urlscan.io logo urlscan.io
SecurityTrails logo

www.cybereason.com Open in urlscan Pro
199.60.103.30  Public Scan

Go To Rescan Add Verdict Report
URL: https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms
Submission: On October 07 via manual from SA — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 61 IPs in 6 countries across 50 domains to perform 153 HTTP transactions. The main IP is 199.60.103.30, located in United States and belongs to CLOUDFLARESPECTRUM Cloudflare, Inc., US. The main domain is www.cybereason.com.
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on July 16th 2021. Valid for: a year.
This is the only time www.cybereason.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
44 199.60.103.30 209242 (CLOUDFLAR...)
9 2.16.186.59 20940 (AKAMAI-ASN1)
1 152.199.22.144 15133 (EDGECAST)
1 104.17.240.204 13335 (CLOUDFLAR...)
2 104.16.19.94 13335 (CLOUDFLAR...)
3 172.217.18.106 15169 (GOOGLE)
10 142.250.186.35 15169 (GOOGLE)
4 31.13.92.14 32934 (FACEBOOK)
2 93.184.220.66 15133 (EDGECAST)
2 104.19.154.83 13335 (CLOUDFLAR...)
1 104.17.233.204 13335 (CLOUDFLAR...)
1 104.18.20.191 13335 (CLOUDFLAR...)
1 104.17.69.176 13335 (CLOUDFLAR...)
1 104.111.215.74 16625 (AKAMAI-AS)
1 104.244.42.72 13414 (TWITTER)
4 142.250.185.174 15169 (GOOGLE)
2 142.250.186.40 15169 (GOOGLE)
1 104.19.155.83 13335 (CLOUDFLAR...)
2 74.125.140.155 15169 (GOOGLE)
1 5 142.250.185.162 15169 (GOOGLE)
1 2.16.186.10 20940 (AKAMAI-ASN1)
1 151.101.12.157 54113 (FASTLY)
3 13.107.21.200 8068 (MICROSOFT...)
2 6 142.250.185.198 15169 (GOOGLE)
1 13.225.87.40 16509 (AMAZON-02)
1 151.101.129.140 54113 (FASTLY)
1 104.16.168.82 13335 (CLOUDFLAR...)
1 104.17.213.204 13335 (CLOUDFLAR...)
1 104.18.0.92 13335 (CLOUDFLAR...)
1 35.244.142.80 15169 (GOOGLE)
1 178.79.242.16 22822 (LLNW)
4 2.18.233.201 16625 (AKAMAI-AS)
1 151.101.130.110 54113 (FASTLY)
1 54.163.67.9 14618 (AMAZON-AES)
1 13.224.193.116 16509 (AMAZON-02)
1 13.225.87.8 16509 (AMAZON-02)
1 1 68.67.153.60 29990 (ASN-APPNEX)
3 3 185.33.220.242 29990 (ASN-APPNEX)
1 13.225.87.106 16509 (AMAZON-02)
5 142.250.185.164 15169 (GOOGLE)
1 2 108.174.11.37 14413 (LINKEDIN)
1 1 13.107.42.14 8068 (MICROSOFT...)
1 104.244.42.67 13414 (TWITTER)
1 104.244.42.69 13414 (TWITTER)
1 13.224.193.31 16509 (AMAZON-02)
1 151.101.193.140 54113 (FASTLY)
1 142.250.185.142 15169 (GOOGLE)
2 216.239.36.54 15169 (GOOGLE)
2 4 66.155.71.25 13768 (COGECO-PEER1)
1 13.224.193.73 16509 (AMAZON-02)
1 206.19.49.24 7018 (ATT-INTER...)
2 31.13.92.36 32934 (FACEBOOK)
1 2 18.196.93.253 16509 (AMAZON-02)
2 2 52.215.67.80 16509 (AMAZON-02)
1 2 13.225.87.69 16509 (AMAZON-02)
1 35.244.174.68 15169 (GOOGLE)
1 13.225.87.16 16509 (AMAZON-02)
2 142.250.185.66 15169 (GOOGLE)
1 52.51.140.204 16509 (AMAZON-02)
1 2 52.214.44.171 16509 (AMAZON-02)
1 2 35.227.248.159 15169 (GOOGLE)
1 34.254.143.3 16509 (AMAZON-02)
1 104.111.242.245 16625 (AKAMAI-AS)
1 2 52.209.129.133 16509 (AMAZON-02)
153 61
44    199.60.103.30 (United States)

ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US)
www.cybereason.com
9    2.16.186.59 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)
PTR: a2-16-186-59.deploy.static.akamaitechnologies.com
use.typekit.net
1    152.199.22.144 (United States)

ASN15133 (EDGECAST, US)
platform.linkedin.com
1    104.17.240.204 (None, )

ASN13335 (CLOUDFLARENET, US)
cdn2.hubspot.net
2    104.16.19.94 (None, )

ASN13335 (CLOUDFLARENET, US)
cdnjs.cloudflare.com
3    172.217.18.106 (United States)

ASN15169 (GOOGLE, US)
PTR: zrh04s05-in-f106.1e100.net
fonts.googleapis.com
10    142.250.186.35 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s04-in-f3.1e100.net
fonts.gstatic.com
4    31.13.92.14 (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)
PTR: xx-fbcdn-shv-01-frt3.fbcdn.net
connect.facebook.net
2    93.184.220.66 (London, United Kingdom)

ASN15133 (EDGECAST, US)
platform.twitter.com
2    104.19.154.83 (None, )

ASN13335 (CLOUDFLARENET, US)
app.hubspot.com
track.hubspot.com
1    104.17.233.204 (None, )

ASN13335 (CLOUDFLARENET, US)
js.hsleadflows.net
1    104.18.20.191 (None, )

ASN13335 (CLOUDFLARENET, US)
js.hs-banner.com
1    104.17.69.176 (None, )

ASN13335 (CLOUDFLARENET, US)
js.hs-analytics.net
1    104.111.215.74 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a104-111-215-74.deploy.static.akamaitechnologies.com
p.typekit.net
1    104.244.42.72 (United States)

ASN13414 (TWITTER, US)
syndication.twitter.com
4    142.250.185.174 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s51-in-f14.1e100.net
www.google-analytics.com
2    142.250.186.40 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s04-in-f8.1e100.net
www.googletagmanager.com
1    104.19.155.83 (None, )

ASN13335 (CLOUDFLARENET, US)
forms.hubspot.com
2    74.125.140.155 (United States)

ASN15169 (GOOGLE, US)
PTR: wq-in-f155.1e100.net
stats.g.doubleclick.net
5    142.250.185.162 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s51-in-f2.1e100.net
www.googleadservices.com
googleads.g.doubleclick.net
1    2.16.186.10 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)
PTR: a2-16-186-10.deploy.static.akamaitechnologies.com
snap.licdn.com
1    151.101.12.157 (Frankfurt am Main, Germany)

ASN54113 (FASTLY, US)
static.ads-twitter.com
3    13.107.21.200 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
bat.bing.com
6    142.250.185.198 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s52-in-f6.1e100.net
10272547.fls.doubleclick.net
10428681.fls.doubleclick.net
1    13.225.87.40 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-225-87-40.fra2.r.cloudfront.net
static.hotjar.com
1    151.101.129.140 (United States)

ASN54113 (FASTLY, US)
www.redditstatic.com
1    104.16.168.82 (None, )

ASN13335 (CLOUDFLARENET, US)
ws.zoominfo.com
1    104.17.213.204 (None, )

ASN13335 (CLOUDFLARENET, US)
js.hs-scripts.com
1    104.18.0.92 (None, )

ASN13335 (CLOUDFLARENET, US)
trk.techtarget.com
1    35.244.142.80 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 80.142.244.35.bc.googleusercontent.com
cdn.pdst.fm
1    178.79.242.16 (United States)

ASN22822 (LLNW, US)
PTR: https-178-79-242-16.fra.llnw.net
up.pixel.ad
4    2.18.233.201 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a2-18-233-201.deploy.static.akamaitechnologies.com
pixel.mathtag.com
1    151.101.130.110 (United States)

ASN54113 (FASTLY, US)
fast.wistia.com
1    54.163.67.9 (United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-163-67-9.compute-1.amazonaws.com
lltrck.com
1    13.224.193.116 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-224-193-116.fra2.r.cloudfront.net
tag.demandbase.com
1    13.225.87.8 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-225-87-8.fra2.r.cloudfront.net
px.airpr.com
1    68.67.153.60 (Secaucus, United States)

ASN29990 (ASN-APPNEX, US)
PTR: s.ml-attr.com.pxlsrv.net
s.ml-attr.com
3    185.33.220.242 (Amsterdam, Netherlands)

ASN29990 (ASN-APPNEX, US)
PTR: 724.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net
secure.adnxs.com
1    13.225.87.106 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-225-87-106.fra2.r.cloudfront.net
attr.ml-api.io
5    142.250.185.164 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s51-in-f4.1e100.net
www.google.com
2    108.174.11.37 (United States)

ASN14413 (LINKEDIN, US)
PTR: 108-174-11-37.fwd.linkedin.com
px.ads.linkedin.com
1    13.107.42.14 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
www.linkedin.com
1    104.244.42.67 (United States)

ASN13414 (TWITTER, US)
analytics.twitter.com
1    104.244.42.69 (United States)

ASN13414 (TWITTER, US)
t.co
1    13.224.193.31 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-224-193-31.fra2.r.cloudfront.net
script.hotjar.com
1    151.101.193.140 (United States)

ASN54113 (FASTLY, US)
alb.reddit.com
1    142.250.185.142 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s50-in-f14.1e100.net
analytics.google.com
2    216.239.36.54 (United States)

ASN15169 (GOOGLE, US)
us-central1-adaptive-growth.cloudfunctions.net
4    66.155.71.25 (Portsmouth, United Kingdom)

ASN13768 (COGECO-PEER1, CA)
pixel.sitescout.com
1    13.224.193.73 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-224-193-73.fra2.r.cloudfront.net
vars.hotjar.com
1    206.19.49.24 (United States)

ASN7018 (ATT-INTERNET4, US)
apt.techtarget.com
2    31.13.92.36 (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)
PTR: edge-star-mini-shv-01-frt3.facebook.com
www.facebook.com
2    18.196.93.253 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-18-196-93-253.eu-central-1.compute.amazonaws.com
dpx.airpr.com
2    52.215.67.80 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-215-67-80.eu-west-1.compute.amazonaws.com
match.prod.bidr.io
2    13.225.87.69 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-225-87-69.fra2.r.cloudfront.net
segments.company-target.com
1    35.244.174.68 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 68.174.244.35.bc.googleusercontent.com
id.rlcdn.com
1    13.225.87.16 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-225-87-16.fra2.r.cloudfront.net
api.company-target.com
2    142.250.185.66 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s48-in-f2.1e100.net
adservice.google.com
1    52.51.140.204 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-51-140-204.eu-west-1.compute.amazonaws.com
in.hotjar.com
2    52.214.44.171 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-214-44-171.eu-west-1.compute.amazonaws.com
dpm.demdex.net
2    35.227.248.159 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 159.248.227.35.bc.googleusercontent.com
pixel.tapad.com
1    34.254.143.3 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-34-254-143-3.eu-west-1.compute.amazonaws.com
loadm.exelator.com
1    104.111.242.245 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a104-111-242-245.deploy.static.akamaitechnologies.com
sync.teads.tv
2    52.209.129.133 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-209-129-133.eu-west-1.compute.amazonaws.com
bcp.crwdcntrl.net
Apex Domain
Subdomains		 Transfer
44 cybereason.com
www.cybereason.com
2 MB
11 doubleclick.net
stats.g.doubleclick.net
10272547.fls.doubleclick.net
10428681.fls.doubleclick.net
googleads.g.doubleclick.net
5 KB
10 gstatic.com
fonts.gstatic.com
252 KB
10 typekit.net
use.typekit.net
p.typekit.net
143 KB
8 google.com
www.google.com
analytics.google.com
adservice.google.com
2 KB
4 sitescout.com
pixel.sitescout.com
3 KB
4 mathtag.com
pixel.mathtag.com
4 KB
4 hotjar.com
static.hotjar.com
script.hotjar.com
vars.hotjar.com
in.hotjar.com
63 KB
4 google-analytics.com
www.google-analytics.com
20 KB
4 twitter.com
platform.twitter.com
syndication.twitter.com
analytics.twitter.com
133 KB
4 facebook.net
connect.facebook.net
246 KB
4 linkedin.com
platform.linkedin.com
px.ads.linkedin.com
www.linkedin.com
64 KB
3 company-target.com
segments.company-target.com
api.company-target.com
2 KB
3 adnxs.com
secure.adnxs.com
3 KB
3 airpr.com
px.airpr.com
dpx.airpr.com
3 KB
3 bing.com
bat.bing.com
10 KB
3 hubspot.com
app.hubspot.com
track.hubspot.com
forms.hubspot.com
2 KB
3 googleapis.com
fonts.googleapis.com
4 KB
2 crwdcntrl.net
bcp.crwdcntrl.net
1 KB
2 tapad.com
pixel.tapad.com
898 B
2 demdex.net
dpm.demdex.net
2 KB
2 bidr.io
match.prod.bidr.io
1019 B
2 facebook.com
www.facebook.com
404 B
2 cloudfunctions.net
us-central1-adaptive-growth.cloudfunctions.net
2 techtarget.com
trk.techtarget.com
apt.techtarget.com
2 KB
2 googleadservices.com
www.googleadservices.com
16 KB
2 googletagmanager.com
www.googletagmanager.com
135 KB
2 cloudflare.com
cdnjs.cloudflare.com
11 KB
1 teads.tv
sync.teads.tv
172 B
1 exelator.com
loadm.exelator.com
324 B
1 rlcdn.com
id.rlcdn.com
66 B
1 reddit.com
alb.reddit.com
125 B
1 t.co
t.co
455 B
1 ml-api.io
attr.ml-api.io
242 B
1 ml-attr.com
s.ml-attr.com
279 B
1 demandbase.com
tag.demandbase.com
19 KB
1 lltrck.com
lltrck.com
1 wistia.com
fast.wistia.com
118 KB
1 pixel.ad
up.pixel.ad
1 KB
1 pdst.fm
cdn.pdst.fm
6 KB
1 hs-scripts.com
js.hs-scripts.com
890 B
1 zoominfo.com
ws.zoominfo.com
689 B
1 redditstatic.com
www.redditstatic.com
7 KB
1 ads-twitter.com
static.ads-twitter.com
6 KB
1 licdn.com
snap.licdn.com
2 KB
1 hs-analytics.net
js.hs-analytics.net
20 KB
1 hs-banner.com
js.hs-banner.com
16 KB
1 hsleadflows.net
js.hsleadflows.net
87 KB
1 hubspot.net
cdn2.hubspot.net
2 KB
0 driftt.com Failed
js.driftt.com Failed
153 50
Domain Requested by
44 www.cybereason.com www.cybereason.com
10 fonts.gstatic.com fonts.googleapis.com
9 use.typekit.net www.cybereason.com
5 www.google.com
4 pixel.sitescout.com 2 redirects www.cybereason.com
4 pixel.mathtag.com www.googletagmanager.com
pixel.mathtag.com
4 www.google-analytics.com www.cybereason.com
www.google-analytics.com
4 connect.facebook.net www.cybereason.com
connect.facebook.net
3 googleads.g.doubleclick.net 1 redirects www.googleadservices.com
3 secure.adnxs.com 3 redirects
3 10428681.fls.doubleclick.net 1 redirects www.googletagmanager.com
3 10272547.fls.doubleclick.net 1 redirects www.googletagmanager.com
3 bat.bing.com www.googletagmanager.com
bat.bing.com
3 fonts.googleapis.com www.cybereason.com
2 bcp.crwdcntrl.net 1 redirects
2 pixel.tapad.com 1 redirects
2 dpm.demdex.net 1 redirects
2 adservice.google.com 10428681.fls.doubleclick.net
10272547.fls.doubleclick.net
2 segments.company-target.com 1 redirects
2 match.prod.bidr.io 2 redirects
2 dpx.airpr.com 1 redirects
2 www.facebook.com
2 us-central1-adaptive-growth.cloudfunctions.net cdn.pdst.fm
2 px.ads.linkedin.com 1 redirects
2 www.googleadservices.com www.googletagmanager.com
www.googleadservices.com
2 stats.g.doubleclick.net www.google-analytics.com
www.googletagmanager.com
2 www.googletagmanager.com www.cybereason.com
www.googletagmanager.com
2 platform.twitter.com www.cybereason.com
platform.twitter.com
2 cdnjs.cloudflare.com www.cybereason.com
1 sync.teads.tv
1 loadm.exelator.com
1 in.hotjar.com script.hotjar.com
1 api.company-target.com tag.demandbase.com
1 id.rlcdn.com
1 apt.techtarget.com
1 vars.hotjar.com static.hotjar.com
1 analytics.google.com www.googletagmanager.com
1 alb.reddit.com
1 script.hotjar.com static.hotjar.com
1 t.co
1 analytics.twitter.com static.ads-twitter.com
1 www.linkedin.com 1 redirects
1 attr.ml-api.io
1 s.ml-attr.com 1 redirects
1 px.airpr.com www.cybereason.com
1 tag.demandbase.com www.cybereason.com
1 lltrck.com www.cybereason.com
1 fast.wistia.com www.googletagmanager.com
1 up.pixel.ad www.googletagmanager.com
1 cdn.pdst.fm www.cybereason.com
1 trk.techtarget.com www.cybereason.com
1 js.hs-scripts.com www.googletagmanager.com
1 ws.zoominfo.com www.cybereason.com
1 www.redditstatic.com www.googletagmanager.com
1 static.hotjar.com www.googletagmanager.com
1 static.ads-twitter.com www.googletagmanager.com
1 snap.licdn.com www.googletagmanager.com
1 forms.hubspot.com js.hsleadflows.net
1 track.hubspot.com
1 syndication.twitter.com platform.twitter.com
1 p.typekit.net www.cybereason.com
1 js.hs-analytics.net www.cybereason.com
1 js.hs-banner.com www.cybereason.com
1 js.hsleadflows.net www.cybereason.com
1 app.hubspot.com www.cybereason.com
1 cdn2.hubspot.net www.cybereason.com
1 platform.linkedin.com www.cybereason.com
0 js.driftt.com Failed www.cybereason.com
153 68
Subject Issuer Validity Valid
www.cybereason.com
Cloudflare Inc ECC CA-3		 2021-07-16 -
2022-07-15		 a year crt.sh
use.typekit.net
DigiCert TLS RSA SHA256 2020 CA1		 2021-08-16 -
2022-08-16		 a year crt.sh
platform.linkedin.com
DigiCert SHA2 Secure Server CA		 2021-09-10 -
2022-09-10		 a year crt.sh
hubspot.net
Cloudflare Inc ECC CA-3		 2021-06-04 -
2022-06-03		 a year crt.sh
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3		 2021-09-21 -
2022-09-20		 a year crt.sh
upload.video.google.com
GTS CA 1C3		 2021-09-13 -
2021-11-20		 2 months crt.sh
*.gstatic.com
GTS CA 1C3		 2021-09-13 -
2021-11-20		 2 months crt.sh
*.facebook.com
DigiCert SHA2 High Assurance Server CA		 2021-09-09 -
2021-12-08		 3 months crt.sh
*.twimg.com
DigiCert TLS RSA SHA256 2020 CA1		 2020-11-05 -
2021-11-09		 a year crt.sh
hubspot.com
Cloudflare Inc ECC CA-3		 2021-06-26 -
2022-06-25		 a year crt.sh
*.typekit.net
DigiCert TLS RSA SHA256 2020 CA1		 2021-07-16 -
2022-07-21		 a year crt.sh
syndication.twitter.com
DigiCert TLS RSA SHA256 2020 CA1		 2021-02-05 -
2022-02-04		 a year crt.sh
*.google-analytics.com
GTS CA 1C3		 2021-09-13 -
2021-11-20		 2 months crt.sh
*.g.doubleclick.net
GTS CA 1C3		 2021-09-13 -
2021-11-20		 2 months crt.sh
www.googleadservices.com
GTS CA 1C3		 2021-09-13 -
2021-11-20		 2 months crt.sh
*.licdn.com
DigiCert SHA2 Secure Server CA		 2021-07-15 -
2022-07-20		 a year crt.sh
ads-twitter.com
DigiCert TLS RSA SHA256 2020 CA1		 2021-07-21 -
2022-07-26		 a year crt.sh
www.bing.com
Microsoft RSA TLS CA 02		 2021-09-30 -
2022-03-30		 6 months crt.sh
*.doubleclick.net
GTS CA 1C3		 2021-09-13 -
2021-11-20		 2 months crt.sh
*.hotjar.com
Amazon		 2020-12-25 -
2022-01-23		 a year crt.sh
www.redditstatic.com
DigiCert TLS RSA SHA256 2020 CA1		 2021-10-05 -
2022-04-02		 6 months crt.sh
zoominfo.com
Cloudflare Inc ECC CA-3		 2021-06-04 -
2022-06-03		 a year crt.sh
cdn.pdst.fm
GTS CA 1D4		 2021-08-28 -
2021-11-26		 3 months crt.sh
*.pixel.ad
RapidSSL RSA CA 2018		 2020-01-15 -
2022-02-02		 2 years crt.sh
pixel.mathtag.com
DigiCert SHA2 Secure Server CA		 2021-06-29 -
2022-07-07		 a year crt.sh
fast.wistia.com
GlobalSign Atlas R3 DV TLS CA 2020		 2021-03-22 -
2022-04-23		 a year crt.sh
lltrck.com
Go Daddy Secure Certificate Authority - G2		 2021-07-25 -
2022-08-26		 a year crt.sh
tag.demandbase.com
Go Daddy Secure Certificate Authority - G2		 2020-10-14 -
2021-11-15		 a year crt.sh
*.airpr.com
Amazon		 2021-01-10 -
2022-02-07		 a year crt.sh
*.ml-api.io
Amazon		 2021-01-20 -
2022-02-17		 a year crt.sh
www.google.com
GTS CA 1C3		 2021-09-13 -
2021-11-20		 2 months crt.sh
px.ads.linkedin.com
DigiCert SHA2 Secure Server CA		 2021-09-16 -
2022-03-16		 6 months crt.sh
*.googleadservices.com
GTS CA 1C3		 2021-09-13 -
2021-11-20		 2 months crt.sh
*.twitter.com
DigiCert TLS RSA SHA256 2020 CA1		 2021-02-05 -
2022-02-04		 a year crt.sh
t.co
DigiCert TLS RSA SHA256 2020 CA1		 2021-02-05 -
2022-02-04		 a year crt.sh
*.reddit.com
DigiCert TLS RSA SHA256 2020 CA1		 2021-10-05 -
2022-04-02		 6 months crt.sh
*.google.com
GTS CA 1C3		 2021-09-13 -
2021-11-20		 2 months crt.sh
misc.google.com
GTS CA 1C3		 2021-09-13 -
2021-11-20		 2 months crt.sh
*.sitescout.com
RapidSSL RSA CA 2018		 2020-01-15 -
2022-02-02		 2 years crt.sh
*.techtarget.com
Sectigo RSA Domain Validation Secure Server CA		 2019-10-25 -
2021-10-24		 2 years crt.sh
*.company-target.com
Amazon		 2021-08-31 -
2022-09-29		 a year crt.sh
*.rlcdn.com
Sectigo RSA Domain Validation Secure Server CA		 2021-02-25 -
2022-03-28		 a year crt.sh
api.demandbase.com
Go Daddy Secure Certificate Authority - G2		 2020-10-09 -
2021-10-28		 a year crt.sh
*.demdex.net
DigiCert TLS RSA SHA256 2020 CA1		 2020-12-02 -
2022-01-02		 a year crt.sh
*.tapad.com
DigiCert SHA2 Secure Server CA		 2020-10-05 -
2021-11-06		 a year crt.sh
*.exelator.com
DigiCert TLS RSA SHA256 2020 CA1		 2021-06-02 -
2022-06-07		 a year crt.sh
teads.tv
R3		 2021-08-23 -
2021-11-21		 3 months crt.sh
*.crwdcntrl.net
Go Daddy Secure Certificate Authority - G2		 2021-04-29 -
2022-05-31		 a year crt.sh

This page contains 8 frames:

Primary Page: https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms
Frame ID: 9E7995F1898A5633561682117C1648F5
Requests: 137 HTTP requests in this frame

Frame: https://platform.twitter.com/widgets/widget_iframe.58065ae230495f5d9e4b6a916472b2c1.html?origin=https%3A%2F%2Fwww.cybereason.com
Frame ID: 7DC83897E1BFDB15144C85EFC211460D
Requests: 2 HTTP requests in this frame

Frame: https://10272547.fls.doubleclick.net/activityi;dc_pre=CN_Q3JqHuPMCFbv41Qodxw8A3w;src=10272547;type=landing;cat=allsite;ord=4843845596050;gtm=2wga40;auiddc=1174171278.1633601336;ps=1;~oref=https%3A%2F%2Fwww.cybereason.com%2Fblog%2Foperation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms
Frame ID: 4AB0F2B30AA808DBFA74C3BCD9F43E48
Requests: 2 HTTP requests in this frame

Frame: https://10428681.fls.doubleclick.net/activityi;dc_pre=CN3x25qHuPMCFTK6UQodXsYJSg;src=10428681;type=cyber0;cat=cyber0;ord=8083476358231;gtm=2wga40;auiddc=1174171278.1633601336;ps=1;~oref=https%3A%2F%2Fwww.cybereason.com%2Fblog%2Foperation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms
Frame ID: F8BB1A6FCB9392AFA20651A5CC0AA2BE
Requests: 1 HTTP requests in this frame

Frame: https://pixel.sitescout.com/dmp/asyncPixelSync?cookieQ=1
Frame ID: 759C24D3CF6186384F9206F251476133
Requests: 6 HTTP requests in this frame

Frame: https://vars.hotjar.com/box-dfc01efbdc94bb0936d9a35a502b0b64.html
Frame ID: 1FD63309C73FBC4C1370D16F67297D10
Requests: 1 HTTP requests in this frame

Frame: https://pixel.mathtag.com/sync/iframe?mt_uuid=1003615e-c738-4900-92d1-d4af52ab233a&no_iframe=1&mt_adid=241675&source=mathtag
Frame ID: 71E681484C7F60A4D061ABF2C7C27ABB
Requests: 2 HTTP requests in this frame

Frame: https://adservice.google.com/ddm/fls/i/dc_pre=CN3x25qHuPMCFTK6UQodXsYJSg;src=10428681;type=cyber0;cat=cyber0;ord=8083476358231;gtm=2wga40;auiddc=1174171278.1633601336;ps=1;~oref=https%3A%2F%2Fwww.cybereason.com%2Fblog%2Foperation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms
Frame ID: DAFF02A46E699D70D35A0142B86D0F9B
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Operation GhostShell: Novel RAT Targets Global Aerospace and Telecoms Firms

Detected technologies

Overall confidence: 100%
Detected patterns
  • <link[^>]+?href="[^"]+bulma(?:\.min)?\.css
Overall confidence: 100%
Detected patterns
  • <link rel="amphtml"
Overall confidence: 100%
Detected patterns
  • //connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js
Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]+(?:([\d.]+)/)?(?:css/)?font-awesome(?:\.min)?\.css
  • <link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
  • (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
Overall confidence: 100%
Detected patterns
  • google-analytics\.com/(?:ga|urchin|analytics)\.js
Overall confidence: 100%
Detected patterns
  • googletagmanager\.com/ns\.html[^>]+></iframe>
  • googletagmanager\.com/gtm\.js
  • googletagmanager\.com/gtag/js
Overall confidence: 100%
Detected patterns
  • //static\.hotjar\.com/
Overall confidence: 100%
Detected patterns
  • js\.hs-analytics\.net/analytics
Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]+ionicons(?:\.min)?\.css
Overall confidence: 100%
Detected patterns
  • //platform\.linkedin\.com/in\.js
Overall confidence: 100%
Detected patterns
  • snap\.licdn\.com/li\.lms-analytics/insight\.min\.js
Overall confidence: 100%
Detected patterns
  • //platform\.twitter\.com/widgets\.js
Overall confidence: 100%
Detected patterns
  • jquery[.-]([\d.]*\d)[^/]*\.js
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

153
Requests

99 %
HTTPS

0 %
IPv6

50
Domains

68
Subdomains

61
IPs

6
Countries

2969 kB
Transfer

6394 kB
Size

54
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 89
  • https://10272547.fls.doubleclick.net/activityi;src=10272547;type=landing;cat=allsite;ord=4843845596050;gtm=2wga40;auiddc=1174171278.1633601336;ps=1;~oref=https%3A%2F%2Fwww.cybereason.com%2Fblog%2Foperation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms HTTP 302
  • https://10272547.fls.doubleclick.net/activityi;dc_pre=CN_Q3JqHuPMCFbv41Qodxw8A3w;src=10272547;type=landing;cat=allsite;ord=4843845596050;gtm=2wga40;auiddc=1174171278.1633601336;ps=1;~oref=https%3A%2F%2Fwww.cybereason.com%2Fblog%2Foperation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms
Request Chain 92
  • https://10428681.fls.doubleclick.net/activityi;src=10428681;type=cyber0;cat=cyber0;ord=8083476358231;gtm=2wga40;auiddc=1174171278.1633601336;ps=1;~oref=https%3A%2F%2Fwww.cybereason.com%2Fblog%2Foperation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms HTTP 302
  • https://10428681.fls.doubleclick.net/activityi;dc_pre=CN3x25qHuPMCFTK6UQodXsYJSg;src=10428681;type=cyber0;cat=cyber0;ord=8083476358231;gtm=2wga40;auiddc=1174171278.1633601336;ps=1;~oref=https%3A%2F%2Fwww.cybereason.com%2Fblog%2Foperation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms
Request Chain 107
  • https://s.ml-attr.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dcybereason.com%26pId%3d%24UID HTTP 302
  • https://secure.adnxs.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dcybereason.com%26pId%3d%24UID HTTP 302
  • https://attr.ml-api.io/?domain=cybereason.com&pId=2730198256998004406
Request Chain 109
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=72596&time=1633601336018&url=https%3A%2F%2Fwww.cybereason.com%2Fblog%2Foperation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms HTTP 302
  • https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D72596%26time%3D1633601336018%26url%3Dhttps%253A%252F%252Fwww.cybereason.com%252Fblog%252Foperation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms%26liSync%3Dtrue HTTP 302
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=72596&time=1633601336018&url=https%3A%2F%2Fwww.cybereason.com%2Fblog%2Foperation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms&liSync=true
Request Chain 123
  • https://googleads.g.doubleclick.net/pagead/viewthroughconversion/401574070/?random=1125264886&cv=9&fst=1633601336024&num=1&value=0&label=6wPaCOv09oACELaRvr8B&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2wga40&sendb=1&ig=1&frm=0&url=https%3A%2F%2Fwww.cybereason.com%2Fblog%2Foperation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms&tiba=Operation%20GhostShell%3A%20Novel%20RAT%20Targets%20Global%20Aerospace%20and%20Telecoms%20Firms&auid=1174171278.1633601336&capi=1&hn=www.googleadservices.com&async=1&fmt=3&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&ocp_id=OMdeYe2bA8mAgAflxojADA&sscte=1&crd=&eitems=ChEI8LX6igYQxuPD0YGw3PyKARIdAP8BwDdJlMy5-xiIG-tWwE7ZXqn3uYGCVYACxT0 HTTP 302
  • https://www.google.com/pagead/1p-conversion/401574070/?random=1125264886&cv=9&fst=1633601336024&num=1&value=0&label=6wPaCOv09oACELaRvr8B&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2wga40&sendb=1&ig=1&frm=0&url=https%3A%2F%2Fwww.cybereason.com%2Fblog%2Foperation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms&tiba=Operation%20GhostShell%3A%20Novel%20RAT%20Targets%20Global%20Aerospace%20and%20Telecoms%20Firms&auid=1174171278.1633601336&capi=1&hn=www.googleadservices.com&async=1&fmt=3&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&sscte=1&crd=&is_vtc=1&ocp_id=OMdeYe2bA8mAgAflxojADA&cid=CAQSKQCNIrLMYdeJlePONEzrTxXHBzMvyX9FvA0fpkn19bQUou4b56XvgzhM&eitems=ChEI8LX6igYQxuPD0YGw3PyKARIdAP8BwDese2nTdYzLoyplJW9XYXk0p8r4lxstdkU&random=1695931113&resp=GooglemKTybQhCsO
Request Chain 124
  • https://pixel.sitescout.com/dmp/asyncPixelSync HTTP 302
  • https://pixel.sitescout.com/dmp/asyncPixelSync?cookieQ=1
Request Chain 125
  • https://pixel.sitescout.com/up/6f002ab8596ff067?cntr_url=https%3A%2F%2Fwww.cybereason.com%2Fblog%2Foperation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms HTTP 302
  • https://pixel.sitescout.com/up/6f002ab8596ff067?cookieQ=1&cntr_url=https%3A%2F%2Fwww.cybereason.com%2Fblog%2Foperation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms
Request Chain 132
  • https://dpx.airpr.com/px?hostname=www.cybereason.com&profile=660386&ga_account_id=UA-56367941-1&ga_account_type=UA&ga_c=226520194.1633601336&an=true HTTP 302
  • https://secure.adnxs.com/getuid?https://dpx.airpr.com/anpx?adnxs_uid=$UID&airpr_id=4105438475 HTTP 307
  • https://secure.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fdpx.airpr.com%2Fanpx%3Fadnxs_uid%3D%24UID%26airpr_id%3D4105438475 HTTP 302
  • https://dpx.airpr.com/anpx?adnxs_uid=2730198256998004406&airpr_id=4105438475
Request Chain 133
  • https://match.prod.bidr.io/cookie-sync/demandbase HTTP 303
  • https://match.prod.bidr.io/cookie-sync/demandbase?_bee_ppp=1 HTTP 303
  • https://segments.company-target.com/log?vendor=choca&user_id=AACzu07CvY4AABfPAS93Vw HTTP 303
  • https://segments.company-target.com/validateCookie?vendor=choca&user_id=AACzu07CvY4AABfPAS93Vw&verifyHash=f2f6e04a486a3a329166744c11a40859131be2fe
Request Chain 145
  • https://dpm.demdex.net/ibs:dpid=82530&dpuuid=fb604dec-420d-434b-ada8-58fdbb58abf5-615ec738-5553&gdpr=0&gdpr_consent= HTTP 302
  • https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=82530&dpuuid=fb604dec-420d-434b-ada8-58fdbb58abf5-615ec738-5553&gdpr=0&gdpr_consent=
Request Chain 146
  • https://pixel.tapad.com/idsync/ex/receive?partner_id=2499&partner_device_id=fb604dec-420d-434b-ada8-58fdbb58abf5-615ec738-5553 HTTP 302
  • https://pixel.tapad.com/idsync/ex/receive/check?partner_id=2499&partner_device_id=fb604dec-420d-434b-ada8-58fdbb58abf5-615ec738-5553
Request Chain 149
  • https://bcp.crwdcntrl.net/map/c=1389/tp=STSC/tpid=fb604dec-420d-434b-ada8-58fdbb58abf5-615ec738-5553 HTTP 302
  • https://bcp.crwdcntrl.net/map/ct=y/c=1389/tp=STSC/tpid=fb604dec-420d-434b-ada8-58fdbb58abf5-615ec738-5553

153 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms
www.cybereason.com/blog/ 		134 KB
29 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
199.60.103.30 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare / HubSpot
Resource Hash
2ade3aa1d89865ba159dcd2d025c1e4e380101d6e192ae0f0d88b22bf3569f5e
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security max-age=31536000

Request headers

:method
GET
:authority
www.cybereason.com
:scheme
https
:path
/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language
de-DE,de;q=0.9
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
none
sec-fetch-mode
navigate
sec-fetch-user
?1
sec-fetch-dest
document
accept-encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language
de-DE,de;q=0.9

Response headers

date
Thu, 07 Oct 2021 10:08:55 GMT
content-type
text/html; charset=UTF-8
cache-control
s-maxage=10800, max-age=0
etag
W/"9c7899278fda00f0853832ac298b7d83"
last-modified
Wed, 06 Oct 2021 23:10:42 GMT
link
</hs/hsstatic/HubspotToolsMenu/static-1.109/js/index.js>; rel=preload; as=script,</hs/hsstatic/cos-i18n/static-1.37/bundles/project.js>; rel=preload; as=script
strict-transport-security
max-age=31536000
cache-tag
CT-56540216169,CG-5272851739,P-3354902,L-42870461961,CW-34473990280,CW-41681847227,CW-41682410610,CW-42867014566,CW-43300360745,CW-44252461159,CW-48386556055,E-34470223313,E-34470224480,E-34470477360,E-35275979682,E-35291999472,E-42363645447,E-42507089303,E-42507091846,E-42760289143,PGS-ALL,SW-0,GC-36042052587
content-security-policy
upgrade-insecure-requests
edge-cache-tag
CT-56540216169,CG-5272851739,P-3354902,L-42870461961,CW-34473990280,CW-41681847227,CW-41682410610,CW-42867014566,CW-43300360745,CW-44252461159,CW-48386556055,E-34470223313,E-34470224480,E-34470477360,E-35275979682,E-35291999472,E-42363645447,E-42507089303,E-42507091846,E-42760289143,PGS-ALL,SW-0,GC-36042052587
referrer-policy
no-referrer-when-downgrade
x-hs-cache-config
BrowserCache-5s-EdgeCache-180s
x-hs-cf-cache-status
HIT
x-hs-combine-css
Disabled
x-hs-content-campaign-id
9d0f7a4c-be0b-46ea-b708-005916cbdaae
x-hs-content-id
56540216169
x-hs-hub-id
3354902
x-hs-prerendered
Wed, 06 Oct 2021 23:10:42 GMT
x-powered-by
HubSpot
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=eV03B6WDKT0ioh8t%2FM%2BR2yu3M%2BJINmBByWwJ8TgJo9v5pLiY8g3C399JgM5S9ryASfvtzKRRHZrdnjfeDwGnkGI51OWeL5pJkU0Hr2L%2FnYXRxFwmQT28gRw0aW53NzpOH9vHEA%3D%3D"}],"group":"cf-nel","max_age":604800}
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary
Accept-Encoding
set-cookie
__cfruid=d7e721c13da4dff96ea791e26c85151287fa3558-1633601335; path=/; domain=.www.cybereason.com; HttpOnly; Secure; SameSite=None
server
cloudflare
cf-ray
69a654b96bd53233-FRA
content-encoding
br
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
cf-h2-pushed
</hs/hsstatic/HubspotToolsMenu/static-1.109/js/index.js>,</hs/hsstatic/cos-i18n/static-1.37/bundles/project.js>
index.js
www.cybereason.com/hs/hsstatic/HubspotToolsMenu/static-1.109/js/ 		52 KB
20 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.cybereason.com/hs/hsstatic/HubspotToolsMenu/static-1.109/js/index.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
199.60.103.30 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
43ac0ae9e90f01a0afabe35cc0aaa377336aac90759e74770251de89db0af44c
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Thu, 07 Oct 2021 10:08:55 GMT
via
1.1 9ab847fabb8c9edbd39cff57c2a2f4c0.cloudfront.net (CloudFront)
vary
Accept-Encoding
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
5064306
x-amz-server-side-encryption
AES256
cf-ray
69a654b9ac1d3233-FRA
x-cache
Miss from cloudfront
x-amz-replication-status
COMPLETED
x-amz-cf-pop
FRA50-C1
content-encoding
br
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
last-modified
Fri, 06 Aug 2021 19:39:07 GMT
server
cloudflare
etag
W/"d0801ffff23e81a99fd8046c0846ba93"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=31536000; includeSubDomains; preload
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=l8Rp2N3jej1CNbyck49L7Rjmhm%2Fxf7GJHHpRT9DpO1kSbLTG3p%2Fa0zW7ANLKfTwx46i3F21pksoR7jiBzeFg%2FJ9o3O6Orlftzs%2BVAcTRpv0UT6J7o8tS2GbLkEurKj%2FxWv4IQg%3D%3D"}],"group":"cf-nel","max_age":604800}
x-amz-version-id
WCB.Owk3aP2vvRplDI.5pUwB8LkSH.e_
cache-control
public, max-age=31536000
set-cookie
__cfruid=d7e721c13da4dff96ea791e26c85151287fa3558-1633601335; path=/; domain=.www.cybereason.com; HttpOnly; Secure; SameSite=None
content-type
application/javascript
x-amz-cf-id
pSsLw65tntFDEdA1Wfzw2gZ1r1sYewn82AJ23gwJ4tbHPJEd6QN2gQ==
expires
Fri, 07 Oct 2022 10:08:55 GMT
project.js
www.cybereason.com/hs/hsstatic/cos-i18n/static-1.37/bundles/ 		1 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.cybereason.com/hs/hsstatic/cos-i18n/static-1.37/bundles/project.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
199.60.103.30 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
69aea70ed00c6297e407afc0b1ccf6db9629eedc412bf0779467f3e462d346e3
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Thu, 07 Oct 2021 10:08:55 GMT
via
1.1 e1e056e45a0f8d6bc22b223900511170.cloudfront.net (CloudFront)
vary
Accept-Encoding
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
9572573
x-amz-server-side-encryption
AES256
cf-ray
69a654b9ac1f3233-FRA
x-cache
Hit from cloudfront
x-amz-replication-status
COMPLETED
x-amz-cf-pop
FRA2-C2
content-encoding
br
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
last-modified
Mon, 14 Jun 2021 16:41:38 GMT
server
cloudflare
etag
W/"6c562b3f1d6a0148fda97d4847422c6f"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=31536000; includeSubDomains; preload
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=vjVmivmPD7NSM9XUvBWRQ7%2B8sNxVF3Kn78RJ2EVsOpqlJq2J5WOwo%2Fwv0hXQFHeHfvUSB8f7mBNRR05SPuc0%2BrZ4DFO3DGKKxw%2BMnTS20DQgyEFLiaqCI0HA2XG3rc%2BsjrHJWA%3D%3D"}],"group":"cf-nel","max_age":604800}
x-amz-version-id
M9oUePGbwt7hrJpARSIQzQLaIi7kmGEy
cache-control
public, max-age=31536000
set-cookie
__cfruid=d7e721c13da4dff96ea791e26c85151287fa3558-1633601335; path=/; domain=.www.cybereason.com; HttpOnly; Secure; SameSite=None
content-type
application/javascript
x-amz-cf-id
DUXbRLuhPxzxlhKqx2KMF2WMfvTtTR6IQDORvdAyUi-gNVGhIKhf-Q==
expires
Fri, 07 Oct 2022 10:08:55 GMT
jquery-1.11.2.js
www.cybereason.com/hs/hsstatic/jquery-libs/static-1.4/jquery/ 		94 KB
36 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.cybereason.com/hs/hsstatic/jquery-libs/static-1.4/jquery/jquery-1.11.2.js
Requested by
Host: www.cybereason.com
URL: https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
199.60.103.30 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
2ecd295d295bec062cedebe177e54b9d6b19fc0a841dc5c178c654c9ccff09c0
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

:path
/hs/hsstatic/jquery-libs/static-1.4/jquery/jquery-1.11.2.js
pragma
no-cache
cookie
__cfruid=d7e721c13da4dff96ea791e26c85151287fa3558-1633601335
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
script
:authority
www.cybereason.com
referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Thu, 07 Oct 2021 10:08:55 GMT
via
1.1 355e7d579c41c1dcc2113e41403be663.cloudfront.net (CloudFront)
vary
Accept-Encoding
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
3832529
cf-ray
69a654b9de4b2c2a-FRA
x-cache
Hit from cloudfront
content-encoding
br
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
last-modified
Thu, 08 Jan 2015 18:08:00 GMT
server
cloudflare
etag
W/"5790ead7ad3ba27397aedfa3d263b867"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=31536000; includeSubDomains; preload
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=evR9HPeFppDd2SrWLOpesDt8OYwfku2ffHhPXbHt8iv67mefG07Igc9lNNnBbdQ0teFTsgeQRgkvC87dACrHj9M8FfN4gtbc22PymGYM7s0XRdZPmjk4FZ0S99%2Fei0OzV44ljg%3D%3D"}],"group":"cf-nel","max_age":604800}
x-amz-version-id
null
cache-control
public, max-age=31536000
x-amz-cf-pop
FRA56-C2
content-type
application/javascript
x-amz-cf-id
qQSCbF1GTkm4UX9jvZEdkLnuHq_b3XC4AH51fb0t-odVZOZshEnuLw==
expires
Fri, 07 Oct 2022 10:08:55 GMT
module_41681847227_CR_-_Malicious_Life_Network_--_Tier_One_Header.min.css
www.cybereason.com/hs-fs/hub/3354902/hub_generated/module_assets/41681847227/1619109182781/ 		3 KB
2 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.cybereason.com/hs-fs/hub/3354902/hub_generated/module_assets/41681847227/1619109182781/module_41681847227_CR_-_Malicious_Life_Network_--_Tier_One_Header.min.css
Requested by
Host: www.cybereason.com
URL: https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
199.60.103.30 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
835866cae4df18da17dc4e3f4d6ae62967b3e344cc0bfe029fe529ed94ae7dff

Request headers

:path
/hs-fs/hub/3354902/hub_generated/module_assets/41681847227/1619109182781/module_41681847227_CR_-_Malicious_Life_Network_--_Tier_One_Header.min.css
pragma
no-cache
cookie
__cfruid=d7e721c13da4dff96ea791e26c85151287fa3558-1633601335
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
text/css,*/*;q=0.1
cache-control
no-cache
sec-fetch-dest
style
:authority
www.cybereason.com
referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

x-amz-meta-created-unix-time-millis
1619109182781
date
Thu, 07 Oct 2021 10:08:55 GMT
via
1.1 5eb5e19c1a78889d10ff38f1551ed2aa.cloudfront.net (CloudFront)
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
2273
x-hs-alternate-content-type
text/plain
x-amz-server-side-encryption
AES256
x-cache
RefreshHit from cloudfront
x-edge-origin-shield-skipped
0
x-amz-replication-status
COMPLETED
x-hs-cf-lambda
us-east-1.enforceAclForReadsProd 12
content-encoding
br
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
x-amz-request-id
KEZH7TPKPRG5Y6CS
x-amz-id-2
UUAo77WwzMnQPxIfLDj8JWy6Tdu3/TLMHyo8qoZUbq3F3yDC3Ltj3rc8dT0RVaPqB6kkvi0S0yA=
last-modified
Thu, 22 Apr 2021 16:33:03 GMT
server
cloudflare
etag
W/"f58fd8f67a47c0e890657f936f29799b"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=3HLYaFZAeQt3PAq6drwWCFSPrqS9UsDzkaByRV2uk%2BZsauNXK32ljr3NKr9rBHuPxNVxkehMa9r5i8PrgwwucTcKV0syuCERMpE7eOYeMuG4hnW%2F1lx19OBuv6k%2FKG10EURaeA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
cache-control
s-maxage=1814400, max-age=1209600, stale-while-revalidate=900, s-maxage=31536000, max-age=31536000
access-control-allow-credentials
false
x-amz-version-id
OrCGPw.DheqgcreVeofegnxXE_xFGg.y
x-amz-cf-pop
IAD89-C1
cf-ray
69a654b9de4e2c2a-FRA
x-amz-cf-id
phVjjJ4SO3_XpiAaYqRdnUgZ_Wz-etVF8_4dxJq1Gy_gEJ9dHkD4IA==
x-hs-cf-lambda-enforce
us-east-1.enforceAclForReadsProd 12
module_41682410610_CR_-_Malicious_Life_Network_--_Main_Hero.min.css
www.cybereason.com/hs-fs/hub/3354902/hub_generated/module_assets/41682410610/1618194603032/ 		6 KB
3 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.cybereason.com/hs-fs/hub/3354902/hub_generated/module_assets/41682410610/1618194603032/module_41682410610_CR_-_Malicious_Life_Network_--_Main_Hero.min.css
Requested by
Host: www.cybereason.com
URL: https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
199.60.103.30 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
f903f416e22249cfab4769b65c97a216746ff7d579fc7fa983740943240a9362

Request headers

:path
/hs-fs/hub/3354902/hub_generated/module_assets/41682410610/1618194603032/module_41682410610_CR_-_Malicious_Life_Network_--_Main_Hero.min.css
pragma
no-cache
cookie
__cfruid=d7e721c13da4dff96ea791e26c85151287fa3558-1633601335
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
text/css,*/*;q=0.1
cache-control
no-cache
sec-fetch-dest
style
:authority
www.cybereason.com
referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

x-amz-meta-created-unix-time-millis
1618194603032
date
Thu, 07 Oct 2021 10:08:55 GMT
via
1.1 417c242b19212928b079740e6dd8f54c.cloudfront.net (CloudFront)
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
2273
x-hs-alternate-content-type
text/plain
x-amz-server-side-encryption
AES256
x-cache
RefreshHit from cloudfront
x-edge-origin-shield-skipped
0
x-amz-replication-status
COMPLETED
x-hs-cf-lambda
us-east-1.enforceAclForReadsProd 12
content-encoding
br
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
x-amz-request-id
KEZQEEZMF64B3CNP
x-amz-id-2
Op9Nz0nf/jO2gsGGuQsWbbRtytMaVeKTaCaop0VomKak2EuP7bSnBUOVB19Ex4IHuBqRh5zM6MI=
last-modified
Mon, 12 Apr 2021 02:30:04 GMT
server
cloudflare
etag
W/"594d3cef98509b9461f429bf5b0e356d"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=B02QoJU0s6zjAK5B8uOS8Rpd6pJEvlSxBVxkHH%2BwCQM4JhEOHG3sokOq1yL57jAaoGOgL1eG4S3vLgSedUJfAry3DFFsi1w2iWpWinu7rQxuJ0DGzGlySOH17MJQ6Kj5MN%2BiTg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
cache-control
s-maxage=1814400, max-age=1209600, stale-while-revalidate=900, s-maxage=31536000, max-age=31536000
access-control-allow-credentials
false
x-amz-version-id
cKpLd9F2Ix7k.Jqar0.eA5KbwB2erQU.
x-amz-cf-pop
IAD89-C1
cf-ray
69a654b9de4f2c2a-FRA
x-amz-cf-id
28Qn-POPOPvf-EmBsXXxH_BveUm_HKpGmordLV9gJZngmRMiTSHkDg==
x-hs-cf-lambda-enforce
us-east-1.enforceAclForReadsProd 12
module_48386556055_CR_-_HTML_PopUp_Window_--_IOCs.css
www.cybereason.com/hs-fs/hub/3354902/hub_generated/module_assets/1622817551130/ 		3 KB
2 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.cybereason.com/hs-fs/hub/3354902/hub_generated/module_assets/1622817551130/module_48386556055_CR_-_HTML_PopUp_Window_--_IOCs.css
Requested by
Host: www.cybereason.com
URL: https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
199.60.103.30 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
53f18426c8904b99d089e01c894d6cc5f2bbcb5416eab34cb134978d6e70cca5

Request headers

:path
/hs-fs/hub/3354902/hub_generated/module_assets/1622817551130/module_48386556055_CR_-_HTML_PopUp_Window_--_IOCs.css
pragma
no-cache
cookie
__cfruid=d7e721c13da4dff96ea791e26c85151287fa3558-1633601335
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
text/css,*/*;q=0.1
cache-control
no-cache
sec-fetch-dest
style
:authority
www.cybereason.com
referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

x-amz-meta-created-unix-time-millis
1622817551130
date
Thu, 07 Oct 2021 10:08:55 GMT
via
1.1 041a4887d523cabe8177e269cc358163.cloudfront.net (CloudFront)
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
1929
x-hs-alternate-content-type
text/plain
x-amz-server-side-encryption
AES256
x-cache
RefreshHit from cloudfront
x-edge-origin-shield-skipped
0
x-amz-replication-status
COMPLETED
x-hs-cf-lambda
us-east-1.enforceAclForReadsProd 12
content-encoding
br
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
x-amz-request-id
EMY204DKP2KC22ES
x-amz-id-2
r+wlbJyQi2J6iYTyFGJ5xhoI7bKSETDkPcLOpHaMD6m9d5/4ujTu3Qd1tLRxPKl2W8gj3nuYvy8=
last-modified
Fri, 04 Jun 2021 14:39:12 GMT
server
cloudflare
etag
W/"5a717c2929bb1377ac7a62cf72240a63"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=l70w2gazH5XLEiYHrgy3EL6xc12g%2BMqAv6kMfhCN0Rst7NH801r36BXCa0k47Lkfkh942BQGMTgjJsfbSpKVHKqOeqVTWM6FxVBg%2BqBJsqhZSX9fnkgfDJGhZv7HdpHDN3%2FTXg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
cache-control
s-maxage=1814400, max-age=1209600, stale-while-revalidate=900, s-maxage=31536000, max-age=31536000
access-control-allow-credentials
false
x-amz-version-id
POb_wh14yuPWmS90kW6Ma3KUAATvNjwi
x-amz-cf-pop
IAD89-C1
cf-ray
69a654b9de502c2a-FRA
x-amz-cf-id
MlCWcRpNkQizTWEwI3ub5e07FYEpicbZKUVxFeQfG7PCzN4TxxNk1A==
x-hs-cf-lambda-enforce
us-east-1.enforceAclForReadsProd 12
module_43300360745_CR_-_Malicious_Life_Network_--_Related_Posts.min.css
www.cybereason.com/hs-fs/hub/3354902/hub_generated/module_assets/43300360745/1617857458537/ 		105 B
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.cybereason.com/hs-fs/hub/3354902/hub_generated/module_assets/43300360745/1617857458537/module_43300360745_CR_-_Malicious_Life_Network_--_Related_Posts.min.css
Requested by
Host: www.cybereason.com
URL: https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
199.60.103.30 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
735e44959f60192ae3b93cfafd034f89a1cd8a95510fbac7aabaf9fa05d9465a

Request headers

:path
/hs-fs/hub/3354902/hub_generated/module_assets/43300360745/1617857458537/module_43300360745_CR_-_Malicious_Life_Network_--_Related_Posts.min.css
pragma
no-cache
cookie
__cfruid=d7e721c13da4dff96ea791e26c85151287fa3558-1633601335
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
text/css,*/*;q=0.1
cache-control
no-cache
sec-fetch-dest
style
:authority
www.cybereason.com
referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

x-amz-meta-created-unix-time-millis
1617857458537
date
Thu, 07 Oct 2021 10:08:55 GMT
via
1.1 55b6418a8a2f714a67d8e4d292154ef3.cloudfront.net (CloudFront)
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
1976
x-hs-alternate-content-type
text/plain
x-amz-server-side-encryption
AES256
x-cache
RefreshHit from cloudfront
x-edge-origin-shield-skipped
0
x-amz-replication-status
COMPLETED
x-hs-cf-lambda
us-east-1.enforceAclForReadsProd 12
content-encoding
br
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
x-amz-request-id
8579VJZ6AJCP0F0P
x-amz-id-2
TkhGxl+u0Veq8Hpr3Gcrz5bPEg4EnUqZC7oBw6XtrO29K/JN1RJzMNU1Vv9Kggumyq+z/Q+lrL0=
last-modified
Thu, 08 Apr 2021 04:50:59 GMT
server
cloudflare
etag
W/"b794f1cb3242ba801fcfb92cfc192f88"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=w3XlpkrlmtHnA7sR79NPBToCWfrpIutffH4bvYenXpGE33cz6IZKbCocVarigtSygBqn3c6CgXm5R22iCD5Cy7Kc7kWhxZs18bD9vbqnayxvQ2QsNFlXcpmEShEoWlBR92MVzQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
cache-control
s-maxage=1814400, max-age=1209600, stale-while-revalidate=900, s-maxage=31536000, max-age=31536000
access-control-allow-credentials
false
x-amz-version-id
MJQ97OPQTN2vmCTXTBA96VHUt3wDMqMb
x-amz-cf-pop
IAD89-C1
cf-ray
69a654b9de522c2a-FRA
x-amz-cf-id
C38io8TvjSHh0Vgaw-PmdKJApZHKEROi3QXSHhyOCortGQtuiQDjzw==
x-hs-cf-lambda-enforce
us-east-1.enforceAclForReadsProd 12
module_34473990280_CR_-_Footer_Full__en_US.min.css
www.cybereason.com/hs-fs/hub/3354902/hub_generated/module_assets/34473990280/1632494173098/ 		3 KB
2 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.cybereason.com/hs-fs/hub/3354902/hub_generated/module_assets/34473990280/1632494173098/module_34473990280_CR_-_Footer_Full__en_US.min.css
Requested by
Host: www.cybereason.com
URL: https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
199.60.103.30 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
97831ff4832c4f000e924a97b5730bebd91816c3282cc2502fca83feebd993a8

Request headers

:path
/hs-fs/hub/3354902/hub_generated/module_assets/34473990280/1632494173098/module_34473990280_CR_-_Footer_Full__en_US.min.css
pragma
no-cache
cookie
__cfruid=d7e721c13da4dff96ea791e26c85151287fa3558-1633601335
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
text/css,*/*;q=0.1
cache-control
no-cache
sec-fetch-dest
style
:authority
www.cybereason.com
referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

x-amz-meta-created-unix-time-millis
1632494173098
date
Thu, 07 Oct 2021 10:08:55 GMT
via
1.1 88b63cb2f8aab28c7291262ffc15282f.cloudfront.net (CloudFront)
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
1929
x-hs-alternate-content-type
text/plain
x-amz-server-side-encryption
AES256
x-cache
RefreshHit from cloudfront
x-edge-origin-shield-skipped
0
x-amz-replication-status
COMPLETED
x-hs-cf-lambda
us-east-1.enforceAclForReadsProd 12
content-encoding
br
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
x-amz-request-id
ES5VJDKC4NJC5X9Y
x-amz-id-2
bafGYq/lIrZAlvfkGwqTUivoA7PMB+mOjet5UgNEo9CbwdJ3JhewuJdUkn0kO92pWVvCRXhMiQk=
last-modified
Fri, 24 Sep 2021 14:36:14 GMT
server
cloudflare
etag
W/"62e33551763d4b79d6470cf52ea33112"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=4bpeZns38VwXsPd0sM0LywEJqqgJSIeeq%2BYhTu%2BxoHufEr%2B3qvAkAVeP3%2FwWb35HD0nr4SKb9T2mAhtbI%2B5ryqUeec84BWedYP6JSGNYeTc8Gr%2F%2BwPaqxvAPN7HCMrYiu4azqw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
cache-control
s-maxage=1814400, max-age=1209600, stale-while-revalidate=900, s-maxage=31536000, max-age=31536000
access-control-allow-credentials
false
x-amz-version-id
a7WhmcS1dHt_u7SlDB3hQxnXv9M9H_7R
x-amz-cf-pop
IAD89-C1
cf-ray
69a654b9de542c2a-FRA
x-amz-cf-id
boRbxJbJzGLZNQAUy5gJZlZtkLNxG-h2oTG1cRapfJxAiQMe-GtWOQ==
x-hs-cf-lambda-enforce
us-east-1.enforceAclForReadsProd 12
vyv2ljd.js
use.typekit.net/ 		19 KB
7 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://use.typekit.net/vyv2ljd.js
Requested by
Host: www.cybereason.com
URL: https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.16.186.59 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a2-16-186-59.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
3548fdd09c76e6d1a78dc0890d0da250339a5021ef499ac8b61f9d1bfae1a43b
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains;

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains;
content-encoding
gzip
server
nginx
date
Thu, 07 Oct 2021 10:08:55 GMT
vary
Accept-Encoding
content-type
text/javascript;charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=600, stale-while-revalidate=604800
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
content-length
7011
in.js
platform.linkedin.com/ 		201 KB
61 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://platform.linkedin.com/in.js
Requested by
Host: www.cybereason.com
URL: https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
152.199.22.144 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECAcc (frd/E2D7) /
Resource Hash
2a1dca98fdd5907f7fcb88246575508d8af0fb184f63926d2c4b0f9549735d1b

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Thu, 07 Oct 2021 10:08:55 GMT
content-encoding
gzip
x-cdn-client-ip-version
IPV4
x-cdn
ECST
age
3404
x-cache
HIT
x-cdn-proto
HTTP2
content-length
62394
x-li-uuid
605rzqm0qxZQrr1PESsAAA==
server
ECAcc (frd/E2D7)
last-modified
Thu, 07 Oct 2021 09:12:11 GMT
x-li-pop
prod-eda6
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=3600
accept-ranges
bytes
x-li-proto
http/1.1
x-li-fabric
prod-ltx1
expires
Thu, 7 Oct 2021 10:12:11 GMT
layout.min.css
cdn2.hubspot.net/hub/7052064/hub_generated/template_assets/1633550986204/hubspot/hubspot_default/shared/responsive/ 		5 KB
2 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://cdn2.hubspot.net/hub/7052064/hub_generated/template_assets/1633550986204/hubspot/hubspot_default/shared/responsive/layout.min.css
Requested by
Host: www.cybereason.com
URL: https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.17.240.204 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
341a4d40ad1b2560db940f906716d0e9539d4c0785399d7e0348fd0d3af00170

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

x-amz-meta-created-unix-time-millis
1633550986282
date
Thu, 07 Oct 2021 10:08:55 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
50239
x-hs-alternate-content-type
text/plain
x-amz-server-side-encryption
AES256
x-edge-origin-shield-skipped
0
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=2b6SMjdEw85PTjJB7S6FNu2GjojvR9xjkRE3BxHLplsSltBZ0YDtoehiwh8uTm9%2FfRXVEHmVQvQS2dwVCJSMO2Co29BZExdqucmg1%2BIY0aHklwO5DdqUlF2Dxs20KtUiKiM%3D"}],"group":"cf-nel","max_age":604800}
x-amz-replication-status
COMPLETED
x-hs-cf-lambda
us-east-1.enforceAclForReadsProd 12
last-modified
Wed, 06 Oct 2021 20:09:47 GMT
server
cloudflare
etag
W/"0b0c633d59ab0af9553a98c0e7d97349"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
access-control-allow-methods
GET
content-type
text/css
access-control-allow-origin
*
cache-control
s-maxage=1814400, max-age=1209600, stale-while-revalidate=900
x-amz-cf-pop
IAD89-C1
cf-ray
69a654b9fa9a5ca4-FRA
x-hs-cf-lambda-enforce
us-east-1.enforceAclForReadsProd 12
cr-master__cta.min.css
www.cybereason.com/hs-fs/hub/3354902/hub_generated/template_assets/34470223313/1627492001587/__CR_Web_Platform_2020/CSS/ 		2 KB
2 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.cybereason.com/hs-fs/hub/3354902/hub_generated/template_assets/34470223313/1627492001587/__CR_Web_Platform_2020/CSS/cr-master__cta.min.css
Requested by
Host: www.cybereason.com
URL: https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
199.60.103.30 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
e4d41fad643257f1b89daa37cbe8d9c0ce35a9d39a465e126a11311c03c703c2

Request headers

:path
/hs-fs/hub/3354902/hub_generated/template_assets/34470223313/1627492001587/__CR_Web_Platform_2020/CSS/cr-master__cta.min.css
pragma
no-cache
cookie
__cfruid=d7e721c13da4dff96ea791e26c85151287fa3558-1633601335
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
text/css,*/*;q=0.1
cache-control
no-cache
sec-fetch-dest
style
:authority
www.cybereason.com
referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

x-amz-meta-created-unix-time-millis
1627492001673
date
Thu, 07 Oct 2021 10:08:55 GMT
via
1.1 85fc1201a1918facbeb30836e7391661.cloudfront.net (CloudFront)
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
2642
x-hs-alternate-content-type
text/plain
x-amz-server-side-encryption
AES256
x-cache
RefreshHit from cloudfront
x-edge-origin-shield-skipped
0
x-amz-replication-status
COMPLETED
x-hs-cf-lambda
us-east-1.enforceAclForReadsProd 12
content-encoding
br
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
x-amz-request-id
ES5PP1PD4H465HBE
x-amz-id-2
APQtHyJb6joy4ddq1A5xcX1qhifTZiZ2ESp9c8wQEiPCReQQayGbRXdqKiJ5f7K/hpYV/nZZjNE=
last-modified
Wed, 28 Jul 2021 17:06:42 GMT
server
cloudflare
etag
W/"89ac76f7f2d4099077234fa1f66eb594"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=5tWiFalBxhmqK8wCKyfeSrnMPil90GQ%2FSsA63lMGY2tYQqfeBBi0byRkJqgO%2Bphs1WbuvHKwLOk87gO1WRdjPaTmkcYpfHZJTUwMHOSmiWkwOdPOr1K23MTSMtsl2WKxhRQvLA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
cache-control
s-maxage=1814400, max-age=1209600, stale-while-revalidate=900, s-maxage=31536000, max-age=31536000
access-control-allow-credentials
false
x-amz-version-id
DwYN0wc2E8h77jnC2saxPkBPwAxtxVqR
x-amz-cf-pop
IAD89-C1
cf-ray
69a654b9de552c2a-FRA
x-amz-cf-id
fBZFL7Gq-gsGCdU9CdSRVYgzQJkrL3IYdscvQwg_7LImVx_ORn7cAw==
x-hs-cf-lambda-enforce
us-east-1.enforceAclForReadsProd 12
cr-master__main.min.css
www.cybereason.com/hs-fs/hub/3354902/hub_generated/template_assets/34470477360/1632935872906/__CR_Web_Platform_2020/CSS/ 		44 KB
9 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.cybereason.com/hs-fs/hub/3354902/hub_generated/template_assets/34470477360/1632935872906/__CR_Web_Platform_2020/CSS/cr-master__main.min.css
Requested by
Host: www.cybereason.com
URL: https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
199.60.103.30 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
5f0957fb43888099a11b4be327296643a4d9c6889303d02a0240b3b341855a9c

Request headers

:path
/hs-fs/hub/3354902/hub_generated/template_assets/34470477360/1632935872906/__CR_Web_Platform_2020/CSS/cr-master__main.min.css
pragma
no-cache
cookie
__cfruid=d7e721c13da4dff96ea791e26c85151287fa3558-1633601335
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
text/css,*/*;q=0.1
cache-control
no-cache
sec-fetch-dest
style
:authority
www.cybereason.com
referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

x-amz-meta-created-unix-time-millis
1632935873022
date
Thu, 07 Oct 2021 10:08:55 GMT
via
1.1 5195de19cbc5ce842ac6538e9a6850cb.cloudfront.net (CloudFront)
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
2763
x-hs-alternate-content-type
text/plain
x-amz-server-side-encryption
AES256
x-cache
RefreshHit from cloudfront
x-edge-origin-shield-skipped
0
x-amz-replication-status
COMPLETED
x-hs-cf-lambda
us-east-1.enforceAclForReadsProd 12
content-encoding
br
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
x-amz-request-id
ES5QHKQYSRJBN3Z7
x-amz-id-2
gr2pwkcIRD/goXr8U9NEqnYau4vI3kcKKvPJJv+/LCTesxeWa5gzx6V2ItfIm5x/sdfRdPt5G6M=
last-modified
Wed, 29 Sep 2021 17:17:54 GMT
server
cloudflare
etag
W/"8dffe180304436c8890e4deb45900016"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=X6JcRZW9MHTCHN0uI34L2Y32FcTU7SWqT4yC%2F3cIJ5SzBP6eN0mz6oOOEigMppkxOJQwyCf2EhBS8o8qzMzeuPQwWfXxvInlxa%2F1s%2B36EPJolAfHRA7cy5wODUFBtfFlv95Oqw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
cache-control
s-maxage=1814400, max-age=1209600, stale-while-revalidate=900, s-maxage=31536000, max-age=31536000
access-control-allow-credentials
false
x-amz-version-id
X_8IoxVRV2kLtsLT671XeGqCxkaiEaey
x-amz-cf-pop
IAD89-C1
cf-ray
69a654b9de572c2a-FRA
x-amz-cf-id
sEl1mJk46etW-WQTfATeawpsenvi6Tdsw4xyISvlIKCldSbSLf4QUQ==
x-hs-cf-lambda-enforce
us-east-1.enforceAclForReadsProd 12
ionicons.min.css
www.cybereason.com/hs-fs/hub/3354902/hub_generated/template_assets/35275979682/1600880367101/__CR_Web_Platform_2020/CSS/ 		50 KB
9 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.cybereason.com/hs-fs/hub/3354902/hub_generated/template_assets/35275979682/1600880367101/__CR_Web_Platform_2020/CSS/ionicons.min.css
Requested by
Host: www.cybereason.com
URL: https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
199.60.103.30 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
72fe18777ebf37b44d58c82be9b67edceefb88c2c6984c614c72991d6e3b8853

Request headers

:path
/hs-fs/hub/3354902/hub_generated/template_assets/35275979682/1600880367101/__CR_Web_Platform_2020/CSS/ionicons.min.css
pragma
no-cache
cookie
__cfruid=d7e721c13da4dff96ea791e26c85151287fa3558-1633601335
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
text/css,*/*;q=0.1
cache-control
no-cache
sec-fetch-dest
style
:authority
www.cybereason.com
referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

x-amz-meta-created-unix-time-millis
1600880367101
date
Thu, 07 Oct 2021 10:08:55 GMT
via
1.1 b5e757a7da6f6fe6261f56a8a9646881.cloudfront.net (CloudFront)
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
2763
x-hs-alternate-content-type
text/plain
x-amz-server-side-encryption
AES256
x-cache
RefreshHit from cloudfront
x-edge-origin-shield-skipped
0
x-amz-replication-status
COMPLETED
x-hs-cf-lambda
us-east-1.enforceAclForReadsProd 12
content-encoding
br
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
x-amz-request-id
ES5VJHPCDVH4J28Z
x-amz-id-2
ekYo/wua2mdPnRQlvF58JGgoQM06R4+IHNqRbv2YpG7utG+hZYYh/JHuh0TH1w75yQgIPh5Umzs=
last-modified
Wed, 23 Sep 2020 16:59:28 GMT
server
cloudflare
etag
W/"71c8c946791f3411c42a4cb1e9cdb5ed"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=MFG4LPmYgRLK92tetb1f92Q9kTc1obFRF8wqXBNQDfY%2BIGwXFYHV%2FUuYozgW9J243VYk17jqGNG8AFi1MPlN9S343QlI%2BgnSCg%2FEcrLQUNjpbPaVz8rpmWi%2FD%2F3N31Em8UOi%2BA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
cache-control
s-maxage=1814400, max-age=1209600, stale-while-revalidate=900, s-maxage=31536000, max-age=31536000
access-control-allow-credentials
false
x-amz-version-id
sBk0NTXt5JC0boW_cB8Js8IeL5M2sXdU
x-amz-cf-pop
IAD89-C1
cf-ray
69a654b9de582c2a-FRA
x-amz-cf-id
UGlcas-G0lShQzNkdykIITg0CXKxQpeg3qphZN5llxgBzCTCfdfg5Q==
x-hs-cf-lambda-enforce
us-east-1.enforceAclForReadsProd 12
cr-mln__build.min.css
www.cybereason.com/hs-fs/hub/3354902/hub_generated/template_assets/42760289143/1624557581500/__CR_Web_Platform_2020/CSS/ 		13 KB
4 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.cybereason.com/hs-fs/hub/3354902/hub_generated/template_assets/42760289143/1624557581500/__CR_Web_Platform_2020/CSS/cr-mln__build.min.css
Requested by
Host: www.cybereason.com
URL: https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
199.60.103.30 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
a939b9fcb8cdec877464e6131704ef19effd6279467d48bd42afe7af8558391c

Request headers

:path
/hs-fs/hub/3354902/hub_generated/template_assets/42760289143/1624557581500/__CR_Web_Platform_2020/CSS/cr-mln__build.min.css
pragma
no-cache
cookie
__cfruid=d7e721c13da4dff96ea791e26c85151287fa3558-1633601335
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
text/css,*/*;q=0.1
cache-control
no-cache
sec-fetch-dest
style
:authority
www.cybereason.com
referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

x-amz-meta-created-unix-time-millis
1624557581580
date
Thu, 07 Oct 2021 10:08:55 GMT
via
1.1 5eb5e19c1a78889d10ff38f1551ed2aa.cloudfront.net (CloudFront)
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
2273
x-hs-alternate-content-type
text/plain
x-amz-server-side-encryption
AES256
x-cache
RefreshHit from cloudfront
x-edge-origin-shield-skipped
0
x-amz-replication-status
COMPLETED
x-hs-cf-lambda
us-east-1.enforceAclForReadsProd 12
content-encoding
br
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
x-amz-request-id
8PB19XKPJ796KE54
x-amz-id-2
aiA8ODy7TkQfPwLsaGyVAxGMH61YnDDazXRBu4/EkMppjgYi2iiDLMdFMLUyPQv6c8uOQzrsMdQ=
last-modified
Thu, 24 Jun 2021 17:59:42 GMT
server
cloudflare
etag
W/"badac49ceb808e0da5626ecf98b71573"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=3pZJ%2BM9aoWIcjIof1RUYXWpE8s5ZJIgxFNMhKebnAAQy3fxvbbas70Gfbl84vCY26lu0OTTDjXfR%2Fo2nHLnFm%2Bjj1Ga07TVj6PJunVGoASegFWrWfp4zZ4%2B3V6LlezWoNVv%2BzQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
cache-control
s-maxage=1814400, max-age=1209600, stale-while-revalidate=900, s-maxage=31536000, max-age=31536000
access-control-allow-credentials
false
x-amz-version-id
AuAOSI.b8qeNmiOriOmPI0duibPKybLM
x-amz-cf-pop
IAD89-C1
cf-ray
69a654b9de5b2c2a-FRA
x-amz-cf-id
hEsI3DcA42KkAUjL51S_FICAi-M88G0KXxrYmnCKmDCMEC0F4u61mg==
x-hs-cf-lambda-enforce
us-east-1.enforceAclForReadsProd 12
cr-framework__bulma-columns.min.css
www.cybereason.com/hs-fs/hub/3354902/hub_generated/template_assets/34470224480/1633108735922/__CR_Web_Platform_2020/CSS/bulma/ 		19 KB
4 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.cybereason.com/hs-fs/hub/3354902/hub_generated/template_assets/34470224480/1633108735922/__CR_Web_Platform_2020/CSS/bulma/cr-framework__bulma-columns.min.css
Requested by
Host: www.cybereason.com
URL: https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
199.60.103.30 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
81c836c05ab1f2d37b7aa60d509a656c7a441e2a4fabf035c1b0666a4daa50fa

Request headers

:path
/hs-fs/hub/3354902/hub_generated/template_assets/34470224480/1633108735922/__CR_Web_Platform_2020/CSS/bulma/cr-framework__bulma-columns.min.css
pragma
no-cache
cookie
__cfruid=d7e721c13da4dff96ea791e26c85151287fa3558-1633601335
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
text/css,*/*;q=0.1
cache-control
no-cache
sec-fetch-dest
style
:authority
www.cybereason.com
referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

x-amz-meta-created-unix-time-millis
1633108736047
date
Thu, 07 Oct 2021 10:08:55 GMT
via
1.1 2ad0cde89ab58d454177893ae4447f50.cloudfront.net (CloudFront)
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
2763
x-hs-alternate-content-type
text/plain
x-amz-server-side-encryption
AES256
x-cache
RefreshHit from cloudfront
x-edge-origin-shield-skipped
0
x-amz-replication-status
PENDING
x-hs-cf-lambda
us-east-1.enforceAclForReadsProd 12
content-encoding
br
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
x-amz-request-id
DMNVP5KWK7P2A8JE
x-amz-id-2
meIyduAFtCSAgJNpnOhtvP91j4JHP/nkJxyK7OLmK8wqUIuBizI0gRnq5CpLNOsVHP7KlLzrdEc=
last-modified
Fri, 01 Oct 2021 17:18:57 GMT
server
cloudflare
etag
W/"636c18615b58fca9536b2e1c578c6db7"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=sSit1RI0Wo95Qka4mZLiP%2B8RE0FhrQeal6mWAXTPeTSWpZBcGf4%2BbImbJDlMxUIVUErA8Q35uzYD42O4gDrmHA8WhHLI52hwQg7GaVxSOwf0p1EqBcUiICGfQlaYQGzrQPrOuA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
cache-control
s-maxage=1814400, max-age=1209600, stale-while-revalidate=900, s-maxage=31536000, max-age=31536000
access-control-allow-credentials
false
x-amz-version-id
Yad_57oe8BCKtK5OVbjoaVEXuSXjLBHB
x-amz-cf-pop
IAD89-C1
cf-ray
69a654b9de5c2c2a-FRA
x-amz-cf-id
_tl2LKOhSS25htfE_iB9noReusIXt_CNrGgamuoRyWCqyUrQH3AWNg==
x-hs-cf-lambda-enforce
us-east-1.enforceAclForReadsProd 12
cr-framework__bulma.min.css
www.cybereason.com/hs-fs/hub/3354902/hub_generated/template_assets/35291999472/1614661129976/__CR_Web_Platform_2020/CSS/bulma/ 		64 KB
10 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.cybereason.com/hs-fs/hub/3354902/hub_generated/template_assets/35291999472/1614661129976/__CR_Web_Platform_2020/CSS/bulma/cr-framework__bulma.min.css
Requested by
Host: www.cybereason.com
URL: https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
199.60.103.30 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
0a1db8e6cb7ae20e5ac308a25943b94734e7ad0f794b26eb778c7e38ae2b51e0

Request headers

:path
/hs-fs/hub/3354902/hub_generated/template_assets/35291999472/1614661129976/__CR_Web_Platform_2020/CSS/bulma/cr-framework__bulma.min.css
pragma
no-cache
cookie
__cfruid=d7e721c13da4dff96ea791e26c85151287fa3558-1633601335
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
text/css,*/*;q=0.1
cache-control
no-cache
sec-fetch-dest
style
:authority
www.cybereason.com
referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

x-amz-meta-created-unix-time-millis
1614661129976
date
Thu, 07 Oct 2021 10:08:55 GMT
via
1.1 d1cde188ada6755fe03b8541b71fce4a.cloudfront.net (CloudFront)
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
2764
x-hs-alternate-content-type
text/plain
x-amz-server-side-encryption
AES256
x-cache
RefreshHit from cloudfront
x-edge-origin-shield-skipped
0
x-amz-replication-status
COMPLETED
x-hs-cf-lambda
us-east-1.enforceAclForReadsProd 12
content-encoding
br
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
x-amz-request-id
ES5VPPH6QHN724J0
x-amz-id-2
Ah14ucVpE7M3/+rkd/O8UAkjMw8T8LSCnwpUdkDDr7zfaMNocqluGOrW5RivF/LB8pGjknKIXeg=
last-modified
Tue, 02 Mar 2021 04:58:50 GMT
server
cloudflare
etag
W/"88605a5e2df657681a0605d62c89a631"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=SJuscfSdEZxWU0ndXOkMKOoqr4xnOSElpv77SzTTd411746XRWkAMwh8mcw0MQYz4q6xTOORuQXOQ1b%2B91SB0Hd81g5zsxQnWeqrKxOGR%2B9RKOC%2FHxFIGaZ1ZzEwTnQLf4GpPw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
cache-control
s-maxage=1814400, max-age=1209600, stale-while-revalidate=900, s-maxage=31536000, max-age=31536000
access-control-allow-credentials
false
x-amz-version-id
tAd3t.xCRJ6C07U_zCfDzg5hCYB7E5P1
x-amz-cf-pop
IAD89-C1
cf-ray
69a654b9de5d2c2a-FRA
x-amz-cf-id
ArrKwJRCOOQ-pEa-1Jmv5zXZjGVpYSPqERe6tM8dK4nkZr2Xo1VvSw==
x-hs-cf-lambda-enforce
us-east-1.enforceAclForReadsProd 12
hamburger-animation.min.css
www.cybereason.com/hs-fs/hub/3354902/hub_generated/template_assets/42363645447/1614911253070/__CR_Web_Platform_2020/CSS/ 		22 KB
4 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.cybereason.com/hs-fs/hub/3354902/hub_generated/template_assets/42363645447/1614911253070/__CR_Web_Platform_2020/CSS/hamburger-animation.min.css
Requested by
Host: www.cybereason.com
URL: https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
199.60.103.30 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
c9130ee8c979a74ab038cf5e8a06db5cb94253eab35ea5242f515d605f4781ad

Request headers

:path
/hs-fs/hub/3354902/hub_generated/template_assets/42363645447/1614911253070/__CR_Web_Platform_2020/CSS/hamburger-animation.min.css
pragma
no-cache
cookie
__cfruid=d7e721c13da4dff96ea791e26c85151287fa3558-1633601335
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
text/css,*/*;q=0.1
cache-control
no-cache
sec-fetch-dest
style
:authority
www.cybereason.com
referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

x-amz-meta-created-unix-time-millis
1614911253070
date
Thu, 07 Oct 2021 10:08:55 GMT
via
1.1 041a4887d523cabe8177e269cc358163.cloudfront.net (CloudFront)
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
2273
x-hs-alternate-content-type
text/plain
x-amz-server-side-encryption
AES256
x-cache
RefreshHit from cloudfront
x-edge-origin-shield-skipped
0
x-amz-replication-status
COMPLETED
x-hs-cf-lambda
us-east-1.enforceAclForReadsProd 12
content-encoding
br
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
x-amz-request-id
KEZY2B41Q2FQSJ35
x-amz-id-2
RL9J5tXTz6H/jT4eCW/bzBwkyUmASFjeufyKBnHKdJw+kAnvSxnzhL2TLsrgLa0n/zxq20CYzQ4=
last-modified
Fri, 05 Mar 2021 02:27:34 GMT
server
cloudflare
etag
W/"a0b451fd96744fa455495e022542ab86"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=sFdVeUmn0WDZdDs%2Fjqg2y4X5VI4PzFlEi8kIF5iiqQIwNhsvXLIFLHBuiNhl%2BRs8%2BNknrw6kU7jCjnEu1mW8En8zAcT3bXi1lgrkNvWiOr2uxuA7toyMzYn2bgXsfbKKUNggqw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
cache-control
s-maxage=1814400, max-age=1209600, stale-while-revalidate=900, s-maxage=31536000, max-age=31536000
access-control-allow-credentials
false
x-amz-version-id
48HHzBt1ZAHNHDF25QKABbh_JsEPbDqv
x-amz-cf-pop
IAD89-C1
cf-ray
69a654b9de602c2a-FRA
x-amz-cf-id
tmX46PWS9YY_n3DxHan7ptIIlZRF7VkBHcU3Wfanb8X7Tn7_2tfZDQ==
x-hs-cf-lambda-enforce
us-east-1.enforceAclForReadsProd 12
animate.min.min.css
www.cybereason.com/hs-fs/hub/3354902/hub_generated/template_assets/42507091846/1614920868925/__CR_Web_Platform_2020/CSS/ 		52 KB
5 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.cybereason.com/hs-fs/hub/3354902/hub_generated/template_assets/42507091846/1614920868925/__CR_Web_Platform_2020/CSS/animate.min.min.css
Requested by
Host: www.cybereason.com
URL: https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
199.60.103.30 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
267c1ae37916b433b1515b4687883dbc2fef448a533e33bbe97085d42c7738d5

Request headers

:path
/hs-fs/hub/3354902/hub_generated/template_assets/42507091846/1614920868925/__CR_Web_Platform_2020/CSS/animate.min.min.css
pragma
no-cache
cookie
__cfruid=d7e721c13da4dff96ea791e26c85151287fa3558-1633601335
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
text/css,*/*;q=0.1
cache-control
no-cache
sec-fetch-dest
style
:authority
www.cybereason.com
referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

x-amz-meta-created-unix-time-millis
1614920868925
date
Thu, 07 Oct 2021 10:08:55 GMT
via
1.1 ef6762d67d012a06d2761f42352c9e53.cloudfront.net (CloudFront)
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
2273
x-hs-alternate-content-type
text/plain
x-amz-server-side-encryption
AES256
x-cache
RefreshHit from cloudfront
x-edge-origin-shield-skipped
0
x-amz-replication-status
COMPLETED
x-hs-cf-lambda
us-east-1.enforceAclForReadsProd 12
content-encoding
br
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
x-amz-request-id
KEZKW7KY4EGQDVPW
x-amz-id-2
5yZBUiccKVI2Uczf4kYclwxOPielXbddneIN1rRqiaw5/6KBQgKpcJBioovKIQ6fR/QGLEdZ9vk=
last-modified
Fri, 05 Mar 2021 05:07:49 GMT
server
cloudflare
etag
W/"a091d6db21bd52764bd7a33e2944a606"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=eNNl%2FW6Hsp%2Fvb4b%2Byy7fQz2fz%2BVFNCI7dyohyYg6ctcuiABSjuLDvY7Cxjx7B3tppd3iVS3JPtoOGWM9VRCCr3fSR2Y7hsmN%2FEH9s%2F8D1jgsBH3XkLdeBhW0LIQnWnNLX3fJmw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
cache-control
s-maxage=1814400, max-age=1209600, stale-while-revalidate=900, s-maxage=31536000, max-age=31536000
access-control-allow-credentials
false
x-amz-version-id
N.0JvpMrNL6R6ApQYx9Po1pYOHB20NAT
x-amz-cf-pop
IAD89-C1
cf-ray
69a654b9de622c2a-FRA
x-amz-cf-id
oqHOKxsHUKkUvp0a1lrycQqy9tW5P3sDiaB_N2AHzT5mngVH8Mu-vg==
x-hs-cf-lambda-enforce
us-east-1.enforceAclForReadsProd 12
font-awesome.min.css
cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/css/ 		30 KB
6 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/css/font-awesome.min.css
Requested by
Host: www.cybereason.com
URL: https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.16.19.94 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd
Security Headers
Name Value
Strict-Transport-Security max-age=15780000
X-Content-Type-Options nosniff

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Thu, 07 Oct 2021 10:08:55 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age
3832552
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length
5631
timing-allow-origin
*
last-modified
Mon, 04 May 2020 16:10:07 GMT
server
cloudflare
cf-cdnjs-via
cfworker/kv
etag
"5eb03e5f-7918"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=15780000
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Hm46mr6ngWPXEobl3ELL9qf6mXZxVXToHUHxKyrR3sUaVk5X%2FHC%2BClgmS%2BiuzOEwts%2BsQ3CNQjlRtep0BAifwWEZviLhFkUK7G68a5xhnJ0UzU2BXlE%2FlFjLcKaVQr7lZs5pGAOX"}],"group":"cf-nel","max_age":604800}
content-type
text/css; charset=utf-8
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=30672000
accept-ranges
bytes
cf-ray
69a654b9ff8e6928-FRA
expires
Tue, 27 Sep 2022 10:08:55 GMT
marker-animation.js
www.cybereason.com/hubfs/dam/plugins/ 		6 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.cybereason.com/hubfs/dam/plugins/marker-animation.js
Requested by
Host: www.cybereason.com
URL: https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
199.60.103.30 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
843803aeba82f94da6f1cbe1f853ccd12f5d7cc6a3afa20923e57e5df60c412d

Request headers

:path
/hubfs/dam/plugins/marker-animation.js
pragma
no-cache
cookie
__cfruid=d7e721c13da4dff96ea791e26c85151287fa3558-1633601335
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
script
:authority
www.cybereason.com
referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

content-encoding
br
x-amz-meta-cache-tag
F-36714670113,FD-35651288461,P-3354902,FLS-ALL
age
567037
x-amz-server-side-encryption
AES256
edge-cache-tag
F-36714670113,FD-35651288461,P-3354902,FLS-ALL
x-edge-origin-shield-skipped
0
x-amz-replication-status
COMPLETED
x-hs-cf-lambda
us-east-1.enforceAclForReadsProd 12
x-amz-request-id
FQA1XHSY9C99CDV2
etag
W/"c789451d244987df6815383a74c748e9"
vary
Accept-Encoding
access-control-allow-methods
GET
content-type
application/javascript
access-control-allow-origin
*
cache-control
s-maxage=1814400, max-age=1209600, stale-while-revalidate=900
x-robots-tag
all
x-hs-cf-lambda-enforce
us-east-1.enforceAclForReadsProd 12
x-amz-meta-created-unix-time-millis
1603818553593
date
Thu, 07 Oct 2021 10:08:55 GMT
via
1.1 0f538ee832e1105649039b38ce89e883.cloudfront.net (CloudFront)
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-amz-cf-pop
FRA2-C1
x-hs-alternate-content-type
text/plain
x-cache
RefreshHit from cloudfront
x-amz-meta-index-tag
all
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
x-amz-id-2
4P8Ev2lXdmcURmTm2fvacKCJu1ATinEAakJYaZDcnzoLWutORL/cI+xpEPNEMXEX/OZLZEw4D2U=
last-modified
Tue, 27 Oct 2020 17:09:14 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=xPlmtWl4UYj6DzjQ8IgBMSuQxj5E42uvq0frthbffxzk%2BzihqkYbdCysl5UhNjqmcI6b6qP8kZKrtKKRfRagL5lc6m3VEm1XmClSG70Crnvhtlt9T%2FnvY5UTx5t5qHiskEVsrg%3D%3D"}],"group":"cf-nel","max_age":604800}
x-amz-version-id
sJPPhJRtfwkomYz4StFq0KxvBmQZgdrG
cf-ray
69a654b9de642c2a-FRA
x-amz-cf-id
B1mldmortL764QVKIlMpQPM4hypX3FvHqJPDFduoD9GPivDBuKyoyA==
cr-logo-web-horizontal-black-500px.png
www.cybereason.com/hubfs/dam/images/images-web/logos/ 		5 KB
6 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.cybereason.com/hubfs/dam/images/images-web/logos/cr-logo-web-horizontal-black-500px.png
Requested by
Host: www.cybereason.com
URL: https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
199.60.103.30 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
2311b7d2f30a6ab89191098f12c99253267df7219477c0702d58bf4999f4a703

Request headers

:path
/hubfs/dam/images/images-web/logos/cr-logo-web-horizontal-black-500px.png
pragma
no-cache
cookie
__cfruid=d7e721c13da4dff96ea791e26c85151287fa3558-1633601335
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
www.cybereason.com
referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

x-amz-meta-cache-tag
F-36668407494,FD-35695393279,P-3354902,FLS-ALL
age
569043
x-amz-server-side-encryption
AES256
edge-cache-tag
F-36668407494,FD-35695393279,P-3354902,FLS-ALL
x-edge-origin-shield-skipped
0
x-amz-replication-status
COMPLETED
content-disposition
inline; filename="cr-logo-web-horizontal-black-500px.webp"
x-hs-cf-lambda
us-east-1.enforceAclForReadsProd 12
x-amz-request-id
1V70ZRXDNKBMDRH1
cf-bgj
imgq:85,h2pri
etag
"acbeba65a7e33212196b1386c365e1fb"
vary
Accept, Accept-Encoding
access-control-allow-methods
GET
content-type
image/webp
access-control-allow-origin
*
cache-control
s-maxage=1814400, max-age=1209600, stale-while-revalidate=900
x-robots-tag
all
x-hs-cf-lambda-enforce
us-east-1.enforceAclForReadsProd 12
x-amz-meta-created-unix-time-millis
1603732670207
date
Thu, 07 Oct 2021 10:08:55 GMT
via
1.1 e39402e2cf62b31f7774452c905f38f3.cloudfront.net (CloudFront)
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-amz-cf-pop
FRA56-C1
x-hs-alternate-content-type
text/plain
cf-polished
origFmt=png, origSize=9553
x-cache
RefreshHit from cloudfront
x-amz-meta-index-tag
all
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length
5062
x-amz-id-2
pQsw8nJKxB7Yr6VAQixTI79/PMNDB9v2LimBZhJmgOKOW0cvukUIiJcS2mMXrAuEtlNkfmvjzz8=
last-modified
Mon, 26 Oct 2020 17:18:08 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=NssVaM%2FnydjNHQVTToy7maYxdcat6rne%2BS0v3INxLiX611BHI3jOxcGUTLBy2khESg8E10ynSZQErKnLGNWofCcGnf8ZQvgVEo%2FTN95tmFOnRL51Ujy2T%2FRWFegk7GeKtCUxsA%3D%3D"}],"group":"cf-nel","max_age":604800}
x-amz-version-id
Fi99aeAoW1lKCRBa1uJA0OV6mR9Vcx_U
accept-ranges
bytes
cf-ray
69a654badffb2c2a-FRA
x-amz-cf-id
CHJjUPe586yB4lXdQjUqTQceTWm_smkVhe7QdNnAZK1eW4__w0xwIA==
cr-malicious-life-network-logo.svg
www.cybereason.com/hubfs/dam/images/images-web/blog-images/template-images/ 		23 KB
7 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.cybereason.com/hubfs/dam/images/images-web/blog-images/template-images/cr-malicious-life-network-logo.svg
Requested by
Host: www.cybereason.com
URL: https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
199.60.103.30 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
59d91999b3e0f1e6191f29f73b2b079ee1aa1350f3d88795db7518ca40a9be60

Request headers

:path
/hubfs/dam/images/images-web/blog-images/template-images/cr-malicious-life-network-logo.svg
pragma
no-cache
cookie
__cfruid=d7e721c13da4dff96ea791e26c85151287fa3558-1633601335
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
www.cybereason.com
referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

content-encoding
br
x-amz-meta-cache-tag
F-41718939860,FD-41718904629,P-3354902,FLS-ALL
age
567037
x-amz-server-side-encryption
AES256
edge-cache-tag
F-41718939860,FD-41718904629,P-3354902,FLS-ALL
x-edge-origin-shield-skipped
0
x-amz-replication-status
COMPLETED
x-hs-cf-lambda
us-east-1.enforceAclForReadsProd 12
x-amz-request-id
YQVKTS0KWKAK7JX8
etag
W/"559d4455bd1fe5c187804bc088e7c79f"
vary
Accept-Encoding
access-control-allow-methods
GET
content-type
image/svg+xml
access-control-allow-origin
*
cache-control
s-maxage=1814400, max-age=1209600, stale-while-revalidate=900
x-robots-tag
all
x-hs-cf-lambda-enforce
us-east-1.enforceAclForReadsProd 12
x-amz-meta-created-unix-time-millis
1613708849844
date
Thu, 07 Oct 2021 10:08:55 GMT
via
1.1 d8eef512ab23f23f549b4cd25ac5328d.cloudfront.net (CloudFront)
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-amz-cf-pop
FRA2-C1
x-hs-alternate-content-type
text/plain
x-cache
RefreshHit from cloudfront
x-amz-meta-index-tag
all
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
x-amz-id-2
DsADWxg7wYPHE0HK2oR97x0UQK7C4SE3SENU5dOdftmGwjJZ0fU/SeCPH2m8dynWewlwu/Okvs4=
last-modified
Fri, 19 Feb 2021 04:27:30 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=2cLuLeJIyi3TyzUhOfNR8VJyfWpFxoNFuhbgaVCE%2FVYr%2B9Qln6PgRqE%2Bbt%2FZRdzS%2FgGlhsSXfLl534M%2FJg%2FKNKmGEYsaB8mmS9N%2BM%2BQP39mnWXsJo9cMNaqyM%2BCcvyN0uYArBQ%3D%3D"}],"group":"cf-nel","max_age":604800}
x-amz-version-id
jV508h77cVNLHNUYKWw1EBxVoCqSOv_T
cf-ray
69a654badffd2c2a-FRA
x-amz-cf-id
Huh05HHtPs6IL3TYBfNJoTWvS1uVLA10nJ57Bv4DPX15N8uKIkJu_w==
cr-blog-icon--search-dark-gray.png
www.cybereason.com/hubfs/dam/images/images-web/blog-images/template-images/ 		282 B
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.cybereason.com/hubfs/dam/images/images-web/blog-images/template-images/cr-blog-icon--search-dark-gray.png
Requested by
Host: www.cybereason.com
URL: https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
199.60.103.30 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
91b667b9d0de69583ee16753496325f38b91e7f77dcb34a5e49bdca3b670002a

Request headers

:path
/hubfs/dam/images/images-web/blog-images/template-images/cr-blog-icon--search-dark-gray.png
pragma
no-cache
cookie
__cfruid=d7e721c13da4dff96ea791e26c85151287fa3558-1633601335
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
www.cybereason.com
referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

x-amz-meta-cache-tag
F-42360212094,FD-41718904629,P-3354902,FLS-ALL
age
567037
x-amz-server-side-encryption
AES256
edge-cache-tag
F-42360212094,FD-41718904629,P-3354902,FLS-ALL
x-edge-origin-shield-skipped
0
x-amz-replication-status
COMPLETED
content-disposition
inline; filename="cr-blog-icon--search-dark-gray.webp"
x-hs-cf-lambda
us-east-1.enforceAclForReadsProd 12
x-amz-request-id
YQVVMKCSZZZ852W1
cf-bgj
imgq:85,h2pri
etag
"5285e68f20ece59da650da19c81751e2"
vary
Accept, Accept-Encoding
access-control-allow-methods
GET
content-type
image/webp
access-control-allow-origin
*
cache-control
s-maxage=1814400, max-age=1209600, stale-while-revalidate=900
x-robots-tag
all
x-hs-cf-lambda-enforce
us-east-1.enforceAclForReadsProd 12
x-amz-meta-created-unix-time-millis
1614741596040
date
Thu, 07 Oct 2021 10:08:55 GMT
via
1.1 8002c303d4f2295f77566a349deba122.cloudfront.net (CloudFront)
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-amz-cf-pop
FRA2-C1
x-hs-alternate-content-type
text/plain
cf-polished
origFmt=png, origSize=583
x-cache
RefreshHit from cloudfront
x-amz-meta-index-tag
all
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length
282
x-amz-id-2
W9Cci3SaAZl5jZrfEK7aXFKww+HU1AKHevZnwYszYNH9X4KdPbG6idDhEfax+G+NLCwLzKoNZmk=
last-modified
Wed, 03 Mar 2021 03:19:57 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Yb9kgkZgtBPoUx2ybfAugdOpVyb5NGu205sADMeOiy%2BAjl9OhBrVWKxw1RqwLTIHVSOSBKhudaCjh78fcfwiN2gHbP4M4CU%2FCRLtXGG2fx0z54EuQ%2FasA1wxBgb0%2BixCNrbDhA%3D%3D"}],"group":"cf-nel","max_age":604800}
x-amz-version-id
Z9.dvET4DoUMSJH5gPgUuVYnyNsIiNYh
accept-ranges
bytes
cf-ray
69a654badfff2c2a-FRA
x-amz-cf-id
sEw66opS5BEPz2AVa9VVi3Q-R-cAE_y8Ak9MSCL8dySv_QNEarvGfg==
BLOG%20%20SOCIAL%20SET%20-%20News%20%281%29-1.png
www.cybereason.com/hubfs/ 		740 KB
742 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.cybereason.com/hubfs/BLOG%20%20SOCIAL%20SET%20-%20News%20%281%29-1.png
Requested by
Host: www.cybereason.com
URL: https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
199.60.103.30 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
06de1d03905fa3708f8beb3b281211ec8c5dd7fcc903649f458bb6bce9241707

Request headers

:path
/hubfs/BLOG%20%20SOCIAL%20SET%20-%20News%20%281%29-1.png
pragma
no-cache
cookie
__cfruid=d7e721c13da4dff96ea791e26c85151287fa3558-1633601335
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
www.cybereason.com
referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

x-amz-meta-cache-tag
F-56558657366,P-3354902,FLS-ALL
age
86802
x-amz-server-side-encryption
AES256
edge-cache-tag
F-56558657366,P-3354902,FLS-ALL
x-edge-origin-shield-skipped
0
x-amz-replication-status
COMPLETED
content-disposition
inline; filename="BLOG%20%20SOCIAL%20SET%20-%20News%20(1)-1.webp"
x-hs-cf-lambda
us-east-1.enforceAclForReadsProd 12
x-amz-request-id
BHSWNYJD0CZKZ9C1
cf-bgj
imgq:85,h2pri
etag
"3750f1f7146100947a68743a34d5c33c"
vary
Accept, Accept-Encoding
access-control-allow-methods
GET
content-type
image/webp
access-control-allow-origin
*
cache-control
s-maxage=1814400, max-age=1209600, stale-while-revalidate=900
x-robots-tag
all
x-hs-cf-lambda-enforce
us-east-1.enforceAclForReadsProd 12
x-amz-meta-created-unix-time-millis
1633117706908
date
Thu, 07 Oct 2021 10:08:55 GMT
via
1.1 c6702f5f3b6e77da6f394e67ef1a6aab.cloudfront.net (CloudFront)
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-amz-cf-pop
FRA50-C1
x-hs-alternate-content-type
text/plain
cf-polished
origFmt=png, origSize=1130259
x-cache
RefreshHit from cloudfront
x-amz-meta-index-tag
all
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length
758124
x-amz-id-2
9zEc0vBkLG/2Tb/x5qG6zvnL9R2RE0qKp7xtgrjGnHsqp6V2xSvPEFnRWeF6SbgrvMPTsTzHHLU=
last-modified
Fri, 01 Oct 2021 19:48:28 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=YqMoS1wDZcdvXrydHluG8Q4T1BVVFfVo0%2BH%2F8Ino66%2FMi6fAGoJXdiJAP6B48yN3C5l1B8WorS2InUSXDR8Z%2B1Yrbc%2BD%2FEVwanLYPcC9M1Yd6GoCO1SURFqIsoOCo9Xdhxr2Pw%3D%3D"}],"group":"cf-nel","max_age":604800}
x-amz-version-id
yA9dKCyghsU1I2ZZNS1jjABJZ0i4WhOC
accept-ranges
bytes
cf-ray
69a654bad8002c2a-FRA
x-amz-cf-id
NMYbWDzrZNpwZMaIxcG4c_ROzrjIvO8HbArgD702xmYZcI3e2JRNag==
twitter-gray.svg
www.cybereason.com/hubfs/dam/images/images-web/blog-images/template-images/ 		749 B
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.cybereason.com/hubfs/dam/images/images-web/blog-images/template-images/twitter-gray.svg
Requested by
Host: www.cybereason.com
URL: https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
199.60.103.30 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
f9db6465a204cc4186368b72a0ba4f063e64569aa4fc96e0f40c7ac69423121b

Request headers

:path
/hubfs/dam/images/images-web/blog-images/template-images/twitter-gray.svg
pragma
no-cache
cookie
__cfruid=d7e721c13da4dff96ea791e26c85151287fa3558-1633601335
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
www.cybereason.com
referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

content-encoding
br
x-amz-meta-cache-tag
F-44251289646,FD-41718904629,P-3354902,FLS-ALL
age
567037
x-amz-server-side-encryption
AES256
edge-cache-tag
F-44251289646,FD-41718904629,P-3354902,FLS-ALL
x-edge-origin-shield-skipped
0
x-amz-replication-status
COMPLETED
x-hs-cf-lambda
us-east-1.enforceAclForReadsProd 12
x-amz-request-id
YQVPFWP3SAEZNQAV
etag
W/"5c103d0cd978b3a8d7ccab6bff714599"
vary
Accept-Encoding
access-control-allow-methods
GET
content-type
image/svg+xml
access-control-allow-origin
*
cache-control
s-maxage=1814400, max-age=1209600, stale-while-revalidate=900
x-robots-tag
all
x-hs-cf-lambda-enforce
us-east-1.enforceAclForReadsProd 12
x-amz-meta-created-unix-time-millis
1617243822112
date
Thu, 07 Oct 2021 10:08:55 GMT
via
1.1 69f13f852a135432abb1b7bfc5a8b421.cloudfront.net (CloudFront)
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-amz-cf-pop
FRA2-C1
x-hs-alternate-content-type
text/plain
x-cache
RefreshHit from cloudfront
x-amz-meta-index-tag
all
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
x-amz-id-2
NgFclnoRmLYE/V6zeQC7s4yZL+ZnfXTNJczUST+Y4NdnbkNL5z0EDDNBgBYzuTx7CjJon2S+Twc=
last-modified
Thu, 01 Apr 2021 02:23:43 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=aLfnFZKdxc2oE00gvJT4aygTQPSS%2Fk4mV%2BcmBZTiQbQ1QyeiPYD1HsUMbi9WBB3VVKGHJohZGSl%2F4MqkGa%2FtNti1okRtlPY%2BpftNn98YvHq2rMroE%2FwobgiI1xAGrAFCYWL6lA%3D%3D"}],"group":"cf-nel","max_age":604800}
x-amz-version-id
IqbJNdLSXrwowOx5nKBNqqtBOZO91Biv
cf-ray
69a654bad8022c2a-FRA
x-amz-cf-id
IS0pksxhd6uEonJwNma7JYUDdHaMsG7968u0GuApb7-NyitBG4Vwfg==
facebook-gray.svg
www.cybereason.com/hubfs/dam/images/images-web/blog-images/template-images/ 		372 B
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.cybereason.com/hubfs/dam/images/images-web/blog-images/template-images/facebook-gray.svg
Requested by
Host: www.cybereason.com
URL: https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
199.60.103.30 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
d82231820461c83d1b0966caae71bd2732bd89e9a910fdb90d193c3dca16dbc7

Request headers

:path
/hubfs/dam/images/images-web/blog-images/template-images/facebook-gray.svg
pragma
no-cache
cookie
__cfruid=d7e721c13da4dff96ea791e26c85151287fa3558-1633601335
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
www.cybereason.com
referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

content-encoding
br
x-amz-meta-cache-tag
F-44251209055,FD-41718904629,P-3354902,FLS-ALL
age
567037
x-amz-server-side-encryption
AES256
edge-cache-tag
F-44251209055,FD-41718904629,P-3354902,FLS-ALL
x-edge-origin-shield-skipped
0
x-amz-replication-status
COMPLETED
x-hs-cf-lambda
us-east-1.enforceAclForReadsProd 12
x-amz-request-id
221M1AHT19TGAD8J
etag
W/"8c22d0d78005c386bf29edacfdd2360d"
vary
Accept-Encoding
access-control-allow-methods
GET
content-type
image/svg+xml
access-control-allow-origin
*
cache-control
s-maxage=1814400, max-age=1209600, stale-while-revalidate=900
x-robots-tag
all
x-hs-cf-lambda-enforce
us-east-1.enforceAclForReadsProd 12
x-amz-meta-created-unix-time-millis
1617243822102
date
Thu, 07 Oct 2021 10:08:55 GMT
via
1.1 8f20db43ba7579b7216cf908572d5054.cloudfront.net (CloudFront)
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-amz-cf-pop
FRA2-C1
x-hs-alternate-content-type
text/plain
x-cache
RefreshHit from cloudfront
x-amz-meta-index-tag
all
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
x-amz-id-2
C+AUWGEFpk1BXj5vyy9P8o862b/vDMkxHr5UclDeMnl3NzHB+wEp1AqP5FvevA5ezhbzaAXpaN0=
last-modified
Thu, 01 Apr 2021 02:23:43 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=O5Ea65Eg0eQ%2B2jLoav0g0Y%2FRWNGknmSi%2BF7REpnjtbcXFTDLkH0hbu1SXikoXv%2BqZZ0Z9te0Cr0h04KWdU3hjAgGx%2FmeCDh9P8RoZMsDyk2GXlvBGMBc3IIpgOyC4iP4PfiEVA%3D%3D"}],"group":"cf-nel","max_age":604800}
x-amz-version-id
j7TMxqcLHA18llA46ti9t98ENVzeqi8u
cf-ray
69a654bad8032c2a-FRA
x-amz-cf-id
f7lWL7Nm_NMbwBgpa0SoTzdb3a9iW1WC61LOcmcWMiTsHxtb6p9Hgw==
linkedin-gray.svg
www.cybereason.com/hubfs/dam/images/images-web/blog-images/template-images/ 		742 B
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.cybereason.com/hubfs/dam/images/images-web/blog-images/template-images/linkedin-gray.svg
Requested by
Host: www.cybereason.com
URL: https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
199.60.103.30 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
12127e3110351f54262db955bafe353593dd58c89c7f6b6fc159c10515e93c61

Request headers

:path
/hubfs/dam/images/images-web/blog-images/template-images/linkedin-gray.svg
pragma
no-cache
cookie
__cfruid=d7e721c13da4dff96ea791e26c85151287fa3558-1633601335
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
www.cybereason.com
referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

content-encoding
br
x-amz-meta-cache-tag
F-44570599712,FD-41718904629,P-3354902,FLS-ALL
age
567037
x-amz-server-side-encryption
AES256
edge-cache-tag
F-44570599712,FD-41718904629,P-3354902,FLS-ALL
x-edge-origin-shield-skipped
0
x-amz-replication-status
COMPLETED
x-hs-cf-lambda
us-east-1.enforceAclForReadsProd 12
x-amz-request-id
YQVYCPQWSEM6KN8B
etag
W/"446340b1a8e73ee28b1a47837a13fdf3"
vary
Accept-Encoding
access-control-allow-methods
GET
content-type
image/svg+xml
access-control-allow-origin
*
cache-control
s-maxage=1814400, max-age=1209600, stale-while-revalidate=900
x-robots-tag
all
x-hs-cf-lambda-enforce
us-east-1.enforceAclForReadsProd 12
x-amz-meta-created-unix-time-millis
1617758009375
date
Thu, 07 Oct 2021 10:08:55 GMT
via
1.1 8f20db43ba7579b7216cf908572d5054.cloudfront.net (CloudFront)
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-amz-cf-pop
FRA2-C1
x-hs-alternate-content-type
text/plain
x-cache
RefreshHit from cloudfront
x-amz-meta-index-tag
all
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
x-amz-id-2
DoKxaJwGHIWMboEIxiFAC9G+UEWG2hAirqg0OPuxOxBueak/I3drSWjDW/vsbJOOCpYY1OaW1qw=
last-modified
Wed, 07 Apr 2021 01:13:30 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=pwkP46b4mMdA%2FWlTG4fbhlKGf3%2BR4zgQCHpveb5HmzAbatgQbOvpzI%2B%2FcYfHHAJ8blhj3vWbDXh1%2Biu4Kao345eQe%2BMjGj2VmGpKvQhCS10MN1NJnRBQVF8nChIZ4fXa9HsRYQ%3D%3D"}],"group":"cf-nel","max_age":604800}
x-amz-version-id
cNQVyvptDzpT8RxIUtNpIf4tWlwMEFMh
cf-ray
69a654bad8042c2a-FRA
x-amz-cf-id
KTLcP7VEPmAMgOAndfblI0D-mvS4c1EA_nKrqqnj3VIlYRcu3RCKHg==
CR_Owl_Web_Mono@3x%202.png
www.cybereason.com/hubfs/ 		7 KB
8 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.cybereason.com/hubfs/CR_Owl_Web_Mono@3x%202.png
Requested by
Host: www.cybereason.com
URL: https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
199.60.103.30 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
8292049c0f7e7fc6406874e976ed7e4134d3e34c16a790084b51f48595848aa0

Request headers

:path
/hubfs/CR_Owl_Web_Mono@3x%202.png
pragma
no-cache
cookie
__cfruid=d7e721c13da4dff96ea791e26c85151287fa3558-1633601335
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
www.cybereason.com
referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

x-amz-meta-cache-tag
F-11216732180,P-3354902,FLS-ALL
age
567012
edge-cache-tag
F-11216732180,P-3354902,FLS-ALL
x-edge-origin-shield-skipped
0
content-disposition
inline; filename="CR_Owl_Web_Mono@3x%202.webp"
x-hs-cf-lambda
us-east-1.enforceAclForReadsProd 12
x-amz-request-id
1M05GM4H4RNFRK6H
cf-bgj
imgq:85,h2pri
etag
"5830fe3ad7045c6e2f662e6cb8ea7db9"
vary
Accept, Accept-Encoding
access-control-allow-methods
GET
content-type
image/webp
access-control-allow-origin
*
cache-control
s-maxage=1814400, max-age=1209600, stale-while-revalidate=900
x-hs-cf-lambda-enforce
us-east-1.enforceAclForReadsProd 12
date
Thu, 07 Oct 2021 10:08:55 GMT
via
1.1 1ac3fd533bf6be1b511077f8b8e23bfd.cloudfront.net (CloudFront)
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-amz-cf-pop
FRA2-C1
cf-polished
origFmt=png, origSize=18281
x-cache
RefreshHit from cloudfront
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length
7120
x-amz-id-2
FWVDbG/0nGtIF3SkxsiPK29rzCUKQ54jRDtSPovIYLnFVB6U53FVO5E8hHi98a0D9NnmHpfZ1E4=
last-modified
Fri, 12 Jul 2019 13:47:40 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=8qG%2BxOMcDKnYOliOtW73r9B85OCa2Ac9CENqX7I1OV%2BWGw9%2BLyhFjmHBU%2F0kIHAi76jF%2BWGMUutxXqstPpCjECnsA0gXOOD%2BJUg23vYeBm6sKPHJ2mv1STUaWVdtj3yktPIaMw%3D%3D"}],"group":"cf-nel","max_age":604800}
x-amz-version-id
nZ4bmwWnKhcTbz9EkpvMbukUoI6WISi.
accept-ranges
bytes
cf-ray
69a654bad8052c2a-FRA
x-amz-cf-id
YNV2iW3Eeb4Psi-dyYqNfKqNCcRMFlW2YkpRE0MAKzT2vXpniLGdmQ==
icon-social-gray-linkedin.png
www.cybereason.com/hubfs/dam/images/images-web/blog-images/template-images/ 		154 B
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.cybereason.com/hubfs/dam/images/images-web/blog-images/template-images/icon-social-gray-linkedin.png
Requested by
Host: www.cybereason.com
URL: https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
199.60.103.30 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
9586d0fb1354dd56116ff8e2bf4c54bb5e283cf33abd801f338ef6054c501978

Request headers

:path
/hubfs/dam/images/images-web/blog-images/template-images/icon-social-gray-linkedin.png
pragma
no-cache
cookie
__cfruid=d7e721c13da4dff96ea791e26c85151287fa3558-1633601335
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
www.cybereason.com
referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

x-amz-meta-cache-tag
F-44556752913,FD-41718904629,P-3354902,FLS-ALL
age
517898
x-amz-server-side-encryption
AES256
edge-cache-tag
F-44556752913,FD-41718904629,P-3354902,FLS-ALL
x-edge-origin-shield-skipped
0
x-amz-replication-status
COMPLETED
content-disposition
inline; filename="icon-social-gray-linkedin.webp"
x-hs-cf-lambda
us-east-1.enforceAclForReadsProd 12
x-amz-request-id
NE93M8FVTMKNWHE2
cf-bgj
imgq:85,h2pri
etag
"5b58aca254cf940946a8b643ac56bc3b"
vary
Accept, Accept-Encoding
access-control-allow-methods
GET
content-type
image/webp
access-control-allow-origin
*
cache-control
s-maxage=1814400, max-age=1209600, stale-while-revalidate=900
x-robots-tag
all
x-hs-cf-lambda-enforce
us-east-1.enforceAclForReadsProd 12
x-amz-meta-created-unix-time-millis
1617740300009
date
Thu, 07 Oct 2021 10:08:55 GMT
via
1.1 bb3ac1595bb014e3b09608a0358d33da.cloudfront.net (CloudFront)
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-amz-cf-pop
FRA56-P4
x-hs-alternate-content-type
text/plain
cf-polished
origFmt=png, origSize=228
x-cache
RefreshHit from cloudfront
x-amz-meta-index-tag
all
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length
154
x-amz-id-2
r1T7lHKETDyQ3VRMs+TEy0Kp46bLRQgxU1WwwdkYhRVRLbXBAKI1kJuyFNidVsW5b+IJi0qTJ6I=
last-modified
Tue, 06 Apr 2021 20:18:21 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=RRb9s3WTJYkOxY%2FhinyRNnTj387WDH87nnRbsdKovL30Sv7GXc2E5iD81wvzPB9JVqk3ShaMnLqY6PAlB%2BJ5lGWQipXPAwMskframTjvKqMKlX%2B90Ypu03H3x8RiRnTM9PlyLw%3D%3D"}],"group":"cf-nel","max_age":604800}
x-amz-version-id
QKZGjr11n8RfLL1jJfRJGaNCWnmOz1y4
accept-ranges
bytes
cf-ray
69a654bad8072c2a-FRA
x-amz-cf-id
I6LHsb2iUPNRqs3LcYkNXQXam5QKXNE03ROhItcw6LkmE4LwDF8bJg==
icon-social-gray-twitter.svg
www.cybereason.com/hubfs/dam/images/images-web/blog-images/template-images/ 		749 B
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.cybereason.com/hubfs/dam/images/images-web/blog-images/template-images/icon-social-gray-twitter.svg
Requested by
Host: www.cybereason.com
URL: https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
199.60.103.30 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
f9db6465a204cc4186368b72a0ba4f063e64569aa4fc96e0f40c7ac69423121b

Request headers

:path
/hubfs/dam/images/images-web/blog-images/template-images/icon-social-gray-twitter.svg
pragma
no-cache
cookie
__cfruid=d7e721c13da4dff96ea791e26c85151287fa3558-1633601335
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
www.cybereason.com
referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

content-encoding
br
x-amz-meta-cache-tag
F-43294710828,FD-41718904629,P-3354902,FLS-ALL
age
567037
x-amz-server-side-encryption
AES256
edge-cache-tag
F-43294710828,FD-41718904629,P-3354902,FLS-ALL
x-edge-origin-shield-skipped
0
x-amz-replication-status
COMPLETED
x-hs-cf-lambda
us-east-1.enforceAclForReadsProd 12
x-amz-request-id
1M0CVWMACWETB0N2
etag
W/"5c103d0cd978b3a8d7ccab6bff714599"
vary
Accept-Encoding
access-control-allow-methods
GET
content-type
image/svg+xml
access-control-allow-origin
*
cache-control
s-maxage=1814400, max-age=1209600, stale-while-revalidate=900
x-robots-tag
all
x-hs-cf-lambda-enforce
us-east-1.enforceAclForReadsProd 12
x-amz-meta-created-unix-time-millis
1616007053027
date
Thu, 07 Oct 2021 10:08:55 GMT
via
1.1 b6d1611761652d7a383651f2bf480596.cloudfront.net (CloudFront)
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-amz-cf-pop
FRA2-C1
x-hs-alternate-content-type
text/plain
x-cache
RefreshHit from cloudfront
x-amz-meta-index-tag
all
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
x-amz-id-2
slGParxjmFR85417Qakm39rYVwNbUR7Ijuu1HXyMlvZVTa4J9x8K+1uLDy+UHi7CeArKFpD9k1Y=
last-modified
Wed, 17 Mar 2021 18:50:54 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Rzul7ysWbfAUUkhWdQlRW0uou8cwzcWrxA7NwyilJMtaWg1AhQ9bsLF%2B09dfG70za2%2BEwuvvOY%2FwqYXl8KMmAh8YXV65c85cjWUHIQBPVdiz55zpq%2B1wgsQEKmxffl2CfHbkbQ%3D%3D"}],"group":"cf-nel","max_age":604800}
x-amz-version-id
NF3dgF5tFLaoFoVElEGWcy105X0OE1GX
cf-ray
69a654bad8082c2a-FRA
x-amz-cf-id
2d51YMuNEDSsFWETWDmgAs00ZpCgYpBu4sE51Y19AQj5Quemq-SVWg==
cr-logo-web-horizontal-white-500px.png
www.cybereason.com/hubfs/dam/images/images-web/logos/ 		5 KB
6 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.cybereason.com/hubfs/dam/images/images-web/logos/cr-logo-web-horizontal-white-500px.png
Requested by
Host: www.cybereason.com
URL: https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
199.60.103.30 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
e25be07e98d8af6966a317f09b01392cce60447ed768a034ec1b18843ee6dcbc

Request headers

:path
/hubfs/dam/images/images-web/logos/cr-logo-web-horizontal-white-500px.png
pragma
no-cache
cookie
__cfruid=d7e721c13da4dff96ea791e26c85151287fa3558-1633601335
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
www.cybereason.com
referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

x-amz-meta-cache-tag
F-36665664687,FD-35695393279,P-3354902,FLS-ALL
age
569043
x-amz-server-side-encryption
AES256
edge-cache-tag
F-36665664687,FD-35695393279,P-3354902,FLS-ALL
x-edge-origin-shield-skipped
0
x-amz-replication-status
COMPLETED
content-disposition
inline; filename="cr-logo-web-horizontal-white-500px.webp"
x-hs-cf-lambda
us-east-1.enforceAclForReadsProd 12
x-amz-request-id
VWAW1C3V2J1HQKVT
cf-bgj
imgq:85,h2pri
etag
"767db0928e354898ad0d5be0b8913d27"
vary
Accept, Accept-Encoding
access-control-allow-methods
GET
content-type
image/webp
access-control-allow-origin
*
cache-control
s-maxage=1814400, max-age=1209600, stale-while-revalidate=900
x-robots-tag
all
x-hs-cf-lambda-enforce
us-east-1.enforceAclForReadsProd 12
x-amz-meta-created-unix-time-millis
1603732670178
date
Thu, 07 Oct 2021 10:08:55 GMT
via
1.1 ba5b5e2e7fd98c4a472633bc4c1d4480.cloudfront.net (CloudFront)
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-amz-cf-pop
FRA2-C1
x-hs-alternate-content-type
text/plain
cf-polished
origFmt=png, origSize=9464
x-cache
Miss from cloudfront
x-amz-meta-index-tag
all
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length
5068
x-amz-id-2
Xhonwn+GSdSmIFSwvVejCsmdB1EpkvNNa+uOfdP/4x+l2Ell/Vh3cRDiLMIGgrefrQBfJrnTjaI=
last-modified
Mon, 26 Oct 2020 17:18:29 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=hHcLrIGHG64OMkO%2FHrboeFH9Ot5YYXftgY666a7MYUC78VuAJ2eiJIeA1PEVenFWSuHMDfm0xFSWCaofWMz0XMDxT5aEcNppPm0lNwYjv7HWFj4woxF%2B0NuFq%2BwUvfFA3yY22Q%3D%3D"}],"group":"cf-nel","max_age":604800}
x-amz-version-id
rUG6Di0oDG3X0PJdHQ7Od_mXd6h0OgSj
accept-ranges
bytes
cf-ray
69a654bad8092c2a-FRA
x-amz-cf-id
Wmf_V6jR7zd5vIj0Zs4hRRm7dPP0cHzl8JdtYoAZN6dHwGc1pl5lCQ==
animatedModal.min.js
www.cybereason.com/hs-fs/hub/3354902/hub_generated/template_assets/42507089303/1614944819152/__CR_Web_Platform_2020/JS/animatedModal/ 		2 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.cybereason.com/hs-fs/hub/3354902/hub_generated/template_assets/42507089303/1614944819152/__CR_Web_Platform_2020/JS/animatedModal/animatedModal.min.js
Requested by
Host: www.cybereason.com
URL: https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
199.60.103.30 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
9ee63a2ce9251063533d17d87c6a2d7f06f0a3c0e38d8c9f107131ce580c057b

Request headers

:path
/hs-fs/hub/3354902/hub_generated/template_assets/42507089303/1614944819152/__CR_Web_Platform_2020/JS/animatedModal/animatedModal.min.js
pragma
no-cache
cookie
__cfruid=d7e721c13da4dff96ea791e26c85151287fa3558-1633601335
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
script
:authority
www.cybereason.com
referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

x-amz-meta-created-unix-time-millis
1614944819152
date
Thu, 07 Oct 2021 10:08:55 GMT
via
1.1 99baebf4b5bb631267dcfa82456151cc.cloudfront.net (CloudFront)
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
2272
x-hs-alternate-content-type
text/plain
x-amz-server-side-encryption
AES256
x-cache
RefreshHit from cloudfront
x-edge-origin-shield-skipped
0
x-amz-replication-status
COMPLETED
x-hs-cf-lambda
us-east-1.enforceAclForReadsProd 12
content-encoding
br
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
x-amz-request-id
YBPBWN5DC79NJJ8V
x-amz-id-2
14PF4IwtUv1Thi8lcawBUqjn2mvRUD4lolkMSYxlN0JERHgpjWg6A/I0hpjCSRbs/ulX9DSMO5o=
last-modified
Fri, 05 Mar 2021 11:47:00 GMT
server
cloudflare
etag
W/"7d1fd84ca69684424460a51e51bc07ff"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=H3ZD%2BBCz4%2FyrngYbn3SQNUH8gW%2FJnb467MSVsu3hOhMoa72pKHD0lcutJJVRCGEaoggRp%2Baoi0GArkHzyePOa4t5jINZg%2FINq0ld%2BNJvgUrCMpnR40SobvblqyWgnD3aynuC%2FQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript; charset=utf-8
cache-control
s-maxage=1814400, max-age=1209600, stale-while-revalidate=900, s-maxage=31536000, max-age=31536000
access-control-allow-credentials
false
x-amz-version-id
LoBDDMrdwgRqzOSnwGaf7mylhX0UQKlT
x-amz-cf-pop
IAD89-C1
cf-ray
69a654baaf992c2a-FRA
x-amz-cf-id
lFVH0XNnV8i7i9f87i9CeGJKo6D5iWGTSk8Jkz_vPbMMPNokLoY-GQ==
x-hs-cf-lambda-enforce
us-east-1.enforceAclForReadsProd 12
module_41681847227_CR_-_Malicious_Life_Network_--_Tier_One_Header.min.js
www.cybereason.com/hs-fs/hub/3354902/hub_generated/module_assets/41681847227/1619109182704/ 		374 B
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.cybereason.com/hs-fs/hub/3354902/hub_generated/module_assets/41681847227/1619109182704/module_41681847227_CR_-_Malicious_Life_Network_--_Tier_One_Header.min.js
Requested by
Host: www.cybereason.com
URL: https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
199.60.103.30 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
119bf322a2ce6d2a82422b51404bc54b375c881f12a120205598d1691fa48820

Request headers

:path
/hs-fs/hub/3354902/hub_generated/module_assets/41681847227/1619109182704/module_41681847227_CR_-_Malicious_Life_Network_--_Tier_One_Header.min.js
pragma
no-cache
cookie
__cfruid=d7e721c13da4dff96ea791e26c85151287fa3558-1633601335
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
script
:authority
www.cybereason.com
referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

x-amz-meta-created-unix-time-millis
1619109182704
date
Thu, 07 Oct 2021 10:08:55 GMT
via
1.1 824fe21e467658628899bdd8725649ee.cloudfront.net (CloudFront)
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
2271
x-hs-alternate-content-type
text/plain
x-amz-server-side-encryption
AES256
x-cache
RefreshHit from cloudfront
x-edge-origin-shield-skipped
0
x-amz-replication-status
COMPLETED
x-hs-cf-lambda
us-east-1.enforceAclForReadsProd 12
content-encoding
br
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
x-amz-request-id
N4M9EA064HQ5DXKP
x-amz-id-2
EFtfRQ4ZrNjbJm6DbHCIb5re8LP1DyAUWrkwTOb3sZbi/2Nms3M4qbkIjQ3LF6GvEjLHugSmBKY=
last-modified
Thu, 22 Apr 2021 16:33:03 GMT
server
cloudflare
etag
W/"1d7f81aaf24568ea5d90a82b829960fd"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2F4p8DtOU8SzYb8WJxref4P60mTD%2B14kILxODEd5fYWJHB8%2FB3TOrmVH0VNP1mef62EUHqrhBTm7NhiAsKFQXq5MBJKEPx%2Boe9iGxae9UzNa40UVPaXyqlNz3fCsrIs%2B%2BYvFHUw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript; charset=utf-8
cache-control
s-maxage=1814400, max-age=1209600, stale-while-revalidate=900, s-maxage=31536000, max-age=31536000
access-control-allow-credentials
false
x-amz-version-id
C.P0pbD1NccRhx0he3pMJ4DTBrrAsMcC
x-amz-cf-pop
IAD89-C1
cf-ray
69a654badfef2c2a-FRA
x-amz-cf-id
YIoCAEOYjhgcu2JxwafKyuMARVtfx1F-akEUDBvPrZ6lSuNjAKEFTw==
x-hs-cf-lambda-enforce
us-east-1.enforceAclForReadsProd 12
module_41682410610_CR_-_Malicious_Life_Network_--_Main_Hero.min.js
www.cybereason.com/hs-fs/hub/3354902/hub_generated/module_assets/41682410610/1618194602937/ 		305 B
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.cybereason.com/hs-fs/hub/3354902/hub_generated/module_assets/41682410610/1618194602937/module_41682410610_CR_-_Malicious_Life_Network_--_Main_Hero.min.js
Requested by
Host: www.cybereason.com
URL: https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
199.60.103.30 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
66ba9d76c09ad6dd52135d52c368f6d87ac40b5b4ce418e41a105fb221c7e470

Request headers

:path
/hs-fs/hub/3354902/hub_generated/module_assets/41682410610/1618194602937/module_41682410610_CR_-_Malicious_Life_Network_--_Main_Hero.min.js
pragma
no-cache
cookie
__cfruid=d7e721c13da4dff96ea791e26c85151287fa3558-1633601335
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
script
:authority
www.cybereason.com
referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

x-amz-meta-created-unix-time-millis
1618194602937
date
Thu, 07 Oct 2021 10:08:55 GMT
via
1.1 fba666ceffdeb316c8edf476d8994bd5.cloudfront.net (CloudFront)
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
2272
x-hs-alternate-content-type
text/plain
x-amz-server-side-encryption
AES256
x-cache
RefreshHit from cloudfront
x-edge-origin-shield-skipped
0
x-amz-replication-status
COMPLETED
x-hs-cf-lambda
us-east-1.enforceAclForReadsProd 12
content-encoding
br
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
x-amz-request-id
A3X1QJ5SPYSVTYAV
x-amz-id-2
TSyRagnsS5ELIWpgoWVIy204BrBatLwGB0OFlLN8v0xpttdZcmj5wAo0unTcNhSlSWdnjyKkG1A=
last-modified
Mon, 12 Apr 2021 02:30:03 GMT
server
cloudflare
etag
W/"86f1ecf1077302d6bd359676a0142438"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=XQoiibXI7gBqiCKoAZfnQPFikt533%2B0n6w%2F7pqcqQ9sqris5Ma%2BloO68NgOtzdZtHrv5otcuL%2Fw8eHq%2Fq%2BgI2xpqcCrf22OjXH7AufNOFB5FzzFQIDRU2%2BoiBQQqdyVN2OLK5A%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript; charset=utf-8
cache-control
s-maxage=1814400, max-age=1209600, stale-while-revalidate=900, s-maxage=31536000, max-age=31536000
access-control-allow-credentials
false
x-amz-version-id
04Ptd8a.kuxBPTQD52G.SU7PbmihQEv1
x-amz-cf-pop
IAD89-C1
cf-ray
69a654badff12c2a-FRA
x-amz-cf-id
Q7cZ5KJ_gledGr9lFu9jczTjgEK_6zRCyQlEkxYphUdWZA5E4wqtLw==
x-hs-cf-lambda-enforce
us-east-1.enforceAclForReadsProd 12
module_48386556055_CR_-_HTML_PopUp_Window_--_IOCs.min.js
www.cybereason.com/hs-fs/hub/3354902/hub_generated/module_assets/48386556055/1622817551100/ 		417 B
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.cybereason.com/hs-fs/hub/3354902/hub_generated/module_assets/48386556055/1622817551100/module_48386556055_CR_-_HTML_PopUp_Window_--_IOCs.min.js
Requested by
Host: www.cybereason.com
URL: https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
199.60.103.30 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
0a2eec7f18edeaecb0a4bbefcdfbb8abfcea0afd260fc4c4c0ae20e65241a093

Request headers

:path
/hs-fs/hub/3354902/hub_generated/module_assets/48386556055/1622817551100/module_48386556055_CR_-_HTML_PopUp_Window_--_IOCs.min.js
pragma
no-cache
cookie
__cfruid=d7e721c13da4dff96ea791e26c85151287fa3558-1633601335
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
script
:authority
www.cybereason.com
referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

x-amz-meta-created-unix-time-millis
1622817551100
date
Thu, 07 Oct 2021 10:08:55 GMT
via
1.1 50f5f6b4e0025748bb74dce1db44c750.cloudfront.net (CloudFront)
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
1848
x-hs-alternate-content-type
text/plain
x-amz-server-side-encryption
AES256
x-cache
RefreshHit from cloudfront
x-edge-origin-shield-skipped
0
x-amz-replication-status
COMPLETED
x-hs-cf-lambda
us-east-1.enforceAclForReadsProd 12
content-encoding
br
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
x-amz-request-id
3C3E4J3K9JJPQAKQ
x-amz-id-2
CwmIoobaARFTLCqnXClS3kqwy1vm2ecebyUCbWJf4FLEOHiZ9ez2N+VY4gZp7piXTteWRJtBY7I=
last-modified
Fri, 04 Jun 2021 14:39:12 GMT
server
cloudflare
etag
W/"7f22b2578e1adaedfb3994df89b8adfd"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=0fISNEQyB%2Ffwz0WICzatgx00sqz2Gx9ku8YFjFJVVrWPklxvouW0C3m6VbVIXFSk0LQZzPweAPiUtS5CokK0YEZMpjF4Iws9OJ9hR4Vb9Vb2bhwt6JQnPOhFYnqDEjjwdLjA6A%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript; charset=utf-8
cache-control
s-maxage=1814400, max-age=1209600, stale-while-revalidate=900, s-maxage=31536000, max-age=31536000
access-control-allow-credentials
false
x-amz-version-id
94DGu_PVrqJKQbRfd1EopDHUO9qOpdwo
x-amz-cf-pop
IAD89-C1
cf-ray
69a654badff62c2a-FRA
x-amz-cf-id
ucU2gL2fLshaEsNML_eft05n1pYmCTS6q7kiNMlfmJPVlX6yut21Gw==
x-hs-cf-lambda-enforce
us-east-1.enforceAclForReadsProd 12
3354902.js
www.cybereason.com/hs/scriptloader/ 		1 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.cybereason.com/hs/scriptloader/3354902.js
Requested by
Host: www.cybereason.com
URL: https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
199.60.103.30 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
d30f0b5cfc0677eb181d27a9a95e7646cb8619c39b61af0f314aabae8042c541

Request headers

:path
/hs/scriptloader/3354902.js
pragma
no-cache
cookie
__cfruid=d7e721c13da4dff96ea791e26c85151287fa3558-1633601335
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
script
:authority
www.cybereason.com
referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Thu, 07 Oct 2021 10:08:55 GMT
content-encoding
br
vary
Accept-Encoding
cf-cache-status
EXPIRED
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-hubspot-correlation-id
c1d1b5d1-6946-4ad5-8b12-f94d99773e1f
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
server
cloudflare
x-trace
2B82D850264F6765BFF59FCBAB3CA6196DD1784307000000000000000000
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
access-control-max-age
3600
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=vRdUp46bBDcX45U9CxEnUwgYuEO2qyXm0UjaExLAahIud1dHRv4EbaU%2BDybYJqHqj9X0wpgPx9l2J627fyx2ACwSKQzvgD5wSdsK%2FeCeqMqMwpXFJuHr3DiYWXaRYuoatSJmrQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript;charset=utf-8
cache-control
public, max-age=60
access-control-allow-credentials
true
cf-ray
69a654bad80b2c2a-FRA
expires
Thu, 07 Oct 2021 10:09:55 GMT
animate.min.css
cdnjs.cloudflare.com/ajax/libs/animate.css/4.1.1/ 		70 KB
5 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://cdnjs.cloudflare.com/ajax/libs/animate.css/4.1.1/animate.min.css
Requested by
Host: www.cybereason.com
URL: https://www.cybereason.com/hs-fs/hub/3354902/hub_generated/template_assets/34470477360/1632935872906/__CR_Web_Platform_2020/CSS/cr-master__main.min.css
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.16.19.94 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
5fbaeb9f8e25d7e0143bae61d4b1802c16ce7390b96ceb2d498b0d96ff4c853f
Security Headers
Name Value
Strict-Transport-Security max-age=15780000
X-Content-Type-Options nosniff

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.cybereason.com/hs-fs/hub/3354902/hub_generated/template_assets/34470477360/1632935872906/__CR_Web_Platform_2020/CSS/cr-master__main.min.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Thu, 07 Oct 2021 10:08:55 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age
1272991
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length
4216
timing-allow-origin
*
last-modified
Mon, 07 Sep 2020 12:33:38 GMT
server
cloudflare
cf-cdnjs-via
cfworker/kv
etag
"5f5628a2-11846"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=15780000
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=GlCev2a7SsUvLyS8rMrRbUXv9SBT6JmBsjqeZuAyCFSPxgOHyxVIg26dZBSqkRarWcbEOSDkg1tysd3nRsiG24E5C3IkOMcWJjAvhzcuSHQ1IXUmxN9UP2Ga3El88q%2BkpcIjHywE"}],"group":"cf-nel","max_age":604800}
content-type
text/css; charset=utf-8
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=30672000
accept-ranges
bytes
cf-ray
69a654ba6a520614-FRA
expires
Tue, 27 Sep 2022 10:08:55 GMT
css2
fonts.googleapis.com/ 		19 KB
2 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://fonts.googleapis.com/css2?family=Barlow:ital,wght@0,100;0,200;0,300;0,400;0,500;0,600;0,700;0,800;0,900;1,100;1,200;1,300;1,400;1,500;1,600;1,700;1,800;1,900&display=swap
Requested by
Host: www.cybereason.com
URL: https://www.cybereason.com/hs-fs/hub/3354902/hub_generated/template_assets/34470477360/1632935872906/__CR_Web_Platform_2020/CSS/cr-master__main.min.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.18.106 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
zrh04s05-in-f106.1e100.net
Software
ESF /
Resource Hash
6af036a4ec23088a2e702e364d84320dbcd420a0c8c5ef82bac37006554e3ea6
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.cybereason.com/hs-fs/hub/3354902/hub_generated/template_assets/34470477360/1632935872906/__CR_Web_Platform_2020/CSS/cr-master__main.min.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection
0
last-modified
Thu, 07 Oct 2021 09:09:55 GMT
server
ESF
date
Thu, 07 Oct 2021 10:08:55 GMT
x-frame-options
SAMEORIGIN
report-to
{"group":"AZM8iraMxxUfRnRum-EGst9UuHcPNVSf9Kp1_90wIgU","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/encsid_AZM8iraMxxUfRnRum-EGst9UuHcPNVSf9Kp1_90wIgU"}]}
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
cross-origin-opener-policy-report-only
same-origin; report-to="AZM8iraMxxUfRnRum-EGst9UuHcPNVSf9Kp1_90wIgU"
expires
Thu, 07 Oct 2021 10:08:55 GMT
css2
fonts.googleapis.com/ 		20 KB
991 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://fonts.googleapis.com/css2?family=Barlow+Condensed:ital,wght@0,100;0,200;0,300;0,400;0,500;0,600;0,700;0,800;0,900;1,100;1,200;1,300;1,400;1,500;1,600;1,700;1,800;1,900&display=swap
Requested by
Host: www.cybereason.com
URL: https://www.cybereason.com/hs-fs/hub/3354902/hub_generated/template_assets/34470477360/1632935872906/__CR_Web_Platform_2020/CSS/cr-master__main.min.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.18.106 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
zrh04s05-in-f106.1e100.net
Software
ESF /
Resource Hash
0ea7d23d55fdda4f42a373f9a16ddb9a744c682714a9516dc95e9acdc5b3ce40
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.cybereason.com/hs-fs/hub/3354902/hub_generated/template_assets/34470477360/1632935872906/__CR_Web_Platform_2020/CSS/cr-master__main.min.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection
0
last-modified
Thu, 07 Oct 2021 10:08:55 GMT
server
ESF
date
Thu, 07 Oct 2021 10:08:55 GMT
x-frame-options
SAMEORIGIN
report-to
{"group":"AZM8iraMxxUfRnRum-EGst9UuHcPNVSf9Kp1_90wIgU","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/encsid_AZM8iraMxxUfRnRum-EGst9UuHcPNVSf9Kp1_90wIgU"}]}
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
cross-origin-opener-policy-report-only
same-origin; report-to="AZM8iraMxxUfRnRum-EGst9UuHcPNVSf9Kp1_90wIgU"
expires
Thu, 07 Oct 2021 10:08:55 GMT
css2
fonts.googleapis.com/ 		46 KB
2 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://fonts.googleapis.com/css2?family=Barlow:ital,wght@0,100;0,200;0,300;0,400;0,500;0,600;0,700;0,800;0,900;1,100;1,200;1,300;1,400;1,500;1,600;1,700;1,800;1,900&family=Open+Sans:ital,wght@0,300;0,400;0,600;0,700;0,800;1,300;1,400;1,600;1,700;1,800&display=swap
Requested by
Host: www.cybereason.com
URL: https://www.cybereason.com/hs-fs/hub/3354902/hub_generated/template_assets/34470477360/1632935872906/__CR_Web_Platform_2020/CSS/cr-master__main.min.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.18.106 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
zrh04s05-in-f106.1e100.net
Software
ESF /
Resource Hash
5df981fec90b8eaea5545cd73ff279821506b668644df536419881bc07653ba3
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.cybereason.com/hs-fs/hub/3354902/hub_generated/template_assets/34470477360/1632935872906/__CR_Web_Platform_2020/CSS/cr-master__main.min.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection
0
last-modified
Thu, 07 Oct 2021 10:08:55 GMT
server
ESF
date
Thu, 07 Oct 2021 10:08:55 GMT
x-frame-options
SAMEORIGIN
report-to
{"group":"AZM8iraMxxUfRnRum-EGst9UuHcPNVSf9Kp1_90wIgU","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/encsid_AZM8iraMxxUfRnRum-EGst9UuHcPNVSf9Kp1_90wIgU"}]}
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
cross-origin-opener-policy-report-only
same-origin; report-to="AZM8iraMxxUfRnRum-EGst9UuHcPNVSf9Kp1_90wIgU"
expires
Thu, 07 Oct 2021 10:08:55 GMT
cr-blog-hero-owl-transparent.png
www.cybereason.com/hubfs/dam/images/images-web/blog-images/template-images/ 		464 KB
466 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.cybereason.com/hubfs/dam/images/images-web/blog-images/template-images/cr-blog-hero-owl-transparent.png
Requested by
Host: www.cybereason.com
URL: https://www.cybereason.com/hs-fs/hub/3354902/hub_generated/module_assets/41682410610/1618194603032/module_41682410610_CR_-_Malicious_Life_Network_--_Main_Hero.min.css
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
199.60.103.30 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
51443fc1aa325f301b39d89ffeae8f8a7833ed59491b89419902b32ef30b3b39

Request headers

:path
/hubfs/dam/images/images-web/blog-images/template-images/cr-blog-hero-owl-transparent.png
pragma
no-cache
cookie
__cfruid=d7e721c13da4dff96ea791e26c85151287fa3558-1633601335
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
www.cybereason.com
referer
https://www.cybereason.com/hs-fs/hub/3354902/hub_generated/module_assets/41682410610/1618194603032/module_41682410610_CR_-_Malicious_Life_Network_--_Main_Hero.min.css
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://www.cybereason.com/hs-fs/hub/3354902/hub_generated/module_assets/41682410610/1618194603032/module_41682410610_CR_-_Malicious_Life_Network_--_Main_Hero.min.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

x-amz-meta-cache-tag
F-41719333184,FD-41718904629,P-3354902,FLS-ALL
age
567036
x-amz-server-side-encryption
AES256
edge-cache-tag
F-41719333184,FD-41718904629,P-3354902,FLS-ALL
x-edge-origin-shield-skipped
0
x-amz-replication-status
COMPLETED
content-disposition
inline; filename="cr-blog-hero-owl-transparent.webp"
x-hs-cf-lambda
us-east-1.enforceAclForReadsProd 12
x-amz-request-id
0D2JN7YYHJZ5919B
cf-bgj
imgq:85,h2pri
etag
"cd208635457bf65f33aa7c8849efcf21"
vary
Accept, Accept-Encoding
access-control-allow-methods
GET
content-type
image/webp
access-control-allow-origin
*
cache-control
s-maxage=1814400, max-age=1209600, stale-while-revalidate=900
x-robots-tag
all
x-hs-cf-lambda-enforce
us-east-1.enforceAclForReadsProd 12
x-amz-meta-created-unix-time-millis
1613708850431
date
Thu, 07 Oct 2021 10:08:55 GMT
via
1.1 41f60102fc29156bc5001d6646f75c02.cloudfront.net (CloudFront)
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-amz-cf-pop
FRA2-C1
x-hs-alternate-content-type
text/plain
cf-polished
origFmt=png, origSize=685987
x-cache
RefreshHit from cloudfront
x-amz-meta-index-tag
all
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length
475630
x-amz-id-2
VMKaVs3CoiNxvO9uDU3G1e2Yei2z8pHddn/VQ5tmETV0kE5OXzx0ttLMZbaSqMcuuGm9oUmDq+w=
last-modified
Fri, 19 Feb 2021 04:27:31 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=QoCo7HXOPSjrwgs56%2B%2FaGc6tpzGGKPs3cJuzIKyR%2BM8Hz1z%2BnAvxXBM8nqeNOaq740ZQNpYXJ%2F0BVU8Y0bS15zL56NWtL9qejqihAa72hQWmzMYmDCGYlarslorGIygYKpX60g%3D%3D"}],"group":"cf-nel","max_age":604800}
x-amz-version-id
pMBSD6mHHoba7vVAwnZHReLD9ID8b41e
accept-ranges
bytes
cf-ray
69a654baf8262c2a-FRA
x-amz-cf-id
_oY5z62GC4nhCaFRqXG_or82G2_tulcEUirQxLlsEmM8Qg8YfyX5FA==
cr-mln-network__footer-subscribe-bg.png
www.cybereason.com/hubfs/dam/images/images-web/blog-images/template-images/ 		17 KB
18 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.cybereason.com/hubfs/dam/images/images-web/blog-images/template-images/cr-mln-network__footer-subscribe-bg.png
Requested by
Host: www.cybereason.com
URL: https://www.cybereason.com/hs-fs/hub/3354902/hub_generated/template_assets/42760289143/1624557581500/__CR_Web_Platform_2020/CSS/cr-mln__build.min.css
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
199.60.103.30 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
218877f60296297dec8266377083291f36d46f2980c1ff027471904470d14f49

Request headers

:path
/hubfs/dam/images/images-web/blog-images/template-images/cr-mln-network__footer-subscribe-bg.png
pragma
no-cache
cookie
__cfruid=d7e721c13da4dff96ea791e26c85151287fa3558-1633601335
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
www.cybereason.com
referer
https://www.cybereason.com/hs-fs/hub/3354902/hub_generated/template_assets/42760289143/1624557581500/__CR_Web_Platform_2020/CSS/cr-mln__build.min.css
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://www.cybereason.com/hs-fs/hub/3354902/hub_generated/template_assets/42760289143/1624557581500/__CR_Web_Platform_2020/CSS/cr-mln__build.min.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

x-amz-meta-cache-tag
F-42844750665,FD-41718904629,P-3354902,FLS-ALL
age
567036
x-amz-server-side-encryption
AES256
edge-cache-tag
F-42844750665,FD-41718904629,P-3354902,FLS-ALL
x-edge-origin-shield-skipped
0
x-amz-replication-status
COMPLETED
content-disposition
inline; filename="cr-mln-network__footer-subscribe-bg.webp"
x-hs-cf-lambda
us-east-1.enforceAclForReadsProd 12
x-amz-request-id
PCB40S46HGBFTDBV
cf-bgj
imgq:85,h2pri
etag
"c28026bc6a6d55f395e2227b7b19c8c9"
vary
Accept, Accept-Encoding
access-control-allow-methods
GET
content-type
image/webp
access-control-allow-origin
*
cache-control
s-maxage=1814400, max-age=1209600, stale-while-revalidate=900
x-robots-tag
all
x-hs-cf-lambda-enforce
us-east-1.enforceAclForReadsProd 12
x-amz-meta-created-unix-time-millis
1615403417467
date
Thu, 07 Oct 2021 10:08:55 GMT
via
1.1 dde0b4b1e223fa23670e93078a04c116.cloudfront.net (CloudFront)
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-amz-cf-pop
FRA2-C1
x-hs-alternate-content-type
text/plain
cf-polished
origFmt=png, origSize=76527
x-cache
RefreshHit from cloudfront
x-amz-meta-index-tag
all
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length
17430
x-amz-id-2
McQVLbOhPw2AeVUwMicslop4XKbiTw4B0ZgwVh45moZX9w575aYN8IKx4srBwIvMQgGgqrYinM8=
last-modified
Wed, 10 Mar 2021 19:10:18 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=x8kz38d3eoVm2Bf%2BUWIV2sJd4BiW2Bmws9XI%2BeJZ%2BdrT8YvlAiau1MUVFq9nRluoaLOl5Ur0XwI%2FDoLaEQJIifcgUGc6pcajCJcMjcA7y17xB6nycjXPBC0DI34hgzx7DUmShA%3D%3D"}],"group":"cf-nel","max_age":604800}
x-amz-version-id
re8UAqBG9Z9r42hnTIwXdZAL52u2VF_w
accept-ranges
bytes
cf-ray
69a654baf8372c2a-FRA
x-amz-cf-id
T2lCbdzUg7PbUGD6x1VYIfkJAJQPixi-_LZdlSg015XfzTkIiM_yng==
memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2
fonts.gstatic.com/s/opensans/v26/ 		44 KB
44 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/opensans/v26/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Barlow:ital,wght@0,100;0,200;0,300;0,400;0,500;0,600;0,700;0,800;0,900;1,100;1,200;1,300;1,400;1,500;1,600;1,700;1,800;1,900&family=Open+Sans:ital,wght@0,300;0,400;0,600;0,700;0,800;1,300;1,400;1,600;1,700;1,800&display=swap
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.186.35 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s04-in-f3.1e100.net
Software
sffe /
Resource Hash
538dd4ff6e384a44155168326ac40a6c20a93cd212b1fbf88ae7b0c44f9ab0bd
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://www.cybereason.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Thu, 30 Sep 2021 17:03:52 GMT
x-content-type-options
nosniff
age
579903
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
44760
x-xss-protection
0
last-modified
Thu, 23 Sep 2021 16:50:17 GMT
server
sffe
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="apps-themes"
expires
Fri, 30 Sep 2022 17:03:52 GMT
ionicons.ttf
www.cybereason.com/hubfs/__dam/fonts/ 		184 KB
107 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://www.cybereason.com/hubfs/__dam/fonts/ionicons.ttf
Requested by
Host: www.cybereason.com
URL: https://www.cybereason.com/hs-fs/hub/3354902/hub_generated/template_assets/35275979682/1600880367101/__CR_Web_Platform_2020/CSS/ionicons.min.css
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
199.60.103.30 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
2ba7f20b1d8990e17a47fe3d88e4c766628aaa2baf1dd30fca0a0db59836f5f9

Request headers

sec-fetch-mode
cors
origin
https://www.cybereason.com
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
sec-fetch-dest
font
cookie
__cfruid=d7e721c13da4dff96ea791e26c85151287fa3558-1633601335
:path
/hubfs/__dam/fonts/ionicons.ttf
pragma
no-cache
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept
*/*
cache-control
no-cache
:authority
www.cybereason.com
referer
https://www.cybereason.com/hs-fs/hub/3354902/hub_generated/template_assets/35275979682/1600880367101/__CR_Web_Platform_2020/CSS/ionicons.min.css
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://www.cybereason.com/hs-fs/hub/3354902/hub_generated/template_assets/35275979682/1600880367101/__CR_Web_Platform_2020/CSS/ionicons.min.css
Origin
https://www.cybereason.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

content-encoding
br
x-amz-meta-cache-tag
F-35275624221,FD-35275624214,P-3354902,FLS-ALL
age
569041
x-amz-server-side-encryption
AES256
edge-cache-tag
F-35275624221,FD-35275624214,P-3354902,FLS-ALL
x-edge-origin-shield-skipped
0
x-amz-replication-status
COMPLETED
x-hs-cf-lambda
us-east-1.enforceAclForReadsProd 12
x-amz-request-id
HD5F0YW69P9QPJG3
etag
W/"24712f6c47821394fba7942fbb52c3b2"
vary
Accept-Encoding
access-control-allow-methods
GET
content-type
font/ttf
access-control-allow-origin
*
cache-control
s-maxage=1814400, max-age=1209600, stale-while-revalidate=900
x-robots-tag
all
x-hs-cf-lambda-enforce
us-east-1.enforceAclForReadsProd 12
x-amz-meta-created-unix-time-millis
1600860540619
date
Thu, 07 Oct 2021 10:08:55 GMT
via
1.1 96283be49fd5bce30b3a0e9559bd2d9e.cloudfront.net (CloudFront)
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-amz-cf-pop
FRA2-C1
x-hs-alternate-content-type
text/plain
x-cache
RefreshHit from cloudfront
x-amz-meta-index-tag
all
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
x-amz-id-2
Yb65YVqHnoMRvpjqsIwmr+8h2RudqeGK3unJ7DbcwNTMpesVMRf/qyOloNd1YMZovMoGKqI5H0Y=
last-modified
Fri, 25 Sep 2020 09:38:00 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=475%2FJ7An8oXTt8vLTlYMNJXI23asmXD2AzDyxIArPMszlPhjQNydww9MRkUJ7UWZ29S2urGuO45kyRY4i9eLOuGCp1SYXVhRXSM0e%2BGPIPrlKRA%2BexqwAZNCwkye6p1%2FDfNqTA%3D%3D"}],"group":"cf-nel","max_age":604800}
x-amz-version-id
jxZ9WTKM12FAq58JViQDodht0EN9wNZx
cf-ray
69a654bb185c2c2a-FRA
x-amz-cf-id
0oO8--K2V89t8kPPt_kY2gd4V94OHZF1ulFjW8zcmHGIcNpV-YIkLg==
7cHqv4kjgoGqM7E3_-gs51os.woff2
fonts.gstatic.com/s/barlow/v5/ 		20 KB
20 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/barlow/v5/7cHqv4kjgoGqM7E3_-gs51os.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Barlow:ital,wght@0,100;0,200;0,300;0,400;0,500;0,600;0,700;0,800;0,900;1,100;1,200;1,300;1,400;1,500;1,600;1,700;1,800;1,900&display=swap
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.186.35 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s04-in-f3.1e100.net
Software
sffe /
Resource Hash
bf6c1e2f8c250b7efeb5d250181599880b1c17efc3c94466aa5d847454bf14ef
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://www.cybereason.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Mon, 04 Oct 2021 20:14:09 GMT
x-content-type-options
nosniff
age
222886
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
20348
x-xss-protection
0
last-modified
Thu, 10 Sep 2020 17:07:49 GMT
server
sffe
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Tue, 04 Oct 2022 20:14:09 GMT
7cHqv4kjgoGqM7E30-8s51os.woff2
fonts.gstatic.com/s/barlow/v5/ 		21 KB
21 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/barlow/v5/7cHqv4kjgoGqM7E30-8s51os.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Barlow:ital,wght@0,100;0,200;0,300;0,400;0,500;0,600;0,700;0,800;0,900;1,100;1,200;1,300;1,400;1,500;1,600;1,700;1,800;1,900&display=swap
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.186.35 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s04-in-f3.1e100.net
Software
sffe /
Resource Hash
46710f0509008ad4a31212927e35441764b757d672b2ed4f892ee4e2f0804abb
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://www.cybereason.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Mon, 04 Oct 2021 18:06:12 GMT
x-content-type-options
nosniff
age
230563
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
21072
x-xss-protection
0
last-modified
Thu, 10 Sep 2020 17:05:33 GMT
server
sffe
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="apps-themes"
expires
Tue, 04 Oct 2022 18:06:12 GMT
7cHqv4kjgoGqM7E3t-4s51os.woff2
fonts.gstatic.com/s/barlow/v5/ 		21 KB
21 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/barlow/v5/7cHqv4kjgoGqM7E3t-4s51os.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Barlow:ital,wght@0,100;0,200;0,300;0,400;0,500;0,600;0,700;0,800;0,900;1,100;1,200;1,300;1,400;1,500;1,600;1,700;1,800;1,900&display=swap
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.186.35 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s04-in-f3.1e100.net
Software
sffe /
Resource Hash
4c52e4274ebdbe29cd5b4983d888c247496b6d3bb55e05d4c0769d1b946d14f8
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://www.cybereason.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Mon, 04 Oct 2021 10:43:50 GMT
x-content-type-options
nosniff
age
257105
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
21080
x-xss-protection
0
last-modified
Thu, 10 Sep 2020 17:05:19 GMT
server
sffe
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Tue, 04 Oct 2022 10:43:50 GMT
7cHpv4kjgoGqM7E_DMs5.woff2
fonts.gstatic.com/s/barlow/v5/ 		20 KB
20 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/barlow/v5/7cHpv4kjgoGqM7E_DMs5.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Barlow:ital,wght@0,100;0,200;0,300;0,400;0,500;0,600;0,700;0,800;0,900;1,100;1,200;1,300;1,400;1,500;1,600;1,700;1,800;1,900&display=swap
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.186.35 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s04-in-f3.1e100.net
Software
sffe /
Resource Hash
023694a0472dde38c6600bf88e6330765839e53f64f94edb63714aeab3de7e51
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://www.cybereason.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Mon, 04 Oct 2021 18:11:51 GMT
x-content-type-options
nosniff
age
230224
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
20444
x-xss-protection
0
last-modified
Thu, 10 Sep 2020 17:04:46 GMT
server
sffe
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="apps-themes"
expires
Tue, 04 Oct 2022 18:11:51 GMT
memtYaGs126MiZpBA-UFUIcVXSCEkx2cmqvXlWqWuU6F.woff2
fonts.gstatic.com/s/opensans/v26/ 		47 KB
47 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/opensans/v26/memtYaGs126MiZpBA-UFUIcVXSCEkx2cmqvXlWqWuU6F.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Barlow:ital,wght@0,100;0,200;0,300;0,400;0,500;0,600;0,700;0,800;0,900;1,100;1,200;1,300;1,400;1,500;1,600;1,700;1,800;1,900&family=Open+Sans:ital,wght@0,300;0,400;0,600;0,700;0,800;1,300;1,400;1,600;1,700;1,800&display=swap
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.186.35 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s04-in-f3.1e100.net
Software
sffe /
Resource Hash
d8dee5bb67e8a759f73dfbaeadba9220ad478a8187f58a59a50f906b0e51f65b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://www.cybereason.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Thu, 30 Sep 2021 17:07:44 GMT
x-content-type-options
nosniff
age
579671
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
47804
x-xss-protection
0
last-modified
Thu, 23 Sep 2021 16:51:13 GMT
server
sffe
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="apps-themes"
expires
Fri, 30 Sep 2022 17:07:44 GMT
HTxwL3I-JCGChYJ8VI-L6OO_au7B46r2z3bWuQ.woff2
fonts.gstatic.com/s/barlowcondensed/v5/ 		20 KB
20 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/barlowcondensed/v5/HTxwL3I-JCGChYJ8VI-L6OO_au7B46r2z3bWuQ.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Barlow+Condensed:ital,wght@0,100;0,200;0,300;0,400;0,500;0,600;0,700;0,800;0,900;1,100;1,200;1,300;1,400;1,500;1,600;1,700;1,800;1,900&display=swap
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.186.35 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s04-in-f3.1e100.net
Software
sffe /
Resource Hash
63e0d1cf0ded40281f4b4c439d8c6e6630e3b31acf44d0d198e2513680c4bac9
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://www.cybereason.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Mon, 04 Oct 2021 18:09:10 GMT
x-content-type-options
nosniff
age
230385
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
20676
x-xss-protection
0
last-modified
Thu, 10 Sep 2020 17:03:52 GMT
server
sffe
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="apps-themes"
expires
Tue, 04 Oct 2022 18:09:10 GMT
HTxwL3I-JCGChYJ8VI-L6OO_au7B4873z3bWuQ.woff2
fonts.gstatic.com/s/barlowcondensed/v5/ 		20 KB
20 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/barlowcondensed/v5/HTxwL3I-JCGChYJ8VI-L6OO_au7B4873z3bWuQ.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Barlow+Condensed:ital,wght@0,100;0,200;0,300;0,400;0,500;0,600;0,700;0,800;0,900;1,100;1,200;1,300;1,400;1,500;1,600;1,700;1,800;1,900&display=swap
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.186.35 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s04-in-f3.1e100.net
Software
sffe /
Resource Hash
604f11b1aa0c94217abb80eb7a5c7de728f9463e4f045fe8a34339f438a50cec
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://www.cybereason.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Wed, 06 Oct 2021 03:46:39 GMT
x-content-type-options
nosniff
age
109336
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
20500
x-xss-protection
0
last-modified
Thu, 10 Sep 2020 17:03:29 GMT
server
sffe
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="apps-themes"
expires
Thu, 06 Oct 2022 03:46:39 GMT
HTxwL3I-JCGChYJ8VI-L6OO_au7B4-Lwz3bWuQ.woff2
fonts.gstatic.com/s/barlowcondensed/v5/ 		19 KB
19 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/barlowcondensed/v5/HTxwL3I-JCGChYJ8VI-L6OO_au7B4-Lwz3bWuQ.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Barlow+Condensed:ital,wght@0,100;0,200;0,300;0,400;0,500;0,600;0,700;0,800;0,900;1,100;1,200;1,300;1,400;1,500;1,600;1,700;1,800;1,900&display=swap
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.186.35 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s04-in-f3.1e100.net
Software
sffe /
Resource Hash
979ddb6f0c77e6744b104f96e9d7ab0f8fc56d7f24ab10d853e4e96fa425e9c5
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://www.cybereason.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Sun, 03 Oct 2021 12:53:33 GMT
x-content-type-options
nosniff
age
335722
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
19724
x-xss-protection
0
last-modified
Thu, 10 Sep 2020 17:03:43 GMT
server
sffe
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="apps-themes"
expires
Mon, 03 Oct 2022 12:53:33 GMT
HTxwL3I-JCGChYJ8VI-L6OO_au7B47rxz3bWuQ.woff2
fonts.gstatic.com/s/barlowcondensed/v5/ 		19 KB
19 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/barlowcondensed/v5/HTxwL3I-JCGChYJ8VI-L6OO_au7B47rxz3bWuQ.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Barlow+Condensed:ital,wght@0,100;0,200;0,300;0,400;0,500;0,600;0,700;0,800;0,900;1,100;1,200;1,300;1,400;1,500;1,600;1,700;1,800;1,900&display=swap
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.186.35 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s04-in-f3.1e100.net
Software
sffe /
Resource Hash
bb40a0a0cec6732e3ed3fb49ad3933f72f441e28585dfaea5e58035f5520709c
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://www.cybereason.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Wed, 06 Oct 2021 08:44:11 GMT
x-content-type-options
nosniff
age
91484
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
19468
x-xss-protection
0
last-modified
Thu, 10 Sep 2020 17:03:05 GMT
server
sffe
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="apps-themes"
expires
Thu, 06 Oct 2022 08:44:11 GMT
image35-3.png
www.cybereason.com/hs-fs/hubfs/ 		9 KB
10 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.cybereason.com/hs-fs/hubfs/image35-3.png?width=609&name=image35-3.png
Requested by
Host: www.cybereason.com
URL: https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
199.60.103.30 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
e6b6cd7a4fc13d7fd71a9b17195f51e5888ba257d487fc6bdde79690fe5f955e

Request headers

:path
/hs-fs/hubfs/image35-3.png?width=609&name=image35-3.png
pragma
no-cache
cookie
__cfruid=d7e721c13da4dff96ea791e26c85151287fa3558-1633601335
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
www.cybereason.com
referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

age
352206
x-amz-server-side-encryption
AES256
edge-cache-tag
F-56556607860,P-3354902,FLS-ALL
x-edge-origin-shield-skipped
0
x-amz-replication-status
COMPLETED
content-disposition
inline; filename="image35-3.webp"
x-hs-cf-lambda
us-east-1.enforceAclForReadsProd 12
cf-bgj
imgq:85,h2pri
etag
"90b3ec7231882349cde010e185d2d567"
vary
Accept, Accept-Encoding
x-amz-meta-created-unix-time-millis
1633114224441
content-type
image/webp
cache-control
s-maxage=1814400, max-age=1209600, stale-while-revalidate=900
x-robots-tag
all
x-hs-cf-lambda-enforce
us-east-1.enforceAclForReadsProd 12
date
Thu, 07 Oct 2021 10:08:55 GMT
via
1.1 824fe21e467658628899bdd8725649ee.cloudfront.net (CloudFront)
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-amz-cf-pop
IAD89-C1
x-hs-alternate-content-type
text/plain
cf-polished
origFmt=png, origSize=18784
x-cache
RefreshHit from cloudfront
x-amz-meta-index-tag
all
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length
9174
last-modified
Fri, 01 Oct 2021 18:50:25 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ScTeVhNpxr6fOP9mf6sELyj9SHWoTmzH2NODwFVplB97grNbLsm71ctetVSg0qyK7%2FFWdmHuTU4WDXTlnz4CDyShvcy3Pw2pIJq2xZfbr3aJpi36MuT1GvBnCt3%2Fn3lI12b%2FAQ%3D%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-credentials
false
accept-ranges
bytes
cf-ray
69a654bba97a2c2a-FRA
x-amz-cf-id
_91sG_5bhoVZCEy06bznrI61rA75OdbvSqTpqMv_uezqxEvSPK7Tjg==
image5-Oct-01-2021-06-01-05-16-PM.png
www.cybereason.com/hs-fs/hubfs/ 		8 KB
9 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.cybereason.com/hs-fs/hubfs/image5-Oct-01-2021-06-01-05-16-PM.png?width=676&name=image5-Oct-01-2021-06-01-05-16-PM.png
Requested by
Host: www.cybereason.com
URL: https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
199.60.103.30 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
520be9aa9d6c5a6b301f92ba52999af829167a848052975840193aaf1d0ced1e

Request headers

:path
/hs-fs/hubfs/image5-Oct-01-2021-06-01-05-16-PM.png?width=676&name=image5-Oct-01-2021-06-01-05-16-PM.png
pragma
no-cache
cookie
__cfruid=d7e721c13da4dff96ea791e26c85151287fa3558-1633601335
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
www.cybereason.com
referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

age
352206
x-amz-server-side-encryption
AES256
edge-cache-tag
F-56551976499,P-3354902,FLS-ALL
x-edge-origin-shield-skipped
0
x-amz-replication-status
COMPLETED
content-disposition
inline; filename="image5-Oct-01-2021-06-01-05-16-PM.webp"
x-hs-cf-lambda
us-east-1.enforceAclForReadsProd 12
cf-bgj
imgq:85,h2pri
etag
"7bf5bcb6ba7cc1b5109d88c6e3e41c31"
vary
Accept, Accept-Encoding
x-amz-meta-created-unix-time-millis
1633111265215
content-type
image/webp
cache-control
s-maxage=1814400, max-age=1209600, stale-while-revalidate=900
x-robots-tag
all
x-hs-cf-lambda-enforce
us-east-1.enforceAclForReadsProd 12
date
Thu, 07 Oct 2021 10:08:55 GMT
via
1.1 b4346add631a498bf6cdbf88cbc5ff13.cloudfront.net (CloudFront)
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-amz-cf-pop
IAD89-C1
x-hs-alternate-content-type
text/plain
cf-polished
origFmt=png, origSize=25359
x-cache
Miss from cloudfront
x-amz-meta-index-tag
all
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length
8244
last-modified
Fri, 01 Oct 2021 18:01:06 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=fB%2BAG3I6uoO4%2Bh%2B1J9i0J%2BTCnU3glCP0G9W7UNzfwNzS4RAGwo76nrhG7QYv7qAUOPvrxVFgNKneVZbbzyGSmbmbtBlx542ETyRYF8HukuaojCY48zA%2BzCliT2dlc1iTdgOstg%3D%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-credentials
false
accept-ranges
bytes
cf-ray
69a654bba9812c2a-FRA
x-amz-cf-id
uj2fRjoFDUuOQm9Fv6AkaxC347R9eMSRQCGfOrC097bwkaSaeHBohA==
image28-3.png
www.cybereason.com/hs-fs/hubfs/ 		2 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.cybereason.com/hs-fs/hubfs/image28-3.png?width=404&name=image28-3.png
Requested by
Host: www.cybereason.com
URL: https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
199.60.103.30 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
936bceef72b48206aa1f56e46495f40fbe6f271189ff009c360eedddfcd401f1

Request headers

:path
/hs-fs/hubfs/image28-3.png?width=404&name=image28-3.png
pragma
no-cache
cookie
__cfruid=d7e721c13da4dff96ea791e26c85151287fa3558-1633601335
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
www.cybereason.com
referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

age
86419
x-amz-server-side-encryption
AES256
edge-cache-tag
F-56551732152,P-3354902,FLS-ALL
x-edge-origin-shield-skipped
0
x-amz-replication-status
COMPLETED
content-disposition
inline; filename="image28-3.webp"
x-hs-cf-lambda
us-east-1.enforceAclForReadsProd 12
cf-bgj
imgq:85,h2pri
etag
"7217c1b7168dca34a02a65d5a157c213"
vary
Accept, Accept-Encoding
x-amz-meta-created-unix-time-millis
1633111391796
content-type
image/webp
cache-control
s-maxage=1814400, max-age=1209600, stale-while-revalidate=900
x-robots-tag
all
x-hs-cf-lambda-enforce
us-east-1.enforceAclForReadsProd 12
date
Thu, 07 Oct 2021 10:08:55 GMT
via
1.1 7e9d74c81117937f0703aa3977d2d999.cloudfront.net (CloudFront)
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-amz-cf-pop
IAD89-C1
x-hs-alternate-content-type
text/plain
cf-polished
origFmt=png, origSize=2808
x-cache
RefreshHit from cloudfront
x-amz-meta-index-tag
all
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length
1842
last-modified
Fri, 01 Oct 2021 18:03:12 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=H6yVzNs4Fer3KZ7BQi8P5RQ%2F8c1dJN%2FiRVRQevcD3KCYonxbuW1q%2Fj82dMolUov2uk4v6r4dBHIMykm%2B1Nktuk2M%2FFtv5J86EMpHAZz4JamnhjuUDa3ppN%2BRDAwkXpx67y7sMg%3D%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-credentials
false
accept-ranges
bytes
cf-ray
69a654bba9872c2a-FRA
x-amz-cf-id
swDyDgVTbjB21gcaNYqjzsDW0QKWQH3xucCH-3I2H8z6lKy2Fl0fGQ==
image25-3.png
www.cybereason.com/hs-fs/hubfs/ 		4 KB
6 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.cybereason.com/hs-fs/hubfs/image25-3.png?width=380&name=image25-3.png
Requested by
Host: www.cybereason.com
URL: https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
199.60.103.30 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
6643689ff2163b6279edbf3aed8b99f3106da59a96aff78e1fce94a3675777e2

Request headers

:path
/hs-fs/hubfs/image25-3.png?width=380&name=image25-3.png
pragma
no-cache
cookie
__cfruid=d7e721c13da4dff96ea791e26c85151287fa3558-1633601335
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
www.cybereason.com
referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

age
351896
x-amz-server-side-encryption
AES256
edge-cache-tag
F-56553219845,P-3354902,FLS-ALL
x-edge-origin-shield-skipped
0
x-amz-replication-status
COMPLETED
content-disposition
inline; filename="image25-3.webp"
x-hs-cf-lambda
us-east-1.enforceAclForReadsProd 12
cf-bgj
imgq:85,h2pri
etag
"4742d02497807bcd9efd156c54fbb331"
vary
Accept, Accept-Encoding
x-amz-meta-created-unix-time-millis
1633111481964
content-type
image/webp
cache-control
s-maxage=1814400, max-age=1209600, stale-while-revalidate=900
x-robots-tag
all
x-hs-cf-lambda-enforce
us-east-1.enforceAclForReadsProd 12
date
Thu, 07 Oct 2021 10:08:55 GMT
via
1.1 824fe21e467658628899bdd8725649ee.cloudfront.net (CloudFront)
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-amz-cf-pop
IAD89-C1
x-hs-alternate-content-type
text/plain
cf-polished
origFmt=png, origSize=8097
x-cache
RefreshHit from cloudfront
x-amz-meta-index-tag
all
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length
4596
last-modified
Fri, 01 Oct 2021 18:04:43 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=xMAEvqeLsjKAx%2Bt48JFyJizWIU7POh2SYj73ccxSp2jB7vTNM%2F0GY6U6PBV1SvneHVBUyA6HcaJQbXxB%2BcsOB055YYziZokqiTqOQ6vQVY%2FtClW4XG1EuLw%2FSWTqI3dKFmeH6Q%3D%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-credentials
false
accept-ranges
bytes
cf-ray
69a654bba9882c2a-FRA
x-amz-cf-id
0aFF9gl8SBtkiIekmXM81ZvUbwWJlvFEJU9zJfC3srkHe6xKtL0gYQ==
image7-Oct-01-2021-06-06-36-68-PM.png
www.cybereason.com/hs-fs/hubfs/ 		8 KB
9 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.cybereason.com/hs-fs/hubfs/image7-Oct-01-2021-06-06-36-68-PM.png?width=870&name=image7-Oct-01-2021-06-06-36-68-PM.png
Requested by
Host: www.cybereason.com
URL: https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
199.60.103.30 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
26c4f84717b932188a5f1b3dfbc9ed2166d27c84b7f763f5ca218258996b78fe

Request headers

:path
/hs-fs/hubfs/image7-Oct-01-2021-06-06-36-68-PM.png?width=870&name=image7-Oct-01-2021-06-06-36-68-PM.png
pragma
no-cache
cookie
__cfruid=d7e721c13da4dff96ea791e26c85151287fa3558-1633601335
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
www.cybereason.com
referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

age
351895
x-amz-server-side-encryption
AES256
edge-cache-tag
F-56552812849,P-3354902,FLS-ALL
x-edge-origin-shield-skipped
0
x-amz-replication-status
COMPLETED
content-disposition
inline; filename="image7-Oct-01-2021-06-06-36-68-PM.webp"
x-hs-cf-lambda
us-east-1.enforceAclForReadsProd 12
cf-bgj
imgq:85,h2pri
etag
"373c334a8b1fe66aec71daf64e82e9c0"
vary
Accept, Accept-Encoding
x-amz-meta-created-unix-time-millis
1633111596691
content-type
image/webp
cache-control
s-maxage=1814400, max-age=1209600, stale-while-revalidate=900
x-robots-tag
all
x-hs-cf-lambda-enforce
us-east-1.enforceAclForReadsProd 12
date
Thu, 07 Oct 2021 10:08:55 GMT
via
1.1 7f7e359e1c06a914d3d305785359b84d.cloudfront.net (CloudFront)
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-amz-cf-pop
IAD89-C1
x-hs-alternate-content-type
text/plain
cf-polished
origFmt=png, origSize=24930
x-cache
Miss from cloudfront
x-amz-meta-index-tag
all
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length
7772
last-modified
Fri, 01 Oct 2021 18:06:37 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=HZ5J%2FPoDx10onPXDK1%2F19%2FjBQQ2WDuO%2FOIcr4R2uADUBZpexgT4QqGaEqrTHFhS2BJL2Wm%2BT03ik6jBwYxKEa%2BVq0Ir0DD%2FH07XiNN2V5nNvW0Zf3YaIs8LzcMRhtOiJd5yidg%3D%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-credentials
false
accept-ranges
bytes
cf-ray
69a654bba9892c2a-FRA
x-amz-cf-id
8dKKgJfqivNOFNXi8egxEI3xktHFYj_-0qpZc4QZpNHMf18TfL4dvA==
image16-Oct-01-2021-06-08-59-58-PM.png
www.cybereason.com/hs-fs/hubfs/ 		4 KB
5 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.cybereason.com/hs-fs/hubfs/image16-Oct-01-2021-06-08-59-58-PM.png?width=514&name=image16-Oct-01-2021-06-08-59-58-PM.png
Requested by
Host: www.cybereason.com
URL: https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
199.60.103.30 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
e5414240e1b04e9d52490a3a54b3fc05978f47ae60cd01e8a61ba799ef0f80df

Request headers

:path
/hs-fs/hubfs/image16-Oct-01-2021-06-08-59-58-PM.png?width=514&name=image16-Oct-01-2021-06-08-59-58-PM.png
pragma
no-cache
cookie
__cfruid=d7e721c13da4dff96ea791e26c85151287fa3558-1633601335
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
www.cybereason.com
referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

age
86655
x-amz-server-side-encryption
AES256
edge-cache-tag
F-56551977343,P-3354902,FLS-ALL
x-edge-origin-shield-skipped
0
x-amz-replication-status
COMPLETED
content-disposition
inline; filename="image16-Oct-01-2021-06-08-59-58-PM.webp"
x-hs-cf-lambda
us-east-1.enforceAclForReadsProd 12
cf-bgj
imgq:85,h2pri
etag
"0488a579a292e5798dc758e6283a33af"
vary
Accept, Accept-Encoding
x-amz-meta-created-unix-time-millis
1633111739630
content-type
image/webp
cache-control
s-maxage=1814400, max-age=1209600, stale-while-revalidate=900
x-robots-tag
all
x-hs-cf-lambda-enforce
us-east-1.enforceAclForReadsProd 12
date
Thu, 07 Oct 2021 10:08:55 GMT
via
1.1 baddfcb4f2a6876b4fcc03bcd62427ef.cloudfront.net (CloudFront)
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-amz-cf-pop
IAD89-C1
x-hs-alternate-content-type
text/plain
cf-polished
origFmt=png, origSize=9027
x-cache
RefreshHit from cloudfront
x-amz-meta-index-tag
all
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length
3984
last-modified
Fri, 01 Oct 2021 18:09:00 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=vGaJbqRryS6OUqIWLTv3E5wUObSmPTQIaFIimt2fZadHy%2FXgYbkJGjaxeOzVOKgZ36oXU5o6lpjefb%2FrwAel%2Bd269h5rf5jlxfRIqf5azqcA0sl4HbzUlLkmlYecY0uT20M5yA%3D%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-credentials
false
accept-ranges
bytes
cf-ray
69a654bba98a2c2a-FRA
x-amz-cf-id
DmjIu3r-XEkQW9bAnBbPFi3BlnlZyDHsPlTAtSG1R5o_y1rXa06yLw==
all.js
connect.facebook.net/en_GB/ 		3 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://connect.facebook.net/en_GB/all.js
Requested by
Host: www.cybereason.com
URL: https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
31.13.92.14 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
xx-fbcdn-shv-01-frt3.fbcdn.net
Software
/
Resource Hash
61b6e4e2b6b5459f7d92586806fe5625a8ca818aa15b421e8b71a25fd3fce9be
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; preload; includeSubDomains
content-encoding
gzip
x-content-type-options
nosniff
content-md5
R/jJJvXCuelyajft8KSNyw==
cross-origin-resource-policy
cross-origin
expires
Thu, 07 Oct 2021 10:26:56 GMT
alt-svc
h3=":443"; ma=3600,h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length
1685
x-fb-rlafr
0
x-fb-debug
s2FxB8MsOii/fzsPzuI/zoJPgBAdfPbaQLQq2YOzQ2gXFvT+M/TCNMwY33j2aV7EVhHDXkIXwtxs3eyxz29uVQ==
x-fb-trip-id
686109401
x-fb-content-md5
469921241351449044cfe4662ae5ce3a
cross-origin-opener-policy
same-origin-allow-popups
cross-origin-embedder-policy-report-only
require-corp;report-to="coep_report"
date
Thu, 07 Oct 2021 10:08:55 GMT
x-frame-options
DENY
report-to
{"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/?minimize=0"}],"group":"coep_report"}
content-type
application/x-javascript; charset=utf-8
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public,max-age=1200,stale-while-revalidate=3600
etag
"565e52af5339b7dffc2f10691e7d54b9"
timing-allow-origin
*
priority
u=3,i
access-control-expose-headers
X-FB-Content-MD5
widgets.js
platform.twitter.com/ 		96 KB
29 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://platform.twitter.com/widgets.js
Requested by
Host: www.cybereason.com
URL: https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
93.184.220.66 London, United Kingdom, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECS (frb/67BA) /
Resource Hash
cfd3099998b0c37ace8024cbd802160585ba9be1c0047fefc172035184f074df

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date
Thu, 07 Oct 2021 10:08:55 GMT
Content-Encoding
gzip
Last-Modified
Thu, 30 Sep 2021 19:09:26 GMT
Server
ECS (frb/67BA)
Age
1093
Etag
"f9ab884058c9d8de47075baa622f0e7e+gzip"
Vary
Accept-Encoding
x-tw-cdn
VZ
P3P
CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin
*
Cache-Control
public, max-age=1800
X-Cache
HIT
Access-Control-Allow-Methods
GET
Content-Type
application/javascript; charset=utf-8
Content-Length
28869
l
use.typekit.net/af/343335/00000000000000003b9b0ad0/27/ 		16 KB
16 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://use.typekit.net/af/343335/00000000000000003b9b0ad0/27/l?primer=7cdcb44be4a7db8877ffa5c0007b8dd865b3bbc383831fe2ea177f62257a9191&fvd=n3&v=3
Requested by
Host: www.cybereason.com
URL: https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.16.186.59 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a2-16-186-59.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
2e96bf761583273e370136ed0b934a38ad1e08b386accb37277252b37b9c9961

Request headers

Referer
https://www.cybereason.com/
Origin
https://www.cybereason.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Thu, 07 Oct 2021 10:08:55 GMT
server
nginx
etag
"eedb93b5a9ba82f97df21a2548066c304a8baad8"
content-type
application/font-woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
content-length
16112
l
use.typekit.net/af/4b34d2/00000000000000003b9b0acf/27/ 		16 KB
16 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://use.typekit.net/af/4b34d2/00000000000000003b9b0acf/27/l?primer=7cdcb44be4a7db8877ffa5c0007b8dd865b3bbc383831fe2ea177f62257a9191&fvd=i4&v=3
Requested by
Host: www.cybereason.com
URL: https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.16.186.59 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a2-16-186-59.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
7219936e6e56b9932b2f1dd06cfff09b655a729bb17d0aa6d757e14184512384

Request headers

Referer
https://www.cybereason.com/
Origin
https://www.cybereason.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Thu, 07 Oct 2021 10:08:55 GMT
server
nginx
etag
"2d91046573f0e4458e7737f18f00bb9c13388e11"
content-type
application/font-woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
content-length
16252
l
use.typekit.net/af/cb6232/00000000000000003b9b0ad8/27/ 		15 KB
15 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://use.typekit.net/af/cb6232/00000000000000003b9b0ad8/27/l?primer=7cdcb44be4a7db8877ffa5c0007b8dd865b3bbc383831fe2ea177f62257a9191&fvd=n4&v=3
Requested by
Host: www.cybereason.com
URL: https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.16.186.59 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a2-16-186-59.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
9607506688417bb09b8d6c29362c2fe29bc1b047b793cccddfce876d927fa57b

Request headers

Referer
https://www.cybereason.com/
Origin
https://www.cybereason.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Thu, 07 Oct 2021 10:08:55 GMT
server
nginx
etag
"865da7d2ecc4da3cb6bd5574f01738cfc5c8bb11"
content-type
application/font-woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
content-length
15448
l
use.typekit.net/af/abc1c3/00000000000000003b9b0ac9/27/ 		16 KB
16 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://use.typekit.net/af/abc1c3/00000000000000003b9b0ac9/27/l?primer=7cdcb44be4a7db8877ffa5c0007b8dd865b3bbc383831fe2ea177f62257a9191&fvd=n6&v=3
Requested by
Host: www.cybereason.com
URL: https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.16.186.59 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a2-16-186-59.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
359197d1e7ab63fe678db88914f31f1f9f6a37bd182e0de565fc7a68302a1f50

Request headers

Referer
https://www.cybereason.com/
Origin
https://www.cybereason.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Thu, 07 Oct 2021 10:08:55 GMT
server
nginx
etag
"8c3ee2b4e977df4e0f73e1b985c24fba9611fc49"
content-type
application/font-woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
content-length
16652
l
use.typekit.net/af/62203f/00000000000000003b9b0ac8/27/ 		17 KB
17 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://use.typekit.net/af/62203f/00000000000000003b9b0ac8/27/l?primer=7cdcb44be4a7db8877ffa5c0007b8dd865b3bbc383831fe2ea177f62257a9191&fvd=i7&v=3
Requested by
Host: www.cybereason.com
URL: https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.16.186.59 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a2-16-186-59.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
66b4fac9494bbeda177f4637fa3e7423fc8ef54b11a6875e68cdf3e472293b2a

Request headers

Referer
https://www.cybereason.com/
Origin
https://www.cybereason.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Thu, 07 Oct 2021 10:08:55 GMT
server
nginx
etag
"7b5be73a29b093f7ae3c099f5a521c9274f6db28"
content-type
application/font-woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
content-length
17148
l
use.typekit.net/af/19a2f0/00000000000000003b9b0ac7/27/ 		16 KB
16 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://use.typekit.net/af/19a2f0/00000000000000003b9b0ac7/27/l?primer=7cdcb44be4a7db8877ffa5c0007b8dd865b3bbc383831fe2ea177f62257a9191&fvd=n7&v=3
Requested by
Host: www.cybereason.com
URL: https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.16.186.59 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a2-16-186-59.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
97829f8a6f2a471117ed06d0b06a81d543b091a262192369c531380779148c5c

Request headers

Referer
https://www.cybereason.com/
Origin
https://www.cybereason.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Thu, 07 Oct 2021 10:08:55 GMT
server
nginx
etag
"b9e1ecdf0fe601a7e9dfc362b400290203e7b31c"
content-type
application/font-woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
content-length
16456
l
use.typekit.net/af/cfbead/0000000000000000000146b3/27/ 		23 KB
23 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://use.typekit.net/af/cfbead/0000000000000000000146b3/27/l?primer=7cdcb44be4a7db8877ffa5c0007b8dd865b3bbc383831fe2ea177f62257a9191&fvd=n4&v=3
Requested by
Host: www.cybereason.com
URL: https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.16.186.59 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a2-16-186-59.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
365a7ca6f52df29efedfdac2e08a9d0f03e4e2122dd9a49803bf8dacd58480fc

Request headers

Referer
https://www.cybereason.com/
Origin
https://www.cybereason.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Thu, 07 Oct 2021 10:08:55 GMT
server
nginx
etag
"122498e3424e674610da39fb441d661549879239"
content-type
application/font-woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
content-length
23248
l
use.typekit.net/af/f50d41/00000000000000003b9b2c84/27/ 		15 KB
15 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://use.typekit.net/af/f50d41/00000000000000003b9b2c84/27/l?primer=7cdcb44be4a7db8877ffa5c0007b8dd865b3bbc383831fe2ea177f62257a9191&fvd=n3&v=3
Requested by
Host: www.cybereason.com
URL: https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.16.186.59 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a2-16-186-59.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
765097740b7490e6ab6a2d8624199ab7b147e8c6cec064b6cce257750fdb1985

Request headers

Referer
https://www.cybereason.com/
Origin
https://www.cybereason.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Thu, 07 Oct 2021 10:08:55 GMT
server
nginx
etag
"13c2813ff67959226aaa4eccfcdd1399bd756b8d"
content-type
application/font-woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
content-length
15336
has-permission
app.hubspot.com/content-tools-menu/api/v1/tools-menu/ 		0
769 B 		Script
General
Check archive.org
Download Go to
Full URL
https://app.hubspot.com/content-tools-menu/api/v1/tools-menu/has-permission?portalId=3354902&callback=jsonpHandler
Requested by
Host: www.cybereason.com
URL: https://www.cybereason.com/hs/hsstatic/HubspotToolsMenu/static-1.109/js/index.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.19.154.83 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
x-hs-worker-debug-mode
false
server
cloudflare
x-hubspot-correlation-id
c2a4a458-9088-4682-9a40-79965c37c802
x-trace
2BF239AA7082A1B8079C75FB155463E4326E6BEA33000000000000000000
date
Thu, 07 Oct 2021 10:08:55 GMT
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
access-control-allow-methods
GET
cf-cache-status
DYNAMIC
report-to
{"group":"default","max_age":86400,"endpoints":[{"url":"https://exceptions.hubspot.com/csp/reports"}]}
cache-control
max-age=0
access-control-allow-credentials
true
cf-ray
69a654bc2c812c52-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
leadflows.js
js.hsleadflows.net/ 		537 KB
87 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://js.hsleadflows.net/leadflows.js
Requested by
Host: www.cybereason.com
URL: https://www.cybereason.com/hs/scriptloader/3354902.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.17.233.204 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
b38803f733f36ff943399e6539b7fe1fa26611706ce6878b5b21c6a4f96ec862

Request headers

Referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms
Origin
https://www.cybereason.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Thu, 07 Oct 2021 10:08:55 GMT
via
1.1 fb41e17254dfd781519e95cedd257827.cloudfront.net (CloudFront)
cf-cache-status
HIT
age
1522
x-amz-server-side-encryption
AES256
content-security-policy-report-only
frame-ancestors 'self'; report-uri https://exceptions.hubspot.com/csp/report?resource=lead-flows-js/static-1.1056/bundle/main/lead-flows-release.js&cfRay=69a62f8d9c4e5c62-FRA
x-cache
RefreshHit from cloudfront
access-control-max-age
3000
x-amz-replication-status
COMPLETED
content-encoding
br
cf-ray
69a654bc689f2bf6-FRA
last-modified
Thu, 23 Sep 2021 09:11:54 UTC
server
cloudflare
etag
W/"9af442c5acbde436228f228f7502bfc8"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Origin,Access-Control-Request-Headers,Access-Control-Request-Method, Accept-Encoding
access-control-allow-methods
GET
x-amz-version-id
BdP6Nyyw4.FdbyHhgb7cfRPPJ2MC6STP
access-control-allow-origin
*
cache-control
s-maxage=86400, max-age=0
x-hs-cache-status
MISS
x-amz-cf-pop
IAD89-C3
content-type
application/javascript; charset=utf-8
x-amz-cf-id
Ki7cGW1DdL1wcaHgiALDN1YTgOrm_YOGvfTmZbcpRmEVbywav7Q1zQ==
x-hs-target-asset
lead-flows-js/static-1.1056/bundle/main/lead-flows-release.js
3354902.js
js.hs-banner.com/ 		61 KB
16 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://js.hs-banner.com/3354902.js
Requested by
Host: www.cybereason.com
URL: https://www.cybereason.com/hs/scriptloader/3354902.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.20.191 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
58ae09d221b5622f041fd635235b28202750a8c2c48a02524e45c555d99c2375

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Thu, 07 Oct 2021 10:08:55 GMT
content-encoding
br
cf-cache-status
HIT
age
204
x-amz-server-side-encryption
AES256
content-type
text/javascript; charset=UTF-8
access-control-max-age
604800
x-amz-request-id
FFTA9V2MRDTXHYB7
x-amz-id-2
iKtuS1VeaNdsh281wHHt3nJGU5NicOHInMKVcK2fRkwxNcW5SCZsWD2vFiqV9W+nvHw4uDPqGIM=
timing-allow-origin
*
last-modified
Fri, 03 Sep 2021 19:44:53 GMT
server
cloudflare
etag
W/"262edf6402d173215ad086fd56b83c6a"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
access-control-allow-methods
GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD
x-amz-version-id
ix.FHnPBRxwsiIHn.9ar513BayFgawqc
access-control-allow-origin
https://jobs.cybereason.com
access-control-expose-headers
x-last-modified-timestamp, X-HubSpot-NotFound, X-HS-User-Request, Link, Server-Timing
cache-control
max-age=300, public
access-control-allow-credentials
true
cf-ray
69a654bc688a4ec1-FRA
access-control-allow-headers
Origin, X-Requested-With, Content-Type, Accept, Accept-Charset, Accept-Encoding, X-Override-Internal-Permissions, X-Properties-Source, X-Properties-SourceId, X-Properties-Flag, X-Hubspot-User-Id, X-Hubspot-Trace, X-Hubspot-Callee, X-Hubspot-Offset, X-Hubspot-No-Trace, X-HubSpot-Static-App-Info, X-HubSpot-Messages-Uri, X-HubSpot-Request-Source, X-HubSpot-Request-Reason, Subscription-Billing-Auth-Token, X-App-CSRF, X-Tools-CSRF, Online-Payment-Signing-UUID, X-Source, X-SourceId, X-Origin-UserId, X-Biden-Request-Source, X-HubSpot-CSRF-hubspotapi, X-Force-Cookie-Refresh, X-Force-Cookie-Refresh-No-Cache, X-HS-User-Request, X-Application-Id, X-HS-Referer, X-HubSpot-Correlation-Id
expires
Thu, 07 Oct 2021 10:10:31 GMT
3354902.js
js.hs-analytics.net/analytics/1633601100000/ 		63 KB
20 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://js.hs-analytics.net/analytics/1633601100000/3354902.js
Requested by
Host: www.cybereason.com
URL: https://www.cybereason.com/hs/scriptloader/3354902.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.17.69.176 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
42d9f880279b211f36a978ee81979fa382507c6428865a3e863cb91366284003

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Thu, 07 Oct 2021 10:08:55 GMT
content-encoding
br
cf-cache-status
HIT
age
196
x-amz-server-side-encryption
AES256
x-amz-request-id
VX07K91TQY282AJY
x-amz-id-2
sRe5OMwIOL0oXnglASdb1vOcTc3vuvyWtw5h9Fw2dsP+Vh4rKz7eoqr0qsQw63ycDtxdjF+y7Xc=
last-modified
Wed, 01 Sep 2021 14:09:56 GMT
server
cloudflare
etag
W/"4d19489cdf419e3b44657d58f5ba356a"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
text/javascript
cache-control
max-age=300, public
access-control-allow-credentials
false
x-amz-version-id
null
cf-ray
69a654bc69262b95-FRA
expires
Thu, 07 Oct 2021 10:10:39 GMT
all.js
connect.facebook.net/en_GB/ 		264 KB
74 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://connect.facebook.net/en_GB/all.js?hash=623aa32f80e9ff3371b2c17fc6ed6bc2
Requested by
Host: connect.facebook.net
URL: https://connect.facebook.net/en_GB/all.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
31.13.92.14 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
xx-fbcdn-shv-01-frt3.fbcdn.net
Software
/
Resource Hash
d8bb0208ad9a0c3a5bda77e7684365d738c2da4084c9bee50ed868380fba7c5c
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

Referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms
Origin
https://www.cybereason.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; preload; includeSubDomains
content-encoding
gzip
x-content-type-options
nosniff
content-md5
NAtcCOncpeZqsMQoGJ+6Jg==
cross-origin-resource-policy
cross-origin
expires
Fri, 07 Oct 2022 10:06:56 GMT
alt-svc
h3=":443"; ma=3600,h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length
76110
x-fb-rlafr
0
x-fb-debug
1YbQjp1PuiDRsgIFal3RKc2C1MK6wWVh+9RRekfcYV+ur/sZ3+6V6HAr2P7+FaVkGw5PGGE8B4VlPcE3KkAvyQ==
cross-origin-embedder-policy-report-only
require-corp;report-to="coep_report"
x-fb-content-md5
a3793a2343233af4052a3f7363df686d
cross-origin-opener-policy
same-origin-allow-popups
date
Thu, 07 Oct 2021 10:08:55 GMT
x-frame-options
DENY
report-to
{"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/?minimize=0"}],"group":"coep_report"}
content-type
application/x-javascript; charset=utf-8
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public,max-age=31536000,stale-while-revalidate=3600,immutable
etag
"ddaaf2fccd8f54627406583f3f0683f4"
timing-allow-origin
*
priority
u=3,i
access-control-expose-headers
X-FB-Content-MD5
widget_iframe.58065ae230495f5d9e4b6a916472b2c1.html
platform.twitter.com/widgets/ Frame 7DC8 		319 KB
103 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://platform.twitter.com/widgets/widget_iframe.58065ae230495f5d9e4b6a916472b2c1.html?origin=https%3A%2F%2Fwww.cybereason.com
Requested by
Host: platform.twitter.com
URL: https://platform.twitter.com/widgets.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
93.184.220.66 London, United Kingdom, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECS (frb/67E0) /
Resource Hash
c6d03b7a5561687268e57b13d9d4a6a4c71ee570ea74718040ce9227676e3e5e

Request headers

Host
platform.twitter.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
cross-site
Sec-Fetch-Mode
navigate
Sec-Fetch-Dest
iframe
Referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms
Accept-Encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms

Response headers

Content-Encoding
gzip
Access-Control-Allow-Methods
GET
Access-Control-Allow-Origin
*
Age
221269
Cache-Control
public, max-age=315360000
Content-Type
text/html; charset=utf-8
Date
Thu, 07 Oct 2021 10:08:55 GMT
Etag
"8321d7cf58d70200c1423dfa0bca40f6+gzip"
Last-Modified
Thu, 30 Sep 2021 18:56:47 GMT
P3P
CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Server
ECS (frb/67E0)
Vary
Accept-Encoding
X-Cache
HIT
x-tw-cdn
VZ
Content-Length
105433
p.gif
p.typekit.net/ 		35 B
214 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://p.typekit.net/p.gif?s=1&k=vyv2ljd&ht=tk&h=www.cybereason.com&f=32224.32226.32227.32228.32230.32231.10875.32265&a=657783&js=1.20.0&app=typekit&e=js&_=1633601335811
Requested by
Host: www.cybereason.com
URL: https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.111.215.74 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-111-215-74.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
9b9265c69a5cc295d1ab0d04e0273b3677db1a6216ce2ccf4efc8c277ed84b39

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Thu, 07 Oct 2021 10:08:55 GMT
last-modified
Wed, 02 Sep 2020 03:58:21 GMT
server
nginx
etag
"5f4f185d-23"
content-type
image/gif
access-control-allow-origin
*
cache-control
public, max-age=604800
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
content-length
35
settings
syndication.twitter.com/ Frame 7DC8 		232 B
432 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://syndication.twitter.com/settings?session_id=7d0231611be31b86db5aa5e940cf6f1c2c7f3ca4
Requested by
Host: platform.twitter.com
URL: https://platform.twitter.com/widgets/widget_iframe.58065ae230495f5d9e4b6a916472b2c1.html?origin=https%3A%2F%2Fwww.cybereason.com
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.244.42.72 , United States, ASN13414 (TWITTER, US),
Reverse DNS
Software
tsa_o /
Resource Hash
726906ee6ce6dfe1b6e35ddad151196c50277e31520de30e916e9cd9affc0ef3
Security Headers
Name Value
Strict-Transport-Security max-age=631138519

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://platform.twitter.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Thu, 07 Oct 2021 10:08:55 GMT
content-encoding
gzip
last-modified
Thu, 07 Oct 2021 10:08:55 GMT
server
tsa_o
vary
Origin
strict-transport-security
max-age=631138519
content-type
application/json; charset=utf-8
access-control-allow-origin
https://platform.twitter.com
cache-control
must-revalidate, max-age=600
access-control-allow-credentials
true
x-connection-hash
10dcb04d4309afa84ce68184b644228c7c36d47953d39d3829c7cc8907c5d15d
content-length
166
analytics.js
www.google-analytics.com/ 		48 KB
20 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/analytics.js
Requested by
Host: www.cybereason.com
URL: https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.185.174 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s51-in-f14.1e100.net
Software
Golfe2 /
Resource Hash
fd222137f245c06ddb4c4d44db41f12138dad6cf8ef5d4d4a5e500f38f0c8c62
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Wed, 11 Aug 2021 00:32:57 GMT
server
Golfe2
age
4918
date
Thu, 07 Oct 2021 08:46:57 GMT
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=7200
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
19747
expires
Thu, 07 Oct 2021 10:46:57 GMT
gtm.js
www.googletagmanager.com/ 		328 KB
75 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtm.js?id=GTM-TJVVB7C
Requested by
Host: www.cybereason.com
URL: https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.186.40 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s04-in-f8.1e100.net
Software
Google Tag Manager /
Resource Hash
8c8a2e123eca4b06a094242bf0184ab0f0828b77ceccc8703cd2541e17d1cdab
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Thu, 07 Oct 2021 10:08:55 GMT
content-encoding
br
vary
Accept-Encoding
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
76243
x-xss-protection
0
last-modified
Thu, 07 Oct 2021 09:00:00 GMT
server
Google Tag Manager
strict-transport-security
max-age=31536000; includeSubDomains
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Thu, 07 Oct 2021 10:08:55 GMT
__ptq.gif
track.hubspot.com/ 		45 B
490 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://track.hubspot.com/__ptq.gif?k=1&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=en-us&bfp=3169173831&v=1.1&a=3354902&pi=56540216169&ct=blog-post&ccu=https%3A%2F%2Fwww.cybereason.com%2Fblog%2Foperation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms&cpi=56540216169&cgi=5272851739&lpi=56540216169&lvi=56540216169&lvc=en&pu=https%3A%2F%2Fwww.cybereason.com%2Fblog%2Foperation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms&t=Operation+GhostShell%3A+Novel+RAT+Targets+Global+Aerospace+and+Telecoms+Firms&cts=1633601335877&vi=77c2b3f4e0a7e83b68e85f9b3a76cfb8&nc=true&u=85683782.77c2b3f4e0a7e83b68e85f9b3a76cfb8.1633601335875.1633601335875.1633601335875.1&b=85683782.1.1633601335875&pt=0&cc=15
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.19.154.83 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Thu, 07 Oct 2021 10:08:55 GMT
vary
Accept-Encoding
cf-cache-status
DYNAMIC
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-hubspot-correlation-id
ed62188a-c8f2-4e52-82b2-e5aa84cd740c
cf-ray
69a654bd4e852c52-FRA
p3p
CP="NOI CUR ADM OUR NOR STA NID"
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length
45
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=31536000; includeSubDomains; preload
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=DHNU2TzHX8Es%2F58qBod%2BVUhVPF3Fba0c4SJ1dywJQ7FMxc%2BpuZMcSyieRQbjh5D%2BZqmV19bFgcFFRKrmh%2FJ8hiKwOi0mh9EGFhTvMU0FLKd%2FzSexsUoyQWATcydDTDTJobXC"}],"group":"cf-nel","max_age":604800}
content-type
image/gif
cache-control
no-cache, no-store, no-transform
access-control-allow-credentials
false
x-robots-tag
none
collect
www.google-analytics.com/j/ 		4 B
24 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/j/collect?v=1&_v=j93&a=1853219360&t=pageview&_s=1&dl=https%3A%2F%2Fwww.cybereason.com%2Fblog%2Foperation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms&ul=en-us&de=UTF-8&dt=Operation%20GhostShell%3A%20Novel%20RAT%20Targets%20Global%20Aerospace%20and%20Telecoms%20Firms&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=IEBAAEABAAAAAC~&jid=2135132631&gjid=1368409217&cid=226520194.1633601336&tid=UA-56367941-1&_gid=1942957253.1633601336&_r=1&_slc=1&z=2075880129
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.185.174 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s51-in-f14.1e100.net
Software
Golfe2 /
Resource Hash
aec60bc104db041b1512185839f18f52986df7e569e5445f740dd60f763fbca8
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Thu, 07 Oct 2021 10:08:55 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://www.cybereason.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
4
expires
Fri, 01 Jan 1990 00:00:00 GMT
json
forms.hubspot.com/lead-flows-config/v1/config/ 		167 B
1 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://forms.hubspot.com/lead-flows-config/v1/config/json?portalId=3354902&utk=77c2b3f4e0a7e83b68e85f9b3a76cfb8&__hstc=85683782.77c2b3f4e0a7e83b68e85f9b3a76cfb8.1633601335875.1633601335875.1633601335875.1&__hssc=85683782.1.1633601335875&contentId=56540216169&currentUrl=https%3A%2F%2Fwww.cybereason.com%2Fblog%2Foperation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms
Requested by
Host: js.hsleadflows.net
URL: https://js.hsleadflows.net/leadflows.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.19.155.83 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
8e55f10c2daa743b890f7adc32fe83b58e45b1fd997888c8cfe4c7b91f54dd04
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Thu, 07 Oct 2021 10:08:56 GMT
content-encoding
br
vary
Accept-Encoding
cf-cache-status
DYNAMIC
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-hubspot-correlation-id
2bad4679-2bde-4f9d-a9b9-52211f5dffb5
access-control-allow-methods
GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD
strict-transport-security
max-age=31536000; includeSubDomains; preload
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
x-robots-tag
none
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
access-control-max-age
180
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=w5R%2FNxigdRhL5B9Ug%2BJEZ7O3%2Bsv6gkXmbGXQV2VsHFknyCp7qJR%2F8X5tTwvD1V1LaMgiQ1HLYR4hKXXoQp8o5Q%2BwUvMxyKMTqLgaiP6n2JjPjqwqVL7r22erF8fqppk103E%2F"}],"group":"cf-nel","max_age":604800}
content-type
application/json;charset=utf-8
access-control-allow-origin
https://www.cybereason.com
cache-control
max-age=0, no-cache, no-store
access-control-allow-credentials
false
cf-ray
69a654bdccd34eda-FRA
access-control-allow-headers
Accept, Accept-Charset, Accept-Encoding, Accept-Language, Content-Type, Host, Origin, Referer, User-Agent
collect
stats.g.doubleclick.net/j/ 		2 B
463 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j93&tid=UA-56367941-1&cid=226520194.1633601336&jid=2135132631&gjid=1368409217&_gid=1942957253.1633601336&_u=IEBAAEAAAAAAAC~&z=1282508997
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
74.125.140.155 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
wq-in-f155.1e100.net
Software
Golfe2 /
Resource Hash
6068f86ff5e6d3a3e100e95fd0ab03a5fb9ebfca9386b2c0ee131361a62526c2
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
strict-transport-security
max-age=10886400; includeSubDomains; preload
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
date
Thu, 07 Oct 2021 10:08:55 GMT
content-type
text/plain
access-control-allow-origin
https://www.cybereason.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
2
expires
Fri, 01 Jan 1990 00:00:00 GMT
js
www.googletagmanager.com/gtag/ 		162 KB
60 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtag/js?id=G-SSF38JVRVJ&l=dataLayer&cx=c
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TJVVB7C
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.186.40 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s04-in-f8.1e100.net
Software
Google Tag Manager /
Resource Hash
0091726febcb55502185109ace112cd67302ca354d72f51fce8bcdcc35298913
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Thu, 07 Oct 2021 10:08:56 GMT
content-encoding
br
server
Google Tag Manager
access-control-allow-headers
Cache-Control
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
strict-transport-security
max-age=31536000; includeSubDomains
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
61436
x-xss-protection
0
expires
Thu, 07 Oct 2021 10:08:56 GMT
conversion_async.js
www.googleadservices.com/pagead/ 		37 KB
15 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googleadservices.com/pagead/conversion_async.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TJVVB7C
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.185.162 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s51-in-f2.1e100.net
Software
cafe /
Resource Hash
03b8f9e258f69727a11fc81ce93fbc8d0d5ca96489a1e84463af819efedf0782
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Thu, 07 Oct 2021 10:08:55 GMT
content-encoding
gzip
x-content-type-options
nosniff
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
14399
x-xss-protection
0
server
cafe
etag
3154747477907843336
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=3600
timing-allow-origin
*
expires
Thu, 07 Oct 2021 10:08:55 GMT
insight.min.js
snap.licdn.com/li.lms-analytics/ 		5 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://snap.licdn.com/li.lms-analytics/insight.min.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TJVVB7C
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2.16.186.10 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a2-16-186-10.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
fed785a6a8ca96fb67230fec5d85f9c508db49f4075aa0ef284af56cd89813e3

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date
Thu, 07 Oct 2021 10:08:55 GMT
Content-Encoding
gzip
Last-Modified
Wed, 29 Sep 2021 19:17:49 GMT
X-CDN
AKAM
Vary
Accept-Encoding
Content-Type
application/x-javascript;charset=utf-8
Cache-Control
max-age=12403
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
2036
uwt.js
static.ads-twitter.com/ 		14 KB
6 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://static.ads-twitter.com/uwt.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TJVVB7C
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.12.157 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
4da3e3aa30b5b06390d7e7e3fcfb16d648909eb429d161c2748bd6d79a7ec5fb

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Thu, 07 Oct 2021 10:08:55 GMT
content-encoding
gzip
last-modified
Mon, 20 Sep 2021 23:58:10 GMT
etag
"8dc11b7ca1d5ed9ec3b1ab1beb621c75+gzip+gzip"
vary
Accept-Encoding,Host
x-tw-cdn
FT
p3p
CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
x-tw-geo-cc_and_ra
DE-HE
cache-control
no-cache
x-cache
HIT, HIT
accept-ranges
bytes
content-type
application/javascript; charset=utf-8
content-length
5410
x-served-by
cache-iad-kiad7000091-IAD, cache-fra19171-FRA
bat.js
bat.bing.com/ 		34 KB
10 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://bat.bing.com/bat.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TJVVB7C
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
13.107.21.200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
d891455e32c9a425e36e190047b1f58abeb7e3709eff687134ddea7ac9cfdd3b

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Thu, 07 Oct 2021 10:08:55 GMT
content-encoding
gzip
last-modified
Wed, 06 Oct 2021 19:11:47 GMT
x-msedge-ref
Ref A: 17210FCDB65B460D945C6252AF8186CE Ref B: PRG01EDGE0811 Ref C: 2021-10-07T10:08:56Z
etag
"805b72e6bad71:0"
vary
Accept-Encoding
x-cache
CONFIG_NOCACHE
content-type
application/javascript
access-control-allow-origin
*
cache-control
private,max-age=1800
accept-ranges
bytes
content-length
10001
activityi;dc_pre=CN_Q3JqHuPMCFbv41Qodxw8A3w;src=10272547;type=landing;cat=allsite;ord=4843845596050;gtm=2wga40;auiddc=1174171278.1633601336;ps=1;~oref=https%3A%2F%2Fwww.cybereason.com%2Fblog%2Foper...
10272547.fls.doubleclick.net/ Frame 4AB0
Redirect Chain
  • https://10272547.fls.doubleclick.net/activityi;src=10272547;type=landing;cat=allsite;ord=4843845596050;gtm=2wga40;auiddc=1174171278.1633601336;ps=1;~oref=https%3A%2F%2Fwww.cybereason.com%2Fblog%2Fo...
  • https://10272547.fls.doubleclick.net/activityi;dc_pre=CN_Q3JqHuPMCFbv41Qodxw8A3w;src=10272547;type=landing;cat=allsite;ord=4843845596050;gtm=2wga40;auiddc=1174171278.1633601336;ps=1;~oref=https%3A%...
483 B
415 B 		Document
General
Check archive.org
Download Go to
Full URL
https://10272547.fls.doubleclick.net/activityi;dc_pre=CN_Q3JqHuPMCFbv41Qodxw8A3w;src=10272547;type=landing;cat=allsite;ord=4843845596050;gtm=2wga40;auiddc=1174171278.1633601336;ps=1;~oref=https%3A%2F%2Fwww.cybereason.com%2Fblog%2Foperation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms?
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TJVVB7C
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.185.198 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s52-in-f6.1e100.net
Software
cafe /
Resource Hash
b0bbae49dc465f15ea86724121cba8410b85b7cf2f1c8c1ac89ba6656584b56f
Security Headers
Name Value
Strict-Transport-Security max-age=21600
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
10272547.fls.doubleclick.net
:scheme
https
:path
/activityi;dc_pre=CN_Q3JqHuPMCFbv41Qodxw8A3w;src=10272547;type=landing;cat=allsite;ord=4843845596050;gtm=2wga40;auiddc=1174171278.1633601336;ps=1;~oref=https%3A%2F%2Fwww.cybereason.com%2Fblog%2Foperation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms?
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language
de-DE,de;q=0.9
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms
accept-encoding
gzip, deflate, br
cookie
test_cookie=CheckForPermission
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
about:blank

Response headers

p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin
*
cross-origin-resource-policy
cross-origin
date
Thu, 07 Oct 2021 10:08:56 GMT
expires
Thu, 07 Oct 2021 10:08:56 GMT
cache-control
private, max-age=0
strict-transport-security
max-age=21600
content-type
text/html; charset=UTF-8
x-content-type-options
nosniff
content-encoding
gzip
server
cafe
content-length
390
x-xss-protection
0
set-cookie
IDE=AHWqTUnjD--Rr5yzQRGuYJhO3uJr79IdUwPwepnVdU2NL_HcEtdGH62A_csFpMwiuKs; expires=Sat, 07-Oct-2023 10:08:56 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none test_cookie=; expires=Fri, 01-Aug-2008 22:45:55 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

Redirect headers

p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin
*
cross-origin-resource-policy
cross-origin
date
Thu, 07 Oct 2021 10:08:56 GMT
pragma
no-cache
expires
Fri, 01 Jan 1990 00:00:00 GMT
cache-control
no-cache, must-revalidate
follow-only-when-prerender-shown
1
strict-transport-security
max-age=21600
location
https://10272547.fls.doubleclick.net/activityi;dc_pre=CN_Q3JqHuPMCFbv41Qodxw8A3w;src=10272547;type=landing;cat=allsite;ord=4843845596050;gtm=2wga40;auiddc=1174171278.1633601336;ps=1;~oref=https%3A%2F%2Fwww.cybereason.com%2Fblog%2Foperation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms?
content-type
text/html; charset=UTF-8
x-content-type-options
nosniff
server
cafe
content-length
0
x-xss-protection
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
hotjar-704918.js
static.hotjar.com/c/ 		4 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://static.hotjar.com/c/hotjar-704918.js?sv=7
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TJVVB7C
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.225.87.40 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-225-87-40.fra2.r.cloudfront.net
Software
/
Resource Hash
0c9fac27726cffa54fe5a0f1da7932bb99e8559546927468c0f931abcf7bf352
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Thu, 07 Oct 2021 10:08:43 GMT
content-encoding
br
x-content-type-options
nosniff
cache-control
max-age=60
age
13
etag
W/f7049aa808309ecdea7195d60512ecef
vary
Accept-Encoding
x-edge-origin-shield-skipped
0
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
x-cache-hit
1
x-cache
Hit from cloudfront
x-amz-cf-pop
FRA2-C2
x-amz-cf-id
b9yJOj-FD8PPXZsaN4HlmRJvKu099GSJB-yhy8YvDOD0fw4arIHZrw==
via
1.1 a10d58b5ce965502cc34c5b27682fe23.cloudfront.net (CloudFront)
pixel.js
www.redditstatic.com/ads/ 		22 KB
7 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.redditstatic.com/ads/pixel.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TJVVB7C
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.129.140 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
snooserv /
Resource Hash
7125a66456daa35dd3e3e8cca4b9523e05caf0b4fa5bd5874676e7c6db40f3aa

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Thu, 07 Oct 2021 10:08:56 GMT
via
1.1 varnish, 1.1 varnish
last-modified
Wed, 14 Jul 2021 17:50:00 GMT
server
snooserv
etag
"912f60c72fda50b2f21068c65115175d"
vary
Accept-Encoding,Origin
content-type
application/javascript
cache-control
public, max-age=60
accept-ranges
bytes
content-encoding
gzip
content-length
7018
activityi;dc_pre=CN3x25qHuPMCFTK6UQodXsYJSg;src=10428681;type=cyber0;cat=cyber0;ord=8083476358231;gtm=2wga40;auiddc=1174171278.1633601336;ps=1;~oref=https%3A%2F%2Fwww.cybereason.com%2Fblog%2Foperat...
10428681.fls.doubleclick.net/ Frame F8BB
Redirect Chain
  • https://10428681.fls.doubleclick.net/activityi;src=10428681;type=cyber0;cat=cyber0;ord=8083476358231;gtm=2wga40;auiddc=1174171278.1633601336;ps=1;~oref=https%3A%2F%2Fwww.cybereason.com%2Fblog%2Fope...
  • https://10428681.fls.doubleclick.net/activityi;dc_pre=CN3x25qHuPMCFTK6UQodXsYJSg;src=10428681;type=cyber0;cat=cyber0;ord=8083476358231;gtm=2wga40;auiddc=1174171278.1633601336;ps=1;~oref=https%3A%2F...
570 B
460 B 		Document
General
Check archive.org
Download Go to
Full URL
https://10428681.fls.doubleclick.net/activityi;dc_pre=CN3x25qHuPMCFTK6UQodXsYJSg;src=10428681;type=cyber0;cat=cyber0;ord=8083476358231;gtm=2wga40;auiddc=1174171278.1633601336;ps=1;~oref=https%3A%2F%2Fwww.cybereason.com%2Fblog%2Foperation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms?
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TJVVB7C
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.185.198 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s52-in-f6.1e100.net
Software
cafe /
Resource Hash
49065b881b53be43323889890d9ba01f36594380bdd9ef725c5fb1f807aa6bc8
Security Headers
Name Value
Strict-Transport-Security max-age=21600
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
10428681.fls.doubleclick.net
:scheme
https
:path
/activityi;dc_pre=CN3x25qHuPMCFTK6UQodXsYJSg;src=10428681;type=cyber0;cat=cyber0;ord=8083476358231;gtm=2wga40;auiddc=1174171278.1633601336;ps=1;~oref=https%3A%2F%2Fwww.cybereason.com%2Fblog%2Foperation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms?
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language
de-DE,de;q=0.9
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms
accept-encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
about:blank

Response headers

p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin
*
cross-origin-resource-policy
cross-origin
date
Thu, 07 Oct 2021 10:08:56 GMT
expires
Fri, 01 Jan 1990 00:00:00 GMT
cache-control
no-cache, must-revalidate
strict-transport-security
max-age=21600
content-type
text/html; charset=UTF-8
pragma
no-cache
x-content-type-options
nosniff
content-encoding
gzip
server
cafe
content-length
435
x-xss-protection
0
set-cookie
test_cookie=CheckForPermission; expires=Thu, 07-Oct-2021 10:23:56 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

Redirect headers

p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin
*
cross-origin-resource-policy
cross-origin
date
Thu, 07 Oct 2021 10:08:56 GMT
pragma
no-cache
expires
Fri, 01 Jan 1990 00:00:00 GMT
cache-control
no-cache, must-revalidate
follow-only-when-prerender-shown
1
strict-transport-security
max-age=21600
location
https://10428681.fls.doubleclick.net/activityi;dc_pre=CN3x25qHuPMCFTK6UQodXsYJSg;src=10428681;type=cyber0;cat=cyber0;ord=8083476358231;gtm=2wga40;auiddc=1174171278.1633601336;ps=1;~oref=https%3A%2F%2Fwww.cybereason.com%2Fblog%2Foperation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms?
content-type
text/html; charset=UTF-8
x-content-type-options
nosniff
server
cafe
content-length
0
x-xss-protection
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
fbevents.js
connect.facebook.net/en_US/ 		98 KB
25 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://connect.facebook.net/en_US/fbevents.js
Requested by
Host: www.cybereason.com
URL: https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
31.13.92.14 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
xx-fbcdn-shv-01-frt3.fbcdn.net
Software
/
Resource Hash
2bc2179dbcac09de834853fc91b815d3bea8112276b7b789f610078d399bcb47
Security Headers
Name Value
Content-Security-Policy default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

content-security-policy
default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=3600,h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length
25967
x-xss-protection
0
pragma
public
x-fb-debug
XFPvc5tUQNlywS9hPtfcyEyPMxhCc1NRDARoIMfGVmziRv3XvNrJu24dAdS7dRlo2wtWl1WVu7g2wgO8efa8pg==
cross-origin-embedder-policy-report-only
require-corp;report-to="coep_report"
cross-origin-opener-policy
same-origin-allow-popups
x-frame-options
DENY
date
Thu, 07 Oct 2021 10:08:56 GMT
strict-transport-security
max-age=31536000; preload; includeSubDomains
report-to
{"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/?minimize=0"}],"group":"coep_report"}
content-type
application/x-javascript; charset=utf-8
vary
Accept-Encoding
cache-control
public, max-age=1200
x-fb-rlafr
0
priority
u=3,i
expires
Sat, 01 Jan 2000 00:00:00 GMT
1cwYCUDAYD26hHzYzki9
ws.zoominfo.com/pixel/ 		0
689 B 		Script
General
Check archive.org
Download Go to
Full URL
https://ws.zoominfo.com/pixel/1cwYCUDAYD26hHzYzki9
Requested by
Host: www.cybereason.com
URL: https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.16.168.82 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / Express
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Thu, 07 Oct 2021 10:08:56 GMT
via
1.1 google
x-content-type-options
nosniff
cf-cache-status
DYNAMIC
server
cloudflare
x-powered-by
Express
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
text/javascript
access-control-allow-origin
*
access-control-allow-credentials
true
cf-ray
69a654be3a9f5cb6-FRA
access-control-allow-headers
Content-Type,cf-ipcountry,service-version,x-appengine-user-ip,x-forwarded-for
content-length
0
3354902.js
js.hs-scripts.com/ 		1 KB
890 B 		Script
General
Check archive.org
Download Go to
Full URL
https://js.hs-scripts.com/3354902.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TJVVB7C
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.17.213.204 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
8c24a1532dd807e59d8658b9194fecba902d94ecb8d44d44087a99563535fab3

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Thu, 07 Oct 2021 10:08:56 GMT
content-encoding
br
vary
Accept-Encoding
cf-cache-status
HIT
age
1
cf-polished
origSize=1513
x-hubspot-correlation-id
c1d1b5d1-6946-4ad5-8b12-f94d99773e1f
cf-bgj
minify
server
cloudflare
x-trace
2B82D850264F6765BFF59FCBAB3CA6196DD1784307000000000000000000
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
access-control-max-age
3600
content-type
application/javascript;charset=utf-8
cache-control
public, max-age=60
access-control-allow-credentials
true
cf-ray
69a654be3ab45c32-FRA
expires
Thu, 07 Oct 2021 10:09:56 GMT
tracking.js
trk.techtarget.com/ 		2 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://trk.techtarget.com/tracking.js
Requested by
Host: www.cybereason.com
URL: https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.0.92 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
ac5000602bb127a5a07be117df96c48667d2e2a9fb1bb33d5ebb7c50e4480a88

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Thu, 07 Oct 2021 10:08:56 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Thu, 30 Sep 2021 16:16:59 GMT
server
cloudflare
age
81
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
text/javascript
expires
Thu, 07 Oct 2021 10:17:35 GMT
cache-control
max-age=1200
cf-ray
69a654be4eaa697f-FRA
cf-bgj
minify
ping.min.js
cdn.pdst.fm/ 		26 KB
6 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.pdst.fm/ping.min.js
Requested by
Host: www.cybereason.com
URL: https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.244.142.80 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
80.142.244.35.bc.googleusercontent.com
Software
UploadServer /
Resource Hash
cb8d40d1eb7e2dc885affcf0012d9e1a73c270d843e8b890d36538e52d0a0342

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Thu, 07 Oct 2021 09:58:03 GMT
content-encoding
gzip
age
653
x-guploader-uploadid
ADPycdsGzsBuB1mA59bWdFVkWWuUIY683yuMN4NFvMjb0tZ_Ty35BvpTiNJaGwebueU8Er0LrGpZM3vPOljiBri16w
x-goog-storage-class
MULTI_REGIONAL
x-goog-metageneration
3
x-goog-stored-content-encoding
gzip
alt-svc
clear
content-length
5774
last-modified
Fri, 28 May 2021 20:34:03 GMT
server
UploadServer
etag
"d001d1c9f5a942fa5524eeacb047e819"
vary
Accept-Encoding
x-goog-hash
crc32c=oKoi/w==, md5=0AHRyfWpQvpVJO6ssEfoGQ==
x-goog-generation
1622234043862937
access-control-allow-origin
*
access-control-expose-headers
Content-Type
cache-control
public, max-age=3600
x-goog-stored-content-length
5774
accept-ranges
bytes
content-type
application/javascript;
expires
Thu, 07 Oct 2021 10:58:03 GMT
up.js
up.pixel.ad/assets/ 		2 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://up.pixel.ad/assets/up.js?um=1
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TJVVB7C
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
178.79.242.16 , United States, ASN22822 (LLNW, US),
Reverse DNS
https-178-79-242-16.fra.llnw.net
Software
AC1.1 /
Resource Hash
5bdf1120c4df8c868092d0bcb7f2540a85456fd94cd1e1a5570c9b63906b1a5b

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Thu, 07 Oct 2021 10:08:56 GMT
content-encoding
gzip
last-modified
Mon, 24 Aug 2020 15:06:26 GMT
server
AC1.1
age
1234
vary
Accept-Encoding
content-type
application/javascript
accept-ranges
bytes
content-length
1041
x-llid
6a3057fe0396dd7873356fe5164d27b6
js
pixel.mathtag.com/event/ 		1 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pixel.mathtag.com/event/js?mt_id=1506452&mt_adid=241675&mt_exem=&mt_excl=&v1=&v2=&v3=&s1=&s2=&s3=
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TJVVB7C
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.233.201 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a2-18-233-201.deploy.static.akamaitechnologies.com
Software
MT3 3984 0e3af3b master cdg-pixel-x24 config:1.0.0 /
Resource Hash
12958d9e965374af90bb5e177bf813b32e93d5e0283a048b04849869cd770270

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date
Thu, 07 Oct 2021 10:08:56 GMT
Server
MT3 3984 0e3af3b master cdg-pixel-x24 config:1.0.0
P3P
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Cache-Control
no-cache
Connection
keep-alive
Content-Type
text/javascript
Content-Length
1411
Expires
Thu, 07 Oct 2021 10:08:55 GMT
zdcd6x8yhg85.js
js.driftt.com/include/1633601400000/ 		0
0
E-v1.js
fast.wistia.com/assets/external/ 		619 KB
118 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://fast.wistia.com/assets/external/E-v1.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TJVVB7C
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.130.110 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
28f00815d1d718764b0e6059d1e5b9f7d64a05c648bd1d182b6d8ecb7d15c225
Security Headers
Name Value
Strict-Transport-Security max-age=0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Thu, 07 Oct 2021 10:08:56 GMT
content-encoding
br
vary
Accept-Encoding
age
1662
x-cache
HIT, HIT
content-length
120086
x-served-by
cache-dca17775-DCA, cache-hhn4026-HHN
access-control-allow-origin
*
x-browser-version
93
last-modified
Mon, 04 Oct 2021 17:52:09 GMT
x-timer
S1633601336.048908,VS0,VE0
etag
"615b3f49-1d516"
strict-transport-security
max-age=0
content-type
application/javascript
via
1.1 varnish, 1.1 varnish
cache-control
public, max-age=3600
x-browser
chrome
x-ecma-v
modern
accept-ranges
bytes
timing-allow-origin
*
x-cache-hits
1, 621
lt-v2.min.js
lltrck.com/ 		0
0 		Script
General
Check archive.org
Download Go to
Full URL
https://lltrck.com/lt-v2.min.js
Requested by
Host: www.cybereason.com
URL: https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.163.67.9 , United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-163-67-9.compute-1.amazonaws.com
Software
/
Resource Hash

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers
6e1424cff90e9cd4.min.js
tag.demandbase.com/ 		67 KB
19 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tag.demandbase.com/6e1424cff90e9cd4.min.js
Requested by
Host: www.cybereason.com
URL: https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.224.193.116 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-224-193-116.fra2.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
4139f0b62005cf3f07a86b399774246fd14ff78729116737cf47df1b6b8dd1fc

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

x-amz-version-id
J0tQY0rsg4xE57tUfGSGBXYXZV_t3ais
content-encoding
gzip
last-modified
Tue, 10 Aug 2021 07:54:24 GMT
server
AmazonS3
age
1032
etag
W/"a9291860616c83d5d0a3dd7a66e4d368"
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
application/javascript; charset=utf-8
via
1.1 0b9e85cfe8fe19b385db56d32b4ce802.cloudfront.net (CloudFront)
cache-control
public, max-age=3600
date
Thu, 07 Oct 2021 10:01:14 GMT
x-amz-cf-pop
FRA2-C1
x-amz-cf-id
2GBh_W9XVJ-trV5V90D3221ckaafKMyCkX1R9dY_6gJ14sEisS9Nsw==
airpr.js
px.airpr.com/ 		7 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://px.airpr.com/airpr.js
Requested by
Host: www.cybereason.com
URL: https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.225.87.8 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-225-87-8.fra2.r.cloudfront.net
Software
nginx /
Resource Hash
529b9c583e6cf8da02c9cadf8c38b5714198f0fde2dcde01da2d5ee681228738

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Thu, 07 Oct 2021 02:09:11 GMT
content-encoding
gzip
last-modified
Sat, 21 Apr 2018 18:03:55 GMT
server
nginx
age
28797
etag
"5adb7d0b-853"
x-edge-origin-shield-skipped
0
content-type
application/javascript; charset=utf-8
via
1.1 590590f04f79f692591f9db0e720a31d.cloudfront.net (CloudFront)
cache-control
max-age=43200
x-cache
Hit from cloudfront
x-amz-cf-pop
FRA2-C2
content-length
2131
x-amz-cf-id
smo9qYZx7xQ1sRZd1VXjVQDBHTGUErGTCgUhtzYi8L4vbCiZMdV_XQ==
expires
Thu, 07 Oct 2021 14:24:04 GMT
activityi;register_conversion=1;src=10272547;type=landing;cat=allsite;ord=4843845596050;gtm=2wga40;auiddc=1174171278.1633601336;ps=1;~oref=https%3A%2F%2Fwww.cybereason.com%2Fblog%2Foperation-ghosts...
10272547.fls.doubleclick.net/ 		0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://10272547.fls.doubleclick.net/activityi;register_conversion=1;src=10272547;type=landing;cat=allsite;ord=4843845596050;gtm=2wga40;auiddc=1174171278.1633601336;ps=1;~oref=https%3A%2F%2Fwww.cybereason.com%2Fblog%2Foperation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms?
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.185.198 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s52-in-f6.1e100.net
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers
activityi;register_conversion=1;src=10428681;type=cyber0;cat=cyber0;ord=8083476358231;gtm=2wga40;auiddc=1174171278.1633601336;ps=1;~oref=https%3A%2F%2Fwww.cybereason.com%2Fblog%2Foperation-ghostshe...
10428681.fls.doubleclick.net/ 		0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://10428681.fls.doubleclick.net/activityi;register_conversion=1;src=10428681;type=cyber0;cat=cyber0;ord=8083476358231;gtm=2wga40;auiddc=1174171278.1633601336;ps=1;~oref=https%3A%2F%2Fwww.cybereason.com%2Fblog%2Foperation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms?
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.185.198 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s52-in-f6.1e100.net
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers
/
attr.ml-api.io/
Redirect Chain
  • https://s.ml-attr.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dcybereason.com%26pId%3d%24UID
  • https://secure.adnxs.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dcybereason.com%26pId%3d%24UID
  • https://attr.ml-api.io/?domain=cybereason.com&pId=2730198256998004406
0
242 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://attr.ml-api.io/?domain=cybereason.com&pId=2730198256998004406
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.225.87.106 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-225-87-106.fra2.r.cloudfront.net
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Thu, 07 Oct 2021 10:08:56 GMT
via
1.1 cc0ab20766d57035422a2c4c69fe0620.cloudfront.net (CloudFront)
apigw-requestid
G1QQ3iN8oAMESyw=
x-amz-cf-pop
FRA2-C2
x-cache
Miss from cloudfront
content-type
application/json
content-length
0
x-amz-cf-id
qDXld1jOqJZrGO3alG27CEMcAXxKRBJqV6q1bxISDbDcSqnHCCESGQ==

Redirect headers

Pragma
no-cache
Date
Thu, 07 Oct 2021 10:08:56 GMT
X-Proxy-Origin
216.131.114.187; 216.131.114.187; 724.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid
e7e0cdef-572c-437a-87b8-0a286a69da9e
Server
nginx/1.17.9
Access-Control-Allow-Origin
*
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location
https://attr.ml-api.io/?domain=cybereason.com&pId=2730198256998004406
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
ga-audiences
www.google.com/ads/ 		42 B
522 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j93&tid=UA-56367941-1&cid=226520194.1633601336&jid=2135132631&_u=IEBAAEAAAAAAAC~&z=853077854
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.185.164 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s51-in-f4.1e100.net
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 07 Oct 2021 10:08:56 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
collect
px.ads.linkedin.com/
Redirect Chain
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=72596&time=1633601336018&url=https%3A%2F%2Fwww.cybereason.com%2Fblog%2Foperation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms
  • https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D72596%26time%3D1633601336018%26url%3Dhttps%253A%252F%252Fwww.cybereason.com%252Fb...
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=72596&time=1633601336018&url=https%3A%2F%2Fwww.cybereason.com%2Fblog%2Foperation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms&...
0
58 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=72596&time=1633601336018&url=https%3A%2F%2Fwww.cybereason.com%2Fblog%2Foperation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms&liSync=true
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
108.174.11.37 , United States, ASN14413 (LINKEDIN, US),
Reverse DNS
108-174-11-37.fwd.linkedin.com
Software
Play /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Thu, 07 Oct 2021 10:08:56 GMT
server
Play
linkedin-action
1
x-li-fabric
prod-lor1
x-li-proto
http/2
x-li-pop
prod-esv5
content-type
application/javascript
content-length
0
x-li-uuid
v2GZvMK3qxYAbbVJXisAAA==

Redirect headers

strict-transport-security
max-age=31536000
x-content-type-options
nosniff
linkedin-action
1
x-cache
CONFIG_NOCACHE
content-length
0
x-li-uuid
AAXNwHNgqsXNvs9UL4OQ0Q==
pragma
no-cache
x-li-pop
afd-prod-lor1-x
x-msedge-ref
Ref A: 44F27CE0109C4818BC4D640EEA594D31 Ref B: PRG01EDGE1006 Ref C: 2021-10-07T10:08:56Z
date
Thu, 07 Oct 2021 10:08:56 GMT
expect-ct
max-age=86400, report-uri="https://www.linkedin.com/platform-telemetry/ct"
x-frame-options
sameorigin
x-li-fabric
prod-lor1
location
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=72596&time=1633601336018&url=https%3A%2F%2Fwww.cybereason.com%2Fblog%2Foperation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms&liSync=true
cache-control
no-cache, no-store
content-security-policy
default-src *; connect-src 'self' https://media-src.linkedin.com/media/ www.linkedin.com s.c.lnkd.licdn.com m.c.lnkd.licdn.com wss://*.linkedin.com dms.licdn.com https://dpm.demdex.net/id lnkd.demdex.net blob: https://accounts.google.com/gsi/status https://linkedin.sc.omtrdc.net/b/ss/ www.google-analytics.com static.licdn.com static-exp1.licdn.com static-exp2.licdn.com static-exp3.licdn.com media.licdn.com media-exp1.licdn.com media-exp2.licdn.com media-exp3.licdn.com; img-src data: blob: *; font-src data: *; style-src 'unsafe-inline' 'self' static-src.linkedin.com *.licdn.com; script-src 'report-sample' 'unsafe-inline' 'unsafe-eval' 'self' spdy.linkedin.com static-src.linkedin.com *.ads.linkedin.com *.licdn.com static.chartbeat.com www.google-analytics.com ssl.google-analytics.com bcvipva02.rightnowtech.com www.bizographics.com sjs.bizographics.com js.bizographics.com d.la4-c1-was.salesforceliveagent.com https://snap.licdn.com/li.lms-analytics/ platform.linkedin.com platform-akam.linkedin.com platform-ecst.linkedin.com platform-azur.linkedin.com; object-src 'none'; media-src blob: *; child-src blob: lnkd-communities: voyager: *; frame-ancestors 'self'; report-uri /security/csp?f=l
x-li-proto
http/2
expires
Thu, 01 Jan 1970 00:00:00 GMT
/
googleads.g.doubleclick.net/pagead/viewthroughconversion/934771702/ 		2 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/viewthroughconversion/934771702/?random=1633601336020&cv=9&fst=1633601336020&num=1&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2wga40&sendb=1&ig=1&frm=0&url=https%3A%2F%2Fwww.cybereason.com%2Fblog%2Foperation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms&tiba=Operation%20GhostShell%3A%20Novel%20RAT%20Targets%20Global%20Aerospace%20and%20Telecoms%20Firms&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4
Requested by
Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.185.162 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s51-in-f2.1e100.net
Software
cafe /
Resource Hash
1a9e6bf7a8466b7f6fc1368a5c895525d2803a88d5e8f1ba9333260a239ddc15
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 07 Oct 2021 10:08:56 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
text/javascript; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1062
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
googleads.g.doubleclick.net/pagead/viewthroughconversion/561371164/ 		2 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/viewthroughconversion/561371164/?random=1633601336023&cv=9&fst=1633601336023&num=1&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2wga40&sendb=1&ig=1&frm=0&url=https%3A%2F%2Fwww.cybereason.com%2Fblog%2Foperation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms&tiba=Operation%20GhostShell%3A%20Novel%20RAT%20Targets%20Global%20Aerospace%20and%20Telecoms%20Firms&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4
Requested by
Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.185.162 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s51-in-f2.1e100.net
Software
cafe /
Resource Hash
54584eb1913c2ef88edfb80081c6a95f61730e42d3726518f24988f110e7571d
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 07 Oct 2021 10:08:56 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
text/javascript; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1063
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.googleadservices.com/pagead/conversion/401574070/ 		2 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googleadservices.com/pagead/conversion/401574070/?random=1633601336024&cv=9&fst=1633601336024&num=1&value=0&label=6wPaCOv09oACELaRvr8B&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2wga40&sendb=1&ig=1&frm=0&url=https%3A%2F%2Fwww.cybereason.com%2Fblog%2Foperation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms&tiba=Operation%20GhostShell%3A%20Novel%20RAT%20Targets%20Global%20Aerospace%20and%20Telecoms%20Firms&auid=1174171278.1633601336&capi=1&hn=www.googleadservices.com&bttype=purchase&async=1&rfmt=3&fmt=4
Requested by
Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.185.162 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s51-in-f2.1e100.net
Software
cafe /
Resource Hash
56a5389239a9c676a8b6b94e5a453acefceb408fb3841e27590bcb8cc819f6c0
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 07 Oct 2021 10:08:56 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
text/javascript; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1286
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.com/pagead/privacysandbox/conversion/401574070/ 		0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.com/pagead/privacysandbox/conversion/401574070/?random=1633601336024&cv=9&fst=1633601336024&num=1&fmt=3&value=0&label=6wPaCOv09oACELaRvr8B&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2wga40&sendb=1&ig=1&frm=0&url=https%3A%2F%2Fwww.cybereason.com%2Fblog%2Foperation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms&tiba=Operation%20GhostShell%3A%20Novel%20RAT%20Targets%20Global%20Aerospace%20and%20Telecoms%20Firms&auid=1174171278.1633601336&capi=1&hn=www.googleadservices.com&bttype=purchase&async=1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.185.164 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s51-in-f4.1e100.net
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers
adsct
analytics.twitter.com/i/ 		31 B
658 B 		Script
General
Check archive.org
Download Go to
Full URL
https://analytics.twitter.com/i/adsct?type=javascript&version=2.0.4&p_id=Twitter&p_user_id=0&txn_id=ny0ol&events=%5B%5B%22pageview%22%2Cnull%5D%5D&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=0&event_id=013d93ec-53a4-4e8f-953b-ab98da2aa743&tw_document_href=https%3A%2F%2Fwww.cybereason.com%2Fblog%2Foperation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms&tpx_cb=twttr.conversion.loadPixels
Requested by
Host: static.ads-twitter.com
URL: https://static.ads-twitter.com/uwt.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.244.42.67 , United States, ASN13414 (TWITTER, US),
Reverse DNS
Software
tsa_o /
Resource Hash
df3e003cc30e9bdd0313100e8ee5d468070b4b34d11ad355f276a356d4b9c7bf
Security Headers
Name Value
Strict-Transport-Security max-age=631138519
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Thu, 07 Oct 2021 10:08:56 GMT
content-encoding
gzip
x-content-type-options
nosniff
p3p
CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
status
200 OK
x-twitter-response-tags
BouncerCompliant
content-length
57
x-xss-protection
0
pragma
no-cache
last-modified
Thu, 07 Oct 2021 10:08:56 GMT
server
tsa_o
x-frame-options
SAMEORIGIN
strict-transport-security
max-age=631138519
content-type
application/javascript;charset=utf-8
cache-control
no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash
cdf51ba213a219f12f99fede267fb5d78f0f2f09d485e73635a5e7f1d40c5713
x-transaction
2e199fc7acef0c3c
expires
Tue, 31 Mar 1981 05:00:00 GMT
adsct
t.co/i/ 		43 B
455 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://t.co/i/adsct?type=javascript&version=2.0.4&p_id=Twitter&p_user_id=0&txn_id=ny0ol&events=%5B%5B%22pageview%22%2Cnull%5D%5D&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=0&event_id=013d93ec-53a4-4e8f-953b-ab98da2aa743&tw_document_href=https%3A%2F%2Fwww.cybereason.com%2Fblog%2Foperation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.244.42.69 , United States, ASN13414 (TWITTER, US),
Reverse DNS
Software
tsa_o /
Resource Hash
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
Security Headers
Name Value
Strict-Transport-Security max-age=0
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Thu, 07 Oct 2021 10:08:56 GMT
content-encoding
gzip
x-content-type-options
nosniff
status
200 OK
x-twitter-response-tags
BouncerCompliant
content-length
65
x-xss-protection
0
pragma
no-cache
last-modified
Thu, 07 Oct 2021 10:08:56 GMT
server
tsa_o
x-frame-options
SAMEORIGIN
strict-transport-security
max-age=0
content-type
image/gif;charset=utf-8
cache-control
no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash
ffb6736b6e758b9df55fb94a850e6cb34aeafeffb3c3b55d61bf826aad0321bb
x-transaction
8db7a599c376615c
expires
Tue, 31 Mar 1981 05:00:00 GMT
modules.e95f6e2deb67f1b24d8e.js
script.hotjar.com/ 		221 KB
59 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://script.hotjar.com/modules.e95f6e2deb67f1b24d8e.js
Requested by
Host: static.hotjar.com
URL: https://static.hotjar.com/c/hotjar-704918.js?sv=7
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.224.193.31 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-224-193-31.fra2.r.cloudfront.net
Software
/
Resource Hash
3e4dcf5d937c6cd9bd580358e83d9bff9769f73cc2364ed9af22c88571959adb
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Tue, 28 Sep 2021 08:27:05 GMT
content-encoding
br
x-content-type-options
nosniff
age
783711
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
content-length
59787
access-control-allow-origin
*
last-modified
Tue, 28 Sep 2021 08:26:22 GMT
etag
"4c2c45df8457d0c2a07b3285a23cd7a4"
vary
Accept-Encoding
content-type
application/javascript
via
1.1 f7bf326347bdd7f275a38a22b5b83724.cloudfront.net (CloudFront)
cache-control
max-age=31536000
x-amz-cf-pop
FRA2-C1
accept-ranges
bytes
x-robots-tag
none
x-amz-cf-id
iQyKkgaqy7CRE2in8fyAX3eunQWLwOHi3iYGh2xIfow8O7GNHTb1Zw==
rp.gif
alb.reddit.com/ 		42 B
125 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://alb.reddit.com/rp.gif?ts=1633601336035&id=t2_32cbm2fl&event=PageVisit&m.itemCount=&m.value=&m.currency=&m.transactionId=&m.customEventName=&uuid=a4f9f072-7043-40fc-a74b-6dfeb83c4fed&aaid=&em=&external_id=&idfa=&integration=reddit&opt_out=0&sh=1600&sw=1200&v=rdt_a797b96e
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.193.140 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
Varnish /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Thu, 07 Oct 2021 10:08:56 GMT
via
1.1 varnish
server
Varnish
accept-ranges
bytes
content-length
42
retry-after
0
content-type
image/gif
116645602292181
connect.facebook.net/signals/config/ 		490 KB
143 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://connect.facebook.net/signals/config/116645602292181?v=2.9.47&r=stable
Requested by
Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
31.13.92.14 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
xx-fbcdn-shv-01-frt3.fbcdn.net
Software
/
Resource Hash
5f9208947e343c28851472d721d14c93a91ee132a1978f1d3e07b692586a3727
Security Headers
Name Value
Content-Security-Policy default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

content-security-policy
default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=3600,h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length
146732
x-xss-protection
0
pragma
public
x-fb-debug
f5fO6pG3n99rfwykXjxwXbgZqwxCoqdFi+03aaJILuHpw4yflfvtmpINqWVkuYefz1vfA7H4tvMCChh9VbQJxA==
cross-origin-opener-policy
same-origin-allow-popups
x-frame-options
DENY
date
Thu, 07 Oct 2021 10:08:56 GMT
strict-transport-security
max-age=31536000; preload; includeSubDomains
content-type
application/x-javascript; charset=utf-8
vary
Accept-Encoding
cache-control
public, max-age=1200
x-fb-rlafr
0
priority
u=3,i
expires
Sat, 01 Jan 2000 00:00:00 GMT
collect
analytics.google.com/g/ 		0
361 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://analytics.google.com/g/collect?v=2&tid=G-SSF38JVRVJ&gtm=2oea40&_p=1853219360&sr=1600x1200&_gaz=1&ul=en-us&cid=226520194.1633601336&_s=1&dl=https%3A%2F%2Fwww.cybereason.com%2Fblog%2Foperation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms&dt=Operation%20GhostShell%3A%20Novel%20RAT%20Targets%20Global%20Aerospace%20and%20Telecoms%20Firms&sid=1633601335&sct=1&seg=0&en=page_view&_fv=1&_ss=1
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-SSF38JVRVJ&l=dataLayer&cx=c
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.185.142 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s50-in-f14.1e100.net
Software
Golfe2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

pragma
no-cache
date
Thu, 07 Oct 2021 10:08:56 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://www.cybereason.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
collect
stats.g.doubleclick.net/g/ 		0
17 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://stats.g.doubleclick.net/g/collect?v=2&tid=G-SSF38JVRVJ&cid=226520194.1633601336&gtm=2oea40&aip=1
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-SSF38JVRVJ&l=dataLayer&cx=c
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
74.125.140.155 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
wq-in-f155.1e100.net
Software
Golfe2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

pragma
no-cache
date
Thu, 07 Oct 2021 10:08:56 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://www.cybereason.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
pdst-events-prod-sink
us-central1-adaptive-growth.cloudfunctions.net/ 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://us-central1-adaptive-growth.cloudfunctions.net/pdst-events-prod-sink
Requested by
Host: cdn.pdst.fm
URL: https://cdn.pdst.fm/ping.min.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
216.239.36.54 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Frontend / Express
Resource Hash

Request headers

Accept
application/json
Referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type
application/json

Response headers

date
Thu, 07 Oct 2021 10:08:56 GMT
etag
W/"2-nOO9QiTIwXgNtWtBJezz8kv3SLc"
server
Google Frontend
access-control-allow-headers
Content-Type, Accept
x-powered-by
Express
access-control-allow-methods
GET, POST
content-type
text/html
access-control-allow-origin
*
x-cloud-trace-context
d1bad91ca829a7ce0142c1747a93f7a2
function-execution-id
ki0cqtkd2z7f
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
pdst-events-prod-sink
us-central1-adaptive-growth.cloudfunctions.net/ Frame 		0
0 		Preflight
General
Check archive.org
Download Go to
Full URL
https://us-central1-adaptive-growth.cloudfunctions.net/pdst-events-prod-sink
Protocol
H2
Server
216.239.36.54 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Frontend / Express
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Method
POST
Access-Control-Request-Headers
content-type
Origin
https://www.cybereason.com
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Sec-Fetch-Mode
cors

Response headers

access-control-allow-headers
Content-Type, Accept
access-control-allow-methods
GET, POST
access-control-allow-origin
*
content-type
text/html; charset=utf-8
etag
W/"2-ROqGvmcGDXooyAXFZHZ+i4au1yQ"
function-execution-id
51nhk1nhxrw0
x-powered-by
Express
x-cloud-trace-context
8dad62ea79a47a198d8c6781cb6e89c5
content-encoding
gzip
date
Thu, 07 Oct 2021 10:08:56 GMT
server
Google Frontend
cache-control
private
content-length
22
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
/
www.google.com/pagead/1p-conversion/401574070/
Redirect Chain
  • https://googleads.g.doubleclick.net/pagead/viewthroughconversion/401574070/?random=1125264886&cv=9&fst=1633601336024&num=1&value=0&label=6wPaCOv09oACELaRvr8B&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&...
  • https://www.google.com/pagead/1p-conversion/401574070/?random=1125264886&cv=9&fst=1633601336024&num=1&value=0&label=6wPaCOv09oACELaRvr8B&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_...
42 B
64 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.com/pagead/1p-conversion/401574070/?random=1125264886&cv=9&fst=1633601336024&num=1&value=0&label=6wPaCOv09oACELaRvr8B&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2wga40&sendb=1&ig=1&frm=0&url=https%3A%2F%2Fwww.cybereason.com%2Fblog%2Foperation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms&tiba=Operation%20GhostShell%3A%20Novel%20RAT%20Targets%20Global%20Aerospace%20and%20Telecoms%20Firms&auid=1174171278.1633601336&capi=1&hn=www.googleadservices.com&async=1&fmt=3&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&sscte=1&crd=&is_vtc=1&ocp_id=OMdeYe2bA8mAgAflxojADA&cid=CAQSKQCNIrLMYdeJlePONEzrTxXHBzMvyX9FvA0fpkn19bQUou4b56XvgzhM&eitems=ChEI8LX6igYQxuPD0YGw3PyKARIdAP8BwDese2nTdYzLoyplJW9XYXk0p8r4lxstdkU&random=1695931113&resp=GooglemKTybQhCsO
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.185.164 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s51-in-f4.1e100.net
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 07 Oct 2021 10:08:56 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-security-policy
script-src 'none'; object-src 'none'
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma
no-cache
date
Thu, 07 Oct 2021 10:08:56 GMT
x-content-type-options
nosniff
server
cafe
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-type
image/gif
location
https://www.google.com/pagead/1p-conversion/401574070/?random=1125264886&cv=9&fst=1633601336024&num=1&value=0&label=6wPaCOv09oACELaRvr8B&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2wga40&sendb=1&ig=1&frm=0&url=https%3A%2F%2Fwww.cybereason.com%2Fblog%2Foperation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms&tiba=Operation%20GhostShell%3A%20Novel%20RAT%20Targets%20Global%20Aerospace%20and%20Telecoms%20Firms&auid=1174171278.1633601336&capi=1&hn=www.googleadservices.com&async=1&fmt=3&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&sscte=1&crd=&is_vtc=1&ocp_id=OMdeYe2bA8mAgAflxojADA&cid=CAQSKQCNIrLMYdeJlePONEzrTxXHBzMvyX9FvA0fpkn19bQUou4b56XvgzhM&eitems=ChEI8LX6igYQxuPD0YGw3PyKARIdAP8BwDese2nTdYzLoyplJW9XYXk0p8r4lxstdkU&random=1695931113&resp=GooglemKTybQhCsO
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
asyncPixelSync
pixel.sitescout.com/dmp/ Frame 759C
Redirect Chain
  • https://pixel.sitescout.com/dmp/asyncPixelSync
  • https://pixel.sitescout.com/dmp/asyncPixelSync?cookieQ=1
1 KB
2 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://pixel.sitescout.com/dmp/asyncPixelSync?cookieQ=1
Requested by
Host: www.cybereason.com
URL: https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server
66.155.71.25 Portsmouth, United Kingdom, ASN13768 (COGECO-PEER1, CA),
Reverse DNS
Software
AC1.1 /
Resource Hash
1e79f5d7c1f23b5a0a263f4d240f1a488a31a8f36f532d6accaa98eddb61ba59

Request headers

:method
GET
:authority
pixel.sitescout.com
:scheme
https
:path
/dmp/asyncPixelSync?cookieQ=1
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language
de-DE,de;q=0.9
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms
accept-encoding
gzip, deflate, br
cookie
ssi=fb604dec-420d-434b-ada8-58fdbb58abf5#1633601336153
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms

Response headers

cache-control
max-age=0,no-cache,no-store
pragma
no-cache
expires
Tue, 11 Oct 1977 12:34:56 GMT
p3p
CP="NON DEVa PSAa PSDa OUR NOR NAV",policyref="/w3c/p3p.xml"
set-cookie
ssi=fb604dec-420d-434b-ada8-58fdbb58abf5#1633601336153; Domain=.sitescout.com; Expires=Fri, 07-Oct-2022 10:08:56 GMT; Path=/; Secure; SameSite=None _ssuma=eyIzNCI6MTYzMzYwMTMzNjE4MiwiMiI6MTYzMzYwMTMzNjE4MiwiNCI6MTYzMzYwMTMzNjE4MiwiMzkiOjE2MzM2MDEzMzYxODIsIjciOjE2MzM2MDEzMzYxODJ9; Domain=.sitescout.com; Expires=Sat, 06-Nov-2021 10:08:56 GMT; Path=/; Secure; SameSite=None
content-type
text/html;charset=UTF-8
content-length
1139
date
Thu, 07 Oct 2021 10:08:55 GMT
server
AC1.1

Redirect headers

set-cookie
ssi=22c383bc-4835-48c1-a48a-aaca019454ed#1633601336154; Domain=.sitescout.com; Expires=Fri, 07-Oct-2022 10:08:56 GMT; Path=/; Secure; SameSite=None
location
https://pixel.sitescout.com/dmp/asyncPixelSync?cookieQ=1
content-length
0
date
Thu, 07 Oct 2021 10:08:55 GMT
server
AC1.1
6f002ab8596ff067
pixel.sitescout.com/up/
Redirect Chain
  • https://pixel.sitescout.com/up/6f002ab8596ff067?cntr_url=https%3A%2F%2Fwww.cybereason.com%2Fblog%2Foperation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms
  • https://pixel.sitescout.com/up/6f002ab8596ff067?cookieQ=1&cntr_url=https%3A%2F%2Fwww.cybereason.com%2Fblog%2Foperation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms
43 B
417 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pixel.sitescout.com/up/6f002ab8596ff067?cookieQ=1&cntr_url=https%3A%2F%2Fwww.cybereason.com%2Fblog%2Foperation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server
66.155.71.25 Portsmouth, United Kingdom, ASN13768 (COGECO-PEER1, CA),
Reverse DNS
Software
AC1.1 /
Resource Hash
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 07 Oct 2021 10:08:55 GMT
server
AC1.1
p3p
CP="NON DEVa PSAa PSDa OUR NOR NAV",policyref="/w3c/p3p.xml"
cache-control
max-age=0,no-cache,no-store
content-type
image/gif
content-length
43
expires
Tue, 11 Oct 1977 12:34:56 GMT

Redirect headers

location
https://pixel.sitescout.com/up/6f002ab8596ff067?cookieQ=1&cntr_url=https%3A%2F%2Fwww.cybereason.com%2Fblog%2Foperation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms
date
Thu, 07 Oct 2021 10:08:55 GMT
server
AC1.1
content-length
0
56273944.js
bat.bing.com/p/action/ 		0
133 B 		Script
General
Check archive.org
Download Go to
Full URL
https://bat.bing.com/p/action/56273944.js
Requested by
Host: bat.bing.com
URL: https://bat.bing.com/bat.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
13.107.21.200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

access-control-allow-origin
*
date
Thu, 07 Oct 2021 10:08:56 GMT
cache-control
private,max-age=86400
x-msedge-ref
Ref A: 4F3212AA1BFC454AAA6E9175B2D2B183 Ref B: PRG01EDGE0811 Ref C: 2021-10-07T10:08:56Z
x-cache
CONFIG_NOCACHE
0
bat.bing.com/action/ 		0
149 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://bat.bing.com/action/0?ti=56273944&tm=gtm002&Ver=2&mid=9790c204-b8d8-4aca-984b-cf3b11707b70&sid=94ed07d0275611ec9dcafd4eb01d8022&vid=94ed3000275611ecb1d0a58348e37271&vids=1&pi=1200101525&lg=en-US&sw=1600&sh=1200&sc=24&tl=Operation%20GhostShell%3A%20Novel%20RAT%20Targets%20Global%20Aerospace%20and%20Telecoms%20Firms&p=https%3A%2F%2Fwww.cybereason.com%2Fblog%2Foperation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms&r=&lt=673&evt=pageLoad&msclkid=N&sv=1&rn=603263
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
13.107.21.200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

access-control-allow-origin
*
pragma
no-cache
date
Thu, 07 Oct 2021 10:08:56 GMT
cache-control
no-cache, must-revalidate
x-msedge-ref
Ref A: 6FA6411282574859A0215B3FA37429AF Ref B: PRG01EDGE0811 Ref C: 2021-10-07T10:08:56Z
x-cache
CONFIG_NOCACHE
expires
Fri, 01 Jan 1990 00:00:00 GMT
box-dfc01efbdc94bb0936d9a35a502b0b64.html
vars.hotjar.com/ Frame 1FD6 		2 KB
1 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://vars.hotjar.com/box-dfc01efbdc94bb0936d9a35a502b0b64.html
Requested by
Host: static.hotjar.com
URL: https://static.hotjar.com/c/hotjar-704918.js?sv=7
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.224.193.73 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-224-193-73.fra2.r.cloudfront.net
Software
/
Resource Hash
88ca677c14d4217c2f6b8c8964a1d172027974c4c0839e4d531ad7d3d6de1987

Request headers

:method
GET
:authority
vars.hotjar.com
:scheme
https
:path
/box-dfc01efbdc94bb0936d9a35a502b0b64.html
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language
de-DE,de;q=0.9
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms
accept-encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms

Response headers

content-type
text/html
content-length
1044
date
Tue, 20 Jul 2021 13:05:05 GMT
accept-ranges
bytes
cache-control
max-age=31536000
content-encoding
br
etag
"10714b84569172431728622d7c8098e4"
last-modified
Tue, 20 Jul 2021 13:04:43 GMT
x-amz-server-side-encryption
AES256
x-robots-tag
none
vary
Accept-Encoding
x-cache
Hit from cloudfront
via
1.1 eab88762658052b4a1e386f8521a38cf.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA2-C1
x-amz-cf-id
XP2vv_6pbqPbKW69uAh-hP2XYl0bQr1DFg5egvnlJpdvWYKL07FF4Q==
age
6815031
activity.gif
apt.techtarget.com/activity/ 		43 B
464 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://apt.techtarget.com/activity/activity.gif?activityTypeId=31&cid=16570449&version=2.1.1&ref=https%3A%2F%2Fwww.cybereason.com%2Fblog%2Foperation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms&r=1633601336090
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
206.19.49.24 , United States, ASN7018 (ATT-INTERNET4, US),
Reverse DNS
Software
/
Resource Hash
2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date
Thu, 07 Oct 2021 10:08:56 GMT
Last-Modified
Tue, 26 Mar 2019 18:30:29 GMT
ETag
"2b-5850384023492"
Content-Type
image/gif
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=71
Content-Length
43
/
www.facebook.com/tr/ 		44 B
313 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.facebook.com/tr/?id=116645602292181&ev=PageView&dl=https%3A%2F%2Fwww.cybereason.com%2Fblog%2Foperation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms&rl=&if=false&ts=1633601336113&sw=1600&sh=1200&v=2.9.47&r=stable&a=tmgoogletagmanager&ec=0&o=30&fbp=fb.1.1633601336112.1414405421&it=1633601336040&coo=false&rqm=GET
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
31.13.92.36 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
edge-star-mini-shv-01-frt3.facebook.com
Software
proxygen-bolt /
Resource Hash
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Thu, 07 Oct 2021 10:08:56 GMT
last-modified
Fri, 21 Dec 2012 00:00:01 GMT
server
proxygen-bolt
strict-transport-security
max-age=31536000; includeSubDomains
content-type
image/gif
cache-control
no-cache, must-revalidate, max-age=0
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=3600, h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length
44
expires
Thu, 07 Oct 2021 10:08:56 GMT
collect
www.google-analytics.com/ 		35 B
55 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google-analytics.com/collect?v=1&_v=j93&a=1853219360&t=event&ni=1&_s=2&dl=https%3A%2F%2Fwww.cybereason.com%2Fblog%2Foperation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms&ul=en-us&de=UTF-8&dt=Operation%20GhostShell%3A%20Novel%20RAT%20Targets%20Global%20Aerospace%20and%20Telecoms%20Firms&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=airpr&ea=visitor%20hit&_u=KHBAAEABAAAAAC~&jid=&gjid=&cid=226520194.1633601336&tid=UA-56367941-1&_gid=1942957253.1633601336&cd16=226520194.1633601336&z=27367221
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.185.174 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s51-in-f14.1e100.net
Software
Golfe2 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 06 Oct 2021 12:35:08 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
age
77628
content-type
image/gif
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
35
expires
Mon, 01 Jan 1990 00:00:00 GMT
anpx
dpx.airpr.com/
Redirect Chain
  • https://dpx.airpr.com/px?hostname=www.cybereason.com&profile=660386&ga_account_id=UA-56367941-1&ga_account_type=UA&ga_c=226520194.1633601336&an=true
  • https://secure.adnxs.com/getuid?https://dpx.airpr.com/anpx?adnxs_uid=$UID&airpr_id=4105438475
  • https://secure.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fdpx.airpr.com%2Fanpx%3Fadnxs_uid%3D%24UID%26airpr_id%3D4105438475
  • https://dpx.airpr.com/anpx?adnxs_uid=2730198256998004406&airpr_id=4105438475
0
63 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dpx.airpr.com/anpx?adnxs_uid=2730198256998004406&airpr_id=4105438475
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
18.196.93.253 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-196-93-253.eu-central-1.compute.amazonaws.com
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Thu, 07 Oct 2021 10:08:56 GMT
cache-control
private
server
nginx

Redirect headers

Pragma
no-cache
Date
Thu, 07 Oct 2021 10:08:56 GMT
X-Proxy-Origin
216.131.114.187; 216.131.114.187; 724.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid
36f6e131-2c71-488f-b59d-d3b37933e24e
Server
nginx/1.17.9
Access-Control-Allow-Origin
*
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location
https://dpx.airpr.com/anpx?adnxs_uid=2730198256998004406&airpr_id=4105438475
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
validateCookie
segments.company-target.com/
Redirect Chain
  • https://match.prod.bidr.io/cookie-sync/demandbase
  • https://match.prod.bidr.io/cookie-sync/demandbase?_bee_ppp=1
  • https://segments.company-target.com/log?vendor=choca&user_id=AACzu07CvY4AABfPAS93Vw
  • https://segments.company-target.com/validateCookie?vendor=choca&user_id=AACzu07CvY4AABfPAS93Vw&verifyHash=f2f6e04a486a3a329166744c11a40859131be2fe
26 B
408 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://segments.company-target.com/validateCookie?vendor=choca&user_id=AACzu07CvY4AABfPAS93Vw&verifyHash=f2f6e04a486a3a329166744c11a40859131be2fe
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
13.225.87.69 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-225-87-69.fra2.r.cloudfront.net
Software
/
Resource Hash
3b7b8a4b411ddf8db9bacc2f3aabf406f8e4c0c087829b336ca331c40adfdff1

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date
Thu, 07 Oct 2021 10:08:56 GMT
Via
1.1 e5b93012e2bfb81dc9846f43efd610a6.cloudfront.net (CloudFront)
X-Amz-Cf-Pop
FRA2-C2
Vary
Origin
X-Cache
Miss from cloudfront
Content-Type
image/gif
Transfer-Encoding
chunked
Connection
keep-alive
trace-id
e1f2072907870041
X-Amz-Cf-Id
VbXObhwnJ1PotzUh5ezt_pOjAIkyGhE9ZCslcUFZ3jcnx_TTBNZcog==

Redirect headers

Date
Thu, 07 Oct 2021 10:08:56 GMT
Via
1.1 e5b93012e2bfb81dc9846f43efd610a6.cloudfront.net (CloudFront)
X-Amz-Cf-Pop
FRA2-C2
Vary
Origin
X-Cache
Miss from cloudfront
Location
/validateCookie?vendor=choca&user_id=AACzu07CvY4AABfPAS93Vw&verifyHash=f2f6e04a486a3a329166744c11a40859131be2fe
Connection
keep-alive
trace-id
53f73f978a957615
Content-Length
0
X-Amz-Cf-Id
M_TagQOi6Rm51eCOT3MasXDWc4qFeGNTQnxWvhFwBOqN2F1DFJ9RHA==
464526.gif
id.rlcdn.com/ 		0
66 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://id.rlcdn.com/464526.gif
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.244.174.68 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
68.174.244.35.bc.googleusercontent.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Thu, 07 Oct 2021 10:08:56 GMT
via
1.1 google
alt-svc
clear
content-length
0
iframe
pixel.mathtag.com/sync/ Frame 71E6 		631 B
961 B 		Document
General
Check archive.org
Download Go to
Full URL
https://pixel.mathtag.com/sync/iframe?mt_uuid=1003615e-c738-4900-92d1-d4af52ab233a&no_iframe=1&mt_adid=241675&source=mathtag
Requested by
Host: pixel.mathtag.com
URL: https://pixel.mathtag.com/event/js?mt_id=1506452&mt_adid=241675&mt_exem=&mt_excl=&v1=&v2=&v3=&s1=&s2=&s3=
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.233.201 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a2-18-233-201.deploy.static.akamaitechnologies.com
Software
MT3 3984 0e3af3b master cdg-pixel-x5 config:1.0.0 /
Resource Hash
304a0259406001319e10acd097537e33bbc0157670417a48fdd527a889951f65

Request headers

Host
pixel.mathtag.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
cross-site
Sec-Fetch-Mode
navigate
Sec-Fetch-Dest
iframe
Referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms
Accept-Encoding
gzip, deflate, br
Cookie
uuid=1003615e-c738-4900-92d1-d4af52ab233a
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms

Response headers

Content-Type
text/html
Content-Length
631
Server
MT3 3984 0e3af3b master cdg-pixel-x5 config:1.0.0
Cache-Control
no-cache
P3P
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Expires
Thu, 07 Oct 2021 10:08:55 GMT
Date
Thu, 07 Oct 2021 10:08:56 GMT
Connection
keep-alive
ip.json
api.company-target.com/api/v2/ 		438 B
929 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://api.company-target.com/api/v2/ip.json?referrer=&page=https%3A%2F%2Fwww.cybereason.com%2Fblog%2Foperation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms&page_title=Operation%20GhostShell%3A%20Novel%20RAT%20Targets%20Global%20Aerospace%20and%20Telecoms%20Firms&src=tag&auth=MOftAmbp2Aha4tkNEmeyvcipKYfCUyVJMXpCWBMS
Requested by
Host: tag.demandbase.com
URL: https://tag.demandbase.com/6e1424cff90e9cd4.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.225.87.16 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-225-87-16.fra2.r.cloudfront.net
Software
nginx /
Resource Hash
18a9a74a968f6478f0a7709f4f8a6a86e14221af669b554dbdf333294dc67f86

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Thu, 07 Oct 2021 10:08:56 GMT
identification-source
CENTRAL
vary
Accept-Encoding, Origin
x-amz-cf-pop
FRA2-C2
x-cache
Miss from cloudfront
request-id
ca22db6e-1d00-4af4-b30b-e837b549f661
content-encoding
gzip
pragma
no-cache
access-control-allow-origin
https://www.cybereason.com
server
nginx
access-control-max-age
7200
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/json;charset=utf-8
via
1.1 90cf045072373c2c671297de3161846f.cloudfront.net (CloudFront)
access-control-expose-headers
cache-control
no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials
true
api-version
v2
access-control-allow-headers
DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
5-vlE8rOW0xGRRd2VWWb77uSHbjPuFDlWTrbITLDTp2nWNSbMjBk_Q==
expires
Wed, 06 Oct 2021 10:08:56 GMT
/
www.google.com/pagead/1p-user-list/561371164/ 		42 B
64 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.com/pagead/1p-user-list/561371164/?random=1633601336023&cv=9&fst=1633600800000&num=1&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2wga40&sendb=1&frm=0&url=https%3A%2F%2Fwww.cybereason.com%2Fblog%2Foperation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms&tiba=Operation%20GhostShell%3A%20Novel%20RAT%20Targets%20Global%20Aerospace%20and%20Telecoms%20Firms&async=1&fmt=3&is_vtc=1&random=2518467308&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.185.164 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s51-in-f4.1e100.net
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 07 Oct 2021 10:08:56 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-security-policy
script-src 'none'; object-src 'none'
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
img
pixel.mathtag.com/misc/ 		43 B
493 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pixel.mathtag.com/misc/img?mm_bnc&bcdv=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.233.201 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a2-18-233-201.deploy.static.akamaitechnologies.com
Software
MT3 3984 0e3af3b master cdg-pixel-x31 config:1.0.0 /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date
Thu, 07 Oct 2021 10:08:56 GMT
Server
MT3 3984 0e3af3b master cdg-pixel-x31 config:1.0.0
P3P
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Cache-Control
no-cache
Connection
keep-alive
Content-Type
image/gif
Content-Length
43
Expires
Thu, 07 Oct 2021 10:08:55 GMT
dc_pre=CN3x25qHuPMCFTK6UQodXsYJSg;src=10428681;type=cyber0;cat=cyber0;ord=8083476358231;gtm=2wga40;auiddc=1174171278.1633601336;ps=1;~oref=https%3A%2F%2Fwww.cybereason.com%2Fblog%2Foperation-ghosts...
adservice.google.com/ddm/fls/i/ Frame DAFF 		194 B
306 B 		Document
General
Check archive.org
Download Go to
Full URL
https://adservice.google.com/ddm/fls/i/dc_pre=CN3x25qHuPMCFTK6UQodXsYJSg;src=10428681;type=cyber0;cat=cyber0;ord=8083476358231;gtm=2wga40;auiddc=1174171278.1633601336;ps=1;~oref=https%3A%2F%2Fwww.cybereason.com%2Fblog%2Foperation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms
Requested by
Host: 10428681.fls.doubleclick.net
URL: https://10428681.fls.doubleclick.net/activityi;dc_pre=CN3x25qHuPMCFTK6UQodXsYJSg;src=10428681;type=cyber0;cat=cyber0;ord=8083476358231;gtm=2wga40;auiddc=1174171278.1633601336;ps=1;~oref=https%3A%2F%2Fwww.cybereason.com%2Fblog%2Foperation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms?
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.185.66 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s48-in-f2.1e100.net
Software
cafe /
Resource Hash
05978957c6c8b028f2785dc77271c286bfac76e30b7bcd7e835c2927fbe897cf
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
adservice.google.com
:scheme
https
:path
/ddm/fls/i/dc_pre=CN3x25qHuPMCFTK6UQodXsYJSg;src=10428681;type=cyber0;cat=cyber0;ord=8083476358231;gtm=2wga40;auiddc=1174171278.1633601336;ps=1;~oref=https%3A%2F%2Fwww.cybereason.com%2Fblog%2Foperation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language
de-DE,de;q=0.9
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://10428681.fls.doubleclick.net/
accept-encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://10428681.fls.doubleclick.net/

Response headers

p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin
*
cross-origin-resource-policy
cross-origin
date
Thu, 07 Oct 2021 10:08:56 GMT
expires
Thu, 07 Oct 2021 10:08:56 GMT
cache-control
private, max-age=0
content-type
text/html; charset=UTF-8
x-content-type-options
nosniff
content-encoding
gzip
server
cafe
content-length
177
x-xss-protection
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
/
www.google.com/pagead/1p-user-list/934771702/ 		42 B
64 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.com/pagead/1p-user-list/934771702/?random=1633601336020&cv=9&fst=1633600800000&num=1&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2wga40&sendb=1&frm=0&url=https%3A%2F%2Fwww.cybereason.com%2Fblog%2Foperation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms&tiba=Operation%20GhostShell%3A%20Novel%20RAT%20Targets%20Global%20Aerospace%20and%20Telecoms%20Firms&async=1&fmt=3&is_vtc=1&random=299795473&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.185.164 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s51-in-f4.1e100.net
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 07 Oct 2021 10:08:56 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-security-policy
script-src 'none'; object-src 'none'
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
dc_pre=CN_Q3JqHuPMCFbv41Qodxw8A3w;src=10272547;type=landing;cat=allsite;ord=4843845596050;gtm=2wga40;auiddc=*;ps=1;~oref=https%3A%2F%2Fwww.cybereason.com%2Fblog%2Foperation-ghostshell-novel-rat-tar...
adservice.google.com/ddm/fls/z/ Frame 4AB0 		42 B
515 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://adservice.google.com/ddm/fls/z/dc_pre=CN_Q3JqHuPMCFbv41Qodxw8A3w;src=10272547;type=landing;cat=allsite;ord=4843845596050;gtm=2wga40;auiddc=*;ps=1;~oref=https%3A%2F%2Fwww.cybereason.com%2Fblog%2Foperation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms
Requested by
Host: 10272547.fls.doubleclick.net
URL: https://10272547.fls.doubleclick.net/activityi;dc_pre=CN_Q3JqHuPMCFbv41Qodxw8A3w;src=10272547;type=landing;cat=allsite;ord=4843845596050;gtm=2wga40;auiddc=1174171278.1633601336;ps=1;~oref=https%3A%2F%2Fwww.cybereason.com%2Fblog%2Foperation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms?
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.185.66 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s48-in-f2.1e100.net
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://10272547.fls.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 07 Oct 2021 10:08:56 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
visit-data
in.hotjar.com/api/v2/client/sites/704918/ 		146 B
323 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://in.hotjar.com/api/v2/client/sites/704918/visit-data?sv=7
Requested by
Host: script.hotjar.com
URL: https://script.hotjar.com/modules.e95f6e2deb67f1b24d8e.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.51.140.204 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-51-140-204.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
ab95872c4726727a3b09b1f8c28490c70b7e407e97fd93bbfb75a2ecc5faac36

Request headers

Referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type
text/plain; charset=UTF-8

Response headers

date
Thu, 07 Oct 2021 10:08:56 GMT
content-encoding
br
vary
Accept-Encoding
content-type
application/json
access-control-allow-origin
*
access-control-max-age
86400
cache-control
no-cache, no-store
access-control-allow-credentials
true
collect
www.google-analytics.com/ 		35 B
55 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google-analytics.com/collect?v=1&_v=j93&a=1853219360&t=event&ni=1&_s=3&dl=https%3A%2F%2Fwww.cybereason.com%2Fblog%2Foperation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms&ul=en-us&de=UTF-8&dt=Operation%20GhostShell%3A%20Novel%20RAT%20Targets%20Global%20Aerospace%20and%20Telecoms%20Firms&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=Demandbase&ea=API%20Resolution&el=IP%20API&_u=aHBAAEABAAAAAC~&jid=&gjid=&cid=226520194.1633601336&tid=UA-56367941-1&_gid=1942957253.1633601336&cd3=(Non-Company%20Visitor)&cd4=(Non-Company%20Visitor)&cd5=(Non-Company%20Visitor)&cd6=(Non-Company%20Visitor)&cd7=(Non-Company%20Visitor)&cd8=(Non-Company%20Visitor)&cd9=Bot&cd10=(Non-Company%20Visitor)&cd11=(Non-Company%20Visitor)&cd12=(Non-Company%20Visitor)&cd13=(Non-Company%20Visitor)&cd14=United%20States&z=1918807
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.185.174 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s51-in-f14.1e100.net
Software
Golfe2 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 06 Oct 2021 12:35:08 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
age
77628
content-type
image/gif
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
35
expires
Mon, 01 Jan 1990 00:00:00 GMT
img
pixel.mathtag.com/misc/ Frame 71E6 		43 B
493 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pixel.mathtag.com/misc/img?mm_bnc&bcdv=0
Requested by
Host: pixel.mathtag.com
URL: https://pixel.mathtag.com/sync/iframe?mt_uuid=1003615e-c738-4900-92d1-d4af52ab233a&no_iframe=1&mt_adid=241675&source=mathtag
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.233.201 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a2-18-233-201.deploy.static.akamaitechnologies.com
Software
MT3 3984 0e3af3b master cdg-pixel-x14 config:1.0.0 /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://pixel.mathtag.com/sync/iframe?mt_uuid=1003615e-c738-4900-92d1-d4af52ab233a&no_iframe=1&mt_adid=241675&source=mathtag
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date
Thu, 07 Oct 2021 10:08:56 GMT
Server
MT3 3984 0e3af3b master cdg-pixel-x14 config:1.0.0
P3P
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Cache-Control
no-cache
Connection
keep-alive
Content-Type
image/gif
Content-Length
43
Expires
Thu, 07 Oct 2021 10:08:55 GMT
demconf.jpg
dpm.demdex.net/ Frame 759C
Redirect Chain
  • https://dpm.demdex.net/ibs:dpid=82530&dpuuid=fb604dec-420d-434b-ada8-58fdbb58abf5-615ec738-5553&gdpr=0&gdpr_consent=
  • https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=82530&dpuuid=fb604dec-420d-434b-ada8-58fdbb58abf5-615ec738-5553&gdpr=0&gdpr_consent=
42 B
943 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=82530&dpuuid=fb604dec-420d-434b-ada8-58fdbb58abf5-615ec738-5553&gdpr=0&gdpr_consent=
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.214.44.171 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-214-44-171.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://pixel.sitescout.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

DCS
dcs-prod-irl1-1-v018-08b127a00.edge-irl1.demdex.com UNKNOWN
Pragma
no-cache
Strict-Transport-Security
max-age=31536000; includeSubDomains
content-encoding
gzip
X-Content-Type-Options
nosniff
X-TID
1w6MSf9UTFM=
P3P
policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Cache-Control
no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection
keep-alive
Content-Type
image/gif
Content-Length
59
Expires
Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

DCS
dcscanary-prod-irl1-1-v024-01c194ccd.edge-irl1.demdex.com UNKNOWN
Pragma
no-cache
Strict-Transport-Security
max-age=31536000; includeSubDomains
X-TID
5VY9+5AGQ1U=
P3P
policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Location
https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=82530&dpuuid=fb604dec-420d-434b-ada8-58fdbb58abf5-615ec738-5553&gdpr=0&gdpr_consent=
Cache-Control
no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection
keep-alive
Content-Length
0
Expires
Thu, 01 Jan 1970 00:00:00 UTC
check
pixel.tapad.com/idsync/ex/receive/ Frame 759C
Redirect Chain
  • https://pixel.tapad.com/idsync/ex/receive?partner_id=2499&partner_device_id=fb604dec-420d-434b-ada8-58fdbb58abf5-615ec738-5553
  • https://pixel.tapad.com/idsync/ex/receive/check?partner_id=2499&partner_device_id=fb604dec-420d-434b-ada8-58fdbb58abf5-615ec738-5553
95 B
425 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pixel.tapad.com/idsync/ex/receive/check?partner_id=2499&partner_device_id=fb604dec-420d-434b-ada8-58fdbb58abf5-615ec738-5553
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.227.248.159 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
159.248.227.35.bc.googleusercontent.com
Software
/
Resource Hash
3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://pixel.sitescout.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Thu, 07 Oct 2021 10:08:56 GMT
via
1.1 google
content-type
image/png
alt-svc
clear
content-length
95
strict-transport-security
max-age=31536000
p3p
policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

Redirect headers

location
https://pixel.tapad.com/idsync/ex/receive/check?partner_id=2499&partner_device_id=fb604dec-420d-434b-ada8-58fdbb58abf5-615ec738-5553
date
Thu, 07 Oct 2021 10:08:56 GMT
via
1.1 google
alt-svc
clear
content-length
0
strict-transport-security
max-age=31536000
p3p
policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
/
loadm.exelator.com/load/ Frame 759C 		0
324 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://loadm.exelator.com/load/?p=204&g=700&j=0&buid=fb604dec-420d-434b-ada8-58fdbb58abf5-615ec738-5553&gdpr=0&gdpr_consent=
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.254.143.3 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-34-254-143-3.eu-west-1.compute.amazonaws.com
Software
nginx / Undertow/1
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://pixel.sitescout.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Thu, 07 Oct 2021 10:08:56 GMT
cache-control
no-cache
access-control-allow-credentials
true
server
nginx
x-powered-by
Undertow/1
p3p
policyref=/w3c/p3p.xml, CP=NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA, policyref=/w3c/p3p.xml, CP=NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA
um
sync.teads.tv/ Frame 759C 		23 B
172 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://sync.teads.tv/um?eid=73&uid=fb604dec-420d-434b-ada8-58fdbb58abf5-615ec738-5553&gdpr=0&gdpr_consent=
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.111.242.245 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-111-242-245.deploy.static.akamaitechnologies.com
Software
akka-http/10.2.6 /
Resource Hash
328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://pixel.sitescout.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 07 Oct 2021 10:08:56 GMT
cache-control
max-age=0, no-cache, no-store
expires
Thu, 07 Oct 2021 10:08:56 GMT
server
akka-http/10.2.6
content-length
23
content-type
image/gif
tpid=fb604dec-420d-434b-ada8-58fdbb58abf5-615ec738-5553
bcp.crwdcntrl.net/map/ct=y/c=1389/tp=STSC/ Frame 759C
Redirect Chain
  • https://bcp.crwdcntrl.net/map/c=1389/tp=STSC/tpid=fb604dec-420d-434b-ada8-58fdbb58abf5-615ec738-5553
  • https://bcp.crwdcntrl.net/map/ct=y/c=1389/tp=STSC/tpid=fb604dec-420d-434b-ada8-58fdbb58abf5-615ec738-5553
49 B
731 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://bcp.crwdcntrl.net/map/ct=y/c=1389/tp=STSC/tpid=fb604dec-420d-434b-ada8-58fdbb58abf5-615ec738-5553
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.209.129.133 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-209-129-133.eu-west-1.compute.amazonaws.com
Software
Jetty(9.4.38.v20210224) /
Resource Hash
2f561b02a49376e3679acd5975e3790abdff09ecbadfa1e1858c7ba26e3ffcef

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://pixel.sitescout.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 07 Oct 2021 10:08:56 GMT
server
Jetty(9.4.38.v20210224)
p3p
CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
access-control-allow-origin
*
cache-control
no-cache
x-server
10.45.11.53
content-type
image/gif
content-length
49
expires
0

Redirect headers

pragma
no-cache
date
Thu, 07 Oct 2021 10:08:56 GMT
server
Jetty(9.4.38.v20210224)
p3p
CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
location
https://bcp.crwdcntrl.net/map/ct=y/c=1389/tp=STSC/tpid=fb604dec-420d-434b-ada8-58fdbb58abf5-615ec738-5553
cache-control
no-cache
x-server
10.45.26.137
content-length
0
expires
0
/
www.facebook.com/tr/ 		44 B
91 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.facebook.com/tr/?id=116645602292181&ev=Microdata&dl=https%3A%2F%2Fwww.cybereason.com%2Fblog%2Foperation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms&rl=&if=false&ts=1633601336617&cd[DataLayer]=%5B%5D&cd[Meta]=%7B%22title%22%3A%22Operation%20GhostShell%3A%20Novel%20RAT%20Targets%20Global%20Aerospace%20and%20Telecoms%20Firms%22%2C%22meta%3Adescription%22%3A%22The%20highly-targeted%20attacks%20against%20aerospace%20and%20telecoms%20firms%20by%20new%20Iranian%20threat%20actor%20MalKamak%20includes%20newly%20discovered%20malware%20that%20evaded%20security%20tools%20since%202018%20and%20abuses%20Dropbox%20services%20for%20command%20and%20control...%22%7D&cd[OpenGraph]=%7B%22og%3Adescription%22%3A%22The%20highly-targeted%20attacks%20against%20aerospace%20and%20telecoms%20firms%20by%20new%20Iranian%20threat%20actor%20MalKamak%20includes%20newly%20discovered%20malware%20that%20evaded%20security%20tools%20since%202018%20and%20abuses%20Dropbox%20services%20for%20command%20and%20control...%22%2C%22og%3Atitle%22%3A%22Operation%20GhostShell%3A%20Novel%20RAT%20Targets%20Global%20Aerospace%20and%20Telecoms%20Firms%22%2C%22og%3Aimage%22%3A%22https%3A%2F%2Fwww.cybereason.com%2Fhubfs%2FBLOG%2520%2520SOCIAL%2520SET%2520-%2520News%2520%25281%2529-1.png%23keepProtocol%22%2C%22og%3Aimage%3Awidth%22%3A%221200%22%2C%22og%3Aimage%3Aheight%22%3A%22627%22%2C%22og%3Aurl%22%3A%22https%3A%2F%2Fwww.cybereason.com%2Fblog%2Foperation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms%22%2C%22og%3Atype%22%3A%22article%22%7D&cd[Schema.org]=%5B%5D&cd[JSON-LD]=%5B%5D&sw=1600&sh=1200&v=2.9.47&r=stable&a=tmgoogletagmanager&ec=1&o=30&fbp=fb.1.1633601336112.1414405421&it=1633601336040&coo=false&es=automatic&tm=3&rqm=GET
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
31.13.92.36 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
edge-star-mini-shv-01-frt3.facebook.com
Software
proxygen-bolt /
Resource Hash
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Thu, 07 Oct 2021 10:08:56 GMT
last-modified
Fri, 21 Dec 2012 00:00:01 GMT
server
proxygen-bolt
strict-transport-security
max-age=31536000; includeSubDomains
content-type
image/gif
cache-control
no-cache, must-revalidate, max-age=0
cross-origin-resource-policy
cross-origin
content-length
44
alt-svc
h3=":443"; ma=3600, h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
priority
u=3,i
expires
Thu, 07 Oct 2021 10:08:56 GMT
perf
www.cybereason.com/_hcms/ 		2 B
664 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://www.cybereason.com/_hcms/perf
Requested by
Host: www.cybereason.com
URL: https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
199.60.103.30 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3

Request headers

sec-fetch-mode
cors
origin
https://www.cybereason.com
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
sec-fetch-dest
empty
cookie
__cfruid=d7e721c13da4dff96ea791e26c85151287fa3558-1633601335; __hstc=85683782.77c2b3f4e0a7e83b68e85f9b3a76cfb8.1633601335875.1633601335875.1633601335875.1; hubspotutk=77c2b3f4e0a7e83b68e85f9b3a76cfb8; __hssrc=1; __hssc=85683782.1.1633601335875; _gid=GA1.2.1942957253.1633601336; _gat=1; _gcl_au=1.1.1174171278.1633601336; _rdt_uuid=1633601336034.a4f9f072-7043-40fc-a74b-6dfeb83c4fed; __pdst=a736c08219064b77978d4fa6f108ed5f; _ga_SSF38JVRVJ=GS1.1.1633601335.1.0.1633601335.60; _ga=GA1.1.226520194.1633601336; _uetsid=94ed07d0275611ec9dcafd4eb01d8022; _uetvid=94ed3000275611ecb1d0a58348e37271; _fbp=fb.1.1633601336112.1414405421; _hjid=fb10d248-3999-4e1d-869c-dd90d1dbf4c1; _hjFirstSeen=1; _hjIncludedInPageviewSample=1; _hjAbsoluteSessionInProgress=0; _hjIncludedInSessionSample=0
content-length
845
:path
/_hcms/perf
pragma
no-cache
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
content-type
application/json
accept
*/*
cache-control
no-cache
:authority
www.cybereason.com
referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms
:scheme
https
sec-fetch-site
same-origin
:method
POST
Referer
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-type
application/json

Response headers

cf-ray
69a654cffc4f2c2a-FRA
date
Thu, 07 Oct 2021 10:08:59 GMT
cf-cache-status
DYNAMIC
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
x-hubspot-correlation-id
098392a8-c370-4a53-8998-d220c2eb261a
x-trace
2B721DF5F1E015B1F16C4BD7EA03D1437D903F2012000000000000000000
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=t0qcJ1x3rk%2FPIO%2F3rdr540n6EXveIVba%2B1%2FWMdvKP17dI2AAUUtTscXrgJfQQQd9zzj8bnpXRt33zusrChUysDPBpBiJXp0KfueHwzxVLnqVwcSrYR5Z0%2BIQ9L2Klc5w9mlBgA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/plain; charset=utf-8
access-control-allow-credentials
false
x-robots-tag
none
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length
2

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
js.driftt.com
URL
https://js.driftt.com/include/1633601400000/zdcd6x8yhg85.js

Verdicts & Comments Add Verdict or Comment

116 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| 1 object| 2 object| 3 object| 4 object| 5 object| 6 object| onbeforexrselect boolean| originAgentCluster function| $ function| jQuery function| hsjQuery object| _hsp object| Typekit object| __core-js_shared__ object| Sslac object| IN object| jQuery1112005175846983381116 object| MarkerAnimation function| hs_i18n_log function| hs_i18n_substituteStrings function| hs_i18n_insertPlaceholders function| hs_i18n_getMessage undefined| module_41681847227 function| i18n_getmessage function| i18n_getlanguage undefined| module_41682410610 undefined| module_48386556055 object| _hsq object| hsVars undefined| myInterval function| sticky_relocate object| hubspot function| jsonpHandler object| FB object| __twttrll object| twttr object| __twttr boolean| _hspb_loaded object| _paq function| sanitizeKey boolean| _hstc_loaded object| globalRoot undefined| hns function| bindToWindowOnError function| defineProperties object| leadflows function| OutpostErrorReporter boolean| popupPoliceActive undefined| hns2 undefined| jade undefined| I18n undefined| hubspot_mailcheck undefined| Pikaday undefined| reqwest undefined| exports undefined| define boolean| LEAD_FLOWS_RAN boolean| COMMON_SETUP_RAN string| GoogleAnalyticsObject function| ga object| dataLayer boolean| _hspb_ran boolean| _hstc_ran string| __hsUserToken number| expireDateTime object| google_tag_data object| gaplugins object| gaGlobal object| gaData object| google_tag_manager string| _linkedin_data_partner_id function| twq function| hj object| _hjSettings function| rdt function| fbq function| _fbq object| techtargetic function| pdst object| drift object| driftt boolean| llcookieless number| sf14gv object| _airpr function| lintrk boolean| _already_called_lintrk function| GooglemKTybQhCsO function| google_trackConversion object| GooglebQhCsO object| hjSiteSettings function| hjBootstrap object| hjBootstrapCalled object| hjLazyModules object| configArgs number| pixelRatio number| width number| height object| screenSize object| labels function| onYouTubeIframeAPIReady function| UET function| UET_init function| UET_push object| cntrUpTag object| uetq object| regeneratorRuntime object| JSON3 boolean| LEAD_FLOW_DOCUMENT_READY_RAN object| _airpr_ns object| Demandbase function| metric object| Wistia string| _wistiaElemId object| _wq object| wistiaEmbeds

54 Cookies

Domain/Path Name / Value
.www.cybereason.com/ Name: __cfruid
Value: d7e721c13da4dff96ea791e26c85151287fa3558-1633601335
.hubspot.com/ Name: __cf_bm
Value: 6PNCKHD_fKA1dDalvr9lNWQQ_LaR0AYTvz05jfSBmpU-1633601335-0-AaECSD7bvpjMYEGqoqUZAanKejJ9P56M/IGHv8rhpMVZNZGx9fiDPyEXLWm9FLt+VfeWyfwEw87+cnxeOtzkm6M=
.cybereason.com/ Name: __hstc
Value: 85683782.77c2b3f4e0a7e83b68e85f9b3a76cfb8.1633601335875.1633601335875.1633601335875.1
.cybereason.com/ Name: hubspotutk
Value: 77c2b3f4e0a7e83b68e85f9b3a76cfb8
.cybereason.com/ Name: __hssrc
Value: 1
.cybereason.com/ Name: __hssc
Value: 85683782.1.1633601335875
.cybereason.com/ Name: _gid
Value: GA1.2.1942957253.1633601336
.cybereason.com/ Name: _gat
Value: 1
.cybereason.com/ Name: _gcl_au
Value: 1.1.1174171278.1633601336
.cybereason.com/ Name: _rdt_uuid
Value: 1633601336034.a4f9f072-7043-40fc-a74b-6dfeb83c4fed
www.cybereason.com/ Name: __pdst
Value: a736c08219064b77978d4fa6f108ed5f
.bing.com/ Name: MUID
Value: 1BAAB06DBCD06C923405A0A4BD926DF5
.cybereason.com/ Name: _ga_SSF38JVRVJ
Value: GS1.1.1633601335.1.0.1633601335.60
.cybereason.com/ Name: _ga
Value: GA1.1.226520194.1633601336
.techtarget.com/ Name: __cf_bm
Value: W2AsfJNMa.P3lLo4ey5EGvceux_3Hu8hk9Jd9h743wg-1633601336-0-ATWap15odCBVFUkPxWQ/cRtSJ75GcnXZL3ml0391g7tJNkOuhXWft7dQfhhHLdmFHoO3V9SulccrHwkDYc1wGSk=
.cybereason.com/ Name: _uetsid
Value: 94ed07d0275611ec9dcafd4eb01d8022
.cybereason.com/ Name: _uetvid
Value: 94ed3000275611ecb1d0a58348e37271
.mathtag.com/ Name: uuid
Value: 1003615e-c738-4900-92d1-d4af52ab233a
.cybereason.com/ Name: _fbp
Value: fb.1.1633601336112.1414405421
.doubleclick.net/ Name: IDE
Value: AHWqTUnjv4yVqoHxj4Tt9B7SLtb30gYXMceeRkwFMWafsmmmSekDuSGY9xJTm6yr
.sitescout.com/ Name: ssi
Value: fb604dec-420d-434b-ada8-58fdbb58abf5#1633601336153
.cybereason.com/ Name: _hjid
Value: fb10d248-3999-4e1d-869c-dd90d1dbf4c1
.cybereason.com/ Name: _hjFirstSeen
Value: 1
.ws.zoominfo.com/ Name: visitorId
Value: a7cca13f61510227a3ca0f49e9639b9eff949df47d353d364200177857be59ff
.zoominfo.com/ Name: __cf_bm
Value: 8Tz_JHwJOIuad8ry50ztHaImuOGeTEpiKo.jucxbJeU-1633601336-0-AUb//Yd5bhN/dvRAadQ9JIuAnONSVpchyYS5voLAFeLHcAzByyH4/tBDmuBQuuc8BO+ARxWZnf3wcnEu1WwSzog=
.sitescout.com/ Name: _ssuma
Value: eyIzNCI6MTYzMzYwMTMzNjE4MiwiMiI6MTYzMzYwMTMzNjE4MiwiNCI6MTYzMzYwMTMzNjE4MiwiMzkiOjE2MzM2MDEzMzYxODIsIjciOjE2MzM2MDEzMzYxODJ9
dpx.airpr.com/ Name: an_airpr_recent_visit
Value: 1
.twitter.com/ Name: personalization_id
Value: "v1_Y24EK4CfjTwMjdtjrgbDtw=="
www.cybereason.com/ Name: _hjIncludedInPageviewSample
Value: 1
.cybereason.com/ Name: _hjAbsoluteSessionInProgress
Value: 0
www.cybereason.com/ Name: _hjIncludedInSessionSample
Value: 0
.mathtag.com/ Name: mt_misc
Value: mt_bt:1
.adnxs.com/ Name: uuid2
Value: 2730198256998004406
.tapad.com/ Name: TapAd_TS
Value: 1633601336312
.tapad.com/ Name: TapAd_DID
Value: 9db96d00-36d2-4685-8872-3678dca4190a
.tapad.com/ Name: TapAd_3WAY_SYNCS
Value:
.bidr.io/ Name: bito
Value: AACzu07CvY4AABfPAS93Vw
.bidr.io/ Name: bitoIsSecure
Value: ok
.demdex.net/ Name: demdex
Value: 57428369607933463523497048319137882682
.crwdcntrl.net/ Name: _cc_dc
Value: 1
.crwdcntrl.net/ Name: _cc_id
Value: bff5e1550f74e50dfd4e3e3e19e4ef5
.crwdcntrl.net/ Name: _cc_cc
Value: "ACZ4XmOQT0pLM001NDU1SDM3STU1SElLMUk1BkJDy1ST1DRTBiBIjDtuAaKhAABexgsG"
.crwdcntrl.net/ Name: _cc_aud
Value: "ABR4XmNgYGBIjDtuAaSgAAAV4gG%2F"
.dpm.demdex.net/ Name: dpm
Value: 57428369607933463523497048319137882682
apt.techtarget.com/ Name: TS01fac3f6
Value: 012c664659eae33e9525721be4a3802c13aac5b0ab2489c4b9abda6d8e2ea9c83bacb1d2a6051eaf1d882093e0fa617ce69aa770ad
.company-target.com/ Name: tuuid
Value: 57a10449-74fd-49cd-ab5f-e8023d2f062b
.company-target.com/ Name: tuuid_lu
Value: 1633601336
.linkedin.com/ Name: UserMatchHistory
Value: AQLGhiwFKhh3fAAAAXxaOjSWd3iyyevG8Ze9NrguQXCCS-EhTbNMJOIOBMBvccYpjXwha7qURoIRjA
.linkedin.com/ Name: AnalyticsSyncHistory
Value: AQIWfahg8v9URQAAAXxaOjSW96rpOY-lDfHOMbIoxYwIEGT6_VlwqC5N2FxpUTWrW3zPETwmiYRzlmXFvXkyhA
.ads.linkedin.com/ Name: lang
Value: v=2&lang=en-us
.linkedin.com/ Name: bcookie
Value: "v=2&a137427d-a746-428c-8a2b-63a5238b9cf7"
.linkedin.com/ Name: lidc
Value: "b=OGST00:s=O:r=O:a=O:p=O:g=2550:u=1:x=1:i=1633601336:t=1633687736:v=2:sig=AQHZ6-MBsgOfUMOimw2ybOMbbQD-lR-6"
.linkedin.com/ Name: lang
Value: v=2&lang=de-de
.www.linkedin.com/ Name: bscookie
Value: "v=1&20211007100856559e5467-a828-4321-8c92-8b796a773fe8AQHwE0BTFYdHR6hObA3cCEYtVRS9v4gf"

2 Console Messages

Source Level URL
Text
network error URL: https://id.rlcdn.com/464526.gif
Message:
Failed to load resource: the server responded with a status of 451 ()
network error URL: https://lltrck.com/lt-v2.min.js
Message:
Failed to load resource: the server responded with a status of 403 ()

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security max-age=31536000

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

10272547.fls.doubleclick.net
10428681.fls.doubleclick.net
adservice.google.com
alb.reddit.com
analytics.google.com
analytics.twitter.com
api.company-target.com
app.hubspot.com
apt.techtarget.com
attr.ml-api.io
bat.bing.com
bcp.crwdcntrl.net
cdn.pdst.fm
cdn2.hubspot.net
cdnjs.cloudflare.com
connect.facebook.net
dpm.demdex.net
dpx.airpr.com
fast.wistia.com
fonts.googleapis.com
fonts.gstatic.com
forms.hubspot.com
googleads.g.doubleclick.net
id.rlcdn.com
in.hotjar.com
js.driftt.com
js.hs-analytics.net
js.hs-banner.com
js.hs-scripts.com
js.hsleadflows.net
lltrck.com
loadm.exelator.com
match.prod.bidr.io
p.typekit.net
pixel.mathtag.com
pixel.sitescout.com
pixel.tapad.com
platform.linkedin.com
platform.twitter.com
px.ads.linkedin.com
px.airpr.com
s.ml-attr.com
script.hotjar.com
secure.adnxs.com
segments.company-target.com
snap.licdn.com
static.ads-twitter.com
static.hotjar.com
stats.g.doubleclick.net
sync.teads.tv
syndication.twitter.com
t.co
tag.demandbase.com
track.hubspot.com
trk.techtarget.com
up.pixel.ad
us-central1-adaptive-growth.cloudfunctions.net
use.typekit.net
vars.hotjar.com
ws.zoominfo.com
www.cybereason.com
www.facebook.com
www.google-analytics.com
www.google.com
www.googleadservices.com
www.googletagmanager.com
www.linkedin.com
www.redditstatic.com
js.driftt.com
104.111.215.74
104.111.242.245
104.16.168.82
104.16.19.94
104.17.213.204
104.17.233.204
104.17.240.204
104.17.69.176
104.18.0.92
104.18.20.191
104.19.154.83
104.19.155.83
104.244.42.67
104.244.42.69
104.244.42.72
108.174.11.37
13.107.21.200
13.107.42.14
13.224.193.116
13.224.193.31
13.224.193.73
13.225.87.106
13.225.87.16
13.225.87.40
13.225.87.69
13.225.87.8
142.250.185.142
142.250.185.162
142.250.185.164
142.250.185.174
142.250.185.198
142.250.185.66
142.250.186.35
142.250.186.40
151.101.12.157
151.101.129.140
151.101.130.110
151.101.193.140
152.199.22.144
172.217.18.106
178.79.242.16
18.196.93.253
185.33.220.242
199.60.103.30
2.16.186.10
2.16.186.59
2.18.233.201
206.19.49.24
216.239.36.54
31.13.92.14
31.13.92.36
34.254.143.3
35.227.248.159
35.244.142.80
35.244.174.68
52.209.129.133
52.214.44.171
52.215.67.80
52.51.140.204
54.163.67.9
66.155.71.25
68.67.153.60
74.125.140.155
93.184.220.66
0091726febcb55502185109ace112cd67302ca354d72f51fce8bcdcc35298913
023694a0472dde38c6600bf88e6330765839e53f64f94edb63714aeab3de7e51
03b8f9e258f69727a11fc81ce93fbc8d0d5ca96489a1e84463af819efedf0782
05978957c6c8b028f2785dc77271c286bfac76e30b7bcd7e835c2927fbe897cf
06de1d03905fa3708f8beb3b281211ec8c5dd7fcc903649f458bb6bce9241707
0a1db8e6cb7ae20e5ac308a25943b94734e7ad0f794b26eb778c7e38ae2b51e0
0a2eec7f18edeaecb0a4bbefcdfbb8abfcea0afd260fc4c4c0ae20e65241a093
0c9fac27726cffa54fe5a0f1da7932bb99e8559546927468c0f931abcf7bf352
0ea7d23d55fdda4f42a373f9a16ddb9a744c682714a9516dc95e9acdc5b3ce40
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
119bf322a2ce6d2a82422b51404bc54b375c881f12a120205598d1691fa48820
12127e3110351f54262db955bafe353593dd58c89c7f6b6fc159c10515e93c61
12958d9e965374af90bb5e177bf813b32e93d5e0283a048b04849869cd770270
18a9a74a968f6478f0a7709f4f8a6a86e14221af669b554dbdf333294dc67f86
1a9e6bf7a8466b7f6fc1368a5c895525d2803a88d5e8f1ba9333260a239ddc15
1e79f5d7c1f23b5a0a263f4d240f1a488a31a8f36f532d6accaa98eddb61ba59
218877f60296297dec8266377083291f36d46f2980c1ff027471904470d14f49
2311b7d2f30a6ab89191098f12c99253267df7219477c0702d58bf4999f4a703
267c1ae37916b433b1515b4687883dbc2fef448a533e33bbe97085d42c7738d5
26c4f84717b932188a5f1b3dfbc9ed2166d27c84b7f763f5ca218258996b78fe
28f00815d1d718764b0e6059d1e5b9f7d64a05c648bd1d182b6d8ecb7d15c225
2a1dca98fdd5907f7fcb88246575508d8af0fb184f63926d2c4b0f9549735d1b
2ade3aa1d89865ba159dcd2d025c1e4e380101d6e192ae0f0d88b22bf3569f5e
2ba7f20b1d8990e17a47fe3d88e4c766628aaa2baf1dd30fca0a0db59836f5f9
2bc2179dbcac09de834853fc91b815d3bea8112276b7b789f610078d399bcb47
2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363
2e96bf761583273e370136ed0b934a38ad1e08b386accb37277252b37b9c9961
2ecd295d295bec062cedebe177e54b9d6b19fc0a841dc5c178c654c9ccff09c0
2f561b02a49376e3679acd5975e3790abdff09ecbadfa1e1858c7ba26e3ffcef
304a0259406001319e10acd097537e33bbc0157670417a48fdd527a889951f65
328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7
341a4d40ad1b2560db940f906716d0e9539d4c0785399d7e0348fd0d3af00170
3548fdd09c76e6d1a78dc0890d0da250339a5021ef499ac8b61f9d1bfae1a43b
359197d1e7ab63fe678db88914f31f1f9f6a37bd182e0de565fc7a68302a1f50
365a7ca6f52df29efedfdac2e08a9d0f03e4e2122dd9a49803bf8dacd58480fc
3b7b8a4b411ddf8db9bacc2f3aabf406f8e4c0c087829b336ca331c40adfdff1
3e4dcf5d937c6cd9bd580358e83d9bff9769f73cc2364ed9af22c88571959adb
3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517
4139f0b62005cf3f07a86b399774246fd14ff78729116737cf47df1b6b8dd1fc
42d9f880279b211f36a978ee81979fa382507c6428865a3e863cb91366284003
43ac0ae9e90f01a0afabe35cc0aaa377336aac90759e74770251de89db0af44c
46710f0509008ad4a31212927e35441764b757d672b2ed4f892ee4e2f0804abb
49065b881b53be43323889890d9ba01f36594380bdd9ef725c5fb1f807aa6bc8
4c52e4274ebdbe29cd5b4983d888c247496b6d3bb55e05d4c0769d1b946d14f8
4da3e3aa30b5b06390d7e7e3fcfb16d648909eb429d161c2748bd6d79a7ec5fb
51443fc1aa325f301b39d89ffeae8f8a7833ed59491b89419902b32ef30b3b39
520be9aa9d6c5a6b301f92ba52999af829167a848052975840193aaf1d0ced1e
529b9c583e6cf8da02c9cadf8c38b5714198f0fde2dcde01da2d5ee681228738
538dd4ff6e384a44155168326ac40a6c20a93cd212b1fbf88ae7b0c44f9ab0bd
53f18426c8904b99d089e01c894d6cc5f2bbcb5416eab34cb134978d6e70cca5
54584eb1913c2ef88edfb80081c6a95f61730e42d3726518f24988f110e7571d
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3
56a5389239a9c676a8b6b94e5a453acefceb408fb3841e27590bcb8cc819f6c0
58ae09d221b5622f041fd635235b28202750a8c2c48a02524e45c555d99c2375
59d91999b3e0f1e6191f29f73b2b079ee1aa1350f3d88795db7518ca40a9be60
5bdf1120c4df8c868092d0bcb7f2540a85456fd94cd1e1a5570c9b63906b1a5b
5df981fec90b8eaea5545cd73ff279821506b668644df536419881bc07653ba3
5f0957fb43888099a11b4be327296643a4d9c6889303d02a0240b3b341855a9c
5f9208947e343c28851472d721d14c93a91ee132a1978f1d3e07b692586a3727
5fbaeb9f8e25d7e0143bae61d4b1802c16ce7390b96ceb2d498b0d96ff4c853f
604f11b1aa0c94217abb80eb7a5c7de728f9463e4f045fe8a34339f438a50cec
6068f86ff5e6d3a3e100e95fd0ab03a5fb9ebfca9386b2c0ee131361a62526c2
61b6e4e2b6b5459f7d92586806fe5625a8ca818aa15b421e8b71a25fd3fce9be
63e0d1cf0ded40281f4b4c439d8c6e6630e3b31acf44d0d198e2513680c4bac9
6643689ff2163b6279edbf3aed8b99f3106da59a96aff78e1fce94a3675777e2
66b4fac9494bbeda177f4637fa3e7423fc8ef54b11a6875e68cdf3e472293b2a
66ba9d76c09ad6dd52135d52c368f6d87ac40b5b4ce418e41a105fb221c7e470
69aea70ed00c6297e407afc0b1ccf6db9629eedc412bf0779467f3e462d346e3
6af036a4ec23088a2e702e364d84320dbcd420a0c8c5ef82bac37006554e3ea6
7125a66456daa35dd3e3e8cca4b9523e05caf0b4fa5bd5874676e7c6db40f3aa
7219936e6e56b9932b2f1dd06cfff09b655a729bb17d0aa6d757e14184512384
726906ee6ce6dfe1b6e35ddad151196c50277e31520de30e916e9cd9affc0ef3
72fe18777ebf37b44d58c82be9b67edceefb88c2c6984c614c72991d6e3b8853
735e44959f60192ae3b93cfafd034f89a1cd8a95510fbac7aabaf9fa05d9465a
765097740b7490e6ab6a2d8624199ab7b147e8c6cec064b6cce257750fdb1985
799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd
81c836c05ab1f2d37b7aa60d509a656c7a441e2a4fabf035c1b0666a4daa50fa
8292049c0f7e7fc6406874e976ed7e4134d3e34c16a790084b51f48595848aa0
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
835866cae4df18da17dc4e3f4d6ae62967b3e344cc0bfe029fe529ed94ae7dff
843803aeba82f94da6f1cbe1f853ccd12f5d7cc6a3afa20923e57e5df60c412d
88ca677c14d4217c2f6b8c8964a1d172027974c4c0839e4d531ad7d3d6de1987
8c24a1532dd807e59d8658b9194fecba902d94ecb8d44d44087a99563535fab3
8c8a2e123eca4b06a094242bf0184ab0f0828b77ceccc8703cd2541e17d1cdab
8e55f10c2daa743b890f7adc32fe83b58e45b1fd997888c8cfe4c7b91f54dd04
91b667b9d0de69583ee16753496325f38b91e7f77dcb34a5e49bdca3b670002a
936bceef72b48206aa1f56e46495f40fbe6f271189ff009c360eedddfcd401f1
9586d0fb1354dd56116ff8e2bf4c54bb5e283cf33abd801f338ef6054c501978
9607506688417bb09b8d6c29362c2fe29bc1b047b793cccddfce876d927fa57b
97829f8a6f2a471117ed06d0b06a81d543b091a262192369c531380779148c5c
97831ff4832c4f000e924a97b5730bebd91816c3282cc2502fca83feebd993a8
979ddb6f0c77e6744b104f96e9d7ab0f8fc56d7f24ab10d853e4e96fa425e9c5
9b9265c69a5cc295d1ab0d04e0273b3677db1a6216ce2ccf4efc8c277ed84b39
9ee63a2ce9251063533d17d87c6a2d7f06f0a3c0e38d8c9f107131ce580c057b
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7
a939b9fcb8cdec877464e6131704ef19effd6279467d48bd42afe7af8558391c
ab95872c4726727a3b09b1f8c28490c70b7e407e97fd93bbfb75a2ecc5faac36
ac5000602bb127a5a07be117df96c48667d2e2a9fb1bb33d5ebb7c50e4480a88
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
aec60bc104db041b1512185839f18f52986df7e569e5445f740dd60f763fbca8
b0bbae49dc465f15ea86724121cba8410b85b7cf2f1c8c1ac89ba6656584b56f
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b38803f733f36ff943399e6539b7fe1fa26611706ce6878b5b21c6a4f96ec862
bb40a0a0cec6732e3ed3fb49ad3933f72f441e28585dfaea5e58035f5520709c
bf6c1e2f8c250b7efeb5d250181599880b1c17efc3c94466aa5d847454bf14ef
c6d03b7a5561687268e57b13d9d4a6a4c71ee570ea74718040ce9227676e3e5e
c9130ee8c979a74ab038cf5e8a06db5cb94253eab35ea5242f515d605f4781ad
cb8d40d1eb7e2dc885affcf0012d9e1a73c270d843e8b890d36538e52d0a0342
cfd3099998b0c37ace8024cbd802160585ba9be1c0047fefc172035184f074df
d30f0b5cfc0677eb181d27a9a95e7646cb8619c39b61af0f314aabae8042c541
d82231820461c83d1b0966caae71bd2732bd89e9a910fdb90d193c3dca16dbc7
d891455e32c9a425e36e190047b1f58abeb7e3709eff687134ddea7ac9cfdd3b
d8bb0208ad9a0c3a5bda77e7684365d738c2da4084c9bee50ed868380fba7c5c
d8dee5bb67e8a759f73dfbaeadba9220ad478a8187f58a59a50f906b0e51f65b
dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4
df3e003cc30e9bdd0313100e8ee5d468070b4b34d11ad355f276a356d4b9c7bf
e25be07e98d8af6966a317f09b01392cce60447ed768a034ec1b18843ee6dcbc
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e4d41fad643257f1b89daa37cbe8d9c0ce35a9d39a465e126a11311c03c703c2
e5414240e1b04e9d52490a3a54b3fc05978f47ae60cd01e8a61ba799ef0f80df
e6b6cd7a4fc13d7fd71a9b17195f51e5888ba257d487fc6bdde79690fe5f955e
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f903f416e22249cfab4769b65c97a216746ff7d579fc7fa983740943240a9362
f9db6465a204cc4186368b72a0ba4f063e64569aa4fc96e0f40c7ac69423121b
fd222137f245c06ddb4c4d44db41f12138dad6cf8ef5d4d4a5e500f38f0c8c62
fed785a6a8ca96fb67230fec5d85f9c508db49f4075aa0ef284af56cd89813e3