www.group-ib.ru Open in urlscan Pro
178.248.235.63 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://cert.group-ib.ru/
Effective URL:
https://www.group-ib.ru/cert.html
Submission: On January 22 via manual (January 22nd 2023, 1:27:50 am UTC) from UA — Scanned from DE

Summary HTTP 103 Redirects Links 39 Behaviour Indicators

Summary

This website contacted 31 IPs in 7 countries across 26 domains to perform 103 HTTP transactions. The main IP is 178.248.235.63, located in Russian Federation and belongs to QRATOR, RU. The main domain is www.group-ib.ru.
TLS certificate: Issued by Starfield Secure Certificate Authorit... on June 16th 2022. Valid for: a year.

This is the only time www.group-ib.ru was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 1	5.9.185.28 5.9.185.28	24940 (HETZNER-AS) (HETZNER-AS)
1 25	178.248.235.63 178.248.235.63	197068 (QRATOR) (QRATOR)
1	172.65.255.172 172.65.255.172	13335 (CLOUDFLAR...) (CLOUDFLARENET)
3	2a00:1450:400... 2a00:1450:4001:812::2008	15169 (GOOGLE) (GOOGLE)
5	2a03:2880:f08... 2a03:2880:f083:100:face:b00c:0:3	32934 (FACEBOOK) (FACEBOOK)
5	172.65.232.43 172.65.232.43	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	104.16.94.80 104.16.94.80	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	185.17.9.183 185.17.9.183	49505 (SELECTEL) (SELECTEL)
1	2606:4700::68... 2606:4700::6810:5705	13335 (CLOUDFLAR...) (CLOUDFLARENET)
3	2a00:1450:400... 2a00:1450:4001:830::200e	15169 (GOOGLE) (GOOGLE)
10	23.44.74.52 23.44.74.52	16625 (AKAMAI-AS) (AKAMAI-AS)
5 12	2a02:6b8::1:119 2a02:6b8::1:119	208722 (GLOBAL_DC) (GLOBAL_DC)
2	23.45.104.85 23.45.104.85	16625 (AKAMAI-AS) (AKAMAI-AS)
1	172.65.208.22 172.65.208.22	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	13.225.78.38 13.225.78.38	16509 (AMAZON-02) (AMAZON-02)
7	2a03:2880:f17... 2a03:2880:f176:181:face:b00c:0:25de	32934 (FACEBOOK) (FACEBOOK)
1	37.252.171.22 37.252.171.22	29990 (ASN-APPNEX) (ASN-APPNEX)
1	2a02:26f0:e30... 2a02:26f0:e300:182::1c91	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	2a00:1450:400... 2a00:1450:400c:c00::9b	15169 (GOOGLE) (GOOGLE)
1	199.15.214.243 199.15.214.243	15224 (OMNITURE) (OMNITURE)
1	172.65.238.60 172.65.238.60	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	172.65.219.229 172.65.219.229	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	172.65.192.122 172.65.192.122	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	172.65.202.201 172.65.202.201	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	52.6.202.178 52.6.202.178	14618 (AMAZON-AES) (AMAZON-AES)
6	2a00:1450:400... 2a00:1450:400d:80a::2004	15169 (GOOGLE) (GOOGLE)
6	2a00:1450:400... 2a00:1450:4001:830::2003	15169 (GOOGLE) (GOOGLE)
1	172.65.193.34 172.65.193.34	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700::68... 2606:4700::6811:cacc	13335 (CLOUDFLAR...) (CLOUDFLARENET)
5	2a00:1450:400... 2a00:1450:4001:829::2002	15169 (GOOGLE) (GOOGLE)
3	172.65.240.166 172.65.240.166	13335 (CLOUDFLAR...) (CLOUDFLARENET)
103	31

1 5.9.185.28 (Germany) 1 redirects

ASN24940 (HETZNER-AS, DE)
PTR: static.28.185.9.5.clients.your-server.de

cert.group-ib.ru	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

25 178.248.235.63 (Russian Federation) 1 redirects

ASN197068 (QRATOR, RU)

www.group-ib.ru	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 172.65.255.172 (United States)

ASN13335 (CLOUDFLARENET, US)

js-eu1.hsforms.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:812::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2a03:2880:f083:100:face:b00c:0:3 (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 172.65.232.43 (United States)

ASN13335 (CLOUDFLARENET, US)

forms-eu1.hsforms.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.16.94.80 (None, )

ASN13335 (CLOUDFLARENET, US)

app-lon09.marketo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 185.17.9.183 (St Petersburg, Russian Federation)

ASN49505 (SELECTEL, RU)

ru.id.group-ib.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6810:5705 (United States)

ASN13335 (CLOUDFLARENET, US)

forms.hsforms.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:830::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 23.44.74.52 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a23-44-74-52.deploy.static.akamaitechnologies.com

j.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
c.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
b.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

12 2a02:6b8::1:119 (Moscow, Russian Federation) 5 redirects

ASN208722 (GLOBAL_DC, FI)

mc.yandex.ru	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
mc.yandex.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 23.45.104.85 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a23-45-104-85.deploy.static.akamaitechnologies.com

munchkin.marketo.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 172.65.208.22 (United States)

ASN13335 (CLOUDFLARENET, US)

js-eu1.hs-scripts.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.225.78.38 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-225-78-38.fra2.r.cloudfront.net

cdn.neverbounce.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 2a03:2880:f176:181:face:b00c:0:25de (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 37.252.171.22 (Frankfurt am Main, Germany)

ASN29990 (ASN-APPNEX, US)
PTR: 1001.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net

secure.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:26f0:e300:182::1c91 (Prague, Czech Republic)

ASN20940 (AKAMAI-ASN1, NL)

ipv6.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:400c:c00::9b (Brussels, Belgium)

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 199.15.214.243 (United States)

ASN15224 (OMNITURE, US)

689-lre-818.mktoresp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 172.65.238.60 (United States)

ASN13335 (CLOUDFLARENET, US)

js-eu1.hs-analytics.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 172.65.219.229 (United States)

ASN13335 (CLOUDFLARENET, US)

js-eu1.hsadspixel.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 172.65.192.122 (United States)

ASN13335 (CLOUDFLARENET, US)

js-eu1.hscollectedforms.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 172.65.202.201 (United States)

ASN13335 (CLOUDFLARENET, US)

js-eu1.hs-banner.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.6.202.178 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-6-202-178.compute-1.amazonaws.com

api.neverbounce.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2a00:1450:400d:80a::2004 (Ireland)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2a00:1450:4001:830::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 172.65.193.34 (United States)

ASN13335 (CLOUDFLARENET, US)

forms-eu1.hubspot.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6811:cacc (United States)

ASN13335 (CLOUDFLARENET, US)

api-eu1.hubapi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2a00:1450:4001:829::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 172.65.240.166 (United States)

ASN13335 (CLOUDFLARENET, US)

track-eu1.hubspot.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
26	group-ib.ru 2 redirects cert.group-ib.ru www.group-ib.ru	6 MB
11	6sc.co j.6sc.co — Cisco Umbrella Rank: 6055 c.6sc.co — Cisco Umbrella Rank: 8967 ipv6.6sc.co — Cisco Umbrella Rank: 6442 b.6sc.co — Cisco Umbrella Rank: 4373	14 KB
9	yandex.com 3 redirects mc.yandex.com — Cisco Umbrella Rank: 9296	3 KB
7	facebook.com www.facebook.com — Cisco Umbrella Rank: 114	294 B
6	google.de www.google.de — Cisco Umbrella Rank: 5983	911 B
6	google.com www.google.com — Cisco Umbrella Rank: 2	911 B
6	doubleclick.net stats.g.doubleclick.net — Cisco Umbrella Rank: 75 googleads.g.doubleclick.net — Cisco Umbrella Rank: 33	6 KB
6	hsforms.com forms-eu1.hsforms.com — Cisco Umbrella Rank: 36145 forms.hsforms.com — Cisco Umbrella Rank: 3863	4 KB
5	facebook.net connect.facebook.net — Cisco Umbrella Rank: 153	437 KB
4	hubspot.com forms-eu1.hubspot.com — Cisco Umbrella Rank: 31002 track-eu1.hubspot.com — Cisco Umbrella Rank: 22176	3 KB
3	yandex.ru 2 redirects mc.yandex.ru — Cisco Umbrella Rank: 3602	73 KB
3	google-analytics.com www.google-analytics.com — Cisco Umbrella Rank: 22	64 KB
3	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 41	203 KB
2	neverbounce.com cdn.neverbounce.com — Cisco Umbrella Rank: 106670 api.neverbounce.com — Cisco Umbrella Rank: 58205	29 KB
2	marketo.net munchkin.marketo.net — Cisco Umbrella Rank: 3035	6 KB
1	hubapi.com api-eu1.hubapi.com — Cisco Umbrella Rank: 34425	912 B
1	hs-banner.com js-eu1.hs-banner.com — Cisco Umbrella Rank: 20457	63 KB
1	hscollectedforms.net js-eu1.hscollectedforms.net — Cisco Umbrella Rank: 32074	25 KB
1	hsadspixel.net js-eu1.hsadspixel.net — Cisco Umbrella Rank: 32623	3 KB
1	hs-analytics.net js-eu1.hs-analytics.net — Cisco Umbrella Rank: 21100	21 KB
1	mktoresp.com 689-lre-818.mktoresp.com	121 B
1	adnxs.com secure.adnxs.com — Cisco Umbrella Rank: 413	822 B
1	hs-scripts.com js-eu1.hs-scripts.com — Cisco Umbrella Rank: 19188	884 B
1	group-ib.com ru.id.group-ib.com — Cisco Umbrella Rank: 203440	1 KB
1	marketo.com app-lon09.marketo.com — Cisco Umbrella Rank: 406297	69 KB
1	hsforms.net js-eu1.hsforms.net — Cisco Umbrella Rank: 73802	159 KB
103	26

	Domain	Requested by
25	www.group-ib.ru	1 redirects www.group-ib.ru
9	mc.yandex.com	3 redirects www.group-ib.ru
8	b.6sc.co	www.group-ib.ru
7	www.facebook.com	www.group-ib.ru
6	www.google.de	www.group-ib.ru
6	www.google.com	www.group-ib.ru
5	googleads.g.doubleclick.net	www.googletagmanager.com
5	forms-eu1.hsforms.com	www.group-ib.ru js-eu1.hscollectedforms.net
5	connect.facebook.net	www.group-ib.ru connect.facebook.net
3	track-eu1.hubspot.com
3	mc.yandex.ru	2 redirects www.group-ib.ru
3	www.google-analytics.com	www.googletagmanager.com www.group-ib.ru
3	www.googletagmanager.com	www.group-ib.ru js-eu1.hsadspixel.net www.googletagmanager.com
2	munchkin.marketo.net	www.group-ib.ru munchkin.marketo.net
1	api-eu1.hubapi.com	www.group-ib.ru
1	forms-eu1.hubspot.com	www.group-ib.ru
1	api.neverbounce.com	cdn.neverbounce.com
1	js-eu1.hs-banner.com	js-eu1.hs-scripts.com
1	js-eu1.hscollectedforms.net	js-eu1.hs-scripts.com
1	js-eu1.hsadspixel.net	js-eu1.hs-scripts.com
1	js-eu1.hs-analytics.net	js-eu1.hs-scripts.com
1	689-lre-818.mktoresp.com	www.group-ib.ru
1	stats.g.doubleclick.net	www.group-ib.ru
1	ipv6.6sc.co	www.group-ib.ru
1	c.6sc.co	www.group-ib.ru
1	secure.adnxs.com	www.group-ib.ru
1	cdn.neverbounce.com	www.googletagmanager.com
1	js-eu1.hs-scripts.com	www.googletagmanager.com
1	j.6sc.co	www.group-ib.ru
1	forms.hsforms.com	www.group-ib.ru
1	ru.id.group-ib.com	www.group-ib.ru
1	app-lon09.marketo.com	www.group-ib.ru
1	js-eu1.hsforms.net	www.group-ib.ru
1	cert.group-ib.ru	1 redirects
103	34

This site contains links to these domains. Also see Links.

Domain
www.group-ib.com
twitter.com
t.me
www.youtube.com
www.first.org
www.trusted-introducer.org
www.oic-cert.org
apwg.org
habr.com
tass.ru
rigf.ru
www.kommersant.ru
rg.ru
iz.ru
on.lenos.com
vk.com
www.bfm.ru
1prime.ru
www.rbc.ru
www.it-world.ru
www.forbes.ru
www.vesti.ru
ria.ru

Subject Issuer	Validity	Valid
group-ib.com Starfield Secure Certificate Authority - G2	`2022-06-16` - `2023-06-16`	a year	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2022-06-15` - `2023-06-15`	a year	crt.sh
*.google-analytics.com GTS CA 1C3	`2023-01-02` - `2023-03-27`	3 months	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2022-10-31` - `2023-01-29`	3 months	crt.sh
app-lon09.marketo.com Cloudflare Inc ECC CA-3	`2022-05-01` - `2023-05-01`	a year	crt.sh
*.id.group-ib.com R3	`2022-12-29` - `2023-03-29`	3 months	crt.sh
*.6sc.co DigiCert TLS Hybrid ECC SHA384 2020 CA1	`2022-03-08` - `2023-03-11`	a year	crt.sh
mc.yandex.ru GlobalSign ECC OV SSL CA 2018	`2022-10-18` - `2023-03-30`	5 months	crt.sh
*.marketo.net DigiCert SHA2 Secure Server CA	`2022-02-06` - `2023-02-07`	a year	crt.sh
neverbounce.com Amazon	`2022-02-28` - `2023-03-28`	a year	crt.sh
*.adnxs.com GeoTrust ECC CA 2018	`2022-02-11` - `2023-03-14`	a year	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2023-01-02` - `2023-03-27`	3 months	crt.sh
*.mktoresp.com DigiCert TLS RSA SHA256 2020 CA1	`2022-10-05` - `2023-11-05`	a year	crt.sh
www.google.com GTS CA 1C3	`2023-01-02` - `2023-03-27`	3 months	crt.sh
www.google.de GTS CA 1C3	`2023-01-02` - `2023-03-27`	3 months	crt.sh
hubspot.com Cloudflare Inc ECC CA-3	`2022-03-08` - `2023-03-07`	a year	crt.sh
hubapi.com Cloudflare Inc ECC CA-3	`2022-05-07` - `2023-05-07`	a year	crt.sh
*.google.com GTS CA 1C3	`2023-01-02` - `2023-03-27`	3 months	crt.sh
*.google.de GTS CA 1C3	`2023-01-02` - `2023-03-27`	3 months	crt.sh

This page contains 5 frames:

Primary Page: https://www.group-ib.ru/cert.html
Frame ID: CD53DF43B87D7809541C242C5626C0A3
Requests: 109 HTTP requests in this frame

Frame: https://ru.id.group-ib.com/id.html
Frame ID: CA7C34B29D15432078735619411CAB10
Requests: 1 HTTP requests in this frame

Frame: https://www.facebook.com/tr/
Frame ID: 163AC3EA03EDE50C20CF66A6382D9851
Requests: 1 HTTP requests in this frame

Frame: https://www.facebook.com/tr/
Frame ID: 21C04568861D949EFAF039DB2FF12B40
Requests: 1 HTTP requests in this frame

Frame: https://www.facebook.com/tr/
Frame ID: A523B5C00728C2746B27606C70191414
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Группа оперативного реагирования на инциденты информационной безопасности - CERT-GIB

Page URL History Show full URLs

http://cert.group-ib.ru/ HTTP 301
http://www.group-ib.ru/cert.html HTTP 301
https://www.group-ib.ru/cert.html Page URL

Detected technologies

AppNexus (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

adnxs\.(?:net|com)

Facebook (Widgets) Expand

Overall confidence: 100%
Detected patterns

//connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

google-analytics\.com/(?:ga|urchin|analytics)\.js

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtm\.js
googletagmanager\.com/gtag/js

Marketo (Marketing Automation) Expand

Overall confidence: 100%
Detected patterns

munchkin\.marketo\.\w+/(?:([\d.]+)/)?munchkin\.js

Marketo Forms (Widgets) Expand

Overall confidence: 100%
Detected patterns

marketo\.\w+/js/forms(?:[\d.]+)/js/forms([\d.]+)\.min\.js

Yandex.Metrika (Analytics) Expand

Overall confidence: 100%
Detected patterns

mc\.yandex\.ru/metrika/(?:tag|watch)\.js

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

103
Requests

97 %
HTTPS

39 %
IPv6

26
Domains

34
Subdomains

31
IPs

7
Countries

7357 kB
Transfer

11712 kB
Size

42
Cookies

39 Outgoing links

These are links going to different origins than the main page.

URL: https://www.group-ib.com/cert.html?__hstc=124113877.90d90f6633ed5c41db2098864a2fb278.1674350865008.1674350865008.1674350865008.1&__hssc=124113877.1.1674350865008&__hsfp=3997732991
Title: english

Search URL Search Domain Scan URL

URL: https://twitter.com/groupib

Search URL Search Domain Scan URL

URL: https://t.me/Group_IB

Search URL Search Domain Scan URL

URL: https://www.youtube.com/user/GroupIB

Search URL Search Domain Scan URL

URL: https://www.first.org/members/teams/cert-gib
Title: Аккредитованный член сообщества FIRST (Forum of Incident Response and Security Teams)

Search URL Search Domain Scan URL

URL: https://www.trusted-introducer.org/directory/teams/cert-gib.html
Title: Аккредитованный член сообщества Trusted Introducer (Services for Security and Incident Response Teams)

Search URL Search Domain Scan URL

URL: https://www.oic-cert.org/en/commercialmembers.html#.X8dG3WgzY2w
Title: Член организации OIC-CERT (Organisation of The Islamic Cooperation — Computer Emergency Response Teams)

Search URL Search Domain Scan URL

URL: https://apwg.org/group-ib-enhances-data-exchange-operations-by-joining-anti-phishing-working-group/
Title: Член международного сообщества APWG (Anti-Phishing Working Group)

Search URL Search Domain Scan URL

URL: https://habr.com/ru/company/group-ib/blog/565264/
Title: Harb

Search URL Search Domain Scan URL

URL: https://habr.com/ru/company/group-ib/blog/552044/
Title: Harb

Search URL Search Domain Scan URL

URL: https://tass.ru/ekonomika/11438719
Title: TASS

Search URL Search Domain Scan URL

URL: https://www.youtube.com/watch?v=3wXft0uVltI
Title: YouTube

Search URL Search Domain Scan URL

URL: https://rigf.ru/prog/?p=prog
Title: RIGF

Search URL Search Domain Scan URL

URL: https://www.kommersant.ru/doc/4743275
Title: Коммерсант

Search URL Search Domain Scan URL

URL: https://www.kommersant.ru/doc/4721121
Title: Коммерсант

Search URL Search Domain Scan URL

URL: https://rg.ru/2021/03/01/polzovatelej-android-atakovali-moshenniki-obeshchaiushchie-denezhnye-vyplaty.html
Title: Российская газета

Search URL Search Domain Scan URL

URL: https://iz.ru/1114569/ivan-petrov/ushli-v-onlain-v-rossii-stalo-menshe-ubiitc-i-bolshe-aferistov
Title: Известия

Search URL Search Domain Scan URL

URL: https://www.oic-cert.org/en/events/conference/2020.html
Title: OIC-CERT

Search URL Search Domain Scan URL

URL: https://tass.ru/ekonomika/10042047?utm_source=yxnews&utm_medium=desktop
Title: ТАСС

Search URL Search Domain Scan URL

URL: https://on.lenos.com/antiphishing/Virtual-eCrime-2020/Home
Title: APWG

Search URL Search Domain Scan URL

URL: https://vk.com/wall-112261161_1807
Title: VK

Search URL Search Domain Scan URL

URL: https://www.bfm.ru/news/455946
Title: Business FM

Search URL Search Domain Scan URL

URL: https://1prime.ru/telecommunications_and_technologies/20201019/832180292.html
Title: Прайм

Search URL Search Domain Scan URL

URL: https://iz.ru/1071698/anastasiia-gavriliuk/s-obrazom-i-podobiem-44-krupnogo-biznesa-dopuskaet-rassylku-fishinga
Title: Известия

Search URL Search Domain Scan URL

URL: https://www.rbc.ru/technology_and_media/06/10/2020/5f7bf6239a7947445554efd7
Title: РБК

Search URL Search Domain Scan URL

URL: https://1prime.ru/telecommunications_and_technologies/20201005/832113027.html
Title: Прайм

Search URL Search Domain Scan URL

URL: https://www.rbc.ru/society/19/08/2020/5f3cfaa59a79475585546035
Title: РБК

Search URL Search Domain Scan URL

URL: https://www.kommersant.ru/doc/4459083
Title: Коммерсант

Search URL Search Domain Scan URL

URL: https://www.it-world.ru/cionews/manage_secure/153868.html
Title: IT World

Search URL Search Domain Scan URL

URL: https://www.forbes.ru/newsroom/obshchestvo/400905-moshenniki-aktivirovali-shemu-hishcheniy-s-onlayn-pokupkami-i-lozhnymi
Title: Forbes

Search URL Search Domain Scan URL

URL: https://www.rbc.ru/rbcfreenews/5ec424169a794740e41b4959
Title: РБК

Search URL Search Domain Scan URL

URL: https://www.kommersant.ru/doc/4340980
Title: Коммерсант

Search URL Search Domain Scan URL

URL: https://www.rbc.ru/rbcfreenews/5eb517cf9a79477cc37a15d0
Title: РБК

Search URL Search Domain Scan URL

URL: https://www.vesti.ru/doc.html?id=3257206
Title: Вести

Search URL Search Domain Scan URL

URL: https://ria.ru/20200410/1569836770.html
Title: РИА

Search URL Search Domain Scan URL

URL: https://iz.ru/997326/2020-04-09/v-group-ib-predupredili-o-novom-vide-internet-moshennichestva
Title: Известия

Search URL Search Domain Scan URL

URL: https://www.kommersant.ru/doc/4317290
Title: Коммерсант

Search URL Search Domain Scan URL

URL: https://www.kommersant.ru/doc/4260958
Title: Коммерсант

Search URL Search Domain Scan URL

URL: https://tass.ru/ekonomika/7803461
Title: ТАСС

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://cert.group-ib.ru/ HTTP 301
http://www.group-ib.ru/cert.html HTTP 301
https://www.group-ib.ru/cert.html Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 72

https://mc.yandex.com/sync_cookie_image_check HTTP 302
https://mc.yandex.ru/sync_cookie_image_start?redirect_domain=mc.yandex.com&token=9890.-sjHfYSmdXmZYFNkuUMZ1IzCCkbwGsVVrkALFRiXn6PiUOIvoTTHDF7_vvRWbgGd.7fpCW5UwfQdjI0zxLWt6fAKBDEc%2C HTTP 302
https://mc.yandex.com/sync_cookie_image_decide?token=9890.82qW9z3HTBKd_Vpl19-T_erIquMBh07Cuxg3DyZzm28K19qIgkxBtKSNNDVfmTQXD7sIpvchmQNiqV0jGhhWdqx-ZXg1RbB-3d5giQPriaQ%2C.hIoEIKX8pmuiUqkUdSjK3B-A03Y%2C

Request Chain 78

https://mc.yandex.com/watch/20002900?wmode=7&page-url=https%3A%2F%2Fwww.group-ib.ru%2Fcert.html&charset=utf-8&browser-info=pv%3A1%3Avf%3Asmv4ejgykhrjvgldb09nr%3Afp%3A864%3Afu%3A0%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A960%3Acn%3A1%3Adp%3A0%3Als%3A1633329359918%3Ahid%3A411530536%3Az%3A0%3Ai%3A20230122012744%3Aet%3A1674350865%3Ac%3A1%3Arn%3A177700697%3Arqn%3A1%3Au%3A167435086512125606%3Aw%3A1600x1200%3As%3A1600x1200x24%3Ask%3A1%3Awv%3A2%3Ads%3A0%2C30%2C110%2C1%2C249%2C0%2C%2C770%2C0%2C%2C%2C%2C1161%3Aco%3A0%3Acpf%3A1%3Ans%3A1674350863126%3Aadb%3A2%3Arqnl%3A1%3Ast%3A1674350865%3At%3A%D0%93%D1%80%D1%83%D0%BF%D0%BF%D0%B0%20%D0%BE%D0%BF%D0%B5%D1%80%D0%B0%D1%82%D0%B8%D0%B2%D0%BD%D0%BE%D0%B3%D0%BE%20%D1%80%D0%B5%D0%B0%D0%B3%D0%B8%D1%80%D0%BE%D0%B2%D0%B0%D0%BD%D0%B8%D1%8F%20%D0%BD%D0%B0%20%D0%B8%D0%BD%D1%86%D0%B8%D0%B4%D0%B5%D0%BD%D1%82%D1%8B%20%D0%B8%D0%BD%D1%84%D0%BE%D1%80%D0%BC%D0%B0%D1%86%D0%B8%D0%BE%D0%BD%D0%BD%D0%BE%D0%B9%20%D0%B1%D0%B5%D0%B7%D0%BE%D0%BF%D0%B0%D1%81%D0%BD%D0%BE%D1%81%D1%82%D0%B8%20-%20CERT-GIB&t=gdpr(14)clc(0-0-0)rqnt(1)aw(1)ti(2) HTTP 302
https://mc.yandex.com/watch/20002900/1?wmode=7&page-url=https%3A%2F%2Fwww.group-ib.ru%2Fcert.html&charset=utf-8&browser-info=pv%3A1%3Avf%3Asmv4ejgykhrjvgldb09nr%3Afp%3A864%3Afu%3A0%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A960%3Acn%3A1%3Adp%3A0%3Als%3A1633329359918%3Ahid%3A411530536%3Az%3A0%3Ai%3A20230122012744%3Aet%3A1674350865%3Ac%3A1%3Arn%3A177700697%3Arqn%3A1%3Au%3A167435086512125606%3Aw%3A1600x1200%3As%3A1600x1200x24%3Ask%3A1%3Awv%3A2%3Ads%3A0%2C30%2C110%2C1%2C249%2C0%2C%2C770%2C0%2C%2C%2C%2C1161%3Aco%3A0%3Acpf%3A1%3Ans%3A1674350863126%3Aadb%3A2%3Arqnl%3A1%3Ast%3A1674350865%3At%3A%D0%93%D1%80%D1%83%D0%BF%D0%BF%D0%B0%20%D0%BE%D0%BF%D0%B5%D1%80%D0%B0%D1%82%D0%B8%D0%B2%D0%BD%D0%BE%D0%B3%D0%BE%20%D1%80%D0%B5%D0%B0%D0%B3%D0%B8%D1%80%D0%BE%D0%B2%D0%B0%D0%BD%D0%B8%D1%8F%20%D0%BD%D0%B0%20%D0%B8%D0%BD%D1%86%D0%B8%D0%B4%D0%B5%D0%BD%D1%82%D1%8B%20%D0%B8%D0%BD%D1%84%D0%BE%D1%80%D0%BC%D0%B0%D1%86%D0%B8%D0%BE%D0%BD%D0%BD%D0%BE%D0%B9%20%D0%B1%D0%B5%D0%B7%D0%BE%D0%BF%D0%B0%D1%81%D0%BD%D0%BE%D1%81%D1%82%D0%B8%20-%20CERT-GIB&t=gdpr%2814%29clc%280-0-0%29rqnt%281%29aw%281%29ti%282%29

Request Chain 83

https://mc.yandex.com/sync_cookie_image_check_secondary HTTP 302
https://mc.yandex.ru/sync_cookie_image_start_secondary?redirect_domain=mc.yandex.com&token=9890.0oZ9OO9CBQCA01J2awr8Gm3Efvp4fmi0OIBAId3Y384rKFdY45KG-d5OSf_jEO0T.Klgv6HsB-JLAVL6jtIT4krB4C98%2C HTTP 302
https://mc.yandex.com/sync_cookie_image_decide_secondary?token=9890.rFTU71NZQez5NoEzmmWRh94cpMI9wPF_psSGih38pMEHJWLfaHMJCJU2Hzx2FFyPFpkWYPNVbMXmZhJ2ainm7nECTDod3AfDCPwF5s7isiw%2C.TWbdiM4ADK9fOM2oa-0Ns7lfvkY%2C

103 HTTP transactions
10 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1

200
OK

Primary Request cert.html Show response
www.group-ib.ru/
Redirect Chain

http://cert.group-ib.ru/
http://www.group-ib.ru/cert.html
https://www.group-ib.ru/cert.html

62 KB
18 KB

141ms
110ms

Document
text/html

178.248.235.63
QRATOR

General

Check archive.org

Show headers Download Go to

Full URL

https://www.group-ib.ru/cert.html

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

178.248.235.63 , Russian Federation, ASN197068 (QRATOR, RU),

Reverse DNS

Software

QRATOR /

Resource Hash

4ae85ebb7e7e9f69f267f3b921071f76b843730bced7762ba2def648c8b7c0b7

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
Strict-Transport-Security	max-age=15724800; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept, Authorization *
Access-Control-Allow-Methods: GET,HEAD,OPTIONS,POST,PUT
Access-Control-Allow-Origin: https://2020.group-ib.ru
Connection: keep-alive
Content-Encoding: gzip
Content-Security-Policy: frame-ancestors 'self'
Content-Type: text/html; charset=UTF-8
Date: Sun, 22 Jan 2023 01:27:43 GMT
Feature-Policy: camera 'none'; microphone 'none'; geolocation 'none'; encrypted-media 'none'; payment 'none'; speaker 'none'; usb 'none';
Keep-Alive: timeout=15
Permissions-Policy: camera=(), microphone=(), geolocation=(), encrypted-media=(), payment=(), speaker=(), usb=(),
Referrer-Policy: no-referrer
Server: QRATOR
Strict-Transport-Security: max-age=15724800; includeSubDomains
Transfer-Encoding: chunked
X-Content-Type-Options: nosniff
X-Dns-Prefetch-Control: off
X-Download-Options: noopen
X-Frame-Options: SAMEORIGIN
X-Xss-Protection: 1; mode=block

Redirect headers

Connection: keep-alive
Content-Length: 185
Content-Type: text/html
Date: Sun, 22 Jan 2023 01:27:43 GMT
Keep-Alive: timeout=15
Location: https://www.group-ib.ru/cert.html
Server: QRATOR

GET
H/1.1 200
OK hubspot-form-0d3ea2cd.css
www.group-ib.ru/hubspot-form/ 4 KB
2 KB 92ms
91ms Stylesheet
text/css 178.248.235.63
QRATOR

General

Check archive.org

Show headers Download Go to

Full URL

https://www.group-ib.ru/hubspot-form/hubspot-form-0d3ea2cd.css

Requested by

Host: www.group-ib.ru
URL: https://www.group-ib.ru/cert.html

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

178.248.235.63 , Russian Federation, ASN197068 (QRATOR, RU),

Reverse DNS

Software

QRATOR /

Resource Hash

66d609b0c975493c48e785524fbb6cfa5d28ea59d8d7e5e12bd4a8c5b8556f67

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
Strict-Transport-Security	max-age=15724800; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

Date: Sun, 22 Jan 2023 01:27:43 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Content-Security-Policy: frame-ancestors 'self'
Strict-Transport-Security: max-age=15724800; includeSubDomains
X-Dns-Prefetch-Control: off
Connection: keep-alive
Content-Length: 1087
X-Xss-Protection: 1; mode=block
Referrer-Policy: no-referrer
Last-Modified: Sun, 22 May 2022 20:14:32 GMT
Server: QRATOR
Etag: W/"628a99a8-ef7"
X-Download-Options: noopen
X-Frame-Options: SAMEORIGIN
Access-Control-Allow-Methods: GET,HEAD,OPTIONS,POST,PUT
Content-Type: text/css
Access-Control-Allow-Origin: https://2020.group-ib.ru
Cache-Control: max-age=604800
Feature-Policy: camera 'none'; microphone 'none'; geolocation 'none'; encrypted-media 'none'; payment 'none'; speaker 'none'; usb 'none';
Permissions-Policy: camera=(), microphone=(), geolocation=(), encrypted-media=(), payment=(), speaker=(), usb=(),
Keep-Alive: timeout=15
Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept, Authorization, *
Expires: Sun, 29 Jan 2023 01:27:43 GMT

GET
H/1.1 200
OK main_26755_2be51925_563_1764.js Show response
www.group-ib.ru/build/ 297 KB
298 KB 328ms
300ms Script
application/javascript 178.248.235.63
QRATOR

General

Check archive.org

Show headers Download Go to

Full URL: https://www.group-ib.ru/build/main_26755_2be51925_563_1764.js
Requested by: Host: www.group-ib.ru
URL: https://www.group-ib.ru/cert.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 178.248.235.63 , Russian Federation, ASN197068 (QRATOR, RU),
Reverse DNS
Software: QRATOR /
Resource Hash: 844bb56d9d924583139e6f89aa998b215f3a7516cafc5e448c64e8cde29361e5

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

Date: Sun, 22 Jan 2023 01:27:43 GMT
Last-Modified: Wed, 25 May 2022 09:25:21 GMT
Server: QRATOR
ETag: "628df601-4a5d3"
Vary: Accept-Encoding, Accept-Encoding
Content-Type: application/javascript
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=15
Content-Length: 304595

GET
H/1.1 200
OK types-new-9cc690da.css
www.group-ib.ru/stylesheets/ 396 KB
306 KB 147ms
119ms Stylesheet
text/css 178.248.235.63
QRATOR

General

Check archive.org

Show headers Download Go to

Full URL

https://www.group-ib.ru/stylesheets/types-new-9cc690da.css

Requested by

Host: www.group-ib.ru
URL: https://www.group-ib.ru/cert.html

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

178.248.235.63 , Russian Federation, ASN197068 (QRATOR, RU),

Reverse DNS

Software

QRATOR /

Resource Hash

9e0c7a947ce776d962b239a6ca61da5e6ab31affa92d2812151632939d5240ec

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
Strict-Transport-Security	max-age=15724800; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

Date: Sun, 22 Jan 2023 01:27:43 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Content-Security-Policy: frame-ancestors 'self'
Strict-Transport-Security: max-age=15724800; includeSubDomains
Transfer-Encoding: chunked
X-Dns-Prefetch-Control: off
Connection: keep-alive
X-Xss-Protection: 1; mode=block
Referrer-Policy: no-referrer
Last-Modified: Thu, 13 May 2021 12:20:37 GMT
Server: QRATOR
Etag: W/"609d1995-62e38"
X-Download-Options: noopen
X-Frame-Options: SAMEORIGIN
Access-Control-Allow-Methods: GET,HEAD,OPTIONS,POST,PUT
Content-Type: text/css
Access-Control-Allow-Origin: https://2020.group-ib.ru
Cache-Control: max-age=604800
Feature-Policy: camera 'none'; microphone 'none'; geolocation 'none'; encrypted-media 'none'; payment 'none'; speaker 'none'; usb 'none';
Permissions-Policy: camera=(), microphone=(), geolocation=(), encrypted-media=(), payment=(), speaker=(), usb=(),
Keep-Alive: timeout=15
Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept, Authorization, *
Expires: Sun, 29 Jan 2023 01:27:43 GMT

GET
H/1.1 200
OK all-9e8937e3.css
www.group-ib.ru/stylesheets/ 1 MB
269 KB 86ms
58ms Stylesheet
text/css 178.248.235.63
QRATOR

General

Check archive.org

Show headers Download Go to

Full URL

https://www.group-ib.ru/stylesheets/all-9e8937e3.css

Requested by

Host: www.group-ib.ru
URL: https://www.group-ib.ru/cert.html

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

178.248.235.63 , Russian Federation, ASN197068 (QRATOR, RU),

Reverse DNS

Software

QRATOR /

Resource Hash

c4f8a2a7d6771629faaf97c7b81d67b0ebc2de9ef0138558ed27cd6a5d44ae19

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
Strict-Transport-Security	max-age=15724800; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

Date: Sun, 22 Jan 2023 01:27:43 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Content-Security-Policy: frame-ancestors 'self'
Strict-Transport-Security: max-age=15724800; includeSubDomains
Transfer-Encoding: chunked
X-Dns-Prefetch-Control: off
Connection: keep-alive
X-Xss-Protection: 1; mode=block
Referrer-Policy: no-referrer
Last-Modified: Tue, 11 Oct 2022 13:35:11 GMT
Server: QRATOR
Etag: W/"6345710f-1747cf"
X-Download-Options: noopen
X-Frame-Options: SAMEORIGIN
Access-Control-Allow-Methods: GET,HEAD,OPTIONS,POST,PUT
Content-Type: text/css
Access-Control-Allow-Origin: https://2020.group-ib.ru
Cache-Control: max-age=604800
Feature-Policy: camera 'none'; microphone 'none'; geolocation 'none'; encrypted-media 'none'; payment 'none'; speaker 'none'; usb 'none';
Permissions-Policy: camera=(), microphone=(), geolocation=(), encrypted-media=(), payment=(), speaker=(), usb=(),
Keep-Alive: timeout=15
Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept, Authorization, *
Expires: Sun, 29 Jan 2023 01:27:43 GMT

GET
H/1.1 200
OK jquery-96f076a3.js Show response
www.group-ib.ru/javascripts/ 85 KB
36 KB 143ms
113ms Script
application/javascript 178.248.235.63
QRATOR

General

Check archive.org

Show headers Download Go to

Full URL

https://www.group-ib.ru/javascripts/jquery-96f076a3.js

Requested by

Host: www.group-ib.ru
URL: https://www.group-ib.ru/cert.html

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

178.248.235.63 , Russian Federation, ASN197068 (QRATOR, RU),

Reverse DNS

Software

QRATOR /

Resource Hash

fe9a7ca1e475140e6b37fbc86a5efcd3251be4348137aa07231bd91ee8678b7c

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
Strict-Transport-Security	max-age=15724800; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

Date: Sun, 22 Jan 2023 01:27:43 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Content-Security-Policy: frame-ancestors 'self'
Strict-Transport-Security: max-age=15724800; includeSubDomains
Transfer-Encoding: chunked
X-Dns-Prefetch-Control: off
Connection: keep-alive
X-Xss-Protection: 1; mode=block
Referrer-Policy: no-referrer
Last-Modified: Wed, 17 Mar 2021 09:38:31 GMT
Server: QRATOR
Etag: W/"6051ce17-1550b"
X-Download-Options: noopen
X-Frame-Options: SAMEORIGIN
Access-Control-Allow-Methods: GET,HEAD,OPTIONS,POST,PUT
Content-Type: application/javascript
Access-Control-Allow-Origin: https://2020.group-ib.ru
Cache-Control: max-age=604800
Feature-Policy: camera 'none'; microphone 'none'; geolocation 'none'; encrypted-media 'none'; payment 'none'; speaker 'none'; usb 'none';
Permissions-Policy: camera=(), microphone=(), geolocation=(), encrypted-media=(), payment=(), speaker=(), usb=(),
Keep-Alive: timeout=15
Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept, Authorization, *
Expires: Sun, 29 Jan 2023 01:27:43 GMT

GET
H/1.1 200
OK all-5b99efc3.js Show response
www.group-ib.ru/javascripts/ 199 KB
71 KB 105ms
105ms Script
application/javascript 178.248.235.63
QRATOR

General

Check archive.org

Show headers Download Go to

Full URL

https://www.group-ib.ru/javascripts/all-5b99efc3.js

Requested by

Host: www.group-ib.ru
URL: https://www.group-ib.ru/cert.html

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

178.248.235.63 , Russian Federation, ASN197068 (QRATOR, RU),

Reverse DNS

Software

QRATOR /

Resource Hash

4be0d762af4ae8418408070645019a56fa8f363350b7cc6199eb49e8dc6618c0

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
Strict-Transport-Security	max-age=15724800; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

Date: Sun, 22 Jan 2023 01:27:44 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Content-Security-Policy: frame-ancestors 'self'
Strict-Transport-Security: max-age=15724800; includeSubDomains
Transfer-Encoding: chunked
X-Dns-Prefetch-Control: off
Connection: keep-alive
X-Xss-Protection: 1; mode=block
Referrer-Policy: no-referrer
Last-Modified: Wed, 07 Jul 2021 04:14:46 GMT
Server: QRATOR
Etag: W/"60e52a36-31a0f"
X-Download-Options: noopen
X-Frame-Options: SAMEORIGIN
Access-Control-Allow-Methods: GET,HEAD,OPTIONS,POST,PUT
Content-Type: application/javascript
Access-Control-Allow-Origin: https://2020.group-ib.ru
Cache-Control: max-age=604800
Feature-Policy: camera 'none'; microphone 'none'; geolocation 'none'; encrypted-media 'none'; payment 'none'; speaker 'none'; usb 'none';
Permissions-Policy: camera=(), microphone=(), geolocation=(), encrypted-media=(), payment=(), speaker=(), usb=(),
Keep-Alive: timeout=15
Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept, Authorization, *
Expires: Sun, 29 Jan 2023 01:27:43 GMT

GET
H/1.1 200
OK first@2x.png
www.group-ib.ru/images/cert-partners/ 5 KB
6 KB 74ms
73ms Image
image/png 178.248.235.63
QRATOR

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.group-ib.ru/images/cert-partners/first@2x.png

Requested by

Host: www.group-ib.ru
URL: https://www.group-ib.ru/cert.html

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

178.248.235.63 , Russian Federation, ASN197068 (QRATOR, RU),

Reverse DNS

Software

QRATOR /

Resource Hash

dd2344a168bef37c706400f1a5656fc16f231ad7e43744132c8b08e8474a33ca

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
Strict-Transport-Security	max-age=15724800; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

Date: Sun, 22 Jan 2023 01:27:43 GMT
Content-Security-Policy: frame-ancestors 'self'
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=15724800; includeSubDomains
X-Dns-Prefetch-Control: off
Connection: keep-alive
Content-Length: 4950
X-Xss-Protection: 1; mode=block
Referrer-Policy: no-referrer
Last-Modified: Wed, 17 Mar 2021 06:25:04 GMT
Server: QRATOR
Etag: "6051a0c0-1356"
X-Download-Options: noopen
X-Frame-Options: SAMEORIGIN
Access-Control-Allow-Methods: GET,HEAD,OPTIONS,POST,PUT
Content-Type: image/png
Access-Control-Allow-Origin: https://2020.group-ib.ru
Cache-Control: max-age=604800
Feature-Policy: camera 'none'; microphone 'none'; geolocation 'none'; encrypted-media 'none'; payment 'none'; speaker 'none'; usb 'none';
Permissions-Policy: camera=(), microphone=(), geolocation=(), encrypted-media=(), payment=(), speaker=(), usb=(),
Accept-Ranges: bytes
Keep-Alive: timeout=15
Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept, Authorization, *
Expires: Sun, 29 Jan 2023 01:27:43 GMT

GET
H/1.1 200
OK ti@2x.png
www.group-ib.ru/images/cert-partners/ 5 KB
6 KB 33ms
32ms Image
image/png 178.248.235.63
QRATOR

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.group-ib.ru/images/cert-partners/ti@2x.png

Requested by

Host: www.group-ib.ru
URL: https://www.group-ib.ru/cert.html

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

178.248.235.63 , Russian Federation, ASN197068 (QRATOR, RU),

Reverse DNS

Software

QRATOR /

Resource Hash

09273e08ac3dfff9b50d542399a39e01549d1eb79202aba74cbdc4bca5849372

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
Strict-Transport-Security	max-age=15724800; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

Date: Sun, 22 Jan 2023 01:27:44 GMT
Content-Security-Policy: frame-ancestors 'self'
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=15724800; includeSubDomains
X-Dns-Prefetch-Control: off
Connection: keep-alive
Content-Length: 4781
X-Xss-Protection: 1; mode=block
Referrer-Policy: no-referrer
Last-Modified: Wed, 17 Mar 2021 06:25:04 GMT
Server: QRATOR
Etag: "6051a0c0-12ad"
X-Download-Options: noopen
X-Frame-Options: SAMEORIGIN
Access-Control-Allow-Methods: GET,HEAD,OPTIONS,POST,PUT
Content-Type: image/png
Access-Control-Allow-Origin: https://2020.group-ib.ru
Cache-Control: max-age=604800
Feature-Policy: camera 'none'; microphone 'none'; geolocation 'none'; encrypted-media 'none'; payment 'none'; speaker 'none'; usb 'none';
Permissions-Policy: camera=(), microphone=(), geolocation=(), encrypted-media=(), payment=(), speaker=(), usb=(),
Accept-Ranges: bytes
Keep-Alive: timeout=15
Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept, Authorization, *
Expires: Sun, 29 Jan 2023 01:27:43 GMT

GET
H/1.1 200
OK impact@2x.png
www.group-ib.ru/images/cert-partners/ 3 KB
4 KB 37ms
35ms Image
image/png 178.248.235.63
QRATOR

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.group-ib.ru/images/cert-partners/impact@2x.png

Requested by

Host: www.group-ib.ru
URL: https://www.group-ib.ru/cert.html

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

178.248.235.63 , Russian Federation, ASN197068 (QRATOR, RU),

Reverse DNS

Software

QRATOR /

Resource Hash

3030463296e8b29cd70142df3707770a0b89f54c191f62974b2373f8454963b5

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
Strict-Transport-Security	max-age=15724800; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

Date: Sun, 22 Jan 2023 01:27:44 GMT
Content-Security-Policy: frame-ancestors 'self'
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=15724800; includeSubDomains
X-Dns-Prefetch-Control: off
Connection: keep-alive
Content-Length: 3007
X-Xss-Protection: 1; mode=block
Referrer-Policy: no-referrer
Last-Modified: Wed, 17 Mar 2021 06:25:04 GMT
Server: QRATOR
Etag: "6051a0c0-bbf"
X-Download-Options: noopen
X-Frame-Options: SAMEORIGIN
Access-Control-Allow-Methods: GET,HEAD,OPTIONS,POST,PUT
Content-Type: image/png
Access-Control-Allow-Origin: https://2020.group-ib.ru
Cache-Control: max-age=604800
Feature-Policy: camera 'none'; microphone 'none'; geolocation 'none'; encrypted-media 'none'; payment 'none'; speaker 'none'; usb 'none';
Permissions-Policy: camera=(), microphone=(), geolocation=(), encrypted-media=(), payment=(), speaker=(), usb=(),
Accept-Ranges: bytes
Keep-Alive: timeout=15
Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept, Authorization, *
Expires: Sun, 29 Jan 2023 01:27:43 GMT

GET
H/1.1 200
OK oic@2x.png
www.group-ib.ru/images/cert-partners/ 12 KB
13 KB 61ms
59ms Image
image/png 178.248.235.63
QRATOR

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.group-ib.ru/images/cert-partners/oic@2x.png

Requested by

Host: www.group-ib.ru
URL: https://www.group-ib.ru/cert.html

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

178.248.235.63 , Russian Federation, ASN197068 (QRATOR, RU),

Reverse DNS

Software

QRATOR /

Resource Hash

7b12bc0e3c26c7489b7b00b5eac170133e840e004baac496b88c23db28353ad4

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
Strict-Transport-Security	max-age=15724800; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

Date: Sun, 22 Jan 2023 01:27:44 GMT
Content-Security-Policy: frame-ancestors 'self'
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=15724800; includeSubDomains
X-Dns-Prefetch-Control: off
Connection: keep-alive
Content-Length: 12648
X-Xss-Protection: 1; mode=block
Referrer-Policy: no-referrer
Last-Modified: Wed, 17 Mar 2021 06:25:04 GMT
Server: QRATOR
Etag: "6051a0c0-3168"
X-Download-Options: noopen
X-Frame-Options: SAMEORIGIN
Access-Control-Allow-Methods: GET,HEAD,OPTIONS,POST,PUT
Content-Type: image/png
Access-Control-Allow-Origin: https://2020.group-ib.ru
Cache-Control: max-age=604800
Feature-Policy: camera 'none'; microphone 'none'; geolocation 'none'; encrypted-media 'none'; payment 'none'; speaker 'none'; usb 'none';
Permissions-Policy: camera=(), microphone=(), geolocation=(), encrypted-media=(), payment=(), speaker=(), usb=(),
Accept-Ranges: bytes
Keep-Alive: timeout=15
Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept, Authorization, *
Expires: Sun, 29 Jan 2023 01:27:44 GMT

GET
H/1.1 200
OK azb-w@2x.png
www.group-ib.ru/images/cert-partners/ 18 KB
19 KB 72ms
41ms Image
image/png 178.248.235.63
QRATOR

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.group-ib.ru/images/cert-partners/azb-w@2x.png

Requested by

Host: www.group-ib.ru
URL: https://www.group-ib.ru/cert.html

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

178.248.235.63 , Russian Federation, ASN197068 (QRATOR, RU),

Reverse DNS

Software

QRATOR /

Resource Hash

206d8cf5d1a0149c666651755b0f7b0b62a50882d61a5d18eaddc7317bb92a53

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
Strict-Transport-Security	max-age=15724800; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

Date: Sun, 22 Jan 2023 01:27:44 GMT
Content-Security-Policy: frame-ancestors 'self'
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=15724800; includeSubDomains
X-Dns-Prefetch-Control: off
Connection: keep-alive
Content-Length: 18668
X-Xss-Protection: 1; mode=block
Referrer-Policy: no-referrer
Last-Modified: Wed, 17 Mar 2021 06:25:04 GMT
Server: QRATOR
Etag: "6051a0c0-48ec"
X-Download-Options: noopen
X-Frame-Options: SAMEORIGIN
Access-Control-Allow-Methods: GET,HEAD,OPTIONS,POST,PUT
Content-Type: image/png
Access-Control-Allow-Origin: https://2020.group-ib.ru
Cache-Control: max-age=604800
Feature-Policy: camera 'none'; microphone 'none'; geolocation 'none'; encrypted-media 'none'; payment 'none'; speaker 'none'; usb 'none';
Permissions-Policy: camera=(), microphone=(), geolocation=(), encrypted-media=(), payment=(), speaker=(), usb=(),
Accept-Ranges: bytes
Keep-Alive: timeout=15
Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept, Authorization, *
Expires: Sun, 29 Jan 2023 01:27:44 GMT

GET
H/1.1 200
OK onc@2x.png
www.group-ib.ru/images/cert-partners/ 39 KB
40 KB 48ms
48ms Image
image/png 178.248.235.63
QRATOR

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.group-ib.ru/images/cert-partners/onc@2x.png

Requested by

Host: www.group-ib.ru
URL: https://www.group-ib.ru/cert.html

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

178.248.235.63 , Russian Federation, ASN197068 (QRATOR, RU),

Reverse DNS

Software

QRATOR /

Resource Hash

e879f79cf3432a5c0e30fe7ff7bbbccf97fb8adf675ea88a3349f22936b73a9d

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
Strict-Transport-Security	max-age=15724800; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

Date: Sun, 22 Jan 2023 01:27:44 GMT
Content-Security-Policy: frame-ancestors 'self'
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=15724800; includeSubDomains
X-Dns-Prefetch-Control: off
Connection: keep-alive
Content-Length: 40133
X-Xss-Protection: 1; mode=block
Referrer-Policy: no-referrer
Last-Modified: Wed, 17 Mar 2021 06:25:04 GMT
Server: QRATOR
Etag: "6051a0c0-9cc5"
X-Download-Options: noopen
X-Frame-Options: SAMEORIGIN
Access-Control-Allow-Methods: GET,HEAD,OPTIONS,POST,PUT
Content-Type: image/png
Access-Control-Allow-Origin: https://2020.group-ib.ru
Cache-Control: max-age=604800
Feature-Policy: camera 'none'; microphone 'none'; geolocation 'none'; encrypted-media 'none'; payment 'none'; speaker 'none'; usb 'none';
Permissions-Policy: camera=(), microphone=(), geolocation=(), encrypted-media=(), payment=(), speaker=(), usb=(),
Accept-Ranges: bytes
Keep-Alive: timeout=15
Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept, Authorization, *
Expires: Sun, 29 Jan 2023 01:27:44 GMT

GET
H/1.1 200
OK apwg@2x.png
www.group-ib.ru/images/cert-partners/ 11 KB
12 KB 36ms
36ms Image
image/png 178.248.235.63
QRATOR

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.group-ib.ru/images/cert-partners/apwg@2x.png

Requested by

Host: www.group-ib.ru
URL: https://www.group-ib.ru/cert.html

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

178.248.235.63 , Russian Federation, ASN197068 (QRATOR, RU),

Reverse DNS

Software

QRATOR /

Resource Hash

141397708f146e91f2a8137f1897e36d558af1c3c2e552c6aeda5f5d0a7448b0

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
Strict-Transport-Security	max-age=15724800; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

Date: Sun, 22 Jan 2023 01:27:44 GMT
Content-Security-Policy: frame-ancestors 'self'
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=15724800; includeSubDomains
X-Dns-Prefetch-Control: off
Connection: keep-alive
Content-Length: 11163
X-Xss-Protection: 1; mode=block
Referrer-Policy: no-referrer
Last-Modified: Wed, 17 Mar 2021 06:25:04 GMT
Server: QRATOR
Etag: "6051a0c0-2b9b"
X-Download-Options: noopen
X-Frame-Options: SAMEORIGIN
Access-Control-Allow-Methods: GET,HEAD,OPTIONS,POST,PUT
Content-Type: image/png
Access-Control-Allow-Origin: https://2020.group-ib.ru
Cache-Control: max-age=604800
Feature-Policy: camera 'none'; microphone 'none'; geolocation 'none'; encrypted-media 'none'; payment 'none'; speaker 'none'; usb 'none';
Permissions-Policy: camera=(), microphone=(), geolocation=(), encrypted-media=(), payment=(), speaker=(), usb=(),
Accept-Ranges: bytes
Keep-Alive: timeout=15
Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept, Authorization, *
Expires: Sun, 29 Jan 2023 01:27:44 GMT

GET
H2 200 v2.js Show response
js-eu1.hsforms.net/forms/ 507 KB
159 KB 188ms
25ms Script
application/javascript 172.65.255.172
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://js-eu1.hsforms.net/forms/v2.js

Requested by

Host: www.group-ib.ru
URL: https://www.group-ib.ru/cert.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.65.255.172 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

3f8ab92da8dd94680196795fcc3018ef6169c1a4744be0b110b32d42e57394d2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

content-encoding: br
age: 252
x-amz-server-side-encryption: AES256
content-security-policy-report-only: frame-ancestors 'self'; report-uri https://exceptions.hubspot.com/csp/report?resource=forms-embed/static-1.2581/bundles/project-v2.js&cfRay=78d47c1bef1b2bd3-FRA
x-amz-replication-status: COMPLETED
x-evy-trace-listener: listener_https
etag: W/"3d5b1adfa186f3d88635eb8b15759930"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
x-evy-trace-virtual-host: all
cache-control: s-maxage=600, max-age=300
x-hs-target-asset: forms-embed/static-1.2581/bundles/project-v2.js
date: Sun, 22 Jan 2023 01:27:43 GMT
x-amz-version-id: pDblZ7ePNOkvsyo2COGg.CQbR8iX0Q1g
via: 1.1 103eb504d36d97c9f30550032223d996.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-amz-cf-pop: FRA56-C2
x-cache: Hit from cloudfront
cache-tag: staticjsapp-forms-embed-v2-web-prod,staticjsapp-prod
x-envoy-upstream-service-time: 5
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-evy-trace-route-configuration: listener_https/all
last-modified: Fri, 20 Jan 2023 09:38:01 UTC
server: cloudflare
x-evy-trace-route: nginx-catch-all
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=nMDmK78iV3XMM01KXs%2BB%2Bw5Oijsg5FY9fDnumvlNE6HRgArLOUhXb5TLHS6cWi4sQejqjkj1ebgMkqz1w1jkPlwqTFLnZRZau3iJa3FI6N7%2FBF6WduTjHe6iFdyV7QNJ1qAsgg%3D%3D"}],"group":"cf-nel","max_age":604800}
x-hs-cache-status: HIT
x-evy-trace-served-by-pod: fra04/app-td/envoy-proxy-6bdc87f4c5-pxdqq
cf-ray: 78d4824339b72bce-FRA
x-amz-cf-id: skFZqUuKLHN2aN1Q82pb7XgQksE5W1MLRFl0lyR9w2KEU2MBtjEIMA==

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 226 KB
74 KB 180ms
32ms Script
application/javascript 2a00:1450:4001:812::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-WJ37CH

Requested by

Host: www.group-ib.ru
URL: https://www.group-ib.ru/cert.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

cfb448f673e571bc655c5c6dc56275b9d3a10e28eb4c9b46f3767d0f03ff5bb6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Sun, 22 Jan 2023 01:27:44 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 75184
x-xss-protection: 0
last-modified: Sun, 22 Jan 2023 00:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Sun, 22 Jan 2023 01:27:44 GMT

GET
H2 200 fbevents.js Show response
connect.facebook.net/en_US/ 106 KB
28 KB 156ms
8ms Script
application/x-javascript 2a03:2880:f083:100:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Host: www.group-ib.ru
URL: https://www.group-ib.ru/cert.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f083:100:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

ef8f067f829af7c95936a36f38e54c98ab090f937f5557e4c78829ed8fcf5ffd

Security Headers

Name	Value
Content-Security-Policy	default-src facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com data: blob: 'self';script-src .fbcdn.net .facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

content-security-policy: default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; preload; includeSubDomains
date: Sun, 22 Jan 2023 01:27:44 GMT
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 27859
x-fb-rlafr: 0
x-xss-protection: 0
pragma: public
x-fb-debug: /pIAdmVVCLRqNFxUR3wzYbxJv7jXXI2ZpJ1ZNRe9Bhw/R66d7/1LjDV3z2slAq9SM4vm8U1Y1GxUM4P9T/CKPw==
x-fb-trip-id: 1679558926
cross-origin-opener-policy: same-origin-allow-popups
vary: Accept-Encoding
x-frame-options: DENY
content-type: application/x-javascript; charset=utf-8
cache-control: public, max-age=1200
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H/1.1 200
OK sdk.js Show response
www.group-ib.ru/javascripts/vendors/ 4 KB
3 KB 40ms
40ms Script
application/javascript 178.248.235.63
QRATOR

General

Check archive.org

Show headers Download Go to

Full URL

https://www.group-ib.ru/javascripts/vendors/sdk.js

Requested by

Host: www.group-ib.ru
URL: https://www.group-ib.ru/cert.html

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

178.248.235.63 , Russian Federation, ASN197068 (QRATOR, RU),

Reverse DNS

Software

QRATOR /

Resource Hash

59459a76ec79e9e9e6deca7590ba2ad508a761628d8289a4b1426a737bd56608

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
Strict-Transport-Security	max-age=15724800; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

Date: Sun, 22 Jan 2023 01:27:44 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Content-Security-Policy: frame-ancestors 'self'
Strict-Transport-Security: max-age=15724800; includeSubDomains
X-Dns-Prefetch-Control: off
Connection: keep-alive
Content-Length: 1920
X-Xss-Protection: 1; mode=block
Referrer-Policy: no-referrer
Last-Modified: Tue, 23 Jun 2020 11:38:34 GMT
Server: QRATOR
Etag: W/"5ef1e9ba-eb5"
X-Download-Options: noopen
X-Frame-Options: SAMEORIGIN
Access-Control-Allow-Methods: GET,HEAD,OPTIONS,POST,PUT
Content-Type: application/javascript
Access-Control-Allow-Origin: https://2020.group-ib.ru
Cache-Control: max-age=604800
Feature-Policy: camera 'none'; microphone 'none'; geolocation 'none'; encrypted-media 'none'; payment 'none'; speaker 'none'; usb 'none';
Permissions-Policy: camera=(), microphone=(), geolocation=(), encrypted-media=(), payment=(), speaker=(), usb=(),
Keep-Alive: timeout=15
Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept, Authorization, *
Expires: Sun, 29 Jan 2023 01:27:44 GMT

GET
H/1.1 200
OK icons.svg
www.group-ib.ru/images/ 504 KB
192 KB 49ms
49ms Other
image/svg+xml 178.248.235.63
QRATOR

General

Check archive.org

Show headers Download Go to

Full URL

https://www.group-ib.ru/images/icons.svg

Requested by

Host: www.group-ib.ru
URL: https://www.group-ib.ru/cert.html

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

178.248.235.63 , Russian Federation, ASN197068 (QRATOR, RU),

Reverse DNS

Software

QRATOR /

Resource Hash

0b2559eba72b782c4878457b97c437c9189a050d9fa17aa7375d95a4a54c6b94

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
Strict-Transport-Security	max-age=15724800; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

Date: Sun, 22 Jan 2023 01:27:44 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Content-Security-Policy: frame-ancestors 'self'
Strict-Transport-Security: max-age=15724800; includeSubDomains
Transfer-Encoding: chunked
X-Dns-Prefetch-Control: off
Connection: keep-alive
X-Xss-Protection: 1; mode=block
Referrer-Policy: no-referrer
Last-Modified: Thu, 19 Jan 2023 18:45:34 GMT
Server: QRATOR
Etag: W/"63c98fce-7e171"
X-Download-Options: noopen
X-Frame-Options: SAMEORIGIN
Access-Control-Allow-Methods: GET,HEAD,OPTIONS,POST,PUT
Content-Type: image/svg+xml
Access-Control-Allow-Origin: https://2020.group-ib.ru
Cache-Control: max-age=604800
Feature-Policy: camera 'none'; microphone 'none'; geolocation 'none'; encrypted-media 'none'; payment 'none'; speaker 'none'; usb 'none';
Permissions-Policy: camera=(), microphone=(), geolocation=(), encrypted-media=(), payment=(), speaker=(), usb=(),
Keep-Alive: timeout=15
Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept, Authorization, *
Expires: Sun, 29 Jan 2023 01:27:44 GMT

GET
DATA 200
OK truncated
/ 121 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 9ee338bd03594461a939b661840e43fec02d7345e19e3ad12509c06ba37ad355

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

Content-Type: image/png

GET
H/1.1 200
OK logo-new.svg
www.group-ib.ru/images/ 2 KB
2 KB 83ms
74ms Image
image/svg+xml 178.248.235.63
QRATOR

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.group-ib.ru/images/logo-new.svg

Requested by

Host: www.group-ib.ru
URL: https://www.group-ib.ru/stylesheets/all-9e8937e3.css

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

178.248.235.63 , Russian Federation, ASN197068 (QRATOR, RU),

Reverse DNS

Software

QRATOR /

Resource Hash

74711bb799e7d4712bcdc9fdf42f5acb835448d1ec23936a1d46a087e192e378

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
Strict-Transport-Security	max-age=15724800; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

Date: Sun, 22 Jan 2023 01:27:44 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Content-Security-Policy: frame-ancestors 'self'
Strict-Transport-Security: max-age=15724800; includeSubDomains
X-Dns-Prefetch-Control: off
Connection: keep-alive
Content-Length: 1139
X-Xss-Protection: 1; mode=block
Referrer-Policy: no-referrer
Last-Modified: Thu, 02 Dec 2021 07:22:15 GMT
Server: QRATOR
Etag: W/"61a87427-980"
X-Download-Options: noopen
X-Frame-Options: SAMEORIGIN
Access-Control-Allow-Methods: GET,HEAD,OPTIONS,POST,PUT
Content-Type: image/svg+xml
Access-Control-Allow-Origin: https://2020.group-ib.ru
Cache-Control: max-age=604800
Feature-Policy: camera 'none'; microphone 'none'; geolocation 'none'; encrypted-media 'none'; payment 'none'; speaker 'none'; usb 'none';
Permissions-Policy: camera=(), microphone=(), geolocation=(), encrypted-media=(), payment=(), speaker=(), usb=(),
Keep-Alive: timeout=15
Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept, Authorization, *
Expires: Sun, 29 Jan 2023 01:27:44 GMT

GET
DATA 200
OK truncated
/ 75 KB
75 KB Font
application/font-woff

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 077dad3be3a10854dc97527ce83bbf6422309d807f6e4b3492de78005d786cdc

Request headers

Referer
Origin: https://www.group-ib.ru
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

Content-Type: application/font-woff

GET
DATA 200
OK truncated
/ 75 KB
75 KB Font
application/font-woff

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 163907259fa19c5b768aea83f82db575b01aad0fd5fbf9ac448d3db383229547

Request headers

Referer
Origin: https://www.group-ib.ru
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

Content-Type: application/font-woff

GET
H/1.1 200
OK main-cover67.jpg
www.group-ib.ru/images/covers/ 150 KB
151 KB 127ms
127ms Image
image/jpeg 178.248.235.63
QRATOR

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.group-ib.ru/images/covers/main-cover67.jpg

Requested by

Host: www.group-ib.ru
URL: https://www.group-ib.ru/stylesheets/all-9e8937e3.css

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

178.248.235.63 , Russian Federation, ASN197068 (QRATOR, RU),

Reverse DNS

Software

QRATOR /

Resource Hash

5e7ba66d01f763eb14675fce5b50a5c54bfa5a3d55b72ef1533ec3dd2243592b

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
Strict-Transport-Security	max-age=15724800; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

Date: Sun, 22 Jan 2023 01:27:44 GMT
Content-Security-Policy: frame-ancestors 'self'
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=15724800; includeSubDomains
X-Dns-Prefetch-Control: off
Connection: keep-alive
Content-Length: 153441
X-Xss-Protection: 1; mode=block
Referrer-Policy: no-referrer
Last-Modified: Wed, 17 Mar 2021 06:25:04 GMT
Server: QRATOR
Etag: "6051a0c0-25761"
X-Download-Options: noopen
X-Frame-Options: SAMEORIGIN
Access-Control-Allow-Methods: GET,HEAD,OPTIONS,POST,PUT
Content-Type: image/jpeg
Access-Control-Allow-Origin: https://2020.group-ib.ru
Cache-Control: max-age=604800
Feature-Policy: camera 'none'; microphone 'none'; geolocation 'none'; encrypted-media 'none'; payment 'none'; speaker 'none'; usb 'none';
Permissions-Policy: camera=(), microphone=(), geolocation=(), encrypted-media=(), payment=(), speaker=(), usb=(),
Accept-Ranges: bytes
Keep-Alive: timeout=15
Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept, Authorization, *
Expires: Sun, 29 Jan 2023 01:27:44 GMT

GET
DATA 200
OK truncated
/ 75 KB
75 KB Font
application/font-woff

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 8b3ecc577e9722ca0bb5fd08ce6e5b800b114001af146f2a03865ab2859e9eb1

Request headers

Referer
Origin: https://www.group-ib.ru
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

Content-Type: application/font-woff

GET
H/1.1 200
OK idgib-w-group-ib Show response
www.group-ib.ru/api/fl/ 205 B
944 B 140ms
140ms XHR
application/json 178.248.235.63
QRATOR

General

Check archive.org

Show headers Download Go to

Full URL: https://www.group-ib.ru/api/fl/idgib-w-group-ib
Requested by: Host: www.group-ib.ru
URL: https://www.group-ib.ru/build/main_26755_2be51925_563_1764.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 178.248.235.63 , Russian Federation, ASN197068 (QRATOR, RU),
Reverse DNS
Software: QRATOR /
Resource Hash: fa226de8637f46d7104e9169cc0155bff7f658af5e11bb28baa8dde9b47e8723

Request headers

Referer
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36
x-cfids: -

Response headers

Date: Sun, 22 Jan 2023 01:27:44 GMT
content-encoding: gzip
Server: QRATOR
etag: W/"WmyV/Hbsa/gQh/q7wK7AaWJ5L4JccRujNvKB/QfTYDmM9q/TkngJ/9H56d2sCtxRg5E/V/dsGMBYOSQPrW4ghDE1pWLaFURRaTuPMWKT0V15yMsqwsvB33cSdpGNlC+0PYC/FtkKsbo2VBPbqhvBF0c/"
Transfer-Encoding: chunked
vary: Accept-Encoding
Content-Type: application/json; charset=utf-8
cache-control: no-cache
x-envoy-upstream-service-time: 0
Connection: keep-alive
Keep-Alive: timeout=15

GET
H2 200 json Show response
forms-eu1.hsforms.com/embed/v3/form/25755956/a54f05ba-5fc5-47a0-bf73-d1dd877d87ff/ 8 KB
2 KB 82ms
37ms XHR
application/json 172.65.232.43
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://forms-eu1.hsforms.com/embed/v3/form/25755956/a54f05ba-5fc5-47a0-bf73-d1dd877d87ff/json?hs_static_app=forms-embed&hs_static_app_version=1.2581&X-HubSpot-Static-App-Info=forms-embed-1.2581

Requested by

Host: www.group-ib.ru
URL: https://www.group-ib.ru/build/main_26755_2be51925_563_1764.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.65.232.43 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

18b62041f42319dd42532a35b9f1b53f42e04c412f152e43b08d7b1155234a8b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Accept: application/json, text/plain, */*
Referer
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

x-origin-hublet: eu1
date: Sun, 22 Jan 2023 01:27:44 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: br
cf-cache-status: DYNAMIC
x-hubspot-correlation-id: 1860b325-4fbc-4a92-8c82-93180ee2e9da
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
server: cloudflare
x-trace: 2B0415DAC52F8FE20113747F0EC79A7B2C67A3465E000000000000000000
vary: origin
access-control-allow-methods: OPTIONS, GET
content-type: application/json;charset=utf-8
access-control-allow-origin: https://www.group-ib.ru
access-control-expose-headers: X-Origin-Hublet
access-control-max-age: 180
access-control-allow-credentials: false
cache-control: max-age=0, no-cache, no-store
x-robots-tag: none
access-control-allow-headers: *
cf-ray: 78d48245d8a3bb49-FRA

GET
DATA 200
OK truncated
/ 412 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 3dfb83a15a1a69fb2c6355797651535983e30f2ebee4666b987b217780a18f61

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 278 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 3976e744f9adf8c331739695158a685668b3136052882117b91d543df93ff9ed

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 1 KB
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 9f76fca582f32f2da3a5f6c1fbfd29f75a599227fc58c9a3acde24fd25550246

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 273 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 4bdf008140cb9fb1f8a566f08c41e56801d474a5c4e8745073d5c32bd3b363db

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 138 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 873b0f296cc53130ff0148c0c8049a5d59903ee62da607a1bd5308b678ae0d8e

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 72 KB
72 KB Font
application/font-woff

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 0ea8a38dd231bd18f82c0fe04c7a14115ecd5600c62be4e7296251f4fd8385b8

Request headers

Referer
Origin: https://www.group-ib.ru
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

Content-Type: application/font-woff

GET
H3 200 sdk.js Show response
connect.facebook.net/ru_RU/ 301 KB
85 KB 21ms
11ms Script
application/x-javascript 2a03:2880:f083:100:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/ru_RU/sdk.js?hash=118d9dcb5e21ba0d88956e18eb06fc69&ua=modern_es6

Requested by

Host: www.group-ib.ru
URL: https://www.group-ib.ru/javascripts/vendors/sdk.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f083:100:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

6b3e18b4a358c58b8e40c94c13914f340011b9ee6f80e0009173627d79776502

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Referer
Origin: https://www.group-ib.ru
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
date: Sun, 22 Jan 2023 01:27:44 GMT
content-md5: uIN/wMiJ2bSTpBhVGZ7tLw==
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 87163
x-fb-rlafr: 0
x-fb-debug: x89SWgrlccq7gii0T14hbA6J1tJIs89i7jo5iGNk5CMXjarlQ3Nma73+yvLOIz9yZ0sNo1mEhvGZDP7gWKo2Lw==
x-fb-content-md5: 3571f5fd7d4cc474ca49241f8686047b
cross-origin-opener-policy: same-origin-allow-popups
etag: "faf8be7fc709466eca21fbd40a6fed8b"
vary: Accept-Encoding
x-frame-options: DENY
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: X-FB-Content-MD5
cache-control: public,max-age=31536000,stale-while-revalidate=3600,immutable
timing-allow-origin: *
priority: u=3,i
expires: Fri, 12 Jan 2024 11:31:24 GMT

GET
H2 200 forms2.min.js Show response
app-lon09.marketo.com/js/forms2/js/ 208 KB
69 KB 65ms
21ms Script
application/x-javascript 104.16.94.80
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://app-lon09.marketo.com/js/forms2/js/forms2.min.js

Requested by

Host: www.group-ib.ru
URL: https://www.group-ib.ru/javascripts/all-5b99efc3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.94.80 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0694124dd8cf871b521cf06ce0b2419ebbe18d3f45658b50c4b038b647fbc849

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Sun, 22 Jan 2023 01:27:44 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
last-modified: Thu, 12 Jan 2023 20:56:20 GMT
server: cloudflare
age: 2894
etag: "d20ea5-33e51-5f217594de500"
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: public, max-age=14400
cf-ray: 78d482461c4e2bec-FRA
expires: Sun, 22 Jan 2023 05:27:44 GMT

GET
H2 200 545899479446758 Show response
connect.facebook.net/signals/config/ 377 KB
108 KB 218ms
218ms Script
application/x-javascript 2a03:2880:f083:100:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/545899479446758?v=2.9.94&r=stable

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f083:100:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

cf9da19ae0f7723bf047835dd2cce51d34179a67d9508e122416a77a4aa3e77c

Security Headers

Name	Value
Content-Security-Policy	default-src facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com data: blob: 'self';script-src .fbcdn.net .facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

content-security-policy: default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; preload; includeSubDomains
date: Sun, 22 Jan 2023 01:27:44 GMT
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
x-fb-rlafr: 0
x-xss-protection: 0
pragma: public
x-fb-debug: 2P6wHoo9msey3jybgHbvovMc2bZ7hbZt8wYV52UNJheSIJxlF21wd7bQl3jIky7Njsix3xtK9KQLYQHa2cPsLQ==
x-fb-trip-id: 1679558926
cross-origin-opener-policy: same-origin-allow-popups
vary: Accept-Encoding
x-frame-options: DENY
content-type: application/x-javascript; charset=utf-8
origin-agent-cluster: ?0
cache-control: public, max-age=1200
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H/1.1 206
Partial Content cert-video.mp4
www.group-ib.ru/video/ 4 MB
4 MB 67ms
66ms Media
video/mp4 178.248.235.63
QRATOR

General

Check archive.org

Show headers Download Go to

Full URL

https://www.group-ib.ru/video/cert-video.mp4

Requested by

Host: www.group-ib.ru
URL: https://www.group-ib.ru/cert.html

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

178.248.235.63 , Russian Federation, ASN197068 (QRATOR, RU),

Reverse DNS

Software

QRATOR /

Resource Hash

b4b270e405f3680387545b2613ed4efb0e20a2924e1848be905e424324fd6fc3

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
Strict-Transport-Security	max-age=15724800; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer
Accept-Encoding: identity;q=1, *;q=0
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36
Range: bytes=0-

Response headers

Date: Sun, 22 Jan 2023 01:27:44 GMT
Content-Security-Policy: frame-ancestors 'self'
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=15724800; includeSubDomains
X-Dns-Prefetch-Control: off
Content-Range: bytes 0-4525159/4525160
Connection: keep-alive
Content-Length: 4525160
X-Xss-Protection: 1; mode=block
Referrer-Policy: no-referrer
Last-Modified: Wed, 17 Mar 2021 06:25:09 GMT
Server: QRATOR
Etag: "6051a0c5-450c68"
X-Download-Options: noopen
X-Frame-Options: SAMEORIGIN
Access-Control-Allow-Methods: GET,HEAD,OPTIONS,POST,PUT
Content-Type: video/mp4
Access-Control-Allow-Origin: https://2020.group-ib.ru
Feature-Policy: camera 'none'; microphone 'none'; geolocation 'none'; encrypted-media 'none'; payment 'none'; speaker 'none'; usb 'none';
Permissions-Policy: camera=(), microphone=(), geolocation=(), encrypted-media=(), payment=(), speaker=(), usb=(),
Keep-Alive: timeout=15
Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept, Authorization, *

GET
H/1.1 403
Forbidden admin-ajax.php Show response
www.group-ib.ru/media/wp-admin/ 571 B
403 B 28ms
28ms XHR
text/html 178.248.235.63
QRATOR

General

Check archive.org

Show headers Download Go to

Full URL: https://www.group-ib.ru/media/wp-admin/admin-ajax.php?action=mediaformain
Requested by: Host: www.group-ib.ru
URL: https://www.group-ib.ru/build/main_26755_2be51925_563_1764.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 178.248.235.63 , Russian Federation, ASN197068 (QRATOR, RU),
Reverse DNS
Software: QRATOR /
Resource Hash: 04bdf7a7f188c4aa11765dd32f67e30c23bd4c20aea5067e37c14c1a6f8a6b20

Request headers

Accept: */*
Referer
X-Requested-With: XMLHttpRequest
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

Date: Sun, 22 Jan 2023 01:27:44 GMT
Content-Encoding: gzip
Server: QRATOR
Connection: keep-alive
Keep-Alive: timeout=15
Transfer-Encoding: chunked
Content-Type: text/html

GET
H/1.1 200
OK id.html Show response
ru.id.group-ib.com/ Frame CA7C 524 B
1 KB 134ms
46ms Document
text/html 185.17.9.183
SELECTEL

General

Check archive.org

Show headers Download Go to

Full URL: https://ru.id.group-ib.com/id.html
Requested by: Host: www.group-ib.ru
URL: https://www.group-ib.ru/build/main_26755_2be51925_563_1764.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 185.17.9.183 St Petersburg, Russian Federation, ASN49505 (SELECTEL, RU),
Reverse DNS
Software: nginx /
Resource Hash: 86aea411ee8e8d7eef5100e833f1c40917512a99ec86dff57105d495525a01e4

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Connection: keep-alive
Content-Type: text/html; charset=utf-8
Date: Sun, 22 Jan 2023 01:27:44 GMT
Server: nginx
Transfer-Encoding: chunked
cache-control: no-cache
content-encoding: gzip
etag: W/"2NOtXWsXmWRCybPtRvaf8K1E7-QCzJL9QDuJ6Wg-KfOZtLpjvST6uWZvgRMcgBoFQTGIou9DQDQRd-+Uo4WN1DnT8dug6R5Sz962Mo6sSyXIyWsybbsnPBFd4USC"
vary: Accept-Encoding
x-envoy-upstream-service-time: 0

GET
H2 200 counters.gif
forms.hsforms.com/embed/v3/ 35 B
439 B 147ms
123ms Image
image/gif 2606:4700::6810:5705
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://forms.hsforms.com/embed/v3/counters.gif?key=forms-embed-v2-DEFINITION_SUCCESS&count=1

Requested by

Host: www.group-ib.ru
URL: https://www.group-ib.ru/cert.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:5705 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Sun, 22 Jan 2023 01:27:44 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
cf-cache-status: DYNAMIC
server: cloudflare
x-hubspot-correlation-id: 755b4b2a-392f-416b-952a-dc74038ed7c4
x-trace: 2BDCD45C1437CA6B5F896CACB7B65ACB3D763CC635000000000000000000
vary: origin
content-type: image/gif
access-control-expose-headers: X-Origin-Hublet
cache-control: max-age=0, no-cache, no-store
access-control-allow-credentials: false
x-robots-tag: none
cf-ray: 78d482466e36bb4d-FRA
content-length: 35
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H2 200 optimize.js Show response
www.google-analytics.com/gtm/ 110 KB
44 KB 65ms
30ms Script
application/javascript 2a00:1450:4001:830::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/gtm/optimize.js?id=GTM-KGXWHDH

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-WJ37CH

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

41cbb050257ab5129be5ad7c3182cc05058690c51ae2beeedd2db1134eeb6811

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Sun, 22 Jan 2023 01:27:44 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 44339
x-xss-protection: 0
last-modified: Sun, 22 Jan 2023 00:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Sun, 22 Jan 2023 01:27:44 GMT

GET
H2 200 6si.min.js Show response
j.6sc.co/ 31 KB
10 KB 42ms
7ms Script
application/javascript 23.44.74.52
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://j.6sc.co/6si.min.js

Requested by

Host: www.group-ib.ru
URL: https://www.group-ib.ru/cert.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.44.74.52 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-44-74-52.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

eea93734d5f0032479fa252394415d53cbcd4e7bd6d54764543eaa8b7c9fd10c

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 22 Jan 2023 01:27:44 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Thu, 01 Dec 2022 20:20:43 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "63890c9b-7ad6"
vary: Accept-Encoding
content-type: application/javascript
cache-control: private, no-cache, proxy-revalidate
accept-ranges: bytes
content-length: 10143
expires: Sun, 22 Jan 2023 01:27:44 GMT

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 49 KB
20 KB 48ms
16ms Script
text/javascript 2a00:1450:4001:830::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-WJ37CH

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

5971b095cff574a66d35ada016d4c077c86e2dea62e9c0f14cf7c94b258619de

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
date: Sun, 22 Jan 2023 00:26:10 GMT
last-modified: Tue, 10 Jan 2023 21:29:14 GMT
server: Golfe2
age: 3694
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 20085
expires: Sun, 22 Jan 2023 02:26:10 GMT

GET
H2 200 tag.js Show response
mc.yandex.ru/metrika/ 211 KB
73 KB 213ms
99ms Script
application/javascript 2a02:6b8::1:119
GLOBAL_DC

General

Check archive.org

Show headers Download Go to

Full URL

https://mc.yandex.ru/metrika/tag.js

Requested by

Host: www.group-ib.ru
URL: https://www.group-ib.ru/cert.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:6b8::1:119 Moscow, Russian Federation, ASN208722 (GLOBAL_DC, FI),

Reverse DNS

Software

Resource Hash

6f4f281400418fc288c5765dc650f12506aa3190183b137d5e129ca3c6038e6a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Sun, 22 Jan 2023 01:27:44 GMT
content-encoding: br
strict-transport-security: max-age=31536000
last-modified: Thu, 19 Jan 2023 15:40:43 GMT
accept-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
etag: "63c93a4b-11ffd"
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=3600
content-length: 73725
expires: Sun, 22 Jan 2023 02:27:44 GMT

GET
H/1.1 200
OK munchkin.js Show response
munchkin.marketo.net/ 1 KB
1 KB 40ms
8ms Script
application/x-javascript 23.45.104.85
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://munchkin.marketo.net/munchkin.js
Requested by: Host: www.group-ib.ru
URL: https://www.group-ib.ru/cert.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.45.104.85 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-45-104-85.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 91a50850c517899e1c975079158949f7a500ddf5a7307fe36bf50092926beedc

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

Date: Sun, 22 Jan 2023 01:27:44 GMT
Content-Encoding: gzip
Last-Modified: Fri, 09 Sep 2022 01:18:39 GMT
Server: AkamaiNetStorage
ETag: "92b41a298690c047b0c4602dd843cba4:1662686319.691662"
Vary: Accept-Encoding
Content-Type: application/x-javascript
P3P: policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR"
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 728

GET
H2 200 25755956.js Show response
js-eu1.hs-scripts.com/ 2 KB
884 B 91ms
40ms Script
application/javascript 172.65.208.22
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js-eu1.hs-scripts.com/25755956.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-WJ37CH
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.65.208.22 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9ebbcf893735f0443c9d7fb98f091b5cd9b70aaf775e3f7185ef661d8aecf1e2

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Sun, 22 Jan 2023 01:27:44 GMT
content-encoding: br
cf-cache-status: EXPIRED
last-modified: Sat, 21 Jan 2023 22:30:02 GMT
server: cloudflare
x-hubspot-correlation-id: 5e716937-c02f-4468-8857-17b99efb8a2a
x-trace: 2BD4D0B7C4B527A10EDF4148E51DEE6A4E21A4F255000000000000000000
vary: origin, Accept-Encoding
access-control-max-age: 3600
content-type: application/javascript;charset=utf-8
cache-control: public, max-age=30
access-control-allow-credentials: true
cf-ray: 78d48246ad125b4a-FRA

GET
H2 200 NeverBounce.js Show response
cdn.neverbounce.com/widget/dist/ 96 KB
29 KB 79ms
13ms Script
application/javascript 13.225.78.38
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.neverbounce.com/widget/dist/NeverBounce.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-WJ37CH
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.78.38 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-78-38.fra2.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: c99d11cb4960d6e1918ed55d5bcbb316d38b51098e2efc1201904d7274d3273e

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Sat, 21 Jan 2023 23:56:04 GMT
content-encoding: gzip
via: 1.1 6c9a2d99a25484f38efa27d58a726b2c.cloudfront.net (CloudFront)
last-modified: Mon, 02 Mar 2020 18:37:33 GMT
server: AmazonS3
x-amz-cf-pop: FRA2-C2
age: 5585
etag: W/"c1e06621030dfcba15b88abbcaa546eb"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
x-amz-cf-id: paMpMkC24Gz6w3VMnzEiyfpuQ26i3Fvrrp6LB5sH3OwUgKI1ACk1MA==

GET
H/1.1 200
OK arrow_white-right.png
www.group-ib.ru/images/arrows/ 214 B
1 KB 38ms
38ms Image
image/png 178.248.235.63
QRATOR

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.group-ib.ru/images/arrows/arrow_white-right.png

Requested by

Host: www.group-ib.ru
URL: https://www.group-ib.ru/stylesheets/all-9e8937e3.css

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

178.248.235.63 , Russian Federation, ASN197068 (QRATOR, RU),

Reverse DNS

Software

QRATOR /

Resource Hash

da80939200fd9b61ce6055bea1095373128866fee16a79d861497e30a434ba23

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
Strict-Transport-Security	max-age=15724800; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

Date: Sun, 22 Jan 2023 01:27:44 GMT
Content-Security-Policy: frame-ancestors 'self'
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=15724800; includeSubDomains
X-Dns-Prefetch-Control: off
Connection: keep-alive
Content-Length: 214
X-Xss-Protection: 1; mode=block
Referrer-Policy: no-referrer
Last-Modified: Wed, 17 Mar 2021 06:25:04 GMT
Server: QRATOR
Etag: "6051a0c0-d6"
X-Download-Options: noopen
X-Frame-Options: SAMEORIGIN
Access-Control-Allow-Methods: GET,HEAD,OPTIONS,POST,PUT
Content-Type: image/png
Access-Control-Allow-Origin: https://2020.group-ib.ru
Cache-Control: max-age=604800
Feature-Policy: camera 'none'; microphone 'none'; geolocation 'none'; encrypted-media 'none'; payment 'none'; speaker 'none'; usb 'none';
Permissions-Policy: camera=(), microphone=(), geolocation=(), encrypted-media=(), payment=(), speaker=(), usb=(),
Accept-Ranges: bytes
Keep-Alive: timeout=15
Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept, Authorization, *
Expires: Sun, 29 Jan 2023 01:27:44 GMT

GET
H2 200 counters.gif
forms-eu1.hsforms.com/embed/v3/ 35 B
439 B 354ms
31ms Image
image/gif 172.65.232.43
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://forms-eu1.hsforms.com/embed/v3/counters.gif?key=forms-embed-v2-RENDER_SUCCESS&count=1

Requested by

Host: www.group-ib.ru
URL: https://www.group-ib.ru/cert.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.65.232.43 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Sun, 22 Jan 2023 01:27:44 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
cf-cache-status: DYNAMIC
server: cloudflare
x-hubspot-correlation-id: a37690db-fbc6-409d-a7a0-578e20350b9d
x-trace: 2BF151D5C7AEF738D52BF7E7780F6F5D7F2B29FEC9000000000000000000
vary: origin
content-type: image/gif
access-control-expose-headers: X-Origin-Hublet
cache-control: max-age=0, no-cache, no-store
access-control-allow-credentials: false
x-robots-tag: none
cf-ray: 78d48248accc5ca4-FRA
content-length: 35
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H2 200 /
www.facebook.com/tr/ 0
185 B 54ms
18ms Image
text/plain 2a03:2880:f176:181:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=929285880515282&ev=fb_page_view&dl=https%3A%2F%2Fwww.group-ib.ru%2Fcert.html&rl=&if=false&ts=1674350864423&sw=1600&sh=1200&at=

Requested by

Host: www.group-ib.ru
URL: https://www.group-ib.ru/cert.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f176:181:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
date: Sun, 22 Jan 2023 01:27:44 GMT
server: proxygen-bolt
content-type: text/plain
access-control-allow-origin
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 0

POST
H/1.1 200
OK fl Show response
www.group-ib.ru/api/ 665 B
1 KB 217ms
217ms XHR
application/json 178.248.235.63
QRATOR

General

Check archive.org

Show headers Download Go to

Full URL: https://www.group-ib.ru/api/fl?u=d5fb122505&mv=2&cfidsgib-w-group-ib=WmyV%2FHbsa%2FgQh%2Fq7wK7AaWJ5L4JccRujNvKB%2FQfTYDmM9q%2FTkngJ%2F9H56d2sCtxRg5E%2FV%2FdsGMBYOSQPrW4ghDE1pWLaFURRaTuPMWKT0V15yMsqwsvB33cSdpGNlC%2B0PYC%2FFtkKsbo2VBPbqhvBF0c%2F
Requested by: Host: www.group-ib.ru
URL: https://www.group-ib.ru/build/main_26755_2be51925_563_1764.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 178.248.235.63 , Russian Federation, ASN197068 (QRATOR, RU),
Reverse DNS
Software: QRATOR /
Resource Hash: 4e120d2062811f5e68425abc7f9e8aadd175a53e128ccb35677a18bdf35a6054

Request headers

Referer
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

Date: Sun, 22 Jan 2023 01:27:44 GMT
content-encoding: gzip
Server: QRATOR
Transfer-Encoding: chunked
vary: Accept-Encoding
Content-Type: application/json; charset=utf-8
Access-Control-Allow-Origin: https://www.group-ib.ru
Access-Control-Allow-Methods: GET, POST, OPTIONS
cache-control: no-store
x-envoy-upstream-service-time: 1
Access-Control-Allow-Credentials: true
Connection: keep-alive
Keep-Alive: timeout=15
Access-Control-Allow-Headers: Accept,DNT,Keep-Alive,User-Agent,If-Modified-Since,Cache-Control,Content-Type,Origin,ETag,If-None-Match,X-Cfids,Authorization

GET
H/1.1 200
OK munchkin.js Show response
munchkin.marketo.net/162/ 11 KB
5 KB 10ms
10ms Script
application/x-javascript 23.45.104.85
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://munchkin.marketo.net/162/munchkin.js
Requested by: Host: munchkin.marketo.net
URL: https://munchkin.marketo.net/munchkin.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.45.104.85 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-45-104-85.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 5d4972183041556a4368526fbac13acafc83de9ff3ca29ce81f31eb29c8f8a57

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

Date: Sun, 22 Jan 2023 01:27:44 GMT
Content-Encoding: gzip
Last-Modified: Fri, 01 Jul 2022 00:59:12 GMT
Server: AkamaiNetStorage
ETag: "75daf56f6191efe42577301908659c29:1656637152.894482"
Vary: Accept-Encoding
P3P: policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR"
Content-Type: application/x-javascript
Cache-Control: max-age=8640000
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 4677
Expires: Tue, 02 May 2023 01:27:44 GMT

GET
H/1.1 200
OK getuidj Show response
secure.adnxs.com/ 11 B
822 B 47ms
7ms XHR
application/json 37.252.171.22
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.adnxs.com/getuidj

Requested by

Host: www.group-ib.ru
URL: https://www.group-ib.ru/build/main_26755_2be51925_563_1764.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.171.22 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

1001.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net

Software

nginx/1.21.3 /

Resource Hash

31b45c462302ac175bfa43f9e5591491db780ca094f6ecdd2907f25ad578448d

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

Pragma: no-cache
Date: Sun, 22 Jan 2023 01:27:44 GMT
AN-X-Request-Uuid: 7302bc8c-1914-4d11-b6c9-8714dec66088
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: application/json; charset=utf-8
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://www.group-ib.ru
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
X-Proxy-Origin: 178.162.209.131; 178.162.209.131; 1001.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
Content-Length: 11
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 / Show response
c.6sc.co/ 7 B
203 B 28ms
18ms XHR
text/html 23.44.74.52
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://c.6sc.co/
Requested by: Host: www.group-ib.ru
URL: https://www.group-ib.ru/build/main_26755_2be51925_563_1764.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.44.74.52 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-44-74-52.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: fe04a9dc88d3f3be8d4f6bc63a9a80f45a4c6d8460e7551dab849457c091920a

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Sun, 22 Jan 2023 01:27:44 GMT
access-control-max-age: 86400
access-control-allow-methods: GET,POST
content-type: text/html
access-control-allow-origin: https://www.group-ib.ru
access-control-allow-credentials: true
access-control-allow-headers: *
content-length: 7

GET
H2 200 / Show response
ipv6.6sc.co/ 24 B
262 B 114ms
25ms XHR
text/html 2a02:26f0:e300:182::1c91
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://ipv6.6sc.co/
Requested by: Host: www.group-ib.ru
URL: https://www.group-ib.ru/build/main_26755_2be51925_563_1764.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:e300:182::1c91 Prague, Czech Republic, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: /
Resource Hash: 6d6b766a86ee59cc94e61ba039af69a6adf0dc75e9eaa15522072d970f5090fd

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 22 Jan 2023 01:27:44 GMT
vary: Origin
content-type: text/html
access-control-allow-origin: https://www.group-ib.ru
cache-control: max-age=0, no-cache, no-store
6si-ipv6: 2a00:c98:2050:a007:2::10
server-timing: cdn-cache; desc=HIT, edge; dur=1
content-length: 24
expires: Sun, 22 Jan 2023 01:27:44 GMT

POST
H2 200 collect Show response
stats.g.doubleclick.net/j/ 4 B
443 B 65ms
19ms XHR
text/plain 2a00:1450:400c:c00::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j99&tid=UA-25492706-1&cid=1289706080.1674350864&jid=1688341411&gjid=1980211359&_gid=1800356927.1674350864&_u=aGBAgAABQAAAAEAEC~&z=1905750470

Requested by

Host: www.group-ib.ru
URL: https://www.group-ib.ru/build/main_26755_2be51925_563_1764.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400c:c00::9b Brussels, Belgium, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
date: Sun, 22 Jan 2023 01:27:44 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.group-ib.ru
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 collect
www.google-analytics.com/ 35 B
192 B 19ms
17ms Image
image/gif 2a00:1450:4001:830::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j99&a=1567055093&t=pageview&_s=1&dl=https%3A%2F%2Fwww.group-ib.ru%2Fcert.html&ul=en-us&de=UTF-8&dt=%D0%93%D1%80%D1%83%D0%BF%D0%BF%D0%B0%20%D0%BE%D0%BF%D0%B5%D1%80%D0%B0%D1%82%D0%B8%D0%B2%D0%BD%D0%BE%D0%B3%D0%BE%20%D1%80%D0%B5%D0%B0%D0%B3%D0%B8%D1%80%D0%BE%D0%B2%D0%B0%D0%BD%D0%B8%D1%8F%20%D0%BD%D0%B0%20%D0%B8%D0%BD%D1%86%D0%B8%D0%B4%D0%B5%D0%BD%D1%82%D1%8B%20%D0%B8%D0%BD%D1%84%D0%BE%D1%80%D0%BC%D0%B0%D1%86%D0%B8%D0%BE%D0%BD%D0%BD%D0%BE%D0%B9%20%D0%B1%D0%B5%D0%B7%D0%BE%D0%BF%D0%B0%D1%81%D0%BD%D0%BE%D1%81%D1%82%D0%B8%20-%20CERT-GIB&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=aGBAgAABQAAAAAAEC~&jid=1688341411&gjid=1980211359&cid=1289706080.1674350864&tid=UA-25492706-1&_gid=1800356927.1674350864&gtm=2wg1i0WJ37CH&cg1=RU%3A%20CERT&cd1=1289706080.1674350864&z=1504927969

Requested by

Host: www.group-ib.ru
URL: https://www.group-ib.ru/cert.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 21 Jan 2023 18:07:31 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 26413
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

POST
H/1.0 200
OK visitWebPage
689-lre-818.mktoresp.com/webevents/ 43 B
121 B 615ms
148ms Ping
image/gif 199.15.214.243
OMNITURE

General

Check archive.org

Show headers Download Go to

Full URL: https://689-lre-818.mktoresp.com/webevents/visitWebPage?_mchNc=1674350864481&_mchCn=&_mchId=689-LRE-818&_mchTk=_mch-www.group-ib.ru-1674350864481-23917&_mchHo=www.group-ib.ru&_mchPo=&_mchRu=%2Fcert.html&_mchPc=https%3A&_mchVr=162&_mchEcid=&_mchHa=&_mchRe=&_mchQp=
Requested by: Host: www.group-ib.ru
URL: https://www.group-ib.ru/build/main_26755_2be51925_563_1764.js
Protocol: HTTP/1.0
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 199.15.214.243 , United States, ASN15224 (OMNITURE, US),
Reverse DNS
Software: BigIP /
Resource Hash: cbbd42bb1d88693e6805bd9d676840424af5ecf3e13d874fd06e6b57d53d8d40

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

Connection: Keep-Alive
Content-Length: 43
Server: BigIP

GET
H2 200 25755956.js Show response
js-eu1.hs-analytics.net/analytics/1674350700000/ 65 KB
21 KB 120ms
64ms Script
text/javascript 172.65.238.60
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js-eu1.hs-analytics.net/analytics/1674350700000/25755956.js
Requested by: Host: js-eu1.hs-scripts.com
URL: https://js-eu1.hs-scripts.com/25755956.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.65.238.60 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 321d7348ac755c0e1002c13bf522c559cc1e9b1e1854b13e7f4e39e2afe6a513

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Sun, 22 Jan 2023 01:27:44 GMT
content-encoding: br
cf-cache-status: MISS
x-amz-request-id: XKVWMTXN6XV4PBBQ
x-amz-server-side-encryption: AES256
x-envoy-upstream-service-time: 21
x-amz-id-2: DThKmcL/ZEJUqweG3SN8hy2GotcgkObkaj3OFMZoIeadMBQb7x5s5k4wGjt+NaNqwI5N5Vr+6AA=
x-evy-trace-listener: listener_https
x-evy-trace-route-configuration: listener_https/all
last-modified: Wed, 18 Jan 2023 20:13:15 GMT
server: cloudflare
x-evy-trace-route: nginx-catch-all
etag: W/"89e8b7c2e7ca6450cad72739a89a151b"
vary: origin, Accept-Encoding
content-type: text/javascript
x-evy-trace-virtual-host: all
x-evy-trace-served-by-pod: fra04/analytics-js-proxy-td/envoy-proxy-5976bcf6d-29ll5
cache-control: max-age=300,public
access-control-allow-credentials: false
cf-ray: 78d48247580f8fd1-FRA
expires: Sun, 22 Jan 2023 01:32:44 GMT

GET
H2 200 fb.js Show response
js-eu1.hsadspixel.net/ 6 KB
3 KB 67ms
14ms Script
application/javascript 172.65.219.229
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js-eu1.hsadspixel.net/fb.js
Requested by: Host: js-eu1.hs-scripts.com
URL: https://js-eu1.hs-scripts.com/25755956.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.65.219.229 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 27f0d709041eb37753cad3710e46e3860ce42c28c8992d29e8c58fba33fa9910

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Sun, 22 Jan 2023 01:27:44 GMT
x-amz-version-id: SDrNOl8ziD8gAW.Yx4_m5h0e_hjF8Ssn
via: 1.1 d8670b0c6b76371fb58f730881dfe504.cloudfront.net (CloudFront)
cf-cache-status: HIT
content-encoding: br
x-amz-cf-pop: FRA56-C2
age: 243
x-amz-server-side-encryption: AES256
content-security-policy-report-only: frame-ancestors 'self'; report-uri https://exceptions.hubspot.com/csp/report?resource=adsscriptloaderstatic/static-1.316/bundles/pixels-release.js&cfRay=78d47c55997f9267-FRA
x-cache: Hit from cloudfront
cache-tag: staticjsapp-AdsScriptLoaderCloudflare-web-prod,staticjsapp-prod
x-envoy-upstream-service-time: 3
x-amz-replication-status: COMPLETED
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
last-modified: Fri, 20 Jan 2023 04:29:49 UTC
server: cloudflare
x-evy-trace-route: nginx-catch-all
etag: W/"c400e8c1e05d683a64923854807562fd"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
x-hs-cache-status: HIT
x-evy-trace-virtual-host: all
cache-control: max-age=600
x-evy-trace-served-by-pod: fra04/app-td/envoy-proxy-6bdc87f4c5-nfdbk
cf-ray: 78d482475f7891d2-FRA
x-amz-cf-id: 8wiH-XSK0azTwJp6dGNVC17pLBwZTuh1HHcfQjWpwDzd1jGtwfjzpA==
x-hs-target-asset: adsscriptloaderstatic/static-1.316/bundles/pixels-release.js

GET
H2 200 collectedforms.js Show response
js-eu1.hscollectedforms.net/ 68 KB
25 KB 72ms
20ms Script
application/javascript 172.65.192.122
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js-eu1.hscollectedforms.net/collectedforms.js
Requested by: Host: js-eu1.hs-scripts.com
URL: https://js-eu1.hs-scripts.com/25755956.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.65.192.122 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3999cf864b43937c278afeae5b60b6db69bb234d5641202c9e7a2385029aa3b7

Request headers

Referer
Origin: https://www.group-ib.ru
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Sun, 22 Jan 2023 01:27:44 GMT
x-amz-version-id: SN4HXBautbT5xHa4DdPckLpyluwLE8QR
via: 1.1 cbe141923b7469a299306144733821c2.cloudfront.net (CloudFront)
cf-cache-status: HIT
content-encoding: br
x-amz-cf-pop: FRA56-C2
age: 4
x-amz-server-side-encryption: AES256
content-security-policy-report-only: frame-ancestors 'self'; report-uri https://exceptions.hubspot.com/csp/report?resource=collected-forms-embed-js/static-1.312/bundles/project.js&cfRay=78d4822bef869a2f-FRA
x-cache: Hit from cloudfront
cache-tag: staticjsapp-collected-forms-embed-js-web-prod,staticjsapp-prod
x-envoy-upstream-service-time: 2
x-amz-replication-status: COMPLETED
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
last-modified: Wed, 07 Dec 2022 02:49:13 UTC
server: cloudflare
x-evy-trace-route: nginx-catch-all
etag: W/"349cabd549e2249f8fb6ac3ac6f08e00"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
x-evy-trace-virtual-host: all
x-hs-cache-status: HIT
cache-control: s-maxage=600, max-age=300
x-evy-trace-served-by-pod: fra04/app-td/envoy-proxy-6bdc87f4c5-x5jnd
cf-ray: 78d4824758909963-FRA
x-amz-cf-id: XlwIoPzcgeW2VoTHVXCbCJi_iRbwpc0Qc6iYkwdAagOuan-L1YFWwQ==
x-hs-target-asset: collected-forms-embed-js/static-1.312/bundles/project.js

GET
H2 200 banner.js Show response
js-eu1.hs-banner.com/v2/25755956/ 202 KB
63 KB 65ms
19ms Script
text/javascript 172.65.202.201
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js-eu1.hs-banner.com/v2/25755956/banner.js
Requested by: Host: js-eu1.hs-scripts.com
URL: https://js-eu1.hs-scripts.com/25755956.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.65.202.201 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 132b669c9634c5296fd3e6802091f16c490089a12c26c4078c2c30754ab17587

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Sun, 22 Jan 2023 01:27:44 GMT
x-amz-version-id: F6GYaCRPqK4IYB5GHkfjAxCM0YTry982
content-encoding: br
cf-cache-status: HIT
x-amz-request-id: RRWSDP5SBD9ZMA6C
age: 3
x-amz-server-side-encryption: AES256
x-amz-id-2: wFTR1fG9ovKy+ZkRKqMcVxF7xLws/HuHqWNVc/7/b1zTE9W3MOy+sjMB5IFgPJi6kzm/0FOQsi8=
last-modified: Thu, 08 Dec 2022 22:08:21 GMT
server: cloudflare
etag: W/"6ffab64f6c18fc303c61b02bbf12428e"
access-control-max-age: 604800
access-control-allow-methods: GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: https://www.group-ib.com
access-control-expose-headers: x-last-modified-timestamp, X-HubSpot-NotFound, X-HS-User-Request, Link, Server-Timing
cache-control: max-age=300, public
access-control-allow-credentials: true
vary: origin, Accept-Encoding
timing-allow-origin: *
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Accept-Charset, Accept-Encoding, X-Override-Internal-Permissions, X-Properties-Source, X-Properties-SourceId, X-Properties-Flag, X-Hubspot-User-Id, X-Hubspot-Trace, X-Hubspot-Callee, X-Hubspot-Offset, X-Hubspot-No-Trace, X-HubSpot-Static-App-Info, X-HubSpot-Messages-Uri, X-HubSpot-Request-Source, X-HubSpot-Request-Reason, Subscription-Billing-Auth-Token, X-App-CSRF, X-Tools-CSRF, Online-Payment-Signing-UUID, X-Source, X-SourceId, X-Origin-UserId, X-Biden-Request-Source, X-HubSpot-CSRF-hubspotapi, X-Force-Cookie-Refresh, X-Force-Cookie-Refresh-No-Cache, X-HS-User-Request, X-Application-Id, X-HS-Referer, X-HubSpot-Correlation-Id
cf-ray: 78d482474edd2bfc-FRA
expires: Sun, 22 Jan 2023 01:32:41 GMT

GET
H2 200 notify Show response
api.neverbounce.com/v4/poe/ 108 B
326 B 335ms
114ms Script
application/javascript 52.6.202.178
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://api.neverbounce.com/v4/poe/notify?key=public_feedec8c69cd171b06421bb96273f04d&event=form.load&callback=__neverbounce_459540

Requested by

Host: cdn.neverbounce.com
URL: https://cdn.neverbounce.com/widget/dist/NeverBounce.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.6.202.178 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-52-6-202-178.compute-1.amazonaws.com

Software

nginx /

Resource Hash

840bed8793252ac8937e135033551aee2737d7969d8d8adc86128aec419be5c1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Sun, 22 Jan 2023 01:27:44 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
server: nginx
vary: Accept-Encoding
content-type: application/javascript
cache-control: no-cache, private
x-ua-compatible: IE=Edge

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
492 B 194ms
185ms Image
image/gif 23.44.74.52
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=e84d9c08a990af8592952e7ac9a983ad&svisitor=null&visitor=9e5e73de-3d3c-437c-85b6-f17c16eac8d2&session=2737c4a5-72f6-4e34-8244-6a02696724e1&event=a_pageload&q=%7B%22pageLoadTime%22%3A%22Sun%2C%2022%20Jan%202023%2001%3A27%3A44%20GMT%22%7D&isIframe=false&m=%7B%22description%22%3A%22CERT-GIB%20%E2%80%93%20%D1%86%D0%B5%D0%BD%D1%82%D1%80%20%D0%BA%D1%80%D1%83%D0%B3%D0%BB%D0%BE%D1%81%D1%83%D1%82%D0%BE%D1%87%D0%BD%D0%BE%D0%B3%D0%BE%20%D1%80%D0%B5%D0%B0%D0%B3%D0%B8%D1%80%D0%BE%D0%B2%D0%B0%D0%BD%D0%B8%D1%8F%20%D0%BD%D0%B0%20%D0%B8%D0%BD%D1%86%D0%B8%D0%B4%D0%B5%D0%BD%D1%82%D1%8B%20%D0%B8%D0%BD%D1%84%D0%BE%D1%80%D0%BC%D0%B0%D1%86%D0%B8%D0%BE%D0%BD%D0%BD%D0%BE%D0%B9%20%D0%B1%D0%B5%D0%B7%D0%BE%D0%BF%D0%B0%D1%81%D0%BD%D0%BE%D1%81%D1%82%D0%B8.%20%D0%9F%D0%BE%D0%B7%D0%B2%D0%BE%D0%BD%D0%B8%D1%82%D0%B5%20%D0%BD%D0%B0%D0%BC%2C%20%D1%87%D1%82%D0%BE%D0%B1%D1%8B%20%D1%81%D0%BE%D0%BE%D0%B1%D1%89%D0%B8%D1%82%D1%8C%20%D0%BE%D0%B1%20%D0%B8%D0%BD%D1%86%D0%B8%D0%B4%D0%B5%D0%BD%D1%82%D0%B5%20%D0%B8%20%D0%BF%D0%BE%D0%BB%D1%83%D1%87%D0%B8%D1%82%D0%B5%20%D0%B1%D0%B5%D1%81%D0%BF%D0%BB%D0%B0%D1%82%D0%BD%D1%83%D1%8E%20%D0%BF%D0%B5%D1%80%D0%B2%D1%83%D1%8E%20%D0%BF%D0%BE%D0%BC%D0%BE%D1%89%D1%8C.%22%2C%22keywords%22%3A%22%D0%B3%D1%80%D1%83%D0%BF%D0%BF%D0%B0%2C%20%D1%80%D0%B5%D0%B0%D0%B3%D0%B8%D1%80%D0%BE%D0%B2%D0%B0%D0%BD%D0%B8%D0%B5%2C%20%D0%B8%D0%BD%D1%86%D0%B8%D0%B4%D0%B5%D0%BD%D1%82%2C%20%D0%B8%D0%B1%2C%20%D0%B8%D0%BD%D1%84%D0%BE%D1%80%D0%BC%D0%B0%D1%86%D0%B8%D0%BE%D0%BD%D0%BD%D0%B0%D1%8F%20%D0%B1%D0%B5%D0%B7%D0%BE%D0%BF%D0%B0%D1%81%D0%BD%D0%BE%D1%81%D1%82%D1%8C%2C%20%D0%BA%D1%80%D1%83%D0%B3%D0%BB%D0%BE%D1%81%D1%83%D1%82%D0%BE%D1%87%D0%BD%D0%BE%2C%20%D0%BE%D0%BF%D0%B5%D1%80%D0%B0%D1%82%D0%B8%D0%B2%D0%BD%D0%BE%2C%20%D0%BA%D0%B8%D0%B1%D0%B5%D1%80%D1%83%D0%B3%D1%80%D0%BE%D0%B7%D0%B0%22%2C%22title%22%3A%22%D0%93%D1%80%D1%83%D0%BF%D0%BF%D0%B0%20%D0%BE%D0%BF%D0%B5%D1%80%D0%B0%D1%82%D0%B8%D0%B2%D0%BD%D0%BE%D0%B3%D0%BE%20%D1%80%D0%B5%D0%B0%D0%B3%D0%B8%D1%80%D0%BE%D0%B2%D0%B0%D0%BD%D0%B8%D1%8F%20%D0%BD%D0%B0%20%D0%B8%D0%BD%D1%86%D0%B8%D0%B4%D0%B5%D0%BD%D1%82%D1%8B%20%D0%B8%D0%BD%D1%84%D0%BE%D1%80%D0%BC%D0%B0%D1%86%D0%B8%D0%BE%D0%BD%D0%BD%D0%BE%D0%B9%20%D0%B1%D0%B5%D0%B7%D0%BE%D0%BF%D0%B0%D1%81%D0%BD%D0%BE%D1%81%D1%82%D0%B8%20-%20CERT-GIB%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.group-ib.ru%2Fcert.html&pageViewId=ca6c969a-f69d-48e7-86b5-6aa9493dd8d4&an_uid=0

Requested by

Host: www.group-ib.ru
URL: https://www.group-ib.ru/cert.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.44.74.52 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-44-74-52.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Sun, 22 Jan 2023 01:27:44 GMT
x-content-type-options: nosniff
content-length: 43
pragma: no-cache
last-modified: Tue, 05 Oct 2021 22:17:52 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "615ccf10-2b"
access-control-max-age: 86400
access-control-allow-methods: GET,POST
content-type: image/gif
access-control-allow-origin
cache-control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: *
expires: Wed, 19 Apr 2000 11:43:00 GMT

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
494 B 194ms
187ms Image
image/gif 23.44.74.52
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=e84d9c08a990af8592952e7ac9a983ad&svisitor=null&visitor=9e5e73de-3d3c-437c-85b6-f17c16eac8d2&session=2737c4a5-72f6-4e34-8244-6a02696724e1&event=play&q=%7B%22event_id%22%3A%22%22%2C%22event_value%22%3A%22https%3A%2F%2Fwww.group-ib.ru%2Fvideo%2Fcert-video.mp4%22%7D&isIframe=false&m=%7B%22description%22%3A%22CERT-GIB%20%E2%80%93%20%D1%86%D0%B5%D0%BD%D1%82%D1%80%20%D0%BA%D1%80%D1%83%D0%B3%D0%BB%D0%BE%D1%81%D1%83%D1%82%D0%BE%D1%87%D0%BD%D0%BE%D0%B3%D0%BE%20%D1%80%D0%B5%D0%B0%D0%B3%D0%B8%D1%80%D0%BE%D0%B2%D0%B0%D0%BD%D0%B8%D1%8F%20%D0%BD%D0%B0%20%D0%B8%D0%BD%D1%86%D0%B8%D0%B4%D0%B5%D0%BD%D1%82%D1%8B%20%D0%B8%D0%BD%D1%84%D0%BE%D1%80%D0%BC%D0%B0%D1%86%D0%B8%D0%BE%D0%BD%D0%BD%D0%BE%D0%B9%20%D0%B1%D0%B5%D0%B7%D0%BE%D0%BF%D0%B0%D1%81%D0%BD%D0%BE%D1%81%D1%82%D0%B8.%20%D0%9F%D0%BE%D0%B7%D0%B2%D0%BE%D0%BD%D0%B8%D1%82%D0%B5%20%D0%BD%D0%B0%D0%BC%2C%20%D1%87%D1%82%D0%BE%D0%B1%D1%8B%20%D1%81%D0%BE%D0%BE%D0%B1%D1%89%D0%B8%D1%82%D1%8C%20%D0%BE%D0%B1%20%D0%B8%D0%BD%D1%86%D0%B8%D0%B4%D0%B5%D0%BD%D1%82%D0%B5%20%D0%B8%20%D0%BF%D0%BE%D0%BB%D1%83%D1%87%D0%B8%D1%82%D0%B5%20%D0%B1%D0%B5%D1%81%D0%BF%D0%BB%D0%B0%D1%82%D0%BD%D1%83%D1%8E%20%D0%BF%D0%B5%D1%80%D0%B2%D1%83%D1%8E%20%D0%BF%D0%BE%D0%BC%D0%BE%D1%89%D1%8C.%22%2C%22keywords%22%3A%22%D0%B3%D1%80%D1%83%D0%BF%D0%BF%D0%B0%2C%20%D1%80%D0%B5%D0%B0%D0%B3%D0%B8%D1%80%D0%BE%D0%B2%D0%B0%D0%BD%D0%B8%D0%B5%2C%20%D0%B8%D0%BD%D1%86%D0%B8%D0%B4%D0%B5%D0%BD%D1%82%2C%20%D0%B8%D0%B1%2C%20%D0%B8%D0%BD%D1%84%D0%BE%D1%80%D0%BC%D0%B0%D1%86%D0%B8%D0%BE%D0%BD%D0%BD%D0%B0%D1%8F%20%D0%B1%D0%B5%D0%B7%D0%BE%D0%BF%D0%B0%D1%81%D0%BD%D0%BE%D1%81%D1%82%D1%8C%2C%20%D0%BA%D1%80%D1%83%D0%B3%D0%BB%D0%BE%D1%81%D1%83%D1%82%D0%BE%D1%87%D0%BD%D0%BE%2C%20%D0%BE%D0%BF%D0%B5%D1%80%D0%B0%D1%82%D0%B8%D0%B2%D0%BD%D0%BE%2C%20%D0%BA%D0%B8%D0%B1%D0%B5%D1%80%D1%83%D0%B3%D1%80%D0%BE%D0%B7%D0%B0%22%2C%22title%22%3A%22%D0%93%D1%80%D1%83%D0%BF%D0%BF%D0%B0%20%D0%BE%D0%BF%D0%B5%D1%80%D0%B0%D1%82%D0%B8%D0%B2%D0%BD%D0%BE%D0%B3%D0%BE%20%D1%80%D0%B5%D0%B0%D0%B3%D0%B8%D1%80%D0%BE%D0%B2%D0%B0%D0%BD%D0%B8%D1%8F%20%D0%BD%D0%B0%20%D0%B8%D0%BD%D1%86%D0%B8%D0%B4%D0%B5%D0%BD%D1%82%D1%8B%20%D0%B8%D0%BD%D1%84%D0%BE%D1%80%D0%BC%D0%B0%D1%86%D0%B8%D0%BE%D0%BD%D0%BD%D0%BE%D0%B9%20%D0%B1%D0%B5%D0%B7%D0%BE%D0%BF%D0%B0%D1%81%D0%BD%D0%BE%D1%81%D1%82%D0%B8%20-%20CERT-GIB%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.group-ib.ru%2Fcert.html&pageViewId=ca6c969a-f69d-48e7-86b5-6aa9493dd8d4&an_uid=0

Requested by

Host: www.group-ib.ru
URL: https://www.group-ib.ru/cert.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.44.74.52 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-44-74-52.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Sun, 22 Jan 2023 01:27:44 GMT
x-content-type-options: nosniff
content-length: 43
pragma: no-cache
last-modified: Sat, 05 Jun 2021 07:56:05 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "60bb2e15-2b"
access-control-max-age: 86400
access-control-allow-methods: GET,POST
content-type: image/gif
access-control-allow-origin
cache-control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: *
expires: Wed, 19 Apr 2000 11:43:00 GMT

GET
H2 200 ga-audiences
www.google.com/ads/ 42 B
501 B 130ms
53ms Image
image/gif 2a00:1450:400d:80a::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j99&tid=UA-25492706-1&cid=1289706080.1674350864&jid=1688341411&_u=aGBAgAABQAAAAEAEC~&z=590792521

Requested by

Host: www.group-ib.ru
URL: https://www.group-ib.ru/cert.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400d:80a::2004 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 22 Jan 2023 01:27:44 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.de/ads/ 42 B
501 B 61ms
24ms Image
image/gif 2a00:1450:4001:830::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j99&tid=UA-25492706-1&cid=1289706080.1674350864&jid=1688341411&_u=aGBAgAABQAAAAEAEC~&z=590792521

Requested by

Host: www.group-ib.ru
URL: https://www.group-ib.ru/cert.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 22 Jan 2023 01:27:44 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.facebook.com/tr/ 0
31 B 14ms
6ms Image
text/plain 2a03:2880:f176:181:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=545899479446758&ev=PageView&dl=https%3A%2F%2Fwww.group-ib.ru%2Fcert.html&rl=&if=false&ts=1674350864557&sw=1600&sh=1200&v=2.9.94&r=stable&ec=0&o=30&fbp=fb.1.1674350864556.609879716&it=1674350864300&coo=false&rqm=GET

Requested by

Host: www.group-ib.ru
URL: https://www.group-ib.ru/cert.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f176:181:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
date: Sun, 22 Jan 2023 01:27:44 GMT
server: proxygen-bolt
content-type: text/plain
access-control-allow-origin
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 0

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
492 B 193ms
192ms Image
image/gif 23.44.74.52
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=e84d9c08a990af8592952e7ac9a983ad&svisitor=null&visitor=9e5e73de-3d3c-437c-85b6-f17c16eac8d2&session=2737c4a5-72f6-4e34-8244-6a02696724e1&event=ipv6&q=%7B%22address%22%3A%222a00%3Ac98%3A2050%3Aa007%3A2%3A%3A10%22%7D&isIframe=false&m=%7B%22description%22%3A%22CERT-GIB%20%E2%80%93%20%D1%86%D0%B5%D0%BD%D1%82%D1%80%20%D0%BA%D1%80%D1%83%D0%B3%D0%BB%D0%BE%D1%81%D1%83%D1%82%D0%BE%D1%87%D0%BD%D0%BE%D0%B3%D0%BE%20%D1%80%D0%B5%D0%B0%D0%B3%D0%B8%D1%80%D0%BE%D0%B2%D0%B0%D0%BD%D0%B8%D1%8F%20%D0%BD%D0%B0%20%D0%B8%D0%BD%D1%86%D0%B8%D0%B4%D0%B5%D0%BD%D1%82%D1%8B%20%D0%B8%D0%BD%D1%84%D0%BE%D1%80%D0%BC%D0%B0%D1%86%D0%B8%D0%BE%D0%BD%D0%BD%D0%BE%D0%B9%20%D0%B1%D0%B5%D0%B7%D0%BE%D0%BF%D0%B0%D1%81%D0%BD%D0%BE%D1%81%D1%82%D0%B8.%20%D0%9F%D0%BE%D0%B7%D0%B2%D0%BE%D0%BD%D0%B8%D1%82%D0%B5%20%D0%BD%D0%B0%D0%BC%2C%20%D1%87%D1%82%D0%BE%D0%B1%D1%8B%20%D1%81%D0%BE%D0%BE%D0%B1%D1%89%D0%B8%D1%82%D1%8C%20%D0%BE%D0%B1%20%D0%B8%D0%BD%D1%86%D0%B8%D0%B4%D0%B5%D0%BD%D1%82%D0%B5%20%D0%B8%20%D0%BF%D0%BE%D0%BB%D1%83%D1%87%D0%B8%D1%82%D0%B5%20%D0%B1%D0%B5%D1%81%D0%BF%D0%BB%D0%B0%D1%82%D0%BD%D1%83%D1%8E%20%D0%BF%D0%B5%D1%80%D0%B2%D1%83%D1%8E%20%D0%BF%D0%BE%D0%BC%D0%BE%D1%89%D1%8C.%22%2C%22keywords%22%3A%22%D0%B3%D1%80%D1%83%D0%BF%D0%BF%D0%B0%2C%20%D1%80%D0%B5%D0%B0%D0%B3%D0%B8%D1%80%D0%BE%D0%B2%D0%B0%D0%BD%D0%B8%D0%B5%2C%20%D0%B8%D0%BD%D1%86%D0%B8%D0%B4%D0%B5%D0%BD%D1%82%2C%20%D0%B8%D0%B1%2C%20%D0%B8%D0%BD%D1%84%D0%BE%D1%80%D0%BC%D0%B0%D1%86%D0%B8%D0%BE%D0%BD%D0%BD%D0%B0%D1%8F%20%D0%B1%D0%B5%D0%B7%D0%BE%D0%BF%D0%B0%D1%81%D0%BD%D0%BE%D1%81%D1%82%D1%8C%2C%20%D0%BA%D1%80%D1%83%D0%B3%D0%BB%D0%BE%D1%81%D1%83%D1%82%D0%BE%D1%87%D0%BD%D0%BE%2C%20%D0%BE%D0%BF%D0%B5%D1%80%D0%B0%D1%82%D0%B8%D0%B2%D0%BD%D0%BE%2C%20%D0%BA%D0%B8%D0%B1%D0%B5%D1%80%D1%83%D0%B3%D1%80%D0%BE%D0%B7%D0%B0%22%2C%22title%22%3A%22%D0%93%D1%80%D1%83%D0%BF%D0%BF%D0%B0%20%D0%BE%D0%BF%D0%B5%D1%80%D0%B0%D1%82%D0%B8%D0%B2%D0%BD%D0%BE%D0%B3%D0%BE%20%D1%80%D0%B5%D0%B0%D0%B3%D0%B8%D1%80%D0%BE%D0%B2%D0%B0%D0%BD%D0%B8%D1%8F%20%D0%BD%D0%B0%20%D0%B8%D0%BD%D1%86%D0%B8%D0%B4%D0%B5%D0%BD%D1%82%D1%8B%20%D0%B8%D0%BD%D1%84%D0%BE%D1%80%D0%BC%D0%B0%D1%86%D0%B8%D0%BE%D0%BD%D0%BD%D0%BE%D0%B9%20%D0%B1%D0%B5%D0%B7%D0%BE%D0%BF%D0%B0%D1%81%D0%BD%D0%BE%D1%81%D1%82%D0%B8%20-%20CERT-GIB%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.group-ib.ru%2Fcert.html&pageViewId=ca6c969a-f69d-48e7-86b5-6aa9493dd8d4&an_uid=0

Requested by

Host: www.group-ib.ru
URL: https://www.group-ib.ru/cert.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.44.74.52 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-44-74-52.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Sun, 22 Jan 2023 01:27:44 GMT
x-content-type-options: nosniff
content-length: 43
pragma: no-cache
last-modified: Fri, 21 Feb 2020 18:57:20 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "5e502810-2b"
access-control-max-age: 86400
access-control-allow-methods: GET,POST
content-type: image/gif
access-control-allow-origin
cache-control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: *
expires: Wed, 19 Apr 2000 11:43:00 GMT

GET
H2 200 json Show response
forms-eu1.hubspot.com/collected-forms/v1/config/ 116 B
1019 B 68ms
22ms XHR
application/json 172.65.193.34
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://forms-eu1.hubspot.com/collected-forms/v1/config/json?portalId=25755956&utk=

Requested by

Host: www.group-ib.ru
URL: https://www.group-ib.ru/build/main_26755_2be51925_563_1764.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.65.193.34 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

43f22362329b9705cf8629061fb5b1d1a38f1cc2bc9fd46728f73e5cd9eb77cf

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Accept: application/json, text/plain, */*
Referer
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Sun, 22 Jan 2023 01:27:44 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: br
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-hubspot-correlation-id: 6e645036-a4cf-4ac8-9774-bafbfbfb6c0e
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
server: cloudflare
vary: origin
access-control-allow-methods: GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD
content-type: application/json;charset=utf-8
access-control-allow-origin: https://www.group-ib.ru
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=s1uZRLf7312vqlfCa1F34nmcvguBDrkGBOG22rh2PdmA65eWYHS8zL%2Fvg1N0gH0wPnyIhPOchxpoEdfvKBOJ7C4UZcA%2BgvnujScWC6PiQmitcCKf%2FFJNwjokZvMYS44ELptdJvBAKw%3D%3D"}],"group":"cf-nel","max_age":604800}
access-control-max-age: 180
access-control-allow-credentials: false
x-robots-tag: none
access-control-allow-headers: *
cf-ray: 78d48247ed912c4a-FRA

GET
H2 200 json Show response
api-eu1.hubapi.com/hs-script-loader-public/v1/config/pixels-and-events/ 250 B
912 B 52ms
27ms XHR
application/json 2606:4700::6811:cacc
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://api-eu1.hubapi.com/hs-script-loader-public/v1/config/pixels-and-events/json?portalId=25755956

Requested by

Host: www.group-ib.ru
URL: https://www.group-ib.ru/build/main_26755_2be51925_563_1764.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:cacc , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

fc50d7c745b4b7ad268ab0c4a71b545dab230889a7f171a29e4a6534041f65bc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Sun, 22 Jan 2023 01:27:44 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: br
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-hubspot-correlation-id: c0f8fd86-5c47-436c-93ba-c24250cb932a
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
server: cloudflare
x-trace: 2B40D31B6F8229B42586C79C26FD3410D40BBA06EE000000000000000000
vary: origin
access-control-allow-methods: GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD
content-type: application/json;charset=utf-8
access-control-allow-origin: https://www.group-ib.ru
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=XofA0GCn1UsjYqH1s0kHRr71DnioAJilrNr1uUqkvgOcTGZ4qfht8o8LbvrAvXjB5SrQi5TsUrHL7nsweHogSYxwgsRnldDpMp3cpNtlC%2Fo9Shfc5Ni0cKbLVoAHC2CxnjdNoD45YKrvCKkLwVk7Mw%3D%3D"}],"group":"cf-nel","max_age":604800}
access-control-max-age: 180
access-control-allow-credentials: false
cf-ray: 78d48247d9d12c62-FRA
access-control-allow-headers: *

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 176 KB
64 KB 27ms
26ms Script
application/javascript 2a00:1450:4001:812::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-10882981508

Requested by

Host: js-eu1.hsadspixel.net
URL: https://js-eu1.hsadspixel.net/fb.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

1704f32f6b6e4bd751881c6bf649e22817115071190df38b412dea1169d8865b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Sun, 22 Jan 2023 01:27:44 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 65785
x-xss-protection: 0
last-modified: Sun, 22 Jan 2023 00:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Sun, 22 Jan 2023 01:27:44 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 176 KB
64 KB 28ms
28ms Script
application/javascript 2a00:1450:4001:812::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-10882981508&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-WJ37CH

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

7269a5d82fd6e7eb1922bd7033cf7cd9809042082b8fedfe30e92bf1616a2264

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Sun, 22 Jan 2023 01:27:44 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 65757
x-xss-protection: 0
last-modified: Sun, 22 Jan 2023 00:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Sun, 22 Jan 2023 01:27:44 GMT

GET
H2

400

sync_cookie_image_decide
mc.yandex.com/
Redirect Chain

https://mc.yandex.com/sync_cookie_image_check
https://mc.yandex.ru/sync_cookie_image_start?redirect_domain=mc.yandex.com&token=9890.-sjHfYSmdXmZYFNkuUMZ1IzCCkbwGsVVrkALFRiXn6PiUOIvoTTHDF7_vvRWbgGd.7fpCW5UwfQdjI0zxLWt6fAKBDEc%2C
https://mc.yandex.com/sync_cookie_image_decide?token=9890.82qW9z3HTBKd_Vpl19-T_erIquMBh07Cuxg3DyZzm28K19qIgkxBtKSNNDVfmTQXD7sIpvchmQNiqV0jGhhWdqx-ZXg1RbB-3d5giQPriaQ%2C.hIoEIKX8pmuiUqkUdSjK3B-A03Y%2C

75 B
75 B

54ms
53ms

Image
text/html

2a02:6b8::1:119
GLOBAL_DC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://mc.yandex.com/sync_cookie_image_decide?token=9890.82qW9z3HTBKd_Vpl19-T_erIquMBh07Cuxg3DyZzm28K19qIgkxBtKSNNDVfmTQXD7sIpvchmQNiqV0jGhhWdqx-ZXg1RbB-3d5giQPriaQ%2C.hIoEIKX8pmuiUqkUdSjK3B-A03Y%2C

Requested by

Host: www.group-ib.ru
URL: https://www.group-ib.ru/cert.html

Protocol

Server

2a02:6b8::1:119 Moscow, Russian Federation, ASN208722 (GLOBAL_DC, FI),

Reverse DNS

Software

Resource Hash

8398a026313c016324f186d1c9b24a46813109d4bc5477d910a683079cbf1434

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Sun, 22 Jan 2023 01:27:44 GMT
strict-transport-security: max-age=31536000
content-length: 75
x-xss-protection: 1; mode=block
content-type: text/html; charset=utf-8

Redirect headers

location: https://mc.yandex.com/sync_cookie_image_decide?token=9890.82qW9z3HTBKd_Vpl19-T_erIquMBh07Cuxg3DyZzm28K19qIgkxBtKSNNDVfmTQXD7sIpvchmQNiqV0jGhhWdqx-ZXg1RbB-3d5giQPriaQ%2C.hIoEIKX8pmuiUqkUdSjK3B-A03Y%2C
date: Sun, 22 Jan 2023 01:27:44 GMT
strict-transport-security: max-age=31536000
x-xss-protection: 1; mode=block

GET
H2 200 counters.gif
forms-eu1.hsforms.com/embed/v3/ 35 B
168 B 326ms
25ms Image
image/gif 172.65.232.43
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://forms-eu1.hsforms.com/embed/v3/counters.gif?key=collected-forms-embed-js-form-bind&count=1

Requested by

Host: www.group-ib.ru
URL: https://www.group-ib.ru/cert.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.65.232.43 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Sun, 22 Jan 2023 01:27:44 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
cf-cache-status: DYNAMIC
server: cloudflare
x-hubspot-correlation-id: 7b73abbb-1477-4698-a643-bac723e401c9
x-trace: 2BBE2716502AC9AF302529160A610DB46AF1B68BA4000000000000000000
vary: origin
content-type: image/gif
access-control-expose-headers: X-Origin-Hublet
cache-control: max-age=0, no-cache, no-store
access-control-allow-credentials: false
x-robots-tag: none
cf-ray: 78d4824a0e005ca4-FRA
content-length: 35
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H2 200 advert.gif
mc.yandex.com/metrika/ 43 B
113 B 52ms
51ms Image
image/gif 2a02:6b8::1:119
GLOBAL_DC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://mc.yandex.com/metrika/advert.gif

Requested by

Host: www.group-ib.ru
URL: https://www.group-ib.ru/cert.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:6b8::1:119 Moscow, Russian Federation, ASN208722 (GLOBAL_DC, FI),

Reverse DNS

Software

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Sun, 22 Jan 2023 01:27:44 GMT
strict-transport-security: max-age=31536000
last-modified: Thu, 19 Jan 2023 15:40:43 GMT
accept-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
etag: "63c93a4b-2b"
content-type: image/gif
access-control-allow-origin: *
cache-control: max-age=3600
accept-ranges: bytes
content-length: 43
expires: Sun, 22 Jan 2023 02:27:44 GMT

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/10882981508/ 2 KB
2 KB 102ms
60ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/10882981508/?random=1674350864718&cv=11&fst=1674350864718&bg=ffffff&guid=ON&async=1&gtm=2oa1i0&u_w=1600&u_h=1200&hn=www.googleadservices.com&frm=0&url=https%3A%2F%2Fwww.group-ib.ru%2Fcert.html&tiba=%D0%93%D1%80%D1%83%D0%BF%D0%BF%D0%B0%20%D0%BE%D0%BF%D0%B5%D1%80%D0%B0%D1%82%D0%B8%D0%B2%D0%BD%D0%BE%D0%B3%D0%BE%20%D1%80%D0%B5%D0%B0%D0%B3%D0%B8%D1%80%D0%BE%D0%B2%D0%B0%D0%BD%D0%B8%D1%8F%20%D0%BD%D0%B0%20%D0%B8%D0%BD%D1%86%D0%B8%D0%B4%D0%B5%D0%BD%D1%82&did=dZTQ1Zm&gdid=dZTQ1Zm&auid=1744288069.1674350864&data=event%3Dgtag.config&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-10882981508&l=dataLayer&cx=c

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

efa932074c870b37032de4416e0737cb005b6b99e79cb671b6366ac1c326a79c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 22 Jan 2023 01:27:44 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 951
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.com/pagead/1p-user-list/10882981508/ 42 B
154 B 58ms
54ms Image
image/gif 2a00:1450:400d:80a::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/10882981508/?random=1674350864718&cv=11&fst=1674349200000&bg=ffffff&guid=ON&async=1&gtm=2oa1i0&u_w=1600&u_h=1200&frm=0&url=https%3A%2F%2Fwww.group-ib.ru%2Fcert.html&tiba=%D0%93%D1%80%D1%83%D0%BF%D0%BF%D0%B0%20%D0%BE%D0%BF%D0%B5%D1%80%D0%B0%D1%82%D0%B8%D0%B2%D0%BD%D0%BE%D0%B3%D0%BE%20%D1%80%D0%B5%D0%B0%D0%B3%D0%B8%D1%80%D0%BE%D0%B2%D0%B0%D0%BD%D0%B8%D1%8F%20%D0%BD%D0%B0%20%D0%B8%D0%BD%D1%86%D0%B8%D0%B4%D0%B5%D0%BD%D1%82&data=event%3Dgtag.config&fmt=3&is_vtc=1&random=2870002081&rmt_tld=0&ipr=y

Requested by

Host: www.group-ib.ru
URL: https://www.group-ib.ru/cert.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400d:80a::2004 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 22 Jan 2023 01:27:44 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.de/pagead/1p-user-list/10882981508/ 42 B
154 B 30ms
26ms Image
image/gif 2a00:1450:4001:830::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/10882981508/?random=1674350864718&cv=11&fst=1674349200000&bg=ffffff&guid=ON&async=1&gtm=2oa1i0&u_w=1600&u_h=1200&frm=0&url=https%3A%2F%2Fwww.group-ib.ru%2Fcert.html&tiba=%D0%93%D1%80%D1%83%D0%BF%D0%BF%D0%B0%20%D0%BE%D0%BF%D0%B5%D1%80%D0%B0%D1%82%D0%B8%D0%B2%D0%BD%D0%BE%D0%B3%D0%BE%20%D1%80%D0%B5%D0%B0%D0%B3%D0%B8%D1%80%D0%BE%D0%B2%D0%B0%D0%BD%D0%B8%D1%8F%20%D0%BD%D0%B0%20%D0%B8%D0%BD%D1%86%D0%B8%D0%B4%D0%B5%D0%BD%D1%82&data=event%3Dgtag.config&fmt=3&is_vtc=1&random=2870002081&rmt_tld=1&ipr=y

Requested by

Host: www.group-ib.ru
URL: https://www.group-ib.ru/cert.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 22 Jan 2023 01:27:44 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

1 Show response
mc.yandex.com/watch/20002900/
Redirect Chain

https://mc.yandex.com/watch/20002900?wmode=7&page-url=https%3A%2F%2Fwww.group-ib.ru%2Fcert.html&charset=utf-8&browser-info=pv%3A1%3Avf%3Asmv4ejgykhrjvgldb09nr%3Afp%3A864%3Afu%3A0%3Aen%3Autf-8%3Ala%...
https://mc.yandex.com/watch/20002900/1?wmode=7&page-url=https%3A%2F%2Fwww.group-ib.ru%2Fcert.html&charset=utf-8&browser-info=pv%3A1%3Avf%3Asmv4ejgykhrjvgldb09nr%3Afp%3A864%3Afu%3A0%3Aen%3Autf-8%3Al...

435 B
796 B

60ms
59ms

XHR
application/json

2a02:6b8::1:119
GLOBAL_DC

General

Check archive.org

Show headers Download Go to

Full URL

https://mc.yandex.com/watch/20002900/1?wmode=7&page-url=https%3A%2F%2Fwww.group-ib.ru%2Fcert.html&charset=utf-8&browser-info=pv%3A1%3Avf%3Asmv4ejgykhrjvgldb09nr%3Afp%3A864%3Afu%3A0%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A960%3Acn%3A1%3Adp%3A0%3Als%3A1633329359918%3Ahid%3A411530536%3Az%3A0%3Ai%3A20230122012744%3Aet%3A1674350865%3Ac%3A1%3Arn%3A177700697%3Arqn%3A1%3Au%3A167435086512125606%3Aw%3A1600x1200%3As%3A1600x1200x24%3Ask%3A1%3Awv%3A2%3Ads%3A0%2C30%2C110%2C1%2C249%2C0%2C%2C770%2C0%2C%2C%2C%2C1161%3Aco%3A0%3Acpf%3A1%3Ans%3A1674350863126%3Aadb%3A2%3Arqnl%3A1%3Ast%3A1674350865%3At%3A%D0%93%D1%80%D1%83%D0%BF%D0%BF%D0%B0%20%D0%BE%D0%BF%D0%B5%D1%80%D0%B0%D1%82%D0%B8%D0%B2%D0%BD%D0%BE%D0%B3%D0%BE%20%D1%80%D0%B5%D0%B0%D0%B3%D0%B8%D1%80%D0%BE%D0%B2%D0%B0%D0%BD%D0%B8%D1%8F%20%D0%BD%D0%B0%20%D0%B8%D0%BD%D1%86%D0%B8%D0%B4%D0%B5%D0%BD%D1%82%D1%8B%20%D0%B8%D0%BD%D1%84%D0%BE%D1%80%D0%BC%D0%B0%D1%86%D0%B8%D0%BE%D0%BD%D0%BD%D0%BE%D0%B9%20%D0%B1%D0%B5%D0%B7%D0%BE%D0%BF%D0%B0%D1%81%D0%BD%D0%BE%D1%81%D1%82%D0%B8%20-%20CERT-GIB&t=gdpr%2814%29clc%280-0-0%29rqnt%281%29aw%281%29ti%282%29

Requested by

Host: www.group-ib.ru
URL: https://www.group-ib.ru/cert.html

Protocol

Server

2a02:6b8::1:119 Moscow, Russian Federation, ASN208722 (GLOBAL_DC, FI),

Reverse DNS

Software

Resource Hash

5a2e5fe51839ca304b661fe1844facf26a8287553d2c9e0b2395254e21e0e45b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 22 Jan 2023 01:27:44 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
last-modified: Sun, 22-Jan-2023 01:27:44 GMT
accept-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
content-type: application/json; charset=utf-8
access-control-allow-origin: https://www.group-ib.ru
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 435
x-xss-protection: 1; mode=block
expires: Sun, 22-Jan-2023 01:27:44 GMT

Redirect headers

pragma: no-cache
date: Sun, 22 Jan 2023 01:27:44 GMT
strict-transport-security: max-age=31536000
last-modified: Sun, 22-Jan-2023 01:27:44 GMT
accept-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
location: /watch/20002900/1?wmode=7&page-url=https%3A%2F%2Fwww.group-ib.ru%2Fcert.html&charset=utf-8&browser-info=pv%3A1%3Avf%3Asmv4ejgykhrjvgldb09nr%3Afp%3A864%3Afu%3A0%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A960%3Acn%3A1%3Adp%3A0%3Als%3A1633329359918%3Ahid%3A411530536%3Az%3A0%3Ai%3A20230122012744%3Aet%3A1674350865%3Ac%3A1%3Arn%3A177700697%3Arqn%3A1%3Au%3A167435086512125606%3Aw%3A1600x1200%3As%3A1600x1200x24%3Ask%3A1%3Awv%3A2%3Ads%3A0%2C30%2C110%2C1%2C249%2C0%2C%2C770%2C0%2C%2C%2C%2C1161%3Aco%3A0%3Acpf%3A1%3Ans%3A1674350863126%3Aadb%3A2%3Arqnl%3A1%3Ast%3A1674350865%3At%3A%D0%93%D1%80%D1%83%D0%BF%D0%BF%D0%B0%20%D0%BE%D0%BF%D0%B5%D1%80%D0%B0%D1%82%D0%B8%D0%B2%D0%BD%D0%BE%D0%B3%D0%BE%20%D1%80%D0%B5%D0%B0%D0%B3%D0%B8%D1%80%D0%BE%D0%B2%D0%B0%D0%BD%D0%B8%D1%8F%20%D0%BD%D0%B0%20%D0%B8%D0%BD%D1%86%D0%B8%D0%B4%D0%B5%D0%BD%D1%82%D1%8B%20%D0%B8%D0%BD%D1%84%D0%BE%D1%80%D0%BC%D0%B0%D1%86%D0%B8%D0%BE%D0%BD%D0%BD%D0%BE%D0%B9%20%D0%B1%D0%B5%D0%B7%D0%BE%D0%BF%D0%B0%D1%81%D0%BD%D0%BE%D1%81%D1%82%D0%B8%20-%20CERT-GIB&t=gdpr%2814%29clc%280-0-0%29rqnt%281%29aw%281%29ti%282%29
access-control-allow-origin: https://www.group-ib.ru
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
x-xss-protection: 1; mode=block
expires: Sun, 22-Jan-2023 01:27:44 GMT

GET
H3 200 649324202964935 Show response
connect.facebook.net/signals/config/ 377 KB
108 KB 72ms
71ms Script
application/x-javascript 2a03:2880:f083:100:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/649324202964935?v=2.9.94&r=stable

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f083:100:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

8e52ed8e2c84be9a31bbfa30f6cf9740db73ff467b7293ecd7c6cefd33e99040

Security Headers

Name	Value
Content-Security-Policy	default-src facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com data: blob: 'self';script-src .fbcdn.net .facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

content-security-policy: default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; preload; includeSubDomains
date: Sun, 22 Jan 2023 01:27:45 GMT
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
x-fb-rlafr: 0
x-xss-protection: 0
pragma: public
x-fb-debug: DfqtTeKvtV+W7rwMPYikVQMDx6MLqztzkKkS+3vm4UFRdnRXc5TU1m8ZbdRp3+qTaQ7LkyI5wpi+I9cDJY5Bvg==
cross-origin-opener-policy: same-origin-allow-popups
vary: Accept-Encoding
x-frame-options: DENY
content-type: application/x-javascript; charset=utf-8
origin-agent-cluster: ?0
cache-control: public, max-age=1200
priority: u=3,i
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 __ptq.gif
track-eu1.hubspot.com/ 45 B
1 KB 95ms
45ms Image
image/gif 172.65.240.166
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://track-eu1.hubspot.com/__ptq.gif?k=1&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=en-us&bfp=3997732991&v=1.1&a=25755956&rcu=https%3A%2F%2Fwww.group-ib.ru%2Fcert.html&pu=https%3A%2F%2Fwww.group-ib.ru%2Fcert.html&t=%D0%93%D1%80%D1%83%D0%BF%D0%BF%D0%B0+%D0%BE%D0%BF%D0%B5%D1%80%D0%B0%D1%82%D0%B8%D0%B2%D0%BD%D0%BE%D0%B3%D0%BE+%D1%80%D0%B5%D0%B0%D0%B3%D0%B8%D1%80%D0%BE%D0%B2%D0%B0%D0%BD%D0%B8%D1%8F+%D0%BD%D0%B0+%D0%B8%D0%BD%D1%86%D0%B8%D0%B4%D0%B5%D0%BD%D1%82%D1%8B+%D0%B8%D0%BD%D1%84%D0%BE%D1%80%D0%BC%D0%B0%D1%86%D0%B8%D0%BE%D0%BD%D0%BD%D0%BE%D0%B9+%D0%B1%D0%B5%D0%B7%D0%BE%D0%BF%D0%B0%D1%81%D0%BD%D0%BE%D1%81%D1%82%D0%B8+-+CERT-GIB&cts=1674350865011&vi=90d90f6633ed5c41db2098864a2fb278&nc=true&u=124113877.90d90f6633ed5c41db2098864a2fb278.1674350865008.1674350865008.1674350865008.1&b=124113877.1.1674350865008&cc=15

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.65.240.166 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Sun, 22 Jan 2023 01:27:45 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
cf-cache-status: MISS
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-hubspot-correlation-id: 20b0b123-fe1a-4090-9d06-4c63857fde75
p3p: CP="NOI CUR ADM OUR NOR STA NID"
x-envoy-upstream-service-time: 4
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 45
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
last-modified: Sun, 22 Jan 2023 01:27:45 GMT
server: cloudflare
x-evy-trace-route: nginx-catch-all
vary: origin, Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=C562uAU7ufG87ekTQLcCnTss3GEiSroEsDbD8B8Be6%2BtIjZ64uy0Sm7oVFtgdF2ddoJ%2F0UilvIUUiVzhOn2UvA2O1ot%2FcfwnBXQ9VLm4JXjw5OxO3wupiTLVZmkw%2BC6i1UWdQewB0g%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/gif
x-evy-trace-served-by-pod: fra04/analytics-tracking-td/envoy-proxy-5f84fc4fdc-56gq8
x-evy-trace-virtual-host: all
cache-control: no-cache, no-store, no-transform
access-control-allow-credentials: false
accept-ranges: bytes
cf-ray: 78d4824aa8409bca-FRA
x-robots-tag: none

GET
H2 200 __ptq.gif
track-eu1.hubspot.com/ 45 B
606 B 102ms
57ms Image
image/gif 172.65.240.166
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://track-eu1.hubspot.com/__ptq.gif?k=15&fi=a54f05ba-5fc5-47a0-bf73-d1dd877d87ff&fci=98867720-9008-4094-981e-942082cc2a14&ft=0&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=en-us&bfp=3997732991&v=1.1&a=25755956&rcu=https%3A%2F%2Fwww.group-ib.ru%2Fcert.html&pu=https%3A%2F%2Fwww.group-ib.ru%2Fcert.html&t=%D0%93%D1%80%D1%83%D0%BF%D0%BF%D0%B0+%D0%BE%D0%BF%D0%B5%D1%80%D0%B0%D1%82%D0%B8%D0%B2%D0%BD%D0%BE%D0%B3%D0%BE+%D1%80%D0%B5%D0%B0%D0%B3%D0%B8%D1%80%D0%BE%D0%B2%D0%B0%D0%BD%D0%B8%D1%8F+%D0%BD%D0%B0+%D0%B8%D0%BD%D1%86%D0%B8%D0%B4%D0%B5%D0%BD%D1%82%D1%8B+%D0%B8%D0%BD%D1%84%D0%BE%D1%80%D0%BC%D0%B0%D1%86%D0%B8%D0%BE%D0%BD%D0%BD%D0%BE%D0%B9+%D0%B1%D0%B5%D0%B7%D0%BE%D0%BF%D0%B0%D1%81%D0%BD%D0%BE%D1%81%D1%82%D0%B8+-+CERT-GIB&cts=1674350865012&vi=90d90f6633ed5c41db2098864a2fb278&nc=true&u=124113877.90d90f6633ed5c41db2098864a2fb278.1674350865008.1674350865008.1674350865008.1&b=124113877.1.1674350865008&cc=15

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.65.240.166 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Sun, 22 Jan 2023 01:27:45 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
cf-cache-status: MISS
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-hubspot-correlation-id: c222424e-049c-4493-9566-127eb426e687
p3p: CP="NOI CUR ADM OUR NOR STA NID"
x-envoy-upstream-service-time: 4
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 45
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
last-modified: Sun, 22 Jan 2023 01:27:45 GMT
server: cloudflare
x-evy-trace-route: nginx-catch-all
vary: origin, Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=M9%2FRb%2Bj%2BdW95wKTWf5VTK2hvrrwSq4%2Bnu6ThEhzs9EPNwOf%2BpT3AkUhRgX6NsZfxKSrj0oM8oZYYv5qd9%2BnSv5fRNapvjgUUrMbW4wo7rzFfFRnNm70KFRte6uD6Rh1WcErmDaBXuw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/gif
x-evy-trace-served-by-pod: fra04/analytics-tracking-td/envoy-proxy-5f84fc4fdc-8dj25
x-evy-trace-virtual-host: all
cache-control: no-cache, no-store, no-transform
access-control-allow-credentials: false
accept-ranges: bytes
cf-ray: 78d4824aa8429bca-FRA
x-robots-tag: none

GET
H2 200 __ptq.gif
track-eu1.hubspot.com/ 45 B
606 B 101ms
56ms Image
image/gif 172.65.240.166
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://track-eu1.hubspot.com/__ptq.gif?k=17&fi=a54f05ba-5fc5-47a0-bf73-d1dd877d87ff&fci=98867720-9008-4094-981e-942082cc2a14&ft=0&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=en-us&bfp=3997732991&v=1.1&a=25755956&rcu=https%3A%2F%2Fwww.group-ib.ru%2Fcert.html&pu=https%3A%2F%2Fwww.group-ib.ru%2Fcert.html&t=%D0%93%D1%80%D1%83%D0%BF%D0%BF%D0%B0+%D0%BE%D0%BF%D0%B5%D1%80%D0%B0%D1%82%D0%B8%D0%B2%D0%BD%D0%BE%D0%B3%D0%BE+%D1%80%D0%B5%D0%B0%D0%B3%D0%B8%D1%80%D0%BE%D0%B2%D0%B0%D0%BD%D0%B8%D1%8F+%D0%BD%D0%B0+%D0%B8%D0%BD%D1%86%D0%B8%D0%B4%D0%B5%D0%BD%D1%82%D1%8B+%D0%B8%D0%BD%D1%84%D0%BE%D1%80%D0%BC%D0%B0%D1%86%D0%B8%D0%BE%D0%BD%D0%BD%D0%BE%D0%B9+%D0%B1%D0%B5%D0%B7%D0%BE%D0%BF%D0%B0%D1%81%D0%BD%D0%BE%D1%81%D1%82%D0%B8+-+CERT-GIB&cts=1674350865013&vi=90d90f6633ed5c41db2098864a2fb278&nc=true&u=124113877.90d90f6633ed5c41db2098864a2fb278.1674350865008.1674350865008.1674350865008.1&b=124113877.1.1674350865008&cc=15

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.65.240.166 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Sun, 22 Jan 2023 01:27:45 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
cf-cache-status: MISS
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-hubspot-correlation-id: 2347e48d-4928-4652-a21c-b5b78b36b943
p3p: CP="NOI CUR ADM OUR NOR STA NID"
x-envoy-upstream-service-time: 5
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 45
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
last-modified: Sun, 22 Jan 2023 01:27:45 GMT
server: cloudflare
x-evy-trace-route: nginx-catch-all
vary: origin, Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=hGZdp5RvSfZV35dRfGRAmjwBhb7Zm93PhbYSvR9vECdwqMe9sC5hRy67F9j90c%2BXVSlz7AuyMKvGC%2FaNc37dnROYVhuWpHdolCSKbVjzqdC2NdknE8akaurTBP%2F417DED1a9PpyYSg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/gif
x-evy-trace-served-by-pod: fra04/analytics-tracking-td/envoy-proxy-5f84fc4fdc-9j2jk
x-evy-trace-virtual-host: all
cache-control: no-cache, no-store, no-transform
access-control-allow-credentials: false
accept-ranges: bytes
cf-ray: 78d4824aa8439bca-FRA
x-robots-tag: none

GET
H2

200

sync_cookie_image_decide_secondary
mc.yandex.com/
Redirect Chain

https://mc.yandex.com/sync_cookie_image_check_secondary
https://mc.yandex.ru/sync_cookie_image_start_secondary?redirect_domain=mc.yandex.com&token=9890.0oZ9OO9CBQCA01J2awr8Gm3Efvp4fmi0OIBAId3Y384rKFdY45KG-d5OSf_jEO0T.Klgv6HsB-JLAVL6jtIT4krB4C98%2C
https://mc.yandex.com/sync_cookie_image_decide_secondary?token=9890.rFTU71NZQez5NoEzmmWRh94cpMI9wPF_psSGih38pMEHJWLfaHMJCJU2Hzx2FFyPFpkWYPNVbMXmZhJ2ainm7nECTDod3AfDCPwF5s7isiw%2C.TWbdiM4ADK9fOM2oa-...

43 B
79 B

54ms
54ms

Image
image/gif

2a02:6b8::1:119
GLOBAL_DC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://mc.yandex.com/sync_cookie_image_decide_secondary?token=9890.rFTU71NZQez5NoEzmmWRh94cpMI9wPF_psSGih38pMEHJWLfaHMJCJU2Hzx2FFyPFpkWYPNVbMXmZhJ2ainm7nECTDod3AfDCPwF5s7isiw%2C.TWbdiM4ADK9fOM2oa-0Ns7lfvkY%2C

Protocol

Server

2a02:6b8::1:119 Moscow, Russian Federation, ASN208722 (GLOBAL_DC, FI),

Reverse DNS

Software

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Sun, 22 Jan 2023 01:27:45 GMT
strict-transport-security: max-age=31536000
content-length: 43
x-xss-protection: 1; mode=block
content-type: image/gif

Redirect headers

location: https://mc.yandex.com/sync_cookie_image_decide_secondary?token=9890.rFTU71NZQez5NoEzmmWRh94cpMI9wPF_psSGih38pMEHJWLfaHMJCJU2Hzx2FFyPFpkWYPNVbMXmZhJ2ainm7nECTDod3AfDCPwF5s7isiw%2C.TWbdiM4ADK9fOM2oa-0Ns7lfvkY%2C
date: Sun, 22 Jan 2023 01:27:45 GMT
strict-transport-security: max-age=31536000
x-xss-protection: 1; mode=block

GET
H3 200 709834390277869 Show response
connect.facebook.net/signals/config/ 377 KB
108 KB 81ms
80ms Script
application/x-javascript 2a03:2880:f083:100:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/709834390277869?v=2.9.94&r=stable

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f083:100:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

1a2217ca9a9da526e5e11fc9dfbd5c03bff3071238d08fa693d2d147835b146d

Security Headers

Name	Value
Content-Security-Policy	default-src facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com data: blob: 'self';script-src .fbcdn.net .facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

content-security-policy: default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; preload; includeSubDomains
date: Sun, 22 Jan 2023 01:27:45 GMT
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
x-fb-rlafr: 0
x-xss-protection: 0
pragma: public
x-fb-debug: B3Qke54AbKAWvbrGGgWzLlH3kKnVW5PAskTAGrLG8fbjStJOht3Ul5/rdPo5PfpE0USlmI9vhnY2Q1Ls2Av6Cg==
cross-origin-opener-policy: same-origin-allow-popups
vary: Accept-Encoding
x-frame-options: DENY
content-type: application/x-javascript; charset=utf-8
origin-agent-cluster: ?0
cache-control: public, max-age=1200
priority: u=3,i
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/10882981508/ 2 KB
1 KB 63ms
62ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/10882981508/?random=1674350865243&cv=11&fst=1674350865243&bg=ffffff&guid=ON&async=1&gtm=2oa1i0&u_w=1600&u_h=1200&hn=www.googleadservices.com&frm=0&url=https%3A%2F%2Fwww.group-ib.ru%2Fcert.html&tiba=%D0%93%D1%80%D1%83%D0%BF%D0%BF%D0%B0%20%D0%BE%D0%BF%D0%B5%D1%80%D0%B0%D1%82%D0%B8%D0%B2%D0%BD%D0%BE%D0%B3%D0%BE%20%D1%80%D0%B5%D0%B0%D0%B3%D0%B8%D1%80%D0%BE%D0%B2%D0%B0%D0%BD%D0%B8%D1%8F%20%D0%BD%D0%B0%20%D0%B8%D0%BD%D1%86%D0%B8%D0%B4%D0%B5%D0%BD%D1%82&did=dZTQ1Zm&gdid=dZTQ1Zm&auid=1744288069.1674350864&uamb=0&uaw=0&data=event%3Dform_start&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-10882981508&l=dataLayer&cx=c

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

99faffe359a6aefc264101e998b957be759204c814ec24dcb70eb854adf97758

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 22 Jan 2023 01:27:45 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 951
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/10882981508/ 2 KB
1 KB 70ms
69ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/10882981508/?random=1674350865248&cv=11&fst=1674350865248&bg=ffffff&guid=ON&async=1&gtm=2oa1i0&u_w=1600&u_h=1200&hn=www.googleadservices.com&frm=0&url=https%3A%2F%2Fwww.group-ib.ru%2Fcert.html&tiba=%D0%93%D1%80%D1%83%D0%BF%D0%BF%D0%B0%20%D0%BE%D0%BF%D0%B5%D1%80%D0%B0%D1%82%D0%B8%D0%B2%D0%BD%D0%BE%D0%B3%D0%BE%20%D1%80%D0%B5%D0%B0%D0%B3%D0%B8%D1%80%D0%BE%D0%B2%D0%B0%D0%BD%D0%B8%D1%8F%20%D0%BD%D0%B0%20%D0%B8%D0%BD%D1%86%D0%B8%D0%B4%D0%B5%D0%BD%D1%82&did=dZTQ1Zm&gdid=dZTQ1Zm&auid=1744288069.1674350864&uamb=0&uaw=0&data=event%3Dform_submit&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-10882981508&l=dataLayer&cx=c

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c571384decf79f68816bf6eebecae6e433ee3714f6c343507c51952991c0e770

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 22 Jan 2023 01:27:45 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 952
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 /
www.facebook.com/tr/ 0
18 B 10ms
9ms Image
text/plain 2a03:2880:f176:181:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=649324202964935&ev=PageView&dl=https%3A%2F%2Fwww.group-ib.ru%2Fcert.html&rl=&if=false&ts=1674350865217&sw=1600&sh=1200&ud[external_id]=90d90f6633ed5c41db2098864a2fb278&v=2.9.94&r=stable&ec=0&o=30&fbp=fb.1.1674350864556.609879716&it=1674350864300&coo=false&rqm=GET

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f176:181:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
date: Sun, 22 Jan 2023 01:27:45 GMT
server: proxygen-bolt
content-type: text/plain
access-control-allow-origin
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 0
priority: u=3,i

GET
H3 200 /
www.facebook.com/tr/ 0
15 B 10ms
10ms Image
text/plain 2a03:2880:f176:181:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=709834390277869&ev=PageView&dl=https%3A%2F%2Fwww.group-ib.ru%2Fcert.html&rl=&if=false&ts=1674350865219&sw=1600&sh=1200&ud[external_id]=90d90f6633ed5c41db2098864a2fb278&v=2.9.94&r=stable&ec=0&o=30&cs_est=true&fbp=fb.1.1674350864556.609879716&it=1674350864300&coo=false&rqm=GET

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f176:181:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
date: Sun, 22 Jan 2023 01:27:45 GMT
server: proxygen-bolt
content-type: text/plain
access-control-allow-origin
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 0
priority: u=3,i

GET
H2 200 counters.gif
forms-eu1.hsforms.com/embed/v3/ 35 B
192 B 28ms
28ms Image
image/gif 172.65.232.43
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://forms-eu1.hsforms.com/embed/v3/counters.gif?key=collected-forms-embed-js-form-bind&count=1

Requested by

Host: js-eu1.hscollectedforms.net
URL: https://js-eu1.hscollectedforms.net/collectedforms.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.65.232.43 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Sun, 22 Jan 2023 01:27:45 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
cf-cache-status: DYNAMIC
server: cloudflare
x-hubspot-correlation-id: 2dd970a8-33fa-46f9-a4d2-4fc5c6f3dfe9
x-trace: 2B3948D3E4975055920692E3CBEC4DD2762D4C87E4000000000000000000
vary: origin
content-type: image/gif
access-control-expose-headers: X-Origin-Hublet
cache-control: max-age=0, no-cache, no-store
access-control-allow-credentials: false
x-robots-tag: none
cf-ray: 78d4824bdfb35ca4-FRA
content-length: 35
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

POST
H3 200 / Show response
www.facebook.com/tr/ Frame 163A 0
15 B 8ms
7ms Document
text/plain 2a03:2880:f176:181:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/tr/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f176:181:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Content-Type: application/x-www-form-urlencoded
Origin: null
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-origin: null
alt-svc: h3=":443"; ma=86400
content-length: 0
content-type: text/plain
cross-origin-resource-policy: cross-origin
date: Sun, 22 Jan 2023 01:27:45 GMT
priority: u=0
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains

GET
H3 200 /
www.google.com/pagead/1p-user-list/10882981508/ 42 B
64 B 54ms
54ms Image
image/gif 2a00:1450:400d:80a::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/10882981508/?random=1674350865243&cv=11&fst=1674349200000&bg=ffffff&guid=ON&async=1&gtm=2oa1i0&u_w=1600&u_h=1200&frm=0&url=https%3A%2F%2Fwww.group-ib.ru%2Fcert.html&tiba=%D0%93%D1%80%D1%83%D0%BF%D0%BF%D0%B0%20%D0%BE%D0%BF%D0%B5%D1%80%D0%B0%D1%82%D0%B8%D0%B2%D0%BD%D0%BE%D0%B3%D0%BE%20%D1%80%D0%B5%D0%B0%D0%B3%D0%B8%D1%80%D0%BE%D0%B2%D0%B0%D0%BD%D0%B8%D1%8F%20%D0%BD%D0%B0%20%D0%B8%D0%BD%D1%86%D0%B8%D0%B4%D0%B5%D0%BD%D1%82&data=event%3Dform_start&fmt=3&is_vtc=1&random=1108810045&rmt_tld=0&ipr=y

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400d:80a::2004 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 22 Jan 2023 01:27:45 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 /
www.google.de/pagead/1p-user-list/10882981508/ 42 B
64 B 35ms
34ms Image
image/gif 2a00:1450:4001:830::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/10882981508/?random=1674350865243&cv=11&fst=1674349200000&bg=ffffff&guid=ON&async=1&gtm=2oa1i0&u_w=1600&u_h=1200&frm=0&url=https%3A%2F%2Fwww.group-ib.ru%2Fcert.html&tiba=%D0%93%D1%80%D1%83%D0%BF%D0%BF%D0%B0%20%D0%BE%D0%BF%D0%B5%D1%80%D0%B0%D1%82%D0%B8%D0%B2%D0%BD%D0%BE%D0%B3%D0%BE%20%D1%80%D0%B5%D0%B0%D0%B3%D0%B8%D1%80%D0%BE%D0%B2%D0%B0%D0%BD%D0%B8%D1%8F%20%D0%BD%D0%B0%20%D0%B8%D0%BD%D1%86%D0%B8%D0%B4%D0%B5%D0%BD%D1%82&data=event%3Dform_start&fmt=3&is_vtc=1&random=1108810045&rmt_tld=1&ipr=y

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 22 Jan 2023 01:27:45 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 /
www.google.com/pagead/1p-user-list/10882981508/ 42 B
64 B 59ms
58ms Image
image/gif 2a00:1450:400d:80a::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/10882981508/?random=1674350865248&cv=11&fst=1674349200000&bg=ffffff&guid=ON&async=1&gtm=2oa1i0&u_w=1600&u_h=1200&frm=0&url=https%3A%2F%2Fwww.group-ib.ru%2Fcert.html&tiba=%D0%93%D1%80%D1%83%D0%BF%D0%BF%D0%B0%20%D0%BE%D0%BF%D0%B5%D1%80%D0%B0%D1%82%D0%B8%D0%B2%D0%BD%D0%BE%D0%B3%D0%BE%20%D1%80%D0%B5%D0%B0%D0%B3%D0%B8%D1%80%D0%BE%D0%B2%D0%B0%D0%BD%D0%B8%D1%8F%20%D0%BD%D0%B0%20%D0%B8%D0%BD%D1%86%D0%B8%D0%B4%D0%B5%D0%BD%D1%82&data=event%3Dform_submit&fmt=3&is_vtc=1&random=1163081712&rmt_tld=0&ipr=y

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400d:80a::2004 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 22 Jan 2023 01:27:45 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 /
www.google.de/pagead/1p-user-list/10882981508/ 42 B
64 B 26ms
26ms Image
image/gif 2a00:1450:4001:830::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/10882981508/?random=1674350865248&cv=11&fst=1674349200000&bg=ffffff&guid=ON&async=1&gtm=2oa1i0&u_w=1600&u_h=1200&frm=0&url=https%3A%2F%2Fwww.group-ib.ru%2Fcert.html&tiba=%D0%93%D1%80%D1%83%D0%BF%D0%BF%D0%B0%20%D0%BE%D0%BF%D0%B5%D1%80%D0%B0%D1%82%D0%B8%D0%B2%D0%BD%D0%BE%D0%B3%D0%BE%20%D1%80%D0%B5%D0%B0%D0%B3%D0%B8%D1%80%D0%BE%D0%B2%D0%B0%D0%BD%D0%B8%D1%8F%20%D0%BD%D0%B0%20%D0%B8%D0%BD%D1%86%D0%B8%D0%B4%D0%B5%D0%BD%D1%82&data=event%3Dform_submit&fmt=3&is_vtc=1&random=1163081712&rmt_tld=1&ipr=y

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 22 Jan 2023 01:27:45 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
493 B 185ms
185ms Image
image/gif 23.44.74.52
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=e84d9c08a990af8592952e7ac9a983ad&svisitor=null&visitor=9e5e73de-3d3c-437c-85b6-f17c16eac8d2&session=2737c4a5-72f6-4e34-8244-6a02696724e1&event=active_time_track&q=%7B%22currentTime%22%3A%22Sun%2C%2022%20Jan%202023%2001%3A27%3A45%20GMT%22%2C%22lastTrackTime%22%3A%22Sun%2C%2022%20Jan%202023%2001%3A27%3A44%20GMT%22%2C%22timeSpent%22%3A%221002%22%2C%22totalTimeSpent%22%3A%221002%22%7D&isIframe=false&m=%7B%22description%22%3A%22CERT-GIB%20%E2%80%93%20%D1%86%D0%B5%D0%BD%D1%82%D1%80%20%D0%BA%D1%80%D1%83%D0%B3%D0%BB%D0%BE%D1%81%D1%83%D1%82%D0%BE%D1%87%D0%BD%D0%BE%D0%B3%D0%BE%20%D1%80%D0%B5%D0%B0%D0%B3%D0%B8%D1%80%D0%BE%D0%B2%D0%B0%D0%BD%D0%B8%D1%8F%20%D0%BD%D0%B0%20%D0%B8%D0%BD%D1%86%D0%B8%D0%B4%D0%B5%D0%BD%D1%82%D1%8B%20%D0%B8%D0%BD%D1%84%D0%BE%D1%80%D0%BC%D0%B0%D1%86%D0%B8%D0%BE%D0%BD%D0%BD%D0%BE%D0%B9%20%D0%B1%D0%B5%D0%B7%D0%BE%D0%BF%D0%B0%D1%81%D0%BD%D0%BE%D1%81%D1%82%D0%B8.%20%D0%9F%D0%BE%D0%B7%D0%B2%D0%BE%D0%BD%D0%B8%D1%82%D0%B5%20%D0%BD%D0%B0%D0%BC%2C%20%D1%87%D1%82%D0%BE%D0%B1%D1%8B%20%D1%81%D0%BE%D0%BE%D0%B1%D1%89%D0%B8%D1%82%D1%8C%20%D0%BE%D0%B1%20%D0%B8%D0%BD%D1%86%D0%B8%D0%B4%D0%B5%D0%BD%D1%82%D0%B5%20%D0%B8%20%D0%BF%D0%BE%D0%BB%D1%83%D1%87%D0%B8%D1%82%D0%B5%20%D0%B1%D0%B5%D1%81%D0%BF%D0%BB%D0%B0%D1%82%D0%BD%D1%83%D1%8E%20%D0%BF%D0%B5%D1%80%D0%B2%D1%83%D1%8E%20%D0%BF%D0%BE%D0%BC%D0%BE%D1%89%D1%8C.%22%2C%22keywords%22%3A%22%D0%B3%D1%80%D1%83%D0%BF%D0%BF%D0%B0%2C%20%D1%80%D0%B5%D0%B0%D0%B3%D0%B8%D1%80%D0%BE%D0%B2%D0%B0%D0%BD%D0%B8%D0%B5%2C%20%D0%B8%D0%BD%D1%86%D0%B8%D0%B4%D0%B5%D0%BD%D1%82%2C%20%D0%B8%D0%B1%2C%20%D0%B8%D0%BD%D1%84%D0%BE%D1%80%D0%BC%D0%B0%D1%86%D0%B8%D0%BE%D0%BD%D0%BD%D0%B0%D1%8F%20%D0%B1%D0%B5%D0%B7%D0%BE%D0%BF%D0%B0%D1%81%D0%BD%D0%BE%D1%81%D1%82%D1%8C%2C%20%D0%BA%D1%80%D1%83%D0%B3%D0%BB%D0%BE%D1%81%D1%83%D1%82%D0%BE%D1%87%D0%BD%D0%BE%2C%20%D0%BE%D0%BF%D0%B5%D1%80%D0%B0%D1%82%D0%B8%D0%B2%D0%BD%D0%BE%2C%20%D0%BA%D0%B8%D0%B1%D0%B5%D1%80%D1%83%D0%B3%D1%80%D0%BE%D0%B7%D0%B0%22%2C%22title%22%3A%22%D0%93%D1%80%D1%83%D0%BF%D0%BF%D0%B0%20%D0%BE%D0%BF%D0%B5%D1%80%D0%B0%D1%82%D0%B8%D0%B2%D0%BD%D0%BE%D0%B3%D0%BE%20%D1%80%D0%B5%D0%B0%D0%B3%D0%B8%D1%80%D0%BE%D0%B2%D0%B0%D0%BD%D0%B8%D1%8F%20%D0%BD%D0%B0%20%D0%B8%D0%BD%D1%86%D0%B8%D0%B4%D0%B5%D0%BD%D1%82%D1%8B%20%D0%B8%D0%BD%D1%84%D0%BE%D1%80%D0%BC%D0%B0%D1%86%D0%B8%D0%BE%D0%BD%D0%BD%D0%BE%D0%B9%20%D0%B1%D0%B5%D0%B7%D0%BE%D0%BF%D0%B0%D1%81%D0%BD%D0%BE%D1%81%D1%82%D0%B8%20-%20CERT-GIB%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.group-ib.ru%2Fcert.html&pageViewId=ca6c969a-f69d-48e7-86b5-6aa9493dd8d4&an_uid=0

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.44.74.52 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-44-74-52.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Sun, 22 Jan 2023 01:27:45 GMT
x-content-type-options: nosniff
content-length: 43
pragma: no-cache
last-modified: Sat, 05 Jun 2021 07:56:05 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "60bb2e15-2b"
access-control-max-age: 86400
access-control-allow-methods: GET,POST
content-type: image/gif
access-control-allow-origin
cache-control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: *
expires: Wed, 19 Apr 2000 11:43:00 GMT

POST
H/1.1 200
OK fl Show response
www.group-ib.ru/api/ 669 B
1 KB 150ms
149ms XHR
application/json 178.248.235.63
QRATOR

General

Check archive.org

Show headers Download Go to

Full URL: https://www.group-ib.ru/api/fl?u=d5fb122505&mv=2&cfidsgib-w-group-ib=NnpG8T92Y7bkGy85gqy9BQddSjJr4ueZLFKP3oVOgrSjbzot05n3XY1cMJ3%2BmlN8jJY7b6ZbwQ7pUFK65V3eDU6ahF27ORGoNc%2BVOlDwC5Sz4FJVYytdEXlu8qdTell7k6eE5S5dLG5DYXYi1CAgPmDrWXZmvuwHfiJW
Requested by: Host: www.group-ib.ru
URL: https://www.group-ib.ru/build/main_26755_2be51925_563_1764.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 178.248.235.63 , Russian Federation, ASN197068 (QRATOR, RU),
Reverse DNS
Software: QRATOR /
Resource Hash: f7096ac96739c35139612e515627a25aa0c3ec833e44e8679e92f529e6fcf44e

Request headers

X-GIB-FGSSCgib-w-group-ib: p3u688e42ec23ed930d42b03bbdc1094041af53e
Referer
accept-language: de-DE,de;q=0.9
X-GIB-GSSCgib-w-group-ib: BqFpktEO5yfF9yFfg11bj+IY2zMC7eyIxuvpeIypHOdH0FInq390Qsjkmf63Q7RVdfhClhJPaQa2utmDL4AF7nk0eMTcvLfqIRldfyHMCVgoI03vw1oUjE9vwQnptG0PYs2v2x8L4bez3PG0P/yxHkXUBtXP6Hq31rFTzrFv/DMm+2zVy1Xevwvx7hKMpEOJwlcp/3Y2IblEN5sby9UsdRGE0p6x5CBsU8aJlwX7rTsxv7k71QM1YdB5pt7ZVg==
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

Date: Sun, 22 Jan 2023 01:27:45 GMT
content-encoding: gzip
Server: QRATOR
Transfer-Encoding: chunked
vary: Accept-Encoding
Content-Type: application/json; charset=utf-8
Access-Control-Allow-Origin: https://www.group-ib.ru
Access-Control-Allow-Methods: GET, POST, OPTIONS
cache-control: no-store
x-envoy-upstream-service-time: 1
Access-Control-Allow-Credentials: true
Connection: keep-alive
Keep-Alive: timeout=15
Access-Control-Allow-Headers: Accept,DNT,Keep-Alive,User-Agent,If-Modified-Since,Cache-Control,Content-Type,Origin,ETag,If-None-Match,X-Cfids,Authorization

GET
H3 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/10882981508/ 2 KB
976 B 97ms
96ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/10882981508/?random=1674350865733&cv=11&fst=1674350865733&bg=ffffff&guid=ON&async=1&gtm=2oa1i0&u_w=1600&u_h=1200&hn=www.googleadservices.com&frm=0&url=https%3A%2F%2Fwww.group-ib.ru%2Fcert.html&tiba=%D0%93%D1%80%D1%83%D0%BF%D0%BF%D0%B0%20%D0%BE%D0%BF%D0%B5%D1%80%D0%B0%D1%82%D0%B8%D0%B2%D0%BD%D0%BE%D0%B3%D0%BE%20%D1%80%D0%B5%D0%B0%D0%B3%D0%B8%D1%80%D0%BE%D0%B2%D0%B0%D0%BD%D0%B8%D1%8F%20%D0%BD%D0%B0%20%D0%B8%D0%BD%D1%86%D0%B8%D0%B4%D0%B5%D0%BD%D1%82&did=dZTQ1Zm&gdid=dZTQ1Zm&auid=1744288069.1674350864&uamb=0&uaw=0&data=event%3Dform_submit&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-10882981508&l=dataLayer&cx=c

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

74b1ef519b646b06a287de1c8c7bdbed614c1cee4d90b387bcf0a680d95ed7a5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 22 Jan 2023 01:27:45 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 952
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 counters.gif
forms-eu1.hsforms.com/embed/v3/ 35 B
169 B 44ms
44ms Image
image/gif 172.65.232.43
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://forms-eu1.hsforms.com/embed/v3/counters.gif?key=collected-forms-embed-js-form-bind&count=1

Requested by

Host: js-eu1.hscollectedforms.net
URL: https://js-eu1.hscollectedforms.net/collectedforms.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.65.232.43 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Sun, 22 Jan 2023 01:27:45 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
cf-cache-status: DYNAMIC
server: cloudflare
x-hubspot-correlation-id: 4a46d3cd-4105-4375-8c7d-d4029c579269
x-trace: 2B64FD90CA92A9B93BDEB2A6A97AAF0CDACD2E614D000000000000000000
vary: origin
content-type: image/gif
access-control-expose-headers: X-Origin-Hublet
cache-control: max-age=0, no-cache, no-store
access-control-allow-credentials: false
x-robots-tag: none
cf-ray: 78d4824eda075ca4-FRA
content-length: 35
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

POST
H3 200 / Show response
www.facebook.com/tr/ Frame 21C0 0
15 B 11ms
9ms Document
text/plain 2a03:2880:f176:181:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/tr/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f176:181:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Content-Type: application/x-www-form-urlencoded
Origin: null
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-origin: null
alt-svc: h3=":443"; ma=86400
content-length: 0
content-type: text/plain
cross-origin-resource-policy: cross-origin
date: Sun, 22 Jan 2023 01:27:45 GMT
priority: u=0
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains

GET
H3 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/10882981508/ 2 KB
976 B 70ms
70ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/10882981508/?random=1674350865755&cv=11&fst=1674350865755&bg=ffffff&guid=ON&async=1&gtm=2oa1i0&u_w=1600&u_h=1200&hn=www.googleadservices.com&frm=0&url=https%3A%2F%2Fwww.group-ib.ru%2Fcert.html&tiba=%D0%93%D1%80%D1%83%D0%BF%D0%BF%D0%B0%20%D0%BE%D0%BF%D0%B5%D1%80%D0%B0%D1%82%D0%B8%D0%B2%D0%BD%D0%BE%D0%B3%D0%BE%20%D1%80%D0%B5%D0%B0%D0%B3%D0%B8%D1%80%D0%BE%D0%B2%D0%B0%D0%BD%D0%B8%D1%8F%20%D0%BD%D0%B0%20%D0%B8%D0%BD%D1%86%D0%B8%D0%B4%D0%B5%D0%BD%D1%82&did=dZTQ1Zm&gdid=dZTQ1Zm&auid=1744288069.1674350864&uamb=0&uaw=0&data=event%3Dform_submit&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-10882981508&l=dataLayer&cx=c

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

266b335a4fb5c75ee1f739b9fec82d916ce2f4c83e9754afa366e3958743358d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 22 Jan 2023 01:27:45 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 952
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 200 / Show response
www.facebook.com/tr/ Frame A523 0
15 B 11ms
10ms Document
text/plain 2a03:2880:f176:181:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/tr/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f176:181:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Content-Type: application/x-www-form-urlencoded
Origin: null
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-origin: null
alt-svc: h3=":443"; ma=86400
content-length: 0
content-type: text/plain
cross-origin-resource-policy: cross-origin
date: Sun, 22 Jan 2023 01:27:45 GMT
priority: u=0
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains

GET
H3 200 /
www.google.com/pagead/1p-user-list/10882981508/ 42 B
64 B 55ms
54ms Image
image/gif 2a00:1450:400d:80a::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/10882981508/?random=1674350865755&cv=11&fst=1674349200000&bg=ffffff&guid=ON&async=1&gtm=2oa1i0&u_w=1600&u_h=1200&frm=0&url=https%3A%2F%2Fwww.group-ib.ru%2Fcert.html&tiba=%D0%93%D1%80%D1%83%D0%BF%D0%BF%D0%B0%20%D0%BE%D0%BF%D0%B5%D1%80%D0%B0%D1%82%D0%B8%D0%B2%D0%BD%D0%BE%D0%B3%D0%BE%20%D1%80%D0%B5%D0%B0%D0%B3%D0%B8%D1%80%D0%BE%D0%B2%D0%B0%D0%BD%D0%B8%D1%8F%20%D0%BD%D0%B0%20%D0%B8%D0%BD%D1%86%D0%B8%D0%B4%D0%B5%D0%BD%D1%82&data=event%3Dform_submit&fmt=3&is_vtc=1&random=317654336&rmt_tld=0&ipr=y

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400d:80a::2004 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 22 Jan 2023 01:27:45 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 /
www.google.de/pagead/1p-user-list/10882981508/ 42 B
64 B 25ms
25ms Image
image/gif 2a00:1450:4001:830::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/10882981508/?random=1674350865755&cv=11&fst=1674349200000&bg=ffffff&guid=ON&async=1&gtm=2oa1i0&u_w=1600&u_h=1200&frm=0&url=https%3A%2F%2Fwww.group-ib.ru%2Fcert.html&tiba=%D0%93%D1%80%D1%83%D0%BF%D0%BF%D0%B0%20%D0%BE%D0%BF%D0%B5%D1%80%D0%B0%D1%82%D0%B8%D0%B2%D0%BD%D0%BE%D0%B3%D0%BE%20%D1%80%D0%B5%D0%B0%D0%B3%D0%B8%D1%80%D0%BE%D0%B2%D0%B0%D0%BD%D0%B8%D1%8F%20%D0%BD%D0%B0%20%D0%B8%D0%BD%D1%86%D0%B8%D0%B4%D0%B5%D0%BD%D1%82&data=event%3Dform_submit&fmt=3&is_vtc=1&random=317654336&rmt_tld=1&ipr=y

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 22 Jan 2023 01:27:45 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 /
www.google.com/pagead/1p-user-list/10882981508/ 42 B
64 B 58ms
58ms Image
image/gif 2a00:1450:400d:80a::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/10882981508/?random=1674350865733&cv=11&fst=1674349200000&bg=ffffff&guid=ON&async=1&gtm=2oa1i0&u_w=1600&u_h=1200&frm=0&url=https%3A%2F%2Fwww.group-ib.ru%2Fcert.html&tiba=%D0%93%D1%80%D1%83%D0%BF%D0%BF%D0%B0%20%D0%BE%D0%BF%D0%B5%D1%80%D0%B0%D1%82%D0%B8%D0%B2%D0%BD%D0%BE%D0%B3%D0%BE%20%D1%80%D0%B5%D0%B0%D0%B3%D0%B8%D1%80%D0%BE%D0%B2%D0%B0%D0%BD%D0%B8%D1%8F%20%D0%BD%D0%B0%20%D0%B8%D0%BD%D1%86%D0%B8%D0%B4%D0%B5%D0%BD%D1%82&data=event%3Dform_submit&fmt=3&is_vtc=1&random=482745932&rmt_tld=0&ipr=y

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400d:80a::2004 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 22 Jan 2023 01:27:45 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 /
www.google.de/pagead/1p-user-list/10882981508/ 42 B
64 B 25ms
25ms Image
image/gif 2a00:1450:4001:830::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/10882981508/?random=1674350865733&cv=11&fst=1674349200000&bg=ffffff&guid=ON&async=1&gtm=2oa1i0&u_w=1600&u_h=1200&frm=0&url=https%3A%2F%2Fwww.group-ib.ru%2Fcert.html&tiba=%D0%93%D1%80%D1%83%D0%BF%D0%BF%D0%B0%20%D0%BE%D0%BF%D0%B5%D1%80%D0%B0%D1%82%D0%B8%D0%B2%D0%BD%D0%BE%D0%B3%D0%BE%20%D1%80%D0%B5%D0%B0%D0%B3%D0%B8%D1%80%D0%BE%D0%B2%D0%B0%D0%BD%D0%B8%D1%8F%20%D0%BD%D0%B0%20%D0%B8%D0%BD%D1%86%D0%B8%D0%B4%D0%B5%D0%BD%D1%82&data=event%3Dform_submit&fmt=3&is_vtc=1&random=482745932&rmt_tld=1&ipr=y

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 22 Jan 2023 01:27:45 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
492 B 184ms
183ms Image
image/gif 23.44.74.52
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=e84d9c08a990af8592952e7ac9a983ad&svisitor=null&visitor=9e5e73de-3d3c-437c-85b6-f17c16eac8d2&session=2737c4a5-72f6-4e34-8244-6a02696724e1&event=active_time_track&q=%7B%22currentTime%22%3A%22Sun%2C%2022%20Jan%202023%2001%3A27%3A46%20GMT%22%2C%22lastTrackTime%22%3A%22Sun%2C%2022%20Jan%202023%2001%3A27%3A45%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%222003%22%7D&isIframe=false&m=%7B%22description%22%3A%22CERT-GIB%20%E2%80%93%20%D1%86%D0%B5%D0%BD%D1%82%D1%80%20%D0%BA%D1%80%D1%83%D0%B3%D0%BB%D0%BE%D1%81%D1%83%D1%82%D0%BE%D1%87%D0%BD%D0%BE%D0%B3%D0%BE%20%D1%80%D0%B5%D0%B0%D0%B3%D0%B8%D1%80%D0%BE%D0%B2%D0%B0%D0%BD%D0%B8%D1%8F%20%D0%BD%D0%B0%20%D0%B8%D0%BD%D1%86%D0%B8%D0%B4%D0%B5%D0%BD%D1%82%D1%8B%20%D0%B8%D0%BD%D1%84%D0%BE%D1%80%D0%BC%D0%B0%D1%86%D0%B8%D0%BE%D0%BD%D0%BD%D0%BE%D0%B9%20%D0%B1%D0%B5%D0%B7%D0%BE%D0%BF%D0%B0%D1%81%D0%BD%D0%BE%D1%81%D1%82%D0%B8.%20%D0%9F%D0%BE%D0%B7%D0%B2%D0%BE%D0%BD%D0%B8%D1%82%D0%B5%20%D0%BD%D0%B0%D0%BC%2C%20%D1%87%D1%82%D0%BE%D0%B1%D1%8B%20%D1%81%D0%BE%D0%BE%D0%B1%D1%89%D0%B8%D1%82%D1%8C%20%D0%BE%D0%B1%20%D0%B8%D0%BD%D1%86%D0%B8%D0%B4%D0%B5%D0%BD%D1%82%D0%B5%20%D0%B8%20%D0%BF%D0%BE%D0%BB%D1%83%D1%87%D0%B8%D1%82%D0%B5%20%D0%B1%D0%B5%D1%81%D0%BF%D0%BB%D0%B0%D1%82%D0%BD%D1%83%D1%8E%20%D0%BF%D0%B5%D1%80%D0%B2%D1%83%D1%8E%20%D0%BF%D0%BE%D0%BC%D0%BE%D1%89%D1%8C.%22%2C%22keywords%22%3A%22%D0%B3%D1%80%D1%83%D0%BF%D0%BF%D0%B0%2C%20%D1%80%D0%B5%D0%B0%D0%B3%D0%B8%D1%80%D0%BE%D0%B2%D0%B0%D0%BD%D0%B8%D0%B5%2C%20%D0%B8%D0%BD%D1%86%D0%B8%D0%B4%D0%B5%D0%BD%D1%82%2C%20%D0%B8%D0%B1%2C%20%D0%B8%D0%BD%D1%84%D0%BE%D1%80%D0%BC%D0%B0%D1%86%D0%B8%D0%BE%D0%BD%D0%BD%D0%B0%D1%8F%20%D0%B1%D0%B5%D0%B7%D0%BE%D0%BF%D0%B0%D1%81%D0%BD%D0%BE%D1%81%D1%82%D1%8C%2C%20%D0%BA%D1%80%D1%83%D0%B3%D0%BB%D0%BE%D1%81%D1%83%D1%82%D0%BE%D1%87%D0%BD%D0%BE%2C%20%D0%BE%D0%BF%D0%B5%D1%80%D0%B0%D1%82%D0%B8%D0%B2%D0%BD%D0%BE%2C%20%D0%BA%D0%B8%D0%B1%D0%B5%D1%80%D1%83%D0%B3%D1%80%D0%BE%D0%B7%D0%B0%22%2C%22title%22%3A%22%D0%93%D1%80%D1%83%D0%BF%D0%BF%D0%B0%20%D0%BE%D0%BF%D0%B5%D1%80%D0%B0%D1%82%D0%B8%D0%B2%D0%BD%D0%BE%D0%B3%D0%BE%20%D1%80%D0%B5%D0%B0%D0%B3%D0%B8%D1%80%D0%BE%D0%B2%D0%B0%D0%BD%D0%B8%D1%8F%20%D0%BD%D0%B0%20%D0%B8%D0%BD%D1%86%D0%B8%D0%B4%D0%B5%D0%BD%D1%82%D1%8B%20%D0%B8%D0%BD%D1%84%D0%BE%D1%80%D0%BC%D0%B0%D1%86%D0%B8%D0%BE%D0%BD%D0%BD%D0%BE%D0%B9%20%D0%B1%D0%B5%D0%B7%D0%BE%D0%BF%D0%B0%D1%81%D0%BD%D0%BE%D1%81%D1%82%D0%B8%20-%20CERT-GIB%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.group-ib.ru%2Fcert.html&pageViewId=ca6c969a-f69d-48e7-86b5-6aa9493dd8d4&an_uid=0

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.44.74.52 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-44-74-52.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Sun, 22 Jan 2023 01:27:46 GMT
x-content-type-options: nosniff
content-length: 43
pragma: no-cache
last-modified: Tue, 05 Oct 2021 22:17:52 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "615ccf10-2b"
access-control-max-age: 86400
access-control-allow-methods: GET,POST
content-type: image/gif
access-control-allow-origin
cache-control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: *
expires: Wed, 19 Apr 2000 11:43:00 GMT

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
492 B 191ms
190ms Image
image/gif 23.44.74.52
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=e84d9c08a990af8592952e7ac9a983ad&svisitor=null&visitor=9e5e73de-3d3c-437c-85b6-f17c16eac8d2&session=2737c4a5-72f6-4e34-8244-6a02696724e1&event=active_time_track&q=%7B%22currentTime%22%3A%22Sun%2C%2022%20Jan%202023%2001%3A27%3A47%20GMT%22%2C%22lastTrackTime%22%3A%22Sun%2C%2022%20Jan%202023%2001%3A27%3A46%20GMT%22%2C%22timeSpent%22%3A%221005%22%2C%22totalTimeSpent%22%3A%223008%22%7D&isIframe=false&m=%7B%22description%22%3A%22CERT-GIB%20%E2%80%93%20%D1%86%D0%B5%D0%BD%D1%82%D1%80%20%D0%BA%D1%80%D1%83%D0%B3%D0%BB%D0%BE%D1%81%D1%83%D1%82%D0%BE%D1%87%D0%BD%D0%BE%D0%B3%D0%BE%20%D1%80%D0%B5%D0%B0%D0%B3%D0%B8%D1%80%D0%BE%D0%B2%D0%B0%D0%BD%D0%B8%D1%8F%20%D0%BD%D0%B0%20%D0%B8%D0%BD%D1%86%D0%B8%D0%B4%D0%B5%D0%BD%D1%82%D1%8B%20%D0%B8%D0%BD%D1%84%D0%BE%D1%80%D0%BC%D0%B0%D1%86%D0%B8%D0%BE%D0%BD%D0%BD%D0%BE%D0%B9%20%D0%B1%D0%B5%D0%B7%D0%BE%D0%BF%D0%B0%D1%81%D0%BD%D0%BE%D1%81%D1%82%D0%B8.%20%D0%9F%D0%BE%D0%B7%D0%B2%D0%BE%D0%BD%D0%B8%D1%82%D0%B5%20%D0%BD%D0%B0%D0%BC%2C%20%D1%87%D1%82%D0%BE%D0%B1%D1%8B%20%D1%81%D0%BE%D0%BE%D0%B1%D1%89%D0%B8%D1%82%D1%8C%20%D0%BE%D0%B1%20%D0%B8%D0%BD%D1%86%D0%B8%D0%B4%D0%B5%D0%BD%D1%82%D0%B5%20%D0%B8%20%D0%BF%D0%BE%D0%BB%D1%83%D1%87%D0%B8%D1%82%D0%B5%20%D0%B1%D0%B5%D1%81%D0%BF%D0%BB%D0%B0%D1%82%D0%BD%D1%83%D1%8E%20%D0%BF%D0%B5%D1%80%D0%B2%D1%83%D1%8E%20%D0%BF%D0%BE%D0%BC%D0%BE%D1%89%D1%8C.%22%2C%22keywords%22%3A%22%D0%B3%D1%80%D1%83%D0%BF%D0%BF%D0%B0%2C%20%D1%80%D0%B5%D0%B0%D0%B3%D0%B8%D1%80%D0%BE%D0%B2%D0%B0%D0%BD%D0%B8%D0%B5%2C%20%D0%B8%D0%BD%D1%86%D0%B8%D0%B4%D0%B5%D0%BD%D1%82%2C%20%D0%B8%D0%B1%2C%20%D0%B8%D0%BD%D1%84%D0%BE%D1%80%D0%BC%D0%B0%D1%86%D0%B8%D0%BE%D0%BD%D0%BD%D0%B0%D1%8F%20%D0%B1%D0%B5%D0%B7%D0%BE%D0%BF%D0%B0%D1%81%D0%BD%D0%BE%D1%81%D1%82%D1%8C%2C%20%D0%BA%D1%80%D1%83%D0%B3%D0%BB%D0%BE%D1%81%D1%83%D1%82%D0%BE%D1%87%D0%BD%D0%BE%2C%20%D0%BE%D0%BF%D0%B5%D1%80%D0%B0%D1%82%D0%B8%D0%B2%D0%BD%D0%BE%2C%20%D0%BA%D0%B8%D0%B1%D0%B5%D1%80%D1%83%D0%B3%D1%80%D0%BE%D0%B7%D0%B0%22%2C%22title%22%3A%22%D0%93%D1%80%D1%83%D0%BF%D0%BF%D0%B0%20%D0%BE%D0%BF%D0%B5%D1%80%D0%B0%D1%82%D0%B8%D0%B2%D0%BD%D0%BE%D0%B3%D0%BE%20%D1%80%D0%B5%D0%B0%D0%B3%D0%B8%D1%80%D0%BE%D0%B2%D0%B0%D0%BD%D0%B8%D1%8F%20%D0%BD%D0%B0%20%D0%B8%D0%BD%D1%86%D0%B8%D0%B4%D0%B5%D0%BD%D1%82%D1%8B%20%D0%B8%D0%BD%D1%84%D0%BE%D1%80%D0%BC%D0%B0%D1%86%D0%B8%D0%BE%D0%BD%D0%BD%D0%BE%D0%B9%20%D0%B1%D0%B5%D0%B7%D0%BE%D0%BF%D0%B0%D1%81%D0%BD%D0%BE%D1%81%D1%82%D0%B8%20-%20CERT-GIB%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.group-ib.ru%2Fcert.html&pageViewId=ca6c969a-f69d-48e7-86b5-6aa9493dd8d4&an_uid=0

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.44.74.52 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-44-74-52.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Sun, 22 Jan 2023 01:27:47 GMT
x-content-type-options: nosniff
content-length: 43
pragma: no-cache
last-modified: Fri, 21 Feb 2020 18:57:20 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "5e502810-2b"
access-control-max-age: 86400
access-control-allow-methods: GET,POST
content-type: image/gif
access-control-allow-origin
cache-control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: *
expires: Wed, 19 Apr 2000 11:43:00 GMT

POST
H2 200 20002900 Show response
mc.yandex.com/webvisor/ 43 B
145 B 199ms
50ms XHR
image/gif 2a02:6b8::1:119
GLOBAL_DC

General

Check archive.org

Show headers Download Go to

Full URL

https://mc.yandex.com/webvisor/20002900?wmode=0&wv-part=1&wv-hit=411530536&page-url=https%3A%2F%2Fwww.group-ib.ru%2Fcert.html&rn=708600211&wv-type=3&browser-info=bt%3A1%3Awe%3A1%3Aet%3A1674350868%3Aw%3A1600x1200%3Av%3A960%3Az%3A0%3Ai%3A20230122012747%3Au%3A167435086512125606%3Avf%3Asmv4ejgykhrjvgldb09nr%3Ast%3A1674350868&t=gdpr(14)ti(2)

Requested by

Host: www.group-ib.ru
URL: https://www.group-ib.ru/build/main_26755_2be51925_563_1764.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:6b8::1:119 Moscow, Russian Federation, ASN208722 (GLOBAL_DC, FI),

Reverse DNS

Software

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Xss-Protection	1; mode=block

Request headers

Referer
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Sun, 22 Jan 2023 01:27:48 GMT
strict-transport-security: max-age=31536000
last-modified: Sun, 22-Jan-2023 01:27:48 GMT
content-type: image/gif
access-control-allow-origin: https://www.group-ib.ru
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 43
x-xss-protection: 1; mode=block
expires: Sun, 22-Jan-2023 01:27:48 GMT

POST
H2 200 20002900 Show response
mc.yandex.com/webvisor/ 43 B
73 B 56ms
56ms XHR
image/gif 2a02:6b8::1:119
GLOBAL_DC

General

Check archive.org

Show headers Download Go to

Full URL

https://mc.yandex.com/webvisor/20002900?wmode=0&wv-part=1&wv-hit=411530536&page-url=https%3A%2F%2Fwww.group-ib.ru%2Fcert.html&rn=1009040416&wv-type=3&browser-info=we%3A1%3Aet%3A1674350868%3Aw%3A1600x1200%3Av%3A960%3Az%3A0%3Ai%3A20230122012748%3Au%3A167435086512125606%3Avf%3Asmv4ejgykhrjvgldb09nr%3Ast%3A1674350868&t=gdpr(14)ti(2)

Requested by

Host: www.group-ib.ru
URL: https://www.group-ib.ru/build/main_26755_2be51925_563_1764.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:6b8::1:119 Moscow, Russian Federation, ASN208722 (GLOBAL_DC, FI),

Reverse DNS

Software

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Xss-Protection	1; mode=block

Request headers

Referer
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Sun, 22 Jan 2023 01:27:48 GMT
strict-transport-security: max-age=31536000
last-modified: Sun, 22-Jan-2023 01:27:48 GMT
content-type: image/gif
access-control-allow-origin: https://www.group-ib.ru
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 43
x-xss-protection: 1; mode=block
expires: Sun, 22-Jan-2023 01:27:48 GMT

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
492 B 193ms
193ms Image
image/gif 23.44.74.52
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=e84d9c08a990af8592952e7ac9a983ad&svisitor=null&visitor=9e5e73de-3d3c-437c-85b6-f17c16eac8d2&session=2737c4a5-72f6-4e34-8244-6a02696724e1&event=active_time_track&q=%7B%22currentTime%22%3A%22Sun%2C%2022%20Jan%202023%2001%3A27%3A48%20GMT%22%2C%22lastTrackTime%22%3A%22Sun%2C%2022%20Jan%202023%2001%3A27%3A47%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%224009%22%7D&isIframe=false&m=%7B%22description%22%3A%22CERT-GIB%20%E2%80%93%20%D1%86%D0%B5%D0%BD%D1%82%D1%80%20%D0%BA%D1%80%D1%83%D0%B3%D0%BB%D0%BE%D1%81%D1%83%D1%82%D0%BE%D1%87%D0%BD%D0%BE%D0%B3%D0%BE%20%D1%80%D0%B5%D0%B0%D0%B3%D0%B8%D1%80%D0%BE%D0%B2%D0%B0%D0%BD%D0%B8%D1%8F%20%D0%BD%D0%B0%20%D0%B8%D0%BD%D1%86%D0%B8%D0%B4%D0%B5%D0%BD%D1%82%D1%8B%20%D0%B8%D0%BD%D1%84%D0%BE%D1%80%D0%BC%D0%B0%D1%86%D0%B8%D0%BE%D0%BD%D0%BD%D0%BE%D0%B9%20%D0%B1%D0%B5%D0%B7%D0%BE%D0%BF%D0%B0%D1%81%D0%BD%D0%BE%D1%81%D1%82%D0%B8.%20%D0%9F%D0%BE%D0%B7%D0%B2%D0%BE%D0%BD%D0%B8%D1%82%D0%B5%20%D0%BD%D0%B0%D0%BC%2C%20%D1%87%D1%82%D0%BE%D0%B1%D1%8B%20%D1%81%D0%BE%D0%BE%D0%B1%D1%89%D0%B8%D1%82%D1%8C%20%D0%BE%D0%B1%20%D0%B8%D0%BD%D1%86%D0%B8%D0%B4%D0%B5%D0%BD%D1%82%D0%B5%20%D0%B8%20%D0%BF%D0%BE%D0%BB%D1%83%D1%87%D0%B8%D1%82%D0%B5%20%D0%B1%D0%B5%D1%81%D0%BF%D0%BB%D0%B0%D1%82%D0%BD%D1%83%D1%8E%20%D0%BF%D0%B5%D1%80%D0%B2%D1%83%D1%8E%20%D0%BF%D0%BE%D0%BC%D0%BE%D1%89%D1%8C.%22%2C%22keywords%22%3A%22%D0%B3%D1%80%D1%83%D0%BF%D0%BF%D0%B0%2C%20%D1%80%D0%B5%D0%B0%D0%B3%D0%B8%D1%80%D0%BE%D0%B2%D0%B0%D0%BD%D0%B8%D0%B5%2C%20%D0%B8%D0%BD%D1%86%D0%B8%D0%B4%D0%B5%D0%BD%D1%82%2C%20%D0%B8%D0%B1%2C%20%D0%B8%D0%BD%D1%84%D0%BE%D1%80%D0%BC%D0%B0%D1%86%D0%B8%D0%BE%D0%BD%D0%BD%D0%B0%D1%8F%20%D0%B1%D0%B5%D0%B7%D0%BE%D0%BF%D0%B0%D1%81%D0%BD%D0%BE%D1%81%D1%82%D1%8C%2C%20%D0%BA%D1%80%D1%83%D0%B3%D0%BB%D0%BE%D1%81%D1%83%D1%82%D0%BE%D1%87%D0%BD%D0%BE%2C%20%D0%BE%D0%BF%D0%B5%D1%80%D0%B0%D1%82%D0%B8%D0%B2%D0%BD%D0%BE%2C%20%D0%BA%D0%B8%D0%B1%D0%B5%D1%80%D1%83%D0%B3%D1%80%D0%BE%D0%B7%D0%B0%22%2C%22title%22%3A%22%D0%93%D1%80%D1%83%D0%BF%D0%BF%D0%B0%20%D0%BE%D0%BF%D0%B5%D1%80%D0%B0%D1%82%D0%B8%D0%B2%D0%BD%D0%BE%D0%B3%D0%BE%20%D1%80%D0%B5%D0%B0%D0%B3%D0%B8%D1%80%D0%BE%D0%B2%D0%B0%D0%BD%D0%B8%D1%8F%20%D0%BD%D0%B0%20%D0%B8%D0%BD%D1%86%D0%B8%D0%B4%D0%B5%D0%BD%D1%82%D1%8B%20%D0%B8%D0%BD%D1%84%D0%BE%D1%80%D0%BC%D0%B0%D1%86%D0%B8%D0%BE%D0%BD%D0%BD%D0%BE%D0%B9%20%D0%B1%D0%B5%D0%B7%D0%BE%D0%BF%D0%B0%D1%81%D0%BD%D0%BE%D1%81%D1%82%D0%B8%20-%20CERT-GIB%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.group-ib.ru%2Fcert.html&pageViewId=ca6c969a-f69d-48e7-86b5-6aa9493dd8d4&an_uid=0

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.44.74.52 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-44-74-52.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Sun, 22 Jan 2023 01:27:48 GMT
x-content-type-options: nosniff
content-length: 43
pragma: no-cache
last-modified: Tue, 05 Oct 2021 22:17:52 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "615ccf10-2b"
access-control-max-age: 86400
access-control-allow-methods: GET,POST
content-type: image/gif
access-control-allow-origin
cache-control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: *
expires: Wed, 19 Apr 2000 11:43:00 GMT

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
493 B 184ms
183ms Image
image/gif 23.44.74.52
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=e84d9c08a990af8592952e7ac9a983ad&svisitor=null&visitor=9e5e73de-3d3c-437c-85b6-f17c16eac8d2&session=2737c4a5-72f6-4e34-8244-6a02696724e1&event=active_time_track&q=%7B%22currentTime%22%3A%22Sun%2C%2022%20Jan%202023%2001%3A27%3A49%20GMT%22%2C%22lastTrackTime%22%3A%22Sun%2C%2022%20Jan%202023%2001%3A27%3A48%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%225010%22%7D&isIframe=false&m=%7B%22description%22%3A%22CERT-GIB%20%E2%80%93%20%D1%86%D0%B5%D0%BD%D1%82%D1%80%20%D0%BA%D1%80%D1%83%D0%B3%D0%BB%D0%BE%D1%81%D1%83%D1%82%D0%BE%D1%87%D0%BD%D0%BE%D0%B3%D0%BE%20%D1%80%D0%B5%D0%B0%D0%B3%D0%B8%D1%80%D0%BE%D0%B2%D0%B0%D0%BD%D0%B8%D1%8F%20%D0%BD%D0%B0%20%D0%B8%D0%BD%D1%86%D0%B8%D0%B4%D0%B5%D0%BD%D1%82%D1%8B%20%D0%B8%D0%BD%D1%84%D0%BE%D1%80%D0%BC%D0%B0%D1%86%D0%B8%D0%BE%D0%BD%D0%BD%D0%BE%D0%B9%20%D0%B1%D0%B5%D0%B7%D0%BE%D0%BF%D0%B0%D1%81%D0%BD%D0%BE%D1%81%D1%82%D0%B8.%20%D0%9F%D0%BE%D0%B7%D0%B2%D0%BE%D0%BD%D0%B8%D1%82%D0%B5%20%D0%BD%D0%B0%D0%BC%2C%20%D1%87%D1%82%D0%BE%D0%B1%D1%8B%20%D1%81%D0%BE%D0%BE%D0%B1%D1%89%D0%B8%D1%82%D1%8C%20%D0%BE%D0%B1%20%D0%B8%D0%BD%D1%86%D0%B8%D0%B4%D0%B5%D0%BD%D1%82%D0%B5%20%D0%B8%20%D0%BF%D0%BE%D0%BB%D1%83%D1%87%D0%B8%D1%82%D0%B5%20%D0%B1%D0%B5%D1%81%D0%BF%D0%BB%D0%B0%D1%82%D0%BD%D1%83%D1%8E%20%D0%BF%D0%B5%D1%80%D0%B2%D1%83%D1%8E%20%D0%BF%D0%BE%D0%BC%D0%BE%D1%89%D1%8C.%22%2C%22keywords%22%3A%22%D0%B3%D1%80%D1%83%D0%BF%D0%BF%D0%B0%2C%20%D1%80%D0%B5%D0%B0%D0%B3%D0%B8%D1%80%D0%BE%D0%B2%D0%B0%D0%BD%D0%B8%D0%B5%2C%20%D0%B8%D0%BD%D1%86%D0%B8%D0%B4%D0%B5%D0%BD%D1%82%2C%20%D0%B8%D0%B1%2C%20%D0%B8%D0%BD%D1%84%D0%BE%D1%80%D0%BC%D0%B0%D1%86%D0%B8%D0%BE%D0%BD%D0%BD%D0%B0%D1%8F%20%D0%B1%D0%B5%D0%B7%D0%BE%D0%BF%D0%B0%D1%81%D0%BD%D0%BE%D1%81%D1%82%D1%8C%2C%20%D0%BA%D1%80%D1%83%D0%B3%D0%BB%D0%BE%D1%81%D1%83%D1%82%D0%BE%D1%87%D0%BD%D0%BE%2C%20%D0%BE%D0%BF%D0%B5%D1%80%D0%B0%D1%82%D0%B8%D0%B2%D0%BD%D0%BE%2C%20%D0%BA%D0%B8%D0%B1%D0%B5%D1%80%D1%83%D0%B3%D1%80%D0%BE%D0%B7%D0%B0%22%2C%22title%22%3A%22%D0%93%D1%80%D1%83%D0%BF%D0%BF%D0%B0%20%D0%BE%D0%BF%D0%B5%D1%80%D0%B0%D1%82%D0%B8%D0%B2%D0%BD%D0%BE%D0%B3%D0%BE%20%D1%80%D0%B5%D0%B0%D0%B3%D0%B8%D1%80%D0%BE%D0%B2%D0%B0%D0%BD%D0%B8%D1%8F%20%D0%BD%D0%B0%20%D0%B8%D0%BD%D1%86%D0%B8%D0%B4%D0%B5%D0%BD%D1%82%D1%8B%20%D0%B8%D0%BD%D1%84%D0%BE%D1%80%D0%BC%D0%B0%D1%86%D0%B8%D0%BE%D0%BD%D0%BD%D0%BE%D0%B9%20%D0%B1%D0%B5%D0%B7%D0%BE%D0%BF%D0%B0%D1%81%D0%BD%D0%BE%D1%81%D1%82%D0%B8%20-%20CERT-GIB%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.group-ib.ru%2Fcert.html&pageViewId=ca6c969a-f69d-48e7-86b5-6aa9493dd8d4&an_uid=0

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.44.74.52 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-44-74-52.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Sun, 22 Jan 2023 01:27:49 GMT
x-content-type-options: nosniff
content-length: 43
pragma: no-cache
last-modified: Sat, 05 Jun 2021 07:56:05 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "60bb2e15-2b"
access-control-max-age: 86400
access-control-allow-methods: GET,POST
content-type: image/gif
access-control-allow-origin
cache-control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: *
expires: Wed, 19 Apr 2000 11:43:00 GMT

Verdicts & Comments Add Verdict or Comment

107 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

42 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.group-ib.ru/	1970-01-20 13:25:02	Name: bpmRef Value:
.group-ib.ru/	1970-01-20 13:25:02	Name: bpmHref Value: https://www.group-ib.ru/cert.html
.group-ib.ru/	1970-01-20 13:25:02	Name: bpmTrackingId Value: 8a5b041d-963a-8538-654a-05c0edc18a76
.www.group-ib.ru/	1970-01-20 17:51:26	Name: __zzatgib-w-group-ib Value: MDA0dBA=Fz2+aQ==
.group-ib.ru/	1970-01-20 17:51:26	Name: __zzatgib-w-group-ib Value: MDA0dBA=Fz2+aQ==
.app-lon09.marketo.com/	1970-01-20 09:05:52	Name: __cf_bm Value: Xr_Lehh1N7YclVszw.7d52ZZG8ZJvptO46vPisTnUhc-1674350864-0-AdQS9Uwa/HprCgdyTILT7ipt7jCDOsfWgpGBnFqP7BlUVqxLefwwFaPWgpngag5ucX1sMW/Aatvjq0H1hlzF2JY=
.group-ib.ru/	1970-01-20 11:15:26	Name: _gcl_au Value: 1.1.1744288069.1674350864
.group-ib.ru/	1970-01-20 18:41:50	Name: _ga Value: GA1.2.1289706080.1674350864
.group-ib.ru/	1970-01-20 09:07:17	Name: _gid Value: GA1.2.1800356927.1674350864
.group-ib.ru/	1970-01-20 09:05:50	Name: _dc_gtm_UA-25492706-1 Value: 1
.id.group-ib.com/	1970-01-20 17:51:26	Name: gcfids Value: 2NOtXWsXmWRCybPtRvaf8K1E7-QCzJL9QDuJ6Wg-KfOZtLpjvST6uWZvgRMcgBoFQTGIou9DQDQRd-+Uo4WN1DnT8dug6R5Sz962Mo6sSyXIyWsybbsnPBFd4USC
.www.group-ib.ru/	1970-01-20 18:41:50	Name: _mkto_trk Value: id:689-LRE-818&token:_mch-www.group-ib.ru-1674350864481-23917
www.group-ib.ru/	1970-01-20 09:15:55	Name: _an_uid Value: 0
www.group-ib.ru/	1970-01-20 18:41:50	Name: _gd_visitor Value: 9e5e73de-3d3c-437c-85b6-f17c16eac8d2
www.group-ib.ru/	1970-01-20 09:06:05	Name: _gd_session Value: 2737c4a5-72f6-4e34-8244-6a02696724e1
.group-ib.ru/	1970-01-20 11:15:26	Name: _fbp Value: fb.1.1674350864556.609879716
www.group-ib.ru/	1970-01-20 09:05:50	Name: gssc26755 Value:
.group-ib.ru/	1970-01-20 17:51:26	Name: _ym_uid Value: 167435086512125606
.group-ib.ru/	1970-01-20 17:51:26	Name: _ym_d Value: 1674350865
.mc.yandex.com/	1970-01-20 09:05:51	Name: sync_cookie_csrf Value: 3883557763fake
.6sc.co/	1970-01-20 18:41:50	Name: 6suuid Value: 31284317b34000001091cc63f9020000ea6a7c00
.group-ib.ru/	1970-01-20 09:07:02	Name: _ym_isad Value: 2
.mc.yandex.ru/	1970-01-20 09:05:51	Name: sync_cookie_csrf Value: 1467955185fake
mc.yandex.com/	1969-12-31 23:59:59	Name: yabs-sid Value: 1987251621674350864
.yandex.com/	1970-01-20 18:41:50	Name: i Value: fSZBgAVzEBfKT+w6KVS6gKPKXq4VmPAXddQFS1n/jQY8ahf+MFmoRTOEo5HSghLOL+LNqywm0W5L1R2XBffMFmk3z4U=
.yandex.com/	1970-01-20 17:51:26	Name: yandexuid Value: 1813119441674350864
.yandex.com/	1970-01-20 17:51:26	Name: yuidss Value: 1813119441674350864
.yandex.com/	1970-01-20 17:51:26	Name: ymex Value: 1705886864.yc.1674350864#1705886864.yrts.1674350864#1705886864.yrtsi.1674350864
.group-ib.ru/	1970-01-20 13:25:02	Name: __hstc Value: 124113877.90d90f6633ed5c41db2098864a2fb278.1674350865008.1674350865008.1674350865008.1
.group-ib.ru/	1970-01-20 13:25:02	Name: hubspotutk Value: 90d90f6633ed5c41db2098864a2fb278
.group-ib.ru/	1969-12-31 23:59:59	Name: __hssrc Value: 1
.group-ib.ru/	1970-01-20 09:05:52	Name: __hssc Value: 124113877.1.1674350865008
.hubspot.com/	1970-01-20 09:05:52	Name: __cf_bm Value: MgE3y0CmZRIJ20fs3tLn.kK8dcJgjcFYOEL.magAZrk-1674350865-0-AZa6cCJJbjNXv35urV0yxg4a7KxBIul4EpojnIzBkX3Ah3aPKW9quHVjaoXupVqMNajSbXlrB0gO1gS7+QcdXcQ=
.group-ib.ru/	1970-01-20 09:05:52	Name: _ym_visorc Value: w
.doubleclick.net/	1970-01-20 18:27:26	Name: IDE Value: AHWqTUmJOg3hhkxB8w0QeWXRILRVH4L7MxjNgIJMzpf4eOgSKtEMtG_j8Wvly6om
www.group-ib.ru/	1970-01-20 17:51:26	Name: cfidsgib-w-group-ib Value: HvYnjXD/UQCFLJL4ouIm7S7YDY/FIPU+bsrgYd6lOb2g5cIoImohIyICa7u+2N2AxOW+CqM7CmhgSp7LRJE8cV1il5iivGjvJAUEwmHXqYJJYtC4ehmWsZE5OXbJ5BAvVVfKQPyAZVmPqWqA3YAeS66I9zgfOEUcjRXI
.www.group-ib.ru/	1970-01-20 17:51:26	Name: cfidsgib-w-group-ib Value: HvYnjXD/UQCFLJL4ouIm7S7YDY/FIPU+bsrgYd6lOb2g5cIoImohIyICa7u+2N2AxOW+CqM7CmhgSp7LRJE8cV1il5iivGjvJAUEwmHXqYJJYtC4ehmWsZE5OXbJ5BAvVVfKQPyAZVmPqWqA3YAeS66I9zgfOEUcjRXI
.group-ib.ru/	1970-01-20 17:51:26	Name: cfidsgib-w-group-ib Value: HvYnjXD/UQCFLJL4ouIm7S7YDY/FIPU+bsrgYd6lOb2g5cIoImohIyICa7u+2N2AxOW+CqM7CmhgSp7LRJE8cV1il5iivGjvJAUEwmHXqYJJYtC4ehmWsZE5OXbJ5BAvVVfKQPyAZVmPqWqA3YAeS66I9zgfOEUcjRXI
.www.group-ib.ru/	1970-01-20 17:51:26	Name: gsscgib-w-group-ib Value: ERM2+EsuP6wpxFaIMJT0h+JaUR+lnknyuSeC09zOl9JuhQO94nQ9fPag6pIlavri1AU+uMwFSUFXviQ1utMvwa8uaj8j4X5uhGEWB7VtW6VzUgzxL3njVbBpj/6BHK9qVW5NS5YjDFxlMM0xuALiwutJiJuqhsrw9DDZNVo9C4rrxzBBGd4qGSmJnjWw64NGYNI8rJXBf/MwypKbclI+3LkcD7h324b2PJaKpTWT6WpuheBrdjYhJQy/Zy0Hp6eNOA==
.group-ib.ru/	1970-01-20 17:51:26	Name: gsscgib-w-group-ib Value: ERM2+EsuP6wpxFaIMJT0h+JaUR+lnknyuSeC09zOl9JuhQO94nQ9fPag6pIlavri1AU+uMwFSUFXviQ1utMvwa8uaj8j4X5uhGEWB7VtW6VzUgzxL3njVbBpj/6BHK9qVW5NS5YjDFxlMM0xuALiwutJiJuqhsrw9DDZNVo9C4rrxzBBGd4qGSmJnjWw64NGYNI8rJXBf/MwypKbclI+3LkcD7h324b2PJaKpTWT6WpuheBrdjYhJQy/Zy0Hp6eNOA==
.www.group-ib.ru/	1970-01-20 17:51:26	Name: fgsscgib-w-group-ib Value: iphz74fd3fcbb913ea6da9361e1c4a2d23e6b187
.group-ib.ru/	1970-01-20 17:51:26	Name: fgsscgib-w-group-ib Value: iphz74fd3fcbb913ea6da9361e1c4a2d23e6b187

4 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
security	warning	Message: Error with Feature-Policy header: Unrecognized feature: 'speaker'.
security	error	Message: Error with Permissions-Policy header: Parse of permissions policy failed because of errors reported by structured header parser.
network	error	URL: https://www.group-ib.ru/media/wp-admin/admin-ajax.php?action=mediaformain Message: Failed to load resource: the server responded with a status of 403 (Forbidden)
network	error	URL: https://mc.yandex.com/sync_cookie_image_decide?token=9890.82qW9z3HTBKd_Vpl19-T_erIquMBh07Cuxg3DyZzm28K19qIgkxBtKSNNDVfmTQXD7sIpvchmQNiqV0jGhhWdqx-ZXg1RbB-3d5giQPriaQ%2C.hIoEIKX8pmuiUqkUdSjK3B-A03Y%2C Message: Failed to load resource: the server responded with a status of 400 ()

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	frame-ancestors 'self'
Strict-Transport-Security	max-age=15724800; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

689-lre-818.mktoresp.com
api-eu1.hubapi.com
api.neverbounce.com
app-lon09.marketo.com
b.6sc.co
c.6sc.co
cdn.neverbounce.com
cert.group-ib.ru
connect.facebook.net
forms-eu1.hsforms.com
forms-eu1.hubspot.com
forms.hsforms.com
googleads.g.doubleclick.net
ipv6.6sc.co
j.6sc.co
js-eu1.hs-analytics.net
js-eu1.hs-banner.com
js-eu1.hs-scripts.com
js-eu1.hsadspixel.net
js-eu1.hscollectedforms.net
js-eu1.hsforms.net
mc.yandex.com
mc.yandex.ru
munchkin.marketo.net
ru.id.group-ib.com
secure.adnxs.com
stats.g.doubleclick.net
track-eu1.hubspot.com
www.facebook.com
www.google-analytics.com
www.google.com
www.google.de
www.googletagmanager.com
www.group-ib.ru
104.16.94.80
13.225.78.38
172.65.192.122
172.65.193.34
172.65.202.201
172.65.208.22
172.65.219.229
172.65.232.43
172.65.238.60
172.65.240.166
172.65.255.172
178.248.235.63
185.17.9.183
199.15.214.243
23.44.74.52
23.45.104.85
2606:4700::6810:5705
2606:4700::6811:cacc
2a00:1450:4001:812::2008
2a00:1450:4001:829::2002
2a00:1450:4001:830::2003
2a00:1450:4001:830::200e
2a00:1450:400c:c00::9b
2a00:1450:400d:80a::2004
2a02:26f0:e300:182::1c91
2a02:6b8::1:119
2a03:2880:f083:100:face:b00c:0:3
2a03:2880:f176:181:face:b00c:0:25de
37.252.171.22
5.9.185.28
52.6.202.178
04bdf7a7f188c4aa11765dd32f67e30c23bd4c20aea5067e37c14c1a6f8a6b20
0694124dd8cf871b521cf06ce0b2419ebbe18d3f45658b50c4b038b647fbc849
077dad3be3a10854dc97527ce83bbf6422309d807f6e4b3492de78005d786cdc
09273e08ac3dfff9b50d542399a39e01549d1eb79202aba74cbdc4bca5849372
0b2559eba72b782c4878457b97c437c9189a050d9fa17aa7375d95a4a54c6b94
0ea8a38dd231bd18f82c0fe04c7a14115ecd5600c62be4e7296251f4fd8385b8
132b669c9634c5296fd3e6802091f16c490089a12c26c4078c2c30754ab17587
141397708f146e91f2a8137f1897e36d558af1c3c2e552c6aeda5f5d0a7448b0
163907259fa19c5b768aea83f82db575b01aad0fd5fbf9ac448d3db383229547
1704f32f6b6e4bd751881c6bf649e22817115071190df38b412dea1169d8865b
18b62041f42319dd42532a35b9f1b53f42e04c412f152e43b08d7b1155234a8b
1a2217ca9a9da526e5e11fc9dfbd5c03bff3071238d08fa693d2d147835b146d
206d8cf5d1a0149c666651755b0f7b0b62a50882d61a5d18eaddc7317bb92a53
266b335a4fb5c75ee1f739b9fec82d916ce2f4c83e9754afa366e3958743358d
27f0d709041eb37753cad3710e46e3860ce42c28c8992d29e8c58fba33fa9910
3030463296e8b29cd70142df3707770a0b89f54c191f62974b2373f8454963b5
31b45c462302ac175bfa43f9e5591491db780ca094f6ecdd2907f25ad578448d
321d7348ac755c0e1002c13bf522c559cc1e9b1e1854b13e7f4e39e2afe6a513
3976e744f9adf8c331739695158a685668b3136052882117b91d543df93ff9ed
3999cf864b43937c278afeae5b60b6db69bb234d5641202c9e7a2385029aa3b7
3dfb83a15a1a69fb2c6355797651535983e30f2ebee4666b987b217780a18f61
3f8ab92da8dd94680196795fcc3018ef6169c1a4744be0b110b32d42e57394d2
41cbb050257ab5129be5ad7c3182cc05058690c51ae2beeedd2db1134eeb6811
43f22362329b9705cf8629061fb5b1d1a38f1cc2bc9fd46728f73e5cd9eb77cf
4ae85ebb7e7e9f69f267f3b921071f76b843730bced7762ba2def648c8b7c0b7
4bdf008140cb9fb1f8a566f08c41e56801d474a5c4e8745073d5c32bd3b363db
4be0d762af4ae8418408070645019a56fa8f363350b7cc6199eb49e8dc6618c0
4e120d2062811f5e68425abc7f9e8aadd175a53e128ccb35677a18bdf35a6054
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
59459a76ec79e9e9e6deca7590ba2ad508a761628d8289a4b1426a737bd56608
5971b095cff574a66d35ada016d4c077c86e2dea62e9c0f14cf7c94b258619de
5a2e5fe51839ca304b661fe1844facf26a8287553d2c9e0b2395254e21e0e45b
5d4972183041556a4368526fbac13acafc83de9ff3ca29ce81f31eb29c8f8a57
5e7ba66d01f763eb14675fce5b50a5c54bfa5a3d55b72ef1533ec3dd2243592b
66d609b0c975493c48e785524fbb6cfa5d28ea59d8d7e5e12bd4a8c5b8556f67
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992
6b3e18b4a358c58b8e40c94c13914f340011b9ee6f80e0009173627d79776502
6d6b766a86ee59cc94e61ba039af69a6adf0dc75e9eaa15522072d970f5090fd
6f4f281400418fc288c5765dc650f12506aa3190183b137d5e129ca3c6038e6a
7269a5d82fd6e7eb1922bd7033cf7cd9809042082b8fedfe30e92bf1616a2264
74711bb799e7d4712bcdc9fdf42f5acb835448d1ec23936a1d46a087e192e378
74b1ef519b646b06a287de1c8c7bdbed614c1cee4d90b387bcf0a680d95ed7a5
7b12bc0e3c26c7489b7b00b5eac170133e840e004baac496b88c23db28353ad4
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
8398a026313c016324f186d1c9b24a46813109d4bc5477d910a683079cbf1434
840bed8793252ac8937e135033551aee2737d7969d8d8adc86128aec419be5c1
844bb56d9d924583139e6f89aa998b215f3a7516cafc5e448c64e8cde29361e5
84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80
86aea411ee8e8d7eef5100e833f1c40917512a99ec86dff57105d495525a01e4
873b0f296cc53130ff0148c0c8049a5d59903ee62da607a1bd5308b678ae0d8e
8b3ecc577e9722ca0bb5fd08ce6e5b800b114001af146f2a03865ab2859e9eb1
8e52ed8e2c84be9a31bbfa30f6cf9740db73ff467b7293ecd7c6cefd33e99040
91a50850c517899e1c975079158949f7a500ddf5a7307fe36bf50092926beedc
99faffe359a6aefc264101e998b957be759204c814ec24dcb70eb854adf97758
9e0c7a947ce776d962b239a6ca61da5e6ab31affa92d2812151632939d5240ec
9ebbcf893735f0443c9d7fb98f091b5cd9b70aaf775e3f7185ef661d8aecf1e2
9ee338bd03594461a939b661840e43fec02d7345e19e3ad12509c06ba37ad355
9f76fca582f32f2da3a5f6c1fbfd29f75a599227fc58c9a3acde24fd25550246
b4b270e405f3680387545b2613ed4efb0e20a2924e1848be905e424324fd6fc3
c4f8a2a7d6771629faaf97c7b81d67b0ebc2de9ef0138558ed27cd6a5d44ae19
c571384decf79f68816bf6eebecae6e433ee3714f6c343507c51952991c0e770
c99d11cb4960d6e1918ed55d5bcbb316d38b51098e2efc1201904d7274d3273e
cbbd42bb1d88693e6805bd9d676840424af5ecf3e13d874fd06e6b57d53d8d40
cf9da19ae0f7723bf047835dd2cce51d34179a67d9508e122416a77a4aa3e77c
cfb448f673e571bc655c5c6dc56275b9d3a10e28eb4c9b46f3767d0f03ff5bb6
da80939200fd9b61ce6055bea1095373128866fee16a79d861497e30a434ba23
dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
dd2344a168bef37c706400f1a5656fc16f231ad7e43744132c8b08e8474a33ca
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e879f79cf3432a5c0e30fe7ff7bbbccf97fb8adf675ea88a3349f22936b73a9d
eea93734d5f0032479fa252394415d53cbcd4e7bd6d54764543eaa8b7c9fd10c
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
ef8f067f829af7c95936a36f38e54c98ab090f937f5557e4c78829ed8fcf5ffd
efa932074c870b37032de4416e0737cb005b6b99e79cb671b6366ac1c326a79c
f7096ac96739c35139612e515627a25aa0c3ec833e44e8679e92f529e6fcf44e
fa226de8637f46d7104e9169cc0155bff7f658af5e11bb28baa8dde9b47e8723
fc50d7c745b4b7ad268ab0c4a71b545dab230889a7f171a29e4a6534041f65bc
fe04a9dc88d3f3be8d4f6bc63a9a80f45a4c6d8460e7551dab849457c091920a
fe9a7ca1e475140e6b37fbc86a5efcd3251be4348137aa07231bd91ee8678b7c

www.group-ib.ru Open in urlscan Pro 178.248.235.63 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

103 Requests

97 %HTTPS

39 %IPv6

26 Domains

34 Subdomains

31 IPs

7 Countries

7357 kBTransfer

11712 kBSize

42 Cookies

39 Outgoing links

Page URL History

Redirected requests

103 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 10 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

www.group-ib.ru Open in urlscan Pro
178.248.235.63 Public Scan

Screenshot
Live screenshot

Full Image

103
Requests

97 %
HTTPS

39 %
IPv6

26
Domains

34
Subdomains

31
IPs

7
Countries

7357 kB
Transfer

11712 kB
Size

42
Cookies

103 HTTP transactions
10 data transactions