usa.kaspersky.com Open in urlscan Pro
185.85.15.47 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://usa.kaspersky.com/about/press-releases/2022_apt-uses-shadowpad-backdoor-and-ms-exchange-vulnerability-to-attack-bu...
Submission: On August 12 via api (August 12th 2022, 4:06:47 am UTC) from IN — Scanned from DE

Summary HTTP 125 Redirects Links 58 Behaviour Indicators

Summary

This website contacted 39 IPs in 7 countries across 29 domains to perform 125 HTTP transactions. The main IP is 185.85.15.47, located in Germany and belongs to KL-EXT, CH. The main domain is usa.kaspersky.com. The Cisco Umbrella rank of the primary domain is 613752.
TLS certificate: Issued by DigiCert TLS RSA SHA256 2020 CA1 on March 31st 2022. Valid for: a year.

This is the only time usa.kaspersky.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
22	185.85.15.47 185.85.15.47	200107 (KL-EXT) (KL-EXT)
3	23.208.225.239 23.208.225.239	16625 (AKAMAI-AS) (AKAMAI-AS)
1	185.85.15.23 185.85.15.23	200107 (KL-EXT) (KL-EXT)
4	2a00:1450:400... 2a00:1450:4001:812::2008	15169 (GOOGLE) (GOOGLE)
3	2001:4860:480... 2001:4860:4802:36::15	15169 (GOOGLE) (GOOGLE)
4	15.236.176.210 15.236.176.210	16509 (AMAZON-02) (AMAZON-02)
2	4.59.181.140 4.59.181.140	3356 (LEVEL3) (LEVEL3)
1	18.66.112.26 18.66.112.26	16509 (AMAZON-02) (AMAZON-02)
2 3	2606:4700::68... 2606:4700::6810:7aaf	13335 (CLOUDFLAR...) (CLOUDFLARENET)
4	2a00:1450:400... 2a00:1450:4001:829::200e	15169 (GOOGLE) (GOOGLE)
2	2a02:26f0:350... 2a02:26f0:3500:16::215:149b	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
3	2620:1ec:c11:... 2620:1ec:c11::200	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
3 5	2606:4700:440... 2606:4700:4400::6812:230b	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	52.49.174.4 52.49.174.4	16509 (AMAZON-02) (AMAZON-02)
1	18.66.97.122 18.66.97.122	16509 (AMAZON-02) (AMAZON-02)
2	2600:9000:215... 2600:9000:2156:9c00:17:2e54:9a00:93a1	16509 (AMAZON-02) (AMAZON-02)
2	2a03:2880:f01... 2a03:2880:f01c:8012:face:b00c:0:3	32934 (FACEBOOK) (FACEBOOK)
16	23.36.163.232 23.36.163.232	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	52.206.171.79 52.206.171.79	14618 (AMAZON-AES) (AMAZON-AES)
1	142.250.184.194 142.250.184.194	15169 (GOOGLE) (GOOGLE)
1 2	185.89.211.116 185.89.211.116	29990 (ASN-APPNEX) (ASN-APPNEX)
3 4	142.250.185.166 142.250.185.166	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:808::2002	15169 (GOOGLE) (GOOGLE)
2 2	172.64.155.149 172.64.155.149	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	185.89.210.141 185.89.210.141	29990 (ASN-APPNEX) (ASN-APPNEX)
1	52.215.191.30 52.215.191.30	16509 (AMAZON-02) (AMAZON-02)
2	54.72.143.148 54.72.143.148	16509 (AMAZON-02) (AMAZON-02)
2	2a00:1450:400... 2a00:1450:400c:c00::9c	15169 (GOOGLE) (GOOGLE)
3 3	2620:1ec:21::14 2620:1ec:21::14	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	13.107.42.14 13.107.42.14	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	52.20.78.240 52.20.78.240	14618 (AMAZON-AES) (AMAZON-AES)
13	3.211.180.245 3.211.180.245	14618 (AMAZON-AES) (AMAZON-AES)
1	35.186.249.72 35.186.249.72	15169 (GOOGLE) (GOOGLE)
2	2a03:2880:f11... 2a03:2880:f11c:8183:face:b00c:0:25de	32934 (FACEBOOK) (FACEBOOK)
2	2a00:1450:400... 2a00:1450:4001:803::2004	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:80f::2003	15169 (GOOGLE) (GOOGLE)
6	54.208.220.65 54.208.220.65	14618 (AMAZON-AES) (AMAZON-AES)
5	108.138.17.129 108.138.17.129	16509 (AMAZON-02) (AMAZON-02)
1	151.101.194.137 151.101.194.137	54113 (FASTLY) (FASTLY)
3	162.247.241.2 162.247.241.2	23467 (NEWRELIC-...) (NEWRELIC-AS-1)
125	39

22 185.85.15.47 (Germany)

ASN200107 (KL-EXT, CH)

usa.kaspersky.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 23.208.225.239 (Vienna, Austria)

ASN16625 (AKAMAI-AS, US)
PTR: a23-208-225-239.deploy.static.akamaitechnologies.com

service.maxymiser.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 185.85.15.23 (Germany)

ASN200107 (KL-EXT, CH)

media.kaspersky.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:812::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2001:4860:4802:36::15 (United States)

ASN15169 (GOOGLE, US)

sgtm.kaspersky.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 15.236.176.210 (Paris, France)

ASN16509 (AMAZON-02, US)
PTR: ec2-15-236-176-210.eu-west-3.compute.amazonaws.com

kaspersky.d3.sc.omtrdc.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 4.59.181.140 (Charlottetown, Canada)

ASN3356 (LEVEL3, US)

api-router.kaspersky-labs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.66.112.26 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-66-112-26.fra56.r.cloudfront.net

t.contentsquare.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2606:4700::6810:7aaf (United States) 2 redirects

ASN13335 (CLOUDFLARENET, US)

unpkg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:829::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a02:26f0:3500:16::215:149b (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)

snap.licdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2620:1ec:c11::200 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

bat.bing.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2606:4700:4400::6812:230b (United States) 3 redirects

ASN13335 (CLOUDFLARENET, US)

a.tribalfusion.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
s.tribalfusion.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.49.174.4 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-49-174-4.eu-west-1.compute.amazonaws.com

resources.xg4ken.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.66.97.122 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-66-97-122.fra56.r.cloudfront.net

js.go2sdk.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2600:9000:2156:9c00:17:2e54:9a00:93a1 (United States)

ASN16509 (AMAZON-02, US)

ove1.marketlinc.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f01c:8012:face:b00c:0:3 (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

16 23.36.163.232 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)
PTR: a23-36-163-232.deploy.static.akamaitechnologies.com

analytics.tiktok.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.206.171.79 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-206-171-79.compute-1.amazonaws.com

jadserve.postrelease.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.184.194 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s11-in-f2.1e100.net

pubads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 185.89.211.116 (Frankfurt am Main, Germany) 1 redirects

ASN29990 (ASN-APPNEX, US)
PTR: 956.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net

secure.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 142.250.185.166 (United States) 3 redirects

ASN15169 (GOOGLE, US)
PTR: fra16s51-in-f6.1e100.net

ad.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
9582686.fls.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:808::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

adservice.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 172.64.155.149 (United States) 2 redirects

ASN13335 (CLOUDFLARENET, US)

a4.tribalfusion.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 185.89.210.141 (Frankfurt am Main, Germany)

ASN29990 (ASN-APPNEX, US)
PTR: 950.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net

ib.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.215.191.30 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-215-191-30.eu-west-1.compute.amazonaws.com

w.usabilla.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 54.72.143.148 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-54-72-143-148.eu-west-1.compute.amazonaws.com

c.contentsquare.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:400c:c00::9c (Brussels, Belgium)

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2620:1ec:21::14 (United States) 3 redirects

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

px.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
www.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.107.42.14 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

px4.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.20.78.240 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-20-78-240.compute-1.amazonaws.com

api.ipify.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

13 3.211.180.245 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-3-211-180-245.compute-1.amazonaws.com

apps.mypurecloud.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.186.249.72 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 72.249.186.35.bc.googleusercontent.com

d.impactradius-event.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f11c:8183:face:b00c:0:25de (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:803::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:80f::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 54.208.220.65 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-208-220-65.compute-1.amazonaws.com

visitor-scoring-b.marketlinc.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 108.138.17.129 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-108-138-17-129.fra56.r.cloudfront.net

api-cdn.mypurecloud.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
api.mypurecloud.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.194.137 (United States)

ASN54113 (FASTLY, US)

js-agent.newrelic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 162.247.241.2 (Portland, United States)

ASN23467 (NEWRELIC-AS-1, US)

bam-cell.nr-data.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
26	kaspersky.com usa.kaspersky.com — Cisco Umbrella Rank: 613752 media.kaspersky.com — Cisco Umbrella Rank: 145846 sgtm.kaspersky.com — Cisco Umbrella Rank: 413185	906 KB
18	mypurecloud.com apps.mypurecloud.com — Cisco Umbrella Rank: 8310 api-cdn.mypurecloud.com — Cisco Umbrella Rank: 55758 api.mypurecloud.com — Cisco Umbrella Rank: 15428	359 KB
16	tiktok.com analytics.tiktok.com — Cisco Umbrella Rank: 894	85 KB
8	marketlinc.com ove1.marketlinc.com visitor-scoring-b.marketlinc.com — Cisco Umbrella Rank: 84791	16 KB
7	doubleclick.net 3 redirects pubads.g.doubleclick.net — Cisco Umbrella Rank: 489 ad.doubleclick.net — Cisco Umbrella Rank: 214 9582686.fls.doubleclick.net — Cisco Umbrella Rank: 415505 stats.g.doubleclick.net — Cisco Umbrella Rank: 118	3 KB
7	tribalfusion.com 5 redirects a.tribalfusion.com — Cisco Umbrella Rank: 804 s.tribalfusion.com — Cisco Umbrella Rank: 2199 a4.tribalfusion.com — Cisco Umbrella Rank: 34203	6 KB
4	linkedin.com 3 redirects px.ads.linkedin.com — Cisco Umbrella Rank: 361 www.linkedin.com — Cisco Umbrella Rank: 491 px4.ads.linkedin.com — Cisco Umbrella Rank: 5619	3 KB
4	google.com adservice.google.com — Cisco Umbrella Rank: 98 www.google.com — Cisco Umbrella Rank: 10	1 KB
4	adnxs.com 1 redirects secure.adnxs.com — Cisco Umbrella Rank: 462 ib.adnxs.com — Cisco Umbrella Rank: 238	4 KB
4	google-analytics.com www.google-analytics.com — Cisco Umbrella Rank: 52	20 KB
4	omtrdc.net kaspersky.d3.sc.omtrdc.net — Cisco Umbrella Rank: 303862	959 B
4	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 94	353 KB
3	nr-data.net bam-cell.nr-data.net — Cisco Umbrella Rank: 1543	3 KB
3	bing.com bat.bing.com — Cisco Umbrella Rank: 351	12 KB
3	unpkg.com 2 redirects unpkg.com — Cisco Umbrella Rank: 878	2 KB
3	contentsquare.net t.contentsquare.net — Cisco Umbrella Rank: 3376 c.contentsquare.net — Cisco Umbrella Rank: 3297	74 KB
3	maxymiser.net service.maxymiser.net — Cisco Umbrella Rank: 7804	49 KB
2	google.de www.google.de — Cisco Umbrella Rank: 5596	564 B
2	facebook.com www.facebook.com — Cisco Umbrella Rank: 100	315 B
2	facebook.net connect.facebook.net — Cisco Umbrella Rank: 155	111 KB
2	licdn.com snap.licdn.com — Cisco Umbrella Rank: 734	4 KB
2	kaspersky-labs.com api-router.kaspersky-labs.com — Cisco Umbrella Rank: 440507	633 B
1	newrelic.com js-agent.newrelic.com — Cisco Umbrella Rank: 402	16 KB
1	impactradius-event.com d.impactradius-event.com — Cisco Umbrella Rank: 2555	13 KB
1	ipify.org api.ipify.org — Cisco Umbrella Rank: 2743	218 B
1	usabilla.com w.usabilla.com — Cisco Umbrella Rank: 3054	19 KB
1	postrelease.com jadserve.postrelease.com — Cisco Umbrella Rank: 1375	427 B
1	go2sdk.com js.go2sdk.com — Cisco Umbrella Rank: 21685	18 KB
1	xg4ken.com resources.xg4ken.com — Cisco Umbrella Rank: 4474	4 KB
125	29

	Domain	Requested by
22	usa.kaspersky.com	usa.kaspersky.com
16	analytics.tiktok.com	usa.kaspersky.com analytics.tiktok.com
13	apps.mypurecloud.com	ove1.marketlinc.com apps.mypurecloud.com
6	visitor-scoring-b.marketlinc.com	ove1.marketlinc.com
4	s.tribalfusion.com	3 redirects a.tribalfusion.com
4	www.google-analytics.com	www.googletagmanager.com www.google-analytics.com
4	kaspersky.d3.sc.omtrdc.net	media.kaspersky.com
4	www.googletagmanager.com	usa.kaspersky.com www.googletagmanager.com
3	bam-cell.nr-data.net	apps.mypurecloud.com
3	api.mypurecloud.com	apps.mypurecloud.com
3	bat.bing.com	usa.kaspersky.com bat.bing.com
3	unpkg.com	2 redirects
3	sgtm.kaspersky.com	media.kaspersky.com www.googletagmanager.com
3	service.maxymiser.net	usa.kaspersky.com service.maxymiser.net
2	api-cdn.mypurecloud.com	apps.mypurecloud.com
2	www.google.de
2	www.google.com
2	www.facebook.com
2	px.ads.linkedin.com	2 redirects
2	stats.g.doubleclick.net	www.google-analytics.com
2	c.contentsquare.net
2	9582686.fls.doubleclick.net	1 redirects www.googletagmanager.com
2	ib.adnxs.com
2	a4.tribalfusion.com	2 redirects
2	adservice.google.com	9582686.fls.doubleclick.net
2	ad.doubleclick.net	2 redirects
2	secure.adnxs.com	1 redirects
2	connect.facebook.net	usa.kaspersky.com connect.facebook.net
2	ove1.marketlinc.com	www.googletagmanager.com usa.kaspersky.com
2	snap.licdn.com	www.googletagmanager.com snap.licdn.com
2	api-router.kaspersky-labs.com	usa.kaspersky.com
1	js-agent.newrelic.com	apps.mypurecloud.com
1	d.impactradius-event.com	usa.kaspersky.com
1	api.ipify.org	ove1.marketlinc.com
1	px4.ads.linkedin.com
1	www.linkedin.com	1 redirects
1	w.usabilla.com	usa.kaspersky.com
1	pubads.g.doubleclick.net
1	jadserve.postrelease.com
1	js.go2sdk.com	www.googletagmanager.com
1	resources.xg4ken.com	usa.kaspersky.com
1	a.tribalfusion.com	www.googletagmanager.com
1	t.contentsquare.net	usa.kaspersky.com
1	media.kaspersky.com	usa.kaspersky.com
125	44

This site contains links to these domains. Also see Links.

Domain
press.kaspersky.com
careers.kaspersky.com
www.kaspersky.com
ics-cert.kaspersky.com
securelist.com
tip.kaspersky.com
ics.kaspersky.com
www.facebook.com
twitter.com
linkedin.com
youtube.com
instagram.com
community.kaspersky.com
latam.kaspersky.com
www.kaspersky.com.br
www.kaspersky.ca
afrique.kaspersky.com
algerie.kaspersky.com
www.kaspersky.ma
www.kaspersky.co.za
www.kaspersky.tn
me-en.kaspersky.com
me.kaspersky.com
www.kaspersky.be
www.kaspersky.dk
www.kaspersky.de
www.kaspersky.es
www.kaspersky.fr
www.kaspersky.it
www.kaspersky.nl
www.kaspersky.no
www.kaspersky.pt
www.kaspersky.se
www.kaspersky.fi
www.kaspersky.co.uk
www.kaspersky.cz
www.kaspersky.hu
www.kaspersky.com.pl
www.kaspersky.ro
www.kaspersky.rs
www.kaspersky.com.tr
www.kaspersky.gr
www.kaspersky.bg
www.kaspersky.ru
www.kaspersky.ua
www.kaspersky.com.au
www.kaspersky.co.in
www.kaspersky.com.vn
www.kaspersky.co.th
www.kaspersky.co.kr
www.kaspersky.com.cn
www.kaspersky.com.hk
www.kaspersky.com.tw
www.kaspersky.co.jp

Subject Issuer	Validity	Valid
usa.kaspersky.com DigiCert TLS RSA SHA256 2020 CA1	`2022-03-31` - `2023-03-30`	a year	crt.sh
*.maxymiser.net DigiCert SHA2 Secure Server CA	`2022-02-27` - `2023-02-28`	a year	crt.sh
media.kaspersky.com DigiCert TLS RSA SHA256 2020 CA1	`2022-03-31` - `2023-03-31`	a year	crt.sh
*.google-analytics.com GTS CA 1C3	`2022-07-18` - `2022-10-10`	3 months	crt.sh
sgtm.kaspersky.com GTS CA 1D4	`2022-07-29` - `2022-10-27`	3 months	crt.sh
*.d3.sc.omtrdc.net DigiCert TLS RSA SHA256 2020 CA1	`2022-02-17` - `2023-03-07`	a year	crt.sh
api-router.kaspersky-labs.com DigiCert TLS RSA SHA256 2020 CA1	`2022-01-21` - `2023-01-21`	a year	crt.sh
t.contentsquare.net Amazon	`2021-11-13` - `2022-12-11`	a year	crt.sh
snap.licdn.com DigiCert SHA2 Secure Server CA	`2022-03-01` - `2023-03-01`	a year	crt.sh
www.bing.com Microsoft RSA TLS CA 01	`2022-06-10` - `2022-12-10`	6 months	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2022-06-07` - `2023-06-06`	a year	crt.sh
*.xg4ken.com Go Daddy Secure Certificate Authority - G2	`2021-09-17` - `2022-10-19`	a year	crt.sh
js.go2sdk.com Amazon	`2021-10-07` - `2022-11-04`	a year	crt.sh
*.marketlinc.com Amazon	`2022-01-06` - `2023-02-03`	a year	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2022-05-21` - `2022-08-19`	3 months	crt.sh
*.tiktok.com RapidSSL TLS DV RSA Mixed SHA256 2020 CA-1	`2021-12-13` - `2023-01-13`	a year	crt.sh
*.postrelease.com Amazon	`2021-12-28` - `2023-01-25`	a year	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2022-07-18` - `2022-10-10`	3 months	crt.sh
w.usabilla.com Amazon	`2022-02-10` - `2023-03-11`	a year	crt.sh
*.doubleclick.net GTS CA 1C3	`2022-07-18` - `2022-10-10`	3 months	crt.sh
c.contentsquare.net Amazon	`2021-09-14` - `2022-10-13`	a year	crt.sh
*.ipify.org Sectigo RSA Domain Validation Secure Server CA	`2022-02-07` - `2023-03-10`	a year	crt.sh
mypurecloud.com Amazon	`2021-10-21` - `2022-11-18`	a year	crt.sh
*.impactradius-event.com Sectigo RSA Domain Validation Secure Server CA	`2021-12-10` - `2023-01-06`	a year	crt.sh
www.google.com GTS CA 1C3	`2022-07-18` - `2022-10-10`	3 months	crt.sh
www.google.de GTS CA 1C3	`2022-07-18` - `2022-10-10`	3 months	crt.sh
*.google.com GTS CA 1C3	`2022-07-18` - `2022-10-10`	3 months	crt.sh
*.google.de GTS CA 1C3	`2022-07-18` - `2022-10-10`	3 months	crt.sh
js-agent.newrelic.com GlobalSign Atlas R3 DV TLS CA 2022 Q2	`2022-07-10` - `2023-08-11`	a year	crt.sh
*.nr-data.net DigiCert TLS RSA SHA256 2020 CA1	`2022-01-10` - `2023-02-10`	a year	crt.sh

This page contains 5 frames:

Primary Page: https://usa.kaspersky.com/about/press-releases/2022_apt-uses-shadowpad-backdoor-and-ms-exchange-vulnerability-to-attack-building-automation-systems
Frame ID: 5E4E55F02CCDD654FE2E9A8212F2B0DE
Requests: 104 HTTP requests in this frame

Frame: https://w.usabilla.com/1649d5fbb67c.js?lv=1
Frame ID: 005D65A83A79652B5FDCF1373C84FC1B
Requests: 1 HTTP requests in this frame

Frame: https://9582686.fls.doubleclick.net/activityi;dc_pre=CLaT18a2wPkCFblHHQkdQhIDRw;src=9582686;type=globalc;cat=globa0;ord=6654833928029;gtm=2od880;auiddc=682534601.1660277202;u1=B2C;u2=en_US;u4=usa.kaspersky.com;u5=%2Fabout%2Fpress-releases%2F2022_apt-uses-shadowpad-backdoor-and-ms-exchange-vulnerability-to-attack-building-automation-systems;u6=;u7=74520031576126851464020767640621381841-1053902295.1660277202;u9=_about_press-releases_2022_apt-uses-shadowpad-backdoor-and-ms-exchange-vulnerability-to-attack-building-automation-systems;~oref=https%3A%2F%2Fusa.kaspersky.com%2Fabout%2Fpress-releases%2F2022_apt-uses-shadowpad-backdoor-and-ms-exchange-vulnerability-to-attack-building-automation-systems
Frame ID: 159C85CACE92C76043342316809EE296
Requests: 2 HTTP requests in this frame

Frame: https://www.facebook.com/tr/
Frame ID: 3C5496DE2747648FC38F326722842028
Requests: 1 HTTP requests in this frame

Frame: https://apps.mypurecloud.com/messenger/messenger.html
Frame ID: EB72F1F7BCD7478FE7A84B06E09FFEFA
Requests: 13 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Kaspersky ICS CERT discovered threat actor attacking telecommunications, manufacturing, and transport organizations | Kaspersky

Detected technologies

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

React (JavaScript Frameworks) Expand

Overall confidence: 100%
Detected patterns

<[^>]+data-react

AppNexus (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

adnxs\.(?:net|com)

Facebook (Widgets) Expand

Overall confidence: 100%
Detected patterns

//connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js

Genesys Cloud (Marketing automation) Expand

Overall confidence: 100%
Detected patterns

apps\.mypurecloud\.\w+

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

google-analytics\.com/(?:ga|urchin|analytics)\.js

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/ns\.html[^>]+></iframe>
googletagmanager\.com/gtm\.js
googletagmanager\.com/gtag/js

Impact (Affiliate programs) Expand

Overall confidence: 100%
Detected patterns

d\.impactradius-event\.com

Linkedin Insight Tag (Analytics) Expand

Overall confidence: 100%
Detected patterns

snap\.licdn\.com/li\.lms-analytics/insight\.min\.js

Page Statistics

125
Requests

94 %
HTTPS

38 %
IPv6

29
Domains

44
Subdomains

39
IPs

7
Countries

2076 kB
Transfer

6624 kB
Size

59
Cookies

58 Outgoing links

These are links going to different origins than the main page.

URL: https://press.kaspersky.com/
Title: Press Center

Search URL Search Domain Scan URL

URL: https://careers.kaspersky.com/
Title: Careers

Search URL Search Domain Scan URL

URL: https://www.kaspersky.com/about/sponsorships/
Title: Sponsorships

Search URL Search Domain Scan URL

URL: https://ics-cert.kaspersky.com/publications/reports/2022/06/27/attacks-on-industrial-control-systems-using-shadowpad/?utm_source=press-release&utm_medium=email&utm_campaign=attacks-on-industrial-control-systems-using-shadowpad
Title: discovered

Search URL Search Domain Scan URL

URL: https://securelist.com/shadowpad-in-corporate-networks/81432/
Title: ShadowPad

Search URL Search Domain Scan URL

URL: https://tip.kaspersky.com/
Title: ICS Threat Intelligence Reporting service

Search URL Search Domain Scan URL

URL: https://ics.kaspersky.com/products/
Title: Kaspersky Industrial CyberSecurity

Search URL Search Domain Scan URL

URL: https://www.kaspersky.com/enterprise-security/endpoint
Title: Integrated Endpoint Security

Search URL Search Domain Scan URL

URL: https://ics-cert.kaspersky.com/
Title: ics-cert.kaspersky.com

Search URL Search Domain Scan URL

URL: https://www.facebook.com/Kaspersky

Search URL Search Domain Scan URL

URL: https://twitter.com/kaspersky

Search URL Search Domain Scan URL

URL: https://linkedin.com/company/kaspersky/

Search URL Search Domain Scan URL

URL: https://youtube.com/Kaspersky

Search URL Search Domain Scan URL

URL: https://instagram.com/kasperskylab

Search URL Search Domain Scan URL

URL: https://community.kaspersky.com/

Search URL Search Domain Scan URL

URL: https://www.kaspersky.com/web-privacy-policy/ccpa#optout
Title: Online Tracking Opt-Out Guide

Search URL Search Domain Scan URL

URL: https://latam.kaspersky.com/?ignoreredirects=true
Title: América Latina

Search URL Search Domain Scan URL

URL: https://www.kaspersky.com.br/?ignoreredirects=true
Title: Brasil

Search URL Search Domain Scan URL

URL: https://www.kaspersky.ca/?ignoreredirects=true
Title: Canada

Search URL Search Domain Scan URL

URL: https://afrique.kaspersky.com/
Title: Afrique Francophone

Search URL Search Domain Scan URL

URL: https://algerie.kaspersky.com/
Title: Algéria

Search URL Search Domain Scan URL

URL: https://www.kaspersky.ma/
Title: Maroc

Search URL Search Domain Scan URL

URL: https://www.kaspersky.co.za/?ignoreredirects=true
Title: South Africa

Search URL Search Domain Scan URL

URL: https://www.kaspersky.tn/
Title: Tunisia

Search URL Search Domain Scan URL

URL: https://me-en.kaspersky.com/?ignoreredirects=true
Title: Middle East

Search URL Search Domain Scan URL

URL: https://me.kaspersky.com/?ignoreredirects=true
Title: الشرق الأوسط

Search URL Search Domain Scan URL

URL: https://www.kaspersky.be/?ignoreredirects=true
Title: Belgique & Luxembourg

Search URL Search Domain Scan URL

URL: https://www.kaspersky.dk/?ignoreredirects=true
Title: Danmark

Search URL Search Domain Scan URL

URL: https://www.kaspersky.de/?ignoreredirects=true
Title: Deutschland & Schweiz

Search URL Search Domain Scan URL

URL: https://www.kaspersky.es/?ignoreredirects=true
Title: España

Search URL Search Domain Scan URL

URL: https://www.kaspersky.fr/?ignoreredirects=true
Title: France

Search URL Search Domain Scan URL

URL: https://www.kaspersky.it/?ignoreredirects=true
Title: Italia & Svizzera

Search URL Search Domain Scan URL

URL: https://www.kaspersky.nl/?ignoreredirects=true
Title: Nederland

Search URL Search Domain Scan URL

URL: https://www.kaspersky.no/?ignoreredirects=true
Title: Norge

Search URL Search Domain Scan URL

URL: https://www.kaspersky.pt/?ignoreredirects=true
Title: Portugal

Search URL Search Domain Scan URL

URL: https://www.kaspersky.se/?ignoreredirects=true
Title: Sverige

Search URL Search Domain Scan URL

URL: https://www.kaspersky.fi/?ignoreredirects=true
Title: Suomi

Search URL Search Domain Scan URL

URL: https://www.kaspersky.co.uk/?ignoreredirects=true
Title: United Kingdom

Search URL Search Domain Scan URL

URL: https://www.kaspersky.cz/
Title: Česká republika

Search URL Search Domain Scan URL

URL: https://www.kaspersky.hu/
Title: Magyarország

Search URL Search Domain Scan URL

URL: https://www.kaspersky.com.pl/
Title: Polska

Search URL Search Domain Scan URL

URL: https://www.kaspersky.ro/
Title: România

Search URL Search Domain Scan URL

URL: https://www.kaspersky.rs/
Title: Srbija

Search URL Search Domain Scan URL

URL: https://www.kaspersky.com.tr/?ignoreredirects=true
Title: Türkiye

Search URL Search Domain Scan URL

URL: https://www.kaspersky.gr/
Title: Ελλάδα (Greece)

Search URL Search Domain Scan URL

URL: https://www.kaspersky.bg/
Title: България (Bulgaria)

Search URL Search Domain Scan URL

URL: https://www.kaspersky.ru/?ignoreredirects=true
Title: Россия и Белару́сь (Russia & Belarus)

Search URL Search Domain Scan URL

URL: https://www.kaspersky.ua/
Title: Україна (Ukraine)

Search URL Search Domain Scan URL

URL: https://www.kaspersky.com.au/?ignoreredirects=true
Title: Australia

Search URL Search Domain Scan URL

URL: https://www.kaspersky.co.in/?ignoreredirects=true
Title: India

Search URL Search Domain Scan URL

URL: https://www.kaspersky.com.vn/
Title: Việt Nam

Search URL Search Domain Scan URL

URL: https://www.kaspersky.co.th/
Title: ไทย (Thailand)

Search URL Search Domain Scan URL

URL: https://www.kaspersky.co.kr/
Title: 한국 (Korea)

Search URL Search Domain Scan URL

URL: https://www.kaspersky.com.cn/?ignoreredirects=true
Title: 中国 (China)

Search URL Search Domain Scan URL

URL: https://www.kaspersky.com.hk/
Title: 中国香港 (Hong Kong)

Search URL Search Domain Scan URL

URL: https://www.kaspersky.com.tw/
Title: 中国台灣 (Taiwan)

Search URL Search Domain Scan URL

URL: https://www.kaspersky.co.jp/
Title: 日本語 (Japan)

Search URL Search Domain Scan URL

URL: https://www.kaspersky.com/?ignoreredirects=true
Title: Global Website

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 33

https://unpkg.com/web-vitals HTTP 302
https://unpkg.com/web-vitals@2.1.4 HTTP 302
https://unpkg.com/web-vitals@2.1.4/dist/web-vitals.umd.js

Request Chain 46

https://secure.adnxs.com/px?id=1565496&seg=29456374&t=2 HTTP 307
https://secure.adnxs.com/bounce?%2Fpx%3Fid%3D1565496%26seg%3D29456374%26t%3D2

Request Chain 47

https://ad.doubleclick.net/ddm/activity/src=11733622;type=invmedia;cat=kaspe00;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=$%7BGDPR%7D;gdpr_consent=$%7BGDPR_CONSENT_755%7D;ord=5499487384964.172 HTTP 302
https://ad.doubleclick.net/ddm/activity/src=11733622;dc_pre=COCp0ca2wPkCFaIQ5godB18ONQ;type=invmedia;cat=kaspe00;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=$%7BGDPR%7D;gdpr_consent=$%7BGDPR_CONSENT_755%7D;ord=5499487384964.172 HTTP 302
https://adservice.google.com/ddm/fls/z/src=11733622;dc_pre=COCp0ca2wPkCFaIQ5godB18ONQ;type=invmedia;cat=kaspe00;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=$%7BGDPR%7D;gdpr_consent=$%7BGDPR_CONSENT_755%7D;ord=5499487384964.172

Request Chain 48

https://s.tribalfusion.com/i.cid?c=705083&ev=0&page=Global HTTP 302
https://s.tribalfusion.com/z/i.cid?c=705083&ev=0&page=Global HTTP 302
https://a4.tribalfusion.com/ipg?ip6=2a02:6ea0:c71b:0:1011:9417:3a04:a480&kv=%7B%22ord%22%3A%2016110033%2C%20%22clientID%22%3A%20705083%7D&redirect=https://ib.adnxs.com/getuidu?https://a.tribalfusion.com/i.match?p=b26&u=$UID&redirect=https%3A%2F%2Fib.adnxs.com%2Fsetuid%3Fentity%3D305%26code%3D%24TF_USER_ID_ENC%24 HTTP 302
https://ib.adnxs.com/setuid?entity=305&code=$TF_USER_ID_ENC$

Request Chain 53

https://9582686.fls.doubleclick.net/activityi;src=9582686;type=globalc;cat=globa0;ord=6654833928029;gtm=2od880;auiddc=682534601.1660277202;u1=B2C;u2=en_US;u4=usa.kaspersky.com;u5=%2Fabout%2Fpress-releases%2F2022_apt-uses-shadowpad-backdoor-and-ms-exchange-vulnerability-to-attack-building-automation-systems;u6=;u7=74520031576126851464020767640621381841-1053902295.1660277202;u9=_about_press-releases_2022_apt-uses-shadowpad-backdoor-and-ms-exchange-vulnerability-to-attack-building-automation-systems;~oref=https%3A%2F%2Fusa.kaspersky.com%2Fabout%2Fpress-releases%2F2022_apt-uses-shadowpad-backdoor-and-ms-exchange-vulnerability-to-attack-building-automation-systems HTTP 302
https://9582686.fls.doubleclick.net/activityi;dc_pre=CLaT18a2wPkCFblHHQkdQhIDRw;src=9582686;type=globalc;cat=globa0;ord=6654833928029;gtm=2od880;auiddc=682534601.1660277202;u1=B2C;u2=en_US;u4=usa.kaspersky.com;u5=%2Fabout%2Fpress-releases%2F2022_apt-uses-shadowpad-backdoor-and-ms-exchange-vulnerability-to-attack-building-automation-systems;u6=;u7=74520031576126851464020767640621381841-1053902295.1660277202;u9=_about_press-releases_2022_apt-uses-shadowpad-backdoor-and-ms-exchange-vulnerability-to-attack-building-automation-systems;~oref=https%3A%2F%2Fusa.kaspersky.com%2Fabout%2Fpress-releases%2F2022_apt-uses-shadowpad-backdoor-and-ms-exchange-vulnerability-to-attack-building-automation-systems

Request Chain 60

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=39138&time=1660277201682&url=https%3A%2F%2Fusa.kaspersky.com%2Fabout%2Fpress-releases%2F2022_apt-uses-shadowpad-backdoor-and-ms-exchange-vulnerability-to-attack-building-automation-systems HTTP 302
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D39138%26time%3D1660277201682%26url%3Dhttps%253A%252F%252Fusa.kaspersky.com%252Fabout%252Fpress-releases%252F2022_apt-uses-shadowpad-backdoor-and-ms-exchange-vulnerability-to-attack-building-automation-systems%26liSync%3Dtrue HTTP 302
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=39138&time=1660277201682&url=https%3A%2F%2Fusa.kaspersky.com%2Fabout%2Fpress-releases%2F2022_apt-uses-shadowpad-backdoor-and-ms-exchange-vulnerability-to-attack-building-automation-systems&liSync=true HTTP 302
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=39138&time=1660277201682&url=https%3A%2F%2Fusa.kaspersky.com%2Fabout%2Fpress-releases%2F2022_apt-uses-shadowpad-backdoor-and-ms-exchange-vulnerability-to-attack-building-automation-systems&liSync=true&e_ipv6=AQKaDwuGdCr-lAAAAYKQO5x3tUqd_d5JsPMeCmvv6TXhU2sqfxfxpXlPc6H9kenO9_dFXIBBrq3ciTvxn_K1khlBOrukPA

Request Chain 89

https://s.tribalfusion.com/insights?%7B%22tagKey%22%3A%222481917101%22%2C%22th%22%3A7238200512%2C%22version%22%3A%221.0%22%2C%22tKey%22%3A%22aKmneMXT3o4abf2qj5mTrEUGJRQhSIYe%22%2C%22url%22%3A%22https%3A%2F%2Fusa.kaspersky.com%2Fabout%2Fpress-releases%2F2022_apt-uses-shadowpad-backdoor-and-ms-exchange-vulnerability-to-attack-building-automation-systems%22%2C%22clientName%22%3A%22Kaspersky%2520UK%22%2C%22clientID%22%3A797783%2C%22eventType%22%3A%22insights%22%2C%22segmentNumber%22%3A0%2C%22segmentName%22%3A%22all%22%7D HTTP 302
https://a4.tribalfusion.com/ipg?ip6=2a02:6ea0:c71b:0:1011:9417:3a04:a480&kv=%7B%22ord%22%3A%2016110034%2C%20%22clientID%22%3A%20797783%7D&redirect=https://ib.adnxs.com/getuidu?https://a.tribalfusion.com/i.match?p=b26&u=$UID&redirect=https%3A%2F%2Fib.adnxs.com%2Fsetuid%3Fentity%3D305%26code%3D%24TF_USER_ID_ENC%24 HTTP 302
https://ib.adnxs.com/setuid?entity=305&code=$TF_USER_ID_ENC$

125 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request 2022_apt-uses-shadowpad-backdoor-and-ms-exchange-vulnerability-to-attack-building-automation-systems Show response
usa.kaspersky.com/about/press-releases/ 254 KB
47 KB 943ms
668ms Document
text/html 185.85.15.47
KL-EXT

General

Check archive.org

Show headers Download Go to

Full URL

https://usa.kaspersky.com/about/press-releases/2022_apt-uses-shadowpad-backdoor-and-ms-exchange-vulnerability-to-attack-building-automation-systems

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

185.85.15.47 , Germany, ASN200107 (KL-EXT, CH),

Reverse DNS

Software

nginx /

Resource Hash

e464599709cada66bc11f679a0d10f56c7bd9229e2d745c27a0d6ec47b921734

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: max-age=600
content-encoding: gzip
content-type: text/html; charset=utf-8
date: Fri, 12 Aug 2022 04:06:40 GMT
expires: Fri, 12 Aug 2022 04:16:40 GMT
referrer-policy: no-referrer-when-downgrade
server: nginx
strict-transport-security: max-age=31536000; includeSubDomains
vary: Accept-Encoding Accept-Encoding
x-cached: MISS
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-platform: repository
x-proxy: fra2
x-request-id: b5b5f84fbfb263b042cff6d7a5a19fcd
x-server: MSKTCMWEB11
x-xss-protection: 1; mode=block

GET
H2 200 mmapi.js Show response
service.maxymiser.net/cdn/com.kaspersky/js/ 20 KB
7 KB 91ms
18ms Script
application/x-javascript 23.208.225.239
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://service.maxymiser.net/cdn/com.kaspersky/js/mmapi.js
Requested by: Host: usa.kaspersky.com
URL: https://usa.kaspersky.com/about/press-releases/2022_apt-uses-shadowpad-backdoor-and-ms-exchange-vulnerability-to-attack-building-automation-systems
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.208.225.239 Vienna, Austria, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-208-225-239.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 59cd7afa1fc8b7762fb5ae77a9c84278b96f3559d097274cd766bda573509dd6

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://usa.kaspersky.com/about/press-releases/2022_apt-uses-shadowpad-backdoor-and-ms-exchange-vulnerability-to-attack-building-automation-systems
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Fri, 12 Aug 2022 04:06:40 GMT
content-encoding: gzip
last-modified: Thu, 17 Jun 2021 08:32:45 GMT
server: AkamaiNetStorage
etag: "09870a1ec48f9cc2347e176bc55e5bcb:1623918767.047959"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: max-age=10
accept-ranges: bytes
content-length: 7170

GET
H2 200 e40bd16e0074e71ecab9.css
usa.kaspersky.com/_next/static/css/ 22 KB
6 KB 201ms
196ms Stylesheet
text/css 185.85.15.47
KL-EXT

General

Check archive.org

Show headers Download Go to

Full URL

https://usa.kaspersky.com/_next/static/css/e40bd16e0074e71ecab9.css

Requested by

Host: usa.kaspersky.com
URL: https://usa.kaspersky.com/about/press-releases/2022_apt-uses-shadowpad-backdoor-and-ms-exchange-vulnerability-to-attack-building-automation-systems

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

185.85.15.47 , Germany, ASN200107 (KL-EXT, CH),

Reverse DNS

Software

nginx /

Resource Hash

60f9b992130b179601e0710bac4742708f71e8df9fad48da085119afa560a9ae

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://usa.kaspersky.com/about/press-releases/2022_apt-uses-shadowpad-backdoor-and-ms-exchange-vulnerability-to-attack-building-automation-systems
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

x-proxy: fra2
date: Fri, 12 Aug 2022 04:06:40 GMT
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains
x-cached: EXPIRED
x-request-id: 145978337c57923ac925972ad8f77d76
referrer-policy: no-referrer-when-downgrade
last-modified: Mon, 01 Aug 2022 10:32:34 GMT
server: nginx
x-frame-options: SAMEORIGIN
etag: W/"595a-18258f6edd0"
vary: Accept-Encoding, Accept-Encoding
content-type: text/css; charset=UTF-8
x-xss-protection: 1; mode=block
cache-control: max-age=600
expires: Fri, 12 Aug 2022 04:16:40 GMT

GET
H2 200 4f687798769426a22aaf.css
usa.kaspersky.com/_next/static/css/ 140 KB
22 KB 392ms
387ms Stylesheet
text/css 185.85.15.47
KL-EXT

General

Check archive.org

Show headers Download Go to

Full URL

https://usa.kaspersky.com/_next/static/css/4f687798769426a22aaf.css

Requested by

Host: usa.kaspersky.com
URL: https://usa.kaspersky.com/about/press-releases/2022_apt-uses-shadowpad-backdoor-and-ms-exchange-vulnerability-to-attack-building-automation-systems

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

185.85.15.47 , Germany, ASN200107 (KL-EXT, CH),

Reverse DNS

Software

nginx /

Resource Hash

f2d6f3a3ec74da2472b0bc0965ca7580bb52503ebb824178e9b15a60eef8ac90

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://usa.kaspersky.com/about/press-releases/2022_apt-uses-shadowpad-backdoor-and-ms-exchange-vulnerability-to-attack-building-automation-systems
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

x-proxy: fra2
date: Fri, 12 Aug 2022 04:06:40 GMT
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains
x-cached: EXPIRED
x-request-id: 3f6d9b7d9b5964d11770a1a51ee2b86a
referrer-policy: no-referrer-when-downgrade
last-modified: Mon, 01 Aug 2022 10:32:34 GMT
server: nginx
x-frame-options: SAMEORIGIN
etag: W/"23184-18258f6edd0"
vary: Accept-Encoding, Accept-Encoding
content-type: text/css; charset=UTF-8
x-xss-protection: 1; mode=block
cache-control: max-age=600
expires: Fri, 12 Aug 2022 04:16:40 GMT

GET
H2 200 _app.js Show response
usa.kaspersky.com/_next/static/spCQAHN-xY9JZO9Y0uq_m/pages/ 388 KB
106 KB 398ms
393ms Script
application/javascript 185.85.15.47
KL-EXT

General

Check archive.org

Show headers Download Go to

Full URL

https://usa.kaspersky.com/_next/static/spCQAHN-xY9JZO9Y0uq_m/pages/_app.js

Requested by

Host: usa.kaspersky.com
URL: https://usa.kaspersky.com/about/press-releases/2022_apt-uses-shadowpad-backdoor-and-ms-exchange-vulnerability-to-attack-building-automation-systems

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

185.85.15.47 , Germany, ASN200107 (KL-EXT, CH),

Reverse DNS

Software

nginx /

Resource Hash

13358f681f05b2514b9d6675a98746d6b5bde5902e7c9b4320e831475be2e6b3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://usa.kaspersky.com/about/press-releases/2022_apt-uses-shadowpad-backdoor-and-ms-exchange-vulnerability-to-attack-building-automation-systems
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

x-proxy: fra2
date: Fri, 12 Aug 2022 04:06:40 GMT
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains
x-cached: EXPIRED
x-request-id: 146730f4f69bafebb4175e67d0ba93cf
referrer-policy: no-referrer-when-downgrade
last-modified: Mon, 01 Aug 2022 10:32:38 GMT
server: nginx
x-frame-options: SAMEORIGIN
etag: W/"6112d-18258f6fd70"
vary: Accept-Encoding, Accept-Encoding
content-type: application/javascript; charset=UTF-8
x-xss-protection: 1; mode=block
cache-control: max-age=600
expires: Fri, 12 Aug 2022 04:16:40 GMT

GET
H2 200 %5BarticleTitle%5D.js Show response
usa.kaspersky.com/_next/static/spCQAHN-xY9JZO9Y0uq_m/pages/about/press-releases/ 1008 KB
293 KB 439ms
435ms Script
application/javascript 185.85.15.47
KL-EXT

General

Check archive.org

Show headers Download Go to

Full URL

https://usa.kaspersky.com/_next/static/spCQAHN-xY9JZO9Y0uq_m/pages/about/press-releases/%5BarticleTitle%5D.js

Requested by

Host: usa.kaspersky.com
URL: https://usa.kaspersky.com/about/press-releases/2022_apt-uses-shadowpad-backdoor-and-ms-exchange-vulnerability-to-attack-building-automation-systems

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

185.85.15.47 , Germany, ASN200107 (KL-EXT, CH),

Reverse DNS

Software

nginx /

Resource Hash

6b5463d352f4d61ca0a83a5bcbed6730584b8c3a9feb484a0efaac3274ff7383

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://usa.kaspersky.com/about/press-releases/2022_apt-uses-shadowpad-backdoor-and-ms-exchange-vulnerability-to-attack-building-automation-systems
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

x-proxy: fra2
date: Fri, 12 Aug 2022 04:06:40 GMT
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains
x-cached: EXPIRED
x-request-id: 1dd1d21f898015ac8d1e9516737d9450
referrer-policy: no-referrer-when-downgrade
last-modified: Mon, 01 Aug 2022 10:32:38 GMT
server: nginx
x-frame-options: SAMEORIGIN
etag: W/"fc1fb-18258f6fd70"
vary: Accept-Encoding, Accept-Encoding
content-type: application/javascript; charset=UTF-8
x-xss-protection: 1; mode=block
cache-control: max-age=600
expires: Fri, 12 Aug 2022 04:16:40 GMT

GET
H2 200 webpack-1c5199ff66550d26e499.js Show response
usa.kaspersky.com/_next/static/runtime/ 1 KB
1 KB 439ms
435ms Script
application/javascript 185.85.15.47
KL-EXT

General

Check archive.org

Show headers Download Go to

Full URL

https://usa.kaspersky.com/_next/static/runtime/webpack-1c5199ff66550d26e499.js

Requested by

Host: usa.kaspersky.com
URL: https://usa.kaspersky.com/about/press-releases/2022_apt-uses-shadowpad-backdoor-and-ms-exchange-vulnerability-to-attack-building-automation-systems

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

185.85.15.47 , Germany, ASN200107 (KL-EXT, CH),

Reverse DNS

Software

nginx /

Resource Hash

e2fbb88b4d15a9f7702ca58ebbe8d1d927ffd2667e585e70a5f3d51acb1a37d2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://usa.kaspersky.com/about/press-releases/2022_apt-uses-shadowpad-backdoor-and-ms-exchange-vulnerability-to-attack-building-automation-systems
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

x-proxy: fra2
date: Fri, 12 Aug 2022 04:06:40 GMT
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains
x-cached: EXPIRED
x-request-id: 62e621991bddfd27c3a0ebd5c07a0288
referrer-policy: no-referrer-when-downgrade
last-modified: Mon, 01 Aug 2022 10:32:38 GMT
server: nginx
x-frame-options: SAMEORIGIN
etag: W/"5fb-18258f6fd70"
vary: Accept-Encoding, Accept-Encoding
content-type: application/javascript; charset=UTF-8
x-xss-protection: 1; mode=block
cache-control: max-age=600
expires: Fri, 12 Aug 2022 04:16:40 GMT

GET
H2 200 framework.619a4f70c1d4d3a29cbc.js Show response
usa.kaspersky.com/_next/static/chunks/ 126 KB
40 KB 465ms
462ms Script
application/javascript 185.85.15.47
KL-EXT

General

Check archive.org

Show headers Download Go to

Full URL

https://usa.kaspersky.com/_next/static/chunks/framework.619a4f70c1d4d3a29cbc.js

Requested by

Host: usa.kaspersky.com
URL: https://usa.kaspersky.com/about/press-releases/2022_apt-uses-shadowpad-backdoor-and-ms-exchange-vulnerability-to-attack-building-automation-systems

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

185.85.15.47 , Germany, ASN200107 (KL-EXT, CH),

Reverse DNS

Software

nginx /

Resource Hash

ece9461b67448fd9efc75ad4bbf3c6a2f0d0aea477046e8822068aee283160d6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://usa.kaspersky.com/about/press-releases/2022_apt-uses-shadowpad-backdoor-and-ms-exchange-vulnerability-to-attack-building-automation-systems
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

x-proxy: fra2
date: Fri, 12 Aug 2022 04:06:40 GMT
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains
x-cached: EXPIRED
x-request-id: 85dc51788ad201e74c9232a72b84dc74
referrer-policy: no-referrer-when-downgrade
last-modified: Mon, 01 Aug 2022 10:32:34 GMT
server: nginx
x-frame-options: SAMEORIGIN
etag: W/"1f968-18258f6edd0"
vary: Accept-Encoding, Accept-Encoding
content-type: application/javascript; charset=UTF-8
x-xss-protection: 1; mode=block
cache-control: max-age=600
expires: Fri, 12 Aug 2022 04:16:40 GMT

GET
H2 200 commons.e10f62e1d912a15c1c9c.js Show response
usa.kaspersky.com/_next/static/chunks/ 9 KB
4 KB 465ms
462ms Script
application/javascript 185.85.15.47
KL-EXT

General

Check archive.org

Show headers Download Go to

Full URL

https://usa.kaspersky.com/_next/static/chunks/commons.e10f62e1d912a15c1c9c.js

Requested by

Host: usa.kaspersky.com
URL: https://usa.kaspersky.com/about/press-releases/2022_apt-uses-shadowpad-backdoor-and-ms-exchange-vulnerability-to-attack-building-automation-systems

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

185.85.15.47 , Germany, ASN200107 (KL-EXT, CH),

Reverse DNS

Software

nginx /

Resource Hash

7aaf4727a2b360e8504f0d6d610dcacaee9def6b26adb81756128a25fd462ff3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://usa.kaspersky.com/about/press-releases/2022_apt-uses-shadowpad-backdoor-and-ms-exchange-vulnerability-to-attack-building-automation-systems
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

x-proxy: fra2
date: Fri, 12 Aug 2022 04:06:40 GMT
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains
x-cached: EXPIRED
x-request-id: 55c92b00f12847cfc65dee8d0cf2484c
referrer-policy: no-referrer-when-downgrade
last-modified: Mon, 01 Aug 2022 10:32:34 GMT
server: nginx
x-frame-options: SAMEORIGIN
etag: W/"22b0-18258f6edd0"
vary: Accept-Encoding, Accept-Encoding
content-type: application/javascript; charset=UTF-8
x-xss-protection: 1; mode=block
cache-control: max-age=600
expires: Fri, 12 Aug 2022 04:16:40 GMT

GET
H2 200 main-d5dab41907fa039833af.js Show response
usa.kaspersky.com/_next/static/runtime/ 41 KB
14 KB 488ms
486ms Script
application/javascript 185.85.15.47
KL-EXT

General

Check archive.org

Show headers Download Go to

Full URL

https://usa.kaspersky.com/_next/static/runtime/main-d5dab41907fa039833af.js

Requested by

Host: usa.kaspersky.com
URL: https://usa.kaspersky.com/about/press-releases/2022_apt-uses-shadowpad-backdoor-and-ms-exchange-vulnerability-to-attack-building-automation-systems

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

185.85.15.47 , Germany, ASN200107 (KL-EXT, CH),

Reverse DNS

Software

nginx /

Resource Hash

e86f7686f9ed6a53e17a3b99796d79ca19a1478349004210abd3db4f170bdcc8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://usa.kaspersky.com/about/press-releases/2022_apt-uses-shadowpad-backdoor-and-ms-exchange-vulnerability-to-attack-building-automation-systems
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

x-proxy: fra2
date: Fri, 12 Aug 2022 04:06:41 GMT
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains
x-cached: EXPIRED
x-request-id: 33cb4836b138b91773f25c710a486748
referrer-policy: no-referrer-when-downgrade
last-modified: Mon, 01 Aug 2022 10:32:38 GMT
server: nginx
x-frame-options: SAMEORIGIN
etag: W/"a46d-18258f6fd70"
vary: Accept-Encoding, Accept-Encoding
content-type: application/javascript; charset=UTF-8
x-xss-protection: 1; mode=block
cache-control: max-age=600
expires: Fri, 12 Aug 2022 04:16:41 GMT

GET
H2 200 29107295.f6a75533f44746ed893d.js Show response
usa.kaspersky.com/_next/static/chunks/ 70 KB
25 KB 488ms
486ms Script
application/javascript 185.85.15.47
KL-EXT

General

Check archive.org

Show headers Download Go to

Full URL

https://usa.kaspersky.com/_next/static/chunks/29107295.f6a75533f44746ed893d.js

Requested by

Host: usa.kaspersky.com
URL: https://usa.kaspersky.com/about/press-releases/2022_apt-uses-shadowpad-backdoor-and-ms-exchange-vulnerability-to-attack-building-automation-systems

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

185.85.15.47 , Germany, ASN200107 (KL-EXT, CH),

Reverse DNS

Software

nginx /

Resource Hash

19714b127696958ae4ba21a02028b0ae5590727c08cd0658ada679ee61b0e1f1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://usa.kaspersky.com/about/press-releases/2022_apt-uses-shadowpad-backdoor-and-ms-exchange-vulnerability-to-attack-building-automation-systems
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

x-proxy: fra2
date: Fri, 12 Aug 2022 04:06:41 GMT
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains
x-cached: EXPIRED
x-request-id: d4cfc9cb47cbc1739582f094db19c16e
referrer-policy: no-referrer-when-downgrade
last-modified: Mon, 01 Aug 2022 10:32:34 GMT
server: nginx
x-frame-options: SAMEORIGIN
etag: W/"117b2-18258f6edd0"
vary: Accept-Encoding, Accept-Encoding
content-type: application/javascript; charset=UTF-8
x-xss-protection: 1; mode=block
cache-control: max-age=600
expires: Fri, 12 Aug 2022 04:16:41 GMT

GET
H2 200 logo.jpg
usa.kaspersky.com/content/en-us/images/homepage/ 8 KB
9 KB 188ms
187ms Image
image/jpeg 185.85.15.47
KL-EXT

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://usa.kaspersky.com/content/en-us/images/homepage/logo.jpg

Requested by

Host: usa.kaspersky.com
URL: https://usa.kaspersky.com/about/press-releases/2022_apt-uses-shadowpad-backdoor-and-ms-exchange-vulnerability-to-attack-building-automation-systems

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

185.85.15.47 , Germany, ASN200107 (KL-EXT, CH),

Reverse DNS

Software

nginx / ASP.NET

Resource Hash

42da5645360f8148bbba20cf35c8be5fa929deac9d43062fd3b580827ce2a51a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://usa.kaspersky.com/about/press-releases/2022_apt-uses-shadowpad-backdoor-and-ms-exchange-vulnerability-to-attack-building-automation-systems
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

x-proxy: fra2
date: Fri, 12 Aug 2022 04:06:40 GMT
x-content-type-options: nosniff
x-powered-by: ASP.NET
strict-transport-security: max-age=31536000; includeSubDomains
content-length: 8420
x-xss-protection: 1; mode=block
x-request-id: 927d7adad24edc178967b723ec817d8c
referrer-policy: no-referrer-when-downgrade
last-modified: Wed, 21 Feb 2018 18:02:45 GMT
server: nginx
x-cached: STALE
etag: "8010b12c3eabd31:0"
x-frame-options: SAMEORIGIN
content-type: image/jpeg
cache-control: max-age=86400
x-server: FRA6
accept-ranges: bytes
expires: Sat, 13 Aug 2022 04:06:40 GMT

GET
H2 200 _buildManifest.js Show response
usa.kaspersky.com/_next/static/spCQAHN-xY9JZO9Y0uq_m/ 1 KB
937 B 292ms
291ms Script
application/javascript 185.85.15.47
KL-EXT

General

Check archive.org

Show headers Download Go to

Full URL

https://usa.kaspersky.com/_next/static/spCQAHN-xY9JZO9Y0uq_m/_buildManifest.js

Requested by

Host: usa.kaspersky.com
URL: https://usa.kaspersky.com/about/press-releases/2022_apt-uses-shadowpad-backdoor-and-ms-exchange-vulnerability-to-attack-building-automation-systems

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

185.85.15.47 , Germany, ASN200107 (KL-EXT, CH),

Reverse DNS

Software

nginx /

Resource Hash

6581ee4496126d377cbfe5ad3ad5071375819734c74627b04553de1a21634846

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://usa.kaspersky.com/about/press-releases/2022_apt-uses-shadowpad-backdoor-and-ms-exchange-vulnerability-to-attack-building-automation-systems
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

x-proxy: fra2
date: Fri, 12 Aug 2022 04:06:41 GMT
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains
x-cached: EXPIRED
x-request-id: ed992012c62ab63a5f177d5940abdeab
referrer-policy: no-referrer-when-downgrade
last-modified: Mon, 01 Aug 2022 10:32:38 GMT
server: nginx
x-frame-options: SAMEORIGIN
etag: W/"42f-18258f6fd70"
vary: Accept-Encoding, Accept-Encoding
content-type: application/javascript; charset=UTF-8
x-xss-protection: 1; mode=block
cache-control: max-age=600
expires: Fri, 12 Aug 2022 04:16:41 GMT

GET
H2 200 _ssgManifest.js Show response
usa.kaspersky.com/_next/static/spCQAHN-xY9JZO9Y0uq_m/ 76 B
615 B 309ms
308ms Script
application/javascript 185.85.15.47
KL-EXT

General

Check archive.org

Show headers Download Go to

Full URL

https://usa.kaspersky.com/_next/static/spCQAHN-xY9JZO9Y0uq_m/_ssgManifest.js

Requested by

Host: usa.kaspersky.com
URL: https://usa.kaspersky.com/about/press-releases/2022_apt-uses-shadowpad-backdoor-and-ms-exchange-vulnerability-to-attack-building-automation-systems

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

185.85.15.47 , Germany, ASN200107 (KL-EXT, CH),

Reverse DNS

Software

nginx /

Resource Hash

653f3e53e89b4f8548ff86c19e92bb3c6b84b6be7485a320b1e00893ed877479

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://usa.kaspersky.com/about/press-releases/2022_apt-uses-shadowpad-backdoor-and-ms-exchange-vulnerability-to-attack-building-automation-systems
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

x-proxy: fra2
date: Fri, 12 Aug 2022 04:06:41 GMT
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains
x-cached: EXPIRED
x-request-id: b52c76d9b1ad2e34b96eb82487071a37
referrer-policy: no-referrer-when-downgrade
last-modified: Mon, 01 Aug 2022 10:32:38 GMT
server: nginx
x-frame-options: SAMEORIGIN
etag: W/"4c-18258f6fd70"
vary: Accept-Encoding, Accept-Encoding
content-type: application/javascript; charset=UTF-8
x-xss-protection: 1; mode=block
cache-control: max-age=600
expires: Fri, 12 Aug 2022 04:16:41 GMT

GET
H2 200 s_code_single_suite.js Show response
media.kaspersky.com/tracking/omniture/ 173 KB
49 KB 69ms
12ms Script
application/javascript 185.85.15.23
KL-EXT

General

Check archive.org

Show headers Download Go to

Full URL

https://media.kaspersky.com/tracking/omniture/s_code_single_suite.js

Requested by

Host: usa.kaspersky.com
URL: https://usa.kaspersky.com/about/press-releases/2022_apt-uses-shadowpad-backdoor-and-ms-exchange-vulnerability-to-attack-building-automation-systems

Protocol

Security

TLS 1.3, , CHACHA20_POLY1305

Server

185.85.15.23 , Germany, ASN200107 (KL-EXT, CH),

Reverse DNS

Software

/ Kaspersky Labs, Kaspersky Labs

Resource Hash

7f7e6e995618480710459b924bae8c1fee53d4f6ccc5d0f99d2f41a7341acf76

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://usa.kaspersky.com/about/press-releases/2022_apt-uses-shadowpad-backdoor-and-ms-exchange-vulnerability-to-attack-building-automation-systems
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
content-encoding: gzip
etag: "8016ed8867a2d81:0"
x-powered-by: Kaspersky Labs, Kaspersky Labs
alt-svc: h3=":443"; ma=86400
content-length: 49453
x-xss-protection: 1; mode=block
last-modified: Thu, 28 Jul 2022 09:50:57 GMT
server
x-frame-options: SAMEORIGIN
date: Fri, 12 Aug 2022 04:06:40 GMT
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=3600
x-server: fr1/FRA2
accept-ranges: bytes
x-content-type-options: nosniff

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 508 KB
121 KB 89ms
48ms Script
application/javascript 2a00:1450:4001:812::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-WZ7LJ3

Requested by

Host: usa.kaspersky.com
URL: https://usa.kaspersky.com/about/press-releases/2022_apt-uses-shadowpad-backdoor-and-ms-exchange-vulnerability-to-attack-building-automation-systems

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

71ac37de282d0cb7de1bf96599c89a77d629d83caa484ca83d28e5a4e4fbea38

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://usa.kaspersky.com/about/press-releases/2022_apt-uses-shadowpad-backdoor-and-ms-exchange-vulnerability-to-attack-building-automation-systems
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Fri, 12 Aug 2022 04:06:40 GMT
content-encoding: br
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 123825
x-xss-protection: 0
last-modified: Fri, 12 Aug 2022 03:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Fri, 12 Aug 2022 04:06:40 GMT

GET
H2 200 / Show response
service.maxymiser.net/cg/v5/ 68 KB
17 KB 39ms
39ms Script
text/javascript 23.208.225.239
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://service.maxymiser.net/cg/v5/?fv=dmn%3Dkaspersky.com%3Bref%3D%3Burl%3Dhttps%253A%252F%252Fusa.kaspersky.com%252Fabout%252Fpress-releases%252F2022_apt-uses-shadowpad-backdoor-and-ms-exchange-vulnerability-to-attack-building-automation-systems%3Bscrw%3D1600%3Bscrh%3D1200%3Bclrd%3D24%3Bcok%3D1&lver=1.18&jsncl=mmRequestCallbacks%5B1%5D&ri=1&lto=0&jrt=s

Requested by

Host: service.maxymiser.net
URL: https://service.maxymiser.net/cdn/com.kaspersky/js/mmapi.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.208.225.239 Vienna, Austria, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-208-225-239.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

294840000d67201b47826d376baf6f71934e2e42cb528c6cd3951e982f253d7a

Security Headers

Name	Value
Strict-Transport-Security	max-age=1800
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://usa.kaspersky.com/about/press-releases/2022_apt-uses-shadowpad-backdoor-and-ms-exchange-vulnerability-to-attack-building-automation-systems
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

pragma: no-cache
strict-transport-security: max-age=1800
content-encoding: gzip
x-content-type-options: nosniff
last-modified: 08/12/2022 04:06:40
server: nginx
date: Fri, 12 Aug 2022 04:06:40 GMT
x-frame-options: SAMEORIGIN
p3p: CP="DEV IND NOI OTC OUR PSA PSD"
cache-control: no-store, no-cache, must-revalidate,post-check=0, pre-check=0
content-type: text/javascript; charset=utf-8
vary: Accept-Encoding
content-length: 17052
x-xss-protection: 1; mode=block
expires: Sun, 06 Jan 1980 01:00:00 GMT

GET
H2 200 mmpackage-1.25.js Show response
service.maxymiser.net/platform/eu/api/ 78 KB
24 KB 23ms
23ms Script
application/x-javascript 23.208.225.239
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://service.maxymiser.net/platform/eu/api/mmpackage-1.25.js
Requested by: Host: service.maxymiser.net
URL: https://service.maxymiser.net/cdn/com.kaspersky/js/mmapi.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.208.225.239 Vienna, Austria, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-208-225-239.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: e8b95def8b00f37d671c6a8a017f7946eeae0c084d896f95b9418feef64a0a4b

Request headers

Referer: https://usa.kaspersky.com/about/press-releases/2022_apt-uses-shadowpad-backdoor-and-ms-exchange-vulnerability-to-attack-building-automation-systems
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

date: Fri, 12 Aug 2022 04:06:40 GMT
content-encoding: gzip
last-modified: Fri, 14 Aug 2020 12:06:19 GMT
server: AkamaiNetStorage
etag: "b9f18659b30ebfd24842a8cf31daa2ee:1597406783.793351"
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: max-age=31536000
accept-ranges: bytes
content-length: 24788

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 473 KB
119 KB 47ms
47ms Script
application/javascript 2a00:1450:4001:812::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-T45JW6B&l=dataLayer

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-WZ7LJ3

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

40fb3eeda8592e67aeeb12842fc37783d5d4eb94cd15efe6f352746a437d5dab

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://usa.kaspersky.com/about/press-releases/2022_apt-uses-shadowpad-backdoor-and-ms-exchange-vulnerability-to-attack-building-automation-systems
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Fri, 12 Aug 2022 04:06:40 GMT
content-encoding: br
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 122159
x-xss-protection: 0
last-modified: Fri, 12 Aug 2022 03:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Fri, 12 Aug 2022 04:06:40 GMT

GET
H2 200 kaspersky-logo-green.edf27003483d0ef42bafce0e295e6269.svg
usa.kaspersky.com/_next/static/media/ 3 KB
2 KB 168ms
168ms Image
image/svg+xml 185.85.15.47
KL-EXT

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://usa.kaspersky.com/_next/static/media/kaspersky-logo-green.edf27003483d0ef42bafce0e295e6269.svg

Requested by

Host: usa.kaspersky.com
URL: https://usa.kaspersky.com/_next/static/css/4f687798769426a22aaf.css

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

185.85.15.47 , Germany, ASN200107 (KL-EXT, CH),

Reverse DNS

Software

nginx /

Resource Hash

97f058586c1d1b08be01ab989c2fe48c6d45a1bbe853b286593cdebf98907cd0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://usa.kaspersky.com/_next/static/css/4f687798769426a22aaf.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

x-proxy: fra2
date: Fri, 12 Aug 2022 04:06:41 GMT
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains
x-cached: EXPIRED
x-request-id: 69891d5d9ecdbe98b59d2f47c062de81
referrer-policy: no-referrer-when-downgrade
last-modified: Mon, 01 Aug 2022 10:32:38 GMT
server: nginx
x-frame-options: SAMEORIGIN
etag: W/"d7c-18258f6fd70"
vary: Accept-Encoding, Accept-Encoding
content-type: image/svg+xml
x-xss-protection: 1; mode=block
cache-control: max-age=600
expires: Fri, 12 Aug 2022 04:16:41 GMT

GET
H2 200 press-center-header.jpg
usa.kaspersky.com/content/en-us/images/repository/headers/ 221 KB
222 KB 83ms
83ms Image
image/jpeg 185.85.15.47
KL-EXT

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://usa.kaspersky.com/content/en-us/images/repository/headers/press-center-header.jpg

Requested by

Host: usa.kaspersky.com
URL: https://usa.kaspersky.com/about/press-releases/2022_apt-uses-shadowpad-backdoor-and-ms-exchange-vulnerability-to-attack-building-automation-systems

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

185.85.15.47 , Germany, ASN200107 (KL-EXT, CH),

Reverse DNS

Software

nginx / ASP.NET

Resource Hash

9938e85f4bedde3746f7c9e2f25b743089cc76f07dfa317952bc74174cb36604

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://usa.kaspersky.com/about/press-releases/2022_apt-uses-shadowpad-backdoor-and-ms-exchange-vulnerability-to-attack-building-automation-systems
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

x-proxy: fra2
date: Fri, 12 Aug 2022 04:06:40 GMT
x-content-type-options: nosniff
x-powered-by: ASP.NET
strict-transport-security: max-age=31536000; includeSubDomains
content-length: 226678
x-xss-protection: 1; mode=block
x-request-id: 9104af0ad567b4638059c7fc1d659432
referrer-policy: no-referrer-when-downgrade
last-modified: Wed, 13 Apr 2022 14:33:33 GMT
server: nginx
x-cached: STALE
etag: "80dcb373434fd81:0"
x-frame-options: SAMEORIGIN
content-type: image/jpeg
cache-control: max-age=86400
x-server: FRA7
accept-ranges: bytes
expires: Sat, 13 Aug 2022 04:06:40 GMT

GET
H2 200 museosans-500-webfont.woff2
usa.kaspersky.com/_next/static/fonts/museo-sans/ 11 KB
12 KB 197ms
197ms Font
font/woff2 185.85.15.47
KL-EXT

General

Check archive.org

Show headers Download Go to

Full URL

https://usa.kaspersky.com/_next/static/fonts/museo-sans/museosans-500-webfont.woff2

Requested by

Host: usa.kaspersky.com
URL: https://usa.kaspersky.com/about/press-releases/2022_apt-uses-shadowpad-backdoor-and-ms-exchange-vulnerability-to-attack-building-automation-systems

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

185.85.15.47 , Germany, ASN200107 (KL-EXT, CH),

Reverse DNS

Software

nginx /

Resource Hash

5c665a75ce13001a0bb6cab3ee959b2f043a672b615876000f764c912649d3ed

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://usa.kaspersky.com/about/press-releases/2022_apt-uses-shadowpad-backdoor-and-ms-exchange-vulnerability-to-attack-building-automation-systems
Origin: https://usa.kaspersky.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

x-proxy: fra2
date: Fri, 12 Aug 2022 04:06:41 GMT
x-content-type-options: nosniff
content-length: 11728
x-cached: EXPIRED
x-request-id: 06bda642474d486b13b0ae578ee1b024
referrer-policy: no-referrer-when-downgrade
last-modified: Mon, 01 Aug 2022 10:32:34 GMT
server: nginx
x-frame-options: SAMEORIGIN
etag: W/"2dd0-18258f6edd0"
strict-transport-security: max-age=31536000; includeSubDomains
content-type: font/woff2
x-xss-protection: 1; mode=block
cache-control: max-age=600
accept-ranges: bytes
expires: Fri, 12 Aug 2022 04:16:41 GMT

GET
H2 200 museosans-300-webfont.woff2
usa.kaspersky.com/_next/static/fonts/museo-sans/ 11 KB
12 KB 229ms
229ms Font
font/woff2 185.85.15.47
KL-EXT

General

Check archive.org

Show headers Download Go to

Full URL

https://usa.kaspersky.com/_next/static/fonts/museo-sans/museosans-300-webfont.woff2

Requested by

Host: usa.kaspersky.com
URL: https://usa.kaspersky.com/about/press-releases/2022_apt-uses-shadowpad-backdoor-and-ms-exchange-vulnerability-to-attack-building-automation-systems

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

185.85.15.47 , Germany, ASN200107 (KL-EXT, CH),

Reverse DNS

Software

nginx /

Resource Hash

dfff48fba10c55918711c4bc2868154379f6348c7facdcefca870d512877cc11

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://usa.kaspersky.com/about/press-releases/2022_apt-uses-shadowpad-backdoor-and-ms-exchange-vulnerability-to-attack-building-automation-systems
Origin: https://usa.kaspersky.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

x-proxy: fra2
date: Fri, 12 Aug 2022 04:06:41 GMT
x-content-type-options: nosniff
content-length: 11716
x-cached: EXPIRED
x-request-id: 913e8eaed4372cea23535ab1d06be24d
referrer-policy: no-referrer-when-downgrade
last-modified: Mon, 01 Aug 2022 10:32:34 GMT
server: nginx
x-frame-options: SAMEORIGIN
etag: W/"2dc4-18258f6edd0"
strict-transport-security: max-age=31536000; includeSubDomains
content-type: font/woff2
x-xss-protection: 1; mode=block
cache-control: max-age=600
accept-ranges: bytes
expires: Fri, 12 Aug 2022 04:16:41 GMT

GET
H2 200 museosans-700-webfont.woff2
usa.kaspersky.com/_next/static/fonts/museo-sans/ 12 KB
12 KB 234ms
234ms Font
font/woff2 185.85.15.47
KL-EXT

General

Check archive.org

Show headers Download Go to

Full URL

https://usa.kaspersky.com/_next/static/fonts/museo-sans/museosans-700-webfont.woff2

Requested by

Host: usa.kaspersky.com
URL: https://usa.kaspersky.com/about/press-releases/2022_apt-uses-shadowpad-backdoor-and-ms-exchange-vulnerability-to-attack-building-automation-systems

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

185.85.15.47 , Germany, ASN200107 (KL-EXT, CH),

Reverse DNS

Software

nginx /

Resource Hash

f7dab0061921848e572d8389f8bedb735dcfed05b4c3baef528d43284f16c190

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://usa.kaspersky.com/about/press-releases/2022_apt-uses-shadowpad-backdoor-and-ms-exchange-vulnerability-to-attack-building-automation-systems
Origin: https://usa.kaspersky.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

x-proxy: fra2
date: Fri, 12 Aug 2022 04:06:41 GMT
x-content-type-options: nosniff
content-length: 11852
x-cached: EXPIRED
x-request-id: f0c2352cbddda8b87d19ed84fa84262e
referrer-policy: no-referrer-when-downgrade
last-modified: Mon, 01 Aug 2022 10:32:34 GMT
server: nginx
x-frame-options: SAMEORIGIN
etag: W/"2e4c-18258f6edd0"
strict-transport-security: max-age=31536000; includeSubDomains
content-type: font/woff2
x-xss-protection: 1; mode=block
cache-control: max-age=600
accept-ranges: bytes
expires: Fri, 12 Aug 2022 04:16:41 GMT

GET
H2 200 museoslab-300-webfont.woff2
usa.kaspersky.com/_next/static/fonts/museo-slab/ 13 KB
13 KB 307ms
307ms Font
font/woff2 185.85.15.47
KL-EXT

General

Check archive.org

Show headers Download Go to

Full URL

https://usa.kaspersky.com/_next/static/fonts/museo-slab/museoslab-300-webfont.woff2

Requested by

Host: usa.kaspersky.com
URL: https://usa.kaspersky.com/about/press-releases/2022_apt-uses-shadowpad-backdoor-and-ms-exchange-vulnerability-to-attack-building-automation-systems

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

185.85.15.47 , Germany, ASN200107 (KL-EXT, CH),

Reverse DNS

Software

nginx /

Resource Hash

56729e7995d1cd6e9b95ada3218cdf39fdd1260f452984614aa21c2862957c70

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://usa.kaspersky.com/about/press-releases/2022_apt-uses-shadowpad-backdoor-and-ms-exchange-vulnerability-to-attack-building-automation-systems
Origin: https://usa.kaspersky.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

x-proxy: fra2
date: Fri, 12 Aug 2022 04:06:41 GMT
x-content-type-options: nosniff
content-length: 13148
x-cached: MISS
x-request-id: 7bd54c2909e879775fed197bcf35ef88
referrer-policy: no-referrer-when-downgrade
last-modified: Mon, 01 Aug 2022 10:32:34 GMT
server: nginx
x-frame-options: SAMEORIGIN
etag: W/"335c-18258f6edd0"
strict-transport-security: max-age=31536000; includeSubDomains
content-type: font/woff2
x-xss-protection: 1; mode=block
cache-control: max-age=600
accept-ranges: bytes
expires: Fri, 12 Aug 2022 04:16:41 GMT

GET
H2 200 museoslab-500-webfont.woff2
usa.kaspersky.com/_next/static/fonts/museo-slab/ 13 KB
13 KB 309ms
309ms Font
font/woff2 185.85.15.47
KL-EXT

General

Check archive.org

Show headers Download Go to

Full URL

https://usa.kaspersky.com/_next/static/fonts/museo-slab/museoslab-500-webfont.woff2

Requested by

Host: usa.kaspersky.com
URL: https://usa.kaspersky.com/about/press-releases/2022_apt-uses-shadowpad-backdoor-and-ms-exchange-vulnerability-to-attack-building-automation-systems

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

185.85.15.47 , Germany, ASN200107 (KL-EXT, CH),

Reverse DNS

Software

nginx /

Resource Hash

175e2018415e3e13c7a1a5aa5ad67ca4e0bf754489bbf35d2eeb647bcff4bf04

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://usa.kaspersky.com/about/press-releases/2022_apt-uses-shadowpad-backdoor-and-ms-exchange-vulnerability-to-attack-building-automation-systems
Origin: https://usa.kaspersky.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

x-proxy: fra2
date: Fri, 12 Aug 2022 04:06:41 GMT
x-content-type-options: nosniff
content-length: 13128
x-cached: EXPIRED
x-request-id: c6d1d6783477a98a8a52c82ac59f6dce
referrer-policy: no-referrer-when-downgrade
last-modified: Mon, 01 Aug 2022 10:32:34 GMT
server: nginx
x-frame-options: SAMEORIGIN
etag: W/"3348-18258f6edd0"
strict-transport-security: max-age=31536000; includeSubDomains
content-type: font/woff2
x-xss-protection: 1; mode=block
cache-control: max-age=600
accept-ranges: bytes
expires: Fri, 12 Aug 2022 04:16:41 GMT

GET
H2 200 id Show response
sgtm.kaspersky.com/ 368 B
815 B 189ms
139ms XHR
application/json 2001:4860:4802:36::15
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://sgtm.kaspersky.com/id?d_visid_ver=4.4.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_orgid=983502BE532960BE0A490D4C%40AdobeOrg&d_nsid=0&ts=1660277200989

Requested by

Host: media.kaspersky.com
URL: https://media.kaspersky.com/tracking/omniture/s_code_single_suite.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2001:4860:4802:36::15 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Resource Hash

612db2a2600f293d1b46736ff124a109bf648b2be672a09c20667a0d9e30049f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://usa.kaspersky.com/about/press-releases/2022_apt-uses-shadowpad-backdoor-and-ms-exchange-vulnerability-to-attack-building-automation-systems
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

dcs: dcscanary-prod-irl1-1-v044-00dc34f34.edge-irl1.demdex.com 1 ms
pragma: no-cache
date: Fri, 12 Aug 2022 04:06:41 GMT
content-encoding: gzip
x-tid: DvHCqwMhRtM=
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
access-control-allow-origin: https://usa.kaspersky.com
cache-control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/json;charset=utf-8
via: 1.1 google
expires: Thu, 01 Jan 1970 00:00:00 UTC

GET
H3 200 destination Show response
www.googletagmanager.com/gtag/ 199 KB
71 KB 22ms
21ms Script
application/javascript 2a00:1450:4001:812::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/destination?id=G-RHQPYL96VR&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-WZ7LJ3

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

94cbf8df2b2906ef77b877956ba4cb69733b278c2a47033a2ff871a99b8c24e2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://usa.kaspersky.com/about/press-releases/2022_apt-uses-shadowpad-backdoor-and-ms-exchange-vulnerability-to-attack-building-automation-systems
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Fri, 12 Aug 2022 04:06:41 GMT
content-encoding: br
server: Google Tag Manager
access-control-allow-headers: Cache-Control
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; includeSubDomains
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 73091
x-xss-protection: 0
expires: Fri, 12 Aug 2022 04:06:41 GMT

GET
H2 200 id Show response
kaspersky.d3.sc.omtrdc.net/ 2 B
318 B 413ms
133ms XHR
application/x-javascript 15.236.176.210
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://kaspersky.d3.sc.omtrdc.net/id?d_visid_ver=4.4.0&d_fieldgroup=A&mcorgid=983502BE532960BE0A490D4C%40AdobeOrg&mid=74520031576126851464020767640621381841&ts=1660277201181

Requested by

Host: media.kaspersky.com
URL: https://media.kaspersky.com/tracking/omniture/s_code_single_suite.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

15.236.176.210 Paris, France, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-15-236-176-210.eu-west-3.compute.amazonaws.com

Software

jag /

Resource Hash

44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://usa.kaspersky.com/about/press-releases/2022_apt-uses-shadowpad-backdoor-and-ms-exchange-vulnerability-to-attack-building-automation-systems
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Fri, 12 Aug 2022 04:06:41 GMT
x-content-type-options: nosniff
server: jag
xserver: anedge-69c8d8cc76-vv8zl
vary: Origin
x-c: main-1661.I2f39db.M0-585
p3p: CP="This is not a P3P policy"
access-control-allow-origin: https://usa.kaspersky.com
cache-control: no-cache, no-store, max-age=0, no-transform, private
access-control-allow-credentials: true
content-type: application/x-javascript;charset=utf-8
content-length: 2
x-xss-protection: 1; mode=block

GET
H2 200 site-bar.json Show response
usa.kaspersky.com/content/en-us/site-header/ 648 B
795 B 22ms
21ms Fetch
application/json 185.85.15.47
KL-EXT

General

Check archive.org

Show headers Download Go to

Full URL

https://usa.kaspersky.com/content/en-us/site-header/site-bar.json

Requested by

Host: usa.kaspersky.com
URL: https://usa.kaspersky.com/_next/static/spCQAHN-xY9JZO9Y0uq_m/pages/about/press-releases/%5BarticleTitle%5D.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

185.85.15.47 , Germany, ASN200107 (KL-EXT, CH),

Reverse DNS

Software

nginx / ASP.NET

Resource Hash

214ff94d4efa3c6185963226140a1eb170ab545745fb8e004d05ac35dba3c7ca

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://usa.kaspersky.com/about/press-releases/2022_apt-uses-shadowpad-backdoor-and-ms-exchange-vulnerability-to-attack-building-automation-systems
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

x-proxy: fra2
date: Fri, 12 Aug 2022 04:06:41 GMT
content-encoding: br
x-content-type-options: nosniff
x-powered-by: ASP.NET
vary: Accept-Encoding
content-length: 328
x-xss-protection: 1; mode=block
x-request-id: ef2235f3582a53223d8001cfd8a26e77
referrer-policy: no-referrer-when-downgrade
last-modified: Tue, 11 Aug 2020 16:00:27 GMT
server: nginx
x-cached: STALE
x-frame-options: SAMEORIGIN
etag: "809f8187f86fd61:0"
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/json
cache-control: max-age=86400
x-server: FRA5
accept-ranges: bytes
expires: Sat, 13 Aug 2022 04:06:41 GMT

GET
H2 200 promotion-home-page-banner.json Show response
usa.kaspersky.com/content/en-us/homepage/ 281 B
654 B 92ms
92ms Fetch
application/json 185.85.15.47
KL-EXT

General

Check archive.org

Show headers Download Go to

Full URL

https://usa.kaspersky.com/content/en-us/homepage/promotion-home-page-banner.json

Requested by

Host: usa.kaspersky.com
URL: https://usa.kaspersky.com/_next/static/spCQAHN-xY9JZO9Y0uq_m/pages/about/press-releases/%5BarticleTitle%5D.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

185.85.15.47 , Germany, ASN200107 (KL-EXT, CH),

Reverse DNS

Software

nginx / ASP.NET

Resource Hash

c12c4757b7dd52cc5c369e032bdbcc7896b8d0b81731a51d386583c8a55973ac

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://usa.kaspersky.com/about/press-releases/2022_apt-uses-shadowpad-backdoor-and-ms-exchange-vulnerability-to-attack-building-automation-systems
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

x-proxy: fra2
date: Fri, 12 Aug 2022 04:06:41 GMT
content-encoding: br
x-content-type-options: nosniff
x-powered-by: ASP.NET
vary: Accept-Encoding
content-length: 187
x-xss-protection: 1; mode=block
x-request-id: fbaf5309a2f5d9828c4fbc22f9792015
referrer-policy: no-referrer-when-downgrade
last-modified: Mon, 20 Jan 2020 13:20:45 GMT
server: nginx
x-cached: STALE
x-frame-options: SAMEORIGIN
etag: "8074eb6b94cfd51:0"
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/json
cache-control: max-age=86400
x-server: FRA5
accept-ranges: bytes
expires: Sat, 13 Aug 2022 04:06:41 GMT

OPTIONS
H2 200 /
api-router.kaspersky-labs.com/logger2/metrics/ Frame 0
0 502ms
110ms Preflight
text/html 4.59.181.140
LEVEL3

General

Check archive.org

Show headers Download Go to

Full URL

https://api-router.kaspersky-labs.com/logger2/metrics/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

4.59.181.140 Charlottetown, Canada, ASN3356 (LEVEL3, US),

Reverse DNS

Software

nginx / Express

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://usa.kaspersky.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Content-Type
access-control-allow-methods: POST, OPTIONS
access-control-allow-origin: https://usa.kaspersky.com
allow: POST
content-length: 4
content-type: text/html; charset=utf-8
date: Fri, 12 Aug 2022 04:06:41 GMT
etag: W/"4-Yf+Bwwqjx254r+pisuO9HfpJ6FQ"
referrer-policy: no-referrer-when-downgrade
server: nginx
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-powered-by: Express
x-proxy: trt1
x-request-id: cb5df3dda01e8e04b1b7cbfb7d955047
x-server: TRTL1
x-xss-protection: 1; mode=block

POST
H2 200 / Show response
api-router.kaspersky-labs.com/logger2/metrics/ 2 B
633 B 504ms
286ms XHR
text/plain 4.59.181.140
LEVEL3

General

Check archive.org

Show headers Download Go to

Full URL

https://api-router.kaspersky-labs.com/logger2/metrics/

Requested by

Host: usa.kaspersky.com
URL: https://usa.kaspersky.com/_next/static/spCQAHN-xY9JZO9Y0uq_m/pages/_app.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

4.59.181.140 Charlottetown, Canada, ASN3356 (LEVEL3, US),

Reverse DNS

Software

nginx / Express

Resource Hash

565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept: application/json, text/plain, */*
Referer: https://usa.kaspersky.com/about/press-releases/2022_apt-uses-shadowpad-backdoor-and-ms-exchange-vulnerability-to-attack-building-automation-systems
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
Content-Type: application/json;charset=UTF-8

Response headers

x-proxy: trt1
date: Fri, 12 Aug 2022 04:06:42 GMT
x-content-type-options: nosniff
x-powered-by: Express
strict-transport-security: max-age=31536000; includeSubDomains
content-length: 2
x-xss-protection: 1; mode=block
x-request-id: 253209104d560536f90ed0ec38beb3b5
referrer-policy: no-referrer-when-downgrade
server: nginx
etag: W/"2-nOO9QiTIwXgNtWtBJezz8kv3SLc"
x-frame-options: SAMEORIGIN
access-control-allow-methods: POST, OPTIONS
content-type: text/plain; charset=utf-8
access-control-allow-origin: https://usa.kaspersky.com
x-server: TRTL1
access-control-allow-credentials: true
access-control-allow-headers: Content-Type

GET
H2 200 2c47087421d0b.js Show response
t.contentsquare.net/uxa/ 330 KB
73 KB 34ms
8ms Script
application/javascript 18.66.112.26
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://t.contentsquare.net/uxa/2c47087421d0b.js
Requested by: Host: usa.kaspersky.com
URL: https://usa.kaspersky.com/about/press-releases/2022_apt-uses-shadowpad-backdoor-and-ms-exchange-vulnerability-to-attack-building-automation-systems
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.66.112.26 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-66-112-26.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: b16fe961cf29b0f3ae5fb03f2426cd852f26cfec71d69ebd4f920ac1bf10e5d1

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://usa.kaspersky.com/about/press-releases/2022_apt-uses-shadowpad-backdoor-and-ms-exchange-vulnerability-to-attack-building-automation-systems
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

x-amz-server-side-encryption: AES256
date: Tue, 09 Aug 2022 12:24:56 GMT
content-encoding: gzip
last-modified: Tue, 09 Aug 2022 12:21:51 GMT
server: AmazonS3
age: 229306
etag: "327bb09f8850332d4c02c188e33965ce"
x-cache: Hit from cloudfront
content-type: application/javascript;charset=utf-8
via: 1.1 ab985bb6f3435d42701015dfa6015878.cloudfront.net (CloudFront)
cache-control: max-age=900
x-amz-cf-pop: FRA56-P5
accept-ranges: bytes
content-length: 74605
x-amz-cf-id: LUKt8snY6iTrqMpdsRbIHWsBKGzGJLnEBbxaFBcl3qgLcSaZy2hG-A==

GET
H2

200

web-vitals.umd.js Show response
unpkg.com/web-vitals@2.1.4/dist/
Redirect Chain

https://unpkg.com/web-vitals
https://unpkg.com/web-vitals@2.1.4
https://unpkg.com/web-vitals@2.1.4/dist/web-vitals.umd.js

5 KB
2 KB

17ms
17ms

Script
application/javascript

2606:4700::6810:7aaf
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://unpkg.com/web-vitals@2.1.4/dist/web-vitals.umd.js

Protocol

Server

2606:4700::6810:7aaf , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

52cac1193a3683e35353723a38e01a9bcc0c5f9bf2be42d29c96905527c7923d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://usa.kaspersky.com/about/press-releases/2022_apt-uses-shadowpad-backdoor-and-ms-exchange-vulnerability-to-attack-building-automation-systems
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Fri, 12 Aug 2022 04:06:41 GMT
via: 1.1 fly.io
x-content-type-options: nosniff
cf-cache-status: HIT
age: 17546054
fly-request-id: 01FSX6G4BV26459PNH2WD5M7Q3
content-encoding: br
vary: Accept-Encoding
last-modified: Sat, 26 Oct 1985 08:15:00 GMT
server: cloudflare
etag: W/"120b-0F8cYs4ysxGP6ebngBlASGivDqM"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
cf-ray: 739656fe6d965b62-FRA

Redirect headers

date: Fri, 12 Aug 2022 04:06:41 GMT
via: 1.1 fly.io
x-content-type-options: nosniff
cf-cache-status: HIT
fly-request-id: 01FSXAPQCR787H8XM1CH5RFGZ6
server: cloudflare
age: 17541643
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept, Accept-Encoding
content-type: text/plain; charset=utf-8
location: /web-vitals@2.1.4/dist/web-vitals.umd.js
cache-control: public, max-age=31536000
strict-transport-security: max-age=31536000; includeSubDomains; preload
cf-ray: 739656fd9d305b62-FRA
access-control-allow-origin: *

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 49 KB
20 KB 37ms
14ms Script
text/javascript 2a00:1450:4001:829::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-WZ7LJ3

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

a1925038db769477ab74b4df34350c35688a795bb718727b0f4292a4a78a6210

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://usa.kaspersky.com/about/press-releases/2022_apt-uses-shadowpad-backdoor-and-ms-exchange-vulnerability-to-attack-building-automation-systems
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 13 Apr 2022 21:02:38 GMT
server: Golfe2
age: 3644
date: Fri, 12 Aug 2022 03:05:57 GMT
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 20006
expires: Fri, 12 Aug 2022 05:05:57 GMT

GET
H2 200 insight.min.js Show response
snap.licdn.com/li.lms-analytics/ 997 B
639 B 54ms
7ms Script
application/x-javascript 2a02:26f0:3500:16::215:149b
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://snap.licdn.com/li.lms-analytics/insight.min.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-T45JW6B&l=dataLayer
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:3500:16::215:149b Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: /
Resource Hash: 3f01cb4e8bb564dfe1d558ba77bf9cda1712b8378f4c25223c44967ae8d5ea04

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://usa.kaspersky.com/about/press-releases/2022_apt-uses-shadowpad-backdoor-and-ms-exchange-vulnerability-to-attack-building-automation-systems
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Fri, 12 Aug 2022 04:06:41 GMT
content-encoding: gzip
last-modified: Thu, 11 Aug 2022 22:44:45 GMT
x-cdn: AKAM
vary: Accept-Encoding
content-type: application/x-javascript;charset=utf-8
cache-control: max-age=67107
accept-ranges: bytes
content-length: 471

GET
H2 200 bat.js Show response
bat.bing.com/ 38 KB
12 KB 67ms
33ms Script
application/javascript 2620:1ec:c11::200
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://bat.bing.com/bat.js

Requested by

Host: usa.kaspersky.com
URL: https://usa.kaspersky.com/about/press-releases/2022_apt-uses-shadowpad-backdoor-and-ms-exchange-vulnerability-to-attack-building-automation-systems

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

30153b15b4cb898c421e657f6de21dc27435cb990e7888367bdee12e06398da7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://usa.kaspersky.com/about/press-releases/2022_apt-uses-shadowpad-backdoor-and-ms-exchange-vulnerability-to-attack-building-automation-systems
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
last-modified: Thu, 28 Jul 2022 17:32:37 GMT
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 719B9C3CEDBE4B03936EBFE265274D3A Ref B: FRA31EDGE0612 Ref C: 2022-08-12T04:06:41Z
etag: "80a8697a8a2d81:0"
vary: Accept-Encoding
x-cache: CONFIG_NOCACHE
content-type: application/javascript
access-control-allow-origin: *
cache-control: private,max-age=1800
date: Fri, 12 Aug 2022 04:06:40 GMT
accept-ranges: bytes
content-length: 11367

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 105 KB
41 KB 21ms
21ms Script
application/javascript 2a00:1450:4001:812::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=DC-9582686

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-T45JW6B&l=dataLayer

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

2172c955759308c9a6154a722206b67f560ef21d676bf90b935fa319149fd220

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://usa.kaspersky.com/about/press-releases/2022_apt-uses-shadowpad-backdoor-and-ms-exchange-vulnerability-to-attack-building-automation-systems
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Fri, 12 Aug 2022 04:06:41 GMT
content-encoding: br
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 41656
x-xss-protection: 0
last-modified: Fri, 12 Aug 2022 03:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Fri, 12 Aug 2022 04:06:41 GMT

GET
H2 200 pixel.js Show response
a.tribalfusion.com/pixel/tags/Kaspersky%20UK/797783/ 8 KB
2 KB 197ms
165ms Script
application/x-javascript 2606:4700:4400::6812:230b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://a.tribalfusion.com/pixel/tags/Kaspersky%20UK/797783/pixel.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-T45JW6B&l=dataLayer
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:4400::6812:230b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b986d774c858e94ecb4cd87d7a43e08cbdde1b0896e047f52c0ad07ffa6be4ac

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://usa.kaspersky.com/about/press-releases/2022_apt-uses-shadowpad-backdoor-and-ms-exchange-vulnerability-to-attack-building-automation-systems
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Fri, 12 Aug 2022 04:06:41 GMT
content-encoding: gzip
cf-cache-status: DYNAMIC
p3p: CP="NOI DEVo TAIa OUR BUS"
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 2002
x-function: 151
last-modified: Fri, 13 Aug 2021 06:35:37 GMT
server: cloudflare
x-reuse-index: 372
etag: 14094569274683928320
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: max-age=3600, private
cf-ray: 739656fd6d1c5b62-FRA
expires: Fri, 12 Aug 2022 05:06:41 GMT

GET
H2 200 ktag.js Show response
resources.xg4ken.com/js/v2/ 9 KB
4 KB 587ms
32ms Script
text/plain 52.49.174.4
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://resources.xg4ken.com/js/v2/ktag.js?tid=KT-N3AA7-3EE

Requested by

Host: usa.kaspersky.com
URL: https://usa.kaspersky.com/about/press-releases/2022_apt-uses-shadowpad-backdoor-and-ms-exchange-vulnerability-to-attack-building-automation-systems

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.49.174.4 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-49-174-4.eu-west-1.compute.amazonaws.com

Software

nginx /

Resource Hash

e4dcf70f2995405028b82c072cca0dfc3bd89595677e84248174239a417fbe59

Security Headers

Name	Value
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://usa.kaspersky.com/about/press-releases/2022_apt-uses-shadowpad-backdoor-and-ms-exchange-vulnerability-to-attack-building-automation-systems
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Fri, 12 Aug 2022 04:06:42 GMT
content-encoding: gzip
last-modified: Tue, 12 Jul 2022 08:39:30 GMT
server: nginx
etag: "62cd3342-dd8"
content-type: text/plain
cache-control: max-age=86400, public
content-length: 3544
x-xss-protection: 1; mode=block
expires: Sat, 13 Aug 2022 04:06:42 GMT

GET
H2 200 tune.js Show response
js.go2sdk.com/v2/ 18 KB
18 KB 65ms
8ms Script
application/javascript 18.66.97.122
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://js.go2sdk.com/v2/tune.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-WZ7LJ3
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.66.97.122 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-66-97-122.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: cca8ce472cbf8c44acf7ac24067c2d6075acd1e0cd4c9003de6055289ac5c68a

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://usa.kaspersky.com/about/press-releases/2022_apt-uses-shadowpad-backdoor-and-ms-exchange-vulnerability-to-attack-building-automation-systems
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

x-amz-version-id: null
via: 1.1 3f3b012fad703fdac0f14efdb7b78b6e.cloudfront.net (CloudFront)
etag: "074c9e70b17ef9db8aced963fef4e2d9"
last-modified: Wed, 06 Jan 2021 18:55:14 GMT
server: AmazonS3
age: 26838
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-type: application/javascript
date: Thu, 11 Aug 2022 20:39:24 GMT
x-amz-cf-pop: FRA56-P2
accept-ranges: bytes
content-length: 17921
x-amz-cf-id: Sh8vmJXUOp-qmFvpBp5vXWlsI96QmDV6-C2NNR3tB6Vp5JsOucdYuA==

GET
H2 200 deployment.js Show response
ove1.marketlinc.com/public/js/ 32 KB
8 KB 133ms
7ms Script
application/javascript 2600:9000:2156:9c00:17:2e54:9a00:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ove1.marketlinc.com/public/js/deployment.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-WZ7LJ3
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2156:9c00:17:2e54:9a00:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 5eb69e0427216540b3a0a4d2c89fc3f379d05183b99b9610674f59bc67287a36

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://usa.kaspersky.com/about/press-releases/2022_apt-uses-shadowpad-backdoor-and-ms-exchange-vulnerability-to-attack-building-automation-systems
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

x-amz-version-id: y5mmyNu7i2o9PfQmFX3U6MO8aoWDSHGl
content-encoding: gzip
last-modified: Tue, 26 Jul 2022 17:23:54 GMT
server: AmazonS3
age: 83052
etag: W/"cb0f0cf3ed61e3befd6e843fd540a8c1"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
via: 1.1 e6d97713eb9b65f883e0f86b833878dc.cloudfront.net (CloudFront)
date: Thu, 11 Aug 2022 05:02:30 GMT
x-amz-cf-pop: FRA50-C1
x-amz-cf-id: aZgSBVyV-k6TJ_H2IN28CihnZBUZqDXVMS4O0dlraTTTusN2Ubi_cA==

GET
H2 200 fbevents.js Show response
connect.facebook.net/en_US/ 100 KB
27 KB 25ms
8ms Script
application/x-javascript 2a03:2880:f01c:8012:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Host: usa.kaspersky.com
URL: https://usa.kaspersky.com/about/press-releases/2022_apt-uses-shadowpad-backdoor-and-ms-exchange-vulnerability-to-attack-building-automation-systems

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f01c:8012:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

4ff1b9b91db584b19d20b4d02af9ff7673add161ce3f9ceae9391b3a84fddab1

Security Headers

Name	Value
Content-Security-Policy	default-src facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com data: blob: 'self';script-src .fbcdn.net .facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://usa.kaspersky.com/about/press-releases/2022_apt-uses-shadowpad-backdoor-and-ms-exchange-vulnerability-to-attack-building-automation-systems
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

content-security-policy: default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
content-encoding: gzip
x-content-type-options: nosniff
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400,h3-29=":443"; ma=86400
content-length: 26515
x-xss-protection: 0
pragma: public
x-fb-debug: TUpwnciJcBopjuTqMRI40NYGAZLYBWJq1GUN8MwEZcfi5gNaADg3oU51YCZs0O//Jld2DNik/gAT/kvW767pAQ==
x-fb-trip-id: 686109401
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: DENY
date: Fri, 12 Aug 2022 04:06:41 GMT
strict-transport-security: max-age=31536000; preload; includeSubDomains
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cache-control: public, max-age=1200
x-fb-rlafr: 0
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 events.js Show response
analytics.tiktok.com/i18n/pixel/ 160 KB
45 KB 169ms
134ms Script
application/javascript 23.36.163.232
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://analytics.tiktok.com/i18n/pixel/events.js?sdkid=C1QRHFHLRI5O97LIAVQG&lib=ttq
Requested by: Host: usa.kaspersky.com
URL: https://usa.kaspersky.com/about/press-releases/2022_apt-uses-shadowpad-backdoor-and-ms-exchange-vulnerability-to-attack-building-automation-systems
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.36.163.232 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a23-36-163-232.deploy.static.akamaitechnologies.com
Software: nginx /
Resource Hash: 61d28bc1bcbc314992f87b4d9621d18e0b19023df08da72c8aed439960ddad38

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://usa.kaspersky.com/about/press-releases/2022_apt-uses-shadowpad-backdoor-and-ms-exchange-vulnerability-to-attack-building-automation-systems
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 12 Aug 2022 04:06:41 GMT
content-encoding: gzip
x-tt-trace-tag: id=16;cdn-cache=miss;type=dyn
server: nginx
x-tt-logid: 20220812040641D6CD09B4FFAC73F05C54
vary: Accept-Encoding
x-cache: TCP_MISS from a23-36-161-204.deploy.akamaitechnologies.com (AkamaiGHost/10.9.1-42763970) (-)
content-type: application/javascript; charset=UTF-8
cache-control: max-age=0, no-cache, no-store
x-origin-response-time: 127,23.36.161.204
x-tt-trace-host: 01071338e576d3120912a2d25762897a4e1167beb4fcac0fceccf38413dad66b68e19e635094156696a4c1b7112cf00e335a6c69c6105872cb4a6df4ce1075b22802efffece591f5698841b78370b61a0c
server-timing: inner; dur=4, cdn-cache; desc=MISS, edge; dur=1, origin; dur=126
x-akamai-request-id: 8b93d93a
expires: Fri, 12 Aug 2022 04:06:41 GMT

GET
H2 200 rt.gif
jadserve.postrelease.com/ 43 B
427 B 356ms
95ms Image
image/gif 52.206.171.79
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://jadserve.postrelease.com/rt.gif?ntv_tg=CQAAAEAAAAsBACAA%3D%3D&gtmcb=11295997
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.206.171.79 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-206-171-79.compute-1.amazonaws.com
Software: nginx/1.12.1 /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://usa.kaspersky.com/about/press-releases/2022_apt-uses-shadowpad-backdoor-and-ms-exchange-vulnerability-to-attack-building-automation-systems
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 12 Aug 2022 04:06:41 GMT
server: nginx/1.12.1
p3p: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
content-type: image/gif
content-length: 43
expires: Mon, 1 Jan 1990 12:00:00 GMT

GET
H2 200 DFPAudiencePixel;ord=9325175383096.113;dc_seg=1048288955
pubads.g.doubleclick.net/activity;dc_iu=/4585/ 42 B
635 B 69ms
45ms Image
image/gif 142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pubads.g.doubleclick.net/activity;dc_iu=/4585/DFPAudiencePixel;ord=9325175383096.113;dc_seg=1048288955?

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s11-in-f2.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://usa.kaspersky.com/about/press-releases/2022_apt-uses-shadowpad-backdoor-and-ms-exchange-vulnerability-to-attack-building-automation-systems
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 12 Aug 2022 04:06:41 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

bounce
secure.adnxs.com/
Redirect Chain

https://secure.adnxs.com/px?id=1565496&seg=29456374&t=2
https://secure.adnxs.com/bounce?%2Fpx%3Fid%3D1565496%26seg%3D29456374%26t%3D2

43 B
1 KB

15ms
15ms

Image
image/gif

185.89.211.116
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://secure.adnxs.com/bounce?%2Fpx%3Fid%3D1565496%26seg%3D29456374%26t%3D2

Protocol

HTTP/1.1

Server

185.89.211.116 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

956.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net

Software

nginx/1.21.3 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://usa.kaspersky.com/about/press-releases/2022_apt-uses-shadowpad-backdoor-and-ms-exchange-vulnerability-to-attack-building-automation-systems
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 12 Aug 2022 04:06:41 GMT
X-Proxy-Origin: 138.199.38.132; 138.199.38.132; 956.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
AN-X-Request-Uuid: 2897a514-7d26-4da8-824c-ac1a4c29dffb
Server: nginx/1.21.3
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Fri, 12 Aug 2022 04:06:41 GMT
X-Proxy-Origin: 138.199.38.132; 138.199.38.132; 956.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
AN-X-Request-Uuid: 253fa6b5-b73d-4461-aff2-f7f8101d2de6
Server: nginx/1.21.3
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://secure.adnxs.com/bounce?%2Fpx%3Fid%3D1565496%26seg%3D29456374%26t%3D2
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2

200

src=11733622;dc_pre=COCp0ca2wPkCFaIQ5godB18ONQ;type=invmedia;cat=kaspe00;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=$%7BGDPR%7D;gdpr_consent=$%7BGDPR_CONSENT_755%7D;ord=5499...
adservice.google.com/ddm/fls/z/
Redirect Chain

https://ad.doubleclick.net/ddm/activity/src=11733622;type=invmedia;cat=kaspe00;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=$%7BGDPR%7D;gdpr_consent=$%7BGDPR_CONSENT_755%7D;or...
https://ad.doubleclick.net/ddm/activity/src=11733622;dc_pre=COCp0ca2wPkCFaIQ5godB18ONQ;type=invmedia;cat=kaspe00;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=$%7BGDPR%7D;gdpr_...
https://adservice.google.com/ddm/fls/z/src=11733622;dc_pre=COCp0ca2wPkCFaIQ5godB18ONQ;type=invmedia;cat=kaspe00;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=$%7BGDPR%7D;gdpr_c...

42 B
107 B

84ms
48ms

Image
image/gif

2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://adservice.google.com/ddm/fls/z/src=11733622;dc_pre=COCp0ca2wPkCFaIQ5godB18ONQ;type=invmedia;cat=kaspe00;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=$%7BGDPR%7D;gdpr_consent=$%7BGDPR_CONSENT_755%7D;ord=5499487384964.172

Protocol

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://usa.kaspersky.com/about/press-releases/2022_apt-uses-shadowpad-backdoor-and-ms-exchange-vulnerability-to-attack-building-automation-systems
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 12 Aug 2022 04:06:41 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 12 Aug 2022 04:06:41 GMT
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-type: text/html; charset=UTF-8
location: https://adservice.google.com/ddm/fls/z/src=11733622;dc_pre=COCp0ca2wPkCFaIQ5godB18ONQ;type=invmedia;cat=kaspe00;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=$%7BGDPR%7D;gdpr_consent=$%7BGDPR_CONSENT_755%7D;ord=5499487384964.172
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

setuid
ib.adnxs.com/
Redirect Chain

https://s.tribalfusion.com/i.cid?c=705083&ev=0&page=Global
https://s.tribalfusion.com/z/i.cid?c=705083&ev=0&page=Global
https://a4.tribalfusion.com/ipg?ip6=2a02:6ea0:c71b:0:1011:9417:3a04:a480&kv=%7B%22ord%22%3A%2016110033%2C%20%22clientID%22%3A%20705083%7D&redirect=https://ib.adnxs.com/getuidu?https://a.tribalfusio...
https://ib.adnxs.com/setuid?entity=305&code=$TF_USER_ID_ENC$

43 B
1008 B

56ms
17ms

Image
image/gif

185.89.210.141
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=305&code=$TF_USER_ID_ENC$

Protocol

HTTP/1.1

Server

185.89.210.141 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

950.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net

Software

nginx/1.21.3 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://usa.kaspersky.com/about/press-releases/2022_apt-uses-shadowpad-backdoor-and-ms-exchange-vulnerability-to-attack-building-automation-systems
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 12 Aug 2022 04:06:42 GMT
X-Proxy-Origin: 138.199.38.132; 138.199.38.132; 950.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
AN-X-Request-Uuid: 8fc6d1b4-7e4a-4b05-b932-1f362fdcafb6
Server: nginx/1.21.3
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 12 Aug 2022 04:06:42 GMT
cf-cache-status: DYNAMIC
x-function: 201
server: cloudflare
x-reuse-index: 40
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
cf-ray: 7396570069656973-FRA
p3p: CP="NOI DEVo TAIa OUR BUS"
location: https://ib.adnxs.com/setuid?entity=305&code=$TF_USER_ID_ENC$
cache-control: no-cache, private
content-type: text/html
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 1649d5fbb67c.js Show response
w.usabilla.com/ Frame 005D 170 KB
19 KB 140ms
33ms Script
text/javascript 52.215.191.30
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://w.usabilla.com/1649d5fbb67c.js?lv=1
Requested by: Host: usa.kaspersky.com
URL: https://usa.kaspersky.com/about/press-releases/2022_apt-uses-shadowpad-backdoor-and-ms-exchange-vulnerability-to-attack-building-automation-systems
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.215.191.30 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-215-191-30.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: 555e53432e4eb7e193a052fb036f5cc2ae6271b7db35284bee6c39b0c3019700

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://usa.kaspersky.com/about/press-releases/2022_apt-uses-shadowpad-backdoor-and-ms-exchange-vulnerability-to-attack-building-automation-systems
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 12 Aug 2022 04:06:41 GMT
content-encoding: gzip
x-widget-server: 2.1
etag: "1f5307ccb5b684aa8010a769816f0942"
content-type: text/javascript
cache-control: public,max-age=0
content-length: 19632

GET
H2 200 insight.old.min.js Show response
snap.licdn.com/li.lms-analytics/ 8 KB
3 KB 8ms
8ms Script
application/x-javascript 2a02:26f0:3500:16::215:149b
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://snap.licdn.com/li.lms-analytics/insight.old.min.js
Requested by: Host: snap.licdn.com
URL: https://snap.licdn.com/li.lms-analytics/insight.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:3500:16::215:149b Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: /
Resource Hash: 14f2ec002b176e0dee403cb7dd4ef2274a1353080e1e3e4084678770f4c15b9c

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://usa.kaspersky.com/about/press-releases/2022_apt-uses-shadowpad-backdoor-and-ms-exchange-vulnerability-to-attack-building-automation-systems
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Fri, 12 Aug 2022 04:06:41 GMT
content-encoding: gzip
last-modified: Thu, 11 Aug 2022 22:33:43 GMT
x-cdn: AKAM
vary: Accept-Encoding
content-type: application/x-javascript;charset=utf-8
cache-control: max-age=66675
accept-ranges: bytes
content-length: 3085

GET
H3 200 839281392784015 Show response
connect.facebook.net/signals/config/ 293 KB
84 KB 18ms
8ms Script
application/x-javascript 2a03:2880:f01c:8012:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/839281392784015?v=2.9.75&r=stable

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f01c:8012:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

b611d3aad8a93ae6586e482983ea4ff27567669f1da4374b0cc43ca2abc63c61

Security Headers

Name	Value
Content-Security-Policy	default-src facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com data: blob: 'self';script-src .fbcdn.net .facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://usa.kaspersky.com/about/press-releases/2022_apt-uses-shadowpad-backdoor-and-ms-exchange-vulnerability-to-attack-building-automation-systems
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

content-security-policy: default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
content-encoding: gzip
x-content-type-options: nosniff
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400,h3-29=":443"; ma=86400
content-length: 86293
x-xss-protection: 0
pragma: public
x-fb-debug: 0Su3APYukL2tF1ZF6UjwopXHBVFWK/hxuu32Vs9Ib4Ngb9bQWIe6rue63Z2rvH6MYo73ofEbJ8wcnlXUn2FXSw==
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: DENY
date: Fri, 12 Aug 2022 04:06:41 GMT
strict-transport-security: max-age=31536000; preload; includeSubDomains
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cache-control: public, max-age=1200
x-fb-rlafr: 0
priority: u=3,i
expires: Sat, 01 Jan 2000 00:00:00 GMT

POST
H3 200 collect Show response
www.google-analytics.com/j/ 2 B
22 B 30ms
14ms XHR
text/plain 2a00:1450:4001:829::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j96&a=291700064&t=pageview&_s=1&dl=https%3A%2F%2Fusa.kaspersky.com%2Fabout%2Fpress-releases%2F2022_apt-uses-shadowpad-backdoor-and-ms-exchange-vulnerability-to-attack-building-automation-systems&dp=%2Fabout%2Fpress-releases%2F2022_apt-uses-shadowpad-backdoor-and-ms-exchange-vulnerability-to-attack-building-automation-systems&ul=en-us&de=UTF-8&dt=other%20%3E%20null&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YEBAAEABAAAAAC~&jid=586617920&gjid=1992193161&cid=1053902295.1660277202&uid=74520031576126851464020767640621381841&tid=UA-63997723-24&_gid=530337426.1660277202&_r=1&gtm=2wg880WZ7LJ3&cd4=USD&cd10=other&cd14=en_US&cd15=74520031576126851464020767640621381841&cd17=other%20%3E%20null&cd50=other&cd53=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F104.0.5112.79%20Safari%2F537.36&cd16=1053902295.1660277202&z=1608455829

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://usa.kaspersky.com/about/press-releases/2022_apt-uses-shadowpad-backdoor-and-ms-exchange-vulnerability-to-attack-building-automation-systems
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Fri, 12 Aug 2022 04:06:41 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://usa.kaspersky.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

activityi;dc_pre=CLaT18a2wPkCFblHHQkdQhIDRw;src=9582686;type=globalc;cat=globa0;ord=6654833928029;gtm=2od880;auiddc=682534601.1660277202;u1=B2C;u2=en_US;u4=usa.kaspersky.com;u5=%2Fabout%2Fpress-rel... Show response
9582686.fls.doubleclick.net/ Frame 159C
Redirect Chain

https://9582686.fls.doubleclick.net/activityi;src=9582686;type=globalc;cat=globa0;ord=6654833928029;gtm=2od880;auiddc=682534601.1660277202;u1=B2C;u2=en_US;u4=usa.kaspersky.com;u5=%2Fabout%2Fpress-r...
https://9582686.fls.doubleclick.net/activityi;dc_pre=CLaT18a2wPkCFblHHQkdQhIDRw;src=9582686;type=globalc;cat=globa0;ord=6654833928029;gtm=2od880;auiddc=682534601.1660277202;u1=B2C;u2=en_US;u4=usa.k...

882 B
529 B

29ms
29ms

Document
text/html

142.250.185.166
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://9582686.fls.doubleclick.net/activityi;dc_pre=CLaT18a2wPkCFblHHQkdQhIDRw;src=9582686;type=globalc;cat=globa0;ord=6654833928029;gtm=2od880;auiddc=682534601.1660277202;u1=B2C;u2=en_US;u4=usa.kaspersky.com;u5=%2Fabout%2Fpress-releases%2F2022_apt-uses-shadowpad-backdoor-and-ms-exchange-vulnerability-to-attack-building-automation-systems;u6=;u7=74520031576126851464020767640621381841-1053902295.1660277202;u9=_about_press-releases_2022_apt-uses-shadowpad-backdoor-and-ms-exchange-vulnerability-to-attack-building-automation-systems;~oref=https%3A%2F%2Fusa.kaspersky.com%2Fabout%2Fpress-releases%2F2022_apt-uses-shadowpad-backdoor-and-ms-exchange-vulnerability-to-attack-building-automation-systems?

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=DC-9582686

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.166 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s51-in-f6.1e100.net

Software

cafe /

Resource Hash

4c6804dfa6056409d98a46f02c6a5ed85274de407a82b2f85ccc8f2a84ec0350

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: about:blank
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private, max-age=0
content-encoding: gzip
content-length: 504
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 12 Aug 2022 04:06:41 GMT
expires: Fri, 12 Aug 2022 04:06:41 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: no-cache, must-revalidate
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 12 Aug 2022 04:06:41 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
follow-only-when-prerender-shown: 1
location: https://9582686.fls.doubleclick.net/activityi;dc_pre=CLaT18a2wPkCFblHHQkdQhIDRw;src=9582686;type=globalc;cat=globa0;ord=6654833928029;gtm=2od880;auiddc=682534601.1660277202;u1=B2C;u2=en_US;u4=usa.kaspersky.com;u5=%2Fabout%2Fpress-releases%2F2022_apt-uses-shadowpad-backdoor-and-ms-exchange-vulnerability-to-attack-building-automation-systems;u6=;u7=74520031576126851464020767640621381841-1053902295.1660277202;u9=_about_press-releases_2022_apt-uses-shadowpad-backdoor-and-ms-exchange-vulnerability-to-attack-building-automation-systems;~oref=https%3A%2F%2Fusa.kaspersky.com%2Fabout%2Fpress-releases%2F2022_apt-uses-shadowpad-backdoor-and-ms-exchange-vulnerability-to-attack-building-automation-systems?
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 204 pageview
c.contentsquare.net/ 0
320 B 114ms
33ms Image
text/plain 54.72.143.148
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://c.contentsquare.net/pageview?pid=2064&uu=61467835-2b04-a5ed-9487-f79d31760af1&sn=1&lv=1660277201&lhd=1660277201&hd=1660277201&pn=1&dw=1600&dh=5046&ww=1600&wh=1200&sw=1600&sh=1200&dr=&url=https%3A%2F%2Fusa.kaspersky.com%2Fabout%2Fpress-releases%2F2022_apt-uses-shadowpad-backdoor-and-ms-exchange-vulnerability-to-attack-building-automation-systems&uc=0&la=en-US&cvars=%7B%221%22%3A%5B%22Page%20Name%22%2C%22other%20%3E%20null%22%5D%7D&cvarp=%7B%221%22%3A%5B%22Page%20Name%22%2C%22other%20%3E%20null%22%5D%7D&v=11.36.2&r=989389
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.72.143.148 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-72-143-148.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://usa.kaspersky.com/about/press-releases/2022_apt-uses-shadowpad-backdoor-and-ms-exchange-vulnerability-to-attack-building-automation-systems
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 12 Aug 2022 04:06:41 GMT
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
content-disposition: inline
timing-allow-origin: *
access-control-allow-headers: Access-Control-Expose-Headers, Content-Type, Content-Compression, X-Requested-With
expires: Sun, 24 Oct 1982 23:00:00 GMT

POST
H2 200 collect Show response
stats.g.doubleclick.net/j/ 4 B
443 B 54ms
18ms XHR
text/plain 2a00:1450:400c:c00::9c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j96&tid=UA-63997723-24&cid=1053902295.1660277202&jid=586617920&uid=74520031576126851464020767640621381841&gjid=1992193161&_gid=530337426.1660277202&_u=YEBAAEAAAAAAAC~&z=1273406527

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400c:c00::9c Brussels, Belgium, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://usa.kaspersky.com/about/press-releases/2022_apt-uses-shadowpad-backdoor-and-ms-exchange-vulnerability-to-attack-building-automation-systems
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
date: Fri, 12 Aug 2022 04:06:41 GMT
content-type: text/plain
access-control-allow-origin: https://usa.kaspersky.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
BLOB 200
OK 27b42b0e-3409-416b-9e1f-f43d93fe05df
https://usa.kaspersky.com/ 6 KB
0 Other
application/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://usa.kaspersky.com/27b42b0e-3409-416b-9e1f-f43d93fe05df
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: ec36c7249716fc660c847484fe53adc360c7dbc6d8f5b93446a518a4e4c0bb49

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

Content-Length: 6483
Content-Type: application/javascript

GET
H2 204 5039146.js Show response
bat.bing.com/p/action/ 0
119 B 351ms
351ms Script
text/plain 2620:1ec:c11::200
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://bat.bing.com/p/action/5039146.js

Requested by

Host: bat.bing.com
URL: https://bat.bing.com/bat.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://usa.kaspersky.com/about/press-releases/2022_apt-uses-shadowpad-backdoor-and-ms-exchange-vulnerability-to-attack-building-automation-systems
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

access-control-allow-origin: *
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: private,max-age=1800
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: F333B1C8472443B4AB0F51AE48AD7216 Ref B: FRA31EDGE0612 Ref C: 2022-08-12T04:06:41Z
date: Fri, 12 Aug 2022 04:06:41 GMT
x-cache: CONFIG_NOCACHE

GET
H2 204 0
bat.bing.com/action/ 0
177 B 33ms
32ms Image
text/plain 2620:1ec:c11::200
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://bat.bing.com/action/0?ti=5039146&Ver=2&mid=ad82926b-f978-4973-b638-868f219bacd1&sid=2bd9a5a019f411ed82d39b405bbe54cc&vid=2bd9d9f019f411ed9e5317a28c0cb1e8&vids=1&msclkid=N&pi=1200101525&lg=en-US&sw=1600&sh=1200&sc=24&tl=Kaspersky%20ICS%20CERT%20discovered%20threat%20actor%20attacking%20telecommunications,%20manufacturing,%20and%20transport%20organizations%20%7C%20Kaspersky&p=https%3A%2F%2Fusa.kaspersky.com%2Fabout%2Fpress-releases%2F2022_apt-uses-shadowpad-backdoor-and-ms-exchange-vulnerability-to-attack-building-automation-systems&r=&lt=1854&evt=pageLoad&sv=1&rn=78314

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://usa.kaspersky.com/about/press-releases/2022_apt-uses-shadowpad-backdoor-and-ms-exchange-vulnerability-to-attack-building-automation-systems
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=31536000; includeSubDomains; preload
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: E01F92BCC0F64EFBBFFE18FD9457F6F4 Ref B: FRA31EDGE0612 Ref C: 2022-08-12T04:06:41Z
date: Fri, 12 Aug 2022 04:06:41 GMT
x-cache: CONFIG_NOCACHE
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 204 dvar
c.contentsquare.net/ 0
319 B 91ms
34ms Image
text/plain 54.72.143.148
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://c.contentsquare.net/dvar?v=11.36.2&pid=2064&uu=61467835-2b04-a5ed-9487-f79d31760af1&sn=1&pn=1&dv=N4IgxgzgsghgLmAFgSwHYHMDSBTAniALhAAYA6AVgGYB2ARkoE5LLzaAWY84htgfVoBsA4gCZq1EcW4NiIAL5AAA&r=783319
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.72.143.148 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-72-143-148.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://usa.kaspersky.com/about/press-releases/2022_apt-uses-shadowpad-backdoor-and-ms-exchange-vulnerability-to-attack-building-automation-systems
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 12 Aug 2022 04:06:41 GMT
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
content-disposition: inline
timing-allow-origin: *
access-control-allow-headers: Access-Control-Expose-Headers, Content-Type, Content-Compression, X-Requested-With
expires: Sun, 24 Oct 1982 23:00:00 GMT

GET
H2

200

collect
px4.ads.linkedin.com/
Redirect Chain

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=39138&time=1660277201682&url=https%3A%2F%2Fusa.kaspersky.com%2Fabout%2Fpress-releases%2F2022_apt-uses-shadowpad-backdoor-and-ms-exchange-vulnerabi...
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D39138%26time%3D1660277201682%26url%3Dhttps%253A%252F%252Fusa.kaspersky.com%252Fab...
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=39138&time=1660277201682&url=https%3A%2F%2Fusa.kaspersky.com%2Fabout%2Fpress-releases%2F2022_apt-uses-shadowpad-backdoor-and-ms-exchange-vulnerabi...
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=39138&time=1660277201682&url=https%3A%2F%2Fusa.kaspersky.com%2Fabout%2Fpress-releases%2F2022_apt-uses-shadowpad-backdoor-and-ms-exchange-vulnerab...

0
265 B

154ms
114ms

Image
application/javascript

13.107.42.14
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=39138&time=1660277201682&url=https%3A%2F%2Fusa.kaspersky.com%2Fabout%2Fpress-releases%2F2022_apt-uses-shadowpad-backdoor-and-ms-exchange-vulnerability-to-attack-building-automation-systems&liSync=true&e_ipv6=AQKaDwuGdCr-lAAAAYKQO5x3tUqd_d5JsPMeCmvv6TXhU2sqfxfxpXlPc6H9kenO9_dFXIBBrq3ciTvxn_K1khlBOrukPA
Protocol: H2
Server: 13.107.42.14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://usa.kaspersky.com/about/press-releases/2022_apt-uses-shadowpad-backdoor-and-ms-exchange-vulnerability-to-attack-building-automation-systems
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Fri, 12 Aug 2022 04:06:41 GMT
x-li-pop: afd-prod-lva1-x
x-msedge-ref: Ref A: 9F5C7A8ECE324CEBBD56C13AE0D2F9C3 Ref B: FRAEDGE1315 Ref C: 2022-08-12T04:06:42Z
linkedin-action: 1
x-cache: CONFIG_NOCACHE
content-type: application/javascript
x-li-proto: http/2
content-length: 0
x-li-uuid: AAXmA2jdTm9U0IlOKrJw5A==
x-li-fabric: prod-lva1

Redirect headers

date: Fri, 12 Aug 2022 04:06:41 GMT
x-li-pop: afd-prod-lva1-x
x-msedge-ref: Ref A: E4670CD73F9C41EC8D10BC9E5FCF56F7 Ref B: FRAEDGE1116 Ref C: 2022-08-12T04:06:41Z
linkedin-action: 1
x-cache: CONFIG_NOCACHE
x-li-fabric: prod-lva1
location: https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=39138&time=1660277201682&url=https%3A%2F%2Fusa.kaspersky.com%2Fabout%2Fpress-releases%2F2022_apt-uses-shadowpad-backdoor-and-ms-exchange-vulnerability-to-attack-building-automation-systems&liSync=true&e_ipv6=AQKaDwuGdCr-lAAAAYKQO5x3tUqd_d5JsPMeCmvv6TXhU2sqfxfxpXlPc6H9kenO9_dFXIBBrq3ciTvxn_K1khlBOrukPA
x-li-proto: http/2
content-length: 0
x-li-uuid: AAXmA2ja9KenBOavwiDWcg==

GET
H/1.1 200
OK / Show response
api.ipify.org/ 34 B
218 B 309ms
94ms Script
application/javascript 52.20.78.240
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://api.ipify.org/?format=jsonp&callback=ML_getIP
Requested by: Host: ove1.marketlinc.com
URL: https://ove1.marketlinc.com/public/js/deployment.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 52.20.78.240 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-20-78-240.compute-1.amazonaws.com
Software: Cowboy /
Resource Hash: 8f0ccb8dd15faf5ebd5bcff663110e44359c7d6b98212e5ee622d71506360991

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://usa.kaspersky.com/about/press-releases/2022_apt-uses-shadowpad-backdoor-and-ms-exchange-vulnerability-to-attack-building-automation-systems
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

Date: Fri, 12 Aug 2022 04:06:41 GMT
Via: 1.1 vegur
Server: Cowboy
Connection: keep-alive
Content-Length: 34
Vary: Origin
Content-Type: application/javascript

GET
H2 200 genesys.min.js Show response
apps.mypurecloud.com/genesys-bootstrap/ 189 KB
58 KB 408ms
188ms Script
text/javascript 3.211.180.245
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://apps.mypurecloud.com/genesys-bootstrap/genesys.min.js

Requested by

Host: ove1.marketlinc.com
URL: https://ove1.marketlinc.com/public/js/deployment.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

3.211.180.245 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-3-211-180-245.compute-1.amazonaws.com

Software

nginx /

Resource Hash

7bf1624c6024a48f6450cd459ac77da54ae016cb2ba28924fcab8f0c48508bc8

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://usa.kaspersky.com/about/press-releases/2022_apt-uses-shadowpad-backdoor-and-ms-exchange-vulnerability-to-attack-building-automation-systems
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Fri, 12 Aug 2022 04:06:41 GMT
content-encoding: gzip
last-modified: Tue, 09 Aug 2022 07:09:18 GMT
server: nginx
x-amz-request-id: RS1NMXP06363YGTY
etag: "c54783af4ff4e740bf1547c6f27c7238"
strict-transport-security: max-age=15768000; includeSubDomains
content-type: text/javascript
cache-control: max-age=0, no-cache
content-length: 58670
x-amz-version-id: iU1Bw1DqeZKEZ9opZguehTOODwb6NpPk
x-amz-id-2: Ikkd5EUbqKFYF3fvUt/nR+iTFqxOg387FhYXUgItIR13UC3i798nVYr17pa/518ESZ3UvYiY95E=

GET
H2 200 snippet.js Show response
ove1.marketlinc.com/public/js/ 22 KB
6 KB 8ms
7ms Script
application/javascript 2600:9000:2156:9c00:17:2e54:9a00:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ove1.marketlinc.com/public/js/snippet.js?307982198
Requested by: Host: usa.kaspersky.com
URL: https://usa.kaspersky.com/about/press-releases/2022_apt-uses-shadowpad-backdoor-and-ms-exchange-vulnerability-to-attack-building-automation-systems
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2156:9c00:17:2e54:9a00:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 9afdb26f17db42d21b1df16c21e4c02ce515a2c2d2ac5140c4ca0e14e473a577

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://usa.kaspersky.com/about/press-releases/2022_apt-uses-shadowpad-backdoor-and-ms-exchange-vulnerability-to-attack-building-automation-systems
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

x-amz-version-id: kwaduWX2qt2w.OHxUXnoYQ0Gy7ylig5F
content-encoding: gzip
last-modified: Fri, 22 Jul 2022 22:32:35 GMT
server: AmazonS3
age: 1595
etag: W/"509301588a6972e9e2c90efa78e70617"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
via: 1.1 e6d97713eb9b65f883e0f86b833878dc.cloudfront.net (CloudFront)
date: Fri, 12 Aug 2022 03:40:07 GMT
x-amz-cf-pop: FRA50-C1
x-amz-cf-id: KGn2Se_dtneFrcPYb2vmJEWH3xfo1V9kngajB8QEfExVO1F2usZM0g==

GET
H2 200 A2336411-46c8-4f83-96b6-294966496d651.js Show response
d.impactradius-event.com/ 42 KB
13 KB 713ms
321ms Script
text/javascript 35.186.249.72
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://d.impactradius-event.com/A2336411-46c8-4f83-96b6-294966496d651.js
Requested by: Host: usa.kaspersky.com
URL: https://usa.kaspersky.com/about/press-releases/2022_apt-uses-shadowpad-backdoor-and-ms-exchange-vulnerability-to-attack-building-automation-systems
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.186.249.72 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 72.249.186.35.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: 4e39dd1af2ab89316460668ebbd994841c3d9aaa9e1ce6d428b040dc73ac8cc4

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://usa.kaspersky.com/about/press-releases/2022_apt-uses-shadowpad-backdoor-and-ms-exchange-vulnerability-to-attack-building-automation-systems
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Fri, 12 Aug 2022 04:06:42 GMT
content-encoding: gzip
age: 0
x-guploader-uploadid: ADPycdt6t6O9MmTNCr9jV4GPcjnfQAN-p3r-BMqSYKrz5tz8Cvx1as-_blkaLTdlzgIarzQM7uSqfA82ePAUSc-_WWOmOotTVyM8
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 1
x-goog-stored-content-encoding: gzip
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13182
last-modified: Wed, 02 Mar 2022 19:41:23 GMT
server: UploadServer
etag: "3de352e7d844a747c3067ea5900e1eb4"
vary: Accept-Encoding
x-goog-hash: crc32c=BL1d/w==, md5=PeNS59hEp0fDBn6lkA4etA==
x-goog-generation: 1646250082848219
cache-control: public,max-age=900,s-maxage=300
x-goog-stored-content-length: 13182
accept-ranges: bytes
content-type: text/javascript; charset=utf-8
expires: Fri, 12 Aug 2022 04:11:42 GMT

GET
H2 200 /
www.facebook.com/tr/ 44 B
297 B 33ms
8ms Image
image/gif 2a03:2880:f11c:8183:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=839281392784015&ev=PageView&dl=https%3A%2F%2Fusa.kaspersky.com%2Fabout%2Fpress-releases%2F2022_apt-uses-shadowpad-backdoor-and-ms-exchange-vulnerability-to-attack-building-automation-systems&rl=&if=false&ts=1660277201698&sw=1600&sh=1200&v=2.9.75&r=stable&ec=0&o=30&fbp=fb.1.1660277201697.568766126&it=1660277201535&coo=false&rqm=GET

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f11c:8183:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://usa.kaspersky.com/about/press-releases/2022_apt-uses-shadowpad-backdoor-and-ms-exchange-vulnerability-to-attack-building-automation-systems
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Fri, 12 Aug 2022 04:06:41 GMT
last-modified: Fri, 21 Dec 2012 00:00:01 GMT
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
cache-control: no-cache, must-revalidate, max-age=0
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 44
expires: Fri, 12 Aug 2022 04:06:41 GMT

GET
H3 200 displayAd.js Show response
s.tribalfusion.com/ 677 B
942 B 164ms
164ms Script
application/x-javascript 2606:4700:4400::6812:230b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://s.tribalfusion.com/displayAd.js?dver=0.8&th=7238200512
Requested by: Host: a.tribalfusion.com
URL: https://a.tribalfusion.com/pixel/tags/Kaspersky%20UK/797783/pixel.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:4400::6812:230b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 19c5e9311f01192e728f41452623bc3a10d346f15fcc5bc0a65437e0924ac60a

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://usa.kaspersky.com/about/press-releases/2022_apt-uses-shadowpad-backdoor-and-ms-exchange-vulnerability-to-attack-building-automation-systems
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Fri, 12 Aug 2022 04:06:41 GMT
content-encoding: gzip
cf-cache-status: DYNAMIC
p3p: CP="NOI DEVo TAIa OUR BUS"
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 331
x-function: 153
last-modified: Wed, 11 Aug 2021 04:08:51 GMT
server: cloudflare
x-reuse-index: 65
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: private
cf-ray: 739656ff1c4f9122-FRA
expires: Thu, 10 Nov 2022 04:06:41 GMT

GET
H2 200 identify.js Show response
analytics.tiktok.com/i18n/pixel/ 114 KB
31 KB 102ms
102ms Script
application/javascript 23.36.163.232
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://analytics.tiktok.com/i18n/pixel/identify.js
Requested by: Host: analytics.tiktok.com
URL: https://analytics.tiktok.com/i18n/pixel/events.js?sdkid=C1QRHFHLRI5O97LIAVQG&lib=ttq
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.36.163.232 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a23-36-163-232.deploy.static.akamaitechnologies.com
Software: nginx /
Resource Hash: b2864c65b32cd25bf64a7eb4fddf486dff821f1924172a0083db962615bd6ce0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://usa.kaspersky.com/about/press-releases/2022_apt-uses-shadowpad-backdoor-and-ms-exchange-vulnerability-to-attack-building-automation-systems
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 12 Aug 2022 04:06:41 GMT
content-encoding: gzip
x-tt-trace-tag: id=16;cdn-cache=miss;type=dyn
server: nginx
x-tt-logid: 20220812040641061F26579D066CDBFB51
vary: Accept-Encoding
x-cache: TCP_MISS from a23-36-161-204.deploy.akamaitechnologies.com (AkamaiGHost/10.9.1-42763970) (-)
content-type: application/javascript; charset=UTF-8
cache-control: max-age=0, no-cache, no-store
x-origin-response-time: 95,23.36.161.204
x-tt-trace-host: 01071338e576d3120912a2d25762897a4e1167beb4fcac0fceccf38413dad66b68abe1825e41ede09a4fcecfcbe4679f3ab3facd1e68f96116fd51680845f206ecf08cb6107ac0c55125f77f441677b9ed
server-timing: inner; dur=2, cdn-cache; desc=MISS, edge; dur=1, origin; dur=94
x-akamai-request-id: 8b93da31
expires: Fri, 12 Aug 2022 04:06:41 GMT

POST
H2 200 monitor
analytics.tiktok.com/api/v2/ 0
688 B 108ms
107ms Ping
application/octet-stream 23.36.163.232
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://analytics.tiktok.com/api/v2/monitor
Requested by: Host: analytics.tiktok.com
URL: https://analytics.tiktok.com/i18n/pixel/events.js?sdkid=C1QRHFHLRI5O97LIAVQG&lib=ttq
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.36.163.232 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a23-36-163-232.deploy.static.akamaitechnologies.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://usa.kaspersky.com/about/press-releases/2022_apt-uses-shadowpad-backdoor-and-ms-exchange-vulnerability-to-attack-building-automation-systems
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

x-akamai-request-id: 49553b52.8b93da56
date: Fri, 12 Aug 2022 04:06:41 GMT
x-cache-remote: TCP_MISS from a23-220-104-19.deploy.akamaitechnologies.com (AkamaiGHost/10.9.1-42763970) (-)
x-tt-trace-tag: id=16;cdn-cache=miss;type=dyn
x-cache: TCP_MISS from a23-36-161-204.deploy.akamaitechnologies.com (AkamaiGHost/10.9.1-42763970) (-)
x-parent-response-time: 100,23.36.161.204
server-timing: cdn-cache; desc=MISS, edge; dur=88, origin; dur=13, inner; dur=5
content-length: 0
pragma: no-cache
server: nginx
x-tt-logid: 20220812040641134382858F796EEBF816
content-type: application/octet-stream
access-control-allow-origin: *
cache-control: max-age=0, no-cache, no-store
x-origin-response-time: 13,23.220.104.19
x-tt-trace-host: 01071338e576d3120912a2d25762897a4e7a0d9fbb4ee826938dbe86eb33a4b2ecb2aa222ae824fd130d167f1f9da5872c83df4c670e77ff0de4c364e2a18adeea3a4774db2d0fd5d6df9c47b1ae2634a7f2ef9c70f5793b29fef233816f80f1b4
expires: Fri, 12 Aug 2022 04:06:41 GMT

POST
H2 200 monitor
analytics.tiktok.com/api/v2/ 0
687 B 107ms
106ms Ping
application/octet-stream 23.36.163.232
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://analytics.tiktok.com/api/v2/monitor
Requested by: Host: analytics.tiktok.com
URL: https://analytics.tiktok.com/i18n/pixel/events.js?sdkid=C1QRHFHLRI5O97LIAVQG&lib=ttq
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.36.163.232 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a23-36-163-232.deploy.static.akamaitechnologies.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://usa.kaspersky.com/about/press-releases/2022_apt-uses-shadowpad-backdoor-and-ms-exchange-vulnerability-to-attack-building-automation-systems
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

x-akamai-request-id: 64113c9e.8b93da5a
date: Fri, 12 Aug 2022 04:06:41 GMT
x-cache-remote: TCP_MISS from a23-220-104-24.deploy.akamaitechnologies.com (AkamaiGHost/10.9.1-42763970) (-)
x-tt-trace-tag: id=16;cdn-cache=miss;type=dyn
x-cache: TCP_MISS from a23-36-161-204.deploy.akamaitechnologies.com (AkamaiGHost/10.9.1-42763970) (-)
x-parent-response-time: 96,23.36.161.204
server-timing: cdn-cache; desc=MISS, edge; dur=87, origin; dur=10, inner; dur=6
content-length: 0
pragma: no-cache
server: nginx
x-tt-logid: 20220812040641DBE3F7C35075F1E409EB
content-type: application/octet-stream
access-control-allow-origin: *
cache-control: max-age=0, no-cache, no-store
x-origin-response-time: 10,23.220.104.24
x-tt-trace-host: 01071338e576d3120912a2d25762897a4e7a0d9fbb4ee826938dbe86eb33a4b2ec9586019a430c608f63fe331bc7d108cca0a16ff7a826361a784538ddf904e062b300a699c5a4b5f20b98c92513dc7b37434aa72a0aa36e84e8b0366dfeeb49a7
expires: Fri, 12 Aug 2022 04:06:41 GMT

POST
H2 200 monitor
analytics.tiktok.com/api/v2/ 0
688 B 114ms
113ms Ping
application/octet-stream 23.36.163.232
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://analytics.tiktok.com/api/v2/monitor
Requested by: Host: analytics.tiktok.com
URL: https://analytics.tiktok.com/i18n/pixel/events.js?sdkid=C1QRHFHLRI5O97LIAVQG&lib=ttq
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.36.163.232 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a23-36-163-232.deploy.static.akamaitechnologies.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://usa.kaspersky.com/about/press-releases/2022_apt-uses-shadowpad-backdoor-and-ms-exchange-vulnerability-to-attack-building-automation-systems
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

x-akamai-request-id: b1bc1e66.8b93da5d
date: Fri, 12 Aug 2022 04:06:41 GMT
x-cache-remote: TCP_MISS from a23-38-170-39.deploy.akamaitechnologies.com (AkamaiGHost/10.9.1-42763970) (-)
x-tt-trace-tag: id=16;cdn-cache=miss;type=dyn
x-cache: TCP_MISS from a23-36-161-204.deploy.akamaitechnologies.com (AkamaiGHost/10.9.1-42763970) (-)
x-parent-response-time: 102,23.36.161.204
server-timing: cdn-cache; desc=MISS, edge; dur=82, origin; dur=21, inner; dur=6
content-length: 0
pragma: no-cache
server: nginx
x-tt-logid: 202208120406418884E11D1FA524E1C4AF
content-type: application/octet-stream
access-control-allow-origin: *
cache-control: max-age=0, no-cache, no-store
x-origin-response-time: 21,23.38.170.39
x-tt-trace-host: 01071338e576d3120912a2d25762897a4e7a0d9fbb4ee826938dbe86eb33a4b2ec40a2fac42d69d912702627dcefef043babc08fd176faae588db646fa4ccf6437afa211bb988b39340ff468928418ebeb3f67c828193f9262cac28ebd5b2c6b09
expires: Fri, 12 Aug 2022 04:06:41 GMT

POST
H2 200 monitor
analytics.tiktok.com/api/v2/ 0
688 B 129ms
128ms Ping
application/octet-stream 23.36.163.232
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://analytics.tiktok.com/api/v2/monitor
Requested by: Host: analytics.tiktok.com
URL: https://analytics.tiktok.com/i18n/pixel/events.js?sdkid=C1QRHFHLRI5O97LIAVQG&lib=ttq
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.36.163.232 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a23-36-163-232.deploy.static.akamaitechnologies.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://usa.kaspersky.com/about/press-releases/2022_apt-uses-shadowpad-backdoor-and-ms-exchange-vulnerability-to-attack-building-automation-systems
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

x-akamai-request-id: 3b3daf0e.8b93da5e
date: Fri, 12 Aug 2022 04:06:41 GMT
x-cache-remote: TCP_MISS from a23-220-104-7.deploy.akamaitechnologies.com (AkamaiGHost/10.9.1-42763970) (-)
x-tt-trace-tag: id=16;cdn-cache=miss;type=dyn
x-cache: TCP_MISS from a23-36-161-204.deploy.akamaitechnologies.com (AkamaiGHost/10.9.1-42763970) (-)
x-parent-response-time: 117,23.36.161.204
server-timing: cdn-cache; desc=MISS, edge; dur=93, origin; dur=24, inner; dur=5
content-length: 0
pragma: no-cache
server: nginx
x-tt-logid: 20220812040641F81439C9537776EB4BFC
content-type: application/octet-stream
access-control-allow-origin: *
cache-control: max-age=0, no-cache, no-store
x-origin-response-time: 24,23.220.104.7
x-tt-trace-host: 01071338e576d3120912a2d25762897a4e7a0d9fbb4ee826938dbe86eb33a4b2eca6ab7f6750e26b2b6a34e5e2cb5506cfc0b6594e686e4e1621ceb80b0168bc801b6a1c588628fc5b048eca2ae58cdda941becde9bf5e48fd603fb9a09410926b
expires: Fri, 12 Aug 2022 04:06:41 GMT

POST
H2 200 monitor
analytics.tiktok.com/api/v2/ 0
545 B 113ms
112ms Ping
application/octet-stream 23.36.163.232
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://analytics.tiktok.com/api/v2/monitor
Requested by: Host: analytics.tiktok.com
URL: https://analytics.tiktok.com/i18n/pixel/events.js?sdkid=C1QRHFHLRI5O97LIAVQG&lib=ttq
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.36.163.232 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a23-36-163-232.deploy.static.akamaitechnologies.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://usa.kaspersky.com/about/press-releases/2022_apt-uses-shadowpad-backdoor-and-ms-exchange-vulnerability-to-attack-building-automation-systems
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Fri, 12 Aug 2022 04:06:41 GMT
x-tt-trace-tag: id=16;cdn-cache=miss;type=dyn
server: nginx
x-tt-logid: 202208120406417586273DD3CEE8E41B33
x-cache: TCP_MISS from a23-36-161-204.deploy.akamaitechnologies.com (AkamaiGHost/10.9.1-42763970) (-)
content-type: application/octet-stream
access-control-allow-origin: *
cache-control: max-age=0, no-cache, no-store
x-origin-response-time: 99,23.36.161.204
x-tt-trace-host: 01071338e576d3120912a2d25762897a4e1167beb4fcac0fceccf38413dad66b68be35b2875f46a9f5e2622d48d34acae6e61100b8f8512767da129db357c66beb401ee96f6211158a3ebc4cf942539fba
server-timing: inner; dur=6, cdn-cache; desc=MISS, edge; dur=0, origin; dur=99
x-akamai-request-id: 8b93da60
content-length: 0
expires: Fri, 12 Aug 2022 04:06:41 GMT

POST
H2 200 monitor
analytics.tiktok.com/api/v2/ 0
545 B 112ms
112ms Ping
application/octet-stream 23.36.163.232
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://analytics.tiktok.com/api/v2/monitor
Requested by: Host: analytics.tiktok.com
URL: https://analytics.tiktok.com/i18n/pixel/events.js?sdkid=C1QRHFHLRI5O97LIAVQG&lib=ttq
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.36.163.232 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a23-36-163-232.deploy.static.akamaitechnologies.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://usa.kaspersky.com/about/press-releases/2022_apt-uses-shadowpad-backdoor-and-ms-exchange-vulnerability-to-attack-building-automation-systems
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Fri, 12 Aug 2022 04:06:41 GMT
x-tt-trace-tag: id=16;cdn-cache=miss;type=dyn
server: nginx
x-tt-logid: 2022081204064178CB22FE66DDA9E03361
x-cache: TCP_MISS from a23-36-161-204.deploy.akamaitechnologies.com (AkamaiGHost/10.9.1-42763970) (-)
content-type: application/octet-stream
access-control-allow-origin: *
cache-control: max-age=0, no-cache, no-store
x-origin-response-time: 97,23.36.161.204
x-tt-trace-host: 01071338e576d3120912a2d25762897a4e1167beb4fcac0fceccf38413dad66b685eaff95506d2afe46208eb964c9fb0d190b1df52164945e1f0f5d29b36e79088a21399b6dc60e8bc1ae9c5766738ec83
server-timing: inner; dur=7, cdn-cache; desc=MISS, edge; dur=1, origin; dur=96
x-akamai-request-id: 8b93da63
content-length: 0
expires: Fri, 12 Aug 2022 04:06:41 GMT

GET
H2 200 config.js Show response
analytics.tiktok.com/i18n/pixel/ 878 B
1 KB 108ms
108ms Script
application/javascript 23.36.163.232
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://analytics.tiktok.com/i18n/pixel/config.js?sdkid=C1QRHFHLRI5O97LIAVQG&hostname=usa.kaspersky.com
Requested by: Host: analytics.tiktok.com
URL: https://analytics.tiktok.com/i18n/pixel/events.js?sdkid=C1QRHFHLRI5O97LIAVQG&lib=ttq
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.36.163.232 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a23-36-163-232.deploy.static.akamaitechnologies.com
Software: nginx /
Resource Hash: bd4be36ffb93797f8742028deb9576191aebb0c45b8987fd28a893e816eada9f

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://usa.kaspersky.com/about/press-releases/2022_apt-uses-shadowpad-backdoor-and-ms-exchange-vulnerability-to-attack-building-automation-systems
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

x-akamai-request-id: 6b1abdf9.8b93da69
date: Fri, 12 Aug 2022 04:06:41 GMT
content-encoding: gzip
x-cache-remote: TCP_MISS from a23-220-104-11.deploy.akamaitechnologies.com (AkamaiGHost/10.9.1-42763970) (-)
x-tt-trace-tag: id=16;cdn-cache=miss;type=dyn
x-cache: TCP_MISS from a23-36-161-204.deploy.akamaitechnologies.com (AkamaiGHost/10.9.1-42763970) (-)
x-parent-response-time: 93,23.36.161.204
server-timing: cdn-cache; desc=MISS, edge; dur=87, origin; dur=6, inner; dur=3
content-length: 352
pragma: no-cache
server: nginx
x-tt-logid: 2022081204064150962D4A51F815E1AE24
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
cache-control: max-age=0, no-cache, no-store
x-origin-response-time: 6,23.220.104.11
x-tt-trace-host: 01071338e576d3120912a2d25762897a4e7a0d9fbb4ee826938dbe86eb33a4b2ecf49d71db6d5233edc7bec0b69a4912b87580e1a98da9d82f1204e7bed38aafdd130594506228533229dbb5c33a69daa36a8c88a602e021db97f42ce4d5ddca35
expires: Fri, 12 Aug 2022 04:06:41 GMT

POST
H2 200 monitor
analytics.tiktok.com/api/v2/ 0
546 B 118ms
118ms Ping
application/octet-stream 23.36.163.232
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://analytics.tiktok.com/api/v2/monitor
Requested by: Host: analytics.tiktok.com
URL: https://analytics.tiktok.com/i18n/pixel/events.js?sdkid=C1QRHFHLRI5O97LIAVQG&lib=ttq
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.36.163.232 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a23-36-163-232.deploy.static.akamaitechnologies.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://usa.kaspersky.com/about/press-releases/2022_apt-uses-shadowpad-backdoor-and-ms-exchange-vulnerability-to-attack-building-automation-systems
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Fri, 12 Aug 2022 04:06:41 GMT
x-tt-trace-tag: id=16;cdn-cache=miss;type=dyn
server: nginx
x-tt-logid: 202208120406413639BAFAA49BC1E0C7E5
x-cache: TCP_MISS from a23-36-161-204.deploy.akamaitechnologies.com (AkamaiGHost/10.9.1-42763970) (-)
content-type: application/octet-stream
access-control-allow-origin: *
cache-control: max-age=0, no-cache, no-store
x-origin-response-time: 100,23.36.161.204
x-tt-trace-host: 01071338e576d3120912a2d25762897a4e1167beb4fcac0fceccf38413dad66b680d7f4aa27a37a6559f8356928f3400d8054c6149c2684df517dd528210b84b9b50a9cd172e4c10e7d69d97e3ca875d3a
server-timing: inner; dur=5, cdn-cache; desc=MISS, edge; dur=1, origin; dur=100
x-akamai-request-id: 8b93da70
content-length: 0
expires: Fri, 12 Aug 2022 04:06:41 GMT

POST
H2 200 monitor
analytics.tiktok.com/api/v2/ 0
687 B 118ms
117ms Ping
application/octet-stream 23.36.163.232
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://analytics.tiktok.com/api/v2/monitor
Requested by: Host: analytics.tiktok.com
URL: https://analytics.tiktok.com/i18n/pixel/events.js?sdkid=C1QRHFHLRI5O97LIAVQG&lib=ttq
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.36.163.232 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a23-36-163-232.deploy.static.akamaitechnologies.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://usa.kaspersky.com/about/press-releases/2022_apt-uses-shadowpad-backdoor-and-ms-exchange-vulnerability-to-attack-building-automation-systems
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

x-akamai-request-id: 64113f0c.8b93da72
date: Fri, 12 Aug 2022 04:06:41 GMT
x-cache-remote: TCP_MISS from a23-220-104-24.deploy.akamaitechnologies.com (AkamaiGHost/10.9.1-42763970) (-)
x-tt-trace-tag: id=16;cdn-cache=miss;type=dyn
x-cache: TCP_MISS from a23-36-161-204.deploy.akamaitechnologies.com (AkamaiGHost/10.9.1-42763970) (-)
x-parent-response-time: 99,23.36.161.204
server-timing: cdn-cache; desc=MISS, edge; dur=88, origin; dur=12, inner; dur=5
content-length: 0
pragma: no-cache
server: nginx
x-tt-logid: 20220812040641A50458352EE714E03D70
content-type: application/octet-stream
access-control-allow-origin: *
cache-control: max-age=0, no-cache, no-store
x-origin-response-time: 12,23.220.104.24
x-tt-trace-host: 01071338e576d3120912a2d25762897a4e7a0d9fbb4ee826938dbe86eb33a4b2ec9586019a430c608f63fe331bc7d108cc7d1f60eccf6cfc79cef69f036e929538378411d7f9bc58d7e1a28254fd408275d66a7909beec4d1f8eddde5aeaabeaf0
expires: Fri, 12 Aug 2022 04:06:41 GMT

GET
H2 200 ga-audiences
www.google.com/ads/ 42 B
501 B 42ms
20ms Image
image/gif 2a00:1450:4001:803::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j96&tid=UA-63997723-24&cid=1053902295.1660277202&jid=586617920&_u=YEBAAEAAAAAAAC~&z=1536070349

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:803::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://usa.kaspersky.com/about/press-releases/2022_apt-uses-shadowpad-backdoor-and-ms-exchange-vulnerability-to-attack-building-automation-systems
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 12 Aug 2022 04:06:41 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.de/ads/ 42 B
501 B 53ms
19ms Image
image/gif 2a00:1450:4001:80f::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j96&tid=UA-63997723-24&cid=1053902295.1660277202&jid=586617920&_u=YEBAAEAAAAAAAC~&z=1536070349

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://usa.kaspersky.com/about/press-releases/2022_apt-uses-shadowpad-backdoor-and-ms-exchange-vulnerability-to-attack-building-automation-systems
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 12 Aug 2022 04:06:41 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 collect Show response
sgtm.kaspersky.com/g/ 65 B
550 B 176ms
176ms XHR
text/plain 2001:4860:4802:36::15
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://sgtm.kaspersky.com/g/collect?v=2&tid=G-RHQPYL96VR&gtm=2oe880&_p=291700064&cid=1053902295.1660277202&ul=en-us&sr=1600x1200&_fplc=0&_z=ccd.v9B&_s=1&sid=1660277201&sct=1&seg=0&dl=https%3A%2F%2Fusa.kaspersky.com%2Fabout%2Fpress-releases%2F2022_apt-uses-shadowpad-backdoor-and-ms-exchange-vulnerability-to-attack-building-automation-systems&dt=Kaspersky%20ICS%20CERT%20discovered%20threat%20actor%20attacking%20telecommunications%2C%20manufacturing%2C%20and%20transport%20organizations%20%7C%20Kaspersky&en=page_view&_fv=1&_ss=1&ep.pageType=other&ep.businessType=other&ep.siteType=Default&ep.siteClass=Websites&ep.siteLocale=en-us&ep.pageName=other%20%3E%20about%2Fpress-releases%2F2022_apt-uses-shadowpad-backdoor-and-ms-exchange-vulnerability-to-attack-building-automation-systems&ep.campaign=&ep.acCampaignId=&ep.omnitureVisitorId=74520031576126851464020767640621381841&ep.dateStringISO=2022-08-12T04%3A06%3A41.768Z&richsstsse

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/destination?id=G-RHQPYL96VR&l=dataLayer&cx=c

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2001:4860:4802:36::15 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Resource Hash

e64954dc34e12c7190cc2338a54b07644ff0f102aa71cc7209bcbb49c3009f7c

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://usa.kaspersky.com/about/press-releases/2022_apt-uses-shadowpad-backdoor-and-ms-exchange-vulnerability-to-attack-building-automation-systems
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Fri, 12 Aug 2022 04:06:41 GMT
content-encoding: gzip
x-content-type-options: nosniff
vary: Accept-Encoding
content-type: text/plain
access-control-allow-origin: https://usa.kaspersky.com
cache-control: no-cache
access-control-allow-credentials: true
via: 1.1 google

GET
H2 200 dc_pre=CLaT18a2wPkCFblHHQkdQhIDRw;src=9582686;type=globalc;cat=globa0;ord=6654833928029;gtm=2od880;auiddc=*;u1=B2C;u2=en_US;u4=usa.kaspersky.com;u5=%2Fabout%2Fpress-releases%2F2022_apt-uses-shadowp...
adservice.google.com/ddm/fls/z/ Frame 159C 42 B
494 B 65ms
46ms Image
image/gif 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://adservice.google.com/ddm/fls/z/dc_pre=CLaT18a2wPkCFblHHQkdQhIDRw;src=9582686;type=globalc;cat=globa0;ord=6654833928029;gtm=2od880;auiddc=*;u1=B2C;u2=en_US;u4=usa.kaspersky.com;u5=%2Fabout%2Fpress-releases%2F2022_apt-uses-shadowpad-backdoor-and-ms-exchange-vulnerability-to-attack-building-automation-systems;u6=;u7=74520031576126851464020767640621381841-1053902295.1660277202;u9=_about_press-releases_2022_apt-uses-shadowpad-backdoor-and-ms-exchange-vulnerability-to-attack-building-automation-systems;~oref=https%3A%2F%2Fusa.kaspersky.com%2Fabout%2Fpress-releases%2F2022_apt-uses-shadowpad-backdoor-and-ms-exchange-vulnerability-to-attack-building-automation-systems

Requested by

Host: 9582686.fls.doubleclick.net
URL: https://9582686.fls.doubleclick.net/activityi;dc_pre=CLaT18a2wPkCFblHHQkdQhIDRw;src=9582686;type=globalc;cat=globa0;ord=6654833928029;gtm=2od880;auiddc=682534601.1660277202;u1=B2C;u2=en_US;u4=usa.kaspersky.com;u5=%2Fabout%2Fpress-releases%2F2022_apt-uses-shadowpad-backdoor-and-ms-exchange-vulnerability-to-attack-building-automation-systems;u6=;u7=74520031576126851464020767640621381841-1053902295.1660277202;u9=_about_press-releases_2022_apt-uses-shadowpad-backdoor-and-ms-exchange-vulnerability-to-attack-building-automation-systems;~oref=https%3A%2F%2Fusa.kaspersky.com%2Fabout%2Fpress-releases%2F2022_apt-uses-shadowpad-backdoor-and-ms-exchange-vulnerability-to-attack-building-automation-systems?

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://9582686.fls.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 12 Aug 2022 04:06:41 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H/1.1 200 visitor-scoring Show response
visitor-scoring-b.marketlinc.com/ 184 B
859 B 126ms
125ms XHR
application/json 54.208.220.65
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://visitor-scoring-b.marketlinc.com/visitor-scoring
Requested by: Host: ove1.marketlinc.com
URL: https://ove1.marketlinc.com/public/js/snippet.js?307982198
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.208.220.65 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-208-220-65.compute-1.amazonaws.com
Software: Apache/2.4.53 () OpenSSL/1.0.2k-fips /
Resource Hash: 962c32a355320866fa85bdd86784d2449e7de92f6f8461756cc19895bc07ea5e

Request headers

Referer: https://usa.kaspersky.com/about/press-releases/2022_apt-uses-shadowpad-backdoor-and-ms-exchange-vulnerability-to-attack-building-automation-systems
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
Content-Type: application/json

Response headers

Date: Fri, 12 Aug 2022 04:06:41 GMT
Content-Encoding: gzip
Server: Apache/2.4.53 () OpenSSL/1.0.2k-fips
Content-Type: application/json
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, must-revalidate, no-cache="set-cookie"
Connection: keep-alive
Content-Length: 166
Expires: -1

OPTIONS
H/1.1 200 visitor-scoring
visitor-scoring-b.marketlinc.com/ Frame 0
0 435ms
96ms Preflight
text/plain 54.208.220.65
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://visitor-scoring-b.marketlinc.com/visitor-scoring
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.208.220.65 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-208-220-65.compute-1.amazonaws.com
Software: Apache/2.4.53 () OpenSSL/1.0.2k-fips /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://usa.kaspersky.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

Access-Control-Allow-Headers: Content-Type
Access-Control-Allow-Methods: POST
Access-Control-Allow-Origin: *
Access-Control-Max-Age: 1800
Cache-Control: no-store, no-cache, must-revalidate
Cache-control: no-cache="set-cookie"
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 0
Content-Type: text/plain; charset=UTF-8
Date: Fri, 12 Aug 2022 04:06:41 GMT
Expires: -1
Server: Apache/2.4.53 () OpenSSL/1.0.2k-fips

POST
H2 200 monitor
analytics.tiktok.com/api/v2/ 0
688 B 126ms
126ms Ping
application/octet-stream 23.36.163.232
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://analytics.tiktok.com/api/v2/monitor
Requested by: Host: analytics.tiktok.com
URL: https://analytics.tiktok.com/i18n/pixel/events.js?sdkid=C1QRHFHLRI5O97LIAVQG&lib=ttq
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.36.163.232 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a23-36-163-232.deploy.static.akamaitechnologies.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://usa.kaspersky.com/about/press-releases/2022_apt-uses-shadowpad-backdoor-and-ms-exchange-vulnerability-to-attack-building-automation-systems
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

x-akamai-request-id: 49553f8d.8b93dab4
date: Fri, 12 Aug 2022 04:06:41 GMT
x-cache-remote: TCP_MISS from a23-220-104-19.deploy.akamaitechnologies.com (AkamaiGHost/10.9.1-42763970) (-)
x-tt-trace-tag: id=16;cdn-cache=miss;type=dyn
x-cache: TCP_MISS from a23-36-161-204.deploy.akamaitechnologies.com (AkamaiGHost/10.9.1-42763970) (-)
x-parent-response-time: 118,23.36.161.204
server-timing: cdn-cache; desc=MISS, edge; dur=91, origin; dur=27, inner; dur=8
content-length: 0
pragma: no-cache
server: nginx
x-tt-logid: 2022081204064168AFB9106AB09AF22815
content-type: application/octet-stream
access-control-allow-origin: *
cache-control: max-age=0, no-cache, no-store
x-origin-response-time: 27,23.220.104.19
x-tt-trace-host: 01071338e576d3120912a2d25762897a4e7a0d9fbb4ee826938dbe86eb33a4b2ecb2aa222ae824fd130d167f1f9da5872ca7596a0182ea8f891176ff7cd18a8f10d1beda1d03393815339525c5fbba5a35c547cfd24034eaaa307ea607c416d4c7
expires: Fri, 12 Aug 2022 04:06:41 GMT

POST
H2 200 monitor
analytics.tiktok.com/api/v2/ 0
688 B 105ms
105ms Ping
application/octet-stream 23.36.163.232
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://analytics.tiktok.com/api/v2/monitor
Requested by: Host: analytics.tiktok.com
URL: https://analytics.tiktok.com/i18n/pixel/events.js?sdkid=C1QRHFHLRI5O97LIAVQG&lib=ttq
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.36.163.232 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a23-36-163-232.deploy.static.akamaitechnologies.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://usa.kaspersky.com/about/press-releases/2022_apt-uses-shadowpad-backdoor-and-ms-exchange-vulnerability-to-attack-building-automation-systems
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

x-akamai-request-id: 8ee9e7e1.8b93daf3
date: Fri, 12 Aug 2022 04:06:41 GMT
x-cache-remote: TCP_MISS from a23-38-170-110.deploy.akamaitechnologies.com (AkamaiGHost/10.9.1-42763970) (-)
x-tt-trace-tag: id=16;cdn-cache=miss;type=dyn
x-cache: TCP_MISS from a23-36-161-204.deploy.akamaitechnologies.com (AkamaiGHost/10.9.1-42763970) (-)
x-parent-response-time: 97,23.36.161.204
server-timing: cdn-cache; desc=MISS, edge; dur=82, origin; dur=15, inner; dur=6
content-length: 0
pragma: no-cache
server: nginx
x-tt-logid: 20220812040641D7B93C0B10E917EE368E
content-type: application/octet-stream
access-control-allow-origin: *
cache-control: max-age=0, no-cache, no-store
x-origin-response-time: 15,23.38.170.110
x-tt-trace-host: 01071338e576d3120912a2d25762897a4e7a0d9fbb4ee826938dbe86eb33a4b2ece3db6a104e67a5d8dbc6fc875e24e1b9c9981d52e1777671d3a6d7585d3834723604b192c0d47de4e99c96fae68e804e3768c97ce2801d81902021000fcd70a7
expires: Fri, 12 Aug 2022 04:06:41 GMT

POST
H2 200 monitor
analytics.tiktok.com/api/v2/ 0
688 B 109ms
108ms Ping
application/octet-stream 23.36.163.232
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://analytics.tiktok.com/api/v2/monitor
Requested by: Host: analytics.tiktok.com
URL: https://analytics.tiktok.com/i18n/pixel/events.js?sdkid=C1QRHFHLRI5O97LIAVQG&lib=ttq
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.36.163.232 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a23-36-163-232.deploy.static.akamaitechnologies.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://usa.kaspersky.com/about/press-releases/2022_apt-uses-shadowpad-backdoor-and-ms-exchange-vulnerability-to-attack-building-automation-systems
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

x-akamai-request-id: 3b3d94fb.8b93daf6
date: Fri, 12 Aug 2022 04:06:41 GMT
x-cache-remote: TCP_MISS from a23-220-104-7.deploy.akamaitechnologies.com (AkamaiGHost/10.9.1-42763970) (-)
x-tt-trace-tag: id=16;cdn-cache=miss;type=dyn
x-cache: TCP_MISS from a23-36-161-204.deploy.akamaitechnologies.com (AkamaiGHost/10.9.1-42763970) (-)
x-parent-response-time: 100,23.36.161.204
server-timing: cdn-cache; desc=MISS, edge; dur=89, origin; dur=11, inner; dur=7
content-length: 0
pragma: no-cache
server: nginx
x-tt-logid: 20220812040641A3A3F42314D784EF6B80
content-type: application/octet-stream
access-control-allow-origin: *
cache-control: max-age=0, no-cache, no-store
x-origin-response-time: 12,23.220.104.7
x-tt-trace-host: 01071338e576d3120912a2d25762897a4e7a0d9fbb4ee826938dbe86eb33a4b2eca6ab7f6750e26b2b6a34e5e2cb5506cff4c9a858a55a24c321dd3c64490c913e5b7285f62ec9679e163a405317bfd45b13ddfbc32fbb14b275615ff6cfed0500
expires: Fri, 12 Aug 2022 04:06:41 GMT

POST
H2 200 pixel
analytics.tiktok.com/api/v2/ 0
548 B 115ms
114ms Ping
application/octet-stream 23.36.163.232
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://analytics.tiktok.com/api/v2/pixel
Requested by: Host: analytics.tiktok.com
URL: https://analytics.tiktok.com/i18n/pixel/events.js?sdkid=C1QRHFHLRI5O97LIAVQG&lib=ttq
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.36.163.232 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a23-36-163-232.deploy.static.akamaitechnologies.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://usa.kaspersky.com/about/press-releases/2022_apt-uses-shadowpad-backdoor-and-ms-exchange-vulnerability-to-attack-building-automation-systems
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Fri, 12 Aug 2022 04:06:41 GMT
x-tt-trace-tag: id=16;cdn-cache=miss;type=dyn
server: nginx
x-tt-logid: 2022081204064178CB22FE66DDA9E0336F
x-cache: TCP_MISS from a23-36-161-204.deploy.akamaitechnologies.com (AkamaiGHost/10.9.1-42763970) (-)
content-type: application/octet-stream
access-control-allow-origin: *
cache-control: max-age=0, no-cache, no-store
x-origin-response-time: 103,23.36.161.204
x-tt-trace-host: 01071338e576d3120912a2d25762897a4e1167beb4fcac0fceccf38413dad66b68849a17d51400f769770552e4d8e22bbc6d40ea7dc10f0f24bfd3730b4496b00162b8b492459353e8f7e4e9a8e54e2cc1
server-timing: inner; dur=15, cdn-cache; desc=MISS, edge; dur=1, origin; dur=103
x-akamai-request-id: 8b93dafc
content-length: 0
expires: Fri, 12 Aug 2022 04:06:41 GMT

POST
H2 200 pixel
analytics.tiktok.com/api/v2/ 0
546 B 113ms
113ms Ping
application/octet-stream 23.36.163.232
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://analytics.tiktok.com/api/v2/pixel
Requested by: Host: analytics.tiktok.com
URL: https://analytics.tiktok.com/i18n/pixel/events.js?sdkid=C1QRHFHLRI5O97LIAVQG&lib=ttq
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.36.163.232 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a23-36-163-232.deploy.static.akamaitechnologies.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://usa.kaspersky.com/about/press-releases/2022_apt-uses-shadowpad-backdoor-and-ms-exchange-vulnerability-to-attack-building-automation-systems
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Fri, 12 Aug 2022 04:06:41 GMT
x-tt-trace-tag: id=16;cdn-cache=miss;type=dyn
server: nginx
x-tt-logid: 20220812040641A1C41716E9212AEF3278
x-cache: TCP_MISS from a23-36-161-204.deploy.akamaitechnologies.com (AkamaiGHost/10.9.1-42763970) (-)
content-type: application/octet-stream
access-control-allow-origin: *
cache-control: max-age=0, no-cache, no-store
x-origin-response-time: 101,23.36.161.204
x-tt-trace-host: 01071338e576d3120912a2d25762897a4e1167beb4fcac0fceccf38413dad66b6890a44bc8b177c2a4bf5473f978f0ad666dd779fe5be32569d09cece2a716fb98d4f8b630d226fe2021a4f2254c61fae1
server-timing: inner; dur=12, cdn-cache; desc=MISS, edge; dur=1, origin; dur=101
x-akamai-request-id: 8b93dafd
content-length: 0
expires: Fri, 12 Aug 2022 04:06:41 GMT

GET
H2 200 s95820179330630
kaspersky.d3.sc.omtrdc.net/b/ss/kaspersky-single-suite/1/JS-2.22.3/ 43 B
221 B 107ms
107ms Image
image/gif 15.236.176.210
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://kaspersky.d3.sc.omtrdc.net/b/ss/kaspersky-single-suite/1/JS-2.22.3/s95820179330630?AQB=1&ndh=1&pf=1&t=12%2F7%2F2022%204%3A6%3A41%205%200&mid=74520031576126851464020767640621381841&aamlh=6&ce=UTF-8&ns=kaspersky&cdp=2&pageName=other%20%3E%20about%2Fpress-releases%2F2022_apt-uses-shadowpad-backdoor-and-ms-exchange-vulnerability-to-attack-building-automation-systems&g=https%3A%2F%2Fusa.kaspersky.com%2Fabout%2Fpress-releases%2F2022_apt-uses-shadowpad-backdoor-and-ms-exchange-vulnerability-to-attack-building-automation-systems&cc=USD&ch=other&server=usa.kaspersky.com&aamb=6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y&c2=other&c3=other&v3=other%20%3E%20about%2Fpress-releases%2F2022_apt-uses-shadowpad-backdoor-and-ms-exchange-vulnerability-to-attack-building-automation-systems&v9=https%3A%2F%2Fusa.kaspersky.com%2Fabout%2Fpress-releases%2F2022_apt-uses-shadowpad-backdoor-and-ms-exchange-vulnerability-to-attack-building-automation-systems&c20=dataLayer&c29=v1%3As_code_single_suite.js%3AtrackPageView%20%3E%20sng.t%3Ap&c30=v1%3A20220728%3A294%3ANextGen%3A%5BNULL%5D&c31=https%3A%2F%2Fusa.kaspersky.com%2Fabout%2Fpress-releases%2F2022_apt-uses-shadowpad-backdoor-and-ms-exchange-vulnerability-to-attack-building-automation-systems&v44=D%3Dv3&c47=Default&v47=D%3Dc47&c51=Websites&c57=en-us&v57=D%3Dc57&c58=Kaspersky%20ICS%20CERT%20discovered%20threat%20actor%20attacking%20telecommunications%2C%20manufacturing%2C%20and%20transport%20organizations%20%7C%20Kaspersky&v71=v1%3APage%20View%3A%5BNULL%5D&v113=74520031576126851464020767640621381841&v116=1053902295.1660277202&v125=0.5371393351405094_1660277200990&s=1600x1200&c=24&j=1.6&v=N&k=Y&bw=1600&bh=1200&mcorgid=983502BE532960BE0A490D4C%40AdobeOrg&AQE=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

15.236.176.210 Paris, France, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-15-236-176-210.eu-west-3.compute.amazonaws.com

Software

jag /

Resource Hash

a1ecbaed793a1f564c49c671f2dd0ce36f858534ef6d26b55783a06b884cc506

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://usa.kaspersky.com/about/press-releases/2022_apt-uses-shadowpad-backdoor-and-ms-exchange-vulnerability-to-attack-building-automation-systems
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Fri, 12 Aug 2022 04:06:41 GMT
x-content-type-options: nosniff
x-c: main-1661.I2f39db.M0-585
p3p: CP="This is not a P3P policy"
content-length: 43
x-xss-protection: 1; mode=block
pragma: no-cache
last-modified: Sat, 13 Aug 2022 04:06:41 GMT
server: jag
xserver: anedge-69c8d8cc76-dhml4
etag: 3565418141214408704-4619879580676817175
vary: *
content-type: image/gif;charset=utf-8
access-control-allow-origin: *
cache-control: no-cache, no-store, max-age=0, no-transform, private
expires: Thu, 11 Aug 2022 04:06:41 GMT

GET
H/1.1

200
OK

setuid
ib.adnxs.com/
Redirect Chain

https://s.tribalfusion.com/insights?%7B%22tagKey%22%3A%222481917101%22%2C%22th%22%3A7238200512%2C%22version%22%3A%221.0%22%2C%22tKey%22%3A%22aKmneMXT3o4abf2qj5mTrEUGJRQhSIYe%22%2C%22url%22%3A%22htt...
https://a4.tribalfusion.com/ipg?ip6=2a02:6ea0:c71b:0:1011:9417:3a04:a480&kv=%7B%22ord%22%3A%2016110034%2C%20%22clientID%22%3A%20797783%7D&redirect=https://ib.adnxs.com/getuidu?https://a.tribalfusio...
https://ib.adnxs.com/setuid?entity=305&code=$TF_USER_ID_ENC$

43 B
1008 B

14ms
14ms

Image
image/gif

185.89.210.141
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=305&code=$TF_USER_ID_ENC$

Protocol

HTTP/1.1

Server

185.89.210.141 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

950.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net

Software

nginx/1.21.3 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://usa.kaspersky.com/about/press-releases/2022_apt-uses-shadowpad-backdoor-and-ms-exchange-vulnerability-to-attack-building-automation-systems
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 12 Aug 2022 04:06:42 GMT
X-Proxy-Origin: 138.199.38.132; 138.199.38.132; 950.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
AN-X-Request-Uuid: 6ebf3c1f-9dca-48bd-91e5-5f15bd69492c
Server: nginx/1.21.3
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 12 Aug 2022 04:06:42 GMT
cf-cache-status: DYNAMIC
x-function: 201
server: cloudflare
x-reuse-index: 1
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
cf-ray: 739657014a256973-FRA
p3p: CP="NOI DEVo TAIa OUR BUS"
location: https://ib.adnxs.com/setuid?entity=305&code=$TF_USER_ID_ENC$
cache-control: no-cache, private
content-type: text/html
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
expires: Thu, 01 Jan 1970 00:00:00 GMT

POST
H3 200 / Show response
www.facebook.com/tr/ Frame 3C54 0
18 B 18ms
8ms Document
text/plain 2a03:2880:f11c:8183:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/tr/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f11c:8183:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Content-Type: application/x-www-form-urlencoded
Origin: https://usa.kaspersky.com
Referer: https://usa.kaspersky.com/about/press-releases/2022_apt-uses-shadowpad-backdoor-and-ms-exchange-vulnerability-to-attack-building-automation-systems
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-origin: https://usa.kaspersky.com
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 0
content-type: text/plain
cross-origin-resource-policy: cross-origin
date: Fri, 12 Aug 2022 04:06:42 GMT
priority: u=0
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains

GET
H/1.1 200
OK domains.json Show response
api-cdn.mypurecloud.com/webdeployments/v1/deployments/0ca4cac6-2f6c-4718-8eb3-54e541bae72f/ 113 B
764 B 500ms
436ms XHR
application/json 108.138.17.129
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://api-cdn.mypurecloud.com/webdeployments/v1/deployments/0ca4cac6-2f6c-4718-8eb3-54e541bae72f/domains.json
Requested by: Host: apps.mypurecloud.com
URL: https://apps.mypurecloud.com/genesys-bootstrap/genesys.min.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 108.138.17.129 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-138-17-129.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 0d430826d874dbcb979adf42923f152d80f48dd19620cc80d5000ae7151320af

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://usa.kaspersky.com/about/press-releases/2022_apt-uses-shadowpad-backdoor-and-ms-exchange-vulnerability-to-attack-building-automation-systems
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

Date: Fri, 12 Aug 2022 04:06:43 GMT
Via: 1.1 a811170f30183becd909b501e545e756.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: FRA56-P7
x-amz-server-side-encryption: AES256
X-Cache: RefreshHit from cloudfront
Connection: keep-alive
Content-Length: 113
Last-Modified: Fri, 05 Aug 2022 17:38:31 GMT
Server: AmazonS3
ETag: "fd121e9ec588aafb3a5e64ee0c60757f"
Vary: Accept-Encoding,Origin
Access-Control-Allow-Methods: GET, POST, PUT
Content-Type: application/json
Access-Control-Allow-Origin: *
Cache-Control: max-age=120,s-maxage=120
Accept-Ranges: bytes
X-Amz-Cf-Id: kuciono8RhWTqZ74y-LUpicH7825P1Eca1mYhvt5Mzgr7qmL1AQ6Kg==

POST
H3 200 collect Show response
www.google-analytics.com/j/ 4 B
24 B 14ms
14ms XHR
text/plain 2a00:1450:4001:829::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j96&a=291700064&t=event&ni=1&_s=1&dl=https%3A%2F%2Fusa.kaspersky.com%2Fabout%2Fpress-releases%2F2022_apt-uses-shadowpad-backdoor-and-ms-exchange-vulnerability-to-attack-building-automation-systems&ul=en-us&de=UTF-8&dt=Kaspersky%20ICS%20CERT%20discovered%20threat%20actor%20attacking%20telecommunications%2C%20manufacturing%2C%20and%20transport%20organizations%20%7C%20Kaspersky&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=Lift%20AI%20Score&ea=20-24&_u=YHDAAEABAAAAAC~&jid=1682270696&gjid=716015755&cid=1053902295.1660277202&tid=UA-63997723-24&_gid=530337426.1660277202&_r=1&_slc=1&cd39=2XjwKnwRjH0wB&cd52=2XjwKnwRjH0wB&cd51=20-24&z=1894308505

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

aec60bc104db041b1512185839f18f52986df7e569e5445f740dd60f763fbca8

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://usa.kaspersky.com/about/press-releases/2022_apt-uses-shadowpad-backdoor-and-ms-exchange-vulnerability-to-attack-building-automation-systems
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Fri, 12 Aug 2022 04:06:42 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://usa.kaspersky.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 s98027811816114
kaspersky.d3.sc.omtrdc.net/b/ss/kaspersky-single-suite/1/JS-2.22.3/ 43 B
210 B 109ms
109ms Image
image/gif 15.236.176.210
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://kaspersky.d3.sc.omtrdc.net/b/ss/kaspersky-single-suite/1/JS-2.22.3/s98027811816114?AQB=1&ndh=1&pf=1&t=12%2F7%2F2022%204%3A6%3A42%205%200&mid=74520031576126851464020767640621381841&aamlh=6&ce=UTF-8&ns=kaspersky&cdp=2&pageName=other%20%3E%20about%2Fpress-releases%2F2022_apt-uses-shadowpad-backdoor-and-ms-exchange-vulnerability-to-attack-building-automation-systems&g=https%3A%2F%2Fusa.kaspersky.com%2Fabout%2Fpress-releases%2F2022_apt-uses-shadowpad-backdoor-and-ms-exchange-vulnerability-to-attack-building-automation-systems&cc=USD&ch=other&server=usa.kaspersky.com&aamb=6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y&c2=other&c3=other&v3=other%20%3E%20about%2Fpress-releases%2F2022_apt-uses-shadowpad-backdoor-and-ms-exchange-vulnerability-to-attack-building-automation-systems&v9=https%3A%2F%2Fusa.kaspersky.com%2Fabout%2Fpress-releases%2F2022_apt-uses-shadowpad-backdoor-and-ms-exchange-vulnerability-to-attack-building-automation-systems&c20=dataLayer&c29=v1%3As_code_single_suite.js%3AtrackMarketLincVisitor%20%3E%20trackEvent%20%3E%20sng.tl%3Ao&c30=v1%3A20220728%3A294%3ANextGen%3A%5BNULL%5D&c31=https%3A%2F%2Fusa.kaspersky.com%2Fabout%2Fpress-releases%2F2022_apt-uses-shadowpad-backdoor-and-ms-exchange-vulnerability-to-attack-building-automation-systems&c47=Default&v47=D%3Dc47&v49=2XjwKnwRjH0wB&c51=Websites&c57=en-us&v57=D%3Dc57&c58=Kaspersky%20ICS%20CERT%20discovered%20threat%20actor%20attacking%20telecommunications%2C%20manufacturing%2C%20and%20transport%20organizations%20%7C%20Kaspersky&v71=v1%3AMarketLinc%20%3E%20Set%20Visitor%3A%7B%7D&v113=74520031576126851464020767640621381841&v116=1053902295.1660277202&v125=0.5371393351405094_1660277200990&pe=lnk_o&pev2=Custom%20Event&s=1600x1200&c=24&j=1.6&v=N&k=Y&bw=1600&bh=1200&mcorgid=983502BE532960BE0A490D4C%40AdobeOrg&lrt=111&AQE=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

15.236.176.210 Paris, France, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-15-236-176-210.eu-west-3.compute.amazonaws.com

Software

jag /

Resource Hash

a1ecbaed793a1f564c49c671f2dd0ce36f858534ef6d26b55783a06b884cc506

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://usa.kaspersky.com/about/press-releases/2022_apt-uses-shadowpad-backdoor-and-ms-exchange-vulnerability-to-attack-building-automation-systems
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Fri, 12 Aug 2022 04:06:42 GMT
x-content-type-options: nosniff
x-c: main-1661.I2f39db.M0-585
p3p: CP="This is not a P3P policy"
content-length: 43
x-xss-protection: 1; mode=block
pragma: no-cache
last-modified: Sat, 13 Aug 2022 04:06:42 GMT
server: jag
xserver: anedge-69c8d8cc76-wgzsr
etag: 3565418143418777600-4619827659355205687
vary: *
content-type: image/gif;charset=utf-8
access-control-allow-origin: *
cache-control: no-cache, no-store, max-age=0, no-transform, private
expires: Thu, 11 Aug 2022 04:06:42 GMT

GET
H/1.1 200
OK config.json Show response
api-cdn.mypurecloud.com/webdeployments/v1/deployments/0ca4cac6-2f6c-4718-8eb3-54e541bae72f/ 729 B
1 KB 419ms
419ms XHR
application/json 108.138.17.129
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://api-cdn.mypurecloud.com/webdeployments/v1/deployments/0ca4cac6-2f6c-4718-8eb3-54e541bae72f/config.json
Requested by: Host: apps.mypurecloud.com
URL: https://apps.mypurecloud.com/genesys-bootstrap/genesys.min.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 108.138.17.129 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-138-17-129.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 4be6c7e5d3bd1b8be7e361c1a62916d05d4d0983e75a4dcf642f39515301e568

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://usa.kaspersky.com/about/press-releases/2022_apt-uses-shadowpad-backdoor-and-ms-exchange-vulnerability-to-attack-building-automation-systems
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

Date: Fri, 12 Aug 2022 04:06:44 GMT
Via: 1.1 a811170f30183becd909b501e545e756.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: FRA56-P7
x-amz-server-side-encryption: AES256
X-Cache: RefreshHit from cloudfront
Connection: keep-alive
Content-Length: 729
Last-Modified: Fri, 05 Aug 2022 17:38:31 GMT
Server: AmazonS3
ETag: "4f38987cf035b093647ad5659433eff8"
Vary: Accept-Encoding,Origin
Access-Control-Allow-Methods: GET, POST, PUT
Content-Type: application/json
Access-Control-Allow-Origin: *
Cache-Control: max-age=120,s-maxage=120
Accept-Ranges: bytes
X-Amz-Cf-Id: nCD2WvXZA1XBy94TcRTo0l6JDpKBTd1M92X3qBWB9l7vkAFaX44klw==

POST
H3 200 collect Show response
stats.g.doubleclick.net/j/ 4 B
25 B 78ms
26ms XHR
text/plain 2a00:1450:400c:c00::9c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j96&tid=UA-63997723-24&cid=1053902295.1660277202&jid=1682270696&gjid=716015755&_gid=530337426.1660277202&_u=YHDAAEABAAAAAC~&z=1495045423

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400c:c00::9c Brussels, Belgium, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://usa.kaspersky.com/about/press-releases/2022_apt-uses-shadowpad-backdoor-and-ms-exchange-vulnerability-to-attack-building-automation-systems
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
date: Fri, 12 Aug 2022 04:06:43 GMT
content-type: text/plain
access-control-allow-origin: https://usa.kaspersky.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ga-audiences
www.google.com/ads/ 42 B
63 B 119ms
33ms Image
image/gif 2a00:1450:4001:803::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j96&tid=UA-63997723-24&cid=1053902295.1660277202&jid=1682270696&_u=YHDAAEABAAAAAC~&z=1844077372

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://usa.kaspersky.com/about/press-releases/2022_apt-uses-shadowpad-backdoor-and-ms-exchange-vulnerability-to-attack-building-automation-systems
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 12 Aug 2022 04:06:43 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ga-audiences
www.google.de/ads/ 42 B
63 B 37ms
20ms Image
image/gif 2a00:1450:4001:80f::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j96&tid=UA-63997723-24&cid=1053902295.1660277202&jid=1682270696&_u=YHDAAEABAAAAAC~&z=1844077372

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://usa.kaspersky.com/about/press-releases/2022_apt-uses-shadowpad-backdoor-and-ms-exchange-vulnerability-to-attack-building-automation-systems
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 12 Aug 2022 04:06:43 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 journey.min.js Show response
apps.mypurecloud.com/journey/messenger-plugins/ 100 KB
30 KB 94ms
94ms Script
text/javascript 3.211.180.245
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://apps.mypurecloud.com/journey/messenger-plugins/journey.min.js

Requested by

Host: apps.mypurecloud.com
URL: https://apps.mypurecloud.com/genesys-bootstrap/genesys.min.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

3.211.180.245 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-3-211-180-245.compute-1.amazonaws.com

Software

nginx /

Resource Hash

027f868c27e71b12c7889438fb9e0667d02e718de70b3a2cfa033f926014cf5f

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://usa.kaspersky.com/about/press-releases/2022_apt-uses-shadowpad-backdoor-and-ms-exchange-vulnerability-to-attack-building-automation-systems
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Fri, 12 Aug 2022 04:06:43 GMT
content-encoding: gzip
last-modified: Mon, 08 Aug 2022 16:14:23 GMT
server: nginx
x-amz-request-id: RS1H8153GTF8R5PJ
etag: "788a954b8246b222ecb70362184b72a2"
strict-transport-security: max-age=15768000; includeSubDomains
content-type: text/javascript
cache-control: max-age: 600
content-length: 30587
x-amz-version-id: 9hcj4anQRWF5722z3VDZQoyBOY728D1h
x-amz-id-2: /x+ZSOiHA+kYiuairh6GzZ8XUTLVLbbDn3vWNkk7OgdSGYXeoNcrsBhsIGvjBmaSp8f4jN5oxjQ=

GET
H2 200 sharer.min.js Show response
apps.mypurecloud.com/cobrowse-next/ 168 KB
43 KB 95ms
94ms Script
text/javascript 3.211.180.245
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://apps.mypurecloud.com/cobrowse-next/sharer.min.js

Requested by

Host: apps.mypurecloud.com
URL: https://apps.mypurecloud.com/genesys-bootstrap/genesys.min.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

3.211.180.245 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-3-211-180-245.compute-1.amazonaws.com

Software

nginx /

Resource Hash

acc511874f10d5992ff14cf84460bcd84a47abad64b2be1f23d35f4d983a13e7

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://usa.kaspersky.com/about/press-releases/2022_apt-uses-shadowpad-backdoor-and-ms-exchange-vulnerability-to-attack-building-automation-systems
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Fri, 12 Aug 2022 04:06:43 GMT
content-encoding: gzip
last-modified: Wed, 10 Aug 2022 05:58:03 GMT
server: nginx
x-amz-request-id: RS1ZVHXGSDG9XSE1
etag: "b23a496195ef213571c0952236f6cb44"
strict-transport-security: max-age=15768000; includeSubDomains
content-type: text/javascript
cache-control: max-age=0, no-cache
content-length: 43945
x-amz-version-id: G4csJftQ1CAAR.JZ3bjir7Zc1yiOjezx
x-amz-id-2: R37NO9f9M01gv1CJfXzdoGyuSUVw/3ZoGpxBH3/ftjwTvmrdBMLdyNNBCk1tGVgrQDjUKbhgYeA=

GET
H2 200 offersHelper.min.js Show response
apps.mypurecloud.com/journey/messenger-plugins/ 12 KB
5 KB 199ms
199ms Script
text/javascript 3.211.180.245
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://apps.mypurecloud.com/journey/messenger-plugins/offersHelper.min.js

Requested by

Host: apps.mypurecloud.com
URL: https://apps.mypurecloud.com/genesys-bootstrap/genesys.min.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

3.211.180.245 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-3-211-180-245.compute-1.amazonaws.com

Software

nginx /

Resource Hash

a63540aa2a97c549fe93e0aac747a34467cd51b2fb36c4d10c4a318eff39c213

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://usa.kaspersky.com/about/press-releases/2022_apt-uses-shadowpad-backdoor-and-ms-exchange-vulnerability-to-attack-building-automation-systems
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Fri, 12 Aug 2022 04:06:43 GMT
content-encoding: gzip
last-modified: Mon, 08 Aug 2022 16:14:23 GMT
server: nginx
x-amz-request-id: 7Y3HBA7DK06XW2NB
etag: "04d6c67b48de821b287d684a6aa25a24"
strict-transport-security: max-age=15768000; includeSubDomains
content-type: text/javascript
cache-control: max-age: 600
content-length: 5068
x-amz-version-id: TsnDyLLolnW8a_cA_BnZiYSyW8BlwnwX
x-amz-id-2: RrZbgIn8KTt4iKdPA/bDUqSRGXl/GQCeqOZURal1lCot7VPWkxjhzGUImmGEAFU0oLqPHm5+kls=

GET
H2 200 messenger.html Show response
apps.mypurecloud.com/messenger/ Frame EB72 1 KB
946 B 183ms
183ms Document
text/html 3.211.180.245
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://apps.mypurecloud.com/messenger/messenger.html

Requested by

Host: apps.mypurecloud.com
URL: https://apps.mypurecloud.com/genesys-bootstrap/genesys.min.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

3.211.180.245 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-3-211-180-245.compute-1.amazonaws.com

Software

nginx /

Resource Hash

83735bbc6ef3247fa656770e5ba56b2732b1d019c43be56b3a26759d3f1ae663

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains

Request headers

Referer: https://usa.kaspersky.com/about/press-releases/2022_apt-uses-shadowpad-backdoor-and-ms-exchange-vulnerability-to-attack-building-automation-systems
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: max-age=0, no-cache
content-encoding: gzip
content-type: text/html
date: Fri, 12 Aug 2022 04:06:43 GMT
etag: W/"c8a5a6ef9e7d04e04e71e9cba9b98aa3"
last-modified: Tue, 09 Aug 2022 07:09:20 GMT
server: nginx
strict-transport-security: max-age=15768000; includeSubDomains
x-amz-id-2: 3GHzyYcRhBPy2RAVB6w6oAiK7ODQUBMSzhJ14gG496pgo4XS2+rEOgVLuO/qHTkxKAr06mi3A6k=
x-amz-request-id: HFXHAS0TKGMEDQP7
x-amz-version-id: vuXQ2IlR_Fdda.KmSFSW7mbParEoWHkh

GET
H2 200 collect Show response
sgtm.kaspersky.com/g/ 65 B
270 B 32ms
32ms XHR
text/plain 2001:4860:4802:36::15
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://sgtm.kaspersky.com/g/collect?v=2&tid=G-RHQPYL96VR&gtm=2oe880&_p=291700064&cid=1053902295.1660277202&ul=en-us&sr=1600x1200&_z=ccd.v9B&_s=2&sid=1660277201&sct=1&seg=0&dl=https%3A%2F%2Fusa.kaspersky.com%2Fabout%2Fpress-releases%2F2022_apt-uses-shadowpad-backdoor-and-ms-exchange-vulnerability-to-attack-building-automation-systems&dt=Kaspersky%20ICS%20CERT%20discovered%20threat%20actor%20attacking%20telecommunications%2C%20manufacturing%2C%20and%20transport%20organizations%20%7C%20Kaspersky&en=MarketLinc%20%3E%20Set%20Visitor&ep.pageType=other&ep.businessType=other&ep.siteType=Default&ep.siteClass=Websites&ep.siteLocale=en-us&ep.pageName=other%20%3E%20about%2Fpress-releases%2F2022_apt-uses-shadowpad-backdoor-and-ms-exchange-vulnerability-to-attack-building-automation-systems&ep.campaign=&ep.acCampaignId=&ep.omnitureVisitorId=74520031576126851464020767640621381841&ep.dateStringISO=2022-08-12T04%3A06%3A41.768Z&richsstsse

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/destination?id=G-RHQPYL96VR&l=dataLayer&cx=c

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2001:4860:4802:36::15 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Resource Hash

e64954dc34e12c7190cc2338a54b07644ff0f102aa71cc7209bcbb49c3009f7c

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://usa.kaspersky.com/about/press-releases/2022_apt-uses-shadowpad-backdoor-and-ms-exchange-vulnerability-to-attack-building-automation-systems
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Fri, 12 Aug 2022 04:06:43 GMT
content-encoding: gzip
x-content-type-options: nosniff
vary: Accept-Encoding
content-type: text/plain
access-control-allow-origin: https://usa.kaspersky.com
cache-control: no-cache
access-control-allow-credentials: true
via: 1.1 google

GET
H2 200 newrelic-agent.js Show response
apps.mypurecloud.com/messenger/newrelic/ Frame EB72 28 KB
10 KB 94ms
94ms Script
text/javascript 3.211.180.245
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://apps.mypurecloud.com/messenger/newrelic/newrelic-agent.js

Requested by

Host: apps.mypurecloud.com
URL: https://apps.mypurecloud.com/messenger/messenger.html

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

3.211.180.245 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-3-211-180-245.compute-1.amazonaws.com

Software

nginx /

Resource Hash

d7e9852ce9f4cf46a09a3dad29bf1717367aabc3c2fa76439e1255f1b7618d70

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://apps.mypurecloud.com/messenger/messenger.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Fri, 12 Aug 2022 04:06:43 GMT
content-encoding: gzip
last-modified: Tue, 09 Aug 2022 07:09:20 GMT
server: nginx
x-amz-request-id: RS1K1N5G91X580F3
etag: "21b38fdda9a93f4611482688250bc630"
strict-transport-security: max-age=15768000; includeSubDomains
content-type: text/javascript
cache-control: max-age=0, no-cache
content-length: 9961
x-amz-version-id: yfUowprF1oA18zVO7IbBv4wd4X5t_MOB
x-amz-id-2: xSHjt+VvRolC/BD86YSMfbEQD6p0XQWF5lTauAeAD8TCk7Ft0CsqISh26gx6kyyRJaG/2V9CQtc=

POST
H/1.1 204
No Content beacons
api.mypurecloud.com/api/v2/journey/deployments/0ca4cac6-2f6c-4718-8eb3-54e541bae72f/customers/48ff87b2-3930-4b68-9955-8504987a554c/ 0
837 B 170ms
114ms Ping
text/plain 108.138.17.129
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://api.mypurecloud.com/api/v2/journey/deployments/0ca4cac6-2f6c-4718-8eb3-54e541bae72f/customers/48ff87b2-3930-4b68-9955-8504987a554c/beacons?data=eyJfdiI6IjIuMTA4Ni4wIiwiX2FjdG11IjoiNDhmZjg3YjItMzkzMC00YjY4LTk5NTUtODUwNDk4N2E1NTRjIiwiYXR0Ijp7fSwiY2lkIjoiNDhmZjg3YjItMzkzMC00YjY4LTk5NTUtODUwNDk4N2E1NTRjIiwiY3ZjIjoiMSIsImRrIjpudWxsLCJkbCI6Imh0dHBzOi8vdXNhLmthc3BlcnNreS5jb20vYWJvdXQvcHJlc3MtcmVsZWFzZXMvMjAyMl9hcHQtdXNlcy1zaGFkb3dwYWQtYmFja2Rvb3ItYW5kLW1zLWV4Y2hhbmdlLXZ1bG5lcmFiaWxpdHktdG8tYXR0YWNrLWJ1aWxkaW5nLWF1dG9tYXRpb24tc3lzdGVtcyIsImRuIjoiZW4iLCJkdCI6Ikthc3BlcnNreSBJQ1MgQ0VSVCBkaXNjb3ZlcmVkIHRocmVhdCBhY3RvciBhdHRhY2tpbmcgdGVsZWNvbW11bmljYXRpb25zLCBtYW51ZmFjdHVyaW5nLCBhbmQgdHJhbnNwb3J0IG9yZ2FuaXphdGlvbnMgfCBLYXNwZXJza3kiLCJmZiI6ZmFsc2UsImZqIjpmYWxzZSwiZnAiOnRydWUsImZ3Ijp0cnVlLCJzYmMiOjEsInNoIjoxMjAwLCJzaWQiOiI4YTFmOWMwYS00MjIyLTRkMjQtOGY1YS1mNzJiYjRjZGZjODkiLCJzcGMiOjEsInNzZiI6MCwic3NwIjowLCJzdyI6MTYwMCwidCI6InBhZ2V2aWV3IiwidGJjIjoxLCJ0cGMiOjEsInR0cyI6e30sInZoIjoxMjAwLCJ2dyI6MTYwMH0%3D&type=pageview

Requested by

Host: apps.mypurecloud.com
URL: https://apps.mypurecloud.com/journey/messenger-plugins/journey.min.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

108.138.17.129 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-108-138-17-129.fra56.r.cloudfront.net

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=600; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://usa.kaspersky.com/about/press-releases/2022_apt-uses-shadowpad-backdoor-and-ms-exchange-vulnerability-to-attack-building-automation-systems
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

Date: Fri, 12 Aug 2022 04:06:43 GMT
Via: 1.1 f1a22cc8d842b0950e4bd5bda60806f2.cloudfront.net (CloudFront)
Connection: keep-alive
ININ-Correlation-Id: 9e835745-78b0-4eac-a0dc-9fcfce94fd5a
X-Amz-Cf-Pop: FRA56-P7
Strict-Transport-Security: max-age=600; includeSubDomains
X-Cache: Miss from cloudfront
Access-Control-Allow-Origin: https://usa.kaspersky.com
Access-Control-Expose-Headers: Retry-After,inin-correlation-id
Cache-Control: no-cache, no-store, must-revalidate
Access-Control-Max-Age: 86400
Access-Control-Allow-Methods: GET, POST, PUT, DELETE, OPTIONS, HEAD, PATCH
Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept, Authorization, DNT, User-Agent, Keep-Alive, Cache-Control, ININ-Client-Path
X-Amz-Cf-Id: m-GQoQGT2uFDg3YG2JStQM-SnMVfn1emjag6JsndzjEjSuhKWDxJjg==

GET
H2 200 cxbus.min.js Show response
apps.mypurecloud.com/cxbus/ Frame EB72 20 KB
7 KB 94ms
94ms Script
text/javascript 3.211.180.245
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://apps.mypurecloud.com/cxbus/cxbus.min.js

Requested by

Host: apps.mypurecloud.com
URL: https://apps.mypurecloud.com/messenger/messenger.html

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

3.211.180.245 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-3-211-180-245.compute-1.amazonaws.com

Software

nginx /

Resource Hash

006a6ea4b26c9ba860c5b3d38300121dbd4206a14ab34c7ea75920917e735924

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://apps.mypurecloud.com/messenger/messenger.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Fri, 12 Aug 2022 04:06:43 GMT
content-encoding: gzip
last-modified: Fri, 12 Mar 2021 23:36:08 GMT
server: nginx
x-amz-request-id: GWDCTJ0WKV3N6YT8
etag: "03eac80149ca14bf8b4abfc4316c8ec0"
strict-transport-security: max-age=15768000; includeSubDomains
content-type: text/javascript
cache-control: max-age=0, no-cache
content-length: 7186
x-amz-version-id: caH_RRaqi5zhszUaYYa_AplaLxzSXsoF
x-amz-id-2: m+J8vlHREsvwWlHicnlO6ZoDBaVbGX27AaYMy3WqqAn5EuPFrdrm7K+R8oKMXmvN+D65JiqbENk=

GET
H2 200 defaultVendors.min.js Show response
apps.mypurecloud.com/messenger/ Frame EB72 297 KB
80 KB 95ms
94ms Script
text/javascript 3.211.180.245
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://apps.mypurecloud.com/messenger/defaultVendors.min.js

Requested by

Host: apps.mypurecloud.com
URL: https://apps.mypurecloud.com/messenger/newrelic/newrelic-agent.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

3.211.180.245 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-3-211-180-245.compute-1.amazonaws.com

Software

nginx /

Resource Hash

30972fb95f829194cacd1d1fb501d11c00c0579dc6695b5c2f5d353f055b188f

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://apps.mypurecloud.com/messenger/messenger.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Fri, 12 Aug 2022 04:06:43 GMT
content-encoding: gzip
last-modified: Tue, 09 Aug 2022 07:09:19 GMT
server: nginx
x-amz-request-id: 6KE1DM5PX7CEDZPZ
etag: "886f4e7314c74bf766a5ef5c2bcbf9f9"
strict-transport-security: max-age=15768000; includeSubDomains
content-type: text/javascript
cache-control: max-age=0, no-cache
content-length: 81289
x-amz-version-id: Cnx2_ZEegFyUQa6AzLYACLY.wU43coYl
x-amz-id-2: /tpsnBPVhp1Ip5hLqpl9ocsPreuARf8iVwDf75Q3wIGxRikXv1Np2ZgYoXpztQf0J7TwD0YdeHw=

GET
H2 200 vendors.min.js Show response
apps.mypurecloud.com/messenger/ Frame EB72 141 KB
45 KB 98ms
97ms Script
text/javascript 3.211.180.245
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://apps.mypurecloud.com/messenger/vendors.min.js

Requested by

Host: apps.mypurecloud.com
URL: https://apps.mypurecloud.com/messenger/newrelic/newrelic-agent.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

3.211.180.245 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-3-211-180-245.compute-1.amazonaws.com

Software

nginx /

Resource Hash

4b53f08f7590c8e4a7b3eb6fcb2b0ac5a9181be7abee162852926354b8c0f80f

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://apps.mypurecloud.com/messenger/messenger.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Fri, 12 Aug 2022 04:06:43 GMT
content-encoding: gzip
last-modified: Tue, 09 Aug 2022 07:09:19 GMT
server: nginx
x-amz-request-id: B7S1D1BEG7KXZ04X
etag: "09ea3cb0bec8ac547465c2079c53cbfe"
strict-transport-security: max-age=15768000; includeSubDomains
content-type: text/javascript
cache-control: max-age=0, no-cache
content-length: 45943
x-amz-version-id: NQcdwFEaL7m.2rGdMA8kc283sJJUbgUa
x-amz-id-2: n8R/m2kxVXscuWrGUHe7YCIBnrKyYSA+x+59OhgDS9CXRj6d4uUHW/K8FfouPmcoeWa31yVpTSg=

GET
H2 200 main.min.js Show response
apps.mypurecloud.com/messenger/ Frame EB72 150 KB
45 KB 96ms
96ms Script
text/javascript 3.211.180.245
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://apps.mypurecloud.com/messenger/main.min.js

Requested by

Host: apps.mypurecloud.com
URL: https://apps.mypurecloud.com/messenger/newrelic/newrelic-agent.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

3.211.180.245 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-3-211-180-245.compute-1.amazonaws.com

Software

nginx /

Resource Hash

a5fd29825a3a6628167de0ec1327b5ea216a37dee9a3b4d7244aa70c0d277854

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://apps.mypurecloud.com/messenger/messenger.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Fri, 12 Aug 2022 04:06:43 GMT
content-encoding: gzip
last-modified: Tue, 09 Aug 2022 07:09:20 GMT
server: nginx
x-amz-request-id: HFXM056WKV9PTTSP
etag: "701a00f959179fbb8c170dde92394d19"
strict-transport-security: max-age=15768000; includeSubDomains
content-type: text/javascript
cache-control: max-age=0, no-cache
content-length: 46024
x-amz-version-id: ZPNWLM.KzugGtyzjeV8TX65Na93TR9qY
x-amz-id-2: kIm56Dw+oOnbPwvgjX0DGEhyEoNcPVPWMB02Yn/wezL+1SpsmehncrwVFLuNa9dGi18tUnMTupk=

GET
H2 200 engage.min.js Show response
apps.mypurecloud.com/messenger/ Frame EB72 81 KB
26 KB 188ms
187ms Script
text/javascript 3.211.180.245
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://apps.mypurecloud.com/messenger/engage.min.js

Requested by

Host: apps.mypurecloud.com
URL: https://apps.mypurecloud.com/messenger/newrelic/newrelic-agent.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

3.211.180.245 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-3-211-180-245.compute-1.amazonaws.com

Software

nginx /

Resource Hash

7b3f1146eba0161356d2d242fec06fd9acb855370625d239049f3f78be05cca3

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://apps.mypurecloud.com/messenger/messenger.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Fri, 12 Aug 2022 04:06:43 GMT
content-encoding: gzip
last-modified: Tue, 09 Aug 2022 07:09:19 GMT
server: nginx
x-amz-request-id: 6KE4SMDK63C4FA5P
etag: "0de191d28983c0e7fa5cb084d387e431"
strict-transport-security: max-age=15768000; includeSubDomains
content-type: text/javascript
cache-control: max-age=0, no-cache
content-length: 26378
x-amz-version-id: OaFtz_HvP.eLxsEZc_Pm_apzwhAt1n0s
x-amz-id-2: eODVgfl+joOUUVw6f87bmXrGcjyDmlY8vyhbEIy+L4xeFFafnyOViF7Mx4/jCDEbXIgjAH82MG4=

GET
H2 200 nr-spa-1208.min.js Show response
js-agent.newrelic.com/ Frame EB72 42 KB
16 KB 28ms
7ms Script
application/javascript 151.101.194.137
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://js-agent.newrelic.com/nr-spa-1208.min.js
Requested by: Host: apps.mypurecloud.com
URL: https://apps.mypurecloud.com/messenger/newrelic/newrelic-agent.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.194.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 13e8b4f6220702a10a7566fb389055fedd388a364975146c8d2780c1d2fdc0d0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://apps.mypurecloud.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

x-amz-version-id: Vh.geaSzxk269x8Ss.5iG8XR8B7_1taB
content-encoding: gzip
etag: "d9d4f5c3991c0454eca3e6b2ddfe31d9"
x-amz-request-id: 136K9HT15A9PP4V7
x-cache: HIT
cross-origin-resource-policy: cross-origin
content-length: 15815
x-amz-id-2: cifVV4hoMqGfJFo6fEmmcpLXFzzNHTqj4S7mOr2iJqlFRZxh79xkHKHHUza3y2yrac+E/6efUH4=
x-served-by: cache-hhn4030-HHN
last-modified: Wed, 10 Mar 2021 16:24:31 GMT
server: AmazonS3
x-timer: S1660277204.847203,VS0,VE0
date: Fri, 12 Aug 2022 04:06:43 GMT
vary: Accept-Encoding
content-type: application/javascript
via: 1.1 varnish
cache-control: public, max-age=7200, stale-if-error=604800
accept-ranges: bytes
x-cache-hits: 38

GET
H2 200 en-us.json Show response
apps.mypurecloud.com/messenger/i18n/ Frame EB72 6 KB
2 KB 94ms
94ms XHR
application/json 3.211.180.245
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://apps.mypurecloud.com/messenger/i18n/en-us.json

Requested by

Host: apps.mypurecloud.com
URL: https://apps.mypurecloud.com/messenger/newrelic/newrelic-agent.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

3.211.180.245 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-3-211-180-245.compute-1.amazonaws.com

Software

nginx /

Resource Hash

834cbb09fbd02ceb95df6571cd540d58c2f2a548b106d3d9894db49decb372b4

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://apps.mypurecloud.com/messenger/messenger.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Fri, 12 Aug 2022 04:06:43 GMT
content-encoding: gzip
last-modified: Tue, 09 Aug 2022 07:09:19 GMT
server: nginx
x-amz-request-id: 6KE2C7GNFSTDE7TR
etag: "ae5d8f3c9059f451dfa6020c84ea3d37"
strict-transport-security: max-age=15768000; includeSubDomains
content-type: application/json
cache-control: max-age=0, no-cache
content-length: 1799
x-amz-version-id: tUqcP3f0qkNcdvqJ2135bxIPTGPz5RLh
x-amz-id-2: XHCd7B9YR1OSbDOMF1QNoZ410X8aHiIMTMOxQp4yETLs6o8hQVzrGLwPDasx8n669QMTgBX3RvM=

GET
H/1.1 200
OK 7a5b0de38e Show response
bam-cell.nr-data.net/1/ Frame EB72 49 B
1 KB 216ms
141ms Script
text/javascript 162.247.241.2
NEWRELIC-AS-1

General

Check archive.org

Show headers Download Go to

Full URL: https://bam-cell.nr-data.net/1/7a5b0de38e?a=1213197656&sa=1&v=1208.49599aa&t=Unnamed%20Transaction&rst=670&ck=1&ref=https://apps.mypurecloud.com/messenger/messenger.html&be=304&fe=636&dc=308&af=err,xhr,stn,ins,spa&perf=%7B%22timing%22:%7B%22of%22:1660277203185,%22n%22:0,%22f%22:1,%22dn%22:1,%22dne%22:1,%22c%22:1,%22ce%22:1,%22rq%22:1,%22rp%22:185,%22rpe%22:198,%22dl%22:199,%22di%22:308,%22ds%22:308,%22de%22:308,%22dc%22:636,%22l%22:636,%22le%22:637%7D,%22navigation%22:%7B%7D%7D&jsonp=NREUM.setToken
Requested by: Host: apps.mypurecloud.com
URL: https://apps.mypurecloud.com/messenger/newrelic/newrelic-agent.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 162.247.241.2 Portland, United States, ASN23467 (NEWRELIC-AS-1, US),
Reverse DNS
Software: cloudflare /
Resource Hash: dac715f087720dd7ff7067f5d2ec1988851fa93140ae8a9cbfaa15659dd7fd82

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://apps.mypurecloud.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

Date: Fri, 12 Aug 2022 04:06:44 GMT
Content-Encoding: gzip
CF-Cache-Status: DYNAMIC
NEL: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
Transfer-Encoding: chunked
Cross-Origin-Resource-Policy: cross-origin
access-control-allow-methods: GET, POST, PUT, HEAD, OPTIONS
Connection: keep-alive
Server: cloudflare
Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
Vary: Accept-Encoding
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=DWojOQpH507xSMHoKv9W0ZNzKXHvJtb9BT75aT5%2FrNnArd9X0nYYXORxxpL2hT3Bp34b0inktnHkpcFD%2F1E%2B4fJD0MYWJrldGkmOHkcdA7e25XBYZ%2F0BoN8Ujr3JHivKhgW%2BVgGS"}],"group":"cf-nel","max_age":604800}
Content-Type: text/javascript
Access-Control-Allow-Origin: *
access-control-allow-credentials: true
CF-Ray: 7396570c9ed69b2e-FRA

GET
H2 200 date-en.min.js Show response
apps.mypurecloud.com/messenger/i18n/vendors/ Frame EB72 477 B
839 B 94ms
94ms Script
text/javascript 3.211.180.245
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://apps.mypurecloud.com/messenger/i18n/vendors/date-en.min.js

Requested by

Host: apps.mypurecloud.com
URL: https://apps.mypurecloud.com/messenger/newrelic/newrelic-agent.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

3.211.180.245 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-3-211-180-245.compute-1.amazonaws.com

Software

nginx /

Resource Hash

0b93f34e313afaab968e455f5076e8f6f89826c3c5512a699052d2a2c9ae39ee

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://apps.mypurecloud.com/messenger/messenger.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Fri, 12 Aug 2022 04:06:43 GMT
last-modified: Tue, 09 Aug 2022 07:09:19 GMT
server: nginx
x-amz-request-id: HFXWAVKHZ0RMRDKW
etag: "f823c1fe3039019f1e931ba312db9e77"
strict-transport-security: max-age=15768000; includeSubDomains
content-type: text/javascript
cache-control: max-age=0, no-cache
content-length: 477
x-amz-version-id: pFng1CKqP5qEg5T0rL8cA_XfGedHyzYk
x-amz-id-2: iPcj5YUw0OMDz0dFB7O2zW/jWlevH4KKVANFt3NS52UsX+vH/AZVInLCU+A0yh5/qnK1rtuJ96Y=

POST
H/1.1 200 tracking-event Show response
visitor-scoring-b.marketlinc.com/ 0
700 B 105ms
105ms XHR
text/plain 54.208.220.65
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://visitor-scoring-b.marketlinc.com/tracking-event
Requested by: Host: ove1.marketlinc.com
URL: https://ove1.marketlinc.com/public/js/snippet.js?307982198
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.208.220.65 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-208-220-65.compute-1.amazonaws.com
Software: Apache/2.4.53 () OpenSSL/1.0.2k-fips /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://usa.kaspersky.com/about/press-releases/2022_apt-uses-shadowpad-backdoor-and-ms-exchange-vulnerability-to-attack-building-automation-systems
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
Content-Type: application/json

Response headers

Date: Fri, 12 Aug 2022 04:06:44 GMT
Content-Encoding: gzip
Server: Apache/2.4.53 () OpenSSL/1.0.2k-fips
Content-Type: text/plain; charset=UTF-8
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, must-revalidate, no-cache="set-cookie"
Connection: keep-alive
Content-Length: 0
Expires: -1

GET
H3 200 collect
www.google-analytics.com/ 35 B
55 B 8ms
7ms Image
image/gif 2a00:1450:4001:829::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j96&a=291700064&t=event&ni=1&_s=2&dl=https%3A%2F%2Fusa.kaspersky.com%2Fabout%2Fpress-releases%2F2022_apt-uses-shadowpad-backdoor-and-ms-exchange-vulnerability-to-attack-building-automation-systems&ul=en-us&de=UTF-8&dt=Kaspersky%20ICS%20CERT%20discovered%20threat%20actor%20attacking%20telecommunications%2C%20manufacturing%2C%20and%20transport%20organizations%20%7C%20Kaspersky&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=MarketLinc%20Chat%20Test&_u=YHDAAEABAAAAAC~&jid=&gjid=&cid=1053902295.1660277202&tid=UA-63997723-24&_gid=530337426.1660277202&cd39=2XjwKnwRjH0wB&cd52=2XjwKnwRjH0wB&cd51=20-24&cd38=MarketLinc%20Chat%20Test&z=366633833

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://usa.kaspersky.com/about/press-releases/2022_apt-uses-shadowpad-backdoor-and-ms-exchange-vulnerability-to-attack-building-automation-systems
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 12 Aug 2022 01:01:10 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 11134
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H2 200 s95432008820620
kaspersky.d3.sc.omtrdc.net/b/ss/kaspersky-single-suite/1/JS-2.22.3/ 43 B
210 B 124ms
123ms Image
image/gif 15.236.176.210
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://kaspersky.d3.sc.omtrdc.net/b/ss/kaspersky-single-suite/1/JS-2.22.3/s95432008820620?AQB=1&ndh=1&pf=1&t=12%2F7%2F2022%204%3A6%3A44%205%200&mid=74520031576126851464020767640621381841&aamlh=6&ce=UTF-8&ns=kaspersky&cdp=2&pageName=other%20%3E%20about%2Fpress-releases%2F2022_apt-uses-shadowpad-backdoor-and-ms-exchange-vulnerability-to-attack-building-automation-systems&g=https%3A%2F%2Fusa.kaspersky.com%2Fabout%2Fpress-releases%2F2022_apt-uses-shadowpad-backdoor-and-ms-exchange-vulnerability-to-attack-building-automation-systems&cc=USD&ch=other&server=usa.kaspersky.com&aamb=6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y&c2=other&c3=other&v3=other%20%3E%20about%2Fpress-releases%2F2022_apt-uses-shadowpad-backdoor-and-ms-exchange-vulnerability-to-attack-building-automation-systems&v9=https%3A%2F%2Fusa.kaspersky.com%2Fabout%2Fpress-releases%2F2022_apt-uses-shadowpad-backdoor-and-ms-exchange-vulnerability-to-attack-building-automation-systems&c20=dataLayer&c29=v1%3As_code_single_suite.js%3AtrackMarketLincGroup%20%3E%20trackEvent%20%3E%20sng.tl%3Ao&c30=v1%3A20220728%3A294%3ANextGen%3A%5BNULL%5D&c31=https%3A%2F%2Fusa.kaspersky.com%2Fabout%2Fpress-releases%2F2022_apt-uses-shadowpad-backdoor-and-ms-exchange-vulnerability-to-attack-building-automation-systems&c47=Default&v47=D%3Dc47&v50=MarketLinc%20Chat%20Test&c51=Websites&c57=en-us&v57=D%3Dc57&c58=Kaspersky%20ICS%20CERT%20discovered%20threat%20actor%20attacking%20telecommunications%2C%20manufacturing%2C%20and%20transport%20organizations%20%7C%20Kaspersky&v71=v1%3AMarketLinc%20%3E%20Set%20Group%3A%7B%7D&v113=74520031576126851464020767640621381841&v116=1053902295.1660277202&v125=0.5371393351405094_1660277200990&pe=lnk_o&pev2=Custom%20Event&s=1600x1200&c=24&j=1.6&v=N&k=Y&bw=1600&bh=1200&mcorgid=983502BE532960BE0A490D4C%40AdobeOrg&lrt=111&AQE=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

15.236.176.210 Paris, France, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-15-236-176-210.eu-west-3.compute.amazonaws.com

Software

jag /

Resource Hash

a1ecbaed793a1f564c49c671f2dd0ce36f858534ef6d26b55783a06b884cc506

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://usa.kaspersky.com/about/press-releases/2022_apt-uses-shadowpad-backdoor-and-ms-exchange-vulnerability-to-attack-building-automation-systems
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Fri, 12 Aug 2022 04:06:44 GMT
x-content-type-options: nosniff
x-c: main-1661.I2f39db.M0-585
p3p: CP="This is not a P3P policy"
content-length: 43
x-xss-protection: 1; mode=block
pragma: no-cache
last-modified: Sat, 13 Aug 2022 04:06:44 GMT
server: jag
xserver: anedge-69c8d8cc76-r6z5r
etag: 3565418148131569664-4619431199036531687
vary: *
content-type: image/gif;charset=utf-8
access-control-allow-origin: *
cache-control: no-cache, no-store, max-age=0, no-transform, private
expires: Thu, 11 Aug 2022 04:06:44 GMT

OPTIONS
H/1.1 200 tracking-event
visitor-scoring-b.marketlinc.com/ Frame 0
0 96ms
96ms Preflight
text/plain 54.208.220.65
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://visitor-scoring-b.marketlinc.com/tracking-event
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.208.220.65 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-208-220-65.compute-1.amazonaws.com
Software: Apache/2.4.53 () OpenSSL/1.0.2k-fips /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://usa.kaspersky.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

Access-Control-Allow-Headers: Content-Type
Access-Control-Allow-Methods: POST
Access-Control-Allow-Origin: *
Access-Control-Max-Age: 1800
Cache-Control: no-store, no-cache, must-revalidate
Cache-control: no-cache="set-cookie"
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 0
Content-Type: text/plain; charset=UTF-8
Date: Fri, 12 Aug 2022 04:06:44 GMT
Expires: -1
Server: Apache/2.4.53 () OpenSSL/1.0.2k-fips

POST
H/1.1 204
No Content 7a5b0de38e Show response
bam-cell.nr-data.net/ins/1/ Frame EB72 0
781 B 136ms
136ms XHR
text/plain 162.247.241.2
NEWRELIC-AS-1

General

Check archive.org

Show headers Download Go to

Full URL: https://bam-cell.nr-data.net/ins/1/7a5b0de38e?a=1213197656&sa=1&v=1208.49599aa&t=Unnamed%20Transaction&rst=890&ck=1&ref=https://apps.mypurecloud.com/messenger/messenger.html
Requested by: Host: apps.mypurecloud.com
URL: https://apps.mypurecloud.com/messenger/newrelic/newrelic-agent.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 162.247.241.2 Portland, United States, ASN23467 (NEWRELIC-AS-1, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://apps.mypurecloud.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
content-type: text/plain

Response headers

Date: Fri, 12 Aug 2022 04:06:44 GMT
CF-Cache-Status: DYNAMIC
NEL: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
Vary: Accept-Encoding
access-control-allow-methods: GET, POST, PUT, HEAD, OPTIONS
Access-Control-Allow-Origin: https://apps.mypurecloud.com
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=KWJtz2tE07eiB0jz243tZXN2pkHQL5B%2FWlNQIx94UUxaj5AFkvOp95UP%2Bs2d3jKt%2F0P%2FcXh3181JFwgXZQF5mZ%2Fwo7YKhsYBEYFKeWxZ8DjU58vOwX9jybef0pksAknDDHVdiLqP"}],"group":"cf-nel","max_age":604800}
access-control-allow-credentials: true
Connection: keep-alive
CF-Ray: 7396570d7fa19b2e-FRA

POST
H/1.1 200
OK 7a5b0de38e Show response
bam-cell.nr-data.net/events/1/ Frame EB72 24 B
844 B 145ms
130ms XHR
image/gif 162.247.241.2
NEWRELIC-AS-1

General

Check archive.org

Show headers Download Go to

Full URL: https://bam-cell.nr-data.net/events/1/7a5b0de38e?a=1213197656&sa=1&v=1208.49599aa&t=Unnamed%20Transaction&rst=892&ck=1&ref=https://apps.mypurecloud.com/messenger/messenger.html
Requested by: Host: apps.mypurecloud.com
URL: https://apps.mypurecloud.com/messenger/newrelic/newrelic-agent.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 162.247.241.2 Portland, United States, ASN23467 (NEWRELIC-AS-1, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0c9cf152a0ad00d4f102c93c613c104914be5517ac8f8e0831727f8bfbe8b300

Request headers

Referer: https://apps.mypurecloud.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
content-type: text/plain

Response headers

Date: Fri, 12 Aug 2022 04:06:44 GMT
CF-Cache-Status: DYNAMIC
NEL: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
Vary: Accept-Encoding
access-control-allow-methods: GET, POST, PUT, HEAD, OPTIONS
Content-Type: image/gif
Access-Control-Allow-Origin: https://apps.mypurecloud.com
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=FKS%2FoU3gNBC%2Fl5B%2BCO6tUaVX4k9LMaYObSl8dKFXS%2BWnE%2F8cyclaFcGJecv71atBSrCIFMQYAtyXIUDu9cqCvyue0oHGnvIFF2jVQ%2BtPrTOG8jH5Qzmei78AAWCWZUHA6beBYJwa"}],"group":"cf-nel","max_age":604800}
access-control-allow-credentials: true
Connection: keep-alive
CF-Ray: 7396570d9863bc04-FRA
Content-Length: 24

POST
H/1.1 204
No Content beacons
api.mypurecloud.com/api/v2/journey/deployments/0ca4cac6-2f6c-4718-8eb3-54e541bae72f/customers/48ff87b2-3930-4b68-9955-8504987a554c/ 0
837 B 108ms
107ms Ping
text/plain 108.138.17.129
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://api.mypurecloud.com/api/v2/journey/deployments/0ca4cac6-2f6c-4718-8eb3-54e541bae72f/customers/48ff87b2-3930-4b68-9955-8504987a554c/beacons?data=eyJfdiI6IjIuMTA4Ni4wIiwiX2FjdG11IjoiNDhmZjg3YjItMzkzMC00YjY4LTk5NTUtODUwNDk4N2E1NTRjIiwiYXR0Ijp7ImNvdW50cnlfY29kZSI6IkRFIiwidnNfY29udl9haSI6IjIwLTI0IiwiX21sX3JhbmRvbSI6IjQxIiwiYWJfdGVzdCI6ImEiLCJtbF9zaGlmdF90aW1lIjoiTm9uLUJ1c2luZXNzLUhvdXJzIiwibWxfZXhjbHVkZSI6Ik5vIn0sImNpZCI6IjQ4ZmY4N2IyLTM5MzAtNGI2OC05OTU1LTg1MDQ5ODdhNTU0YyIsImN2YyI6IjEiLCJkayI6bnVsbCwiZGwiOiJodHRwczovL3VzYS5rYXNwZXJza3kuY29tL2Fib3V0L3ByZXNzLXJlbGVhc2VzLzIwMjJfYXB0LXVzZXMtc2hhZG93cGFkLWJhY2tkb29yLWFuZC1tcy1leGNoYW5nZS12dWxuZXJhYmlsaXR5LXRvLWF0dGFjay1idWlsZGluZy1hdXRvbWF0aW9uLXN5c3RlbXMiLCJkbiI6ImVuIiwiZHQiOiJLYXNwZXJza3kgSUNTIENFUlQgZGlzY292ZXJlZCB0aHJlYXQgYWN0b3IgYXR0YWNraW5nIHRlbGVjb21tdW5pY2F0aW9ucywgbWFudWZhY3R1cmluZywgYW5kIHRyYW5zcG9ydCBvcmdhbml6YXRpb25zIHwgS2FzcGVyc2t5IiwiZmYiOmZhbHNlLCJmaiI6ZmFsc2UsImZwIjp0cnVlLCJmdyI6dHJ1ZSwic2JjIjoyLCJzaCI6MTIwMCwic2lkIjoiOGExZjljMGEtNDIyMi00ZDI0LThmNWEtZjcyYmI0Y2RmYzg5Iiwic3BjIjoyLCJzc2YiOjAsInNzcCI6MCwic3ciOjE2MDAsInQiOiJwYWdldmlldyIsInRiYyI6MiwidHBjIjoyLCJ0dHMiOnt9LCJ2aCI6MTIwMCwidnciOjE2MDB9&type=pageview

Requested by

Host: apps.mypurecloud.com
URL: https://apps.mypurecloud.com/journey/messenger-plugins/journey.min.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

108.138.17.129 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-108-138-17-129.fra56.r.cloudfront.net

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=600; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://usa.kaspersky.com/about/press-releases/2022_apt-uses-shadowpad-backdoor-and-ms-exchange-vulnerability-to-attack-building-automation-systems
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

Date: Fri, 12 Aug 2022 04:06:44 GMT
Via: 1.1 f1a22cc8d842b0950e4bd5bda60806f2.cloudfront.net (CloudFront)
Connection: keep-alive
ININ-Correlation-Id: 837272a1-9dc0-4255-bcd0-013026e481ca
X-Amz-Cf-Pop: FRA56-P7
Strict-Transport-Security: max-age=600; includeSubDomains
X-Cache: Miss from cloudfront
Access-Control-Allow-Origin: https://usa.kaspersky.com
Access-Control-Expose-Headers: Retry-After,inin-correlation-id
Cache-Control: no-cache, no-store, must-revalidate
Access-Control-Max-Age: 86400
Access-Control-Allow-Methods: GET, POST, PUT, DELETE, OPTIONS, HEAD, PATCH
Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept, Authorization, DNT, User-Agent, Keep-Alive, Cache-Control, ININ-Client-Path
X-Amz-Cf-Id: XQ8vjrijx9n8eYt_5yPKEE_ZmUkR970tUbm2U3kGUBoFeFmG6dYUHw==

GET
H/1.1 200
OK ping Show response
api.mypurecloud.com/api/v2/journey/deployments/0ca4cac6-2f6c-4718-8eb3-54e541bae72f/customers/48ff87b2-3930-4b68-9955-8504987a554c/ 14 B
895 B 302ms
285ms XHR
application/json 108.138.17.129
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://api.mypurecloud.com/api/v2/journey/deployments/0ca4cac6-2f6c-4718-8eb3-54e541bae72f/customers/48ff87b2-3930-4b68-9955-8504987a554c/ping?sessionId=8a1f9c0a-4222-4d24-8f5a-f72bb4cdfc89&t=1660277205294&dl=https%3A%2F%2Fusa.kaspersky.com%2Fabout%2Fpress-releases%2F2022_apt-uses-shadowpad-backdoor-and-ms-exchange-vulnerability-to-attack-building-automation-systems&dt=Kaspersky%20ICS%20CERT%20discovered%20threat%20actor%20attacking%20telecommunications%2C%20manufacturing%2C%20and%20transport%20organizations%20%7C%20Kaspersky

Requested by

Host: apps.mypurecloud.com
URL: https://apps.mypurecloud.com/journey/messenger-plugins/journey.min.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

108.138.17.129 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-108-138-17-129.fra56.r.cloudfront.net

Software

Resource Hash

7d357b0ef1f85ba71c5ccebb6671b0c34f4b3950f5b21d2af7b4a3d4e9dcd570

Security Headers

Name	Value
Strict-Transport-Security	max-age=600; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://usa.kaspersky.com/about/press-releases/2022_apt-uses-shadowpad-backdoor-and-ms-exchange-vulnerability-to-attack-building-automation-systems
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

Date: Fri, 12 Aug 2022 04:06:45 GMT
Via: 1.1 ca339b9e98820e424be1609317fd0314.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: FRA56-P7
X-Cache: Miss from cloudfront
Access-Control-Allow-Methods: GET, POST, PUT, DELETE, OPTIONS, HEAD, PATCH
Connection: keep-alive
Content-Length: 14
ININ-Correlation-Id: f138b15a-62ba-4abd-ac69-0ab8eb148624
Access-Control-Max-Age: 86400
Strict-Transport-Security: max-age=600; includeSubDomains
Content-Type: application/json
Access-Control-Allow-Origin: https://usa.kaspersky.com
Access-Control-Expose-Headers: Retry-After,inin-correlation-id
Cache-Control: no-cache, no-store, must-revalidate
Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept, Authorization, DNT, User-Agent, Keep-Alive, Cache-Control, ININ-Client-Path
X-Amz-Cf-Id: tVNIg5hgglJWrOYVohMCHC1VpWcQzfZYOkaIfjL6Dvyd3rqxjat3GQ==

POST
H/1.1 200 tracking-event Show response
visitor-scoring-b.marketlinc.com/ 0
700 B 106ms
106ms XHR
text/plain 54.208.220.65
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://visitor-scoring-b.marketlinc.com/tracking-event
Requested by: Host: ove1.marketlinc.com
URL: https://ove1.marketlinc.com/public/js/snippet.js?307982198
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.208.220.65 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-208-220-65.compute-1.amazonaws.com
Software: Apache/2.4.53 () OpenSSL/1.0.2k-fips /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://usa.kaspersky.com/about/press-releases/2022_apt-uses-shadowpad-backdoor-and-ms-exchange-vulnerability-to-attack-building-automation-systems
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
Content-Type: application/json

Response headers

Date: Fri, 12 Aug 2022 04:06:46 GMT
Content-Encoding: gzip
Server: Apache/2.4.53 () OpenSSL/1.0.2k-fips
Content-Type: text/plain; charset=UTF-8
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, must-revalidate, no-cache="set-cookie"
Connection: keep-alive
Content-Length: 0
Expires: -1

OPTIONS
H/1.1 200 tracking-event
visitor-scoring-b.marketlinc.com/ Frame 0
0 97ms
96ms Preflight
text/plain 54.208.220.65
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://visitor-scoring-b.marketlinc.com/tracking-event
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.208.220.65 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-208-220-65.compute-1.amazonaws.com
Software: Apache/2.4.53 () OpenSSL/1.0.2k-fips /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://usa.kaspersky.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

Access-Control-Allow-Headers: Content-Type
Access-Control-Allow-Methods: POST
Access-Control-Allow-Origin: *
Access-Control-Max-Age: 1800
Cache-Control: no-store, no-cache, must-revalidate
Cache-control: no-cache="set-cookie"
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 0
Content-Type: text/plain; charset=UTF-8
Date: Fri, 12 Aug 2022 04:06:46 GMT
Expires: -1
Server: Apache/2.4.53 () OpenSSL/1.0.2k-fips

Verdicts & Comments Add Verdict or Comment

252 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

59 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
usa.kaspersky.com/	1970-01-20 05:11:20	Name: webserver_id Value: f8ee71cae29c79c86a4d5fe4e94a8d89
usa.kaspersky.com/	1970-01-20 05:11:20	Name: country Value: DE
.kaspersky.com/	1970-01-20 13:56:53	Name: mmapi.p.pd Value: %22i6GJbhRPo1lXyZaHn3RItkTnNrJ7GZ6kI-BPNBokhSg%3D%7CAQAAAApDH4sIAAAAAAAEAGNh2MhzP9lNzD6AgTmtKJFRiIHRiaG5j2kWI4OkdSG_RM0tDxjNAAT_oYCBzSWzKDW5hNFNjBEkDgYwSRDNwMDM8JSFkWHax0JGBr7LxYwMCUA1jK4AOLA83nAAAAA%3D%22
.kaspersky.com/	1970-01-20 05:11:17	Name: mmapi.p.bid Value: %22prodfracgeu11%22
.kaspersky.com/	1970-01-20 13:56:53	Name: mmapi.p.srv Value: %22prodfracgeu11%22
.kaspersky.com/	1970-01-20 05:11:19	Name: _cs_mk Value: 0.5371393351405094_1660277200990
.kaspersky.com/	1970-01-20 14:47:17	Name: demdex Value: 75796118337907776004149582669765334667
.kaspersky.com/	1969-12-31 23:59:59	Name: AMCVS_983502BE532960BE0A490D4C%40AdobeOrg Value: 1
usa.kaspersky.com/	1970-01-20 14:47:17	Name: CookieConsent Value: {stamp:65759856=='\|Cnecessary:true\|Cpreferences:true\|Cstatistics:true\|Cmarketing:true\|Cver:1\|Cutc:2106572914\|Cregion:'not_gdpr'}
.bing.com/	1970-01-20 14:32:53	Name: MUID Value: 203485F78BC1628B26CA94098A4A6322
.kaspersky.com/	1970-01-20 05:12:43	Name: _gid Value: GA1.2.530337426.1660277202
.adnxs.com/	1970-01-20 07:20:53	Name: uuid2 Value: 8816277305435262089
.kaspersky.com/	1970-01-20 05:11:17	Name: _gat_UA-63997723-24 Value: 1
.kaspersky.com/	1970-01-20 07:20:53	Name: _gcl_au Value: 1.1.682534601.1660277202
.kaspersky.com/	1970-01-20 14:40:41	Name: _cs_c Value: 0
.kaspersky.com/	1970-01-20 14:40:41	Name: _cs_id Value: 61467835-2b04-a5ed-9487-f79d31760af1.1660277201.1.1660277201.1660277201.1.1694441201653
.kaspersky.com/	1970-01-20 05:11:19	Name: _cs_s Value: 1.0.0.1660279001654
.kaspersky.com/	1970-01-20 14:47:17	Name: AMCV_983502BE532960BE0A490D4C%40AdobeOrg Value: 998868700%7CMCMID%7C74520031576126851464020767640621381841%7CMCAAMLH-1660882001%7C6%7CMCAAMB-1660882001%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCOPTOUT-1660284401s%7CNONE%7CMCAID%7CNONE%7CvVersion%7C4.4.0
.kaspersky.com/	1970-01-20 05:12:43	Name: _uetsid Value: 2bd9a5a019f411ed82d39b405bbe54cc
.kaspersky.com/	1970-01-20 14:32:53	Name: _uetvid Value: 2bd9d9f019f411ed9e5317a28c0cb1e8
.kaspersky.com/	1969-12-31 23:59:59	Name: ml_country Value: DE
.kaspersky.com/	1969-12-31 23:59:59	Name: ml_language Value: en
.kaspersky.com/	1970-01-20 05:54:29	Name: _ml_random Value: 41
.kaspersky.com/	1969-12-31 23:59:59	Name: ml_shift_time Value: Non-Business-Hours
.kaspersky.com/	1970-01-20 14:47:17	Name: _fbp Value: fb.1.1660277201697.568766126
.doubleclick.net/	1970-01-20 14:32:53	Name: IDE Value: AHWqTUkwLq28iDWJ5GL7WR94S4KC3yZO-aCO2isPyth7T-8s7GsQCO3jEEUE8bhJ8wU
.linkedin.com/	1970-01-20 05:54:29	Name: UserMatchHistory Value: AQJbCRZRdyWdBgAAAYKQO5t6HSLV_N7L1Rx95I9x-ysLHiusdMb03AFTmrEUwgiHc4rZK10y5i2MhQ
.linkedin.com/	1970-01-20 05:54:29	Name: AnalyticsSyncHistory Value: AQLnOiOE0oPU7AAAAYKQO5t6shZLIz5H_4c46CQ7whkOvatNw3mgjgtK61ymeLjzX9KunZwYwn3rKuEQ4nNcAw
.ads.linkedin.com/	1969-12-31 23:59:59	Name: lang Value: v=2&lang=en-us
.linkedin.com/	1970-01-20 13:56:53	Name: bcookie Value: "v=2&14275b13-c779-4684-86b3-293a2d4dc79a"
.linkedin.com/	1970-01-20 05:12:43	Name: lidc Value: "b=VGST01:s=V:r=V:a=V:p=V:g=2687:u=1:x=1:i=1660277201:t=1660363601:v=2:sig=AQFgxQEyOBMTFqqIRsBj16LW4fevlVrU"
.postrelease.com/	1970-01-20 13:56:53	Name: opt_out Value: 1
.tiktok.com/	1970-01-20 14:32:53	Name: _ttp Value: 2DEvkadRIgt6kZ4qXe7YGdyVcse
.kaspersky.com/	1970-01-20 14:32:53	Name: _tt_enable_cookie Value: 1
.kaspersky.com/	1970-01-20 14:32:53	Name: _ttp Value: d7c592a2-3b44-427b-b31b-d660e97bff0a
.kaspersky.com/	1969-12-31 23:59:59	Name: s_cc Value: true
.linkedin.com/	1969-12-31 23:59:59	Name: lang Value: v=2&lang=de-de
.www.linkedin.com/	1970-01-20 13:56:53	Name: bscookie Value: "v=1&20220812040641fa1d5810-0e41-4383-8654-81d2a7ad926bAQGssheInVg3ho40S1mLE-M6me-bnu2D"
.linkedin.com/	1970-01-20 09:30:29	Name: li_gc Value: MTswOzE2NjAyNzcyMDE7MjswMjFDMC660ptVblCiMv0oPLCw2PIOkz6fQ8H7XR0qax5qzg==
.kaspersky.com/	1970-01-20 05:12:29	Name: FPLC Value: VCkIo%2B5V1xrsL8YUoa83wj%2FVhZy3O%2B5ymrvlQ%2BJCyLCjlgA6RoeZS%2BFprF6KciWeCs3BHRtFT5TDnL0ELRfONHevwoDeX6%2F%2FHXmu4ENLqcXNY5Sesc4wDp4I0TFRow%3D%3D
.kaspersky.com/	1970-01-20 14:47:17	Name: FPID Value: FPID2.2.6PFGIbXxFnXELEFvtHoQzqp%2F6uwRQl6hAMAywxveIdQ%3D.1660277202
.tribalfusion.com/	1970-01-20 07:20:53	Name: ANON_ID Value: aKnsPCxNeTnBeZdwQMlEOMTKq79QqcK00XRtajnNUvR0ZamJrEkqU17F0ZcWeEqohTJZblVMonyQUb6dTNXH
.adnxs.com/	1970-01-20 07:20:53	Name: anj Value: dTM7k!M4/YE:2jUF']wIg2GVOuv%/a!]tb:8i_jAf!5CO17y]i(DdKbD.Z(w>VC@08E*cc=<kzPF=Uc2D$25ADb6_:!)1W'c(W08
.usa.kaspersky.com/	1970-01-20 07:20:53	Name: _fbp Value: fb.2.1660277202206.784633799
.kaspersky.com/	1970-01-20 14:47:17	Name: vs_vid Value: 2XjwKnwRjH0wB
.kaspersky.com/	1969-12-31 23:59:59	Name: vs_vfs Value: 1
.kaspersky.com/	1969-12-31 23:59:59	Name: vs_sid Value: 8rvj8njxvfB21
.kaspersky.com/	1969-12-31 23:59:59	Name: vs_conv_ai Value: 20-24
.kaspersky.com/	1969-12-31 23:59:59	Name: vs_lift_ai Value: 95-100
api-router.kaspersky-labs.com/	1970-01-20 05:11:20	Name: webserver_id Value: 2fb934a005e7713064a0a34e9eb9a6fa
api-router.kaspersky-labs.com/	1970-01-20 05:11:20	Name: country Value: DE
.kaspersky.com/	1969-12-31 23:59:59	Name: IR_gbd Value: kaspersky.com
.kaspersky.com/	1969-12-31 23:59:59	Name: IR_11660 Value: 1660277202503%7C0%7C1660277202503%7C%7C
.kaspersky.com/	1970-01-20 14:47:17	Name: _ga Value: GA1.2.1053902295.1660277202
.kaspersky.com/	1970-01-20 05:11:17	Name: _gat_mlGATracker Value: 1
.kaspersky.com/	1970-01-20 05:54:29	Name: ml_eg_new Value: IMPRESSION-OFFERED
.kaspersky.com/	1969-12-31 23:59:59	Name: ml_count Value: 1
.kaspersky.com/	1970-01-20 14:47:17	Name: _ga_RHQPYL96VR Value: GS1.1.1660277201.1.0.1660277204.0
.nr-data.net/	1969-12-31 23:59:59	Name: JSESSIONID Value: 28ac6acc1b28d0b2

4 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
javascript	warning	URL: https://service.maxymiser.net/cdn/com.kaspersky/js/mmapi.js(Line 16) Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://service.maxymiser.net/cg/v5/?fv=dmn%3Dkaspersky.com%3Bref%3D%3Burl%3Dhttps%253A%252F%252Fusa.kaspersky.com%252Fabout%252Fpress-releases%252F2022_apt-uses-shadowpad-backdoor-and-ms-exchange-vulnerability-to-attack-building-automation-systems%3Bscrw%3D1600%3Bscrh%3D1200%3Bclrd%3D24%3Bcok%3D1&lver=1.18&jsncl=mmRequestCallbacks%5B1%5D&ri=1&lto=0&jrt=s, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript	warning	URL: https://service.maxymiser.net/cdn/com.kaspersky/js/mmapi.js(Line 16) Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://service.maxymiser.net/cg/v5/?fv=dmn%3Dkaspersky.com%3Bref%3D%3Burl%3Dhttps%253A%252F%252Fusa.kaspersky.com%252Fabout%252Fpress-releases%252F2022_apt-uses-shadowpad-backdoor-and-ms-exchange-vulnerability-to-attack-building-automation-systems%3Bscrw%3D1600%3Bscrh%3D1200%3Bclrd%3D24%3Bcok%3D1&lver=1.18&jsncl=mmRequestCallbacks%5B1%5D&ri=1&lto=0&jrt=s, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript	warning	URL: https://service.maxymiser.net/cdn/com.kaspersky/js/mmapi.js(Line 16) Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://service.maxymiser.net/platform/eu/api/mmpackage-1.25.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript	warning	URL: https://service.maxymiser.net/cdn/com.kaspersky/js/mmapi.js(Line 16) Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://service.maxymiser.net/platform/eu/api/mmpackage-1.25.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

9582686.fls.doubleclick.net
a.tribalfusion.com
a4.tribalfusion.com
ad.doubleclick.net
adservice.google.com
analytics.tiktok.com
api-cdn.mypurecloud.com
api-router.kaspersky-labs.com
api.ipify.org
api.mypurecloud.com
apps.mypurecloud.com
bam-cell.nr-data.net
bat.bing.com
c.contentsquare.net
connect.facebook.net
d.impactradius-event.com
ib.adnxs.com
jadserve.postrelease.com
js-agent.newrelic.com
js.go2sdk.com
kaspersky.d3.sc.omtrdc.net
media.kaspersky.com
ove1.marketlinc.com
pubads.g.doubleclick.net
px.ads.linkedin.com
px4.ads.linkedin.com
resources.xg4ken.com
s.tribalfusion.com
secure.adnxs.com
service.maxymiser.net
sgtm.kaspersky.com
snap.licdn.com
stats.g.doubleclick.net
t.contentsquare.net
unpkg.com
usa.kaspersky.com
visitor-scoring-b.marketlinc.com
w.usabilla.com
www.facebook.com
www.google-analytics.com
www.google.com
www.google.de
www.googletagmanager.com
www.linkedin.com
108.138.17.129
13.107.42.14
142.250.184.194
142.250.185.166
15.236.176.210
151.101.194.137
162.247.241.2
172.64.155.149
18.66.112.26
18.66.97.122
185.85.15.23
185.85.15.47
185.89.210.141
185.89.211.116
2001:4860:4802:36::15
23.208.225.239
23.36.163.232
2600:9000:2156:9c00:17:2e54:9a00:93a1
2606:4700:4400::6812:230b
2606:4700::6810:7aaf
2620:1ec:21::14
2620:1ec:c11::200
2a00:1450:4001:803::2004
2a00:1450:4001:808::2002
2a00:1450:4001:80f::2003
2a00:1450:4001:812::2008
2a00:1450:4001:829::200e
2a00:1450:400c:c00::9c
2a02:26f0:3500:16::215:149b
2a03:2880:f01c:8012:face:b00c:0:3
2a03:2880:f11c:8183:face:b00c:0:25de
3.211.180.245
35.186.249.72
4.59.181.140
52.20.78.240
52.206.171.79
52.215.191.30
52.49.174.4
54.208.220.65
54.72.143.148
006a6ea4b26c9ba860c5b3d38300121dbd4206a14ab34c7ea75920917e735924
027f868c27e71b12c7889438fb9e0667d02e718de70b3a2cfa033f926014cf5f
0b93f34e313afaab968e455f5076e8f6f89826c3c5512a699052d2a2c9ae39ee
0c9cf152a0ad00d4f102c93c613c104914be5517ac8f8e0831727f8bfbe8b300
0d430826d874dbcb979adf42923f152d80f48dd19620cc80d5000ae7151320af
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
13358f681f05b2514b9d6675a98746d6b5bde5902e7c9b4320e831475be2e6b3
13e8b4f6220702a10a7566fb389055fedd388a364975146c8d2780c1d2fdc0d0
14f2ec002b176e0dee403cb7dd4ef2274a1353080e1e3e4084678770f4c15b9c
175e2018415e3e13c7a1a5aa5ad67ca4e0bf754489bbf35d2eeb647bcff4bf04
19714b127696958ae4ba21a02028b0ae5590727c08cd0658ada679ee61b0e1f1
19c5e9311f01192e728f41452623bc3a10d346f15fcc5bc0a65437e0924ac60a
214ff94d4efa3c6185963226140a1eb170ab545745fb8e004d05ac35dba3c7ca
2172c955759308c9a6154a722206b67f560ef21d676bf90b935fa319149fd220
294840000d67201b47826d376baf6f71934e2e42cb528c6cd3951e982f253d7a
30153b15b4cb898c421e657f6de21dc27435cb990e7888367bdee12e06398da7
30972fb95f829194cacd1d1fb501d11c00c0579dc6695b5c2f5d353f055b188f
3f01cb4e8bb564dfe1d558ba77bf9cda1712b8378f4c25223c44967ae8d5ea04
40fb3eeda8592e67aeeb12842fc37783d5d4eb94cd15efe6f352746a437d5dab
42da5645360f8148bbba20cf35c8be5fa929deac9d43062fd3b580827ce2a51a
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
4b53f08f7590c8e4a7b3eb6fcb2b0ac5a9181be7abee162852926354b8c0f80f
4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef
4be6c7e5d3bd1b8be7e361c1a62916d05d4d0983e75a4dcf642f39515301e568
4c6804dfa6056409d98a46f02c6a5ed85274de407a82b2f85ccc8f2a84ec0350
4e39dd1af2ab89316460668ebbd994841c3d9aaa9e1ce6d428b040dc73ac8cc4
4ff1b9b91db584b19d20b4d02af9ff7673add161ce3f9ceae9391b3a84fddab1
52cac1193a3683e35353723a38e01a9bcc0c5f9bf2be42d29c96905527c7923d
555e53432e4eb7e193a052fb036f5cc2ae6271b7db35284bee6c39b0c3019700
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3
56729e7995d1cd6e9b95ada3218cdf39fdd1260f452984614aa21c2862957c70
59cd7afa1fc8b7762fb5ae77a9c84278b96f3559d097274cd766bda573509dd6
5c665a75ce13001a0bb6cab3ee959b2f043a672b615876000f764c912649d3ed
5eb69e0427216540b3a0a4d2c89fc3f379d05183b99b9610674f59bc67287a36
60f9b992130b179601e0710bac4742708f71e8df9fad48da085119afa560a9ae
612db2a2600f293d1b46736ff124a109bf648b2be672a09c20667a0d9e30049f
61d28bc1bcbc314992f87b4d9621d18e0b19023df08da72c8aed439960ddad38
653f3e53e89b4f8548ff86c19e92bb3c6b84b6be7485a320b1e00893ed877479
6581ee4496126d377cbfe5ad3ad5071375819734c74627b04553de1a21634846
6b5463d352f4d61ca0a83a5bcbed6730584b8c3a9feb484a0efaac3274ff7383
71ac37de282d0cb7de1bf96599c89a77d629d83caa484ca83d28e5a4e4fbea38
7aaf4727a2b360e8504f0d6d610dcacaee9def6b26adb81756128a25fd462ff3
7b3f1146eba0161356d2d242fec06fd9acb855370625d239049f3f78be05cca3
7bf1624c6024a48f6450cd459ac77da54ae016cb2ba28924fcab8f0c48508bc8
7d357b0ef1f85ba71c5ccebb6671b0c34f4b3950f5b21d2af7b4a3d4e9dcd570
7f7e6e995618480710459b924bae8c1fee53d4f6ccc5d0f99d2f41a7341acf76
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
834cbb09fbd02ceb95df6571cd540d58c2f2a548b106d3d9894db49decb372b4
83735bbc6ef3247fa656770e5ba56b2732b1d019c43be56b3a26759d3f1ae663
84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80
8f0ccb8dd15faf5ebd5bcff663110e44359c7d6b98212e5ee622d71506360991
94cbf8df2b2906ef77b877956ba4cb69733b278c2a47033a2ff871a99b8c24e2
962c32a355320866fa85bdd86784d2449e7de92f6f8461756cc19895bc07ea5e
97f058586c1d1b08be01ab989c2fe48c6d45a1bbe853b286593cdebf98907cd0
9938e85f4bedde3746f7c9e2f25b743089cc76f07dfa317952bc74174cb36604
9afdb26f17db42d21b1df16c21e4c02ce515a2c2d2ac5140c4ca0e14e473a577
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7
a1925038db769477ab74b4df34350c35688a795bb718727b0f4292a4a78a6210
a1ecbaed793a1f564c49c671f2dd0ce36f858534ef6d26b55783a06b884cc506
a5fd29825a3a6628167de0ec1327b5ea216a37dee9a3b4d7244aa70c0d277854
a63540aa2a97c549fe93e0aac747a34467cd51b2fb36c4d10c4a318eff39c213
acc511874f10d5992ff14cf84460bcd84a47abad64b2be1f23d35f4d983a13e7
aec60bc104db041b1512185839f18f52986df7e569e5445f740dd60f763fbca8
b16fe961cf29b0f3ae5fb03f2426cd852f26cfec71d69ebd4f920ac1bf10e5d1
b2864c65b32cd25bf64a7eb4fddf486dff821f1924172a0083db962615bd6ce0
b611d3aad8a93ae6586e482983ea4ff27567669f1da4374b0cc43ca2abc63c61
b986d774c858e94ecb4cd87d7a43e08cbdde1b0896e047f52c0ad07ffa6be4ac
bd4be36ffb93797f8742028deb9576191aebb0c45b8987fd28a893e816eada9f
c12c4757b7dd52cc5c369e032bdbcc7896b8d0b81731a51d386583c8a55973ac
cca8ce472cbf8c44acf7ac24067c2d6075acd1e0cd4c9003de6055289ac5c68a
d7e9852ce9f4cf46a09a3dad29bf1717367aabc3c2fa76439e1255f1b7618d70
dac715f087720dd7ff7067f5d2ec1988851fa93140ae8a9cbfaa15659dd7fd82
de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af
dfff48fba10c55918711c4bc2868154379f6348c7facdcefca870d512877cc11
e2fbb88b4d15a9f7702ca58ebbe8d1d927ffd2667e585e70a5f3d51acb1a37d2
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e464599709cada66bc11f679a0d10f56c7bd9229e2d745c27a0d6ec47b921734
e4dcf70f2995405028b82c072cca0dfc3bd89595677e84248174239a417fbe59
e64954dc34e12c7190cc2338a54b07644ff0f102aa71cc7209bcbb49c3009f7c
e86f7686f9ed6a53e17a3b99796d79ca19a1478349004210abd3db4f170bdcc8
e8b95def8b00f37d671c6a8a017f7946eeae0c084d896f95b9418feef64a0a4b
ec36c7249716fc660c847484fe53adc360c7dbc6d8f5b93446a518a4e4c0bb49
ece9461b67448fd9efc75ad4bbf3c6a2f0d0aea477046e8822068aee283160d6
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f2d6f3a3ec74da2472b0bc0965ca7580bb52503ebb824178e9b15a60eef8ac90
f7dab0061921848e572d8389f8bedb735dcfed05b4c3baef528d43284f16c190

usa.kaspersky.com Open in urlscan Pro 185.85.15.47 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

125 Requests

94 %HTTPS

38 %IPv6

29 Domains

44 Subdomains

39 IPs

7 Countries

2076 kBTransfer

6624 kBSize

59 Cookies

58 Outgoing links

Redirected requests

125 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

usa.kaspersky.com Open in urlscan Pro
185.85.15.47 Public Scan

Screenshot
Live screenshot

Full Image

125
Requests

94 %
HTTPS

38 %
IPv6

29
Domains

44
Subdomains

39
IPs

7
Countries

2076 kB
Transfer

6624 kB
Size

59
Cookies

125 HTTP transactions
0 data transactions