain-and-anti-forensic-activity%2F

Search URL Search Domain Scan URL

URL: https://sebsauvage.net/paste/?b0443b90f3fc5ffc#UomoaFa+vkJS9tcLpJwcH1X38YjfbBZDDf3BBk1abPE=
Title: Events Cleared

Search URL Search Domain Scan URL

URL: https://sebsauvage.net/paste/?8531b9e9ff63f646#2I+OdDt1RxWVhkUJ1HFTCj9g8boqMcrpkfU0ESMJ03Y=
Title: Tasks Killed

Search URL Search Domain Scan URL

URL: https://blogs.quickheal.com/proactive-measures-to-safeguard-against-the-ransomware-menace/
Title: proactive measures

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

63 HTTP transactions
4 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request / Show response
www.seqrite.com/blog/uncovering-lockbit-blacks-attack-chain-and-anti-forensic-activity/ 107 KB
25 KB 2798ms
1337ms Document
text/html 103.228.50.20
BALASAINET-AS Bal...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.seqrite.com/blog/uncovering-lockbit-blacks-attack-chain-and-anti-forensic-activity/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

103.228.50.20 , India, ASN133288 (BALASAINET-AS Balasai Net Pvt. Ltd., IN),

Reverse DNS

50-20.static-pnq.balasai.com

Software

Apache / PHP/5.3.14 ZendServer/5.0

Resource Hash

635c08873c57f14c85adb8851c342eaa54c7cf17e00cd6b445fb6537ff821364

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Cache-Control: max-age=2592000, private, must-revalidate
Connection: keep-alive, Keep-Alive
Content-Encoding: gzip
Content-Length: 24074
Content-Security-Policy: upgrade-insecure-requests
Content-Type: text/html; charset=UTF-8
Date: Wed, 22 Mar 2023 01:10:02 GMT
Expires: Fri, 21 Apr 2023 01:10:02 GMT
Keep-Alive: timeout=15, max=100
Link: <https://www.seqrite.com/blog/wp-json/>; rel="https://api.w.org/" <https://www.seqrite.com/blog/?p=5541>; rel=shortlink
Permissions-Policy: geolocation=(); midi=();notifications=();push=();sync-xhr=();accelerometer=(); gyroscope=(); magnetometer=(); payment=(); camera=(); microphone=();usb=(); xr=();speaker=(self);vibrate=();fullscreen=(self);
Referrer-Policy: no-referrer-when-downgrade
Server: Apache
Strict-Transport-Security: max-age=63072000; includeSubDomains
Vary: Accept-Encoding,User-Agent
X-Content-Type-Options: nosniff
X-Frame-Options: ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
X-Pingback: https://www.seqrite.com/blog/xmlrpc.php
X-Powered-By: PHP/5.3.14 ZendServer/5.0
X-XSS-Protection: 1; mode=block

GET
H/1.1 200
OK font-awesome.css
www.seqrite.com/blog/wp-content/themes/goblog/css/ 28 KB
7 KB 311ms
305ms Stylesheet
text/css 103.228.50.20
BALASAINET-AS Bal...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.seqrite.com/blog/wp-content/themes/goblog/css/font-awesome.css

Requested by

Host: www.seqrite.com
URL: https://www.seqrite.com/blog/uncovering-lockbit-blacks-attack-chain-and-anti-forensic-activity/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

103.228.50.20 , India, ASN133288 (BALASAINET-AS Balasai Net Pvt. Ltd., IN),

Reverse DNS

50-20.static-pnq.balasai.com

Software

Apache /

Resource Hash

6f20c872577786195e3973e8b5f2f9063214f32171ccf196b90c4710b9df99ee

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.seqrite.com/blog/uncovering-lockbit-blacks-attack-chain-and-anti-forensic-activity/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

Date: Wed, 22 Mar 2023 01:10:04 GMT
Strict-Transport-Security: max-age=63072000; includeSubDomains
Content-Encoding: gzip
Content-Security-Policy: upgrade-insecure-requests
X-Content-Type-Options: nosniff
Connection: keep-alive, Keep-Alive
Content-Length: 5376
X-XSS-Protection: 1; mode=block
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Wed, 16 Feb 2022 06:49:58 GMT
Server: Apache
Vary: Accept-Encoding,User-Agent
X-Frame-Options: ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
Content-Type: text/css
Cache-Control: max-age=2592000, public
Permissions-Policy: geolocation=(); midi=();notifications=();push=();sync-xhr=();accelerometer=(); gyroscope=(); magnetometer=(); payment=(); camera=(); microphone=();usb=(); xr=();speaker=(self);vibrate=();fullscreen=(self);
Accept-Ranges: bytes
Keep-Alive: timeout=15, max=100
Expires: Fri, 21 Apr 2023 01:10:04 GMT

GET
H/1.1 200
OK email-subscribers-public.css
www.seqrite.com/blog/wp-content/plugins/email-subscribers/public/css/ 807 B
2 KB 596ms
301ms Stylesheet
text/css 103.228.50.20
BALASAINET-AS Bal...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.seqrite.com/blog/wp-content/plugins/email-subscribers/public/css/email-subscribers-public.css

Requested by

Host: www.seqrite.com
URL: https://www.seqrite.com/blog/uncovering-lockbit-blacks-attack-chain-and-anti-forensic-activity/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

103.228.50.20 , India, ASN133288 (BALASAINET-AS Balasai Net Pvt. Ltd., IN),

Reverse DNS

50-20.static-pnq.balasai.com

Software

Apache /

Resource Hash

f84eb4571c0eb40823ed47af468684cc9703ecfc89f6a38e569a470d504a3504

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.seqrite.com/blog/uncovering-lockbit-blacks-attack-chain-and-anti-forensic-activity/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

Date: Wed, 22 Mar 2023 01:10:04 GMT
Strict-Transport-Security: max-age=63072000; includeSubDomains
Content-Encoding: gzip
Content-Security-Policy: upgrade-insecure-requests
X-Content-Type-Options: nosniff
Connection: keep-alive, Keep-Alive
Content-Length: 363
X-XSS-Protection: 1; mode=block
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Mon, 05 Aug 2019 06:40:46 GMT
Server: Apache
Vary: Accept-Encoding,User-Agent
X-Frame-Options: ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
Content-Type: text/css
Cache-Control: max-age=2592000, public
Permissions-Policy: geolocation=(); midi=();notifications=();push=();sync-xhr=();accelerometer=(); gyroscope=(); magnetometer=(); payment=(); camera=(); microphone=();usb=(); xr=();speaker=(self);vibrate=();fullscreen=(self);
Accept-Ranges: bytes
Keep-Alive: timeout=15, max=99
Expires: Fri, 21 Apr 2023 01:10:04 GMT

GET
H/1.1 200
OK style.css
www.seqrite.com/blog/wp-content/themes/goblog/ 73 KB
17 KB 622ms
307ms Stylesheet
text/css 103.228.50.20
BALASAINET-AS Bal...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.seqrite.com/blog/wp-content/themes/goblog/style.css?ver=4.8.3

Requested by

Host: www.seqrite.com
URL: https://www.seqrite.com/blog/uncovering-lockbit-blacks-attack-chain-and-anti-forensic-activity/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

103.228.50.20 , India, ASN133288 (BALASAINET-AS Balasai Net Pvt. Ltd., IN),

Reverse DNS

50-20.static-pnq.balasai.com

Software

Apache /

Resource Hash

66190b77ffc756b5432c16887dbc3c7a0f751e7fe1128e1cb6de8725d2b463f1

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.seqrite.com/blog/uncovering-lockbit-blacks-attack-chain-and-anti-forensic-activity/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

Date: Wed, 22 Mar 2023 01:10:04 GMT
Strict-Transport-Security: max-age=63072000; includeSubDomains
Content-Encoding: gzip
Content-Security-Policy: upgrade-insecure-requests
X-Content-Type-Options: nosniff
Connection: keep-alive, Keep-Alive
Content-Length: 15498
X-XSS-Protection: 1; mode=block
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Thu, 29 Sep 2022 06:28:54 GMT
Server: Apache
Vary: Accept-Encoding,User-Agent
X-Frame-Options: ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
Content-Type: text/css
Cache-Control: max-age=2592000, public
Permissions-Policy: geolocation=(); midi=();notifications=();push=();sync-xhr=();accelerometer=(); gyroscope=(); magnetometer=(); payment=(); camera=(); microphone=();usb=(); xr=();speaker=(self);vibrate=();fullscreen=(self);
Accept-Ranges: bytes
Keep-Alive: timeout=15, max=99
Expires: Fri, 21 Apr 2023 01:10:04 GMT

GET
H/1.1 200
OK magnific-popup.css
www.seqrite.com/blog/wp-content/themes/goblog/css/ 8 KB
3 KB 880ms
293ms Stylesheet
text/css 103.228.50.20
BALASAINET-AS Bal...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.seqrite.com/blog/wp-content/themes/goblog/css/magnific-popup.css?ver=4.8.3

Requested by

Host: www.seqrite.com
URL: https://www.seqrite.com/blog/uncovering-lockbit-blacks-attack-chain-and-anti-forensic-activity/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

103.228.50.20 , India, ASN133288 (BALASAINET-AS Balasai Net Pvt. Ltd., IN),

Reverse DNS

50-20.static-pnq.balasai.com

Software

Apache /

Resource Hash

0fbf945eae1c5869be401c6db68da93f5a47f2c1ff6072151ebb4b2dea6d4f62

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.seqrite.com/blog/uncovering-lockbit-blacks-attack-chain-and-anti-forensic-activity/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

Date: Wed, 22 Mar 2023 01:10:04 GMT
Strict-Transport-Security: max-age=63072000; includeSubDomains
Content-Encoding: gzip
Content-Security-Policy: upgrade-insecure-requests
X-Content-Type-Options: nosniff
Connection: keep-alive, Keep-Alive
Content-Length: 1936
X-XSS-Protection: 1; mode=block
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Thu, 25 Feb 2016 09:40:14 GMT
Server: Apache
Vary: Accept-Encoding,User-Agent
X-Frame-Options: ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
Content-Type: text/css
Cache-Control: max-age=2592000, public
Permissions-Policy: geolocation=(); midi=();notifications=();push=();sync-xhr=();accelerometer=(); gyroscope=(); magnetometer=(); payment=(); camera=(); microphone=();usb=(); xr=();speaker=(self);vibrate=();fullscreen=(self);
Accept-Ranges: bytes
Keep-Alive: timeout=15, max=100
Expires: Fri, 21 Apr 2023 01:10:04 GMT

GET
H/1.1 200
OK responsive.css
www.seqrite.com/blog/wp-content/themes/goblog/css/ 13 KB
5 KB 892ms
298ms Stylesheet
text/css 103.228.50.20
BALASAINET-AS Bal...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.seqrite.com/blog/wp-content/themes/goblog/css/responsive.css?ver=4.8.3

Requested by

Host: www.seqrite.com
URL: https://www.seqrite.com/blog/uncovering-lockbit-blacks-attack-chain-and-anti-forensic-activity/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

103.228.50.20 , India, ASN133288 (BALASAINET-AS Balasai Net Pvt. Ltd., IN),

Reverse DNS

50-20.static-pnq.balasai.com

Software

Apache /

Resource Hash

93754643da5a46ca1b7e1f6ba4378655974e11e1cbb432e8c5cbf54804b722bc

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.seqrite.com/blog/uncovering-lockbit-blacks-attack-chain-and-anti-forensic-activity/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

Date: Wed, 22 Mar 2023 01:10:04 GMT
Strict-Transport-Security: max-age=63072000; includeSubDomains
Content-Encoding: gzip
Content-Security-Policy: upgrade-insecure-requests
X-Content-Type-Options: nosniff
Connection: keep-alive, Keep-Alive
Content-Length: 3334
X-XSS-Protection: 1; mode=block
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Thu, 25 Feb 2016 09:40:14 GMT
Server: Apache
Vary: Accept-Encoding,User-Agent
X-Frame-Options: ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
Content-Type: text/css
Cache-Control: max-age=2592000, public
Permissions-Policy: geolocation=(); midi=();notifications=();push=();sync-xhr=();accelerometer=(); gyroscope=(); magnetometer=(); payment=(); camera=(); microphone=();usb=(); xr=();speaker=(self);vibrate=();fullscreen=(self);
Accept-Ranges: bytes
Keep-Alive: timeout=15, max=98
Expires: Fri, 21 Apr 2023 01:10:04 GMT

GET
H/1.1 200
OK wpp.css
www.seqrite.com/blog/wp-content/plugins/wordpress-popular-posts/style/ 889 B
2 KB 907ms
301ms Stylesheet
text/css 103.228.50.20
BALASAINET-AS Bal...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.seqrite.com/blog/wp-content/plugins/wordpress-popular-posts/style/wpp.css?ver=3.2.2

Requested by

Host: www.seqrite.com
URL: https://www.seqrite.com/blog/uncovering-lockbit-blacks-attack-chain-and-anti-forensic-activity/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

103.228.50.20 , India, ASN133288 (BALASAINET-AS Balasai Net Pvt. Ltd., IN),

Reverse DNS

50-20.static-pnq.balasai.com

Software

Apache /

Resource Hash

b4ae8ad8c560bb87aa8fe03d597e2a69eef809072a35415d32ba68757e13ece6

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.seqrite.com/blog/uncovering-lockbit-blacks-attack-chain-and-anti-forensic-activity/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

Date: Wed, 22 Mar 2023 01:10:04 GMT
Strict-Transport-Security: max-age=63072000; includeSubDomains
Content-Encoding: gzip
Content-Security-Policy: upgrade-insecure-requests
X-Content-Type-Options: nosniff
Connection: keep-alive, Keep-Alive
Content-Length: 433
X-XSS-Protection: 1; mode=block
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Thu, 25 Feb 2016 09:41:46 GMT
Server: Apache
Vary: Accept-Encoding,User-Agent
X-Frame-Options: ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
Content-Type: text/css
Cache-Control: max-age=2592000, public
Permissions-Policy: geolocation=(); midi=();notifications=();push=();sync-xhr=();accelerometer=(); gyroscope=(); magnetometer=(); payment=(); camera=(); microphone=();usb=(); xr=();speaker=(self);vibrate=();fullscreen=(self);
Accept-Ranges: bytes
Keep-Alive: timeout=15, max=100
Expires: Fri, 21 Apr 2023 01:10:04 GMT

GET
H/1.1 200
OK sassy-social-share-public.css
www.seqrite.com/blog/wp-content/plugins/sassy-social-share/public/css/ 30 KB
10 KB 910ms
302ms Stylesheet
text/css 103.228.50.20
BALASAINET-AS Bal...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.seqrite.com/blog/wp-content/plugins/sassy-social-share/public/css/sassy-social-share-public.css?ver=3.2.3

Requested by

Host: www.seqrite.com
URL: https://www.seqrite.com/blog/uncovering-lockbit-blacks-attack-chain-and-anti-forensic-activity/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

103.228.50.20 , India, ASN133288 (BALASAINET-AS Balasai Net Pvt. Ltd., IN),

Reverse DNS

50-20.static-pnq.balasai.com

Software

Apache /

Resource Hash

680a80d356565114378e038218e6971571fb76e54ff0530999d38f2b3c99368f

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.seqrite.com/blog/uncovering-lockbit-blacks-attack-chain-and-anti-forensic-activity/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

Date: Wed, 22 Mar 2023 01:10:04 GMT
Strict-Transport-Security: max-age=63072000; includeSubDomains
Content-Encoding: gzip
Content-Security-Policy: upgrade-insecure-requests
X-Content-Type-Options: nosniff
Connection: keep-alive, Keep-Alive
Content-Length: 8569
X-XSS-Protection: 1; mode=block
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Tue, 03 Jul 2018 09:32:39 GMT
Server: Apache
Vary: Accept-Encoding,User-Agent
X-Frame-Options: ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
Content-Type: text/css
Cache-Control: max-age=2592000, public
Permissions-Policy: geolocation=(); midi=();notifications=();push=();sync-xhr=();accelerometer=(); gyroscope=(); magnetometer=(); payment=(); camera=(); microphone=();usb=(); xr=();speaker=(self);vibrate=();fullscreen=(self);
Accept-Ranges: bytes
Keep-Alive: timeout=15, max=100
Expires: Fri, 21 Apr 2023 01:10:04 GMT

GET
H/1.1 200
OK sassy-social-share-svg.css
www.seqrite.com/blog/wp-content/plugins/sassy-social-share/admin/css/ 117 KB
37 KB 917ms
309ms Stylesheet
text/css 103.228.50.20
BALASAINET-AS Bal...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.seqrite.com/blog/wp-content/plugins/sassy-social-share/admin/css/sassy-social-share-svg.css?ver=3.2.3

Requested by

Host: www.seqrite.com
URL: https://www.seqrite.com/blog/uncovering-lockbit-blacks-attack-chain-and-anti-forensic-activity/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

103.228.50.20 , India, ASN133288 (BALASAINET-AS Balasai Net Pvt. Ltd., IN),

Reverse DNS

50-20.static-pnq.balasai.com

Software

Apache /

Resource Hash

1c5fe2a18d6a2a223e6b8ee3f1876e841873b9235e2f170226eb583e073f587c

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.seqrite.com/blog/uncovering-lockbit-blacks-attack-chain-and-anti-forensic-activity/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

Date: Wed, 22 Mar 2023 01:10:04 GMT
Strict-Transport-Security: max-age=63072000; includeSubDomains
Content-Encoding: gzip
Content-Security-Policy: upgrade-insecure-requests
X-Content-Type-Options: nosniff
Connection: keep-alive, Keep-Alive
Content-Length: 36679
X-XSS-Protection: 1; mode=block
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Tue, 03 Jul 2018 09:32:39 GMT
Server: Apache
Vary: Accept-Encoding,User-Agent
X-Frame-Options: ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
Content-Type: text/css
Cache-Control: max-age=2592000, public
Permissions-Policy: geolocation=(); midi=();notifications=();push=();sync-xhr=();accelerometer=(); gyroscope=(); magnetometer=(); payment=(); camera=(); microphone=();usb=(); xr=();speaker=(self);vibrate=();fullscreen=(self);
Accept-Ranges: bytes
Keep-Alive: timeout=15, max=100
Expires: Fri, 21 Apr 2023 01:10:04 GMT

GET
H/1.1 200
OK jquery-3.6.0.min.js Show response
www.seqrite.com/blog/wp-content/plugins/jquery-updater/js/ 87 KB
32 KB 1177ms
297ms Script
text/javascript 103.228.50.20
BALASAINET-AS Bal...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.seqrite.com/blog/wp-content/plugins/jquery-updater/js/jquery-3.6.0.min.js?ver=4.8.3

Requested by

Host: www.seqrite.com
URL: https://www.seqrite.com/blog/uncovering-lockbit-blacks-attack-chain-and-anti-forensic-activity/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

103.228.50.20 , India, ASN133288 (BALASAINET-AS Balasai Net Pvt. Ltd., IN),

Reverse DNS

50-20.static-pnq.balasai.com

Software

Apache /

Resource Hash

ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.seqrite.com/blog/uncovering-lockbit-blacks-attack-chain-and-anti-forensic-activity/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

Date: Wed, 22 Mar 2023 01:10:04 GMT
Strict-Transport-Security: max-age=63072000; includeSubDomains
Content-Encoding: gzip
Content-Security-Policy: upgrade-insecure-requests
X-Content-Type-Options: nosniff
Connection: keep-alive, Keep-Alive
Content-Length: 30902
X-XSS-Protection: 1; mode=block
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Tue, 22 Jun 2021 11:50:20 GMT
Server: Apache
Vary: Accept-Encoding,User-Agent
X-Frame-Options: ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
Content-Type: text/javascript
Cache-Control: max-age=2592000, private
Permissions-Policy: geolocation=(); midi=();notifications=();push=();sync-xhr=();accelerometer=(); gyroscope=(); magnetometer=(); payment=(); camera=(); microphone=();usb=(); xr=();speaker=(self);vibrate=();fullscreen=(self);
Accept-Ranges: bytes
Keep-Alive: timeout=15, max=99
Expires: Fri, 21 Apr 2023 01:10:04 GMT

GET
H/1.1 200
OK jquery-migrate-3.3.2.min.js Show response
www.seqrite.com/blog/wp-content/plugins/jquery-updater/js/ 11 KB
6 KB 1190ms
298ms Script
text/javascript 103.228.50.20
BALASAINET-AS Bal...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.seqrite.com/blog/wp-content/plugins/jquery-updater/js/jquery-migrate-3.3.2.min.js?ver=4.8.3

Requested by

Host: www.seqrite.com
URL: https://www.seqrite.com/blog/uncovering-lockbit-blacks-attack-chain-and-anti-forensic-activity/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

103.228.50.20 , India, ASN133288 (BALASAINET-AS Balasai Net Pvt. Ltd., IN),

Reverse DNS

50-20.static-pnq.balasai.com

Software

Apache /

Resource Hash

f7e248392cea6eed6651423f5b9a4adafec5b15921a2f16ec54e1012be0aaee5

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.seqrite.com/blog/uncovering-lockbit-blacks-attack-chain-and-anti-forensic-activity/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

Date: Wed, 22 Mar 2023 01:10:04 GMT
Strict-Transport-Security: max-age=63072000; includeSubDomains
Content-Encoding: gzip
Content-Security-Policy: upgrade-insecure-requests
X-Content-Type-Options: nosniff
Connection: keep-alive, Keep-Alive
Content-Length: 4170
X-XSS-Protection: 1; mode=block
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Tue, 22 Jun 2021 11:50:20 GMT
Server: Apache
Vary: Accept-Encoding,User-Agent
X-Frame-Options: ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
Content-Type: text/javascript
Cache-Control: max-age=2592000, private
Permissions-Policy: geolocation=(); midi=();notifications=();push=();sync-xhr=();accelerometer=(); gyroscope=(); magnetometer=(); payment=(); camera=(); microphone=();usb=(); xr=();speaker=(self);vibrate=();fullscreen=(self);
Accept-Ranges: bytes
Keep-Alive: timeout=15, max=97
Expires: Fri, 21 Apr 2023 01:10:04 GMT

GET
H/1.1 200
OK email-subscribers-public.js Show response
www.seqrite.com/blog/wp-content/plugins/email-subscribers/public/js/ 3 KB
3 KB 1208ms
301ms Script
text/javascript 103.228.50.20
BALASAINET-AS Bal...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.seqrite.com/blog/wp-content/plugins/email-subscribers/public/js/email-subscribers-public.js

Requested by

Host: www.seqrite.com
URL: https://www.seqrite.com/blog/uncovering-lockbit-blacks-attack-chain-and-anti-forensic-activity/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

103.228.50.20 , India, ASN133288 (BALASAINET-AS Balasai Net Pvt. Ltd., IN),

Reverse DNS

50-20.static-pnq.balasai.com

Software

Apache /

Resource Hash

34e35f893b634d5439db39f3c4f202ddc21aaf406e5724e8c118d513f086752f

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.seqrite.com/blog/uncovering-lockbit-blacks-attack-chain-and-anti-forensic-activity/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

Date: Wed, 22 Mar 2023 01:10:04 GMT
Strict-Transport-Security: max-age=63072000; includeSubDomains
Content-Encoding: gzip
Content-Security-Policy: upgrade-insecure-requests
X-Content-Type-Options: nosniff
Connection: keep-alive, Keep-Alive
Content-Length: 1458
X-XSS-Protection: 1; mode=block
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Mon, 05 Aug 2019 06:40:50 GMT
Server: Apache
Vary: Accept-Encoding,User-Agent
X-Frame-Options: ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
Content-Type: text/javascript
Cache-Control: max-age=2592000, private
Permissions-Policy: geolocation=(); midi=();notifications=();push=();sync-xhr=();accelerometer=(); gyroscope=(); magnetometer=(); payment=(); camera=(); microphone=();usb=(); xr=();speaker=(self);vibrate=();fullscreen=(self);
Accept-Ranges: bytes
Keep-Alive: timeout=15, max=99
Expires: Fri, 21 Apr 2023 01:10:04 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 112 KB
44 KB 174ms
52ms Script
application/javascript 2a00:1450:4001:827::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=UA-104093208-1

Requested by

Host: www.seqrite.com
URL: https://www.seqrite.com/blog/uncovering-lockbit-blacks-attack-chain-and-anti-forensic-activity/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

1ab4898c7aa4bb6dd96637f795e2c9f92cbef410697e3386e6a30f6bca53ccb1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.seqrite.com/blog/uncovering-lockbit-blacks-attack-chain-and-anti-forensic-activity/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date: Wed, 22 Mar 2023 02:05:35 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 44695
x-xss-protection: 0
last-modified: Wed, 22 Mar 2023 01:06:31 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Wed, 22 Mar 2023 02:05:35 GMT

GET
H/1.1 200
OK seqrite_logo.jpg
www.seqrite.com/blog/wp-content/uploads/2019/02/ 4 KB
6 KB 539ms
293ms Image
image/jpeg 103.228.50.20
BALASAINET-AS Bal...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.seqrite.com/blog/wp-content/uploads/2019/02/seqrite_logo.jpg

Requested by

Host: www.seqrite.com
URL: https://www.seqrite.com/blog/uncovering-lockbit-blacks-attack-chain-and-anti-forensic-activity/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

103.228.50.20 , India, ASN133288 (BALASAINET-AS Balasai Net Pvt. Ltd., IN),

Reverse DNS

50-20.static-pnq.balasai.com

Software

Apache /

Resource Hash

3d602bd6510bdbcbcdb3e9fdcd9d23ab1bb0a44a41a2ecbc4d0daa55698e9c63

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.seqrite.com/blog/uncovering-lockbit-blacks-attack-chain-and-anti-forensic-activity/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

Date: Wed, 22 Mar 2023 01:10:05 GMT
Strict-Transport-Security: max-age=63072000; includeSubDomains
X-Content-Type-Options: nosniff
Content-Security-Policy: upgrade-insecure-requests
Connection: keep-alive, Keep-Alive
Content-Length: 4447
X-XSS-Protection: 1; mode=block
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Mon, 04 Feb 2019 14:13:54 GMT
Server: Apache
X-Frame-Options: ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
Content-Type: image/jpeg
Cache-Control: max-age=31536000, public
Permissions-Policy: geolocation=(); midi=();notifications=();push=();sync-xhr=();accelerometer=(); gyroscope=(); magnetometer=(); payment=(); camera=(); microphone=();usb=(); xr=();speaker=(self);vibrate=();fullscreen=(self);
Accept-Ranges: bytes
Keep-Alive: timeout=15, max=97
Expires: Thu, 21 Mar 2024 01:10:05 GMT

GET
H2 200 webfont.js Show response
ajax.googleapis.com/ajax/libs/webfont/1.5.3/ 17 KB
7 KB 160ms
37ms Script
text/javascript 2a00:1450:4001:80b::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.googleapis.com/ajax/libs/webfont/1.5.3/webfont.js

Requested by

Host: www.seqrite.com
URL: https://www.seqrite.com/blog/uncovering-lockbit-blacks-attack-chain-and-anti-forensic-activity/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

36ef095d011c4ced97b0acef551ca36d76b95299518595dc1acab792a2344601

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.seqrite.com/blog/uncovering-lockbit-blacks-attack-chain-and-anti-forensic-activity/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date: Fri, 17 Mar 2023 14:43:43 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 386512
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6791
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 19:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="hosted-libraries-pushers"
vary: Accept-Encoding
report-to: {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 16 Mar 2024 14:43:43 GMT

GET
H/1.1 200
OK lockbit-3.0-SQ-770x360.jpg
www.seqrite.com/blog/wp-content/uploads/2022/08/ 32 KB
33 KB 576ms
301ms Image
image/jpeg 103.228.50.20
BALASAINET-AS Bal...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.seqrite.com/blog/wp-content/uploads/2022/08/lockbit-3.0-SQ-770x360.jpg

Requested by

Host: www.seqrite.com
URL: https://www.seqrite.com/blog/uncovering-lockbit-blacks-attack-chain-and-anti-forensic-activity/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

103.228.50.20 , India, ASN133288 (BALASAINET-AS Balasai Net Pvt. Ltd., IN),

Reverse DNS

50-20.static-pnq.balasai.com

Software

Apache /

Resource Hash

c23b261e4ef182b41e08e4d1f842b43380435b47d901047b1d4efa147b3392fb

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.seqrite.com/blog/uncovering-lockbit-blacks-attack-chain-and-anti-forensic-activity/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

Date: Wed, 22 Mar 2023 01:10:05 GMT
Strict-Transport-Security: max-age=63072000; includeSubDomains
X-Content-Type-Options: nosniff
Content-Security-Policy: upgrade-insecure-requests
Connection: keep-alive, Keep-Alive
Content-Length: 32440
X-XSS-Protection: 1; mode=block
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Wed, 10 Aug 2022 11:29:25 GMT
Server: Apache
X-Frame-Options: ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
Content-Type: image/jpeg
Cache-Control: max-age=31536000, public
Permissions-Policy: geolocation=(); midi=();notifications=();push=();sync-xhr=();accelerometer=(); gyroscope=(); magnetometer=(); payment=(); camera=(); microphone=();usb=(); xr=();speaker=(self);vibrate=();fullscreen=(self);
Accept-Ranges: bytes
Keep-Alive: timeout=15, max=98
Expires: Thu, 21 Mar 2024 01:10:05 GMT

GET
H/1.1 200
OK Profile_Image-150x150.jpg
www.seqrite.com/blog/wp-content/uploads/2022/07/ 5 KB
6 KB 833ms
293ms Image
image/jpeg 103.228.50.20
BALASAINET-AS Bal...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.seqrite.com/blog/wp-content/uploads/2022/07/Profile_Image-150x150.jpg

Requested by

Host: www.seqrite.com
URL: https://www.seqrite.com/blog/uncovering-lockbit-blacks-attack-chain-and-anti-forensic-activity/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

103.228.50.20 , India, ASN133288 (BALASAINET-AS Balasai Net Pvt. Ltd., IN),

Reverse DNS

50-20.static-pnq.balasai.com

Software

Apache /

Resource Hash

ca1f8476f46a20514a230649a5528e4af4d3656d421294c38d1f2e51e057cac5

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.seqrite.com/blog/uncovering-lockbit-blacks-attack-chain-and-anti-forensic-activity/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

Date: Wed, 22 Mar 2023 01:10:06 GMT
Strict-Transport-Security: max-age=63072000; includeSubDomains
X-Content-Type-Options: nosniff
Content-Security-Policy: upgrade-insecure-requests
Connection: keep-alive, Keep-Alive
Content-Length: 4784
X-XSS-Protection: 1; mode=block
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Tue, 19 Jul 2022 09:27:40 GMT
Server: Apache
X-Frame-Options: ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
Content-Type: image/jpeg
Cache-Control: max-age=31536000, public
Permissions-Policy: geolocation=(); midi=();notifications=();push=();sync-xhr=();accelerometer=(); gyroscope=(); magnetometer=(); payment=(); camera=(); microphone=();usb=(); xr=();speaker=(self);vibrate=();fullscreen=(self);
Accept-Ranges: bytes
Keep-Alive: timeout=15, max=96
Expires: Thu, 21 Mar 2024 01:10:06 GMT

GET
H/1.1 200
OK lockbit3.drawio-1.png
www.seqrite.com/blog/wp-content/uploads/2023/01/ 27 KB
28 KB 889ms
614ms Image
image/png 103.228.50.20
BALASAINET-AS Bal...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.seqrite.com/blog/wp-content/uploads/2023/01/lockbit3.drawio-1.png

Requested by

Host: www.seqrite.com
URL: https://www.seqrite.com/blog/uncovering-lockbit-blacks-attack-chain-and-anti-forensic-activity/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

103.228.50.20 , India, ASN133288 (BALASAINET-AS Balasai Net Pvt. Ltd., IN),

Reverse DNS

50-20.static-pnq.balasai.com

Software

Apache /

Resource Hash

dab5edff54eb8164a1f8af158d11fd370c58809db85578c3b22b8fac1798ae0c

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.seqrite.com/blog/uncovering-lockbit-blacks-attack-chain-and-anti-forensic-activity/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

Date: Wed, 22 Mar 2023 01:10:05 GMT
Strict-Transport-Security: max-age=63072000; includeSubDomains
X-Content-Type-Options: nosniff
Content-Security-Policy: upgrade-insecure-requests
Connection: keep-alive, Keep-Alive
Content-Length: 27441
X-XSS-Protection: 1; mode=block
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Tue, 31 Jan 2023 13:49:48 GMT
Server: Apache
X-Frame-Options: ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
Content-Type: image/png
Cache-Control: max-age=31536000, public
Permissions-Policy: geolocation=(); midi=();notifications=();push=();sync-xhr=();accelerometer=(); gyroscope=(); magnetometer=(); payment=(); camera=(); microphone=();usb=(); xr=();speaker=(self);vibrate=();fullscreen=(self);
Accept-Ranges: bytes
Keep-Alive: timeout=15, max=97
Expires: Thu, 21 Mar 2024 01:10:05 GMT

GET
H/1.1 200
OK decrypt_func_2-768x564.png
www.seqrite.com/blog/wp-content/uploads/2023/01/ 289 KB
291 KB 417ms
417ms Image
image/png 103.228.50.20
BALASAINET-AS Bal...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.seqrite.com/blog/wp-content/uploads/2023/01/decrypt_func_2-768x564.png

Requested by

Host: www.seqrite.com
URL: https://www.seqrite.com/blog/uncovering-lockbit-blacks-attack-chain-and-anti-forensic-activity/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

103.228.50.20 , India, ASN133288 (BALASAINET-AS Balasai Net Pvt. Ltd., IN),

Reverse DNS

50-20.static-pnq.balasai.com

Software

Apache /

Resource Hash

5f558acf8cdf920788c9e18caee1457c4d4e0d3232eae0a90b3d8c1334be0abb

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.seqrite.com/blog/uncovering-lockbit-blacks-attack-chain-and-anti-forensic-activity/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

Date: Wed, 22 Mar 2023 01:10:06 GMT
Strict-Transport-Security: max-age=63072000; includeSubDomains
X-Content-Type-Options: nosniff
Content-Security-Policy: upgrade-insecure-requests
Connection: keep-alive, Keep-Alive
Content-Length: 296441
X-XSS-Protection: 1; mode=block
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Tue, 31 Jan 2023 13:40:53 GMT
Server: Apache
X-Frame-Options: ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
Content-Type: image/png
Cache-Control: max-age=31536000, public
Permissions-Policy: geolocation=(); midi=();notifications=();push=();sync-xhr=();accelerometer=(); gyroscope=(); magnetometer=(); payment=(); camera=(); microphone=();usb=(); xr=();speaker=(self);vibrate=();fullscreen=(self);
Accept-Ranges: bytes
Keep-Alive: timeout=15, max=96
Expires: Thu, 21 Mar 2024 01:10:06 GMT

GET
H/1.1 200
OK win32api.png
www.seqrite.com/blog/wp-content/uploads/2023/01/ 18 KB
20 KB 398ms
398ms Image
image/png 103.228.50.20
BALASAINET-AS Bal...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.seqrite.com/blog/wp-content/uploads/2023/01/win32api.png

Requested by

Host: www.seqrite.com
URL: https://www.seqrite.com/blog/uncovering-lockbit-blacks-attack-chain-and-anti-forensic-activity/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

103.228.50.20 , India, ASN133288 (BALASAINET-AS Balasai Net Pvt. Ltd., IN),

Reverse DNS

50-20.static-pnq.balasai.com

Software

Apache /

Resource Hash

e9341f1e94a837c178ece2c2fe427d6729baa807dc85fa93b4cd83100c59927a

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.seqrite.com/blog/uncovering-lockbit-blacks-attack-chain-and-anti-forensic-activity/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

Date: Wed, 22 Mar 2023 01:10:06 GMT
Strict-Transport-Security: max-age=63072000; includeSubDomains
X-Content-Type-Options: nosniff
Content-Security-Policy: upgrade-insecure-requests
Connection: keep-alive, Keep-Alive
Content-Length: 18874
X-XSS-Protection: 1; mode=block
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Tue, 31 Jan 2023 13:39:56 GMT
Server: Apache
X-Frame-Options: ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
Content-Type: image/png
Cache-Control: max-age=31536000, public
Permissions-Policy: geolocation=(); midi=();notifications=();push=();sync-xhr=();accelerometer=(); gyroscope=(); magnetometer=(); payment=(); camera=(); microphone=();usb=(); xr=();speaker=(self);vibrate=();fullscreen=(self);
Accept-Ranges: bytes
Keep-Alive: timeout=15, max=95
Expires: Thu, 21 Mar 2024 01:10:06 GMT

GET
H/1.1 200
OK cmlua_1-768x236.png
www.seqrite.com/blog/wp-content/uploads/2023/01/ 116 KB
118 KB 310ms
310ms Image
image/png 103.228.50.20
BALASAINET-AS Bal...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.seqrite.com/blog/wp-content/uploads/2023/01/cmlua_1-768x236.png

Requested by

Host: www.seqrite.com
URL: https://www.seqrite.com/blog/uncovering-lockbit-blacks-attack-chain-and-anti-forensic-activity/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

103.228.50.20 , India, ASN133288 (BALASAINET-AS Balasai Net Pvt. Ltd., IN),

Reverse DNS

50-20.static-pnq.balasai.com

Software

Apache /

Resource Hash

26686944017a4d6d20de086fd51a0c8678b4d6660d49c3022c1553b76e2b9149

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.seqrite.com/blog/uncovering-lockbit-blacks-attack-chain-and-anti-forensic-activity/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

Date: Wed, 22 Mar 2023 01:10:06 GMT
Strict-Transport-Security: max-age=63072000; includeSubDomains
X-Content-Type-Options: nosniff
Content-Security-Policy: upgrade-insecure-requests
Connection: keep-alive, Keep-Alive
Content-Length: 118935
X-XSS-Protection: 1; mode=block
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Tue, 31 Jan 2023 13:39:17 GMT
Server: Apache
X-Frame-Options: ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
Content-Type: image/png
Cache-Control: max-age=31536000, public
Permissions-Policy: geolocation=(); midi=();notifications=();push=();sync-xhr=();accelerometer=(); gyroscope=(); magnetometer=(); payment=(); camera=(); microphone=();usb=(); xr=();speaker=(self);vibrate=();fullscreen=(self);
Accept-Ranges: bytes
Keep-Alive: timeout=15, max=93
Expires: Thu, 21 Mar 2024 01:10:06 GMT

GET
H/1.1 200
OK ntsetinfothread.png
www.seqrite.com/blog/wp-content/uploads/2023/01/ 58 KB
59 KB 350ms
350ms Image
image/png 103.228.50.20
BALASAINET-AS Bal...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.seqrite.com/blog/wp-content/uploads/2023/01/ntsetinfothread.png

Requested by

Host: www.seqrite.com
URL: https://www.seqrite.com/blog/uncovering-lockbit-blacks-attack-chain-and-anti-forensic-activity/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

103.228.50.20 , India, ASN133288 (BALASAINET-AS Balasai Net Pvt. Ltd., IN),

Reverse DNS

50-20.static-pnq.balasai.com

Software

Apache /

Resource Hash

d210aaab1fc778b5506b77917853e21191e3a55c4bf0af599031f9e9565165a3

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.seqrite.com/blog/uncovering-lockbit-blacks-attack-chain-and-anti-forensic-activity/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

Date: Wed, 22 Mar 2023 01:10:06 GMT
Strict-Transport-Security: max-age=63072000; includeSubDomains
X-Content-Type-Options: nosniff
Content-Security-Policy: upgrade-insecure-requests
Connection: keep-alive, Keep-Alive
Content-Length: 58980
X-XSS-Protection: 1; mode=block
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Tue, 31 Jan 2023 13:38:17 GMT
Server: Apache
X-Frame-Options: ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
Content-Type: image/png
Cache-Control: max-age=31536000, public
Permissions-Policy: geolocation=(); midi=();notifications=();push=();sync-xhr=();accelerometer=(); gyroscope=(); magnetometer=(); payment=(); camera=(); microphone=();usb=(); xr=();speaker=(self);vibrate=();fullscreen=(self);
Accept-Ranges: bytes
Keep-Alive: timeout=15, max=91
Expires: Thu, 21 Mar 2024 01:10:06 GMT

GET
H/1.1 200
OK ransom_note_1-768x376.png
www.seqrite.com/blog/wp-content/uploads/2023/01/ 252 KB
253 KB 336ms
336ms Image
image/png 103.228.50.20
BALASAINET-AS Bal...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.seqrite.com/blog/wp-content/uploads/2023/01/ransom_note_1-768x376.png

Requested by

Host: www.seqrite.com
URL: https://www.seqrite.com/blog/uncovering-lockbit-blacks-attack-chain-and-anti-forensic-activity/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

103.228.50.20 , India, ASN133288 (BALASAINET-AS Balasai Net Pvt. Ltd., IN),

Reverse DNS

50-20.static-pnq.balasai.com

Software

Apache /

Resource Hash

dafdeb62aa723cf02a440b79322cdf6382cd329d8dbf02a5aed0b5d0a9938d61

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.seqrite.com/blog/uncovering-lockbit-blacks-attack-chain-and-anti-forensic-activity/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

Date: Wed, 22 Mar 2023 01:10:07 GMT
Strict-Transport-Security: max-age=63072000; includeSubDomains
X-Content-Type-Options: nosniff
Content-Security-Policy: upgrade-insecure-requests
Connection: keep-alive, Keep-Alive
Content-Length: 257959
X-XSS-Protection: 1; mode=block
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Tue, 31 Jan 2023 13:33:48 GMT
Server: Apache
X-Frame-Options: ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
Content-Type: image/png
Cache-Control: max-age=31536000, public
Permissions-Policy: geolocation=(); midi=();notifications=();push=();sync-xhr=();accelerometer=(); gyroscope=(); magnetometer=(); payment=(); camera=(); microphone=();usb=(); xr=();speaker=(self);vibrate=();fullscreen=(self);
Accept-Ranges: bytes
Keep-Alive: timeout=15, max=95
Expires: Thu, 21 Mar 2024 01:10:07 GMT

GET
H/1.1 200
OK encr.png
www.seqrite.com/blog/wp-content/uploads/2023/01/ 122 KB
124 KB 381ms
380ms Image
image/png 103.228.50.20
BALASAINET-AS Bal...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.seqrite.com/blog/wp-content/uploads/2023/01/encr.png

Requested by

Host: www.seqrite.com
URL: https://www.seqrite.com/blog/uncovering-lockbit-blacks-attack-chain-and-anti-forensic-activity/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

103.228.50.20 , India, ASN133288 (BALASAINET-AS Balasai Net Pvt. Ltd., IN),

Reverse DNS

50-20.static-pnq.balasai.com

Software

Apache /

Resource Hash

1c83e6f85e7a30771e1206fc9398f814501878328ddcd24ae00873be24fb84c6

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.seqrite.com/blog/uncovering-lockbit-blacks-attack-chain-and-anti-forensic-activity/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

Date: Wed, 22 Mar 2023 01:10:07 GMT
Strict-Transport-Security: max-age=63072000; includeSubDomains
X-Content-Type-Options: nosniff
Content-Security-Policy: upgrade-insecure-requests
Connection: keep-alive, Keep-Alive
Content-Length: 125066
X-XSS-Protection: 1; mode=block
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Tue, 31 Jan 2023 13:32:47 GMT
Server: Apache
X-Frame-Options: ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
Content-Type: image/png
Cache-Control: max-age=31536000, public
Permissions-Policy: geolocation=(); midi=();notifications=();push=();sync-xhr=();accelerometer=(); gyroscope=(); magnetometer=(); payment=(); camera=(); microphone=();usb=(); xr=();speaker=(self);vibrate=();fullscreen=(self);
Accept-Ranges: bytes
Keep-Alive: timeout=15, max=95
Expires: Thu, 21 Mar 2024 01:10:07 GMT

GET
H/1.1 200
OK Lockbit3.0-b.jpg.png
www.seqrite.com/blog/wp-content/uploads/2022/10/ 71 KB
73 KB 301ms
301ms Image
image/png 103.228.50.20
BALASAINET-AS Bal...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.seqrite.com/blog/wp-content/uploads/2022/10/Lockbit3.0-b.jpg.png

Requested by

Host: www.seqrite.com
URL: https://www.seqrite.com/blog/uncovering-lockbit-blacks-attack-chain-and-anti-forensic-activity/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

103.228.50.20 , India, ASN133288 (BALASAINET-AS Balasai Net Pvt. Ltd., IN),

Reverse DNS

50-20.static-pnq.balasai.com

Software

Apache /

Resource Hash

8011c33dee3c82409f5a8f412add94325ca04b5f74ddb1e732c3c046daedb101

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.seqrite.com/blog/uncovering-lockbit-blacks-attack-chain-and-anti-forensic-activity/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

Date: Wed, 22 Mar 2023 01:10:07 GMT
Strict-Transport-Security: max-age=63072000; includeSubDomains
X-Content-Type-Options: nosniff
Content-Security-Policy: upgrade-insecure-requests
Connection: keep-alive, Keep-Alive
Content-Length: 73021
X-XSS-Protection: 1; mode=block
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Fri, 07 Oct 2022 08:21:30 GMT
Server: Apache
X-Frame-Options: ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
Content-Type: image/png
Cache-Control: max-age=31536000, public
Permissions-Policy: geolocation=(); midi=();notifications=();push=();sync-xhr=();accelerometer=(); gyroscope=(); magnetometer=(); payment=(); camera=(); microphone=();usb=(); xr=();speaker=(self);vibrate=();fullscreen=(self);
Accept-Ranges: bytes
Keep-Alive: timeout=15, max=92
Expires: Thu, 21 Mar 2024 01:10:07 GMT

GET
H/1.1 200
OK Profile_Image-230x168.jpg
www.seqrite.com/blog/wp-content/uploads/2022/07/ 7 KB
9 KB 293ms
293ms Image
image/jpeg 103.228.50.20
BALASAINET-AS Bal...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.seqrite.com/blog/wp-content/uploads/2022/07/Profile_Image-230x168.jpg

Requested by

Host: www.seqrite.com
URL: https://www.seqrite.com/blog/uncovering-lockbit-blacks-attack-chain-and-anti-forensic-activity/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

103.228.50.20 , India, ASN133288 (BALASAINET-AS Balasai Net Pvt. Ltd., IN),

Reverse DNS

50-20.static-pnq.balasai.com

Software

Apache /

Resource Hash

f2986872ddc78af97ea3b28505ce3bd94aa025f448b06ce13ebcef3984d901bd

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.seqrite.com/blog/uncovering-lockbit-blacks-attack-chain-and-anti-forensic-activity/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

Date: Wed, 22 Mar 2023 01:10:08 GMT
Strict-Transport-Security: max-age=63072000; includeSubDomains
X-Content-Type-Options: nosniff
Content-Security-Policy: upgrade-insecure-requests
Connection: keep-alive, Keep-Alive
Content-Length: 7598
X-XSS-Protection: 1; mode=block
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Tue, 19 Jul 2022 09:27:39 GMT
Server: Apache
X-Frame-Options: ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
Content-Type: image/jpeg
Cache-Control: max-age=31536000, public
Permissions-Policy: geolocation=(); midi=();notifications=();push=();sync-xhr=();accelerometer=(); gyroscope=(); magnetometer=(); payment=(); camera=(); microphone=();usb=(); xr=();speaker=(self);vibrate=();fullscreen=(self);
Accept-Ranges: bytes
Keep-Alive: timeout=15, max=92
Expires: Thu, 21 Mar 2024 01:10:08 GMT

GET
H/1.1 200
OK Advanced-Approved-Endpoint-Protection_blog-image-240x185.png
www.seqrite.com/blog/wp-content/uploads/2022/01/ 77 KB
79 KB 299ms
298ms Image
image/png 103.228.50.20
BALASAINET-AS Bal...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.seqrite.com/blog/wp-content/uploads/2022/01/Advanced-Approved-Endpoint-Protection_blog-image-240x185.png

Requested by

Host: www.seqrite.com
URL: https://www.seqrite.com/blog/uncovering-lockbit-blacks-attack-chain-and-anti-forensic-activity/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

103.228.50.20 , India, ASN133288 (BALASAINET-AS Balasai Net Pvt. Ltd., IN),

Reverse DNS

50-20.static-pnq.balasai.com

Software

Apache /

Resource Hash

c34bb59c9600a63ff1e3153a7b2c3a9e9f6e3afdc5c1b72517cfe1a9536e781c

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.seqrite.com/blog/uncovering-lockbit-blacks-attack-chain-and-anti-forensic-activity/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

Date: Wed, 22 Mar 2023 01:10:08 GMT
Strict-Transport-Security: max-age=63072000; includeSubDomains
X-Content-Type-Options: nosniff
Content-Security-Policy: upgrade-insecure-requests
Connection: keep-alive, Keep-Alive
Content-Length: 79075
X-XSS-Protection: 1; mode=block
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Mon, 03 Jan 2022 12:16:08 GMT
Server: Apache
X-Frame-Options: ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
Content-Type: image/png
Cache-Control: max-age=31536000, public
Permissions-Policy: geolocation=(); midi=();notifications=();push=();sync-xhr=();accelerometer=(); gyroscope=(); magnetometer=(); payment=(); camera=(); microphone=();usb=(); xr=();speaker=(self);vibrate=();fullscreen=(self);
Accept-Ranges: bytes
Keep-Alive: timeout=15, max=90
Expires: Thu, 21 Mar 2024 01:10:08 GMT

GET
H/1.1 200
OK Top-6-cybersecurity-threats-to-address-in-2021-240x185.jpg
www.seqrite.com/blog/wp-content/uploads/2021/12/ 11 KB
13 KB 301ms
301ms Image
image/jpeg 103.228.50.20
BALASAINET-AS Bal...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.seqrite.com/blog/wp-content/uploads/2021/12/Top-6-cybersecurity-threats-to-address-in-2021-240x185.jpg

Requested by

Host: www.seqrite.com
URL: https://www.seqrite.com/blog/uncovering-lockbit-blacks-attack-chain-and-anti-forensic-activity/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

103.228.50.20 , India, ASN133288 (BALASAINET-AS Balasai Net Pvt. Ltd., IN),

Reverse DNS

50-20.static-pnq.balasai.com

Software

Apache /

Resource Hash

5b3dc373e125a8d5edd29b7a4c449021c7b6215f3c4985aa64528f6200c2c00f

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.seqrite.com/blog/uncovering-lockbit-blacks-attack-chain-and-anti-forensic-activity/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

Date: Wed, 22 Mar 2023 01:10:08 GMT
Strict-Transport-Security: max-age=63072000; includeSubDomains
X-Content-Type-Options: nosniff
Content-Security-Policy: upgrade-insecure-requests
Connection: keep-alive, Keep-Alive
Content-Length: 11384
X-XSS-Protection: 1; mode=block
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Fri, 03 Dec 2021 13:04:08 GMT
Server: Apache
X-Frame-Options: ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
Content-Type: image/jpeg
Cache-Control: max-age=31536000, public
Permissions-Policy: geolocation=(); midi=();notifications=();push=();sync-xhr=();accelerometer=(); gyroscope=(); magnetometer=(); payment=(); camera=(); microphone=();usb=(); xr=();speaker=(self);vibrate=();fullscreen=(self);
Accept-Ranges: bytes
Keep-Alive: timeout=15, max=94
Expires: Thu, 21 Mar 2024 01:10:08 GMT

GET
H/1.1 200
OK Anydesk-SQ-240x185.jpg
www.seqrite.com/blog/wp-content/uploads/2021/11/ 13 KB
15 KB 301ms
301ms Image
image/jpeg 103.228.50.20
BALASAINET-AS Bal...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.seqrite.com/blog/wp-content/uploads/2021/11/Anydesk-SQ-240x185.jpg

Requested by

Host: www.seqrite.com
URL: https://www.seqrite.com/blog/uncovering-lockbit-blacks-attack-chain-and-anti-forensic-activity/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

103.228.50.20 , India, ASN133288 (BALASAINET-AS Balasai Net Pvt. Ltd., IN),

Reverse DNS

50-20.static-pnq.balasai.com

Software

Apache /

Resource Hash

b0f582d9722fb491186e6f4efbd1c649e03d6c3c6a49cf52cdd69cc454feea60

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.seqrite.com/blog/uncovering-lockbit-blacks-attack-chain-and-anti-forensic-activity/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

Date: Wed, 22 Mar 2023 01:10:08 GMT
Strict-Transport-Security: max-age=63072000; includeSubDomains
X-Content-Type-Options: nosniff
Content-Security-Policy: upgrade-insecure-requests
Connection: keep-alive, Keep-Alive
Content-Length: 13511
X-XSS-Protection: 1; mode=block
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Fri, 26 Nov 2021 08:22:57 GMT
Server: Apache
X-Frame-Options: ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
Content-Type: image/jpeg
Cache-Control: max-age=31536000, public
Permissions-Policy: geolocation=(); midi=();notifications=();push=();sync-xhr=();accelerometer=(); gyroscope=(); magnetometer=(); payment=(); camera=(); microphone=();usb=(); xr=();speaker=(self);vibrate=();fullscreen=(self);
Accept-Ranges: bytes
Keep-Alive: timeout=15, max=91
Expires: Thu, 21 Mar 2024 01:10:08 GMT

GET
H/1.1 200
OK securimage_show.php
www.seqrite.com/blog/wp-content/plugins/si-captcha-for-wordpress/captcha/ 14 KB
15 KB 482ms
481ms Image
image/png 103.228.50.20
BALASAINET-AS Bal...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.seqrite.com/blog/wp-content/plugins/si-captcha-for-wordpress/captcha/securimage_show.php?si_form_id=com&prefix=oTJOOMy5ZWm8zMxF

Requested by

Host: www.seqrite.com
URL: https://www.seqrite.com/blog/uncovering-lockbit-blacks-attack-chain-and-anti-forensic-activity/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

103.228.50.20 , India, ASN133288 (BALASAINET-AS Balasai Net Pvt. Ltd., IN),

Reverse DNS

50-20.static-pnq.balasai.com

Software

Apache / PHP/5.3.14 ZendServer/5.0

Resource Hash

46e5b3f56210a36ed865daf3fe027508323db826d9bae35f298fd08feb01aa22

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.seqrite.com/blog/uncovering-lockbit-blacks-attack-chain-and-anti-forensic-activity/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

Date: Wed, 22 Mar 2023 01:10:08 GMT
Strict-Transport-Security: max-age=63072000; includeSubDomains
Content-Encoding: gzip
Content-Security-Policy: upgrade-insecure-requests
X-Content-Type-Options: nosniff
X-Powered-By: PHP/5.3.14 ZendServer/5.0
Connection: keep-alive, Keep-Alive
Content-Length: 14011
X-XSS-Protection: 1; mode=block
Pragma: no-cache
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Wed, 22 Mar 2023 01:10:08GMT
Server: Apache
Vary: Accept-Encoding,User-Agent
X-Frame-Options: ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
Content-Type: image/png
Cache-Control: no-store, no-cache, must-revalidate, private, must-revalidate, post-check=0, pre-check=0
Permissions-Policy: geolocation=(); midi=();notifications=();push=();sync-xhr=();accelerometer=(); gyroscope=(); magnetometer=(); payment=(); camera=(); microphone=();usb=(); xr=();speaker=(self);vibrate=();fullscreen=(self);
Keep-Alive: timeout=15, max=95
Expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H/1.1 200
OK refresh.png
www.seqrite.com/blog/wp-content/plugins/si-captcha-for-wordpress/captcha/images/ 1 KB
2 KB 293ms
293ms Image
image/png 103.228.50.20
BALASAINET-AS Bal...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.seqrite.com/blog/wp-content/plugins/si-captcha-for-wordpress/captcha/images/refresh.png

Requested by

Host: www.seqrite.com
URL: https://www.seqrite.com/blog/uncovering-lockbit-blacks-attack-chain-and-anti-forensic-activity/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

103.228.50.20 , India, ASN133288 (BALASAINET-AS Balasai Net Pvt. Ltd., IN),

Reverse DNS

50-20.static-pnq.balasai.com

Software

Apache /

Resource Hash

7efa72f5d3878a1f7145d552d8d2186bac3942fce7b3d7e3a51550c3bc9ab3cb

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.seqrite.com/blog/uncovering-lockbit-blacks-attack-chain-and-anti-forensic-activity/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

Date: Wed, 22 Mar 2023 01:10:08 GMT
Strict-Transport-Security: max-age=63072000; includeSubDomains
X-Content-Type-Options: nosniff
Content-Security-Policy: upgrade-insecure-requests
Connection: keep-alive, Keep-Alive
Content-Length: 1106
X-XSS-Protection: 1; mode=block
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Thu, 25 Feb 2016 09:42:14 GMT
Server: Apache
X-Frame-Options: ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
Content-Type: image/png
Cache-Control: max-age=31536000, public
Permissions-Policy: geolocation=(); midi=();notifications=();push=();sync-xhr=();accelerometer=(); gyroscope=(); magnetometer=(); payment=(); camera=(); microphone=();usb=(); xr=();speaker=(self);vibrate=();fullscreen=(self);
Accept-Ranges: bytes
Keep-Alive: timeout=15, max=91
Expires: Thu, 21 Mar 2024 01:10:08 GMT

GET
H/1.1 200
OK 2158-featured-80x81.jpg
www.seqrite.com/blog/wp-content/uploads/wordpress-popular-posts/ 3 KB
5 KB 862ms
301ms Image
image/jpeg 103.228.50.20
BALASAINET-AS Bal...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.seqrite.com/blog/wp-content/uploads/wordpress-popular-posts/2158-featured-80x81.jpg

Requested by

Host: www.seqrite.com
URL: https://www.seqrite.com/blog/uncovering-lockbit-blacks-attack-chain-and-anti-forensic-activity/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

103.228.50.20 , India, ASN133288 (BALASAINET-AS Balasai Net Pvt. Ltd., IN),

Reverse DNS

50-20.static-pnq.balasai.com

Software

Apache /

Resource Hash

a8fee4cbbd9d665342da792fa3055b33d508f4ff3cd63065562eb0e5e68f481f

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.seqrite.com/blog/uncovering-lockbit-blacks-attack-chain-and-anti-forensic-activity/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

Date: Wed, 22 Mar 2023 01:10:06 GMT
Strict-Transport-Security: max-age=63072000; includeSubDomains
X-Content-Type-Options: nosniff
Content-Security-Policy: upgrade-insecure-requests
Connection: keep-alive, Keep-Alive
Content-Length: 3329
X-XSS-Protection: 1; mode=block
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Wed, 30 May 2018 17:55:18 GMT
Server: Apache
X-Frame-Options: ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
Content-Type: image/jpeg
Cache-Control: max-age=31536000, public
Permissions-Policy: geolocation=(); midi=();notifications=();push=();sync-xhr=();accelerometer=(); gyroscope=(); magnetometer=(); payment=(); camera=(); microphone=();usb=(); xr=();speaker=(self);vibrate=();fullscreen=(self);
Accept-Ranges: bytes
Keep-Alive: timeout=15, max=97
Expires: Thu, 21 Mar 2024 01:10:06 GMT

GET
H/1.1 200
OK 1008-featured-80x81.jpg
www.seqrite.com/blog/wp-content/uploads/wordpress-popular-posts/ 3 KB
4 KB 824ms
298ms Image
image/jpeg 103.228.50.20
BALASAINET-AS Bal...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.seqrite.com/blog/wp-content/uploads/wordpress-popular-posts/1008-featured-80x81.jpg

Requested by

Host: www.seqrite.com
URL: https://www.seqrite.com/blog/uncovering-lockbit-blacks-attack-chain-and-anti-forensic-activity/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

103.228.50.20 , India, ASN133288 (BALASAINET-AS Balasai Net Pvt. Ltd., IN),

Reverse DNS

50-20.static-pnq.balasai.com

Software

Apache /

Resource Hash

13d874471687d90dfb9d1aa90cfe742ee68fc016db77197306ee7d0f43db453d

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.seqrite.com/blog/uncovering-lockbit-blacks-attack-chain-and-anti-forensic-activity/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

Date: Wed, 22 Mar 2023 01:10:06 GMT
Strict-Transport-Security: max-age=63072000; includeSubDomains
X-Content-Type-Options: nosniff
Content-Security-Policy: upgrade-insecure-requests
Connection: keep-alive, Keep-Alive
Content-Length: 2707
X-XSS-Protection: 1; mode=block
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Thu, 07 Feb 2019 15:14:55 GMT
Server: Apache
X-Frame-Options: ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
Content-Type: image/jpeg
Cache-Control: max-age=31536000, public
Permissions-Policy: geolocation=(); midi=();notifications=();push=();sync-xhr=();accelerometer=(); gyroscope=(); magnetometer=(); payment=(); camera=(); microphone=();usb=(); xr=();speaker=(self);vibrate=();fullscreen=(self);
Accept-Ranges: bytes
Keep-Alive: timeout=15, max=94
Expires: Thu, 21 Mar 2024 01:10:06 GMT

GET
H/1.1 200
OK 5541-featured-80x81.jpg
www.seqrite.com/blog/wp-content/uploads/wordpress-popular-posts/ 2 KB
4 KB 928ms
301ms Image
image/jpeg 103.228.50.20
BALASAINET-AS Bal...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.seqrite.com/blog/wp-content/uploads/wordpress-popular-posts/5541-featured-80x81.jpg

Requested by

Host: www.seqrite.com
URL: https://www.seqrite.com/blog/uncovering-lockbit-blacks-attack-chain-and-anti-forensic-activity/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

103.228.50.20 , India, ASN133288 (BALASAINET-AS Balasai Net Pvt. Ltd., IN),

Reverse DNS

50-20.static-pnq.balasai.com

Software

Apache /

Resource Hash

7ceb8882eb554d97209220159fe17846a3114cd962a816e9508df15534dfa3e5

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.seqrite.com/blog/uncovering-lockbit-blacks-attack-chain-and-anti-forensic-activity/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

Date: Wed, 22 Mar 2023 01:10:06 GMT
Strict-Transport-Security: max-age=63072000; includeSubDomains
X-Content-Type-Options: nosniff
Content-Security-Policy: upgrade-insecure-requests
Connection: keep-alive, Keep-Alive
Content-Length: 2278
X-XSS-Protection: 1; mode=block
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Wed, 22 Feb 2023 13:30:40 GMT
Server: Apache
X-Frame-Options: ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
Content-Type: image/jpeg
Cache-Control: max-age=31536000, public
Permissions-Policy: geolocation=(); midi=();notifications=();push=();sync-xhr=();accelerometer=(); gyroscope=(); magnetometer=(); payment=(); camera=(); microphone=();usb=(); xr=();speaker=(self);vibrate=();fullscreen=(self);
Accept-Ranges: bytes
Keep-Alive: timeout=15, max=97
Expires: Thu, 21 Mar 2024 01:10:06 GMT

GET
H/1.1 200
OK Final_seqrite_logo-red-option.png
www.seqrite.com/blog/wp-content/uploads/2017/06/ 1 KB
3 KB 1138ms
301ms Image
image/png 103.228.50.20
BALASAINET-AS Bal...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.seqrite.com/blog/wp-content/uploads/2017/06/Final_seqrite_logo-red-option.png

Requested by

Host: www.seqrite.com
URL: https://www.seqrite.com/blog/uncovering-lockbit-blacks-attack-chain-and-anti-forensic-activity/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

103.228.50.20 , India, ASN133288 (BALASAINET-AS Balasai Net Pvt. Ltd., IN),

Reverse DNS

50-20.static-pnq.balasai.com

Software

Apache /

Resource Hash

9d70a7e2a86a40b03aec810c473ff1443d9fa5181cb04b60f53454eead9ba579

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.seqrite.com/blog/uncovering-lockbit-blacks-attack-chain-and-anti-forensic-activity/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

Date: Wed, 22 Mar 2023 01:10:06 GMT
Strict-Transport-Security: max-age=63072000; includeSubDomains
X-Content-Type-Options: nosniff
Content-Security-Policy: upgrade-insecure-requests
Connection: keep-alive, Keep-Alive
Content-Length: 1450
X-XSS-Protection: 1; mode=block
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Tue, 27 Jun 2017 08:05:40 GMT
Server: Apache
X-Frame-Options: ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
Content-Type: image/png
Cache-Control: max-age=31536000, public
Permissions-Policy: geolocation=(); midi=();notifications=();push=();sync-xhr=();accelerometer=(); gyroscope=(); magnetometer=(); payment=(); camera=(); microphone=();usb=(); xr=();speaker=(self);vibrate=();fullscreen=(self);
Accept-Ranges: bytes
Keep-Alive: timeout=15, max=97
Expires: Thu, 21 Mar 2024 01:10:06 GMT

GET
H/1.1 200
OK SK_Photo12-150x149.jpg
www.seqrite.com/blog/wp-content/uploads/2017/09/ 5 KB
6 KB 1087ms
293ms Image
image/jpeg 103.228.50.20
BALASAINET-AS Bal...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.seqrite.com/blog/wp-content/uploads/2017/09/SK_Photo12-150x149.jpg

Requested by

Host: www.seqrite.com
URL: https://www.seqrite.com/blog/uncovering-lockbit-blacks-attack-chain-and-anti-forensic-activity/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

103.228.50.20 , India, ASN133288 (BALASAINET-AS Balasai Net Pvt. Ltd., IN),

Reverse DNS

50-20.static-pnq.balasai.com

Software

Apache /

Resource Hash

c4594d5cd9d4ae7683d9af90f8946692ded44d22e423bc6700ff671c8fe2d00f

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.seqrite.com/blog/uncovering-lockbit-blacks-attack-chain-and-anti-forensic-activity/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

Date: Wed, 22 Mar 2023 01:10:06 GMT
Strict-Transport-Security: max-age=63072000; includeSubDomains
X-Content-Type-Options: nosniff
Content-Security-Policy: upgrade-insecure-requests
Connection: keep-alive, Keep-Alive
Content-Length: 4765
X-XSS-Protection: 1; mode=block
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Mon, 25 Sep 2017 06:43:44 GMT
Server: Apache
X-Frame-Options: ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
Content-Type: image/jpeg
Cache-Control: max-age=31536000, public
Permissions-Policy: geolocation=(); midi=();notifications=();push=();sync-xhr=();accelerometer=(); gyroscope=(); magnetometer=(); payment=(); camera=(); microphone=();usb=(); xr=();speaker=(self);vibrate=();fullscreen=(self);
Accept-Ranges: bytes
Keep-Alive: timeout=15, max=95
Expires: Thu, 21 Mar 2024 01:10:06 GMT

GET
H/1.1 200
OK Blog_Display-150x150.jpg
www.seqrite.com/blog/wp-content/uploads/2020/01/ 5 KB
7 KB 1123ms
298ms Image
image/jpeg 103.228.50.20
BALASAINET-AS Bal...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.seqrite.com/blog/wp-content/uploads/2020/01/Blog_Display-150x150.jpg

Requested by

Host: www.seqrite.com
URL: https://www.seqrite.com/blog/uncovering-lockbit-blacks-attack-chain-and-anti-forensic-activity/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

103.228.50.20 , India, ASN133288 (BALASAINET-AS Balasai Net Pvt. Ltd., IN),

Reverse DNS

50-20.static-pnq.balasai.com

Software

Apache /

Resource Hash

c061326a5c95aa5b03f23b2aa0fd325211bb303785b065bdd166023db14f0118

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.seqrite.com/blog/uncovering-lockbit-blacks-attack-chain-and-anti-forensic-activity/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

Date: Wed, 22 Mar 2023 01:10:06 GMT
Strict-Transport-Security: max-age=63072000; includeSubDomains
X-Content-Type-Options: nosniff
Content-Security-Policy: upgrade-insecure-requests
Connection: keep-alive, Keep-Alive
Content-Length: 5367
X-XSS-Protection: 1; mode=block
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Wed, 01 Jan 2020 07:10:16 GMT
Server: Apache
X-Frame-Options: ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
Content-Type: image/jpeg
Cache-Control: max-age=31536000, public
Permissions-Policy: geolocation=(); midi=();notifications=();push=();sync-xhr=();accelerometer=(); gyroscope=(); magnetometer=(); payment=(); camera=(); microphone=();usb=(); xr=();speaker=(self);vibrate=();fullscreen=(self);
Accept-Ranges: bytes
Keep-Alive: timeout=15, max=93
Expires: Thu, 21 Mar 2024 01:10:06 GMT

GET
H/1.1 200
OK spinner.gif
www.seqrite.com/blog/wp-content/plugins/email-subscribers/public/images/ 3 KB
5 KB 301ms
301ms Image
image/gif 103.228.50.20
BALASAINET-AS Bal...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.seqrite.com/blog/wp-content/plugins/email-subscribers/public/images/spinner.gif

Requested by

Host: www.seqrite.com
URL: https://www.seqrite.com/blog/uncovering-lockbit-blacks-attack-chain-and-anti-forensic-activity/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

103.228.50.20 , India, ASN133288 (BALASAINET-AS Balasai Net Pvt. Ltd., IN),

Reverse DNS

50-20.static-pnq.balasai.com

Software

Apache /

Resource Hash

7837e876f1eef549b3250b78380ec2df00ad6da4da6c27667424b1636854df3c

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.seqrite.com/blog/uncovering-lockbit-blacks-attack-chain-and-anti-forensic-activity/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

Date: Wed, 22 Mar 2023 01:10:08 GMT
Strict-Transport-Security: max-age=63072000; includeSubDomains
X-Content-Type-Options: nosniff
Content-Security-Policy: upgrade-insecure-requests
Connection: keep-alive, Keep-Alive
Content-Length: 3208
X-XSS-Protection: 1; mode=block
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Mon, 05 Aug 2019 06:40:50 GMT
Server: Apache
X-Frame-Options: ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
Content-Type: image/gif
Cache-Control: max-age=31536000, public
Permissions-Policy: geolocation=(); midi=();notifications=();push=();sync-xhr=();accelerometer=(); gyroscope=(); magnetometer=(); payment=(); camera=(); microphone=();usb=(); xr=();speaker=(self);vibrate=();fullscreen=(self);
Accept-Ranges: bytes
Keep-Alive: timeout=15, max=93
Expires: Thu, 21 Mar 2024 01:10:08 GMT

GET
H/1.1 200
OK si_captcha.js Show response
www.seqrite.com/blog/wp-content/plugins/si-captcha-for-wordpress/captcha/ 685 B
2 KB 301ms
301ms Script
text/javascript 103.228.50.20
BALASAINET-AS Bal...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.seqrite.com/blog/wp-content/plugins/si-captcha-for-wordpress/captcha/si_captcha.js?ver=1.0

Requested by

Host: www.seqrite.com
URL: https://www.seqrite.com/blog/uncovering-lockbit-blacks-attack-chain-and-anti-forensic-activity/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

103.228.50.20 , India, ASN133288 (BALASAINET-AS Balasai Net Pvt. Ltd., IN),

Reverse DNS

50-20.static-pnq.balasai.com

Software

Apache /

Resource Hash

c52d8ecaada50da7a9739ca285872b431fad51042eccf398e2c2ecad8013880b

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.seqrite.com/blog/uncovering-lockbit-blacks-attack-chain-and-anti-forensic-activity/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

Date: Wed, 22 Mar 2023 01:10:05 GMT
Strict-Transport-Security: max-age=63072000; includeSubDomains
Content-Encoding: gzip
Content-Security-Policy: upgrade-insecure-requests
X-Content-Type-Options: nosniff
Connection: keep-alive, Keep-Alive
Content-Length: 380
X-XSS-Protection: 1; mode=block
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Thu, 25 Feb 2016 09:42:14 GMT
Server: Apache
Vary: Accept-Encoding,User-Agent
X-Frame-Options: ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
Content-Type: text/javascript
Cache-Control: max-age=2592000, private
Permissions-Policy: geolocation=(); midi=();notifications=();push=();sync-xhr=();accelerometer=(); gyroscope=(); magnetometer=(); payment=(); camera=(); microphone=();usb=(); xr=();speaker=(self);vibrate=();fullscreen=(self);
Accept-Ranges: bytes
Keep-Alive: timeout=15, max=99
Expires: Fri, 21 Apr 2023 01:10:05 GMT

GET
H/1.1 200
OK slickQuiz.css
www.seqrite.com/blog/wp-content/plugins/slickquiz/slickquiz/css/ 908 B
2 KB 293ms
293ms Stylesheet
text/css 103.228.50.20
BALASAINET-AS Bal...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.seqrite.com/blog/wp-content/plugins/slickquiz/slickquiz/css/slickQuiz.css?ver=4.8.3

Requested by

Host: www.seqrite.com
URL: https://www.seqrite.com/blog/uncovering-lockbit-blacks-attack-chain-and-anti-forensic-activity/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

103.228.50.20 , India, ASN133288 (BALASAINET-AS Balasai Net Pvt. Ltd., IN),

Reverse DNS

50-20.static-pnq.balasai.com

Software

Apache /

Resource Hash

48d1d7078b27223c895b4a9604916429879cc4e00e3a8772d64c76aa406711f6

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.seqrite.com/blog/uncovering-lockbit-blacks-attack-chain-and-anti-forensic-activity/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

Date: Wed, 22 Mar 2023 01:10:05 GMT
Strict-Transport-Security: max-age=63072000; includeSubDomains
Content-Encoding: gzip
Content-Security-Policy: upgrade-insecure-requests
X-Content-Type-Options: nosniff
Connection: keep-alive, Keep-Alive
Content-Length: 475
X-XSS-Protection: 1; mode=block
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Mon, 03 Apr 2017 09:41:26 GMT
Server: Apache
Vary: Accept-Encoding,User-Agent
X-Frame-Options: ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
Content-Type: text/css
Cache-Control: max-age=2592000, public
Permissions-Policy: geolocation=(); midi=();notifications=();push=();sync-xhr=();accelerometer=(); gyroscope=(); magnetometer=(); payment=(); camera=(); microphone=();usb=(); xr=();speaker=(self);vibrate=();fullscreen=(self);
Accept-Ranges: bytes
Keep-Alive: timeout=15, max=98
Expires: Fri, 21 Apr 2023 01:10:05 GMT

GET
H/1.1 200
OK front.css
www.seqrite.com/blog/wp-content/plugins/slickquiz/css/ 3 KB
2 KB 299ms
298ms Stylesheet
text/css 103.228.50.20
BALASAINET-AS Bal...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.seqrite.com/blog/wp-content/plugins/slickquiz/css/front.css?ver=4.8.3

Requested by

Host: www.seqrite.com
URL: https://www.seqrite.com/blog/uncovering-lockbit-blacks-attack-chain-and-anti-forensic-activity/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

103.228.50.20 , India, ASN133288 (BALASAINET-AS Balasai Net Pvt. Ltd., IN),

Reverse DNS

50-20.static-pnq.balasai.com

Software

Apache /

Resource Hash

0f8a76154e9d4d4f95724c6fa01caa18d4511ad594363004e03055859da90ccf

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.seqrite.com/blog/uncovering-lockbit-blacks-attack-chain-and-anti-forensic-activity/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

Date: Wed, 22 Mar 2023 01:10:05 GMT
Strict-Transport-Security: max-age=63072000; includeSubDomains
Content-Encoding: gzip
Content-Security-Policy: upgrade-insecure-requests
X-Content-Type-Options: nosniff
Connection: keep-alive, Keep-Alive
Content-Length: 929
X-XSS-Protection: 1; mode=block
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Mon, 03 Apr 2017 09:38:50 GMT
Server: Apache
Vary: Accept-Encoding,User-Agent
X-Frame-Options: ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
Content-Type: text/css
Cache-Control: max-age=2592000, public
Permissions-Policy: geolocation=(); midi=();notifications=();push=();sync-xhr=();accelerometer=(); gyroscope=(); magnetometer=(); payment=(); camera=(); microphone=();usb=(); xr=();speaker=(self);vibrate=();fullscreen=(self);
Accept-Ranges: bytes
Keep-Alive: timeout=15, max=96
Expires: Fri, 21 Apr 2023 01:10:05 GMT

GET
H/1.1 200
OK comment-reply.min.js Show response
www.seqrite.com/blog/wp-includes/js/ 1 KB
2 KB 307ms
303ms Script
text/javascript 103.228.50.20
BALASAINET-AS Bal...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.seqrite.com/blog/wp-includes/js/comment-reply.min.js?ver=4.8.3

Requested by

Host: www.seqrite.com
URL: https://www.seqrite.com/blog/uncovering-lockbit-blacks-attack-chain-and-anti-forensic-activity/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

103.228.50.20 , India, ASN133288 (BALASAINET-AS Balasai Net Pvt. Ltd., IN),

Reverse DNS

50-20.static-pnq.balasai.com

Software

Apache /

Resource Hash

1b1ca0f15010e0124bd4ca481404643c88f7eda1b276e9554d0ed83fb45b7e30

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.seqrite.com/blog/uncovering-lockbit-blacks-attack-chain-and-anti-forensic-activity/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

Date: Wed, 22 Mar 2023 01:10:05 GMT
Strict-Transport-Security: max-age=63072000; includeSubDomains
Content-Encoding: gzip
Content-Security-Policy: upgrade-insecure-requests
X-Content-Type-Options: nosniff
Connection: keep-alive, Keep-Alive
Content-Length: 589
X-XSS-Protection: 1; mode=block
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Thu, 19 Nov 2015 06:45:28 GMT
Server: Apache
Vary: Accept-Encoding,User-Agent
X-Frame-Options: ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
Content-Type: text/javascript
Cache-Control: max-age=2592000, private
Permissions-Policy: geolocation=(); midi=();notifications=();push=();sync-xhr=();accelerometer=(); gyroscope=(); magnetometer=(); payment=(); camera=(); microphone=();usb=(); xr=();speaker=(self);vibrate=();fullscreen=(self);
Accept-Ranges: bytes
Keep-Alive: timeout=15, max=98
Expires: Fri, 21 Apr 2023 01:10:05 GMT

GET
H/1.1 200
OK jquery.magnific-popup.min.js Show response
www.seqrite.com/blog/wp-content/themes/goblog/js/ 21 KB
9 KB 306ms
302ms Script
text/javascript 103.228.50.20
BALASAINET-AS Bal...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.seqrite.com/blog/wp-content/themes/goblog/js/jquery.magnific-popup.min.js?ver=0.9.9

Requested by

Host: www.seqrite.com
URL: https://www.seqrite.com/blog/uncovering-lockbit-blacks-attack-chain-and-anti-forensic-activity/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

103.228.50.20 , India, ASN133288 (BALASAINET-AS Balasai Net Pvt. Ltd., IN),

Reverse DNS

50-20.static-pnq.balasai.com

Software

Apache /

Resource Hash

21afd5dde7c1a80e8227df99b65b838d02411ee25dd37c8c6de6ab9b4a6a11f9

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.seqrite.com/blog/uncovering-lockbit-blacks-attack-chain-and-anti-forensic-activity/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

Date: Wed, 22 Mar 2023 01:10:05 GMT
Strict-Transport-Security: max-age=63072000; includeSubDomains
Content-Encoding: gzip
Content-Security-Policy: upgrade-insecure-requests
X-Content-Type-Options: nosniff
Connection: keep-alive, Keep-Alive
Content-Length: 7840
X-XSS-Protection: 1; mode=block
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Thu, 25 Feb 2016 09:40:16 GMT
Server: Apache
Vary: Accept-Encoding,User-Agent
X-Frame-Options: ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
Content-Type: text/javascript
Cache-Control: max-age=2592000, private
Permissions-Policy: geolocation=(); midi=();notifications=();push=();sync-xhr=();accelerometer=(); gyroscope=(); magnetometer=(); payment=(); camera=(); microphone=();usb=(); xr=();speaker=(self);vibrate=();fullscreen=(self);
Accept-Ranges: bytes
Keep-Alive: timeout=15, max=99
Expires: Fri, 21 Apr 2023 01:10:05 GMT

GET
H/1.1 200
OK theme-scripts.js Show response
www.seqrite.com/blog/wp-content/themes/goblog/js/ 64 KB
16 KB 913ms
303ms Script
text/javascript 103.228.50.20
BALASAINET-AS Bal...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.seqrite.com/blog/wp-content/themes/goblog/js/theme-scripts.js?ver=1.0

Requested by

Host: www.seqrite.com
URL: https://www.seqrite.com/blog/uncovering-lockbit-blacks-attack-chain-and-anti-forensic-activity/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

103.228.50.20 , India, ASN133288 (BALASAINET-AS Balasai Net Pvt. Ltd., IN),

Reverse DNS

50-20.static-pnq.balasai.com

Software

Apache /

Resource Hash

a46ad0cf194211eaa38d041861c834baca57d2531fa6bf7ed766441400f8c914

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.seqrite.com/blog/uncovering-lockbit-blacks-attack-chain-and-anti-forensic-activity/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

Date: Wed, 22 Mar 2023 01:10:06 GMT
Strict-Transport-Security: max-age=63072000; includeSubDomains
Content-Encoding: gzip
Content-Security-Policy: upgrade-insecure-requests
X-Content-Type-Options: nosniff
Connection: keep-alive, Keep-Alive
Content-Length: 14567
X-XSS-Protection: 1; mode=block
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Thu, 25 Feb 2016 09:40:16 GMT
Server: Apache
Vary: Accept-Encoding,User-Agent
X-Frame-Options: ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
Content-Type: text/javascript
Cache-Control: max-age=2592000, private
Permissions-Policy: geolocation=(); midi=();notifications=();push=();sync-xhr=();accelerometer=(); gyroscope=(); magnetometer=(); payment=(); camera=(); microphone=();usb=(); xr=();speaker=(self);vibrate=();fullscreen=(self);
Accept-Ranges: bytes
Keep-Alive: timeout=15, max=96
Expires: Fri, 21 Apr 2023 01:10:06 GMT

GET
H/1.1 200
OK sassy-social-share-public.js Show response
www.seqrite.com/blog/wp-content/plugins/sassy-social-share/public/js/ 46 KB
13 KB 303ms
302ms Script
text/javascript 103.228.50.20
BALASAINET-AS Bal...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.seqrite.com/blog/wp-content/plugins/sassy-social-share/public/js/sassy-social-share-public.js?ver=3.2.3

Requested by

Host: www.seqrite.com
URL: https://www.seqrite.com/blog/uncovering-lockbit-blacks-attack-chain-and-anti-forensic-activity/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

103.228.50.20 , India, ASN133288 (BALASAINET-AS Balasai Net Pvt. Ltd., IN),

Reverse DNS

50-20.static-pnq.balasai.com

Software

Apache /

Resource Hash

d4e8aef3270141a3bd33cfa0c36a91d75a3960a1e4a7eb346aa72101fa99f34b

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.seqrite.com/blog/uncovering-lockbit-blacks-attack-chain-and-anti-forensic-activity/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

Date: Wed, 22 Mar 2023 01:10:06 GMT
Strict-Transport-Security: max-age=63072000; includeSubDomains
Content-Encoding: gzip
Content-Security-Policy: upgrade-insecure-requests
X-Content-Type-Options: nosniff
Connection: keep-alive, Keep-Alive
Content-Length: 11655
X-XSS-Protection: 1; mode=block
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Tue, 03 Jul 2018 09:32:39 GMT
Server: Apache
Vary: Accept-Encoding,User-Agent
X-Frame-Options: ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
Content-Type: text/javascript
Cache-Control: max-age=2592000, private
Permissions-Policy: geolocation=(); midi=();notifications=();push=();sync-xhr=();accelerometer=(); gyroscope=(); magnetometer=(); payment=(); camera=(); microphone=();usb=(); xr=();speaker=(self);vibrate=();fullscreen=(self);
Accept-Ranges: bytes
Keep-Alive: timeout=15, max=96
Expires: Fri, 21 Apr 2023 01:10:06 GMT

GET
H/1.1 200
OK wp-embed.min.js Show response
www.seqrite.com/blog/wp-includes/js/ 1 KB
2 KB 296ms
295ms Script
text/javascript 103.228.50.20
BALASAINET-AS Bal...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.seqrite.com/blog/wp-includes/js/wp-embed.min.js?ver=4.8.3

Requested by

Host: www.seqrite.com
URL: https://www.seqrite.com/blog/uncovering-lockbit-blacks-attack-chain-and-anti-forensic-activity/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

103.228.50.20 , India, ASN133288 (BALASAINET-AS Balasai Net Pvt. Ltd., IN),

Reverse DNS

50-20.static-pnq.balasai.com

Software

Apache /

Resource Hash

dcb5e540e62fc85857254a1066afb6a7e8999279c6d4c583eef855d39f9289c0

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.seqrite.com/blog/uncovering-lockbit-blacks-attack-chain-and-anti-forensic-activity/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

Date: Wed, 22 Mar 2023 01:10:06 GMT
Strict-Transport-Security: max-age=63072000; includeSubDomains
Content-Encoding: gzip
Content-Security-Policy: upgrade-insecure-requests
X-Content-Type-Options: nosniff
Connection: keep-alive, Keep-Alive
Content-Length: 751
X-XSS-Protection: 1; mode=block
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Wed, 08 Nov 2017 07:20:23 GMT
Server: Apache
Vary: Accept-Encoding,User-Agent
X-Frame-Options: ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
Content-Type: text/javascript
Cache-Control: max-age=2592000, private
Permissions-Policy: geolocation=(); midi=();notifications=();push=();sync-xhr=();accelerometer=(); gyroscope=(); magnetometer=(); payment=(); camera=(); microphone=();usb=(); xr=();speaker=(self);vibrate=();fullscreen=(self);
Accept-Ranges: bytes
Keep-Alive: timeout=15, max=94
Expires: Fri, 21 Apr 2023 01:10:06 GMT

GET
H/1.1 200
OK slickQuiz.js Show response
www.seqrite.com/blog/wp-content/plugins/slickquiz/slickquiz/js/ 37 KB
9 KB 299ms
299ms Script
text/javascript 103.228.50.20
BALASAINET-AS Bal...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.seqrite.com/blog/wp-content/plugins/slickquiz/slickquiz/js/slickQuiz.js?ver=4.8.3

Requested by

Host: www.seqrite.com
URL: https://www.seqrite.com/blog/uncovering-lockbit-blacks-attack-chain-and-anti-forensic-activity/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

103.228.50.20 , India, ASN133288 (BALASAINET-AS Balasai Net Pvt. Ltd., IN),

Reverse DNS

50-20.static-pnq.balasai.com

Software

Apache /

Resource Hash

5ac7017782855b44f36da92da024c5de980002bd06ca9c94dc631e8c26e9b57c

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.seqrite.com/blog/uncovering-lockbit-blacks-attack-chain-and-anti-forensic-activity/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

Date: Wed, 22 Mar 2023 01:10:06 GMT
Strict-Transport-Security: max-age=63072000; includeSubDomains
Content-Encoding: gzip
Content-Security-Policy: upgrade-insecure-requests
X-Content-Type-Options: nosniff
Connection: keep-alive, Keep-Alive
Content-Length: 7289
X-XSS-Protection: 1; mode=block
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Mon, 03 Apr 2017 09:41:43 GMT
Server: Apache
Vary: Accept-Encoding,User-Agent
X-Frame-Options: ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
Content-Type: text/javascript
Cache-Control: max-age=2592000, private
Permissions-Policy: geolocation=(); midi=();notifications=();push=();sync-xhr=();accelerometer=(); gyroscope=(); magnetometer=(); payment=(); camera=(); microphone=();usb=(); xr=();speaker=(self);vibrate=();fullscreen=(self);
Accept-Ranges: bytes
Keep-Alive: timeout=15, max=92
Expires: Fri, 21 Apr 2023 01:10:06 GMT

GET
H/1.1 200
OK widgets.js Show response
platform.twitter.com/ 91 KB
28 KB 126ms
7ms Script
application/javascript 2606:2800:234:59:254c:406:2366:268c
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/widgets.js?ver=4.8.3
Requested by: Host: www.seqrite.com
URL: https://www.seqrite.com/blog/uncovering-lockbit-blacks-attack-chain-and-anti-forensic-activity/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:234:59:254c:406:2366:268c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECS (frb/673A) /
Resource Hash: 392c9fa9cd1273a2a89d1a83a69cd1f63f21d1d55e7be21e1d8f51f25145668b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.seqrite.com/blog/uncovering-lockbit-blacks-attack-chain-and-anti-forensic-activity/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

Date: Wed, 22 Mar 2023 02:05:35 GMT
Content-Encoding: gzip
Age: 769
x-amz-server-side-encryption: AES256
X-Cache: HIT
P3P: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Server-Timing: x-cache;desc= HIT,x-tw-cdn;desc=VZ
Content-Length: 27630
Last-Modified: Tue, 24 Jan 2023 21:41:51 GMT
Server: ECS (frb/673A)
Etag: "9e99725b7a4cd730a934afba2a438bb5+gzip"
Vary: Accept-Encoding
Access-Control-Allow-Methods: GET
Content-Type: application/javascript; charset=utf-8
Access-Control-Allow-Origin: *
x-tw-cdn: VZ
Cache-Control: public, max-age=1800

GET
H/1.1 200
OK main.min.js Show response
www.seqrite.com/blog/wp-content/plugins/icegram/assets/js/ 3 KB
2 KB 301ms
301ms Script
text/javascript 103.228.50.20
BALASAINET-AS Bal...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.seqrite.com/blog/wp-content/plugins/icegram/assets/js/main.min.js?ver=1.10.16

Requested by

Host: www.seqrite.com
URL: https://www.seqrite.com/blog/uncovering-lockbit-blacks-attack-chain-and-anti-forensic-activity/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

103.228.50.20 , India, ASN133288 (BALASAINET-AS Balasai Net Pvt. Ltd., IN),

Reverse DNS

50-20.static-pnq.balasai.com

Software

Apache /

Resource Hash

9ebff7017dd268671621d8ee78f8d0fbbc8acf656f7f7988aec31da68be69e2a

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.seqrite.com/blog/uncovering-lockbit-blacks-attack-chain-and-anti-forensic-activity/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

Date: Wed, 22 Mar 2023 01:10:06 GMT
Strict-Transport-Security: max-age=63072000; includeSubDomains
Content-Encoding: gzip
Content-Security-Policy: upgrade-insecure-requests
X-Content-Type-Options: nosniff
Connection: keep-alive, Keep-Alive
Content-Length: 975
X-XSS-Protection: 1; mode=block
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Fri, 23 Mar 2018 10:38:53 GMT
Server: Apache
Vary: Accept-Encoding,User-Agent
X-Frame-Options: ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
Content-Type: text/javascript
Cache-Control: max-age=2592000, private
Permissions-Policy: geolocation=(); midi=();notifications=();push=();sync-xhr=();accelerometer=(); gyroscope=(); magnetometer=(); payment=(); camera=(); microphone=();usb=(); xr=();speaker=(self);vibrate=();fullscreen=(self);
Accept-Ranges: bytes
Keep-Alive: timeout=15, max=96
Expires: Fri, 21 Apr 2023 01:10:06 GMT

POST
H/1.1 200
OK admin-ajax.php Show response
www.seqrite.com/blog/wp-admin/ 41 B
2 KB 701ms
701ms XHR
text/html 103.228.50.20
BALASAINET-AS Bal...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.seqrite.com/blog/wp-admin/admin-ajax.php

Requested by

Host: www.seqrite.com
URL: https://www.seqrite.com/blog/uncovering-lockbit-blacks-attack-chain-and-anti-forensic-activity/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

103.228.50.20 , India, ASN133288 (BALASAINET-AS Balasai Net Pvt. Ltd., IN),

Reverse DNS

50-20.static-pnq.balasai.com

Software

Apache / PHP/5.3.14 ZendServer/5.0

Resource Hash

bbc4b8755a0035e1878c7201a23b3844225bcd5d967b22c10b4d988228da2617

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.seqrite.com/blog/uncovering-lockbit-blacks-attack-chain-and-anti-forensic-activity/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36
Content-type: application/x-www-form-urlencoded

Response headers

Date: Wed, 22 Mar 2023 01:10:05 GMT
Strict-Transport-Security: max-age=63072000; includeSubDomains
X-Content-Type-Options: nosniff
Content-Security-Policy: upgrade-insecure-requests
Content-Encoding: gzip
X-Powered-By: PHP/5.3.14 ZendServer/5.0
Connection: keep-alive, Keep-Alive
Content-Length: 61
X-XSS-Protection: 1; mode=block
Referrer-Policy: no-referrer-when-downgrade
Server: Apache
X-Frame-Options: SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
Vary: Accept-Encoding,User-Agent
Content-Type: text/html; charset=UTF-8
Access-Control-Allow-Origin: https://www.seqrite.com
Cache-Control: no-cache, must-revalidate, max-age=0, private, must-revalidate
Access-Control-Allow-Credentials: true
Permissions-Policy: geolocation=(); midi=();notifications=();push=();sync-xhr=();accelerometer=(); gyroscope=(); magnetometer=(); payment=(); camera=(); microphone=();usb=(); xr=();speaker=(self);vibrate=();fullscreen=(self);
X-Robots-Tag: noindex
Keep-Alive: timeout=15, max=98
Expires: Wed, 11 Jan 1984 05:00:00 GMT

GET
H/1.1 200
OK bg.png
www.seqrite.com/blog/wp-content/themes/goblog/images/ 95 B
2 KB 565ms
298ms Image
image/png 103.228.50.20
BALASAINET-AS Bal...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.seqrite.com/blog/wp-content/themes/goblog/images/bg.png

Requested by

Host: www.seqrite.com
URL: https://www.seqrite.com/blog/uncovering-lockbit-blacks-attack-chain-and-anti-forensic-activity/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

103.228.50.20 , India, ASN133288 (BALASAINET-AS Balasai Net Pvt. Ltd., IN),

Reverse DNS

50-20.static-pnq.balasai.com

Software

Apache /

Resource Hash

3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.seqrite.com/blog/uncovering-lockbit-blacks-attack-chain-and-anti-forensic-activity/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

Date: Wed, 22 Mar 2023 01:10:05 GMT
Strict-Transport-Security: max-age=63072000; includeSubDomains
X-Content-Type-Options: nosniff
Content-Security-Policy: upgrade-insecure-requests
Connection: keep-alive, Keep-Alive
Content-Length: 95
X-XSS-Protection: 1; mode=block
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Thu, 25 Feb 2016 09:40:14 GMT
Server: Apache
X-Frame-Options: ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
Content-Type: image/png
Cache-Control: max-age=31536000, public
Permissions-Policy: geolocation=(); midi=();notifications=();push=();sync-xhr=();accelerometer=(); gyroscope=(); magnetometer=(); payment=(); camera=(); microphone=();usb=(); xr=();speaker=(self);vibrate=();fullscreen=(self);
Accept-Ranges: bytes
Keep-Alive: timeout=15, max=95
Expires: Thu, 21 Mar 2024 01:10:05 GMT

GET
DATA 200
OK truncated
/ 302 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: b980f62a2d545d64f24e6f96902c8fbf5da0018569c369bc18f9e5b5fcf099ed

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

Content-Type: image/svg+xml;charset=utf8

GET
DATA 200
OK truncated
/ 682 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: c2e8b4fba49f90cfca5a43371c09879aed7447e0ba2ed4abd75b81448776c4f7

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

Content-Type: image/svg+xml;charset=utf8

GET
DATA 200
OK truncated
/ 425 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 54c9560cb0117d8d1f955aefe0f88b843517964e118512d8f1a224a8a9b662f4

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

Content-Type: image/svg+xml;charset=utf8

GET
DATA 200
OK truncated
/ 436 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 2662e0eef0f270830358bb255f079f695da71794ecbe8ba0825200862d8e9746

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

Content-Type: image/svg+xml;charset=utf8

GET
H/1.1 200
OK fontawesome-webfont.woff
www.seqrite.com/blog/wp-content/themes/goblog/fonts/ 64 KB
65 KB 320ms
302ms Font
text/plain 103.228.50.20
BALASAINET-AS Bal...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.seqrite.com/blog/wp-content/themes/goblog/fonts/fontawesome-webfont.woff?v=4.2.0

Requested by

Host: www.seqrite.com
URL: https://www.seqrite.com/blog/wp-content/themes/goblog/css/font-awesome.css

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

103.228.50.20 , India, ASN133288 (BALASAINET-AS Balasai Net Pvt. Ltd., IN),

Reverse DNS

50-20.static-pnq.balasai.com

Software

Apache /

Resource Hash

b55bdbb110ff893cfe96074d8811c2644c8a9c1ef2b7c22f423d85f762967189

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.seqrite.com/blog/wp-content/themes/goblog/css/font-awesome.css
Origin: https://www.seqrite.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

Date: Wed, 22 Mar 2023 01:10:05 GMT
Strict-Transport-Security: max-age=63072000; includeSubDomains
Content-Encoding: gzip
Content-Security-Policy: upgrade-insecure-requests
X-Content-Type-Options: nosniff
Connection: keep-alive, Keep-Alive
Content-Length: 65453
X-XSS-Protection: 1; mode=block
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Thu, 25 Feb 2016 09:40:18 GMT
Server: Apache
Vary: Accept-Encoding,User-Agent
X-Frame-Options: ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
Content-Type: text/plain
Cache-Control: max-age=31536000
Permissions-Policy: geolocation=(); midi=();notifications=();push=();sync-xhr=();accelerometer=(); gyroscope=(); magnetometer=(); payment=(); camera=(); microphone=();usb=(); xr=();speaker=(self);vibrate=();fullscreen=(self);
Accept-Ranges: bytes
Keep-Alive: timeout=15, max=98
Expires: Thu, 21 Mar 2024 01:10:05 GMT

GET
H2 200 css
fonts.googleapis.com/ 8 KB
1 KB 126ms
46ms Stylesheet
text/css 2a00:1450:4001:828::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Open+Sans:400,700,600&display=swap

Requested by

Host: ajax.googleapis.com
URL: https://ajax.googleapis.com/ajax/libs/webfont/1.5.3/webfont.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

9dc8e62b83994a1eda313381316790cec86d097f2c843ae416a097747864382b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.seqrite.com/blog/uncovering-lockbit-blacks-attack-chain-and-anti-forensic-activity/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Wed, 22 Mar 2023 02:05:35 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Wed, 22 Mar 2023 01:33:29 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Wed, 22 Mar 2023 02:05:35 GMT

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 49 KB
20 KB 116ms
36ms Script
text/javascript 2a00:1450:4001:813::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-104093208-1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

5971b095cff574a66d35ada016d4c077c86e2dea62e9c0f14cf7c94b258619de

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.seqrite.com/blog/uncovering-lockbit-blacks-attack-chain-and-anti-forensic-activity/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
date: Wed, 22 Mar 2023 00:23:33 GMT
last-modified: Tue, 10 Jan 2023 21:29:14 GMT
server: Golfe2
age: 6122
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 20085
expires: Wed, 22 Mar 2023 02:23:33 GMT

GET
H2 200 memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2
fonts.gstatic.com/s/opensans/v34/ 44 KB
44 KB 116ms
35ms Font
font/woff2 2a00:1450:4001:808::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v34/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Open+Sans:400,700,600&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8778e9af2422858d7052ff9a0f3c12c08ae976bdd6e0316db144cd5579cd97db

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://www.seqrite.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date: Tue, 21 Mar 2023 08:37:39 GMT
x-content-type-options: nosniff
age: 62876
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 44856
x-xss-protection: 0
last-modified: Mon, 15 Aug 2022 18:20:18 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 20 Mar 2024 08:37:39 GMT

POST
H2 200 collect Show response
www.google-analytics.com/j/ 2 B
207 B 43ms
42ms XHR
text/plain 2a00:1450:4001:813::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j99&a=1144455392&t=pageview&_s=1&dl=https%3A%2F%2Fwww.seqrite.com%2Fblog%2Funcovering-lockbit-blacks-attack-chain-and-anti-forensic-activity%2F&ul=en-us&de=UTF-8&dt=Uncovering%20LockBit%20Black%E2%80%99s%20Attack%20Chain%20and%20Anti-forensic%20activity&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YEBAAUABAAAAACAAI~&jid=2054823704&gjid=1799881385&cid=202676914.1679450736&tid=UA-104093208-1&_gid=940671738.1679450736&_r=1&gtm=457e33k0&z=1642981757

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.seqrite.com/blog/uncovering-lockbit-blacks-attack-chain-and-anti-forensic-activity/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Wed, 22 Mar 2023 02:05:35 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.seqrite.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 collect Show response
stats.g.doubleclick.net/j/ 1 B
346 B 58ms
19ms XHR
text/plain 2a00:1450:400c:c0c::9c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j99&tid=UA-104093208-1&cid=202676914.1679450736&jid=2054823704&gjid=1799881385&_gid=940671738.1679450736&_u=YEBAAUAAAAAAACAAI~&z=894019657

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400c:c0c::9c Brussels, Belgium, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.seqrite.com/blog/uncovering-lockbit-blacks-attack-chain-and-anti-forensic-activity/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
date: Wed, 22 Mar 2023 02:05:35 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.seqrite.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK frontend.min.css
www.seqrite.com/blog/wp-content/plugins/icegram/assets/css/ 19 KB
4 KB 318ms
301ms Stylesheet
text/css 103.228.50.20
BALASAINET-AS Bal...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.seqrite.com/blog/wp-content/plugins/icegram/assets/css/frontend.min.css?var=1.10.16

Requested by

Host: www.seqrite.com
URL: https://www.seqrite.com/blog/wp-content/plugins/jquery-updater/js/jquery-3.6.0.min.js?ver=4.8.3

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

103.228.50.20 , India, ASN133288 (BALASAINET-AS Balasai Net Pvt. Ltd., IN),

Reverse DNS

50-20.static-pnq.balasai.com

Software

Apache /

Resource Hash

92d8884bb3f73093e6d0d49afb2d4e3129c7f92f5f9b0b741d2dc61a75dff904

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.seqrite.com/blog/uncovering-lockbit-blacks-attack-chain-and-anti-forensic-activity/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

Date: Wed, 22 Mar 2023 01:10:07 GMT
Strict-Transport-Security: max-age=63072000; includeSubDomains
Content-Encoding: gzip
Content-Security-Policy: upgrade-insecure-requests
X-Content-Type-Options: nosniff
Connection: keep-alive, Keep-Alive
Content-Length: 2386
X-XSS-Protection: 1; mode=block
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Fri, 23 Mar 2018 10:38:15 GMT
Server: Apache
Vary: Accept-Encoding,User-Agent
X-Frame-Options: ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
Content-Type: text/css
Cache-Control: max-age=2592000, public
Permissions-Policy: geolocation=(); midi=();notifications=();push=();sync-xhr=();accelerometer=(); gyroscope=(); magnetometer=(); payment=(); camera=(); microphone=();usb=(); xr=();speaker=(self);vibrate=();fullscreen=(self);
Accept-Ranges: bytes
Keep-Alive: timeout=15, max=94
Expires: Fri, 21 Apr 2023 01:10:07 GMT

GET
H/1.1 200
OK popup.min.css
www.seqrite.com/blog/wp-content/plugins/icegram/message-types/popup/themes/ 21 KB
6 KB 620ms
301ms Stylesheet
text/css 103.228.50.20
BALASAINET-AS Bal...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.seqrite.com/blog/wp-content/plugins/icegram/message-types/popup/themes/popup.min.css?var=1.10.16

Requested by

Host: www.seqrite.com
URL: https://www.seqrite.com/blog/wp-content/plugins/jquery-updater/js/jquery-3.6.0.min.js?ver=4.8.3

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

103.228.50.20 , India, ASN133288 (BALASAINET-AS Balasai Net Pvt. Ltd., IN),

Reverse DNS

50-20.static-pnq.balasai.com

Software

Apache /

Resource Hash

2fea67957caea31ef5c4541c83f121cb0dd690da9c3e16c8a1a88ab60b7fcccb

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.seqrite.com/blog/uncovering-lockbit-blacks-attack-chain-and-anti-forensic-activity/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

Date: Wed, 22 Mar 2023 01:10:07 GMT
Strict-Transport-Security: max-age=63072000; includeSubDomains
Content-Encoding: gzip
Content-Security-Policy: upgrade-insecure-requests
X-Content-Type-Options: nosniff
Connection: keep-alive, Keep-Alive
Content-Length: 4400
X-XSS-Protection: 1; mode=block
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Fri, 23 Mar 2018 10:39:41 GMT
Server: Apache
Vary: Accept-Encoding,User-Agent
X-Frame-Options: ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
Content-Type: text/css
Cache-Control: max-age=2592000, public
Permissions-Policy: geolocation=(); midi=();notifications=();push=();sync-xhr=();accelerometer=(); gyroscope=(); magnetometer=(); payment=(); camera=(); microphone=();usb=(); xr=();speaker=(self);vibrate=();fullscreen=(self);
Accept-Ranges: bytes
Keep-Alive: timeout=15, max=93
Expires: Fri, 21 Apr 2023 01:10:07 GMT

GET
H/1.1 200
OK icegram.min.js Show response
www.seqrite.com/blog/wp-content/plugins/icegram/assets/js/ 45 KB
14 KB 303ms
303ms Script
text/javascript 103.228.50.20
BALASAINET-AS Bal...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.seqrite.com/blog/wp-content/plugins/icegram/assets/js/icegram.min.js?var=1.10.16

Requested by

Host: www.seqrite.com
URL: https://www.seqrite.com/blog/wp-content/plugins/jquery-updater/js/jquery-3.6.0.min.js?ver=4.8.3

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

103.228.50.20 , India, ASN133288 (BALASAINET-AS Balasai Net Pvt. Ltd., IN),

Reverse DNS

50-20.static-pnq.balasai.com

Software

Apache /

Resource Hash

9bfbc0be0ca1c7fc6220860de2077caec179c03c5ff29e68bbeb148fe23d657c

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.seqrite.com/blog/uncovering-lockbit-blacks-attack-chain-and-anti-forensic-activity/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

Date: Wed, 22 Mar 2023 01:10:08 GMT
Strict-Transport-Security: max-age=63072000; includeSubDomains
Content-Encoding: gzip
Content-Security-Policy: upgrade-insecure-requests
X-Content-Type-Options: nosniff
Connection: keep-alive, Keep-Alive
Content-Length: 13287
X-XSS-Protection: 1; mode=block
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Fri, 23 Mar 2018 10:38:53 GMT
Server: Apache
Vary: Accept-Encoding,User-Agent
X-Frame-Options: ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
Content-Type: text/javascript
Cache-Control: max-age=2592000, private
Permissions-Policy: geolocation=(); midi=();notifications=();push=();sync-xhr=();accelerometer=(); gyroscope=(); magnetometer=(); payment=(); camera=(); microphone=();usb=(); xr=();speaker=(self);vibrate=();fullscreen=(self);
Accept-Ranges: bytes
Keep-Alive: timeout=15, max=90
Expires: Fri, 21 Apr 2023 01:10:08 GMT

GET
H/1.1 200
OK widget_iframe.2b2d73daf636805223fb11d48f3e94f7.html Show response
platform.twitter.com/widgets/ Frame 3C88 320 KB
104 KB 8ms
7ms Document
text/html 2606:2800:234:59:254c:406:2366:268c
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/widgets/widget_iframe.2b2d73daf636805223fb11d48f3e94f7.html?origin=https%3A%2F%2Fwww.seqrite.com
Requested by: Host: platform.twitter.com
URL: https://platform.twitter.com/widgets.js?ver=4.8.3
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:234:59:254c:406:2366:268c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECS (frb/674C) /
Resource Hash: 4002d65e95f94dc87ae8ad170eb8dbc3644921032ac76dcb376537d9304a6fbf

Request headers

Referer: https://www.seqrite.com/blog/uncovering-lockbit-blacks-attack-chain-and-anti-forensic-activity/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Access-Control-Allow-Methods: GET
Access-Control-Allow-Origin: *
Age: 537170
Cache-Control: public, max-age=315360000
Content-Encoding: gzip
Content-Length: 105435
Content-Type: text/html; charset=utf-8
Date: Wed, 22 Mar 2023 02:05:36 GMT
Etag: "95e1b50b0c179aefb47b5b211bb347b5+gzip"
Last-Modified: Tue, 24 Jan 2023 21:41:13 GMT
P3P: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Server: ECS (frb/674C)
Server-Timing: x-cache;desc= HIT,x-tw-cdn;desc=VZ
Vary: Accept-Encoding
X-Cache: HIT
x-amz-server-side-encryption: AES256
x-tw-cdn: VZ

GET
H2 200 settings Show response
syndication.twitter.com/ Frame 3C88 663 B
606 B 150ms
119ms Fetch
application/json 104.244.42.200
TWITTER

General

Check archive.org

Show headers Download Go to

Full URL

https://syndication.twitter.com/settings?session_id=c819272a8bbeb1f7d54d43c13546d246c284a4e7

Requested by

Host: platform.twitter.com
URL: https://platform.twitter.com/widgets/widget_iframe.2b2d73daf636805223fb11d48f3e94f7.html?origin=https%3A%2F%2Fwww.seqrite.com

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.244.42.200 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

92747742b0d05de841880d3cad6550593fa08692d26fe086e15d4a5696606a54

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://platform.twitter.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

x-response-time: 112
date: Wed, 22 Mar 2023 02:05:36 GMT
content-encoding: gzip
strict-transport-security: max-age=631138519
last-modified: Wed, 22 Mar 2023 02:05:36 GMT
server: tsa_o
vary: Origin
content-type: application/json; charset=utf-8
access-control-allow-origin: https://platform.twitter.com
x-transaction-id: eec941e2c12275e0
cache-control: must-revalidate, max-age=600
access-control-allow-credentials: true
perf: 7626143928
x-connection-hash: 5997f54eb1b375a3593447e23bebcf94bdd89b99be34a8f2a8122f44dbff66af
content-length: 284

GET admin-ajax.php
www.seqrite.com/blog/wp-admin/ 0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: www.seqrite.com
URL: https://www.seqrite.com/blog/wp-admin/admin-ajax.php?action=heateor_sss_sharing_count&urls%5B%5D=https%3A%2F%2Fwww.seqrite.com%2Fblog%2Funcovering-lockbit-blacks-attack-chain-and-anti-forensic-activity%2F

Verdicts & Comments Add Verdict or Comment

76 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

4 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.seqrite.com/	1970-01-20 20:06:50	Name: _ga Value: GA1.2.202676914.1679450736
.seqrite.com/	1970-01-20 10:32:17	Name: _gid Value: GA1.2.940671738.1679450736
.seqrite.com/	1970-01-20 10:30:50	Name: _gat_gtag_UA_104093208_1 Value: 1
www.seqrite.com/	1969-12-31 23:59:59	Name: PHPSESSID Value: erhjpqqop1fv8tmoca7b30qei5

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
security	error	Message: Error with Permissions-Policy header: Parse of permissions policy failed because of errors reported by structured header parser.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ajax.googleapis.com
fonts.googleapis.com
fonts.gstatic.com
platform.twitter.com
stats.g.doubleclick.net
syndication.twitter.com
www.google-analytics.com
www.googletagmanager.com
www.seqrite.com
www.seqrite.com
103.228.50.20
104.244.42.200
2606:2800:234:59:254c:406:2366:268c
2a00:1450:4001:808::2003
2a00:1450:4001:80b::200a
2a00:1450:4001:813::200e
2a00:1450:4001:827::2008
2a00:1450:4001:828::200a
2a00:1450:400c:c0c::9c
0f8a76154e9d4d4f95724c6fa01caa18d4511ad594363004e03055859da90ccf
0fbf945eae1c5869be401c6db68da93f5a47f2c1ff6072151ebb4b2dea6d4f62
13d874471687d90dfb9d1aa90cfe742ee68fc016db77197306ee7d0f43db453d
1ab4898c7aa4bb6dd96637f795e2c9f92cbef410697e3386e6a30f6bca53ccb1
1b1ca0f15010e0124bd4ca481404643c88f7eda1b276e9554d0ed83fb45b7e30
1c5fe2a18d6a2a223e6b8ee3f1876e841873b9235e2f170226eb583e073f587c
1c83e6f85e7a30771e1206fc9398f814501878328ddcd24ae00873be24fb84c6
21afd5dde7c1a80e8227df99b65b838d02411ee25dd37c8c6de6ab9b4a6a11f9
2662e0eef0f270830358bb255f079f695da71794ecbe8ba0825200862d8e9746
26686944017a4d6d20de086fd51a0c8678b4d6660d49c3022c1553b76e2b9149
2fea67957caea31ef5c4541c83f121cb0dd690da9c3e16c8a1a88ab60b7fcccb
34e35f893b634d5439db39f3c4f202ddc21aaf406e5724e8c118d513f086752f
36ef095d011c4ced97b0acef551ca36d76b95299518595dc1acab792a2344601
392c9fa9cd1273a2a89d1a83a69cd1f63f21d1d55e7be21e1d8f51f25145668b
3d602bd6510bdbcbcdb3e9fdcd9d23ab1bb0a44a41a2ecbc4d0daa55698e9c63
3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517
4002d65e95f94dc87ae8ad170eb8dbc3644921032ac76dcb376537d9304a6fbf
46e5b3f56210a36ed865daf3fe027508323db826d9bae35f298fd08feb01aa22
48d1d7078b27223c895b4a9604916429879cc4e00e3a8772d64c76aa406711f6
54c9560cb0117d8d1f955aefe0f88b843517964e118512d8f1a224a8a9b662f4
5971b095cff574a66d35ada016d4c077c86e2dea62e9c0f14cf7c94b258619de
5ac7017782855b44f36da92da024c5de980002bd06ca9c94dc631e8c26e9b57c
5b3dc373e125a8d5edd29b7a4c449021c7b6215f3c4985aa64528f6200c2c00f
5f558acf8cdf920788c9e18caee1457c4d4e0d3232eae0a90b3d8c1334be0abb
635c08873c57f14c85adb8851c342eaa54c7cf17e00cd6b445fb6537ff821364
66190b77ffc756b5432c16887dbc3c7a0f751e7fe1128e1cb6de8725d2b463f1
680a80d356565114378e038218e6971571fb76e54ff0530999d38f2b3c99368f
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
6f20c872577786195e3973e8b5f2f9063214f32171ccf196b90c4710b9df99ee
7837e876f1eef549b3250b78380ec2df00ad6da4da6c27667424b1636854df3c
7ceb8882eb554d97209220159fe17846a3114cd962a816e9508df15534dfa3e5
7efa72f5d3878a1f7145d552d8d2186bac3942fce7b3d7e3a51550c3bc9ab3cb
8011c33dee3c82409f5a8f412add94325ca04b5f74ddb1e732c3c046daedb101
8778e9af2422858d7052ff9a0f3c12c08ae976bdd6e0316db144cd5579cd97db
92747742b0d05de841880d3cad6550593fa08692d26fe086e15d4a5696606a54
92d8884bb3f73093e6d0d49afb2d4e3129c7f92f5f9b0b741d2dc61a75dff904
93754643da5a46ca1b7e1f6ba4378655974e11e1cbb432e8c5cbf54804b722bc
9bfbc0be0ca1c7fc6220860de2077caec179c03c5ff29e68bbeb148fe23d657c
9d70a7e2a86a40b03aec810c473ff1443d9fa5181cb04b60f53454eead9ba579
9dc8e62b83994a1eda313381316790cec86d097f2c843ae416a097747864382b
9ebff7017dd268671621d8ee78f8d0fbbc8acf656f7f7988aec31da68be69e2a
a46ad0cf194211eaa38d041861c834baca57d2531fa6bf7ed766441400f8c914
a8fee4cbbd9d665342da792fa3055b33d508f4ff3cd63065562eb0e5e68f481f
b0f582d9722fb491186e6f4efbd1c649e03d6c3c6a49cf52cdd69cc454feea60
b4ae8ad8c560bb87aa8fe03d597e2a69eef809072a35415d32ba68757e13ece6
b55bdbb110ff893cfe96074d8811c2644c8a9c1ef2b7c22f423d85f762967189
b980f62a2d545d64f24e6f96902c8fbf5da0018569c369bc18f9e5b5fcf099ed
bbc4b8755a0035e1878c7201a23b3844225bcd5d967b22c10b4d988228da2617
c061326a5c95aa5b03f23b2aa0fd325211bb303785b065bdd166023db14f0118
c23b261e4ef182b41e08e4d1f842b43380435b47d901047b1d4efa147b3392fb
c2e8b4fba49f90cfca5a43371c09879aed7447e0ba2ed4abd75b81448776c4f7
c34bb59c9600a63ff1e3153a7b2c3a9e9f6e3afdc5c1b72517cfe1a9536e781c
c4594d5cd9d4ae7683d9af90f8946692ded44d22e423bc6700ff671c8fe2d00f
c52d8ecaada50da7a9739ca285872b431fad51042eccf398e2c2ecad8013880b
ca1f8476f46a20514a230649a5528e4af4d3656d421294c38d1f2e51e057cac5
d210aaab1fc778b5506b77917853e21191e3a55c4bf0af599031f9e9565165a3
d4e8aef3270141a3bd33cfa0c36a91d75a3960a1e4a7eb346aa72101fa99f34b
dab5edff54eb8164a1f8af158d11fd370c58809db85578c3b22b8fac1798ae0c
dafdeb62aa723cf02a440b79322cdf6382cd329d8dbf02a5aed0b5d0a9938d61
dcb5e540e62fc85857254a1066afb6a7e8999279c6d4c583eef855d39f9289c0
de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af
e9341f1e94a837c178ece2c2fe427d6729baa807dc85fa93b4cd83100c59927a
f2986872ddc78af97ea3b28505ce3bd94aa025f448b06ce13ebcef3984d901bd
f7e248392cea6eed6651423f5b9a4adafec5b15921a2f16ec54e1012be0aaee5
f84eb4571c0eb40823ed47af468684cc9703ecfc89f6a38e569a470d504a3504
ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e

www.seqrite.com Open in urlscan Pro 103.228.50.20 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

63 Requests

98 %HTTPS

78 %IPv6

7 Domains

9 Subdomains

10 IPs

4 Countries

1723 kBTransfer

2589 kBSize

4 Cookies

9 Outgoing links

Redirected requests

63 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 4 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

www.seqrite.com Open in urlscan Pro
103.228.50.20 Public Scan

Screenshot
Live screenshot

Full Image

63
Requests

98 %
HTTPS

78 %
IPv6

7
Domains

9
Subdomains

10
IPs

4
Countries

1723 kB
Transfer

2589 kB
Size

4
Cookies

63 HTTP transactions
4 data transactions