research.nccgroup.com Open in urlscan Pro
192.0.78.199 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://research.nccgroup.com/2022/08/19/back-in-black-unlocking-a-lockbit-3-0-ransomware-attack/
Submission: On January 24 via manual (January 24th 2024, 3:13:33 pm UTC) from IN — Scanned from DE

Summary HTTP 56 Redirects Links 12 Behaviour Indicators

Summary

This website contacted 12 IPs in 2 countries across 7 domains to perform 56 HTTP transactions. The main IP is 192.0.78.199, located in San Francisco, United States and belongs to AUTOMATTIC, US. The main domain is research.nccgroup.com.
TLS certificate: Issued by R3 on January 2nd 2024. Valid for: 3 months.

This is the only time research.nccgroup.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
25	192.0.78.199 192.0.78.199	2635 (AUTOMATTIC) (AUTOMATTIC)
2	192.0.77.37 192.0.77.37	2635 (AUTOMATTIC) (AUTOMATTIC)
2	2606:4700::68... 2606:4700::6810:5514	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	192.0.77.2 192.0.77.2	2635 (AUTOMATTIC) (AUTOMATTIC)
10	192.0.77.32 192.0.77.32	2635 (AUTOMATTIC) (AUTOMATTIC)
1	2606:4700:440... 2606:4700:4400::ac40:93bc	13335 (CLOUDFLAR...) (CLOUDFLARENET)
3	192.0.76.3 192.0.76.3	2635 (AUTOMATTIC) (AUTOMATTIC)
2	2a00:1450:400... 2a00:1450:4001:82a::200a	15169 (GOOGLE) (GOOGLE)
4	2a00:1450:400... 2a00:1450:4001:813::2003	15169 (GOOGLE) (GOOGLE)
5	2606:4700:e6:... 2606:4700:e6::ac40:cd14	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	192.0.78.23 192.0.78.23	2635 (AUTOMATTIC) (AUTOMATTIC)
56	12

25 192.0.78.199 (San Francisco, United States)

ASN2635 (AUTOMATTIC, US)

research.nccgroup.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 192.0.77.37 (San Francisco, United States)

ASN2635 (AUTOMATTIC, US)
PTR: wordpress.com

c0.wp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700::6810:5514 (United States)

ASN13335 (CLOUDFLARENET, US)

cdn.jsdelivr.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 192.0.77.2 (San Francisco, United States)

ASN2635 (AUTOMATTIC, US)
PTR: i1.wp.com

i0.wp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 192.0.77.32 (San Francisco, United States)

ASN2635 (AUTOMATTIC, US)
PTR: wordpress.com

s0.wp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
fonts-api.wp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
fonts.wp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
widgets.wp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:4400::ac40:93bc (United States)

ASN13335 (CLOUDFLARENET, US)

kit.fontawesome.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 192.0.76.3 (San Francisco, United States)

ASN2635 (AUTOMATTIC, US)

stats.wp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
pixel.wp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:82a::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:813::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2606:4700:e6::ac40:cd14 (United States)

ASN13335 (CLOUDFLARENET, US)

ka-f.fontawesome.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 192.0.78.23 (San Francisco, United States)

ASN2635 (AUTOMATTIC, US)

public-api.wordpress.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
25	nccgroup.com research.nccgroup.com	577 KB
16	wp.com c0.wp.com — Cisco Umbrella Rank: 8666 i0.wp.com — Cisco Umbrella Rank: 3696 s0.wp.com — Cisco Umbrella Rank: 8186 stats.wp.com — Cisco Umbrella Rank: 2723 fonts-api.wp.com — Cisco Umbrella Rank: 16464 fonts.wp.com — Cisco Umbrella Rank: 17444 widgets.wp.com — Cisco Umbrella Rank: 11869 pixel.wp.com — Cisco Umbrella Rank: 2679	392 KB
6	fontawesome.com kit.fontawesome.com — Cisco Umbrella Rank: 1448 ka-f.fontawesome.com — Cisco Umbrella Rank: 3140	188 KB
4	gstatic.com fonts.gstatic.com	165 KB
2	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 28	2 KB
2	jsdelivr.net cdn.jsdelivr.net — Cisco Umbrella Rank: 324	9 KB
1	wordpress.com public-api.wordpress.com — Cisco Umbrella Rank: 9533	4 KB
56	7

	Domain	Requested by
25	research.nccgroup.com	research.nccgroup.com
5	ka-f.fontawesome.com	kit.fontawesome.com research.nccgroup.com
4	fonts.wp.com	fonts-api.wp.com
4	fonts.gstatic.com	fonts.googleapis.com
4	s0.wp.com	research.nccgroup.com widgets.wp.com public-api.wordpress.com
2	pixel.wp.com	research.nccgroup.com
2	fonts.googleapis.com	research.nccgroup.com
2	cdn.jsdelivr.net	research.nccgroup.com cdn.jsdelivr.net
2	c0.wp.com	research.nccgroup.com
1	public-api.wordpress.com	s0.wp.com
1	widgets.wp.com	research.nccgroup.com
1	fonts-api.wp.com	research.nccgroup.com
1	stats.wp.com	research.nccgroup.com
1	kit.fontawesome.com	research.nccgroup.com
1	i0.wp.com	research.nccgroup.com
56	15

This site contains links to these domains. Also see Links.

Domain
www.nccgroup.com
www.twitter.com
i0.wp.com
www.bleepingcomputer.com
github.com
www.linkedin.com
www.instagram.com
twitter.com

Subject Issuer	Validity	Valid
tls.automattic.com R3	`2024-01-02` - `2024-04-01`	3 months	crt.sh
*.wp.com Sectigo ECC Domain Validation Secure Server CA	`2023-11-28` - `2024-12-28`	a year	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2023-05-02` - `2024-05-01`	a year	crt.sh
*.fontawesome.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-12-04` - `2025-01-03`	a year	crt.sh
upload.video.google.com GTS CA 1C3	`2024-01-02` - `2024-03-26`	3 months	crt.sh
*.gstatic.com GTS CA 1C3	`2024-01-02` - `2024-03-26`	3 months	crt.sh
ka-f.fontawesome.com GTS CA 1P5	`2024-01-06` - `2024-04-05`	3 months	crt.sh
*.wordpress.com Sectigo ECC Domain Validation Secure Server CA	`2023-12-05` - `2025-01-04`	a year	crt.sh

This page contains 3 frames:

Primary Page: https://research.nccgroup.com/2022/08/19/back-in-black-unlocking-a-lockbit-3-0-ransomware-attack/
Frame ID: D700295D4403D79BD3A655DBBF7DD685
Requests: 52 HTTP requests in this frame

Frame: https://widgets.wp.com/likes/master.html?ver=20240124
Frame ID: 1AF8E5742BB76AC34F8961DCE8CF331C
Requests: 3 HTTP requests in this frame

Frame: https://public-api.wordpress.com/wp-admin/rest-proxy/
Frame ID: 52F4913DA7A52FBC9CD0C9B56AFFC5A1
Requests: 2 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Back in Black: Unlocking a LockBit 3.0 Ransomware Attack | NCC Group Research Blog | Making the world safer and more secure

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

<link rel=["']stylesheet["'] [^>]+/wp-(?:content|includes)/
<link[^>]+s\d+\.wp\.com
/wp-(?:content|includes)/

Font Awesome (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
kit\.fontawesome\.com/([0-9a-z]+).js

Swiper Slider (Miscellaneous) Expand

Overall confidence: 100%
Detected patterns

swiper(?:\.min)?\.js

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

jsDelivr (CDN) Expand

Overall confidence: 100%
Detected patterns

//cdn\.jsdelivr\.net/

Page Statistics

56
Requests

100 %
HTTPS

45 %
IPv6

7
Domains

15
Subdomains

12
IPs

2
Countries

1344 kB
Transfer

2900 kB
Size

0
Cookies

12 Outgoing links

These are links going to different origins than the main page.

URL: https://www.nccgroup.com/
Title: nccgroup.com

Search URL Search Domain Scan URL

URL: https://www.nccgroup.com/us/cyber-incident-response/
Title: Support

Search URL Search Domain Scan URL

URL: https://www.nccgroup.com/us/contact-us/
Title: Contact

Search URL Search Domain Scan URL

URL: https://www.twitter.com/rdi_x64
Title: @rdi_x64

Search URL Search Domain Scan URL

URL: https://www.nccgroup.com/uk/cyber-incident-response/
Title: Incident Response – NCC Group

Search URL Search Domain Scan URL

URL: https://i0.wp.com/research.nccgroup.com/wp-content/uploads/2023/04/image-1-4.png?ssl=1

Search URL Search Domain Scan URL

URL: https://www.bleepingcomputer.com/news/security/conti-ransomware-finally-shuts-down-data-leak-negotiation-sites/
Title: https://www.bleepingcomputer.com/news/security/conti-ransomware-finally-shuts-down-data-leak-negotiation-sites/

Search URL Search Domain Scan URL

URL: https://github.com/GhostPack/Seatbelt
Title: https://github.com/GhostPack/Seatbelt

Search URL Search Domain Scan URL

URL: https://www.nccgroup.com/uk/contact-us/
Title: Get in touch

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/company/ncc-group/

Search URL Search Domain Scan URL

URL: https://www.instagram.com/lifeatnccgroup/

Search URL Search Domain Scan URL

URL: https://twitter.com/NCCGroupInfosec

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

56 HTTP transactions
1 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
research.nccgroup.com/2022/08/19/back-in-black-unlocking-a-lockbit-3-0-ransomware-attack/ 757 KB
88 KB 367ms
233ms Document
text/html 192.0.78.199
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://research.nccgroup.com/2022/08/19/back-in-black-unlocking-a-lockbit-3-0-ransomware-attack/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.78.199 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

cd1b25d7b70da44c4423d64b0f1e8cccbed8cdad41ab300c8b72eca0f0e1cbac

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400
cache-control: max-age=168, must-revalidate
content-encoding: br
content-type: text/html; charset=UTF-8
date: Wed, 24 Jan 2024 15:13:26 GMT
host-header: WordPress.com
last-modified: Wed, 24 Jan 2024 15:11:14 GMT
link: <https://wp.me/pbnf4R-6r6>; rel=shortlink
server: nginx
strict-transport-security: max-age=31536000
vary: Accept-Encoding Cookie
x-ac: 2.hhn _atomic_ams BYPASS
x-hacker: Want root? Visit join.a8c.com and mention this header.
x-nananana: Batcache-Hit

GET
H2 200 style.css
research.nccgroup.com/wp-content/plugins/gutenberg/build/block-library/ 110 KB
15 KB 214ms
213ms Stylesheet
text/css 192.0.78.199
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://research.nccgroup.com/wp-content/plugins/gutenberg/build/block-library/style.css

Requested by

Host: research.nccgroup.com
URL: https://research.nccgroup.com/2022/08/19/back-in-black-unlocking-a-lockbit-3-0-ransomware-attack/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.78.199 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

e04e7d913ec3268951f4e1c923499eb347070a78cb0ca99a454d8c7d373acc54

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://research.nccgroup.com/2022/08/19/back-in-black-unlocking-a-lockbit-3-0-ransomware-attack/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Wed, 24 Jan 2024 15:13:26 GMT
strict-transport-security: max-age=31536000
content-encoding: br
last-modified: Wed, 17 Jan 2024 12:56:36 GMT
server: nginx
x-ac: 2.hhn _atomic_ams BYPASS
etag: W/"65a7ce84-1b99f"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=604800
alt-svc: h3=":443"; ma=86400
expires: Wed, 31 Jan 2024 15:13:26 GMT

GET
H2 200 style.css
research.nccgroup.com/wp-content/plugins/layout-grid/ 58 KB
3 KB 206ms
204ms Stylesheet
text/css 192.0.78.199
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://research.nccgroup.com/wp-content/plugins/layout-grid/style.css

Requested by

Host: research.nccgroup.com
URL: https://research.nccgroup.com/2022/08/19/back-in-black-unlocking-a-lockbit-3-0-ransomware-attack/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.78.199 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

4ff079893cbfe8eebd0d49b7c8bcbeba131173b3e0da0e13210ad611869e0e36

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://research.nccgroup.com/2022/08/19/back-in-black-unlocking-a-lockbit-3-0-ransomware-attack/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Wed, 24 Jan 2024 15:13:26 GMT
strict-transport-security: max-age=31536000
content-encoding: br
last-modified: Wed, 26 Jan 2022 12:47:22 GMT
server: nginx
x-ac: 2.hhn _atomic_ams BYPASS
etag: W/"61f142da-e64d"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=604800
alt-svc: h3=":443"; ma=86400
expires: Wed, 31 Jan 2024 15:13:26 GMT

GET
H2 200 mediaelementplayer-legacy.min.css
c0.wp.com/c/6.4.2/wp-includes/js/mediaelement/ 11 KB
3 KB 134ms
39ms Stylesheet
text/css 192.0.77.37
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://c0.wp.com/c/6.4.2/wp-includes/js/mediaelement/mediaelementplayer-legacy.min.css

Requested by

Host: research.nccgroup.com
URL: https://research.nccgroup.com/2022/08/19/back-in-black-unlocking-a-lockbit-3-0-ransomware-attack/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.37 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

b7908a015a567ec2363011df2475368dbff34360e9da3fdff50604d6395fb646

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://research.nccgroup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

x-nc: HIT hhn 2
date: Wed, 24 Jan 2024 15:13:26 GMT
content-encoding: br
strict-transport-security: max-age=15552000
last-modified: Tue, 29 Sep 2020 15:53:06 GMT
server: nginx
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=31536000
timing-allow-origin: *
alt-svc: h3=":443"; ma=86400, h3=":443"; ma=86400
expires: Thu, 23 Jan 2025 15:13:26 GMT

GET
H2 200 wp-mediaelement.min.css
c0.wp.com/c/6.4.2/wp-includes/js/mediaelement/ 4 KB
1 KB 134ms
39ms Stylesheet
text/css 192.0.77.37
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://c0.wp.com/c/6.4.2/wp-includes/js/mediaelement/wp-mediaelement.min.css

Requested by

Host: research.nccgroup.com
URL: https://research.nccgroup.com/2022/08/19/back-in-black-unlocking-a-lockbit-3-0-ransomware-attack/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.37 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

2e10d353ff038c2cad3492fc17801af3e6ef2669c9e9713bdb78b1dcb104c4fe

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://research.nccgroup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

x-nc: HIT hhn 2
date: Wed, 24 Jan 2024 15:13:26 GMT
content-encoding: br
strict-transport-security: max-age=15552000
last-modified: Fri, 07 Jun 2019 20:45:02 GMT
server: nginx
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=31536000
timing-allow-origin: *
alt-svc: h3=":443"; ma=86400, h3=":443"; ma=86400
expires: Thu, 23 Jan 2025 15:13:26 GMT

GET
H2 200 style-coblocks-1.css
research.nccgroup.com/wp-content/plugins/coblocks/dist/ 264 KB
35 KB 218ms
216ms Stylesheet
text/css 192.0.78.199
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://research.nccgroup.com/wp-content/plugins/coblocks/dist/style-coblocks-1.css

Requested by

Host: research.nccgroup.com
URL: https://research.nccgroup.com/2022/08/19/back-in-black-unlocking-a-lockbit-3-0-ransomware-attack/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.78.199 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

eed4c6c84ba33aeebda2fdcbbd60a027f9a006f3623fb13f22a8971e02d32f30

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://research.nccgroup.com/2022/08/19/back-in-black-unlocking-a-lockbit-3-0-ransomware-attack/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Wed, 24 Jan 2024 15:13:26 GMT
strict-transport-security: max-age=31536000
content-encoding: br
last-modified: Mon, 06 Nov 2023 21:01:08 GMT
server: nginx
x-ac: 2.hhn _atomic_ams BYPASS
etag: W/"65495414-41f0b"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=604800
alt-svc: h3=":443"; ma=86400
expires: Wed, 31 Jan 2024 15:13:26 GMT

GET
H2 200 style-coblocks-extensions.css
research.nccgroup.com/wp-content/plugins/coblocks/dist/ 2 KB
656 B 207ms
206ms Stylesheet
text/css 192.0.78.199
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://research.nccgroup.com/wp-content/plugins/coblocks/dist/style-coblocks-extensions.css

Requested by

Host: research.nccgroup.com
URL: https://research.nccgroup.com/2022/08/19/back-in-black-unlocking-a-lockbit-3-0-ransomware-attack/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.78.199 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

9c197c685d1cfde9e68e198bd0c023f58202efd10e5991a58aeacb01db67f844

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://research.nccgroup.com/2022/08/19/back-in-black-unlocking-a-lockbit-3-0-ransomware-attack/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Wed, 24 Jan 2024 15:13:26 GMT
strict-transport-security: max-age=31536000
content-encoding: br
last-modified: Tue, 28 Mar 2023 01:18:34 GMT
server: nginx
x-ac: 2.hhn _atomic_ams BYPASS
etag: W/"6422406a-695"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=604800
alt-svc: h3=":443"; ma=86400
expires: Wed, 31 Jan 2024 15:13:26 GMT

GET
H2 200 style-coblocks-animation.css
research.nccgroup.com/wp-content/plugins/coblocks/dist/ 4 KB
1 KB 206ms
205ms Stylesheet
text/css 192.0.78.199
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://research.nccgroup.com/wp-content/plugins/coblocks/dist/style-coblocks-animation.css

Requested by

Host: research.nccgroup.com
URL: https://research.nccgroup.com/2022/08/19/back-in-black-unlocking-a-lockbit-3-0-ransomware-attack/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.78.199 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

559a8fa7fa5cb693bd3cf92d8992623527db2a54a97d86e02b998a46ad90351d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://research.nccgroup.com/2022/08/19/back-in-black-unlocking-a-lockbit-3-0-ransomware-attack/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Wed, 24 Jan 2024 15:13:26 GMT
strict-transport-security: max-age=31536000
content-encoding: br
last-modified: Mon, 06 Nov 2023 21:01:08 GMT
server: nginx
x-ac: 2.hhn _atomic_ams BYPASS
etag: W/"65495414-10e8"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=604800
alt-svc: h3=":443"; ma=86400
expires: Wed, 31 Jan 2024 15:13:26 GMT

GET
H2 200 owl-carousel.css
research.nccgroup.com/wp-content/themes/ncc-blog/resources/owl-carousel/ 4 KB
1 KB 362ms
361ms Stylesheet
text/css 192.0.78.199
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://research.nccgroup.com/wp-content/themes/ncc-blog/resources/owl-carousel/owl-carousel.css

Requested by

Host: research.nccgroup.com
URL: https://research.nccgroup.com/2022/08/19/back-in-black-unlocking-a-lockbit-3-0-ransomware-attack/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.78.199 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

bd7f27f6a69ec7e919c3c51dbf85c185a2e38b482af4084593704ed0bca40930

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://research.nccgroup.com/2022/08/19/back-in-black-unlocking-a-lockbit-3-0-ransomware-attack/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Wed, 24 Jan 2024 15:13:27 GMT
strict-transport-security: max-age=31536000
content-encoding: br
last-modified: Mon, 27 Mar 2023 12:39:30 GMT
server: nginx
x-ac: 2.hhn _atomic_ams BYPASS
etag: W/"64218e82-e09"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=604800
alt-svc: h3=":443"; ma=86400
expires: Wed, 31 Jan 2024 15:13:27 GMT

GET
H2 200 aos.css
research.nccgroup.com/wp-content/themes/ncc-blog/resources/aos/ 25 KB
2 KB 204ms
203ms Stylesheet
text/css 192.0.78.199
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://research.nccgroup.com/wp-content/themes/ncc-blog/resources/aos/aos.css

Requested by

Host: research.nccgroup.com
URL: https://research.nccgroup.com/2022/08/19/back-in-black-unlocking-a-lockbit-3-0-ransomware-attack/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.78.199 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

731681671ddee142213a3242e4a6d3444aeae1c4f7e0630847903dab12922398

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://research.nccgroup.com/2022/08/19/back-in-black-unlocking-a-lockbit-3-0-ransomware-attack/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Wed, 24 Jan 2024 15:13:26 GMT
strict-transport-security: max-age=31536000
content-encoding: br
last-modified: Mon, 27 Mar 2023 12:39:30 GMT
server: nginx
x-ac: 2.hhn _atomic_ams BYPASS
etag: W/"64218e82-65c6"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=604800
alt-svc: h3=":443"; ma=86400
expires: Wed, 31 Jan 2024 15:13:26 GMT

GET
H2 200 main.css
research.nccgroup.com/wp-content/themes/ncc-blog/ 36 KB
7 KB 363ms
362ms Stylesheet
text/css 192.0.78.199
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://research.nccgroup.com/wp-content/themes/ncc-blog/main.css

Requested by

Host: research.nccgroup.com
URL: https://research.nccgroup.com/2022/08/19/back-in-black-unlocking-a-lockbit-3-0-ransomware-attack/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.78.199 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

fbf8f849b126b5226f0e1cc4ac77ad237766e603d825321dc1110ddc4c295862

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://research.nccgroup.com/2022/08/19/back-in-black-unlocking-a-lockbit-3-0-ransomware-attack/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Wed, 24 Jan 2024 15:13:27 GMT
strict-transport-security: max-age=31536000
content-encoding: br
last-modified: Wed, 03 May 2023 08:40:32 GMT
server: nginx
x-ac: 2.hhn _atomic_ams BYPASS
etag: W/"64521e00-904d"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=604800
alt-svc: h3=":443"; ma=86400
expires: Wed, 31 Jan 2024 15:13:27 GMT

GET
H2 200 social-logos.min.css
research.nccgroup.com/wp-content/plugins/jetpack/_inc/social-logos/ 13 KB
8 KB 207ms
207ms Stylesheet
text/css 192.0.78.199
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://research.nccgroup.com/wp-content/plugins/jetpack/_inc/social-logos/social-logos.min.css

Requested by

Host: research.nccgroup.com
URL: https://research.nccgroup.com/2022/08/19/back-in-black-unlocking-a-lockbit-3-0-ransomware-attack/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.78.199 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

8e974b6ae4f0e09293655569f14af299bd59572ce397d0f9546df10eb89b671d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://research.nccgroup.com/2022/08/19/back-in-black-unlocking-a-lockbit-3-0-ransomware-attack/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Wed, 24 Jan 2024 15:13:26 GMT
strict-transport-security: max-age=31536000
content-encoding: br
last-modified: Tue, 26 Dec 2023 12:52:02 GMT
server: nginx
x-ac: 2.hhn _atomic_ams BYPASS
etag: W/"658acc72-3212"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=604800
alt-svc: h3=":443"; ma=86400
expires: Wed, 31 Jan 2024 15:13:26 GMT

GET
H2 200 jetpack.css
research.nccgroup.com/wp-content/plugins/jetpack/css/ 99 KB
19 KB 209ms
208ms Stylesheet
text/css 192.0.78.199
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://research.nccgroup.com/wp-content/plugins/jetpack/css/jetpack.css

Requested by

Host: research.nccgroup.com
URL: https://research.nccgroup.com/2022/08/19/back-in-black-unlocking-a-lockbit-3-0-ransomware-attack/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.78.199 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

d3da67f9a0b5c6854f83c013c4381d9d3b3434351a39b8a017aec61e681ee460

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://research.nccgroup.com/2022/08/19/back-in-black-unlocking-a-lockbit-3-0-ransomware-attack/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Wed, 24 Jan 2024 15:13:26 GMT
strict-transport-security: max-age=31536000
content-encoding: br
last-modified: Mon, 15 Jan 2024 18:54:22 GMT
server: nginx
x-ac: 2.hhn _atomic_ams BYPASS
etag: W/"65a57f5e-18d2f"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=604800
alt-svc: h3=":443"; ma=86400
expires: Wed, 31 Jan 2024 15:13:26 GMT

GET
H2 200 run_prettify.js Show response
cdn.jsdelivr.net/gh/google/code-prettify@master/loader/ 18 KB
9 KB 140ms
54ms Script
application/javascript 2606:4700::6810:5514
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/gh/google/code-prettify@master/loader/run_prettify.js

Requested by

Host: research.nccgroup.com
URL: https://research.nccgroup.com/2022/08/19/back-in-black-unlocking-a-lockbit-3-0-ransomware-attack/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:5514 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7285646ea1d6480a26b5c3d66f75edac636a664b9ef84bbd5fb63122065bb668

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://research.nccgroup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Wed, 24 Jan 2024 15:13:26 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 19839
x-jsd-version: master
content-encoding: br
x-cache: HIT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
x-served-by: cache-fra-eddf8230065-FRA
x-jsd-version-type: branch
server: cloudflare
etag: W/"480b-TyrgZ46CV/5URLUGkuqmgyGFFkY"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=YXei1KgRAhaXZGyENZfDGhSBSX5EhvlOeaJOEmz4slpoa%2F%2FhkyiUVJ9xlk65UM0J69FoOKrWg8E7IwdqsVeqKrl5bPPy%2FmZTXtINtO1KeYE8uOl%2FOdLvoMgC9aSAjyYH0WIm0%2BTa8jiv%2F0sHTnw%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=604800, s-maxage=43200
timing-allow-origin: *
cf-ray: 84a9386f0e062c52-FRA

GET
H3 200 webfont.js Show response
research.nccgroup.com/wp-content/mu-plugins/wpcomsh/vendor/automattic/custom-fonts/js/ 12 KB
5 KB 207ms
206ms Script
application/javascript 192.0.78.199
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://research.nccgroup.com/wp-content/mu-plugins/wpcomsh/vendor/automattic/custom-fonts/js/webfont.js

Requested by

Host: research.nccgroup.com
URL: https://research.nccgroup.com/2022/08/19/back-in-black-unlocking-a-lockbit-3-0-ransomware-attack/

Protocol

Security

QUIC, , AES_128_GCM

Server

192.0.78.199 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

c4ed980116c12325b30c81ef2bf6e2284ba2242b57d7c2ee4867278fd078dcae

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://research.nccgroup.com/2022/08/19/back-in-black-unlocking-a-lockbit-3-0-ransomware-attack/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Wed, 24 Jan 2024 15:13:27 GMT
strict-transport-security: max-age=31536000
content-encoding: br
last-modified: Wed, 24 Jan 2024 08:32:31 GMT
server: nginx
x-ac: 2.hhn _atomic_ams BYPASS
etag: W/"65b0cb1f-30cd"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=604800
alt-svc: h3=":443"; ma=86400
expires: Wed, 31 Jan 2024 15:13:27 GMT

GET
H2 200 image-1-4.png
i0.wp.com/research.nccgroup.com/wp-content/uploads/2023/04/ 189 KB
190 KB 134ms
40ms Image
image/webp 192.0.77.2
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://i0.wp.com/research.nccgroup.com/wp-content/uploads/2023/04/image-1-4.png?ssl=1

Requested by

Host: research.nccgroup.com
URL: https://research.nccgroup.com/2022/08/19/back-in-black-unlocking-a-lockbit-3-0-ransomware-attack/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

i1.wp.com

Software

nginx /

Resource Hash

58ef81613a90fc2af22b15e8819fde36ca0d84ec40c4f7577a32e0781d2fc3b3

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://research.nccgroup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Wed, 24 Jan 2024 15:13:26 GMT
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
content-length: 193722
x-nc: HIT hhn 1
last-modified: Wed, 29 Nov 2023 02:28:01 GMT
server: nginx
etag: "1ff7d65177855e89"
vary: Accept
access-control-allow-methods: GET, HEAD
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=63115200
timing-allow-origin: *
link: <https://research.nccgroup.com/wp-content/uploads/2023/04/image-1-4.png>; rel="canonical"
expires: Fri, 28 Nov 2025 14:28:01 GMT

GET
H2 200 bilmur.min.js Show response
s0.wp.com/wp-content/js/ 6 KB
3 KB 136ms
39ms Script
application/javascript 192.0.77.32
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://s0.wp.com/wp-content/js/bilmur.min.js?m=202404
Requested by: Host: research.nccgroup.com
URL: https://research.nccgroup.com/2022/08/19/back-in-black-unlocking-a-lockbit-3-0-ransomware-attack/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS: wordpress.com
Software: nginx /
Resource Hash: 216728e33a7de4be9b784eff527c6ccf1658319ea78fe66a7864c0b923200252

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://research.nccgroup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

x-nc: HIT hhn 2
date: Wed, 24 Jan 2024 15:13:27 GMT
content-encoding: br
x-ac: 2.hhn _dfw MISS
last-modified: Wed, 15 Nov 2023 17:05:24 GMT
server: nginx
etag: W/"6554fa54-161b"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=31536000
timing-allow-origin: *
alt-svc: h3=":443"; ma=86400, h3=":443"; ma=86400
expires: Tue, 21 Jan 2025 00:00:01 GMT

GET
H2 200 image-cdn.js Show response
research.nccgroup.com/wp-content/plugins/jetpack/jetpack_vendor/automattic/jetpack-image-cdn/dist/ 701 B
693 B 366ms
359ms Script
application/javascript 192.0.78.199
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://research.nccgroup.com/wp-content/plugins/jetpack/jetpack_vendor/automattic/jetpack-image-cdn/dist/image-cdn.js?minify=false

Requested by

Host: research.nccgroup.com
URL: https://research.nccgroup.com/2022/08/19/back-in-black-unlocking-a-lockbit-3-0-ransomware-attack/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.78.199 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

27dd9b075cc59cf5f3c0f6ee075f4bd113782d81ce30a4f16aac669ecfdc4fa2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://research.nccgroup.com/2022/08/19/back-in-black-unlocking-a-lockbit-3-0-ransomware-attack/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Wed, 24 Jan 2024 15:13:27 GMT
strict-transport-security: max-age=31536000
content-encoding: br
last-modified: Mon, 08 May 2023 16:57:46 GMT
server: nginx
x-ac: 2.hhn _atomic_ams BYPASS
etag: W/"64592a0a-2bd"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=315360000
alt-svc: h3=":443"; ma=86400
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H3 200 coblocks-animation.js Show response
research.nccgroup.com/wp-content/plugins/coblocks/dist/js/ 412 B
726 B 204ms
204ms Script
application/javascript 192.0.78.199
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://research.nccgroup.com/wp-content/plugins/coblocks/dist/js/coblocks-animation.js

Requested by

Host: research.nccgroup.com
URL: https://research.nccgroup.com/2022/08/19/back-in-black-unlocking-a-lockbit-3-0-ransomware-attack/

Protocol

Security

QUIC, , AES_128_GCM

Server

192.0.78.199 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

a2c1967d4bc375b190863aabb8bb22a2da4ec5461f8dfd8add4987e3687a26ed

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://research.nccgroup.com/2022/08/19/back-in-black-unlocking-a-lockbit-3-0-ransomware-attack/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Wed, 24 Jan 2024 15:13:27 GMT
strict-transport-security: max-age=31536000
x-ac: 2.hhn _atomic_ams BYPASS
last-modified: Mon, 06 Nov 2023 21:01:08 GMT
server: nginx
etag: "65495414-19c"
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=604800
accept-ranges: bytes
alt-svc: h3=":443"; ma=86400
content-length: 412
expires: Wed, 31 Jan 2024 15:13:27 GMT

GET
H3 200 tiny-swiper.js Show response
research.nccgroup.com/wp-content/plugins/coblocks/dist/js/vendors/ 10 KB
5 KB 207ms
207ms Script
application/javascript 192.0.78.199
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://research.nccgroup.com/wp-content/plugins/coblocks/dist/js/vendors/tiny-swiper.js

Requested by

Host: research.nccgroup.com
URL: https://research.nccgroup.com/2022/08/19/back-in-black-unlocking-a-lockbit-3-0-ransomware-attack/

Protocol

Security

QUIC, , AES_128_GCM

Server

192.0.78.199 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

1882608f84e795b684548d2f468653fd68c50b3a8dbb3b63a28537112222a208

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://research.nccgroup.com/2022/08/19/back-in-black-unlocking-a-lockbit-3-0-ransomware-attack/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Wed, 24 Jan 2024 15:13:27 GMT
strict-transport-security: max-age=31536000
content-encoding: br
last-modified: Mon, 06 Nov 2023 21:01:08 GMT
server: nginx
x-ac: 2.hhn _atomic_ams BYPASS
etag: W/"65495414-290b"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=604800
alt-svc: h3=":443"; ma=86400
expires: Wed, 31 Jan 2024 15:13:27 GMT

GET
H3 200 coblocks-tinyswiper-initializer.js Show response
research.nccgroup.com/wp-content/plugins/coblocks/dist/js/ 14 KB
6 KB 212ms
212ms Script
application/javascript 192.0.78.199
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://research.nccgroup.com/wp-content/plugins/coblocks/dist/js/coblocks-tinyswiper-initializer.js

Requested by

Host: research.nccgroup.com
URL: https://research.nccgroup.com/2022/08/19/back-in-black-unlocking-a-lockbit-3-0-ransomware-attack/

Protocol

Security

QUIC, , AES_128_GCM

Server

192.0.78.199 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

fc8c00f9c709b002856df234b920785bd69ba089627ab5197b65e4bea07fafe4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://research.nccgroup.com/2022/08/19/back-in-black-unlocking-a-lockbit-3-0-ransomware-attack/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Wed, 24 Jan 2024 15:13:27 GMT
strict-transport-security: max-age=31536000
content-encoding: br
last-modified: Mon, 06 Nov 2023 21:01:08 GMT
server: nginx
x-ac: 2.hhn _atomic_ams BYPASS
etag: W/"65495414-3862"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=604800
alt-svc: h3=":443"; ma=86400
expires: Wed, 31 Jan 2024 15:13:27 GMT

GET
H3 200 jquery.js Show response
research.nccgroup.com/wp-content/themes/ncc-blog/resources/ 86 KB
31 KB 210ms
209ms Script
application/javascript 192.0.78.199
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://research.nccgroup.com/wp-content/themes/ncc-blog/resources/jquery.js

Requested by

Host: research.nccgroup.com
URL: https://research.nccgroup.com/2022/08/19/back-in-black-unlocking-a-lockbit-3-0-ransomware-attack/

Protocol

Security

QUIC, , AES_128_GCM

Server

192.0.78.199 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

4c24dfd28784ad2befb3dafaac6bf1ed4e7cd58cce713d9a0b228d426e812baf

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://research.nccgroup.com/2022/08/19/back-in-black-unlocking-a-lockbit-3-0-ransomware-attack/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Wed, 24 Jan 2024 15:13:27 GMT
strict-transport-security: max-age=31536000
content-encoding: br
last-modified: Mon, 27 Mar 2023 12:39:30 GMT
server: nginx
x-ac: 2.hhn _atomic_ams BYPASS
etag: W/"64218e82-15850"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=604800
alt-svc: h3=":443"; ma=86400
expires: Wed, 31 Jan 2024 15:13:27 GMT

GET
H3 200 owl-carousel.js Show response
research.nccgroup.com/wp-content/themes/ncc-blog/resources/owl-carousel/ 43 KB
12 KB 363ms
362ms Script
application/javascript 192.0.78.199
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://research.nccgroup.com/wp-content/themes/ncc-blog/resources/owl-carousel/owl-carousel.js

Requested by

Host: research.nccgroup.com
URL: https://research.nccgroup.com/2022/08/19/back-in-black-unlocking-a-lockbit-3-0-ransomware-attack/

Protocol

Security

QUIC, , AES_128_GCM

Server

192.0.78.199 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

554caf1eb82495c5dd63b74de2de86fac9ee78fbb3ec323add52654b5c932163

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://research.nccgroup.com/2022/08/19/back-in-black-unlocking-a-lockbit-3-0-ransomware-attack/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Wed, 24 Jan 2024 15:13:27 GMT
strict-transport-security: max-age=31536000
content-encoding: br
last-modified: Mon, 27 Mar 2023 12:39:30 GMT
server: nginx
x-ac: 2.hhn _atomic_ams BYPASS
etag: W/"64218e82-ac6f"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=604800
alt-svc: h3=":443"; ma=86400
expires: Wed, 31 Jan 2024 15:13:27 GMT

GET
H3 200 aos.js Show response
research.nccgroup.com/wp-content/themes/ncc-blog/resources/aos/ 16 KB
5 KB 204ms
203ms Script
application/javascript 192.0.78.199
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://research.nccgroup.com/wp-content/themes/ncc-blog/resources/aos/aos.js

Requested by

Host: research.nccgroup.com
URL: https://research.nccgroup.com/2022/08/19/back-in-black-unlocking-a-lockbit-3-0-ransomware-attack/

Protocol

Security

QUIC, , AES_128_GCM

Server

192.0.78.199 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

8ca6ce966eec195519e56f78877f489c0b248e1293271d66d821a6c7b004b605

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://research.nccgroup.com/2022/08/19/back-in-black-unlocking-a-lockbit-3-0-ransomware-attack/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Wed, 24 Jan 2024 15:13:27 GMT
strict-transport-security: max-age=31536000
content-encoding: br
last-modified: Mon, 27 Mar 2023 12:39:30 GMT
server: nginx
x-ac: 2.hhn _atomic_ams BYPASS
etag: W/"64218e82-3ff7"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=604800
alt-svc: h3=":443"; ma=86400
expires: Wed, 31 Jan 2024 15:13:27 GMT

GET
H2 200 2e07949954.js Show response
kit.fontawesome.com/ 12 KB
5 KB 583ms
497ms Script
text/javascript 2606:4700:4400::ac40:93bc
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://kit.fontawesome.com/2e07949954.js
Requested by: Host: research.nccgroup.com
URL: https://research.nccgroup.com/2022/08/19/back-in-black-unlocking-a-lockbit-3-0-ransomware-attack/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:4400::ac40:93bc , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 21881883151f8080c5d8b2fd9c877b6b9ce7438e6cd17b11697eed48896f8f49

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://research.nccgroup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Wed, 24 Jan 2024 15:13:27 GMT
content-encoding: gzip
cf-cache-status: REVALIDATED
server: cloudflare
vary: origin, accept-encoding, access-control-request-headers, access-control-request-method
access-control-max-age: 3000
access-control-allow-methods: GET, OPTIONS
access-control-allow-origin: *
content-type: text/javascript
cache-control: max-age=60, public, stale-while-revalidate=30
cf-ray: 84a938723cce3625-FRA
access-control-allow-headers: accept, accept-langauge, content-language, content-type, fa-kit-token
x-request-id: F6rXY9xvVmAC4l4KEUmj

GET
H3 200 script.js Show response
research.nccgroup.com/wp-content/themes/ncc-blog/ 5 KB
2 KB 205ms
204ms Script
application/javascript 192.0.78.199
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://research.nccgroup.com/wp-content/themes/ncc-blog/script.js

Requested by

Host: research.nccgroup.com
URL: https://research.nccgroup.com/2022/08/19/back-in-black-unlocking-a-lockbit-3-0-ransomware-attack/

Protocol

Security

QUIC, , AES_128_GCM

Server

192.0.78.199 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

8cb35fd293f499c41e2e1dbb87d52109d7214fb4a2bce7e2a1ac2cddef081646

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://research.nccgroup.com/2022/08/19/back-in-black-unlocking-a-lockbit-3-0-ransomware-attack/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Wed, 24 Jan 2024 15:13:27 GMT
strict-transport-security: max-age=31536000
content-encoding: br
last-modified: Fri, 31 Mar 2023 13:04:17 GMT
server: nginx
x-ac: 2.hhn _atomic_ams BYPASS
etag: W/"6426da51-1518"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=604800
alt-svc: h3=":443"; ma=86400
expires: Wed, 31 Jan 2024 15:13:27 GMT

GET
H3 200 queuehandler.min.js Show response
research.nccgroup.com/wp-content/plugins/jetpack/_inc/build/likes/ 7 KB
3 KB 362ms
361ms Script
application/javascript 192.0.78.199
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://research.nccgroup.com/wp-content/plugins/jetpack/_inc/build/likes/queuehandler.min.js

Requested by

Host: research.nccgroup.com
URL: https://research.nccgroup.com/2022/08/19/back-in-black-unlocking-a-lockbit-3-0-ransomware-attack/

Protocol

Security

QUIC, , AES_128_GCM

Server

192.0.78.199 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

926f41ff22908ac0389b92af3fd742e0e5921e1c0e7f3d034163c25c7abc0567

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://research.nccgroup.com/2022/08/19/back-in-black-unlocking-a-lockbit-3-0-ransomware-attack/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Wed, 24 Jan 2024 15:13:27 GMT
strict-transport-security: max-age=31536000
content-encoding: br
last-modified: Mon, 08 Jan 2024 20:42:16 GMT
server: nginx
x-ac: 2.hhn _atomic_ams BYPASS
etag: W/"659c5e28-1b9f"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=604800
alt-svc: h3=":443"; ma=86400
expires: Wed, 31 Jan 2024 15:13:27 GMT

GET
H2 200 e-202404.js Show response
stats.wp.com/ 7 KB
3 KB 128ms
39ms Script
application/javascript 192.0.76.3
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://stats.wp.com/e-202404.js
Requested by: Host: research.nccgroup.com
URL: https://research.nccgroup.com/2022/08/19/back-in-black-unlocking-a-lockbit-3-0-ransomware-attack/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.76.3 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 4f9f4e2e225088f9cf3b6b54aa421e0f776d1802255505d2f752e1f83f441641

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://research.nccgroup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

x-minify-cache: hit
x-nc: HIT hhn
date: Wed, 24 Jan 2024 15:13:27 GMT
content-encoding: br
server: nginx
x-minify: t
etag: W/14377-1704402356565.5398
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=31536000
alt-svc: h3=":443"; ma=86400
expires: Mon, 20 Jan 2025 10:07:35 GMT

GET
H3 200 jetpack-carousel.min.js Show response
research.nccgroup.com/wp-content/plugins/jetpack/_inc/build/carousel/ 23 KB
8 KB 208ms
207ms Script
application/javascript 192.0.78.199
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://research.nccgroup.com/wp-content/plugins/jetpack/_inc/build/carousel/jetpack-carousel.min.js

Requested by

Host: research.nccgroup.com
URL: https://research.nccgroup.com/2022/08/19/back-in-black-unlocking-a-lockbit-3-0-ransomware-attack/

Protocol

Security

QUIC, , AES_128_GCM

Server

192.0.78.199 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

66e324493b6a145a004d03c0548370be06c879ef95e8072ff8247d0964b26499

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://research.nccgroup.com/2022/08/19/back-in-black-unlocking-a-lockbit-3-0-ransomware-attack/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Wed, 24 Jan 2024 15:13:27 GMT
strict-transport-security: max-age=31536000
content-encoding: br
last-modified: Mon, 18 Dec 2023 16:25:24 GMT
server: nginx
x-ac: 2.hhn _atomic_ams BYPASS
etag: W/"65807274-5d6b"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=604800
alt-svc: h3=":443"; ma=86400
expires: Wed, 31 Jan 2024 15:13:27 GMT

GET
H3 200 sharing.min.js Show response
research.nccgroup.com/wp-content/plugins/jetpack/_inc/build/sharedaddy/ 9 KB
3 KB 360ms
359ms Script
application/javascript 192.0.78.199
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://research.nccgroup.com/wp-content/plugins/jetpack/_inc/build/sharedaddy/sharing.min.js

Requested by

Host: research.nccgroup.com
URL: https://research.nccgroup.com/2022/08/19/back-in-black-unlocking-a-lockbit-3-0-ransomware-attack/

Protocol

Security

QUIC, , AES_128_GCM

Server

192.0.78.199 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

9e1dae23d3ad3212f67d09ca79a50003c32953c36bab976f634c9b38d8a8c6dc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://research.nccgroup.com/2022/08/19/back-in-black-unlocking-a-lockbit-3-0-ransomware-attack/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Wed, 24 Jan 2024 15:13:27 GMT
strict-transport-security: max-age=31536000
content-encoding: br
last-modified: Tue, 07 Mar 2023 19:14:38 GMT
server: nginx
x-ac: 2.hhn _atomic_ams BYPASS
etag: W/"64078d1e-2259"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=604800
alt-svc: h3=":443"; ma=86400
expires: Wed, 31 Jan 2024 15:13:27 GMT

GET
H2 200 css2
fonts.googleapis.com/ 4 KB
1003 B 136ms
49ms Stylesheet
text/css 2a00:1450:4001:82a::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Montserrat:wght@500;600&display=swap

Requested by

Host: research.nccgroup.com
URL: https://research.nccgroup.com/wp-content/themes/ncc-blog/main.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

1aa38ac7dc6c385b596a3764765a756748e7811d4f2b655dac3106704a17246f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://research.nccgroup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Wed, 24 Jan 2024 15:13:27 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Wed, 24 Jan 2024 15:13:27 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Wed, 24 Jan 2024 15:13:27 GMT

GET
H2 200 css2
fonts.googleapis.com/ 5 KB
713 B 141ms
55ms Stylesheet
text/css 2a00:1450:4001:82a::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=PT+Sans:ital,wght@0,400;0,700;1,400;1,700&display=swap

Requested by

Host: research.nccgroup.com
URL: https://research.nccgroup.com/wp-content/themes/ncc-blog/main.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

03b42c369450f4dbaff7256e7bed1b9056a6a279f667492e00a8675beaf99da7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://research.nccgroup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Wed, 24 Jan 2024 15:13:27 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Wed, 24 Jan 2024 14:47:46 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Wed, 24 Jan 2024 15:13:27 GMT

GET
H2 200 prettify.css
cdn.jsdelivr.net/gh/google/code-prettify@master/loader/ 655 B
678 B 48ms
47ms Stylesheet
text/css 2606:4700::6810:5514
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/gh/google/code-prettify@master/loader/prettify.css

Requested by

Host: cdn.jsdelivr.net
URL: https://cdn.jsdelivr.net/gh/google/code-prettify@master/loader/run_prettify.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:5514 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0f209e58b0d412b1e37d9468ab6674dad3860077ad9a918a7462ca67d033d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://research.nccgroup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Wed, 24 Jan 2024 15:13:27 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 37840
x-jsd-version: master
content-encoding: br
x-cache: HIT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
x-served-by: cache-fra-eddf8230062-FRA
x-jsd-version-type: branch
server: cloudflare
etag: W/"28f-3AMtzR7l//agOVmpYsx92kQQyCI"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2FqcRL6KL474oATAHNZmSoVMrVvWeKsgxcqlBqF99G8Dvw0Pf7twyk8Uisj%2BlKVD0L02swRQcn8zwjztCrcvKOwWJZzEDxXeNWYmmqh6iXzHHctkFxWelTKOtxfiIwFiGNECfFEMS0FZKWGn50D8%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=604800, s-maxage=43200
timing-allow-origin: *
cf-ray: 84a93871a9492c52-FRA

GET
H2 200 jizaRExUiTo99u79D0KExQ.woff2
fonts.gstatic.com/s/ptsans/v17/ 44 KB
45 KB 132ms
43ms Font
font/woff2 2a00:1450:4001:813::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/ptsans/v17/jizaRExUiTo99u79D0KExQ.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=PT+Sans:ital,wght@0,400;0,700;1,400;1,700&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e13ffa988be59cbf299d7ff68f019f902b60848203ac4990819eb7e4624ee52d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://research.nccgroup.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Mon, 22 Jan 2024 23:20:08 GMT
x-content-type-options: nosniff
age: 143599
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 45300
x-xss-protection: 0
last-modified: Wed, 27 Apr 2022 16:11:08 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 21 Jan 2025 23:20:08 GMT

GET
H3 200 hero-bg.jpg
research.nccgroup.com/wp-content/themes/ncc-blog/images/ 248 KB
249 KB 212ms
212ms Image
image/jpeg 192.0.78.199
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://research.nccgroup.com/wp-content/themes/ncc-blog/images/hero-bg.jpg

Requested by

Host: research.nccgroup.com
URL: https://research.nccgroup.com/wp-content/themes/ncc-blog/main.css

Protocol

Security

QUIC, , AES_128_GCM

Server

192.0.78.199 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

5def178e375166c5d070b4873630065c4c2510c11d254d128f311f8ccee2566d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://research.nccgroup.com/wp-content/themes/ncc-blog/main.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Wed, 24 Jan 2024 15:13:27 GMT
strict-transport-security: max-age=31536000
x-ac: 2.hhn _atomic_ams BYPASS
last-modified: Mon, 27 Mar 2023 12:39:30 GMT
server: nginx
etag: "64218e82-3e1d9"
access-control-allow-methods: GET, HEAD
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=604800
accept-ranges: bytes
alt-svc: h3=":443"; ma=86400
content-length: 254425
expires: Wed, 31 Jan 2024 15:13:27 GMT

GET
H3 200 background-2a.jpg
research.nccgroup.com/wp-content/themes/ncc-blog/images/ 68 KB
68 KB 742ms
742ms Image
image/jpeg 192.0.78.199
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://research.nccgroup.com/wp-content/themes/ncc-blog/images/background-2a.jpg

Requested by

Host: research.nccgroup.com
URL: https://research.nccgroup.com/wp-content/themes/ncc-blog/main.css

Protocol

Security

QUIC, , AES_128_GCM

Server

192.0.78.199 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

8a4dce653720706ba2279829a9923501765f239e5fe88f88ff9cbc6b7370fd2a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://research.nccgroup.com/wp-content/themes/ncc-blog/main.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Wed, 24 Jan 2024 15:13:28 GMT
strict-transport-security: max-age=31536000
x-ac: 2.hhn _atomic_ams BYPASS
last-modified: Mon, 27 Mar 2023 12:39:30 GMT
server: nginx
etag: "64218e82-110b2"
access-control-allow-methods: GET, HEAD
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=604800
accept-ranges: bytes
alt-svc: h3=":443"; ma=86400
content-length: 69810
expires: Wed, 31 Jan 2024 15:13:27 GMT

GET
H2 200 jizfRExUiTo99u79B_mh0O6tLQ.woff2
fonts.gstatic.com/s/ptsans/v17/ 46 KB
46 KB 170ms
89ms Font
font/woff2 2a00:1450:4001:813::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/ptsans/v17/jizfRExUiTo99u79B_mh0O6tLQ.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=PT+Sans:ital,wght@0,400;0,700;1,400;1,700&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

141f0c53e457585d4ac7426eb3d757666d250ee6fbf0e9c0878128e4c627f0b1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://research.nccgroup.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Tue, 23 Jan 2024 23:44:49 GMT
x-content-type-options: nosniff
age: 55718
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 47048
x-xss-protection: 0
last-modified: Wed, 27 Apr 2022 16:55:54 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 22 Jan 2025 23:44:49 GMT

GET
H2 200 jizYRExUiTo99u79D0e0x8mI.woff2
fonts.gstatic.com/s/ptsans/v17/ 42 KB
42 KB 212ms
132ms Font
font/woff2 2a00:1450:4001:813::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/ptsans/v17/jizYRExUiTo99u79D0e0x8mI.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=PT+Sans:ital,wght@0,400;0,700;1,400;1,700&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

595c14bd7589b069e4570ba658cfab8850611639e8a077ca84ef263bfa4671f9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://research.nccgroup.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Tue, 23 Jan 2024 23:30:39 GMT
x-content-type-options: nosniff
age: 56568
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42500
x-xss-protection: 0
last-modified: Wed, 27 Apr 2022 16:01:40 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 22 Jan 2025 23:30:39 GMT

GET
DATA 200
OK truncated
/ 7 KB
7 KB Font
application/octet-stream

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 70c44a9df364a5e5779a64d3b6bace4a0939ad6649859f59e30d4df5bbfbf7d6

Request headers

Referer
Origin: https://research.nccgroup.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

Content-Type: application/octet-stream

GET
H2 200 css
fonts-api.wp.com/ 5 KB
1 KB 68ms
59ms Stylesheet
text/css 192.0.77.32
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts-api.wp.com/css?family=PT+Sans:r%7CPT+Sans:r,i,b,bi&subset=latin,latin-ext,latin,latin-ext

Requested by

Host: research.nccgroup.com
URL: https://research.nccgroup.com/wp-content/mu-plugins/wpcomsh/vendor/automattic/custom-fonts/js/webfont.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

46115bbb71a40bd586253d4ee483a0fc065a418c7a54ee5926e49c0b93b0e547

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://research.nccgroup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Wed, 24 Jan 2024 15:13:27 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-encoding: gzip
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
x-xss-protection: 0
x-nc: BYPASS hhn 2
last-modified: Wed, 24 Jan 2024 15:13:27 GMT
server: nginx
cross-origin-opener-policy: same-origin-allow-popups
vary: Accept-Encoding, Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin

GET
H2 200 jizfRExUiTo99u79B_mh0O6tLQ.woff2
fonts.wp.com/s/ptsans/v17/ 46 KB
46 KB 125ms
39ms Font
font/woff2 192.0.77.32
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.wp.com/s/ptsans/v17/jizfRExUiTo99u79B_mh0O6tLQ.woff2

Requested by

Host: fonts-api.wp.com
URL: https://fonts-api.wp.com/css?family=PT+Sans:r%7CPT+Sans:r,i,b,bi&subset=latin,latin-ext,latin,latin-ext

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

141f0c53e457585d4ac7426eb3d757666d250ee6fbf0e9c0878128e4c627f0b1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts-api.wp.com/
Origin: https://research.nccgroup.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

x-nc: HIT hhn 1
date: Wed, 24 Jan 2024 15:13:27 GMT
x-content-type-options: nosniff
last-modified: Wed, 27 Apr 2022 16:55:54 GMT
server: nginx
age: 262267
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3=":443"; ma=86400
content-length: 47048
x-xss-protection: 0

GET
H2 200 jizaRExUiTo99u79D0KExQ.woff2
fonts.wp.com/s/ptsans/v17/ 44 KB
45 KB 125ms
39ms Font
font/woff2 192.0.77.32
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.wp.com/s/ptsans/v17/jizaRExUiTo99u79D0KExQ.woff2

Requested by

Host: fonts-api.wp.com
URL: https://fonts-api.wp.com/css?family=PT+Sans:r%7CPT+Sans:r,i,b,bi&subset=latin,latin-ext,latin,latin-ext

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

e13ffa988be59cbf299d7ff68f019f902b60848203ac4990819eb7e4624ee52d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts-api.wp.com/
Origin: https://research.nccgroup.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

x-nc: HIT hhn 1
date: Wed, 24 Jan 2024 15:13:27 GMT
x-content-type-options: nosniff
last-modified: Wed, 27 Apr 2022 16:11:08 GMT
server: nginx
age: 74551
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3=":443"; ma=86400
content-length: 45300
x-xss-protection: 0

GET
H2 200 jizYRExUiTo99u79D0e0x8mI.woff2
fonts.wp.com/s/ptsans/v17/ 42 KB
42 KB 121ms
39ms Font
font/woff2 192.0.77.32
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.wp.com/s/ptsans/v17/jizYRExUiTo99u79D0e0x8mI.woff2

Requested by

Host: fonts-api.wp.com
URL: https://fonts-api.wp.com/css?family=PT+Sans:r%7CPT+Sans:r,i,b,bi&subset=latin,latin-ext,latin,latin-ext

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

595c14bd7589b069e4570ba658cfab8850611639e8a077ca84ef263bfa4671f9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts-api.wp.com/
Origin: https://research.nccgroup.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

x-nc: HIT hhn 1
date: Wed, 24 Jan 2024 15:13:27 GMT
x-content-type-options: nosniff
last-modified: Wed, 27 Apr 2022 16:01:40 GMT
server: nginx
age: 426259
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3=":443"; ma=86400
content-length: 42500
x-xss-protection: 0

GET
H2 200 jizdRExUiTo99u79D0e8fOydLxUd.woff2
fonts.gstatic.com/s/ptsans/v17/ 32 KB
32 KB 40ms
39ms Font
font/woff2 2a00:1450:4001:813::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/ptsans/v17/jizdRExUiTo99u79D0e8fOydLxUd.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=PT+Sans:ital,wght@0,400;0,700;1,400;1,700&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

001d8a10f7fa65efb142212df4f00867320cda3b9ee9075d7dbe50ef090e14e0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://research.nccgroup.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Sat, 20 Jan 2024 11:10:32 GMT
x-content-type-options: nosniff
age: 360175
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 32964
x-xss-protection: 0
last-modified: Wed, 27 Apr 2022 16:06:22 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 19 Jan 2025 11:10:32 GMT

GET
H2 200 jizdRExUiTo99u79D0e8fOydLxUd.woff2
fonts.wp.com/s/ptsans/v17/ 32 KB
32 KB 115ms
39ms Font
font/woff2 192.0.77.32
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.wp.com/s/ptsans/v17/jizdRExUiTo99u79D0e8fOydLxUd.woff2

Requested by

Host: fonts-api.wp.com
URL: https://fonts-api.wp.com/css?family=PT+Sans:r%7CPT+Sans:r,i,b,bi&subset=latin,latin-ext,latin,latin-ext

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

001d8a10f7fa65efb142212df4f00867320cda3b9ee9075d7dbe50ef090e14e0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts-api.wp.com/
Origin: https://research.nccgroup.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

x-nc: HIT hhn 1
date: Wed, 24 Jan 2024 15:13:27 GMT
x-content-type-options: nosniff
last-modified: Wed, 27 Apr 2022 16:06:22 GMT
server: nginx
age: 297675
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3=":443"; ma=86400
content-length: 32964
x-xss-protection: 0

GET
H2 200 free.min.css Show response
ka-f.fontawesome.com/releases/v6.5.1/css/ 101 KB
23 KB 158ms
59ms Fetch
text/css 2606:4700:e6::ac40:cd14
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ka-f.fontawesome.com/releases/v6.5.1/css/free.min.css?token=2e07949954
Requested by: Host: kit.fontawesome.com
URL: https://kit.fontawesome.com/2e07949954.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:e6::ac40:cd14 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b2bfe99e2e78f71c88eb00c49e1392a15531fb6486d0d0c2ea71937dda34deab

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://research.nccgroup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Wed, 24 Jan 2024 15:13:28 GMT
via: 1.1 df4167ab0949b4d2c15466bdfdc05f94.cloudfront.net (CloudFront)
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-amz-cf-pop: AMS54-C1
age: 694411
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
alt-svc: h3=":443"; ma=86400
last-modified: Thu, 30 Nov 2023 17:25:52 GMT
server: cloudflare
etag: W/"edc53d8d44037708e54122b9e30bb2a1"
access-control-max-age: 3000
access-control-allow-methods: GET
content-type: text/css
access-control-allow-origin: *
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=jZbCMlXkA1wIk1hRQgn%2FRTELZirmkv5pqAm0H6CY6%2FhxZavAfkBWhd80y3YxR%2FP2a5gxgeMR%2BuRmOV8bPyi89z4lFcRNlFVY5%2FAP60x%2Fb7lPrYxLfOt0WFd80CaoTHG2D%2BcIHEbcyWyzytHTt0jUZuzl1g%3D%3D"}],"group":"cf-nel","max_age":604800}
cache-control: max-age=31556926
vary: Accept-Encoding
cf-ray: 84a93875fadb0bcb-AMS
access-control-allow-headers: fa-kit-token
x-amz-cf-id: rnxpOFk1QYaoRMJiULrwDVg5IcjBDADZXxJSH0SO0Ac6Ko1vE1yOcQ==

GET
H2 200 free-v4-shims.min.css Show response
ka-f.fontawesome.com/releases/v6.5.1/css/ 27 KB
5 KB 157ms
58ms Fetch
text/css 2606:4700:e6::ac40:cd14
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ka-f.fontawesome.com/releases/v6.5.1/css/free-v4-shims.min.css?token=2e07949954
Requested by: Host: kit.fontawesome.com
URL: https://kit.fontawesome.com/2e07949954.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:e6::ac40:cd14 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5031c11dd77875afefe4eeddfaa320af07fdccea327f7416a5ee8980674c9c76

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://research.nccgroup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Wed, 24 Jan 2024 15:13:28 GMT
via: 1.1 96e04892ec84a7161914f66c3ba3b5f0.cloudfront.net (CloudFront)
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-amz-cf-pop: AMS1-P2
age: 409164
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
alt-svc: h3=":443"; ma=86400
last-modified: Thu, 30 Nov 2023 17:25:51 GMT
server: cloudflare
etag: W/"604d6da359831b0dc67e0f522f1ff94d"
access-control-max-age: 3000
access-control-allow-methods: GET
content-type: text/css
access-control-allow-origin: *
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=gttIP6QttOxy6IWeQmqsl%2BA1OTz%2FnLpTGSkjSiWa7hdgcPvQlI372Zj0%2BKbMUM%2FY0JVfuAy7TmC6UvOHTM94RAuHruBmZvYL5QZbyb5ieDx%2Fz9fzgGta4lF9DT25Xmj9mG%2F%2B0NZzvYCzdVQER%2B0YJ1tPAQ%3D%3D"}],"group":"cf-nel","max_age":604800}
cache-control: max-age=31556926
vary: Accept-Encoding
cf-ray: 84a93875fae10bcb-AMS
access-control-allow-headers: fa-kit-token
x-amz-cf-id: gxEYNwechWXC96sTh22iWXxi6uhHTGbZQbPNGPYfQOh_11PWaj44mg==

GET
H2 200 free-v5-font-face.min.css Show response
ka-f.fontawesome.com/releases/v6.5.1/css/ 823 B
728 B 168ms
69ms Fetch
text/css 2606:4700:e6::ac40:cd14
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ka-f.fontawesome.com/releases/v6.5.1/css/free-v5-font-face.min.css?token=2e07949954
Requested by: Host: kit.fontawesome.com
URL: https://kit.fontawesome.com/2e07949954.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:e6::ac40:cd14 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f581083ac72ae169a698cd0cb7f02d8bb2e079844bfad68cc98df5b3c4692408

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://research.nccgroup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Wed, 24 Jan 2024 15:13:28 GMT
via: 1.1 4cc2a0a7eb7d5483edc69be298297f9e.cloudfront.net (CloudFront)
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-amz-cf-pop: AMS54-C1
age: 695912
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
alt-svc: h3=":443"; ma=86400
last-modified: Thu, 30 Nov 2023 17:25:51 GMT
server: cloudflare
etag: W/"496965a55b1faa4d5c41073ef276afc0"
access-control-max-age: 3000
access-control-allow-methods: GET
content-type: text/css
access-control-allow-origin: *
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=KJxVRi8rJgThoqBn5I0BzFjSMnFX%2B2bt6GoL9wAqSeb5%2BRGecmdO3ytjG5bCWy6EGtnDa3VRmIfX4MRIHh7h7xvLpn%2B7r3%2F1DFrYJZlmtKfAd4GAgwPbkXaUsrTPxqfe9Cx4cU5cxrZyngQtELgC81Y9wg%3D%3D"}],"group":"cf-nel","max_age":604800}
cache-control: max-age=31556926
vary: Accept-Encoding
cf-ray: 84a93875fae00bcb-AMS
access-control-allow-headers: fa-kit-token
x-amz-cf-id: FB8-DhcEybSpt1xNzKMYiIr5Z9cOICXy0gE_VcIVY7BR-c8CGjzBaQ==

GET
H2 200 free-v4-font-face.min.css Show response
ka-f.fontawesome.com/releases/v6.5.1/css/ 2 KB
1 KB 156ms
57ms Fetch
text/css 2606:4700:e6::ac40:cd14
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ka-f.fontawesome.com/releases/v6.5.1/css/free-v4-font-face.min.css?token=2e07949954
Requested by: Host: kit.fontawesome.com
URL: https://kit.fontawesome.com/2e07949954.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:e6::ac40:cd14 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6530f32fa70a330cd76547497f20048ae081dcc897af26befc84600357ba06be

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://research.nccgroup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Wed, 24 Jan 2024 15:13:28 GMT
via: 1.1 bb1fd0922e473ba97ff6a00f6c71141a.cloudfront.net (CloudFront)
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-amz-cf-pop: AMS54-C1
age: 694411
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
alt-svc: h3=":443"; ma=86400
last-modified: Thu, 30 Nov 2023 17:25:51 GMT
server: cloudflare
etag: W/"cc84affe95dbdd9726525f57d20b4ea6"
access-control-max-age: 3000
access-control-allow-methods: GET
content-type: text/css
access-control-allow-origin: *
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=7ht8z2LiYo0DTormVaN93QRhEqinFyzXNTCZrcSQ9pr1610Ow2SszA%2BeMdBiREOcNUwE%2Fw2YTOuINo7UJxoSADKabfKFJVu2OVO6dpghi3vNc0Vy517s%2F1TQ1CFJP%2BXiqk3OsQlDrXJ5UmgseWN4Q4D57Q%3D%3D"}],"group":"cf-nel","max_age":604800}
cache-control: max-age=31556926
vary: Accept-Encoding
cf-ray: 84a93875fae30bcb-AMS
access-control-allow-headers: fa-kit-token
x-amz-cf-id: pmzBifG63dsbIBu9lMi0wQexjjY3_Dil11XniPLua7Y3y4gT3wu_8Q==

GET
H2 200 master.html Show response
widgets.wp.com/likes/ Frame 1AF8 3 KB
1 KB 44ms
39ms Document
text/html 192.0.77.32
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://widgets.wp.com/likes/master.html?ver=20240124
Requested by: Host: research.nccgroup.com
URL: https://research.nccgroup.com/2022/08/19/back-in-black-unlocking-a-lockbit-3-0-ransomware-attack/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS: wordpress.com
Software: nginx /
Resource Hash: 6b7ef8d2f3fd4cebb645196195e1f21fd4faf547f08b72662ebaf9cbda2ef2bb

Request headers

Referer: https://research.nccgroup.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

access-control-allow-methods: GET, HEAD
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400 h3=":443"; ma=86400
content-encoding: br
content-type: text/html
date: Wed, 24 Jan 2024 15:13:27 GMT
etag: W/"65aa73c3-b70"
last-modified: Fri, 19 Jan 2024 13:06:11 GMT
server: nginx
timing-allow-origin: *
vary: Accept-Encoding
x-ac: 2.hhn _dfw MISS
x-nc: HIT hhn 2

GET
H2 200 g.gif
pixel.wp.com/ 50 B
177 B 44ms
38ms Image
image/gif 192.0.76.3
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.wp.com/g.gif?v=ext&blog=168079201&post=24744&tz=0&srv=research.nccgroup.com&hp=atomic&ac=2&amp=0&j=1%3A13.1-a.1&host=research.nccgroup.com&ref=&fcp=897&rand=0.012867613594343963
Requested by: Host: research.nccgroup.com
URL: https://research.nccgroup.com/2022/08/19/back-in-black-unlocking-a-lockbit-3-0-ransomware-attack/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.76.3 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: f3a8992acb9ab911e0fa4ae12f4b85ef8e61008619f13ee51c7a121ff87f63b1

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://research.nccgroup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

access-control-allow-origin: *
date: Wed, 24 Jan 2024 15:13:27 GMT
cache-control: no-cache
server: nginx
alt-svc: h3=":443"; ma=86400
content-length: 50
content-type: image/gif

GET
H2 200 rlt-proxy.js Show response
s0.wp.com/wp-content/js/ Frame 1AF8 3 KB
1 KB 39ms
38ms Script
application/javascript 192.0.77.32
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://s0.wp.com/wp-content/js/rlt-proxy.js?m=20211122
Requested by: Host: widgets.wp.com
URL: https://widgets.wp.com/likes/master.html?ver=20240124
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS: wordpress.com
Software: nginx /
Resource Hash: f72ea1589b707feb0d369c239e89cc4ca754d70645c76e3a61ba0af9d69bba8c

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://widgets.wp.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

x-minify-cache: hit
date: Wed, 24 Jan 2024 15:13:27 GMT
content-encoding: br
x-ac: 2.hhn _dfw MISS
x-minify: t
alt-svc: h3=":443"; ma=86400
x-nc: HIT hhn 2
server: nginx
etag: W/7325-1684465206729.7068
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=31536000
timing-allow-origin: *
expires: Thu, 30 May 2024 14:44:30 GMT

GET
H2 200 / Show response
s0.wp.com/_static/ Frame 1AF8 87 KB
22 KB 39ms
39ms Script
application/javascript 192.0.77.32
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://s0.wp.com/_static/??/wp-content/js/postmessage.js,/wp-content/js/tannin/compat.min.js,/wp-content/js/wpcom-proxy-request.js,/wp-content/js/likes-rest-nojquery.js?m=20240112
Requested by: Host: widgets.wp.com
URL: https://widgets.wp.com/likes/master.html?ver=20240124
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS: wordpress.com
Software: nginx /
Resource Hash: d80555bb44fed58a5f6316f646ae78d82a7cf46c483c5d4f1fea2f8231496101

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://widgets.wp.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

x-nc: HIT hhn 2
date: Wed, 24 Jan 2024 15:13:27 GMT
content-encoding: br
x-ac: 2.hhn _dfw MISS
last-modified: Thu, 11 Jan 2024 15:14:26 GMT
server: nginx
etag: W/"65a005d2-15d18"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=31536000
timing-allow-origin: *
alt-svc: h3=":443"; ma=86400, h3=":443"; ma=86400
expires: Sat, 11 Jan 2025 10:33:01 GMT

GET
H2 200 / Show response
public-api.wordpress.com/wp-admin/rest-proxy/ Frame 52F4 9 KB
4 KB 331ms
162ms Document
text/html 192.0.78.23
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://public-api.wordpress.com/wp-admin/rest-proxy/

Requested by

Host: s0.wp.com
URL: https://s0.wp.com/_static/??/wp-content/js/postmessage.js,/wp-content/js/tannin/compat.min.js,/wp-content/js/wpcom-proxy-request.js,/wp-content/js/likes-rest-nojquery.js?m=20240112

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.78.23 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

cb6af707ec628bb1798235eca73cdccb92608977e4680a4c60c308bf230e6032

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://widgets.wp.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400
content-encoding: br
content-type: text/html; charset=utf-8
date: Wed, 24 Jan 2024 15:13:28 GMT
p3p: CP="CAO PSA OUR"
server: nginx
strict-transport-security: max-age=31536000
vary: Accept-Encoding
x-ac: 1.hhn _dfw BYPASS

GET
H2 200 free-fa-solid-900.woff2
ka-f.fontawesome.com/releases/v6.5.1/webfonts/ 153 KB
153 KB 52ms
52ms Font
font/woff2 2606:4700:e6::ac40:cd14
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ka-f.fontawesome.com/releases/v6.5.1/webfonts/free-fa-solid-900.woff2
Requested by: Host: research.nccgroup.com
URL: https://research.nccgroup.com/2022/08/19/back-in-black-unlocking-a-lockbit-3-0-ransomware-attack/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:e6::ac40:cd14 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: a93f7f459e0dabc5d86e6b6e3936c07d2dd02b52369f26bb7e8c0005a5d26368

Request headers

Referer: https://research.nccgroup.com/
Origin: https://research.nccgroup.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Wed, 24 Jan 2024 15:13:28 GMT
via: 1.1 c149c6b8a4d6f497cac6f2d9e9e6be40.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-amz-cf-pop: AMS54-C1
age: 694411
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
alt-svc: h3=":443"; ma=86400
content-length: 156504
last-modified: Thu, 30 Nov 2023 17:53:29 GMT
server: cloudflare
etag: "98ff5c340b38803d09d3f22fd9a00501"
access-control-max-age: 3000
access-control-allow-methods: GET
content-type: font/woff2
access-control-allow-origin: *
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ktMrQX7jj7oP5kqMJOejVfsymK4vWn53xeoPSOrTNZjZD%2FxEzG3H5wfmVD4cPznwr93TaiWIlmD8LNSChpQ%2F75Dxfpovjv06nSpV%2F0W5KX6ssH1p5IURiM9AetoJmADQSfcFoI%2Fklmj8ShiycGqYdEC5KA%3D%3D"}],"group":"cf-nel","max_age":604800}
cache-control: max-age=31556926
vary: Accept-Encoding
accept-ranges: bytes
cf-ray: 84a938768ba40bcb-AMS
access-control-allow-headers: fa-kit-token
x-amz-cf-id: -Go9IwpQptJJcyNjjvcj3KJJWCsGbLXU346K3e8JLjsG7guSxoRltQ==

GET
H3 200 rlt-proxy.js Show response
s0.wp.com/wp-content/js/ Frame 52F4 3 KB
1 KB 40ms
40ms Script
application/javascript 192.0.77.32
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://s0.wp.com/wp-content/js/rlt-proxy.js?m=20211122
Requested by: Host: public-api.wordpress.com
URL: https://public-api.wordpress.com/wp-admin/rest-proxy/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS: wordpress.com
Software: nginx /
Resource Hash: f72ea1589b707feb0d369c239e89cc4ca754d70645c76e3a61ba0af9d69bba8c

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://public-api.wordpress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

x-minify-cache: hit
date: Wed, 24 Jan 2024 15:13:28 GMT
content-encoding: br
x-ac: 2.hhn _dfw MISS
x-minify: t
alt-svc: h3=":443"; ma=86400
x-nc: HIT hhn 2
server: nginx
etag: W/7325-1684465206729.7068
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=31536000
timing-allow-origin: *
expires: Thu, 30 May 2024 14:44:30 GMT

GET
H2 204 boom.gif
pixel.wp.com/ 0
105 B 39ms
38ms Image
text/plain 192.0.76.3
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.wp.com/boom.gif?bilmur=1&cumulative_layout_shift=0.006&largest_contentful_paint=1261&batcache_hit=1&provider=wordpress.com&service=atomic&effective_connection_type=4g&rtt=0&downlink=10000&host_name=research.nccgroup.com&url_path=%2F2022%2F08%2F19%2Fback-in-black-unlocking-a-lockbit-3-0-ransomware-attack%2F&nt_fetchStart=0&nt_domainLookupStart=55&nt_domainLookupEnd=55&nt_connectStart=55&nt_connectEnd=133&nt_secureConnectionStart=93&nt_requestStart=133&nt_responseStart=367&nt_responseEnd=453&nt_domLoading=368&nt_domInteractive=1502&nt_domContentLoadedEventStart=1505&nt_domContentLoadedEventEnd=1510&nt_domComplete=1984&nt_loadEventStart=1984&nt_loadEventEnd=1985&nt_redirectCount=0&nt_nextHopProtocol=h2&nt_api_level=2&start_render=897&first_contentful_paint=897&resource_size=1364335&resource_transferred=642060&resource_cache_percent=0&js_size=256490&js_transferred=93106&js_cache_percent=0&blocking_size=672332&blocking_transferred=107271&blocking_cache_percent=0&last_resource_end=1785
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.76.3 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://research.nccgroup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

access-control-allow-origin: *
date: Wed, 24 Jan 2024 15:13:30 GMT
cache-control: no-cache
server: nginx
alt-svc: h3=":443"; ma=86400

Verdicts & Comments Add Verdict or Comment

22 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=31536000

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

c0.wp.com
cdn.jsdelivr.net
fonts-api.wp.com
fonts.googleapis.com
fonts.gstatic.com
fonts.wp.com
i0.wp.com
ka-f.fontawesome.com
kit.fontawesome.com
pixel.wp.com
public-api.wordpress.com
research.nccgroup.com
s0.wp.com
stats.wp.com
widgets.wp.com
192.0.76.3
192.0.77.2
192.0.77.32
192.0.77.37
192.0.78.199
192.0.78.23
2606:4700:4400::ac40:93bc
2606:4700::6810:5514
2606:4700:e6::ac40:cd14
2a00:1450:4001:813::2003
2a00:1450:4001:82a::200a
001d8a10f7fa65efb142212df4f00867320cda3b9ee9075d7dbe50ef090e14e0
03b42c369450f4dbaff7256e7bed1b9056a6a279f667492e00a8675beaf99da7
141f0c53e457585d4ac7426eb3d757666d250ee6fbf0e9c0878128e4c627f0b1
1882608f84e795b684548d2f468653fd68c50b3a8dbb3b63a28537112222a208
1aa38ac7dc6c385b596a3764765a756748e7811d4f2b655dac3106704a17246f
216728e33a7de4be9b784eff527c6ccf1658319ea78fe66a7864c0b923200252
21881883151f8080c5d8b2fd9c877b6b9ce7438e6cd17b11697eed48896f8f49
27dd9b075cc59cf5f3c0f6ee075f4bd113782d81ce30a4f16aac669ecfdc4fa2
2e10d353ff038c2cad3492fc17801af3e6ef2669c9e9713bdb78b1dcb104c4fe
46115bbb71a40bd586253d4ee483a0fc065a418c7a54ee5926e49c0b93b0e547
4c24dfd28784ad2befb3dafaac6bf1ed4e7cd58cce713d9a0b228d426e812baf
4f9f4e2e225088f9cf3b6b54aa421e0f776d1802255505d2f752e1f83f441641
4ff079893cbfe8eebd0d49b7c8bcbeba131173b3e0da0e13210ad611869e0e36
5031c11dd77875afefe4eeddfaa320af07fdccea327f7416a5ee8980674c9c76
554caf1eb82495c5dd63b74de2de86fac9ee78fbb3ec323add52654b5c932163
559a8fa7fa5cb693bd3cf92d8992623527db2a54a97d86e02b998a46ad90351d
58ef81613a90fc2af22b15e8819fde36ca0d84ec40c4f7577a32e0781d2fc3b3
595c14bd7589b069e4570ba658cfab8850611639e8a077ca84ef263bfa4671f9
5def178e375166c5d070b4873630065c4c2510c11d254d128f311f8ccee2566d
6530f32fa70a330cd76547497f20048ae081dcc897af26befc84600357ba06be
66e324493b6a145a004d03c0548370be06c879ef95e8072ff8247d0964b26499
6b7ef8d2f3fd4cebb645196195e1f21fd4faf547f08b72662ebaf9cbda2ef2bb
70c44a9df364a5e5779a64d3b6bace4a0939ad6649859f59e30d4df5bbfbf7d6
7285646ea1d6480a26b5c3d66f75edac636a664b9ef84bbd5fb63122065bb668
731681671ddee142213a3242e4a6d3444aeae1c4f7e0630847903dab12922398
8a4dce653720706ba2279829a9923501765f239e5fe88f88ff9cbc6b7370fd2a
8ca6ce966eec195519e56f78877f489c0b248e1293271d66d821a6c7b004b605
8cb35fd293f499c41e2e1dbb87d52109d7214fb4a2bce7e2a1ac2cddef081646
8e974b6ae4f0e09293655569f14af299bd59572ce397d0f9546df10eb89b671d
926f41ff22908ac0389b92af3fd742e0e5921e1c0e7f3d034163c25c7abc0567
9c197c685d1cfde9e68e198bd0c023f58202efd10e5991a58aeacb01db67f844
9e1dae23d3ad3212f67d09ca79a50003c32953c36bab976f634c9b38d8a8c6dc
a2c1967d4bc375b190863aabb8bb22a2da4ec5461f8dfd8add4987e3687a26ed
a93f7f459e0dabc5d86e6b6e3936c07d2dd02b52369f26bb7e8c0005a5d26368
b2bfe99e2e78f71c88eb00c49e1392a15531fb6486d0d0c2ea71937dda34deab
b7908a015a567ec2363011df2475368dbff34360e9da3fdff50604d6395fb646
bd7f27f6a69ec7e919c3c51dbf85c185a2e38b482af4084593704ed0bca40930
c4ed980116c12325b30c81ef2bf6e2284ba2242b57d7c2ee4867278fd078dcae
cb6af707ec628bb1798235eca73cdccb92608977e4680a4c60c308bf230e6032
cd1b25d7b70da44c4423d64b0f1e8cccbed8cdad41ab300c8b72eca0f0e1cbac
d3da67f9a0b5c6854f83c013c4381d9d3b3434351a39b8a017aec61e681ee460
d80555bb44fed58a5f6316f646ae78d82a7cf46c483c5d4f1fea2f8231496101
e04e7d913ec3268951f4e1c923499eb347070a78cb0ca99a454d8c7d373acc54
e13ffa988be59cbf299d7ff68f019f902b60848203ac4990819eb7e4624ee52d
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e3b0f209e58b0d412b1e37d9468ab6674dad3860077ad9a918a7462ca67d033d
eed4c6c84ba33aeebda2fdcbbd60a027f9a006f3623fb13f22a8971e02d32f30
f3a8992acb9ab911e0fa4ae12f4b85ef8e61008619f13ee51c7a121ff87f63b1
f581083ac72ae169a698cd0cb7f02d8bb2e079844bfad68cc98df5b3c4692408
f72ea1589b707feb0d369c239e89cc4ca754d70645c76e3a61ba0af9d69bba8c
fbf8f849b126b5226f0e1cc4ac77ad237766e603d825321dc1110ddc4c295862
fc8c00f9c709b002856df234b920785bd69ba089627ab5197b65e4bea07fafe4

research.nccgroup.com Open in urlscan Pro 192.0.78.199 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

56 Requests

100 %HTTPS

45 %IPv6

7 Domains

15 Subdomains

12 IPs

2 Countries

1344 kBTransfer

2900 kBSize

0 Cookies

12 Outgoing links

Redirected requests

56 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

research.nccgroup.com Open in urlscan Pro
192.0.78.199 Public Scan

Screenshot
Live screenshot

Full Image

56
Requests

100 %
HTTPS

45 %
IPv6

7
Domains

15
Subdomains

12
IPs

2
Countries

1344 kB
Transfer

2900 kB
Size

0
Cookies

56 HTTP transactions
1 data transactions