www.group-ib.com Open in urlscan Pro
3.72.181.255  Public Scan

17 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

1. https://www.group-ib.com/media-center/press-releases/sidewinder-apt-report/ Page URL
2. https://www.group-ib.com/media-center/press-releases/sidewinder-apt-report/ Page URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 76

• https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=4496601&time=1697653810791&url=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fsidewinder-apt-report%2F&tm=gtmv2 HTTP 302
• https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=4496601&time=1697653810791&url=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fsidewinder-apt-report%2F&tm=gtmv2&cookiesTest=true HTTP 302
• https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D4496601%26time%3D1697653810791%26url%3Dhttps%253A%252F%252Fwww.group-ib.com%252Fmedia-center%252Fpress-releases%252Fsidewinder-apt-report%252F%26tm%3Dgtmv2%26cookiesTest%3Dtrue%26liSync%3Dtrue HTTP 302
• https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=4496601&time=1697653810791&url=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fsidewinder-apt-report%2F&tm=gtmv2&cookiesTest=true&liSync=true HTTP 302
• https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=4496601&time=1697653810791&url=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fsidewinder-apt-report%2F&tm=gtmv2&cookiesTest=true&liSync=true&e_ipv6=AQKJaGbyVv7z-QAAAYtEDWlDoTL4uCckk1biddTFcPn63r9UO3arEEyBrvb9C2AorXH17qNRh9OQ

Request Chain 92

• https://mc.yandex.com/sync_cookie_image_check HTTP 302
• https://mc.yandex.ru/sync_cookie_image_start?redirect_domain=mc.yandex.com&token=10160.cBOVT6CSro7VMTISOmtDENikrpWccgLwwSzkBS7sfnj_7Yo6iEwUeoZdT7uNTg_9.q68f362muIyyyXeJ1g1Z_pJn8dU%2C HTTP 302
• https://mc.yandex.com/sync_cookie_image_decide?token=10160._pulQcu05VWlPcI6AaWH6SoxS2sgkUV-rfMIAX56p99QRHxnpfPl66YJfukOutl7fsY5KiTTGrGs7YhPQdr09CqQvVjnzI_MMMTMVO3slUIWBGHCURybZCA6ikhEcvqH0kYpa7-orhzg53HOD5rscwNG3HrNKUvaztDOPhpTOxm1GgjlhIZe3G78USM0XAqpt_0vhbhnaQ2h4h4Qfj7ETZHzPENBD9tgbGd7aYydPlY%2C.3H7AWt3iHGk0hopqdjtSvLJQ7VE%2C HTTP 302
• https://mc.yandex.ru/sync_cookie_image_finish?redirect_domain=mc.yandex.com&token=10160.srMTufwk050YPLISp1tvDkY_YBHUkoXtWt0qcrZNsGBFB37QSg99Tt62LABRNQse3m-njDU1GHBeTtDprgMMgJN6xaoUEgyYb--S1aEk1MCFXIj_YYdB6psH4hfcJaf_VFYE5hvGbzlyAq4hhdCDBXCOYUPIDZSf-rw3DeWHE11oM9GHgRvpL_JLBAzztHFLxeY7lCcpyHmtOsPWLG2mWQ%2C%2C.XbeB7b9bH_CIMzFGaBGPceITfmQ%2C

Request Chain 107

• https://mc.yandex.com/watch/26812653?wmode=7&page-url=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fsidewinder-apt-report%2F&charset=utf-8&site-info=%7B%22shareVersion%22%3A2%2C%22strategy%22%3A%22d%2Fn%2Fq%2Fr%2Fs%2Ft%22%7D&uah=chm%0A%3F0&browser-info=pv%3A1%3Avf%3A3qm6qq812ez2u52y4wzrnbv%3Afp%3A498%3Afu%3A1%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A1135%3Acn%3A1%3Adp%3A0%3Als%3A810756797713%3Ahid%3A831156496%3Az%3A120%3Ai%3A20231018203010%3Aet%3A1697653811%3Ac%3A1%3Arn%3A507436145%3Arqn%3A1%3Au%3A1697653811210564030%3Aw%3A1600x1200%3As%3A1600x1200x24%3Ask%3A1%3Awv%3A2%3Ads%3A0%2C0%2C49%2C18%2C1%2C0%2C%2C414%2C0%2C%2C%2C%2C668%3Aco%3A0%3Acpf%3A1%3Ans%3A1697653809974%3Aadb%3A2%3Arqnl%3A1%3Ast%3A1697653811%3At%3AMolted%20skin%3A%20APT%20SideWinder%202021%20campaign%20that%20targeted%20over%2060%20companies%20in%20the%20Asia-Pacific%20%7C%20Group-IB&t=gdpr(14)clc(0-0-0)rqnt(1)aw(1)ti(2) HTTP 302
• https://mc.yandex.com/watch/26812653/1?wmode=7&page-url=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fsidewinder-apt-report%2F&charset=utf-8&site-info=%7B%22shareVersion%22%3A2%2C%22strategy%22%3A%22d%2Fn%2Fq%2Fr%2Fs%2Ft%22%7D&uah=chm%0A%3F0&browser-info=pv%3A1%3Avf%3A3qm6qq812ez2u52y4wzrnbv%3Afp%3A498%3Afu%3A1%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A1135%3Acn%3A1%3Adp%3A0%3Als%3A810756797713%3Ahid%3A831156496%3Az%3A120%3Ai%3A20231018203010%3Aet%3A1697653811%3Ac%3A1%3Arn%3A507436145%3Arqn%3A1%3Au%3A1697653811210564030%3Aw%3A1600x1200%3As%3A1600x1200x24%3Ask%3A1%3Awv%3A2%3Ads%3A0%2C0%2C49%2C18%2C1%2C0%2C%2C414%2C0%2C%2C%2C%2C668%3Aco%3A0%3Acpf%3A1%3Ans%3A1697653809974%3Aadb%3A2%3Arqnl%3A1%3Ast%3A1697653811%3At%3AMolted%20skin%3A%20APT%20SideWinder%202021%20campaign%20that%20targeted%20over%2060%20companies%20in%20the%20Asia-Pacific%20%7C%20Group-IB&t=gdpr%2814%29clc%280-0-0%29rqnt%281%29aw%281%29ti%282%29

119 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
9 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	403	/ Show response www.group-ib.com/media-center/press-releases/sidewinder-apt-report/	7 KB 7 KB	315ms 12ms	Document text/html	3.72.181.255 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://www.group-ib.com/media-center/press-releases/sidewinder-apt-report/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 3.72.181.255 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-3-72-181-255.eu-central-1.compute.amazonaws.com Software / Resource Hash c8a093cc2d324481ccd87d5bf94b134f68ece777cdfd2e643753477d187af5fa Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers cache-control no-cache, no-store, must-revalidate content-type text/html date Wed, 18 Oct 2023 18:30:08 GMT
GET H/1.1	200 OK	bt-autoinject.js Show response fhp-de-js.group-ib.com/d/	342 KB 134 KB	82ms 31ms	Script text/javascript	188.40.44.175 HETZNER-AS
General Check archive.org Show headers Download Go to Full URL https://fhp-de-js.group-ib.com/d/bt-autoinject.js Requested by Host: www.group-ib.com URL: https://www.group-ib.com/media-center/press-releases/sidewinder-apt-report/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 188.40.44.175 , Germany, ASN24940 (HETZNER-AS, DE), Reverse DNS static.175.44.40.188.clients.your-server.de Software nginx / Resource Hash ba94685a300cba555ba04b2e16a9c28c59e08a54c6c3822048b92fda87d75fde Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers Date Wed, 18 Oct 2023 18:30:08 GMT Content-Encoding gzip Server nginx Transfer-Encoding chunked Vary Accept-Encoding Content-Type text/javascript; charset=UTF-8 Access-Control-Allow-Methods GET, POST, OPTIONS x-envoy-upstream-service-time 0 Access-Control-Allow-Credentials true Connection keep-alive Access-Control-Allow-Headers Accept,DNT,Keep-Alive,User-Agent,If-Modified-Since,Cache-Control,Content-Type,Origin,ETag,If-None-Match,X-Cfids,Authorization
GET DATA	200 OK	truncated /	481 B 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash fb832bcda8dc73f9b54a8e2487813b58879d3ce3de7c1458694eee98bf0e9f18 Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	4 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 43e75be5a6a535328afa8e04dae8f5e23ce3ba4c86e6d939c67d6c03332c84f3 Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers Content-Type image/png
GET H2	200	idgib-w-61354c22-16cc-40a8-a871-6901f1a76e24 Show response www.group-ib.com/api/fl/	205 B 660 B	47ms 47ms	XHR application/json	3.72.181.255 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://www.group-ib.com/api/fl/idgib-w-61354c22-16cc-40a8-a871-6901f1a76e24 Requested by Host: fhp-de-js.group-ib.com URL: https://fhp-de-js.group-ib.com/d/bt-autoinject.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 3.72.181.255 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-3-72-181-255.eu-central-1.compute.amazonaws.com Software nginx / Resource Hash 2f784956b85effbad0705cfea10b0c0ae37f55e8868b332d9d1349b6b85269b8 Request headers Referer https://www.group-ib.com/media-center/press-releases/sidewinder-apt-report/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 x-cfids - Response headers date Wed, 18 Oct 2023 18:30:08 GMT content-encoding gzip server nginx etag W/"UnUvcAKQVEi667IqzqPfvZ1Je/cIPb4nP+LG+az7I1To5BptvTci1gKvLuiDevAr9OkiT0mq3REFySOd3A8a0xLhl2OI+aH/pNOxzfanppyoP+IZdFlrQbK8Y0ecgKZwDsVng+6OJl99QCUY3Wqe5eIc" vary Accept-Encoding content-type application/json; charset=utf-8 cache-control no-cache x-envoy-upstream-service-time 0
POST H2	200	fl www.group-ib.com/api/	665 B 986 B	96ms 95ms	XHR application/json	3.72.181.255 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://www.group-ib.com/api/fl?u=078c8cd0-6dd4-11ee-991f-4be53f4f36ab&cfidsgib-w-61354c22-16cc-40a8-a871-6901f1a76e24=UnUvcAKQVEi667IqzqPfvZ1Je%2FcIPb4nP%2BLG%2Baz7I1To5BptvTci1gKvLuiDevAr9OkiT0mq3REFySOd3A8a0xLhl2OI%2BaH%2FpNOxzfanppyoP%2BIZdFlrQbK8Y0ecgKZwDsVng%2B6OJl99QCUY3Wqe5eIc Requested by Host: fhp-de-js.group-ib.com URL: https://fhp-de-js.group-ib.com/d/bt-autoinject.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 3.72.181.255 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-3-72-181-255.eu-central-1.compute.amazonaws.com Software nginx / Resource Hash Request headers Referer https://www.group-ib.com/media-center/press-releases/sidewinder-apt-report/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Content-Type text/plain;charset=UTF-8 Response headers date Wed, 18 Oct 2023 18:30:09 GMT content-encoding gzip server nginx vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS content-type application/json; charset=utf-8 access-control-allow-origin https://www.group-ib.com cache-control no-store access-control-allow-credentials true x-envoy-upstream-service-time 2 access-control-allow-headers Accept,DNT,Keep-Alive,User-Agent,If-Modified-Since,Cache-Control,Content-Type,Origin,ETag,If-None-Match,X-Cfids,Authorization
GET H2	200	Primary Request / Show response www.group-ib.com/media-center/press-releases/sidewinder-apt-report/	76 KB 16 KB	49ms 49ms	Document text/html	3.72.181.255 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://www.group-ib.com/media-center/press-releases/sidewinder-apt-report/ Requested by Host: www.group-ib.com URL: https://www.group-ib.com/media-center/press-releases/sidewinder-apt-report/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 3.72.181.255 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-3-72-181-255.eu-central-1.compute.amazonaws.com Software nginx / Resource Hash 346cc7e6cf178c4a8f66596651fa5121349537400767e9dd6ce424565feab9c1 Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers Referer https://www.group-ib.com/media-center/press-releases/sidewinder-apt-report/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers accept-ranges bytes access-control-allow-origin https://www.group-ib.com cache-control private, max-age=3600 content-encoding gzip content-length 16306 content-security-policy frame-ancestors 'self'; content-type text/html; charset=UTF-8 date Wed, 18 Oct 2023 18:30:09 GMT etag "3f2e-607ff0afdcc09" last-modified Wed, 18 Oct 2023 15:10:42 GMT permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() referrer-policy strict-origin-when-cross-origin server nginx strict-transport-security max-age=31536000; includeSubDomains vary X-Forwarded-Proto,Accept-Encoding,Cookie x-content-type-options nosniff x-frame-options sameorigin x-xss-protection 1; mode=block
POST H2	200	fl www.group-ib.com/api/	665 B 692 B	50ms 50ms	Ping application/json	3.72.181.255 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://www.group-ib.com/api/fl?u=078c8cd0-6dd4-11ee-991f-4be53f4f36ab&cfidsgib-w-61354c22-16cc-40a8-a871-6901f1a76e24=CiVWzsZQwKdXVcu31ejVqCwEq3HRYEfZ4Y8WV6m9w87A5ez41OTvZxLcpj5NbeMDrJNQEMXyXy1wvEix4SjGc0zShIgcjtauS6dloYnZKkhAFbzW5DOVe%2FrEy4%2BzkX8pr6lfWsNCswhSCa8cxQjEwaYXqOAqpnKO59KX Requested by Host: fhp-de-js.group-ib.com URL: https://fhp-de-js.group-ib.com/d/bt-autoinject.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 3.72.181.255 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-3-72-181-255.eu-central-1.compute.amazonaws.com Software nginx / Resource Hash Request headers Referer https://www.group-ib.com/media-center/press-releases/sidewinder-apt-report/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Content-Type text/plain;charset=UTF-8 Response headers date Wed, 18 Oct 2023 18:30:09 GMT content-encoding gzip server nginx vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS content-type application/json; charset=utf-8 access-control-allow-origin https://www.group-ib.com cache-control no-store access-control-allow-credentials true x-envoy-upstream-service-time 1 access-control-allow-headers Accept,DNT,Keep-Alive,User-Agent,If-Modified-Since,Cache-Control,Content-Type,Origin,ETag,If-None-Match,X-Cfids,Authorization
GET H/1.1	200 OK	bt-autoinject.js Show response fhp-de-js.group-ib.com/d/	342 KB 134 KB	27ms 26ms	Script text/javascript	188.40.44.175 HETZNER-AS
General Check archive.org Show headers Download Go to Full URL https://fhp-de-js.group-ib.com/d/bt-autoinject.js Requested by Host: www.group-ib.com URL: https://www.group-ib.com/media-center/press-releases/sidewinder-apt-report/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 188.40.44.175 , Germany, ASN24940 (HETZNER-AS, DE), Reverse DNS static.175.44.40.188.clients.your-server.de Software nginx / Resource Hash ba94685a300cba555ba04b2e16a9c28c59e08a54c6c3822048b92fda87d75fde Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers Date Wed, 18 Oct 2023 18:30:10 GMT Content-Encoding gzip Server nginx Transfer-Encoding chunked Vary Accept-Encoding Content-Type text/javascript; charset=UTF-8 Access-Control-Allow-Methods GET, POST, OPTIONS x-envoy-upstream-service-time 0 Access-Control-Allow-Credentials true Connection keep-alive Access-Control-Allow-Headers Accept,DNT,Keep-Alive,User-Agent,If-Modified-Since,Cache-Control,Content-Type,Origin,ETag,If-None-Match,X-Cfids,Authorization
GET H2	200	lazyload.min.js Show response www.group-ib.com/wp-content/plugins/w3-total-cache/pub/js/	6 KB 2 KB	21ms 20ms	Script application/x-javascript	3.72.181.255 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://www.group-ib.com/wp-content/plugins/w3-total-cache/pub/js/lazyload.min.js Requested by Host: www.group-ib.com URL: https://www.group-ib.com/media-center/press-releases/sidewinder-apt-report/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 3.72.181.255 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-3-72-181-255.eu-central-1.compute.amazonaws.com Software nginx / Resource Hash 1a54a1907a6443e3c81608130bfed4546eb0ce5d0c8897e1d7a3b43d89ecc367 Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/media-center/press-releases/sidewinder-apt-report/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; content-encoding gzip x-content-type-options nosniff date Wed, 18 Oct 2023 18:30:10 GMT strict-transport-security max-age=31536000; includeSubDomains content-length 2356 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Tue, 17 Oct 2023 14:39:45 GMT server nginx etag "1883-607ea7e6d372f-gzip" vary X-Forwarded-Proto,Accept-Encoding x-frame-options sameorigin content-type application/x-javascript access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes expires Wed, 18 Oct 2023 19:00:10 GMT
GET H2	200	swiper-bundle.min.js Show response website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/js/	140 KB 39 KB	256ms 123ms	Script application/x-javascript	2600:9000:238d:1a00:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/js/swiper-bundle.min.js Requested by Host: www.group-ib.com URL: https://www.group-ib.com/media-center/press-releases/sidewinder-apt-report/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:238d:1a00:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash b624e1e378abe009ef0de69a698b0a3e734af47efcdbd6816d5fcb8fc64c8bfe Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; content-encoding gzip x-content-type-options nosniff strict-transport-security max-age=31536000; includeSubDomains via 1.1 b26a5eb677aed7368a2c7fd7f1d673dc.cloudfront.net (CloudFront) date Wed, 18 Oct 2023 18:30:10 GMT x-amz-cf-pop AMS1-P1 x-cache RefreshHit from cloudfront content-length 39504 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Mon, 05 Sep 2022 07:41:14 GMT server nginx etag "22ede-5e7e9344df9f2-gzip" x-frame-options sameorigin vary Accept-Encoding content-type application/x-javascript access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id CXeOfIbMRgeJL4yDaaApM6kN2ibZNGuIWk4yHRXxSZWujxjAE-kItg== expires Wed, 18 Oct 2023 19:00:10 GMT
GET H2	200	classic-themes.min.css website.cdn.group-ib.com/wp-includes/css/	217 B 1009 B	240ms 106ms	Stylesheet text/css	2600:9000:238d:1a00:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://website.cdn.group-ib.com/wp-includes/css/classic-themes.min.css Requested by Host: www.group-ib.com URL: https://www.group-ib.com/media-center/press-releases/sidewinder-apt-report/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:238d:1a00:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash 5a5f39391fbf5b06db84b8f9716d53de575ee97a627d2c5f12f79a991a671eb5 Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; content-encoding gzip x-content-type-options nosniff strict-transport-security max-age=31536000; includeSubDomains via 1.1 b26a5eb677aed7368a2c7fd7f1d673dc.cloudfront.net (CloudFront) date Wed, 18 Oct 2023 18:30:10 GMT x-amz-cf-pop AMS1-P1 x-cache RefreshHit from cloudfront content-length 189 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Fri, 11 Nov 2022 11:58:50 GMT server nginx etag "d9-5ed309cf15c82-gzip" x-frame-options sameorigin vary Accept-Encoding content-type text/css access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id cZxss62PfUuV4fbggeqoqXydZlM8FzkalaK6A6oryO88PxopnDw-Mg== expires Wed, 18 Oct 2023 19:00:10 GMT
GET H2	200	dashicons.min.css website.cdn.group-ib.com/wp-includes/css/	58 KB 36 KB	240ms 107ms	Stylesheet text/css	2600:9000:238d:1a00:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://website.cdn.group-ib.com/wp-includes/css/dashicons.min.css Requested by Host: www.group-ib.com URL: https://www.group-ib.com/media-center/press-releases/sidewinder-apt-report/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:238d:1a00:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash c21e5a2b32c47bc5f9d9efc97bc0e29fd081946d1d3ebffc5621cfafb1d3960e Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; content-encoding gzip x-content-type-options nosniff strict-transport-security max-age=31536000; includeSubDomains via 1.1 b26a5eb677aed7368a2c7fd7f1d673dc.cloudfront.net (CloudFront) date Wed, 18 Oct 2023 18:30:10 GMT x-amz-cf-pop AMS1-P1 x-cache RefreshHit from cloudfront content-length 35730 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Fri, 10 Jun 2022 07:03:36 GMT server nginx etag "e688-5e112897ec200-gzip" x-frame-options sameorigin vary Accept-Encoding content-type text/css access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id ZgFf4uZxHm1gqGRd9XkLYiaAv6RJgeL1BlX3QXsyGkkYGkr9TvAVmg== expires Wed, 18 Oct 2023 19:00:10 GMT
GET H2	200	frontend.min.css www.group-ib.com/wp-content/plugins/post-views-counter/css/	215 B 333 B	20ms 19ms	Stylesheet text/css	3.72.181.255 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://www.group-ib.com/wp-content/plugins/post-views-counter/css/frontend.min.css Requested by Host: www.group-ib.com URL: https://www.group-ib.com/media-center/press-releases/sidewinder-apt-report/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 3.72.181.255 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-3-72-181-255.eu-central-1.compute.amazonaws.com Software nginx / Resource Hash ed70c2cf61d0f24d03299ffc5896c7abd86bb858501987dc10e3afec086c01df Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/media-center/press-releases/sidewinder-apt-report/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; content-encoding gzip x-content-type-options nosniff date Wed, 18 Oct 2023 18:30:10 GMT strict-transport-security max-age=31536000; includeSubDomains content-length 160 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Wed, 26 Apr 2023 07:26:40 GMT server nginx etag "d7-5fa38293ec798-gzip" vary X-Forwarded-Proto,Accept-Encoding x-frame-options sameorigin content-type text/css access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes expires Wed, 18 Oct 2023 19:00:10 GMT
GET H2	200	jquery.min.js Show response website.cdn.group-ib.com/wp-includes/js/jquery/	88 KB 31 KB	205ms 72ms	Script application/x-javascript	2600:9000:238d:1a00:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://website.cdn.group-ib.com/wp-includes/js/jquery/jquery.min.js Requested by Host: www.group-ib.com URL: https://www.group-ib.com/media-center/press-releases/sidewinder-apt-report/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:238d:1a00:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash cc7403bab52ed166e24ea9324241045af370be482f5b594468f4a6ac6e7e7981 Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; content-encoding gzip x-content-type-options nosniff strict-transport-security max-age=31536000; includeSubDomains via 1.1 b26a5eb677aed7368a2c7fd7f1d673dc.cloudfront.net (CloudFront) date Wed, 18 Oct 2023 18:30:10 GMT x-amz-cf-pop AMS1-P1 x-cache RefreshHit from cloudfront content-length 30995 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Fri, 11 Nov 2022 11:58:50 GMT server nginx etag "15e54-5ed309cf21802-gzip" x-frame-options sameorigin vary Accept-Encoding content-type application/x-javascript access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id lYchZefFq6WW10JBqFGuR2m0kkmuKRLRtOxW-1z70IocorTrO14bRA== expires Wed, 18 Oct 2023 19:00:10 GMT
GET H2	200	single-press-release.css website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/	227 KB 34 KB	258ms 125ms	Stylesheet text/css	2600:9000:238d:1a00:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-press-release.css Requested by Host: www.group-ib.com URL: https://www.group-ib.com/media-center/press-releases/sidewinder-apt-report/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:238d:1a00:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash 9ea99438227af036f87175bd97770d185538ffd7bf7e3c9a786bd735b68d8f66 Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; content-encoding gzip x-content-type-options nosniff date Wed, 18 Oct 2023 18:30:10 GMT via 1.1 b26a5eb677aed7368a2c7fd7f1d673dc.cloudfront.net (CloudFront) strict-transport-security max-age=31536000; includeSubDomains x-amz-cf-pop AMS1-P1 x-cache Miss from cloudfront content-length 33723 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Wed, 18 Oct 2023 18:30:08 GMT server nginx etag "38aba-60801d43b1896-gzip" x-frame-options sameorigin vary Accept-Encoding content-type text/css access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id uuE6KIxqu_uu38pb1aumLRbmqdt61RGHJXfpgpCAppYS-DDXI_EfnQ== expires Wed, 18 Oct 2023 19:00:10 GMT
GET H2	200	v2.js Show response js-eu1.hsforms.net/forms/	563 KB 179 KB	170ms 37ms	Script application/javascript	172.65.255.172 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://js-eu1.hsforms.net/forms/v2.js Requested by Host: www.group-ib.com URL: https://www.group-ib.com/media-center/press-releases/sidewinder-apt-report/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.65.255.172 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 279817a125934c4629aa278564e64fca0dcb0fdc45f38739e38c9cab297d2a92 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers content-encoding br age 74 x-evy-trace-route-service-name envoyset-translator x-amz-server-side-encryption AES256 content-security-policy-report-only frame-ancestors 'self'; report-uri https://send.hsbrowserreports.com/csp/report?resource=forms-embed/static-1.3938/bundles/project-v2.js&cfRay=8182d80a6a5637ef-FRA x-amz-replication-status COMPLETED x-evy-trace-listener listener_https etag W/"df4d197f9648d27915af7ec01a018b73" vary Accept-Encoding content-type application/javascript; charset=utf-8 access-control-allow-origin * x-evy-trace-virtual-host all cache-control s-maxage=600, max-age=300 x-hs-target-asset forms-embed/static-1.3938/bundles/project-v2.js date Wed, 18 Oct 2023 18:30:10 GMT x-amz-version-id pLPYW3H2ND7V2jGLhGJ4mCejj6Xammwx via 1.1 4a502b22092e94faddf9a5b056e273ae.cloudfront.net (CloudFront) x-content-type-options nosniff cf-cache-status HIT nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} strict-transport-security max-age=31536000; includeSubDomains; preload x-amz-cf-pop FRA56-P2 x-hubspot-correlation-id 2a7a3b75-87da-429a-bf03-e67e45f6fe67 x-cache Hit from cloudfront cache-tag staticjsapp-forms-embed-v2-web-prod,staticjsapp-prod x-envoy-upstream-service-time 10 alt-svc h3=":443"; ma=86400 x-evy-trace-route-configuration listener_https/all x-request-id 2a7a3b75-87da-429a-bf03-e67e45f6fe67 last-modified Thu, 12 Oct 2023 03:05:49 UTC server cloudflare report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=WvhZRTR203St1kNPK6yuY0etouryELNHzstsJpVbaNBtEraYvZVIEOwbQUjHb%2FHq7IVyc%2FNRL5tr%2BWzOYs64F7A%2F9sAOAFks%2BMg97kn8JQeWFuxOX2ZDKTbpN4mdim5HDT%2Bb7Q%3D%3D"}],"group":"cf-nel","max_age":604800} x-hs-cache-status HIT x-evy-trace-served-by-pod fra04/app-td/envoy-proxy-797758f45b-8q8m9 cf-ray 8182d9d9ac8937eb-FRA x-amz-cf-id 4DWT07rdb1hkfR5XczhwmentxszfyZDJA3T0NgMm8qnEKNfagP6-nA==
GET H2	200	jquery-ui.js Show response website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/libs/jquery-ui/	517 KB 125 KB	56ms 55ms	Script application/x-javascript	2600:9000:238d:1a00:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/libs/jquery-ui/jquery-ui.js Requested by Host: www.group-ib.com URL: https://www.group-ib.com/media-center/press-releases/sidewinder-apt-report/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:238d:1a00:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash e97315234cc1f1c4737d98ea29c0f4d4f06c032dc5943012ae50bc4b10a92276 Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; content-encoding gzip x-content-type-options nosniff strict-transport-security max-age=31536000; includeSubDomains via 1.1 b26a5eb677aed7368a2c7fd7f1d673dc.cloudfront.net (CloudFront) date Wed, 18 Oct 2023 18:30:10 GMT x-amz-cf-pop AMS1-P1 x-cache RefreshHit from cloudfront x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Mon, 05 Sep 2022 07:24:28 GMT server nginx etag "812a6-5e7e8f85cb376-gzip" x-frame-options sameorigin vary Accept-Encoding content-type application/x-javascript access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id BJ5ratPmwfKUMu-c-XqVQkAirMuYtQUutiLzw2UtIcGNFdfQvFuCag== expires Wed, 18 Oct 2023 19:00:10 GMT
GET H2	200	fancybox.umd.js Show response website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/libs/fancybox/	103 KB 30 KB	205ms 73ms	Script application/x-javascript	2600:9000:238d:1a00:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/libs/fancybox/fancybox.umd.js Requested by Host: www.group-ib.com URL: https://www.group-ib.com/media-center/press-releases/sidewinder-apt-report/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:238d:1a00:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash 942e02acf640c0308f65e057a8afaed63dfaf995034cda9cfc75532a1009ec72 Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; content-encoding gzip x-content-type-options nosniff strict-transport-security max-age=31536000; includeSubDomains via 1.1 b26a5eb677aed7368a2c7fd7f1d673dc.cloudfront.net (CloudFront) date Wed, 18 Oct 2023 18:30:10 GMT x-amz-cf-pop AMS1-P1 x-cache RefreshHit from cloudfront content-length 29634 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Mon, 05 Sep 2022 07:24:28 GMT server nginx etag "19ca6-5e7e8f85cb376-gzip" x-frame-options sameorigin vary Accept-Encoding content-type application/x-javascript access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id D4znM28oAK6iudEP6vSmBPjdfna8I2hxWBXbkfew1-3IaRMHoupbzw== expires Wed, 18 Oct 2023 19:00:10 GMT
GET H2	200	main.js Show response website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/js/	212 KB 45 KB	61ms 60ms	Script application/x-javascript	2600:9000:238d:1a00:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/js/main.js Requested by Host: www.group-ib.com URL: https://www.group-ib.com/media-center/press-releases/sidewinder-apt-report/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:238d:1a00:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software cloudflare / Resource Hash 620418e15bd4302ca68fe0c806a6a6e74a11a7cbc56004a3e052529b73092e9b Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; strict-transport-security max-age=31536000; includeSubDomains x-content-type-options nosniff cf-cache-status BYPASS nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} date Wed, 18 Oct 2023 18:30:10 GMT content-encoding br x-amz-cf-pop AMS1-P1 via 1.1 b26a5eb677aed7368a2c7fd7f1d673dc.cloudfront.net (CloudFront) x-cache RefreshHit from cloudfront x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Fri, 06 Oct 2023 11:14:14 GMT server cloudflare etag W/"34e47-6070a5733757d-gzip" x-frame-options sameorigin report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=BXbh4Wgj3BHyncFoFR0LAb9%2FR6K%2FsCGYJrMd6LfO7fu262iY%2BAgUspwl0N9FjseSiCKKvOUi1sDjspXuwmMo5D5GYw8kwoIpMteWLWiPSwGwus%2B5QRc5xOu7l7%2F5Vg2twHk%3D"}],"group":"cf-nel","max_age":604800} content-type application/x-javascript access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() vary Accept-Encoding cf-ray 817e64155a5b9bc2-FRA x-amz-cf-id AbV_fWjJ2WwE8eLsZr5NlwmGXcD6r5sblcWCpW2Va729SC2SDCqE8g== expires Wed, 18 Oct 2023 19:00:10 GMT
GET H2	200	25755956.js Show response js-eu1.hs-scripts.com/	2 KB 1 KB	213ms 61ms	Script application/javascript	172.65.208.22 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://js-eu1.hs-scripts.com/25755956.js Requested by Host: www.group-ib.com URL: https://www.group-ib.com/media-center/press-releases/sidewinder-apt-report/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.65.208.22 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 3c7d36603c267c2e34591d131ceb020f20d2bbbda3940e505ead239dbcdb460e Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers date Wed, 18 Oct 2023 18:30:10 GMT content-encoding br x-content-type-options nosniff cf-cache-status EXPIRED x-evy-trace-route-service-name envoyset-translator x-hubspot-correlation-id d47f862e-ba0f-42e0-9d77-64b38066bcb5 x-envoy-upstream-service-time 5 x-evy-trace-route-configuration listener_https/all x-evy-trace-listener listener_https x-request-id d47f862e-ba0f-42e0-9d77-64b38066bcb5 last-modified Wed, 18 Oct 2023 18:23:24 GMT server cloudflare x-trace 2B3B2C9348621BF138A15EEEC4F56258B73AFDFEBC000000000000000000 vary origin, Accept-Encoding access-control-max-age 3600 content-type application/javascript;charset=utf-8 access-control-allow-origin https://www.group-ib.com x-evy-trace-virtual-host all cache-control public, max-age=30 access-control-allow-credentials true x-evy-trace-served-by-pod fra04/hubapi-td/envoy-proxy-86f46d6c7b-gvdlr cf-ray 8182d9db8acb9171-FRA
GET DATA	200 OK	truncated /	488 B 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash f176ebf4d0ccb386bd71e7fc160b3926d8e2ecf384c0847e4de994e0768ba4d5 Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	4 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 9a5692a0a699bd6c34e6f2cab4f9b2a3f33528ee45fcdae00504bb1d77db974e Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers Content-Type image/png
GET H2	200	idgib-w-61354c22-16cc-40a8-a871-6901f1a76e24 Show response www.group-ib.com/api/fl/	217 B 667 B	42ms 41ms	XHR application/json	3.72.181.255 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://www.group-ib.com/api/fl/idgib-w-61354c22-16cc-40a8-a871-6901f1a76e24 Requested by Host: fhp-de-js.group-ib.com URL: https://fhp-de-js.group-ib.com/d/bt-autoinject.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 3.72.181.255 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-3-72-181-255.eu-central-1.compute.amazonaws.com Software nginx / Resource Hash 49f9bbcf95f774971a19e23b13c2e9977bcee9beb724dc30cb8872b106c84a12 Request headers X-GIB-GSSCgib-w-61354c22-16cc-40a8-a871-6901f1a76e24 PJeSeZlD9/+TPUTkPpqACdjt3TOPIgbNX9+cB5gOfM5phFZHmDIdt9/nZ7tf8Oxpuyxvg7nPWEMqfRq4feQT2gZyPD0z+vZ0Ocry6BiVEf/yyAVjhfnYkqrZpMjTJkqkZeWoWE7d0dDBdfWFNQXLY5wQZpaVjDmHlqzdqJ5CYsZ3hh5rTRYeN9LLOQwdy59459xFNcO/v0W1nHqvtrvpNX7vHLz5hGjg7ZY83bHBVhebda7RHnp+xojLF/ZVOA== Referer https://www.group-ib.com/media-center/press-releases/sidewinder-apt-report/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 X-GIB-FGSSCgib-w-61354c22-16cc-40a8-a871-6901f1a76e24 r7cS957ee44d8138d708a0113c4f6e9ba8d32dd3 x-cfids CiVWzsZQwKdXVcu31ejVqCwEq3HRYEfZ4Y8WV6m9w87A5ez41OTvZxLcpj5NbeMDrJNQEMXyXy1wvEix4SjGc0zShIgcjtauS6dloYnZKkhAFbzW5DOVe/rEy4+zkX8pr6lfWsNCswhSCa8cxQjEwaYXqOAqpnKO59KX Response headers date Wed, 18 Oct 2023 18:30:10 GMT content-encoding gzip server nginx etag W/"fw8kF3a81FtkqCuLnjnmvxupvWDjyjuMEMy0KgSoTSRQyTgO8S4cxYTNM0gVuMqjqd9fFzQZ51v2byMsjINHO7grxlBvzYkg6q9djpJeJL6sekktDlNxsE0cAEwG6P59Z5f7JMZ8YbnISiFw7ceiHXSg9XIB0RELyVCo" vary Accept-Encoding content-type application/json; charset=utf-8 cache-control no-cache x-envoy-upstream-service-time 0
GET H2	200	G-font-Medium.otf website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/fonts/G-font/	60 KB 35 KB	76ms 44ms	Font application/x-font-otf	2600:9000:238d:1a00:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/fonts/G-font/G-font-Medium.otf Requested by Host: website.cdn.group-ib.com URL: https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-press-release.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:238d:1a00:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash 1efe16c9efbadde5e242d88a315eca3906a55669fcd4882a904fbc723306a4e4 Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers Referer https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-press-release.css Origin https://www.group-ib.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; content-encoding gzip x-content-type-options nosniff strict-transport-security max-age=31536000; includeSubDomains via 1.1 13a0a1a7b326f5c854b35536576cfe0e.cloudfront.net (CloudFront) date Wed, 18 Oct 2023 18:30:10 GMT x-amz-cf-pop AMS1-P1 x-cache RefreshHit from cloudfront content-length 35382 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Tue, 28 Jun 2022 07:55:26 GMT server nginx etag "eed4-5e27d5c025780-gzip" x-frame-options sameorigin vary Accept-Encoding content-type application/x-font-otf access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id pEi8xEGxLeVOUPcJSAGIgb3A6EAU3NXmXQq4N32R5ceeNOoEd3_lMg== expires Wed, 18 Oct 2023 19:00:10 GMT
GET H2	200	G-font-Regular.otf website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/fonts/G-font/	47 KB 31 KB	108ms 77ms	Font application/x-font-otf	2600:9000:238d:1a00:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/fonts/G-font/G-font-Regular.otf Requested by Host: website.cdn.group-ib.com URL: https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-press-release.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:238d:1a00:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash 6cee0fb06339ba13e1f15d044e0e4904bbeeb7fbe4351e3f102b6d80b2465061 Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers Referer https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-press-release.css Origin https://www.group-ib.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; content-encoding gzip x-content-type-options nosniff strict-transport-security max-age=31536000; includeSubDomains via 1.1 13a0a1a7b326f5c854b35536576cfe0e.cloudfront.net (CloudFront) date Wed, 18 Oct 2023 18:30:10 GMT x-amz-cf-pop AMS1-P1 x-cache RefreshHit from cloudfront content-length 30798 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Tue, 28 Jun 2022 07:55:26 GMT server nginx etag "bbf8-5e27d5c025780-gzip" x-frame-options sameorigin vary Accept-Encoding content-type application/x-font-otf access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id 17XHRgQeKuSkQyQ156PWGgjYpxZw9jxEHsttQBcM6riN6tEOiPvh2A== expires Wed, 18 Oct 2023 19:00:10 GMT
GET H/1.1	200 OK	json Show response forms-eu1.hsforms.com/embed/v3/form/25755956/044e7558-8073-478a-ad3c-5807dd76840f/	9 KB 3 KB	188ms 72ms	XHR application/json	172.65.232.43 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://forms-eu1.hsforms.com/embed/v3/form/25755956/044e7558-8073-478a-ad3c-5807dd76840f/json?hs_static_app=forms-embed&hs_static_app_version=1.3938&X-HubSpot-Static-App-Info=forms-embed-1.3938 Requested by Host: fhp-de-js.group-ib.com URL: https://fhp-de-js.group-ib.com/d/bt-autoinject.js Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 172.65.232.43 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 241ecb200c6ee2f1bc5ae244275471565ce243ebab7bdbd5deefe65dddfbde0f Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Accept application/json, text/plain, */* Referer https://www.group-ib.com/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers X-Origin-Hublet eu1 Date Wed, 18 Oct 2023 18:30:10 GMT Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff CF-Cache-Status DYNAMIC Content-Encoding br x-evy-trace-route-service-name envoyset-translator X-HubSpot-Correlation-Id 2b4c758c-ab80-4660-b2a9-656db52ab367 Transfer-Encoding chunked x-envoy-upstream-service-time 7 Connection keep-alive alt-svc h3=":443"; ma=86400 x-evy-trace-route-configuration listener_https/all x-evy-trace-listener listener_https x-request-id 2b4c758c-ab80-4660-b2a9-656db52ab367 Server cloudflare X-Trace 2B99CA2823D270B02762AA6EB3C060D5CCD59B44AC000000000000000000 Vary origin Access-Control-Allow-Methods OPTIONS, GET Content-Type application/json;charset=utf-8 Access-Control-Allow-Origin https://www.group-ib.com x-evy-trace-virtual-host all Access-Control-Expose-Headers X-Origin-Hublet Access-Control-Max-Age 180 Access-Control-Allow-Credentials false Cache-Control max-age=0, no-cache, no-store X-Robots-Tag none Access-Control-Allow-Headers * CF-RAY 8182d9db8b3e91f9-FRA x-evy-trace-served-by-pod fra04/star-hubspot-td/envoy-proxy-5cdd94655b-hn9qf
GET H2	200	cross.svg website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/main-nav/	342 B 1 KB	30ms 29ms	Image image/svg+xml	2600:9000:238d:1a00:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/main-nav/cross.svg Requested by Host: website.cdn.group-ib.com URL: https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-press-release.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:238d:1a00:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash dfb059f8aa219769088fd6c85d85aae789f1e72bfe3d314748f1f3ccfffffb1c Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-press-release.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; content-encoding gzip x-content-type-options nosniff strict-transport-security max-age=31536000; includeSubDomains via 1.1 b26a5eb677aed7368a2c7fd7f1d673dc.cloudfront.net (CloudFront) date Wed, 18 Oct 2023 18:30:10 GMT x-amz-cf-pop AMS1-P1 x-cache RefreshHit from cloudfront content-length 207 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Tue, 28 Jun 2022 07:55:26 GMT server nginx etag "156-5e27d5c025780-gzip" x-frame-options sameorigin vary Accept-Encoding content-type image/svg+xml access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id Y_yJ6gOo7QwYKZiEBwZQa5W69o1URhA3fuJkVQiIsWkoR8gilcp2BA== expires Wed, 18 Oct 2023 19:00:10 GMT
GET H/1.1	200 OK	json Show response forms-eu1.hsforms.com/embed/v3/form/25755956/4dbceae1-75ae-423a-9c12-dee8f1ca3345/	112 KB 30 KB	161ms 62ms	XHR application/json	172.65.232.43 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://forms-eu1.hsforms.com/embed/v3/form/25755956/4dbceae1-75ae-423a-9c12-dee8f1ca3345/json?hs_static_app=forms-embed&hs_static_app_version=1.3938&X-HubSpot-Static-App-Info=forms-embed-1.3938 Requested by Host: fhp-de-js.group-ib.com URL: https://fhp-de-js.group-ib.com/d/bt-autoinject.js Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 172.65.232.43 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 8733d53baaabd98a3666cd87fa239b623ea44478936605a08880c040211961d1 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Accept application/json, text/plain, */* Referer https://www.group-ib.com/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers X-Origin-Hublet eu1 Date Wed, 18 Oct 2023 18:30:10 GMT Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff CF-Cache-Status DYNAMIC Content-Encoding br x-evy-trace-route-service-name envoyset-translator X-HubSpot-Correlation-Id bcd44b11-8ff7-434c-a0ae-7d92f1b61f7c Transfer-Encoding chunked x-envoy-upstream-service-time 17 Connection keep-alive alt-svc h3=":443"; ma=86400 x-evy-trace-route-configuration listener_https/all x-evy-trace-listener listener_https x-request-id bcd44b11-8ff7-434c-a0ae-7d92f1b61f7c Server cloudflare X-Trace 2BEA7376A8ED410D8B51F9E7467662081160160BD9000000000000000000 Vary origin Access-Control-Allow-Methods OPTIONS, GET Content-Type application/json;charset=utf-8 Access-Control-Allow-Origin https://www.group-ib.com x-evy-trace-virtual-host all Access-Control-Expose-Headers X-Origin-Hublet Access-Control-Max-Age 180 Access-Control-Allow-Credentials false Cache-Control max-age=0, no-cache, no-store X-Robots-Tag none Access-Control-Allow-Headers * CF-RAY 8182d9db8d081919-FRA x-evy-trace-served-by-pod fra04/star-hubspot-td/envoy-proxy-5cdd94655b-pnstb
GET H/1.1	200 OK	json Show response forms-eu1.hsforms.com/embed/v3/form/25755956/5a995f05-701c-48e3-b25a-d1548ba3c0b3/	104 KB 29 KB	170ms 75ms	XHR application/json	172.65.232.43 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://forms-eu1.hsforms.com/embed/v3/form/25755956/5a995f05-701c-48e3-b25a-d1548ba3c0b3/json?hs_static_app=forms-embed&hs_static_app_version=1.3938&X-HubSpot-Static-App-Info=forms-embed-1.3938 Requested by Host: fhp-de-js.group-ib.com URL: https://fhp-de-js.group-ib.com/d/bt-autoinject.js Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 172.65.232.43 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 22dba217e83b399e939edc08c8ffc7cc6b151dd9e55d9698b7cd566f91733c2c Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Accept application/json, text/plain, */* Referer https://www.group-ib.com/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers X-Origin-Hublet eu1 Date Wed, 18 Oct 2023 18:30:10 GMT Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff CF-Cache-Status DYNAMIC Content-Encoding br x-evy-trace-route-service-name envoyset-translator X-HubSpot-Correlation-Id a11dee0b-68c9-4ac4-98b0-644054a21673 Transfer-Encoding chunked x-envoy-upstream-service-time 20 Connection keep-alive alt-svc h3=":443"; ma=86400 x-evy-trace-route-configuration listener_https/all x-evy-trace-listener listener_https x-request-id a11dee0b-68c9-4ac4-98b0-644054a21673 Server cloudflare X-Trace 2B89330DE4497E1572CC180505A4B6CFA55D612DB9000000000000000000 Vary origin Access-Control-Allow-Methods OPTIONS, GET Content-Type application/json;charset=utf-8 Access-Control-Allow-Origin https://www.group-ib.com x-evy-trace-virtual-host all Access-Control-Expose-Headers X-Origin-Hublet Access-Control-Max-Age 180 Access-Control-Allow-Credentials false Cache-Control max-age=0, no-cache, no-store X-Robots-Tag none Access-Control-Allow-Headers * CF-RAY 8182d9db89a32baa-FRA x-evy-trace-served-by-pod fra04/star-hubspot-td/envoy-proxy-5cdd94655b-hn9qf
GET DATA	200 OK	truncated /	64 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 01caf20e667c8e300960582162f912d9405e9895c32cff1a9ee95511fd509a2c Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	70 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash acfaaf62bff0119246c65258ed4eddfff3758441c562b3726627e377d6939118 Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	70 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash f59722d80d5bcb23fa7c960363f48f17425b85230b9ab7afce1ac2373ab48182 Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	69 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 13576fd1666bc8bbfa0781e24be84c10aebff8877e898795c9bd9847e49b7388 Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	69 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 81cc2a3a0c0b6e8335f5f3143390b8b6f036dc573e73d3f4b5742482f0bdca73 Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers Content-Type image/svg+xml
GET H/1.1	200 OK	json Show response forms-eu1.hsforms.com/embed/v3/form/25755956/55a22738-d5a5-43f9-9c1c-fa4c1a6eb349/	8 KB 3 KB	140ms 60ms	XHR application/json	172.65.232.43 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://forms-eu1.hsforms.com/embed/v3/form/25755956/55a22738-d5a5-43f9-9c1c-fa4c1a6eb349/json?hs_static_app=forms-embed&hs_static_app_version=1.3938&X-HubSpot-Static-App-Info=forms-embed-1.3938 Requested by Host: fhp-de-js.group-ib.com URL: https://fhp-de-js.group-ib.com/d/bt-autoinject.js Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 172.65.232.43 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 18f0b7409e8c981f2ce529e1b30afa3e5114161385f052ca93fe5808610bb9c2 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Accept application/json, text/plain, */* Referer https://www.group-ib.com/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers X-Origin-Hublet eu1 Date Wed, 18 Oct 2023 18:30:10 GMT Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff CF-Cache-Status DYNAMIC Content-Encoding br x-evy-trace-route-service-name envoyset-translator X-HubSpot-Correlation-Id ecbc9282-4882-4efb-bc54-8571dccb7e7e Transfer-Encoding chunked x-envoy-upstream-service-time 7 Connection keep-alive alt-svc h3=":443"; ma=86400 x-evy-trace-route-configuration listener_https/all x-evy-trace-listener listener_https x-request-id ecbc9282-4882-4efb-bc54-8571dccb7e7e Server cloudflare X-Trace 2BA975D68E0AD0ED19006775172387DABD3F6CC4E3000000000000000000 Vary origin Access-Control-Allow-Methods OPTIONS, GET Content-Type application/json;charset=utf-8 Access-Control-Allow-Origin https://www.group-ib.com x-evy-trace-virtual-host all Access-Control-Expose-Headers X-Origin-Hublet Access-Control-Max-Age 180 Access-Control-Allow-Credentials false Cache-Control max-age=0, no-cache, no-store X-Robots-Tag none Access-Control-Allow-Headers * CF-RAY 8182d9db8d133a80-FRA x-evy-trace-served-by-pod fra04/star-hubspot-td/envoy-proxy-5cdd94655b-9hfk8
GET H2	200	gtm.js Show response www.googletagmanager.com/	287 KB 90 KB	137ms 60ms	Script application/javascript	2a00:1450:4001:800::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtm.js?id=GTM-PW7265 Requested by Host: www.group-ib.com URL: https://www.group-ib.com/media-center/press-releases/sidewinder-apt-report/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:800::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash 88b4d93d5c28e061504ba9a6b0b2578cd3faa8c6990dcf99ea099cf80ed93588 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers date Wed, 18 Oct 2023 18:30:10 GMT content-encoding br strict-transport-security max-age=31536000; includeSubDomains cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 91923 x-xss-protection 0 last-modified Wed, 18 Oct 2023 18:00:00 GMT server Google Tag Manager vary Accept-Encoding content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true access-control-allow-headers Cache-Control expires Wed, 18 Oct 2023 18:30:10 GMT
GET H2	200	insight.min.js Show response website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/js/	8 KB 4 KB	41ms 41ms	Script application/x-javascript	2600:9000:238d:1a00:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/js/insight.min.js Requested by Host: www.group-ib.com URL: https://www.group-ib.com/media-center/press-releases/sidewinder-apt-report/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:238d:1a00:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software cloudflare / Resource Hash 14f2ec002b176e0dee403cb7dd4ef2274a1353080e1e3e4084678770f4c15b9c Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers strict-transport-security max-age=31536000; includeSubDomains content-security-policy frame-ancestors 'self'; x-content-type-options nosniff cf-cache-status BYPASS nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} date Wed, 18 Oct 2023 18:30:10 GMT content-encoding br x-amz-cf-pop AMS1-P1 via 1.1 b26a5eb677aed7368a2c7fd7f1d673dc.cloudfront.net (CloudFront) x-cache RefreshHit from cloudfront x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Fri, 15 Jul 2022 14:12:57 GMT server cloudflare etag W/"1e5a-5e3d89d6a8c40-gzip" x-frame-options sameorigin report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=3%2F%2BDFDQydgD86CZcerWrIFFiW4Gfx2mB%2FWvDbWObssNeQ%2BEL7I3y61%2BAi0k4R%2BpHlhpasZAWQ3T62uzn2Ov1Xz%2BICGlBtIQo8zVA7jf5y34%2F2YIsW6VnSv6GSd1B4l6ieN4%3D"}],"group":"cf-nel","max_age":604800} content-type application/x-javascript access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() vary Accept-Encoding cf-ray 8145911299ee921a-FRA x-amz-cf-id 2kRStUOdEZ-bsxCSX2rF7JWZe3DNGXLFqpUs1xXEXShBDXPYfua9_A== expires Wed, 18 Oct 2023 19:00:10 GMT
GET H2	200	dropdown_before.svg website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/main-nav/	154 B 1 KB	40ms 39ms	Image image/svg+xml	2600:9000:238d:1a00:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/main-nav/dropdown_before.svg Requested by Host: website.cdn.group-ib.com URL: https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-press-release.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:238d:1a00:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software cloudflare / Resource Hash 574ab1a3d7b47add5d43a927f62c87698264f63572acd70b42081dd4a1dc5ced Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-press-release.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers strict-transport-security max-age=31536000; includeSubDomains content-security-policy frame-ancestors 'self'; x-content-type-options nosniff cf-cache-status BYPASS nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} date Wed, 18 Oct 2023 18:30:10 GMT content-encoding br x-amz-cf-pop AMS1-P1 via 1.1 b26a5eb677aed7368a2c7fd7f1d673dc.cloudfront.net (CloudFront) x-cache RefreshHit from cloudfront x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Tue, 28 Jun 2022 07:55:26 GMT server cloudflare etag W/"9a-5e27d5c025780-gzip" x-frame-options sameorigin report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=7esrJ2dayLci2vDjReVtd9UC3LBPGsWWxleawzzfNnIyLpec4Pku4PfkS8to07A0Ag8HMd0NHzR%2BtcbKGdP5ZCN341NGcS5inSJtnvZbVR5BSTjtnmb2kF%2FwsUki47A0ENA%3D"}],"group":"cf-nel","max_age":604800} content-type image/svg+xml access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() vary Accept-Encoding cf-ray 8145918baa261d84-FRA x-amz-cf-id NTrK3gWIIx5NLv-tQxa1w7msL6HtxuMCBx1wTPioXGxSBZcW4cl9uQ== expires Wed, 18 Oct 2023 19:00:10 GMT
GET H2	200	link-arrow.svg website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/	409 B 1 KB	67ms 66ms	Image image/svg+xml	2600:9000:238d:1a00:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/link-arrow.svg Requested by Host: website.cdn.group-ib.com URL: https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-press-release.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:238d:1a00:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash e91c5731358570d3e4cd684118251d243fc799059648b152403dcd775ceba632 Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-press-release.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; content-encoding gzip x-content-type-options nosniff strict-transport-security max-age=31536000; includeSubDomains via 1.1 b26a5eb677aed7368a2c7fd7f1d673dc.cloudfront.net (CloudFront) date Wed, 18 Oct 2023 18:30:10 GMT x-amz-cf-pop AMS1-P1 x-cache RefreshHit from cloudfront content-length 267 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Tue, 28 Jun 2022 07:55:26 GMT server nginx etag "199-5e27d5c025780-gzip" x-frame-options sameorigin vary Accept-Encoding content-type image/svg+xml access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id VYnWgzUa40SntMdyyijNVZWn_B4C9bTToHrHVl7WGTQi1I3kVYzrIQ== expires Wed, 18 Oct 2023 19:00:10 GMT
GET H2	200	G-font-Bold.otf website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/fonts/G-font/	49 KB 32 KB	55ms 55ms	Font application/x-font-otf	2600:9000:238d:1a00:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/fonts/G-font/G-font-Bold.otf Requested by Host: website.cdn.group-ib.com URL: https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-press-release.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:238d:1a00:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash 8d15a221986226efe4f742f390f46f9d5ae8b2008a6edd40e10ff121ef9cca9b Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers Referer https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-press-release.css Origin https://www.group-ib.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; content-encoding gzip x-content-type-options nosniff strict-transport-security max-age=31536000; includeSubDomains via 1.1 13a0a1a7b326f5c854b35536576cfe0e.cloudfront.net (CloudFront) date Wed, 18 Oct 2023 18:30:10 GMT x-amz-cf-pop AMS1-P1 x-cache RefreshHit from cloudfront content-length 31918 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Tue, 28 Jun 2022 07:55:26 GMT server nginx etag "c320-5e27d5c025780-gzip" x-frame-options sameorigin vary Accept-Encoding content-type application/x-font-otf access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id gdOGd0WVHV1RNu6G_ZFO3UfsmBe4_RMnibl1BHlgEUtFm5JP-FHU3w== expires Wed, 18 Oct 2023 19:00:10 GMT
GET H/1.1	200 OK	json Show response forms-eu1.hsforms.com/embed/v3/form/25755956/eb903dab-0ef3-43b5-bdeb-71372e6ad0f0/	7 KB 3 KB	131ms 77ms	XHR application/json	172.65.232.43 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://forms-eu1.hsforms.com/embed/v3/form/25755956/eb903dab-0ef3-43b5-bdeb-71372e6ad0f0/json?hs_static_app=forms-embed&hs_static_app_version=1.3938&X-HubSpot-Static-App-Info=forms-embed-1.3938 Requested by Host: fhp-de-js.group-ib.com URL: https://fhp-de-js.group-ib.com/d/bt-autoinject.js Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 172.65.232.43 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash f1b5489434149a97fc7590a05a0c7b583321808d3039a7e27df8c0e7ad350356 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Accept application/json, text/plain, */* Referer https://www.group-ib.com/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers X-Origin-Hublet eu1 Date Wed, 18 Oct 2023 18:30:10 GMT Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff CF-Cache-Status DYNAMIC Content-Encoding br x-evy-trace-route-service-name envoyset-translator X-HubSpot-Correlation-Id 63e9f69a-9ca9-4a21-b5ff-14297acb9d9e Transfer-Encoding chunked x-envoy-upstream-service-time 11 Connection keep-alive alt-svc h3=":443"; ma=86400 x-evy-trace-route-configuration listener_https/all x-evy-trace-listener listener_https x-request-id 63e9f69a-9ca9-4a21-b5ff-14297acb9d9e Server cloudflare X-Trace 2BECAFB924C8CAC6D2459483B9D27B078D6A71021F000000000000000000 Vary origin Access-Control-Allow-Methods OPTIONS, GET Content-Type application/json;charset=utf-8 Access-Control-Allow-Origin https://www.group-ib.com x-evy-trace-virtual-host all Access-Control-Expose-Headers X-Origin-Hublet Access-Control-Max-Age 180 Access-Control-Allow-Credentials false Cache-Control max-age=0, no-cache, no-store X-Robots-Tag none Access-Control-Allow-Headers * CF-RAY 8182d9db9e1a9966-FRA x-evy-trace-served-by-pod fra04/star-hubspot-td/envoy-proxy-5cdd94655b-5tsjd
GET H2	200	main-logo.svg www.group-ib.com/wp-content/themes/gib-theme/assets/images/	3 KB 2 KB	20ms 18ms	Image image/svg+xml	3.72.181.255 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://www.group-ib.com/wp-content/themes/gib-theme/assets/images/main-logo.svg Requested by Host: www.group-ib.com URL: https://www.group-ib.com/media-center/press-releases/sidewinder-apt-report/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 3.72.181.255 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-3-72-181-255.eu-central-1.compute.amazonaws.com Software nginx / Resource Hash 589c9a6a159cf2ecc8555bc4457827f21002eaec9a24e3bc54401ed0b4d30ac8 Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/media-center/press-releases/sidewinder-apt-report/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; content-encoding gzip x-content-type-options nosniff date Wed, 18 Oct 2023 18:30:10 GMT strict-transport-security max-age=31536000; includeSubDomains content-length 1527 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Mon, 30 Jan 2023 11:16:06 GMT server nginx etag "d82-5f379576be685-gzip" vary Accept-Encoding x-frame-options sameorigin content-type image/svg+xml access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes expires Wed, 18 Oct 2023 19:00:10 GMT
GET H2	200	ti.png website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/main-nav/	6 KB 7 KB	67ms 65ms	Image image/png	2600:9000:238d:1a00:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/main-nav/ti.png Requested by Host: www.group-ib.com URL: https://www.group-ib.com/media-center/press-releases/sidewinder-apt-report/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:238d:1a00:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash f0e3a799744c0c67782742af2c13b85f769b58abd04800a04853d26f60cf7314 Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; strict-transport-security max-age=31536000; includeSubDomains x-content-type-options nosniff date Wed, 18 Oct 2023 18:30:10 GMT via 1.1 b26a5eb677aed7368a2c7fd7f1d673dc.cloudfront.net (CloudFront) x-amz-cf-pop AMS1-P1 x-cache RefreshHit from cloudfront content-length 5919 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Tue, 28 Jun 2022 07:55:26 GMT server nginx etag "171f-5e27d5c025780" x-frame-options sameorigin vary Accept-Encoding content-type image/png access-control-allow-origin https://www.group-ib.com cache-control no-cache, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id kCNdrWkJFb0M7p12S6J48NVWXdfmYHB3ylh8-_j4yKIUSg2Lxkq1kQ== expires Wed, 18 Oct 2023 18:30:09 GMT
GET H2	200	asm.png website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/main-nav/	6 KB 7 KB	40ms 39ms	Image image/png	2600:9000:238d:1a00:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/main-nav/asm.png Requested by Host: www.group-ib.com URL: https://www.group-ib.com/media-center/press-releases/sidewinder-apt-report/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:238d:1a00:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash 997d49d316b533985208f14602a1ff15a76bf6a567afbb6b6980629ca8d78bab Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; strict-transport-security max-age=31536000; includeSubDomains x-content-type-options nosniff date Wed, 18 Oct 2023 18:30:10 GMT via 1.1 b26a5eb677aed7368a2c7fd7f1d673dc.cloudfront.net (CloudFront) x-amz-cf-pop AMS1-P1 x-cache RefreshHit from cloudfront content-length 5941 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Tue, 28 Jun 2022 07:55:26 GMT server nginx etag "1735-5e27d5c025780" x-frame-options sameorigin vary Accept-Encoding content-type image/png access-control-allow-origin https://www.group-ib.com cache-control no-cache, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id Q9K3B5b-7_asJ43WUjJo3gljzLVBsdPy2GQBAZ0LYU9vZhA6gVP5kA== expires Wed, 18 Oct 2023 18:30:09 GMT
GET H2	200	fp.png website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/main-nav/	8 KB 8 KB	51ms 50ms	Image image/png	2600:9000:238d:1a00:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/main-nav/fp.png Requested by Host: www.group-ib.com URL: https://www.group-ib.com/media-center/press-releases/sidewinder-apt-report/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:238d:1a00:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash 15534f98c260c3c3caaedf53335d912010b2de1731477a9fd4dbea89fb4995d9 Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; strict-transport-security max-age=31536000; includeSubDomains x-content-type-options nosniff date Wed, 18 Oct 2023 18:30:10 GMT via 1.1 b26a5eb677aed7368a2c7fd7f1d673dc.cloudfront.net (CloudFront) x-amz-cf-pop AMS1-P1 x-cache RefreshHit from cloudfront content-length 7844 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Tue, 28 Jun 2022 07:55:26 GMT server nginx etag "1ea4-5e27d5c025780" x-frame-options sameorigin vary Accept-Encoding content-type image/png access-control-allow-origin https://www.group-ib.com cache-control no-cache, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id tjs0NHtU1A_us3LWMyBc5Qutc6RlmMNrAAM2eowxsCsFyyQrr1E3vg== expires Wed, 18 Oct 2023 18:30:09 GMT
GET H2	200	drp.png website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/main-nav/	5 KB 6 KB	70ms 68ms	Image image/png	2600:9000:238d:1a00:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/main-nav/drp.png Requested by Host: www.group-ib.com URL: https://www.group-ib.com/media-center/press-releases/sidewinder-apt-report/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:238d:1a00:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software cloudflare / Resource Hash a300a894e169169882504968fae71958a87e0a4322e2aee1b6b0bbd63fd9621f Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers strict-transport-security max-age=31536000; includeSubDomains content-security-policy frame-ancestors 'self'; x-content-type-options nosniff cf-cache-status BYPASS nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} date Wed, 18 Oct 2023 18:30:10 GMT via 1.1 b26a5eb677aed7368a2c7fd7f1d673dc.cloudfront.net (CloudFront) x-amz-cf-pop AMS1-P1 x-cache RefreshHit from cloudfront content-length 5398 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Tue, 28 Jun 2022 07:55:26 GMT server cloudflare etag "1516-5e27d5c025780" x-frame-options sameorigin report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=QsUJdnIkDxAOWGpHksoXVH71v7T6HHIQUTnn6kXnY2r%2F2lheyBA5hgvu0rvlGk36y5C3tHzKZZ%2BjSt2OiL1llrNHOqY5gfzllbLpsOBm7%2BUsgEY0Cg%2FUqUK5H4a5kCDtuH4%3D"}],"group":"cf-nel","max_age":604800} content-type image/png access-control-allow-origin https://www.group-ib.com cache-control no-cache, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() vary Accept-Encoding accept-ranges bytes cf-ray 8144bbcdbaa0693d-FRA x-amz-cf-id zpWlRcxTkFH5QITv_QbNSbzvoYXqbxmgI82XFbmTLJDV_fBmJ5nsmg== expires Wed, 18 Oct 2023 18:30:09 GMT
GET H2	200	mxdr.png website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/main-nav/	6 KB 7 KB	40ms 39ms	Image image/png	2600:9000:238d:1a00:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/main-nav/mxdr.png Requested by Host: www.group-ib.com URL: https://www.group-ib.com/media-center/press-releases/sidewinder-apt-report/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:238d:1a00:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash 2be8ce2b065360537771ed230d5d72cbd84758ec127ffa035e6d260ed14af5b0 Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; strict-transport-security max-age=31536000; includeSubDomains x-content-type-options nosniff date Wed, 18 Oct 2023 18:30:10 GMT via 1.1 b26a5eb677aed7368a2c7fd7f1d673dc.cloudfront.net (CloudFront) x-amz-cf-pop AMS1-P1 x-cache RefreshHit from cloudfront content-length 6506 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Tue, 28 Jun 2022 07:55:26 GMT server nginx etag "196a-5e27d5c025780" x-frame-options sameorigin vary Accept-Encoding content-type image/png access-control-allow-origin https://www.group-ib.com cache-control no-cache, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id ylbzzerEmPzNzhutcfV_yEkR2NxQ1IY7dfxXSuX2c9dtbgndretH9A== expires Wed, 18 Oct 2023 18:30:09 GMT
GET H2	200	bep.png website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/main-nav/	6 KB 7 KB	68ms 67ms	Image image/png	2600:9000:238d:1a00:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/main-nav/bep.png Requested by Host: www.group-ib.com URL: https://www.group-ib.com/media-center/press-releases/sidewinder-apt-report/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:238d:1a00:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash 7574ba97d4ee7e81bd60873a52a31ff13359f246d0ac492ef2dabf96233a99e6 Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; strict-transport-security max-age=31536000; includeSubDomains x-content-type-options nosniff date Wed, 18 Oct 2023 18:30:10 GMT via 1.1 b26a5eb677aed7368a2c7fd7f1d673dc.cloudfront.net (CloudFront) x-amz-cf-pop AMS1-P1 x-cache RefreshHit from cloudfront content-length 6362 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Tue, 28 Jun 2022 07:55:26 GMT server nginx etag "18da-5e27d5c025780" x-frame-options sameorigin vary Accept-Encoding content-type image/png access-control-allow-origin https://www.group-ib.com cache-control no-cache, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id RPqXKYH8l3W6y3phUkrM2Y7NjmgJc6vbgsP4j4WzCIg6tDz9wmiL9w== expires Wed, 18 Oct 2023 18:30:09 GMT
GET H2	200	press-release-sidewinder-min.jpg website.cdn.group-ib.com/wp-content/uploads/	293 KB 294 KB	39ms 38ms	Image image/jpeg	2600:9000:238d:1a00:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://website.cdn.group-ib.com/wp-content/uploads/press-release-sidewinder-min.jpg Requested by Host: www.group-ib.com URL: https://www.group-ib.com/media-center/press-releases/sidewinder-apt-report/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:238d:1a00:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash d26e821ef3caa8e441f177698c9ebcb963acc02d57170238083dabcacb7255cf Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; strict-transport-security max-age=31536000; includeSubDomains x-content-type-options nosniff date Wed, 18 Oct 2023 18:30:10 GMT via 1.1 b26a5eb677aed7368a2c7fd7f1d673dc.cloudfront.net (CloudFront) x-amz-cf-pop AMS1-P1 x-cache RefreshHit from cloudfront content-length 300007 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Mon, 13 Feb 2023 12:38:43 GMT server nginx etag "493e7-5f49420ab566c" x-frame-options sameorigin vary Accept-Encoding content-type image/jpeg access-control-allow-origin https://www.group-ib.com cache-control no-cache, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id 5vkdYkI7fWDJf8VZp2kcE0HAAbP9p8TpgRChAIkjxY2WFmBpM_kHpw== expires Wed, 18 Oct 2023 18:30:09 GMT
GET H/1.1	200 OK	counters.gif forms.hsforms.com/embed/v3/	35 B 1015 B	156ms 134ms	Image image/gif	2606:4700::6811:cff9 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://forms.hsforms.com/embed/v3/counters.gif?key=forms-embed-v2-DEFINITION_SUCCESS&count=1 Requested by Host: www.group-ib.com URL: https://www.group-ib.com/media-center/press-releases/sidewinder-apt-report/ Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6811:cff9 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers Date Wed, 18 Oct 2023 18:30:10 GMT Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff CF-Cache-Status DYNAMIC x-evy-trace-route-service-name envoyset-translator X-HubSpot-Correlation-Id 22f5e721-a191-4b7c-9e7e-ecf31dc61331 x-envoy-upstream-service-time 7 Connection keep-alive alt-svc h3=":443"; ma=86400 Content-Length 35 x-evy-trace-route-configuration listener_https/all x-evy-trace-listener listener_https x-request-id 22f5e721-a191-4b7c-9e7e-ecf31dc61331 Server cloudflare X-Trace 2BACD9CEBE969DD359FBB9AAB54E9C20D14AA6DED8000000000000000000 Vary origin Content-Type image/gif x-evy-trace-virtual-host all x-evy-trace-served-by-pod iad02/star-hubspot-td/envoy-proxy-79986f96f-rwf2n Access-Control-Expose-Headers X-Origin-Hublet Cache-Control max-age=0, no-cache, no-store Access-Control-Allow-Credentials false X-Robots-Tag none CF-RAY 8182d9dc48d9373d-FRA
GET H2	200	tag.js Show response mc.yandex.ru/metrika/	202 KB 70 KB	219ms 113ms	Script application/javascript	2a02:6b8::1:119 GLOBAL_DC
General Check archive.org Show headers Download Go to Full URL https://mc.yandex.ru/metrika/tag.js Requested by Host: website.cdn.group-ib.com URL: https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/js/main.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:6b8::1:119 Ulyanovsk, Russian Federation, ASN208722 (GLOBAL_DC, FI), Reverse DNS Software / Resource Hash e9597987b6f5f6a1e2c0a9bb76f9728ad3bda5548c3b1341dac1e7708c18ee7e Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers date Wed, 18 Oct 2023 18:30:10 GMT content-encoding br strict-transport-security max-age=31536000 last-modified Tue, 17 Oct 2023 09:59:45 GMT accept-ch Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA etag "652e5b11-11470" content-type application/javascript access-control-allow-origin * cache-control max-age=3600 timing-allow-origin * content-length 70768 expires Wed, 18 Oct 2023 19:30:10 GMT
GET H2	200	telegram-64.svg website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/socials/	1 KB 2 KB	38ms 36ms	Image image/svg+xml	2600:9000:238d:1a00:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/socials/telegram-64.svg Requested by Host: website.cdn.group-ib.com URL: https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-press-release.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:238d:1a00:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash cdc4d10b6b74ad79b55333b9882e854f054ee8b9953c6203dc46c68dc74eb0fb Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-press-release.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; content-encoding gzip x-content-type-options nosniff strict-transport-security max-age=31536000; includeSubDomains via 1.1 b26a5eb677aed7368a2c7fd7f1d673dc.cloudfront.net (CloudFront) date Wed, 18 Oct 2023 18:30:10 GMT x-amz-cf-pop AMS1-P1 x-cache RefreshHit from cloudfront content-length 787 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Tue, 29 Nov 2022 07:39:21 GMT server nginx etag "5fc-5ee9716179e8a-gzip" x-frame-options sameorigin vary Accept-Encoding content-type image/svg+xml access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id tvx390uJsO9sF2-AqshYvvxemQP8BqOCKEm0F94wQrKQWqaQKzT30g== expires Wed, 18 Oct 2023 19:00:10 GMT
GET H2	200	telegram-blue.svg website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/socials/	1 KB 2 KB	44ms 41ms	Image image/svg+xml	2600:9000:238d:1a00:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/socials/telegram-blue.svg Requested by Host: website.cdn.group-ib.com URL: https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-press-release.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:238d:1a00:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash f134669d195076302131981e5fbcff6cf42dc48f5642c1a8e392862f7b4ca412 Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-press-release.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; content-encoding gzip x-content-type-options nosniff strict-transport-security max-age=31536000; includeSubDomains via 1.1 b26a5eb677aed7368a2c7fd7f1d673dc.cloudfront.net (CloudFront) date Wed, 18 Oct 2023 18:30:10 GMT x-amz-cf-pop AMS1-P1 x-cache RefreshHit from cloudfront content-length 792 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Tue, 29 Nov 2022 07:39:21 GMT server nginx etag W/"5fb-5ee9716179e8a-gzip" x-frame-options sameorigin vary Accept-Encoding content-type image/svg+xml access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id CejOE2QiuKl8yXk3-JaBZSr2x9cZTzBoAWyqbGrDdJqyYjjIRDXl_A== expires Wed, 18 Oct 2023 19:00:10 GMT
GET H2	200	twitter-64.svg website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/socials/	1 KB 2 KB	42ms 40ms	Image image/svg+xml	2600:9000:238d:1a00:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/socials/twitter-64.svg Requested by Host: website.cdn.group-ib.com URL: https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-press-release.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:238d:1a00:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software cloudflare / Resource Hash ae9dad69229703dfa3b6d226c4c7d692e2f2809bf2475f22612824c2f7602efc Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-press-release.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers strict-transport-security max-age=31536000; includeSubDomains content-security-policy frame-ancestors 'self'; x-content-type-options nosniff cf-cache-status BYPASS nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} date Wed, 18 Oct 2023 18:30:10 GMT content-encoding br x-amz-cf-pop AMS1-P1 via 1.1 b26a5eb677aed7368a2c7fd7f1d673dc.cloudfront.net (CloudFront) x-cache RefreshHit from cloudfront x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Tue, 29 Nov 2022 07:39:21 GMT server cloudflare etag W/"426-5ee9716179e8a-gzip" x-frame-options sameorigin report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=3h%2Fu7ZtUr3fbbcl8qzrDo8EbSYnXoIimzBu%2BKCLI0kxR8OfIVMrn9COSFbmzH8gAZFeUPIVFKWM2L7NEiyZc09%2F2ZC7aQqJ4LHHngzMRxGfFUtGU3WZa2FTmr92fP59b1Us%3D"}],"group":"cf-nel","max_age":604800} content-type image/svg+xml access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() vary Accept-Encoding cf-ray 814489b50e613804-FRA x-amz-cf-id mcdsaaxYoCl7cT_UsJrnKptNnxBFC5-KZBcaPd7OQ67yTjb86ID1rg== expires Wed, 18 Oct 2023 19:00:10 GMT
GET H2	200	twitter-blue.svg website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/socials/	1 KB 1 KB	43ms 41ms	Image image/svg+xml	2600:9000:238d:1a00:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/socials/twitter-blue.svg Requested by Host: website.cdn.group-ib.com URL: https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-press-release.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:238d:1a00:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash 811a0ac7da35a5fd342022f6587eec2f5ad3aa69dfdb05a7cea5224030617507 Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-press-release.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; content-encoding gzip x-content-type-options nosniff strict-transport-security max-age=31536000; includeSubDomains via 1.1 b26a5eb677aed7368a2c7fd7f1d673dc.cloudfront.net (CloudFront) date Wed, 18 Oct 2023 18:30:10 GMT x-amz-cf-pop AMS1-P1 x-cache RefreshHit from cloudfront content-length 556 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Tue, 29 Nov 2022 07:39:21 GMT server nginx etag W/"426-5ee9716179e8a-gzip" x-frame-options sameorigin vary Accept-Encoding content-type image/svg+xml access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id SOSAE3k9ZWjlOh_15fgFXlUsVG22MlUv10ou4euu4SbSeTa4FwSzRQ== expires Wed, 18 Oct 2023 19:00:10 GMT
GET H2	200	linkedin-64.svg website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/socials/	919 B 2 KB	44ms 42ms	Image image/svg+xml	2600:9000:238d:1a00:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/socials/linkedin-64.svg Requested by Host: website.cdn.group-ib.com URL: https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-press-release.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:238d:1a00:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software cloudflare / Resource Hash f4991587d5312981e74087707ed399bd3820d83f773e7773c013ce00d6835f28 Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-press-release.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers strict-transport-security max-age=31536000; includeSubDomains content-security-policy frame-ancestors 'self'; x-content-type-options nosniff cf-cache-status BYPASS nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} date Wed, 18 Oct 2023 18:30:10 GMT content-encoding br x-amz-cf-pop AMS1-P1 via 1.1 b26a5eb677aed7368a2c7fd7f1d673dc.cloudfront.net (CloudFront) x-cache RefreshHit from cloudfront x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Tue, 29 Nov 2022 07:39:21 GMT server cloudflare etag W/"397-5ee9716179e8a-gzip" x-frame-options sameorigin report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=GK5ibWO%2BC1oavPJyfeDWTV06OqLuSEUh%2BBomal6ENGVGUTgY7WPEyVcEqAvw0IEP73ZLbuPeg2aj8RR6ol6dhRJ0GQrv1t1vWHn15jl7455BkGE8%2BNYB3JlbAO73xl1wZ00%3D"}],"group":"cf-nel","max_age":604800} content-type image/svg+xml access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() vary Accept-Encoding cf-ray 814489b50fc337ef-FRA x-amz-cf-id YRcl3FrF3mYnyWxKy4NeSYozF791kL5Nhn1Zwug30LPV9kpAYhOOiw== expires Wed, 18 Oct 2023 19:00:10 GMT
GET H2	200	linkedin-blue.svg website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/socials/	919 B 1 KB	40ms 39ms	Image image/svg+xml	2600:9000:238d:1a00:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/socials/linkedin-blue.svg Requested by Host: website.cdn.group-ib.com URL: https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-press-release.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:238d:1a00:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash dbc32b11b85805050a7fbd85361a52e9c84a34cff6fa03d7d764b190c75fefe3 Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-press-release.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; content-encoding gzip x-content-type-options nosniff strict-transport-security max-age=31536000; includeSubDomains via 1.1 b26a5eb677aed7368a2c7fd7f1d673dc.cloudfront.net (CloudFront) date Wed, 18 Oct 2023 18:30:10 GMT x-amz-cf-pop AMS1-P1 x-cache RefreshHit from cloudfront content-length 470 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Tue, 29 Nov 2022 07:39:21 GMT server nginx etag W/"397-5ee9716179e8a-gzip" x-frame-options sameorigin vary Accept-Encoding content-type image/svg+xml access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id 8CfeFoZTuZ9H1eQBsvevBvZp5hqJjCcmsaytSRhwaq_3Qzo6y2M-qQ== expires Wed, 18 Oct 2023 19:00:10 GMT
GET H2	200	whatsapp-64.svg website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/socials/	2 KB 2 KB	54ms 53ms	Image image/svg+xml	2600:9000:238d:1a00:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/socials/whatsapp-64.svg Requested by Host: website.cdn.group-ib.com URL: https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-press-release.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:238d:1a00:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash 45d44c2f23a04d49dbbb3f216ba72782ad80278cf7c4c330b1f03b8263c544ee Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-press-release.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; content-encoding gzip x-content-type-options nosniff strict-transport-security max-age=31536000; includeSubDomains via 1.1 b26a5eb677aed7368a2c7fd7f1d673dc.cloudfront.net (CloudFront) date Wed, 18 Oct 2023 18:30:10 GMT x-amz-cf-pop AMS1-P1 x-cache RefreshHit from cloudfront content-length 1046 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Tue, 29 Nov 2022 07:39:21 GMT server nginx etag W/"7e8-5ee9716179e8a-gzip" x-frame-options sameorigin vary Accept-Encoding content-type image/svg+xml access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id Qg7r0Gygvw-mGbdI28bqHjK5mY5puMM53mp2kJRLDTSoCG-WBqjsrw== expires Wed, 18 Oct 2023 19:00:10 GMT
GET H2	200	whatsapp-blue.svg website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/socials/	2 KB 2 KB	52ms 51ms	Image image/svg+xml	2600:9000:238d:1a00:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/socials/whatsapp-blue.svg Requested by Host: website.cdn.group-ib.com URL: https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-press-release.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:238d:1a00:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash d3689b014c0ffdfe6c70af7141a0d708166ba120d136838de16b50a7394947a9 Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-press-release.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; content-encoding gzip x-content-type-options nosniff strict-transport-security max-age=31536000; includeSubDomains via 1.1 b26a5eb677aed7368a2c7fd7f1d673dc.cloudfront.net (CloudFront) date Wed, 18 Oct 2023 18:30:10 GMT x-amz-cf-pop AMS1-P1 x-cache RefreshHit from cloudfront content-length 1047 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Tue, 29 Nov 2022 07:39:21 GMT server nginx etag W/"7e7-5ee9716179e8a-gzip" x-frame-options sameorigin vary Accept-Encoding content-type image/svg+xml access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id yY_vp4hK67M_PgSjwaNqEDl-LKCxkLf19XAIxVFpsR3_Skb9Xcevig== expires Wed, 18 Oct 2023 19:00:10 GMT
GET H/1.1	200 OK	counters.gif forms-eu1.hsforms.com/embed/v3/	35 B 1016 B	65ms 37ms	Image image/gif	172.65.232.43 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://forms-eu1.hsforms.com/embed/v3/counters.gif?key=forms-embed-v2-RENDER_SUCCESS&count=1 Requested by Host: www.group-ib.com URL: https://www.group-ib.com/media-center/press-releases/sidewinder-apt-report/ Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 172.65.232.43 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers Date Wed, 18 Oct 2023 18:30:10 GMT Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff CF-Cache-Status DYNAMIC x-evy-trace-route-service-name envoyset-translator X-HubSpot-Correlation-Id 6f7cb0f7-41f4-4ad6-96f0-2cdf2d54df07 x-envoy-upstream-service-time 1 Connection keep-alive alt-svc h3=":443"; ma=86400 Content-Length 35 x-evy-trace-route-configuration listener_https/all x-evy-trace-listener listener_https x-request-id 6f7cb0f7-41f4-4ad6-96f0-2cdf2d54df07 Server cloudflare X-Trace 2B4256AB369A255BCD33A8E6BB6ED97CD9B5F969AA000000000000000000 Vary origin Content-Type image/gif x-evy-trace-virtual-host all x-evy-trace-served-by-pod fra04/star-hubspot-td/envoy-proxy-5cdd94655b-pnstb Access-Control-Expose-Headers X-Origin-Hublet Cache-Control max-age=0, no-cache, no-store Access-Control-Allow-Credentials false X-Robots-Tag none CF-RAY 8182d9dd4db72c1e-FRA
GET H2	200	collectedforms.js Show response js-eu1.hscollectedforms.net/	69 KB 25 KB	54ms 25ms	Script application/javascript	172.65.192.122 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://js-eu1.hscollectedforms.net/collectedforms.js Requested by Host: js-eu1.hs-scripts.com URL: https://js-eu1.hs-scripts.com/25755956.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.65.192.122 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash d1b5aca028dd8447199f3c06601e38f5b8aba3b29be5ccd2de504a561fed2558 Security Headers Name Value X-Content-Type-Options nosniff Request headers Referer https://www.group-ib.com/ Origin https://www.group-ib.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers content-encoding br age 223 x-evy-trace-route-service-name envoyset-translator x-amz-server-side-encryption AES256 content-security-policy-report-only frame-ancestors 'self'; report-uri https://send.hsbrowserreports.com/csp/report?resource=collected-forms-embed-js/static-1.425/bundles/project.js&cfRay=8182d4688f9e3a67-FRA x-amz-replication-status COMPLETED x-evy-trace-listener listener_https etag W/"526bb173ed1384afadfc2b0eb6b0846e" vary Accept-Encoding content-type application/javascript; charset=utf-8 access-control-allow-origin * x-evy-trace-virtual-host all cache-control s-maxage=600, max-age=300 x-hs-target-asset collected-forms-embed-js/static-1.425/bundles/project.js date Wed, 18 Oct 2023 18:30:10 GMT x-amz-version-id 99Y.E0UsJAdqqpubte3vKq3r2MOVQh4K via 1.1 83f1b8f73f37458f38e2ee1fc0b9e68c.cloudfront.net (CloudFront) x-content-type-options nosniff cf-cache-status HIT x-amz-cf-pop FRA56-P2 x-hubspot-correlation-id 04f0d10e-c8ca-4709-849f-6bddabe69e05 x-cache Hit from cloudfront cache-tag staticjsapp-collected-forms-embed-js-web-prod,staticjsapp-prod x-envoy-upstream-service-time 2 x-evy-trace-route-configuration listener_https/all x-request-id 04f0d10e-c8ca-4709-849f-6bddabe69e05 last-modified Fri, 22 Sep 2023 08:42:59 UTC server cloudflare x-hs-cache-status HIT x-evy-trace-served-by-pod fra04/app-td/envoy-proxy-797758f45b-49p9l cf-ray 8182d9dd58fe1953-FRA x-amz-cf-id WGZHakpNQUPXQP2ku6x50rddg_LmTtzxwVZ7YbM1TyEhAdOmjM9SQw==
GET H2	200	banner.js Show response js-eu1.hs-banner.com/v2/25755956/	66 KB 20 KB	46ms 17ms	Script text/javascript	172.65.202.201 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://js-eu1.hs-banner.com/v2/25755956/banner.js Requested by Host: js-eu1.hs-scripts.com URL: https://js-eu1.hs-scripts.com/25755956.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.65.202.201 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash c84eae5b234d8595c0318241296fe36e8a29f6f9077176a2b3f1c553b7ef823b Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers date Wed, 18 Oct 2023 18:30:10 GMT x-amz-version-id k.vw21NpSh7kRqhHX0xaReU0fWn_9Gg5 content-encoding br cf-cache-status HIT x-amz-request-id 5DTD75KSFV2P6VRN x-evy-trace-route-service-name envoyset-translator x-amz-server-side-encryption AES256 x-hubspot-correlation-id 882c981a-ec5f-4c94-a55a-f21ce92cc58e age 223 x-envoy-upstream-service-time 19 x-amz-id-2 vFP0XGjRIgFrTONIdj9WVwNVhsnkTWnl9u/XpgBkjWI1qDT4sLgqBxmKsoLtoo6r5vMEdSS9hK8= x-evy-trace-listener listener_https x-request-id 882c981a-ec5f-4c94-a55a-f21ce92cc58e x-evy-trace-route-configuration listener_https/all last-modified Wed, 18 Oct 2023 17:20:52 GMT server cloudflare etag W/"0fe58bfdba164c72145bf56fb55fa2bb" access-control-max-age 604800 access-control-allow-methods GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD content-type text/javascript; charset=UTF-8 access-control-allow-origin https://www.group-ib.com x-evy-trace-virtual-host all access-control-expose-headers x-last-modified-timestamp, X-HubSpot-NotFound, X-HS-User-Request, Link, Server-Timing cache-control max-age=300,public access-control-allow-credentials true x-evy-trace-served-by-pod fra04/analytics-js-proxy-td/envoy-proxy-6bfd96c9d5-v5rkj vary origin, Accept-Encoding timing-allow-origin * access-control-allow-headers Origin, X-Requested-With, Content-Type, Accept, Accept-Charset, Accept-Encoding, X-Override-Internal-Permissions, X-Properties-Source, X-Properties-SourceId, X-Properties-Flag, X-Hubspot-User-Id, X-Hubspot-Trace, X-Hubspot-Callee, X-Hubspot-Offset, X-Hubspot-No-Trace, X-HubSpot-Static-App-Info, X-HubSpot-Messages-Uri, X-HubSpot-Request-Source, X-HubSpot-Request-Reason, Subscription-Billing-Auth-Token, X-App-CSRF, X-Tools-CSRF, Online-Payment-Signing-UUID, X-Source, X-SourceId, X-Origin-UserId, X-Biden-Request-Source, X-HubSpot-CSRF-hubspotapi, X-Force-Cookie-Refresh, X-Force-Cookie-Refresh-No-Cache, X-HS-User-Request, X-Application-Id, X-HS-Referer, X-HubSpot-Correlation-Id cf-ray 8182d9dd5eb64d49-FRA expires Wed, 18 Oct 2023 18:31:27 GMT
GET H2	200	web-interactives-embed.js Show response js-eu1.hubspot.com/	75 KB 23 KB	72ms 45ms	Script application/javascript	172.65.236.181 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://js-eu1.hubspot.com/web-interactives-embed.js Requested by Host: js-eu1.hs-scripts.com URL: https://js-eu1.hs-scripts.com/25755956.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.65.236.181 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash acabd35f2b1e9987602b0dd006d22beaaf59d64d55aa0b1182953f605b4aedca Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer https://www.group-ib.com/ Origin https://www.group-ib.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers content-encoding br age 574 x-evy-trace-route-service-name envoyset-translator x-amz-server-side-encryption AES256 content-security-policy-report-only frame-ancestors 'self'; report-uri https://send.hsbrowserreports.com/csp/report?resource=web-interactives-embed/static-2.603/bundles/project.js&cfRay=8182cbd939a64d1f-FRA x-amz-replication-status COMPLETED x-evy-trace-listener listener_https etag W/"05df44f442894aeff6db4cae78774575" vary Accept-Encoding content-type application/javascript; charset=utf-8 access-control-allow-origin * x-evy-trace-virtual-host all cache-control max-age=600 x-hs-target-asset web-interactives-embed/static-2.603/bundles/project.js date Wed, 18 Oct 2023 18:30:10 GMT x-amz-version-id CUHT59SEc6aYYLtp23JCKXXA_T1K86mL via 1.1 44b457512f742b4e48fc7f0c87d8ed92.cloudfront.net (CloudFront) x-content-type-options nosniff cf-cache-status HIT nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} strict-transport-security max-age=31536000; includeSubDomains; preload x-amz-cf-pop FRA56-P2 x-hubspot-correlation-id 123c3653-df44-447a-96aa-49927b884d4b x-cache Hit from cloudfront cache-tag staticjsapp-web-interactives-embed-web-prod,staticjsapp-prod x-envoy-upstream-service-time 2 x-evy-trace-route-configuration listener_https/all x-request-id 123c3653-df44-447a-96aa-49927b884d4b last-modified Thu, 12 Oct 2023 02:04:49 UTC server cloudflare report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=m1zxNp8qhJm67Ab%2FnL9HILZ0oL7EUdzWOImoH%2Fwg0ct5fSENva063Fyp%2BbK2u90nDQ0rueZIBN6s4YTAdIlARq5Dc6t%2FUOQyn3zsyEJB7%2BQHivXtL4SiE04UCHyFnANNJGnCtg%3D%3D"}],"group":"cf-nel","max_age":604800} x-hs-cache-status HIT x-evy-trace-served-by-pod fra04/app-td/envoy-proxy-797758f45b-8q8m9 cf-ray 8182d9dd59f04d38-FRA x-amz-cf-id 4DRWsP2PhSkEUsg9DWdv6KR6v6Gqxu_sawJTagiUwZDZbBdcpFccHg==
GET H2	200	fb.js Show response js-eu1.hsadspixel.net/	6 KB 4 KB	71ms 42ms	Script application/javascript	172.65.219.229 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://js-eu1.hsadspixel.net/fb.js Requested by Host: js-eu1.hs-scripts.com URL: https://js-eu1.hs-scripts.com/25755956.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.65.219.229 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 413237d22e25097e3cee2595c2cedccc0d680158bd638a421aecaa1a7237321f Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers date Wed, 18 Oct 2023 18:30:10 GMT x-amz-version-id 6Rl00Bao8JSR9sjVJgKGfhCjk_eTdRhI via 1.1 4d0ae7ca3bb5e2d6eaa1450e1906adb4.cloudfront.net (CloudFront) x-content-type-options nosniff cf-cache-status HIT x-amz-cf-pop FRA56-P2 age 224 x-amz-server-side-encryption AES256 x-evy-trace-route-service-name envoyset-translator content-security-policy-report-only frame-ancestors 'self'; report-uri https://send.hsbrowserreports.com/csp/report?resource=adsscriptloaderstatic/static-1.490/bundles/pixels-release.js&cfRay=8182d4631ad54da6-FRA x-cache Hit from cloudfront x-hubspot-correlation-id e07d3d0b-01f5-419e-971a-9e7c2964c881 cache-tag staticjsapp-AdsScriptLoaderCloudflare-web-prod,staticjsapp-prod content-encoding br x-envoy-upstream-service-time 1 x-amz-replication-status COMPLETED x-evy-trace-route-configuration listener_https/all x-evy-trace-listener listener_https x-request-id e07d3d0b-01f5-419e-971a-9e7c2964c881 last-modified Mon, 16 Oct 2023 16:51:04 UTC server cloudflare etag W/"7e8c6b3c97842ae7b4b13d1465637fd9" vary Accept-Encoding content-type application/javascript; charset=utf-8 x-hs-cache-status HIT x-evy-trace-virtual-host all cache-control max-age=600 x-evy-trace-served-by-pod fra04/app-td/envoy-proxy-797758f45b-8q8m9 cf-ray 8182d9dd78ab65b7-FRA x-amz-cf-id oSN6bdM2WUllxQjwnqz8T8iWumbZYyRAg46nNxqPrIAmpITNNGfcsg== x-hs-target-asset adsscriptloaderstatic/static-1.490/bundles/pixels-release.js
GET H2	200	25755956.js Show response js-eu1.hs-analytics.net/analytics/1697653800000/	66 KB 21 KB	83ms 56ms	Script text/javascript	172.65.238.60 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://js-eu1.hs-analytics.net/analytics/1697653800000/25755956.js Requested by Host: js-eu1.hs-scripts.com URL: https://js-eu1.hs-scripts.com/25755956.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.65.238.60 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 92361eb5c51c83c5575a6704ee3734c26cd7713fb564e503d3a7800a0e284638 Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers date Wed, 18 Oct 2023 18:30:10 GMT content-encoding br cf-cache-status MISS x-amz-request-id YM1HBXCZ6B5YKS43 x-evy-trace-route-service-name envoyset-translator x-amz-server-side-encryption AES256 x-hubspot-correlation-id 8a74c90f-bdca-42b1-850a-a0eb1c494428 x-envoy-upstream-service-time 20 x-amz-id-2 lCbqBW7ds+lwZH9h34TKvivrTUAU/+URw4BJ5IAZARFn1tZdsSzI80XcnxSj2birHEwS/S/C/uU= x-evy-trace-listener listener_https x-request-id 8a74c90f-bdca-42b1-850a-a0eb1c494428 x-evy-trace-route-configuration listener_https/all last-modified Thu, 12 Oct 2023 15:15:37 GMT server cloudflare etag W/"181d06e20d9f2d1a1320c23d29224409" vary origin, Accept-Encoding content-type text/javascript x-evy-trace-virtual-host all x-evy-trace-served-by-pod fra04/analytics-js-proxy-td/envoy-proxy-6bfd96c9d5-gdvn9 cache-control max-age=300,public access-control-allow-credentials false cf-ray 8182d9dd5bb63a5c-FRA expires Wed, 18 Oct 2023 18:35:10 GMT
GET H2	200	collect px.ads.linkedin.com/	0 528 B	128ms 104ms	Image application/javascript	2620:1ec:21::14 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Show image Full URL https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=&time=1697653810747&url=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fsidewinder-apt-report%2F Requested by Host: www.group-ib.com URL: https://www.group-ib.com/media-center/press-releases/sidewinder-apt-report/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2620:1ec:21::14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers date Wed, 18 Oct 2023 18:30:09 GMT x-li-pop afd-prod-lva1-x x-msedge-ref Ref A: 7938F667C7E246919928628A64BF636E Ref B: FRAEDGE2010 Ref C: 2023-10-18T18:30:10Z linkedin-action 1 x-cache CONFIG_NOCACHE content-type application/javascript x-li-fabric prod-lva1 x-li-proto http/2 content-length 0 x-li-uuid AAYIAdRYW7tJgmP1yx5E2Q==
GET H2	200	6si.min.js Show response j.6sc.co/	60 KB 16 KB	54ms 9ms	Script application/javascript	2.17.100.184 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://j.6sc.co/6si.min.js Requested by Host: www.group-ib.com URL: https://www.group-ib.com/media-center/press-releases/sidewinder-apt-report/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2.17.100.184 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS a2-17-100-184.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash e8a99c16a581c4e69330699d00aa4a7763158ed99194087bceebd232d53eb42f Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers pragma no-cache date Wed, 18 Oct 2023 18:30:10 GMT content-encoding gzip x-content-type-options nosniff last-modified Tue, 17 Oct 2023 19:14:48 GMT server nginx/1.14.0 (Ubuntu) etag "652edd28-f1f8" vary Accept-Encoding content-type application/javascript cache-control private, no-cache, proxy-revalidate accept-ranges bytes content-length 16484 expires Wed, 18 Oct 2023 18:30:10 GMT
GET H2	200	/ Show response googleads.g.doubleclick.net/pagead/viewthroughconversion/10897073384/	3 KB 2 KB	99ms 30ms	Script text/javascript	2a00:1450:4001:800::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://googleads.g.doubleclick.net/pagead/viewthroughconversion/10897073384/?random=1697653810787&cv=11&fst=1697653810787&bg=ffffff&guid=ON&async=1&gtm=45He3ag0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fsidewinder-apt-report%2F&ref=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fsidewinder-apt-report%2F&hn=www.googleadservices.com&frm=0&tiba=Molted%20skin%3A%20APT%20SideWinder%202021%20campaign%20that%20targeted%20over%2060%20companies%20in%20the%20Asia-Pacific%20%7C%20Group-IB&auid=889656904.1697653811&uamb=0&uaw=0&rfmt=3&fmt=4 Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-PW7265 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash 7ecc8e0c207b191de267bc6f30adfd9f40635a8d716cacca9ee77b6a7a645c15 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers pragma no-cache date Wed, 18 Oct 2023 18:30:10 GMT content-encoding br x-content-type-options nosniff server cafe content-type text/javascript; charset=UTF-8 p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" cache-control no-cache, must-revalidate cross-origin-resource-policy cross-origin content-disposition attachment; filename="f.txt" timing-allow-origin * alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 1408 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	pixel.js Show response www.redditstatic.com/ads/	23 KB 8 KB	46ms 7ms	Script application/javascript	2a04:4e42::396 FASTLY
General Check archive.org Show headers Download Go to Full URL https://www.redditstatic.com/ads/pixel.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-PW7265 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42::396 , United States, ASN54113 (FASTLY, US), Reverse DNS Software snooserv / Resource Hash e803e774c7b59fe74f71ed93acaa875cf9a99947ff8ed7615cd0c93c1667250f Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers date Wed, 18 Oct 2023 18:30:10 GMT content-encoding gzip via 1.1 varnish, 1.1 varnish last-modified Thu, 15 Jun 2023 20:49:59 GMT server snooserv nel {"report_to": "w3-reporting-nel", "max_age": 14400, "include_subdomains": false, "success_fraction": 0.02, "failure_fraction": 0.02} etag "4a205643a240cb95fa82289d62b5af7e" x-amz-server-side-encryption AES256 vary Accept-Encoding,Origin report-to {"group": "w3-reporting-nel", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-nel.reddit.com/reports" }]}, {"group": "w3-reporting", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting.reddit.com/reports" }]}, {"group": "w3-reporting-csp", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-csp.reddit.com/reports" }]} content-type application/javascript cache-control public, max-age=60 accept-ranges bytes content-length 7409
GET H2	200	NeverBounce.js Show response cdn.neverbounce.com/widget/dist/	96 KB 29 KB	99ms 17ms	Script application/javascript	18.239.18.127 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://cdn.neverbounce.com/widget/dist/NeverBounce.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-PW7265 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.239.18.127 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-18-239-18-127.ams58.r.cloudfront.net Software AmazonS3 / Resource Hash c99d11cb4960d6e1918ed55d5bcbb316d38b51098e2efc1201904d7274d3273e Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers date Wed, 18 Oct 2023 03:31:41 GMT content-encoding gzip via 1.1 9c7ba0aaf8652834e3f6b51b901da726.cloudfront.net (CloudFront) last-modified Mon, 02 Mar 2020 18:37:33 GMT server AmazonS3 x-amz-cf-pop AMS58-P6 age 53916 etag W/"c1e06621030dfcba15b88abbcaa546eb" vary Accept-Encoding x-cache Hit from cloudfront content-type application/javascript x-amz-cf-id GbOy6AzpqDsN52R6AFotaMyQ1HxEtjTjme534S9ybpp5lhU7MIifkg==
GET H2	200	63e267f61a03d71ea3df5fe7 Show response ws.zoominfo.com/pixel/	3 KB 2 KB	257ms 236ms	Script text/javascript	2606:4700::6810:880f CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://ws.zoominfo.com/pixel/63e267f61a03d71ea3df5fe7 Requested by Host: www.group-ib.com URL: https://www.group-ib.com/media-center/press-releases/sidewinder-apt-report/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6810:880f , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Express Resource Hash 979fed72c29582ed366e389b893ea1ef95bdebbdb0279901310d0c8ec9b3046c Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/media-center/press-releases/sidewinder-apt-report/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers date Wed, 18 Oct 2023 18:30:11 GMT content-encoding gzip x-content-type-options nosniff cf-cache-status DYNAMIC via 1.1 google server cloudflare x-powered-by Express vary Accept-Encoding content-type text/javascript access-control-allow-origin * access-control-allow-credentials true cf-ray 8182d9dda89c928d-FRA access-control-allow-headers Content-Type,cf-ipcountry,service-version,x-appengine-user-ip,x-forwarded-for, x-ws-collect-type,requestFromZITag,unifiedScriptVerified,_zitok,_vtok alt-svc h3=":443"; ma=86400
GET H2	200	fbevents.js Show response connect.facebook.net/en_US/	198 KB 53 KB	29ms 10ms	Script application/x-javascript	2a03:2880:f084:d:face:b00c:0:3 FACEBOOK
General Check archive.org Show headers Download Go to Full URL https://connect.facebook.net/en_US/fbevents.js Requested by Host: www.group-ib.com URL: https://www.group-ib.com/media-center/press-releases/sidewinder-apt-report/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a03:2880:f084:d:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US), Reverse DNS Software / Resource Hash 564a53ce84ae022b30816d44aa48589ebfe170c226b098d0245c47fe13341c67 Security Headers Name Value Content-Security-Policy default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script'; Strict-Transport-Security max-age=31536000; preload; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers content-security-policy default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script'; content-encoding gzip x-content-type-options nosniff strict-transport-security max-age=31536000; preload; includeSubDomains date Wed, 18 Oct 2023 18:30:10 GMT document-policy force-load-at-top cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400 content-length 53498 x-xss-protection 0 pragma public x-fb-debug ONytLyD6LS1KjlS6maULYlnNB1ykS5DTl8hZC41+m8gi1HFyysaCHbdQ2ra9+zzq3BP3is82AbGjXj2myiovdw== cross-origin-opener-policy same-origin-allow-popups vary Accept-Encoding x-frame-options DENY content-type application/x-javascript; charset=utf-8 cache-control public, max-age=1200 permissions-policy accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(), gyroscope=(), hid=(), idle-detection=(), magnetometer=(), microphone=(), midi=(), payment=(), screen-wake-lock=(), serial=(), usb=() timing-allow-origin * expires Sat, 01 Jan 2000 00:00:00 GMT
GET H2	200	1010045.js Show response tracking.g2crowd.com/attribution_tracking/conversions/	958 B 969 B	147ms 124ms	Script text/javascript	2606:4700:4400::6812:2b1f CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://tracking.g2crowd.com/attribution_tracking/conversions/1010045.js?p=https://www.group-ib.com/media-center/press-releases/sidewinder-apt-report/&e= Requested by Host: www.group-ib.com URL: https://www.group-ib.com/media-center/press-releases/sidewinder-apt-report/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:4400::6812:2b1f , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash d4c9ffda6ca556f36f402f6d1131a4f3f567505320a9f60151023d4a8bbdb458 Security Headers Name Value Content-Security-Policy default-src 'self' *.g2crowd.com *.g2.com; connect-src 'self' *.g2crowd.com *.g2.com; font-src 'self' *.g2crowd.com *.g2.com; form-action 'self' *.g2crowd.com *.g2.com; frame-src 'self' *.g2crowd.com *.g2.com; img-src 'self' *.g2crowd.com *.g2.com; manifest-src 'self' *.g2crowd.com *.g2.com; media-src 'self' *.g2crowd.com *.g2.com; object-src 'self' *.g2crowd.com *.g2.com; script-src 'self' *.g2crowd.com *.g2.com; style-src 'self' *.g2crowd.com *.g2.com; worker-src 'self' *.g2crowd.com *.g2.com Strict-Transport-Security max-age=604800 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers date Wed, 18 Oct 2023 18:30:10 GMT strict-transport-security max-age=604800 x-content-type-options nosniff cf-cache-status DYNAMIC content-encoding br x-permitted-cross-domain-policies none content-security-policy default-src 'self' *.g2crowd.com *.g2.com; connect-src 'self' *.g2crowd.com *.g2.com; font-src 'self' *.g2crowd.com *.g2.com; form-action 'self' *.g2crowd.com *.g2.com; frame-src 'self' *.g2crowd.com *.g2.com; img-src 'self' *.g2crowd.com *.g2.com; manifest-src 'self' *.g2crowd.com *.g2.com; media-src 'self' *.g2crowd.com *.g2.com; object-src 'self' *.g2crowd.com *.g2.com; script-src 'self' *.g2crowd.com *.g2.com; style-src 'self' *.g2crowd.com *.g2.com; worker-src 'self' *.g2crowd.com *.g2.com x-xss-protection 1; mode=block x-request-id d94d1c28-ad3a-4fb3-ad70-cbf55689241d x-runtime 0.004245 referrer-policy strict-origin-when-cross-origin server cloudflare etag W/"d4c9ffda6ca556f36f402f6d1131a4f3" x-download-options noopen x-frame-options SAMEORIGIN vary Origin content-type text/javascript; charset=utf-8 cache-control max-age=600, public cf-ray 8182d9ddccf49bec-FRA
GET H2	200	1010056.js Show response tracking.g2crowd.com/attribution_tracking/conversions/	958 B 922 B	136ms 123ms	Script text/javascript	2606:4700:4400::6812:2b1f CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://tracking.g2crowd.com/attribution_tracking/conversions/1010056.js?p=https://www.group-ib.com/media-center/press-releases/sidewinder-apt-report/&e= Requested by Host: www.group-ib.com URL: https://www.group-ib.com/media-center/press-releases/sidewinder-apt-report/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:4400::6812:2b1f , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 085d5ab7549bcb7c4e86df292e05e2e579ec6ce11e052357110484554cdb12c1 Security Headers Name Value Content-Security-Policy default-src 'self' *.g2crowd.com *.g2.com; connect-src 'self' *.g2crowd.com *.g2.com; font-src 'self' *.g2crowd.com *.g2.com; form-action 'self' *.g2crowd.com *.g2.com; frame-src 'self' *.g2crowd.com *.g2.com; img-src 'self' *.g2crowd.com *.g2.com; manifest-src 'self' *.g2crowd.com *.g2.com; media-src 'self' *.g2crowd.com *.g2.com; object-src 'self' *.g2crowd.com *.g2.com; script-src 'self' *.g2crowd.com *.g2.com; style-src 'self' *.g2crowd.com *.g2.com; worker-src 'self' *.g2crowd.com *.g2.com Strict-Transport-Security max-age=604800 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers date Wed, 18 Oct 2023 18:30:10 GMT strict-transport-security max-age=604800 x-content-type-options nosniff cf-cache-status DYNAMIC content-encoding br x-permitted-cross-domain-policies none content-security-policy default-src 'self' *.g2crowd.com *.g2.com; connect-src 'self' *.g2crowd.com *.g2.com; font-src 'self' *.g2crowd.com *.g2.com; form-action 'self' *.g2crowd.com *.g2.com; frame-src 'self' *.g2crowd.com *.g2.com; img-src 'self' *.g2crowd.com *.g2.com; manifest-src 'self' *.g2crowd.com *.g2.com; media-src 'self' *.g2crowd.com *.g2.com; object-src 'self' *.g2crowd.com *.g2.com; script-src 'self' *.g2crowd.com *.g2.com; style-src 'self' *.g2crowd.com *.g2.com; worker-src 'self' *.g2crowd.com *.g2.com x-xss-protection 1; mode=block x-request-id b0b074a2-5d66-4c55-845a-27cad737c6b3 x-runtime 0.004944 referrer-policy strict-origin-when-cross-origin server cloudflare etag W/"085d5ab7549bcb7c4e86df292e05e2e5" x-download-options noopen x-frame-options SAMEORIGIN vary Origin content-type text/javascript; charset=utf-8 cache-control max-age=600, public cf-ray 8182d9ddccf79bec-FRA
GET H2	200	1010057.js Show response tracking.g2crowd.com/attribution_tracking/conversions/	958 B 2 KB	127ms 122ms	Script text/javascript	2606:4700:4400::6812:2b1f CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://tracking.g2crowd.com/attribution_tracking/conversions/1010057.js?p=https://www.group-ib.com/media-center/press-releases/sidewinder-apt-report/&e= Requested by Host: www.group-ib.com URL: https://www.group-ib.com/media-center/press-releases/sidewinder-apt-report/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:4400::6812:2b1f , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 1d26a8b07287923bfa829132476a39ef18a3d54142a095bead617044f2255eab Security Headers Name Value Content-Security-Policy default-src 'self' *.g2crowd.com *.g2.com; connect-src 'self' *.g2crowd.com *.g2.com; font-src 'self' *.g2crowd.com *.g2.com; form-action 'self' *.g2crowd.com *.g2.com; frame-src 'self' *.g2crowd.com *.g2.com; img-src 'self' *.g2crowd.com *.g2.com; manifest-src 'self' *.g2crowd.com *.g2.com; media-src 'self' *.g2crowd.com *.g2.com; object-src 'self' *.g2crowd.com *.g2.com; script-src 'self' *.g2crowd.com *.g2.com; style-src 'self' *.g2crowd.com *.g2.com; worker-src 'self' *.g2crowd.com *.g2.com Strict-Transport-Security max-age=604800 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers date Wed, 18 Oct 2023 18:30:10 GMT strict-transport-security max-age=604800 x-content-type-options nosniff cf-cache-status DYNAMIC content-encoding br x-permitted-cross-domain-policies none content-security-policy default-src 'self' *.g2crowd.com *.g2.com; connect-src 'self' *.g2crowd.com *.g2.com; font-src 'self' *.g2crowd.com *.g2.com; form-action 'self' *.g2crowd.com *.g2.com; frame-src 'self' *.g2crowd.com *.g2.com; img-src 'self' *.g2crowd.com *.g2.com; manifest-src 'self' *.g2crowd.com *.g2.com; media-src 'self' *.g2crowd.com *.g2.com; object-src 'self' *.g2crowd.com *.g2.com; script-src 'self' *.g2crowd.com *.g2.com; style-src 'self' *.g2crowd.com *.g2.com; worker-src 'self' *.g2crowd.com *.g2.com x-xss-protection 1; mode=block x-request-id 4b98150e-6987-4b15-8337-8f6f19c8be67 x-runtime 0.004303 referrer-policy strict-origin-when-cross-origin server cloudflare etag W/"1d26a8b07287923bfa829132476a39ef" x-download-options noopen x-frame-options SAMEORIGIN vary Origin content-type text/javascript; charset=utf-8 cache-control max-age=600, public cf-ray 8182d9ddccf69bec-FRA
GET H2	200	js Show response www.googletagmanager.com/gtag/	287 KB 93 KB	37ms 34ms	Script application/javascript	2a00:1450:4001:800::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtag/js?id=G-QMES53K3Y2&l=dataLayer&cx=c Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-PW7265 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:800::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash 483dffb10af618cbc1a62e9a72991fab367a8a630430ecd7301a924db12276f2 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers date Wed, 18 Oct 2023 18:30:10 GMT content-encoding br strict-transport-security max-age=31536000; includeSubDomains server Google Tag Manager vary Accept-Encoding content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true cross-origin-resource-policy cross-origin access-control-allow-headers Cache-Control content-length 95272 x-xss-protection 0 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 expires Wed, 18 Oct 2023 18:30:10 GMT
GET H2	200	collect px4.ads.linkedin.com/ Redirect Chain https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=4496601&time=1697653810791&url=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fsidewinder-apt-report%2F&tm=gtmv2 https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=4496601&time=1697653810791&url=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fsidewinder-apt-report%2F&tm=gtmv2&cookiesTest=true https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D4496601%26time%3D1697653810791%26url%3Dhttps%253A%252F%252Fwww.group-ib.com%252Fm... https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=4496601&time=1697653810791&url=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fsidewinder-apt-report%2F&tm=gtmv2&cookiesTest=true... https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=4496601&time=1697653810791&url=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fsidewinder-apt-report%2F&tm=gtmv2&cookiesTest=tru...	0 264 B	248ms 189ms	Image application/javascript	13.107.42.14 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Show image Full URL https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=4496601&time=1697653810791&url=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fsidewinder-apt-report%2F&tm=gtmv2&cookiesTest=true&liSync=true&e_ipv6=AQKJaGbyVv7z-QAAAYtEDWlDoTL4uCckk1biddTFcPn63r9UO3arEEyBrvb9C2AorXH17qNRh9OQ Requested by Host: www.group-ib.com URL: https://www.group-ib.com/media-center/press-releases/sidewinder-apt-report/ Protocol H2 Server 13.107.42.14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers date Wed, 18 Oct 2023 18:30:11 GMT x-li-pop afd-prod-lor1-x x-msedge-ref Ref A: 425138D66B934836871F2F708710109F Ref B: FRAEDGE1912 Ref C: 2023-10-18T18:30:11Z linkedin-action 1 x-cache CONFIG_NOCACHE content-type application/javascript x-li-fabric prod-lor1 x-li-proto http/2 content-length 0 x-li-uuid AAYIAdRm8Mupq0yfG7vZrA== Redirect headers date Wed, 18 Oct 2023 18:30:10 GMT x-li-pop afd-prod-lor1-x x-msedge-ref Ref A: 08BF0BBE439F436384EF9BD2864029BB Ref B: FRAEDGE2010 Ref C: 2023-10-18T18:30:11Z linkedin-action 1 x-cache CONFIG_NOCACHE x-li-fabric prod-lor1 location https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=4496601&time=1697653810791&url=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fsidewinder-apt-report%2F&tm=gtmv2&cookiesTest=true&liSync=true&e_ipv6=AQKJaGbyVv7z-QAAAYtEDWlDoTL4uCckk1biddTFcPn63r9UO3arEEyBrvb9C2AorXH17qNRh9OQ x-li-proto http/2 content-length 0 x-li-uuid AAYIAdRjFfP32iBtTYDBmQ==
GET H2	200	json Show response forms-eu1.hscollectedforms.net/collected-forms/v1/config/	116 B 432 B	44ms 33ms	XHR application/json	172.65.192.122 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://forms-eu1.hscollectedforms.net/collected-forms/v1/config/json?portalId=25755956&utk= Requested by Host: fhp-de-js.group-ib.com URL: https://fhp-de-js.group-ib.com/d/bt-autoinject.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.65.192.122 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 43f22362329b9705cf8629061fb5b1d1a38f1cc2bc9fd46728f73e5cd9eb77cf Security Headers Name Value X-Content-Type-Options nosniff Request headers Accept application/json, text/plain, */* Referer https://www.group-ib.com/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers date Wed, 18 Oct 2023 18:30:10 GMT content-encoding br x-content-type-options nosniff cf-cache-status DYNAMIC x-evy-trace-route-service-name envoyset-translator x-hubspot-correlation-id 82400e77-1503-431e-8e53-4f90ba4a28b5 x-envoy-upstream-service-time 2 x-evy-trace-route-configuration listener_https/all x-evy-trace-listener listener_https x-request-id 82400e77-1503-431e-8e53-4f90ba4a28b5 server cloudflare vary Accept-Encoding access-control-allow-methods GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD content-type application/json;charset=utf-8 access-control-allow-origin https://www.group-ib.com x-evy-trace-virtual-host all cache-control max-age=0 x-evy-trace-served-by-pod fra04/app-td/envoy-proxy-797758f45b-8q8m9 access-control-max-age 180 x-robots-tag none access-control-allow-headers * cf-ray 8182d9ddc9c41953-FRA
GET H2	200	json Show response api-eu1.hubapi.com/hs-script-loader-public/v1/config/pixels-and-events/	250 B 1 KB	59ms 32ms	XHR application/json	2a06:98c1:3200::90:1 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://api-eu1.hubapi.com/hs-script-loader-public/v1/config/pixels-and-events/json?portalId=25755956 Requested by Host: fhp-de-js.group-ib.com URL: https://fhp-de-js.group-ib.com/d/bt-autoinject.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a06:98c1:3200::90:1 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 1aa462865a143f6b053d5d1594aea3e38d36ebad2a23a7fcfdd84ba7a7a1fddb Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers date Wed, 18 Oct 2023 18:30:10 GMT strict-transport-security max-age=31536000; includeSubDomains; preload x-content-type-options nosniff cf-cache-status DYNAMIC nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} x-evy-trace-route-service-name envoyset-translator x-hubspot-correlation-id 4e2da714-3c9e-4ed9-96c1-6c8a65870b47 content-encoding br x-envoy-upstream-service-time 3 x-evy-trace-route-configuration listener_https/all x-evy-trace-listener listener_https x-request-id 4e2da714-3c9e-4ed9-96c1-6c8a65870b47 server cloudflare x-trace 2B5D826D51293B14C664D60A934BA7BDE02A6FCD9A000000000000000000 vary origin access-control-allow-methods GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD content-type application/json;charset=utf-8 access-control-allow-origin https://www.group-ib.com x-evy-trace-virtual-host all access-control-max-age 180 access-control-allow-credentials false x-evy-trace-served-by-pod fra04/hubapi-td/envoy-proxy-86f46d6c7b-vmxl5 report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=3v4GhvRY9MhlUHBhZvRwaEjYbqQrkueZVdMG4EIZ8hDwhlC1BS0XeM1wGh9K85n%2F2O42%2FVqdJ4D2oMjHEZNRmKNQAqjlHzS8mq%2BTrkUmDR%2BqhbWH%2FpdIlmL1LFhvGrAs0%2FRC1J4dAgC0LLw%2F7UzTyQ%3D%3D"}],"group":"cf-nel","max_age":604800} cf-ray 8182d9ddda0b5b7a-FRA access-control-allow-headers *
GET H2	200	combinedConfigs Show response cta-eu1.hubspot.com/web-interactives/public/v1/embed/	207 B 1 KB	80ms 47ms	Fetch application/json	172.65.198.159 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cta-eu1.hubspot.com/web-interactives/public/v1/embed/combinedConfigs?portalId=25755956&currentUrl=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fsidewinder-apt-report%2F&referrer=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fsidewinder-apt-report%2F Requested by Host: fhp-de-js.group-ib.com URL: https://fhp-de-js.group-ib.com/d/bt-autoinject.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.65.198.159 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 4e1f5dae1f231a3e6c42993418f2c2b7670e62db5b3ffee9afe0afa6657504f5 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers date Wed, 18 Oct 2023 18:30:10 GMT strict-transport-security max-age=31536000; includeSubDomains; preload x-content-type-options nosniff cf-cache-status DYNAMIC nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} x-evy-trace-route-service-name envoyset-translator x-hubspot-correlation-id bb63852a-d409-41b8-b86d-84d977f2dd09 content-encoding br x-envoy-upstream-service-time 14 x-evy-trace-route-configuration listener_https/all x-evy-trace-listener listener_https x-request-id bb63852a-d409-41b8-b86d-84d977f2dd09 server cloudflare vary origin access-control-allow-methods OPTIONS, GET content-type application/json;charset=utf-8 access-control-allow-origin https://www.group-ib.com x-evy-trace-virtual-host all access-control-max-age 180 access-control-allow-credentials true cache-control max-age=0, no-cache, no-store report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=fPmiiJy76VaKjxZAqN6RC%2FS5cxOScvseiv6E6T40mliLnNEQMSs2r3ZVmg95SbBFUa32H0NzOm0zjuxaQw2UM8aXAVdINd9%2FmlP5IPgMJa6XbR5ZY8ijt3Hk0Vx9Ldq9rA3Y%2Be8%3D"}],"group":"cf-nel","max_age":604800} x-robots-tag noindex, follow access-control-allow-headers Accept, Accept-Charset, Accept-Encoding, Accept-Language, Content-Type, Host, Origin, Referer, User-Agent cf-ray 8182d9ddfba32bbc-FRA x-evy-trace-served-by-pod fra04/star-hubspot-td/envoy-proxy-5cdd94655b-hn9qf
GET H2	200	rp.gif alb.reddit.com/	42 B 637 B	50ms 8ms	Image image/gif	151.101.129.140 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://alb.reddit.com/rp.gif?ts=1697653810858&id=a2_du2owjr6f67j&event=PageVisit&m.itemCount=undefined&m.value=&m.valueDecimal=undefined&m.currency=undefined&m.transactionId=&m.customEventName=&m.products=&m.conversionId=&uuid=81ce3e89-6c39-4c02-b109-55b61b5c1419&aaid=&em=&external_id=&idfa=&integration=gtm&opt_out=0&sh=1600&sw=1200&v=rdt_f5bd31b2 Requested by Host: www.group-ib.com URL: https://www.group-ib.com/media-center/press-releases/sidewinder-apt-report/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 151.101.129.140 , United States, ASN54113 (FASTLY, US), Reverse DNS Software Varnish / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers date Wed, 18 Oct 2023 18:30:10 GMT via 1.1 varnish nel {"report_to": "w3-reporting-nel", "max_age": 14400, "include_subdomains": false, "success_fraction": 0.3, "failure_fraction": 0.3} server Varnish report-to {"group": "w3-reporting-nel", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-nel.reddit.com/reports" }]}, {"group": "w3-reporting", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting.reddit.com/reports" }]}, {"group": "w3-reporting-csp", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-csp.reddit.com/reports" }]} content-type image/gif cross-origin-resource-policy cross-origin accept-ranges bytes content-length 42 retry-after 0
GET H2	200	/ Show response c.6sc.co/	7 B 194 B	56ms 29ms	XHR text/html	2.17.100.184 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://c.6sc.co/ Requested by Host: fhp-de-js.group-ib.com URL: https://fhp-de-js.group-ib.com/d/bt-autoinject.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2.17.100.184 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS a2-17-100-184.deploy.static.akamaitechnologies.com Software / Resource Hash fe04a9dc88d3f3be8d4f6bc63a9a80f45a4c6d8460e7551dab849457c091920a Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers date Wed, 18 Oct 2023 18:30:10 GMT access-control-max-age 86400 access-control-allow-methods GET,POST content-type text/html access-control-allow-origin https://www.group-ib.com access-control-allow-credentials true access-control-allow-headers * content-length 7
GET H2	200	/ Show response ipv6.6sc.co/	23 B 316 B	89ms 18ms	XHR text/html	2a02:26f0:4700::17d4:6e90 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://ipv6.6sc.co/ Requested by Host: fhp-de-js.group-ib.com URL: https://fhp-de-js.group-ib.com/d/bt-autoinject.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:4700::17d4:6e90 Prague, Czech Republic, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software / Resource Hash 2075c09d4bbc39bda07bcbb691e49268f9f6913af7815a9ab5d6649b91db861e Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers pragma no-cache date Wed, 18 Oct 2023 18:30:10 GMT vary Origin content-type text/html access-control-allow-origin https://www.group-ib.com cache-control max-age=0, no-cache, no-store 6si-ipv6 2a00:c98:2050:a007:2::3 server-timing cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="1697653810911_399797900_15143997_33_1184_14_34_219";dur=1 content-length 23 expires Wed, 18 Oct 2023 18:30:10 GMT
GET H2	200	img.gif b.6sc.co/v1/beacon/	43 B 483 B	271ms 270ms	Image image/gif	2.17.100.184 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=e84d9c08a990af8592952e7ac9a983ad&svisitor=null&visitor=b0ec56dd-7979-448a-8bcc-3d3c1239d033&session=1823748f-0aa5-4e1b-8735-fb6c2888a48f&event=a_pageload&q=%7B%22pageLoadTime%22%3A%22Wed%2C%2018%20Oct%202023%2018%3A30%3A10%20GMT%22%7D&isIframe=false&m=%7B%22description%22%3A%22Group-IB%20has%20documented%20previously%20unreported%20phishing%20operations%20carried%20out%20by%20the%20nation-state%20cyber%20threat%20actor%20SideWinder%20between%20June%20and%20November%202021.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Molted%20skin%3A%20APT%20SideWinder%202021%20campaign%20that%20targeted%20over%2060%20companies%20in%20the%20Asia-Pacific%20%7C%20Group-IB%22%7D&cb=&r=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fsidewinder-apt-report%2F&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fsidewinder-apt-report%2F&pageViewId=0242a1e3-25d5-4ade-8c10-917a2020184e&v=1.1.7 Requested by Host: www.group-ib.com URL: https://www.group-ib.com/media-center/press-releases/sidewinder-apt-report/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2.17.100.184 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS a2-17-100-184.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers date Wed, 18 Oct 2023 18:30:11 GMT x-content-type-options nosniff content-length 43 pragma no-cache last-modified Fri, 21 Feb 2020 18:57:20 GMT server nginx/1.14.0 (Ubuntu) etag "5e502810-2b" access-control-max-age 86400 access-control-allow-methods GET,POST content-type image/gif access-control-allow-origin cache-control private, no-cache, no-cache=Set-Cookie, proxy-revalidate access-control-allow-credentials true accept-ranges bytes access-control-allow-headers * expires Wed, 19 Apr 2000 11:43:00 GMT
GET H2	200	img.gif b.6sc.co/v1/beacon/	43 B 484 B	297ms 296ms	Image image/gif	2.17.100.184 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=e84d9c08a990af8592952e7ac9a983ad&svisitor=null&visitor=b0ec56dd-7979-448a-8bcc-3d3c1239d033&session=1823748f-0aa5-4e1b-8735-fb6c2888a48f&event=ni%3AasyncSettingsAudit&q=%7B%22settings%22%3A%22%5B%7B%5C%22name%5C%22%3A%5C%22enableEventTracking%5C%22%2C%5C%22value%5C%22%3A%5C%22true%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Wed%2C%2018%20Oct%202023%2018%3A30%3A10%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setToken%5C%22%2C%5C%22value%5C%22%3A%5C%22e84d9c08a990af8592952e7ac9a983ad%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Wed%2C%2018%20Oct%202023%2018%3A30%3A10%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setEndpoint%5C%22%2C%5C%22value%5C%22%3A%5C%22b.6sc.co%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Wed%2C%2018%20Oct%202023%2018%3A30%3A10%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%5D%22%7D&isIframe=false&m=%7B%22description%22%3A%22Group-IB%20has%20documented%20previously%20unreported%20phishing%20operations%20carried%20out%20by%20the%20nation-state%20cyber%20threat%20actor%20SideWinder%20between%20June%20and%20November%202021.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Molted%20skin%3A%20APT%20SideWinder%202021%20campaign%20that%20targeted%20over%2060%20companies%20in%20the%20Asia-Pacific%20%7C%20Group-IB%22%7D&cb=&r=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fsidewinder-apt-report%2F&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fsidewinder-apt-report%2F&pageViewId=0242a1e3-25d5-4ade-8c10-917a2020184e&v=1.1.7 Requested by Host: www.group-ib.com URL: https://www.group-ib.com/media-center/press-releases/sidewinder-apt-report/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2.17.100.184 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS a2-17-100-184.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers date Wed, 18 Oct 2023 18:30:11 GMT x-content-type-options nosniff content-length 43 pragma no-cache last-modified Sat, 18 Feb 2023 01:45:17 GMT server nginx/1.14.0 (Ubuntu) etag "63f02dad-2b" access-control-max-age 86400 access-control-allow-methods GET,POST content-type image/gif access-control-allow-origin cache-control private, no-cache, no-cache=Set-Cookie, proxy-revalidate access-control-allow-credentials true accept-ranges bytes access-control-allow-headers * expires Wed, 19 Apr 2000 11:43:00 GMT
POST H2	204	collect region1.analytics.google.com/g/	0 255 B	55ms 19ms	Ping text/plain	2001:4860:4802:34::36 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://region1.analytics.google.com/g/collect?v=2&tid=G-QMES53K3Y2&gtm=45je3ag0&_p=1845783551&_gaz=1&cid=1347526.1697653811&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_s=1&dl=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fsidewinder-apt-report%2F&sid=1697653810&sct=1&seg=0&dr=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fsidewinder-apt-report%2F&dt=Molted%20skin%3A%20APT%20SideWinder%202021%20campaign%20that%20targeted%20over%2060%20companies%20in%20the%20Asia-Pacific%20%7C%20Group-IB&en=page_view&_fv=1&_nsi=1&_ss=1 Requested by Host: fhp-de-js.group-ib.com URL: https://fhp-de-js.group-ib.com/d/bt-autoinject.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2001:4860:4802:34::36 , United States, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers pragma no-cache date Wed, 18 Oct 2023 18:30:10 GMT server Golfe2 content-type text/plain access-control-allow-origin https://www.group-ib.com cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 0 expires Fri, 01 Jan 1990 00:00:00 GMT
POST H2	204	collect stats.g.doubleclick.net/g/	0 255 B	72ms 25ms	Ping text/plain	2a00:1450:400c:c06::9c GOOGLE
General Check archive.org Show headers Download Go to Full URL https://stats.g.doubleclick.net/g/collect?v=2&tid=G-QMES53K3Y2&cid=1347526.1697653811&gtm=45je3ag0&aip=1 Requested by Host: fhp-de-js.group-ib.com URL: https://fhp-de-js.group-ib.com/d/bt-autoinject.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:400c:c06::9c Brussels, Belgium, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers pragma no-cache date Wed, 18 Oct 2023 18:30:10 GMT server Golfe2 content-type text/plain access-control-allow-origin https://www.group-ib.com cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	ga-audiences www.google.de/ads/	42 B 107 B	99ms 52ms	Image image/gif	2a00:1450:4001:830::2003 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.de/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&tid=G-QMES53K3Y2&cid=1347526.1697653811&gtm=45je3ag0&aip=1&z=1331788866 Requested by Host: www.group-ib.com URL: https://www.group-ib.com/media-center/press-releases/sidewinder-apt-report/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:830::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers pragma no-cache date Wed, 18 Oct 2023 18:30:10 GMT x-content-type-options nosniff server cafe content-type image/gif p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin timing-allow-origin * alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	649324202964935 Show response connect.facebook.net/signals/config/	141 KB 37 KB	202ms 201ms	Script application/x-javascript	2a03:2880:f084:d:face:b00c:0:3 FACEBOOK
General Check archive.org Show headers Download Go to Full URL https://connect.facebook.net/signals/config/649324202964935?v=2.9.134&r=stable&domain=www.group-ib.com Requested by Host: connect.facebook.net URL: https://connect.facebook.net/en_US/fbevents.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a03:2880:f084:d:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US), Reverse DNS Software / Resource Hash 159950096492a963e1d167bf53b49aaa3d33db34d629c51d34dd233d01ea1ae5 Security Headers Name Value Content-Security-Policy default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script'; Strict-Transport-Security max-age=31536000; preload; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers content-security-policy default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script'; content-encoding gzip x-content-type-options nosniff strict-transport-security max-age=31536000; preload; includeSubDomains date Wed, 18 Oct 2023 18:30:11 GMT document-policy force-load-at-top cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400 x-xss-protection 0 pragma public x-fb-debug C7KFzU/vn19l90kRw+2S2GqgOdkG0GklV4oVb4iDiX7rSPPlyDDQoyMpSgYdjzieAOC6XfT9vC2xnOlnLzNl3g== cross-origin-opener-policy same-origin-allow-popups vary Accept-Encoding x-frame-options DENY content-type application/x-javascript; charset=utf-8 origin-agent-cluster ?0 cache-control public, max-age=1200 permissions-policy accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(), gyroscope=(), hid=(), idle-detection=(), magnetometer=(), microphone=(), midi=(), payment=(), screen-wake-lock=(), serial=(), usb=() timing-allow-origin * expires Sat, 01 Jan 2000 00:00:00 GMT
GET H/1.1	200 OK	counters.gif forms-eu1.hsforms.com/embed/v3/	35 B 1016 B	338ms 36ms	Image image/gif	172.65.232.43 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://forms-eu1.hsforms.com/embed/v3/counters.gif?key=collected-forms-embed-js-form-bind&count=5 Requested by Host: www.group-ib.com URL: https://www.group-ib.com/media-center/press-releases/sidewinder-apt-report/ Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 172.65.232.43 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers Date Wed, 18 Oct 2023 18:30:11 GMT Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff CF-Cache-Status DYNAMIC x-evy-trace-route-service-name envoyset-translator X-HubSpot-Correlation-Id 09a31da8-cfcb-4a70-ac73-9478f1a07c55 x-envoy-upstream-service-time 2 Connection keep-alive alt-svc h3=":443"; ma=86400 Content-Length 35 x-evy-trace-route-configuration listener_https/all x-evy-trace-listener listener_https x-request-id 09a31da8-cfcb-4a70-ac73-9478f1a07c55 Server cloudflare X-Trace 2B8C2C0704D9375B4EDF66A2DEFF20BAC28F89183B000000000000000000 Vary origin Content-Type image/gif x-evy-trace-virtual-host all x-evy-trace-served-by-pod fra04/star-hubspot-td/envoy-proxy-5cdd94655b-hn9qf Access-Control-Expose-Headers X-Origin-Hublet Cache-Control max-age=0, no-cache, no-store Access-Control-Allow-Credentials false X-Robots-Tag none CF-RAY 8182d9e02a142c1e-FRA
GET H3	200	js Show response www.googletagmanager.com/gtag/	226 KB 78 KB	43ms 43ms	Script application/javascript	2a00:1450:4001:800::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtag/js?id=AW-10882981508 Requested by Host: js-eu1.hsadspixel.net URL: https://js-eu1.hsadspixel.net/fb.js Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:800::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash 5c36d030a8879a5e59882111022188ef92c40175f9366a2ca7923b1889a7f30c Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers date Wed, 18 Oct 2023 18:30:10 GMT content-encoding br strict-transport-security max-age=31536000; includeSubDomains cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 80184 x-xss-protection 0 last-modified Wed, 18 Oct 2023 18:00:00 GMT server Google Tag Manager vary Accept-Encoding content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true access-control-allow-headers Cache-Control expires Wed, 18 Oct 2023 18:30:10 GMT
GET H3	200	js Show response www.googletagmanager.com/gtag/	226 KB 78 KB	31ms 31ms	Script application/javascript	2a00:1450:4001:800::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtag/js?id=AW-10882981508&l=dataLayer&cx=c Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-PW7265 Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:800::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash 52c3ce9e4cd74ebd4448048f869846a0a01ef50b4538b111caec2eb747ee1f27 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers date Wed, 18 Oct 2023 18:30:10 GMT content-encoding br strict-transport-security max-age=31536000; includeSubDomains cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 80186 x-xss-protection 0 last-modified Wed, 18 Oct 2023 18:00:00 GMT server Google Tag Manager vary Accept-Encoding content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true access-control-allow-headers Cache-Control expires Wed, 18 Oct 2023 18:30:10 GMT
GET H2	200	sync_cookie_image_finish mc.yandex.ru/ Redirect Chain https://mc.yandex.com/sync_cookie_image_check https://mc.yandex.ru/sync_cookie_image_start?redirect_domain=mc.yandex.com&token=10160.cBOVT6CSro7VMTISOmtDENikrpWccgLwwSzkBS7sfnj_7Yo6iEwUeoZdT7uNTg_9.q68f362muIyyyXeJ1g1Z_pJn8dU%2C https://mc.yandex.com/sync_cookie_image_decide?token=10160._pulQcu05VWlPcI6AaWH6SoxS2sgkUV-rfMIAX56p99QRHxnpfPl66YJfukOutl7fsY5KiTTGrGs7YhPQdr09CqQvVjnzI_MMMTMVO3slUIWBGHCURybZCA6ikhEcvqH0kYpa7-orh... https://mc.yandex.ru/sync_cookie_image_finish?redirect_domain=mc.yandex.com&token=10160.srMTufwk050YPLISp1tvDkY_YBHUkoXtWt0qcrZNsGBFB37QSg99Tt62LABRNQse3m-njDU1GHBeTtDprgMMgJN6xaoUEgyYb--S1aEk1MCFX...	43 B 581 B	56ms 56ms	Image image/gif	2a02:6b8::1:119 GLOBAL_DC
General Check archive.org Show headers Download Go to Show image Full URL https://mc.yandex.ru/sync_cookie_image_finish?redirect_domain=mc.yandex.com&token=10160.srMTufwk050YPLISp1tvDkY_YBHUkoXtWt0qcrZNsGBFB37QSg99Tt62LABRNQse3m-njDU1GHBeTtDprgMMgJN6xaoUEgyYb--S1aEk1MCFXIj_YYdB6psH4hfcJaf_VFYE5hvGbzlyAq4hhdCDBXCOYUPIDZSf-rw3DeWHE11oM9GHgRvpL_JLBAzztHFLxeY7lCcpyHmtOsPWLG2mWQ%2C%2C.XbeB7b9bH_CIMzFGaBGPceITfmQ%2C Requested by Host: www.group-ib.com URL: https://www.group-ib.com/media-center/press-releases/sidewinder-apt-report/ Protocol H2 Server 2a02:6b8::1:119 Ulyanovsk, Russian Federation, ASN208722 (GLOBAL_DC, FI), Reverse DNS Software / Resource Hash 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87 Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers date Wed, 18 Oct 2023 18:30:11 GMT strict-transport-security max-age=31536000 content-length 43 x-xss-protection 1; mode=block content-type image/gif Redirect headers location https://mc.yandex.ru/sync_cookie_image_finish?redirect_domain=mc.yandex.com&token=10160.srMTufwk050YPLISp1tvDkY_YBHUkoXtWt0qcrZNsGBFB37QSg99Tt62LABRNQse3m-njDU1GHBeTtDprgMMgJN6xaoUEgyYb--S1aEk1MCFXIj_YYdB6psH4hfcJaf_VFYE5hvGbzlyAq4hhdCDBXCOYUPIDZSf-rw3DeWHE11oM9GHgRvpL_JLBAzztHFLxeY7lCcpyHmtOsPWLG2mWQ%2C%2C.XbeB7b9bH_CIMzFGaBGPceITfmQ%2C date Wed, 18 Oct 2023 18:30:11 GMT strict-transport-security max-age=31536000 x-xss-protection 1; mode=block
GET H2	200	/ www.google.com/pagead/1p-user-list/10897073384/	42 B 455 B	71ms 30ms	Image image/gif	2a00:1450:4001:803::2004 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.com/pagead/1p-user-list/10897073384/?random=1697653810787&cv=11&fst=1697652000000&bg=ffffff&guid=ON&async=1&gtm=45He3ag0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fsidewinder-apt-report%2F&ref=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fsidewinder-apt-report%2F&frm=0&tiba=Molted%20skin%3A%20APT%20SideWinder%202021%20campaign%20that%20targeted%20over%2060%20companies%20in%20the%20Asia-Pacific%20%7C%20Group-IB&fmt=3&is_vtc=1&random=2425818227&rmt_tld=0&ipr=y Requested by Host: www.group-ib.com URL: https://www.group-ib.com/media-center/press-releases/sidewinder-apt-report/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:803::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value Content-Security-Policy script-src 'none'; object-src 'none' X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers pragma no-cache date Wed, 18 Oct 2023 18:30:11 GMT content-security-policy script-src 'none'; object-src 'none' x-content-type-options nosniff server cafe content-type image/gif p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin timing-allow-origin * alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	/ www.google.de/pagead/1p-user-list/10897073384/	42 B 455 B	33ms 31ms	Image image/gif	2a00:1450:4001:830::2003 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.de/pagead/1p-user-list/10897073384/?random=1697653810787&cv=11&fst=1697652000000&bg=ffffff&guid=ON&async=1&gtm=45He3ag0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fsidewinder-apt-report%2F&ref=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fsidewinder-apt-report%2F&frm=0&tiba=Molted%20skin%3A%20APT%20SideWinder%202021%20campaign%20that%20targeted%20over%2060%20companies%20in%20the%20Asia-Pacific%20%7C%20Group-IB&fmt=3&is_vtc=1&random=2425818227&rmt_tld=1&ipr=y Requested by Host: www.group-ib.com URL: https://www.group-ib.com/media-center/press-releases/sidewinder-apt-report/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:830::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value Content-Security-Policy script-src 'none'; object-src 'none' X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers pragma no-cache date Wed, 18 Oct 2023 18:30:10 GMT content-security-policy script-src 'none'; object-src 'none' x-content-type-options nosniff server cafe content-type image/gif p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin timing-allow-origin * alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	advert.gif mc.yandex.com/metrika/	43 B 520 B	55ms 53ms	Image image/gif	2a02:6b8::1:119 GLOBAL_DC
General Check archive.org Show headers Download Go to Show image Full URL https://mc.yandex.com/metrika/advert.gif Requested by Host: www.group-ib.com URL: https://www.group-ib.com/media-center/press-releases/sidewinder-apt-report/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:6b8::1:119 Ulyanovsk, Russian Federation, ASN208722 (GLOBAL_DC, FI), Reverse DNS Software / Resource Hash 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers date Wed, 18 Oct 2023 18:30:11 GMT strict-transport-security max-age=31536000 last-modified Tue, 17 Oct 2023 09:59:45 GMT accept-ch Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA etag "652e5b11-2b" content-type image/gif access-control-allow-origin * cache-control max-age=3600 accept-ranges bytes timing-allow-origin * content-length 43 expires Wed, 18 Oct 2023 19:30:11 GMT
GET H2	200	notify Show response api.neverbounce.com/v4/poe/	63 B 282 B	424ms 197ms	Script application/javascript	35.169.111.207 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://api.neverbounce.com/v4/poe/notify?key=public_feedec8c69cd171b06421bb96273f04d&event=form.load&callback=__neverbounce_120009 Requested by Host: cdn.neverbounce.com URL: https://cdn.neverbounce.com/widget/dist/NeverBounce.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 35.169.111.207 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-35-169-111-207.compute-1.amazonaws.com Software nginx / Resource Hash 4b90917e1e541bee26408e0c30bc2df9e21bd66c6f8774665b12a6ba6965983f Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers date Wed, 18 Oct 2023 18:30:11 GMT content-encoding gzip strict-transport-security max-age=31536000; includeSubDomains server nginx vary Accept-Encoding content-type application/javascript cache-control no-cache, private x-ua-compatible IE=Edge
GET H2	200	notify Show response api.neverbounce.com/v4/poe/	63 B 282 B	341ms 114ms	Script application/javascript	35.169.111.207 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://api.neverbounce.com/v4/poe/notify?key=public_feedec8c69cd171b06421bb96273f04d&event=form.load&callback=__neverbounce_321711 Requested by Host: cdn.neverbounce.com URL: https://cdn.neverbounce.com/widget/dist/NeverBounce.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 35.169.111.207 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-35-169-111-207.compute-1.amazonaws.com Software nginx / Resource Hash 8309f132e2a06e754f790df0741d1c1950d105e3599c214fe6ee73bd6a09da03 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers date Wed, 18 Oct 2023 18:30:11 GMT content-encoding gzip strict-transport-security max-age=31536000; includeSubDomains server nginx vary Accept-Encoding content-type application/javascript cache-control no-cache, private x-ua-compatible IE=Edge
GET H2	200	notify Show response api.neverbounce.com/v4/poe/	63 B 282 B	335ms 124ms	Script application/javascript	35.169.111.207 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://api.neverbounce.com/v4/poe/notify?key=public_feedec8c69cd171b06421bb96273f04d&event=form.load&callback=__neverbounce_725293 Requested by Host: cdn.neverbounce.com URL: https://cdn.neverbounce.com/widget/dist/NeverBounce.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 35.169.111.207 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-35-169-111-207.compute-1.amazonaws.com Software nginx / Resource Hash 52f851fcb01243dd6dcd902fb4764d4c7364132b8a3517932ae641cae20ffe14 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers date Wed, 18 Oct 2023 18:30:11 GMT content-encoding gzip strict-transport-security max-age=31536000; includeSubDomains server nginx vary Accept-Encoding content-type application/javascript cache-control no-cache, private x-ua-compatible IE=Edge
GET H2	200	notify Show response api.neverbounce.com/v4/poe/	61 B 281 B	297ms 113ms	Script application/javascript	35.169.111.207 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://api.neverbounce.com/v4/poe/notify?key=public_feedec8c69cd171b06421bb96273f04d&event=form.load&callback=__neverbounce_12933 Requested by Host: cdn.neverbounce.com URL: https://cdn.neverbounce.com/widget/dist/NeverBounce.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 35.169.111.207 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-35-169-111-207.compute-1.amazonaws.com Software nginx / Resource Hash 4e57427a7c7ade58dbf3e7ec1b6c284892f557b7e5f3d2760337aac1da87b565 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers date Wed, 18 Oct 2023 18:30:11 GMT content-encoding gzip strict-transport-security max-age=31536000; includeSubDomains server nginx vary Accept-Encoding content-type application/javascript cache-control no-cache, private x-ua-compatible IE=Edge
GET H2	200	notify Show response api.neverbounce.com/v4/poe/	63 B 282 B	293ms 121ms	Script application/javascript	35.169.111.207 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://api.neverbounce.com/v4/poe/notify?key=public_feedec8c69cd171b06421bb96273f04d&event=form.load&callback=__neverbounce_960154 Requested by Host: cdn.neverbounce.com URL: https://cdn.neverbounce.com/widget/dist/NeverBounce.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 35.169.111.207 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-35-169-111-207.compute-1.amazonaws.com Software nginx / Resource Hash 0c1144db4b2db72b4d0e8b9ff868132cf5fa33e8f1eeaa6e8f83cc886e4b6ca2 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers date Wed, 18 Oct 2023 18:30:11 GMT content-encoding gzip strict-transport-security max-age=31536000; includeSubDomains server nginx vary Accept-Encoding content-type application/javascript cache-control no-cache, private x-ua-compatible IE=Edge
GET H/1.1	200 OK	counters.gif perf-eu1.hsforms.com/embed/v3/	35 B 1 KB	81ms 36ms	Image image/gif	172.65.232.43 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://perf-eu1.hsforms.com/embed/v3/counters.gif?key=config-loaded-success&value=1 Requested by Host: www.group-ib.com URL: https://www.group-ib.com/media-center/press-releases/sidewinder-apt-report/ Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 172.65.232.43 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers Date Wed, 18 Oct 2023 18:30:11 GMT Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff CF-Cache-Status MISS x-evy-trace-route-service-name envoyset-translator X-HubSpot-Correlation-Id cab6dec0-95ba-4c85-9d63-e98bd74cfd21 x-envoy-upstream-service-time 4 Connection keep-alive alt-svc h3=":443"; ma=86400 Content-Length 35 x-evy-trace-route-configuration listener_https/all x-evy-trace-listener listener_https x-request-id cab6dec0-95ba-4c85-9d63-e98bd74cfd21 Last-Modified Wed, 18 Oct 2023 18:30:11 GMT Server cloudflare X-Trace 2B4F9AEF935290DE9EC403F5CD742E462315FF9083000000000000000000 Vary origin, Accept-Encoding Content-Type image/gif x-evy-trace-virtual-host all x-evy-trace-served-by-pod fra04/star-hubspot-td/envoy-proxy-5cdd94655b-hn9qf Access-Control-Expose-Headers X-Origin-Hublet Cache-Control max-age=0, no-cache, no-store Access-Control-Allow-Credentials false Accept-Ranges bytes X-Robots-Tag none CF-RAY 8182d9df4806bb3b-FRA
GET H2	200	img.gif b.6sc.co/v1/beacon/	43 B 484 B	212ms 211ms	Image image/gif	2.17.100.184 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=e84d9c08a990af8592952e7ac9a983ad&svisitor=null&visitor=b0ec56dd-7979-448a-8bcc-3d3c1239d033&session=1823748f-0aa5-4e1b-8735-fb6c2888a48f&event=ipv6&q=%7B%22address%22%3A%222a00%3Ac98%3A2050%3Aa007%3A2%3A%3A3%22%7D&isIframe=false&m=%7B%22description%22%3A%22Group-IB%20has%20documented%20previously%20unreported%20phishing%20operations%20carried%20out%20by%20the%20nation-state%20cyber%20threat%20actor%20SideWinder%20between%20June%20and%20November%202021.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Molted%20skin%3A%20APT%20SideWinder%202021%20campaign%20that%20targeted%20over%2060%20companies%20in%20the%20Asia-Pacific%20%7C%20Group-IB%22%7D&cb=&r=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fsidewinder-apt-report%2F&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fsidewinder-apt-report%2F&pageViewId=0242a1e3-25d5-4ade-8c10-917a2020184e&v=1.1.7 Requested by Host: www.group-ib.com URL: https://www.group-ib.com/media-center/press-releases/sidewinder-apt-report/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2.17.100.184 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS a2-17-100-184.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers date Wed, 18 Oct 2023 18:30:11 GMT x-content-type-options nosniff content-length 43 pragma no-cache last-modified Sat, 05 Jun 2021 07:56:05 GMT server nginx/1.14.0 (Ubuntu) etag "60bb2e15-2b" access-control-max-age 86400 access-control-allow-methods GET,POST content-type image/gif access-control-allow-origin cache-control private, no-cache, no-cache=Set-Cookie, proxy-revalidate access-control-allow-credentials true accept-ranges bytes access-control-allow-headers * expires Wed, 19 Apr 2000 11:43:00 GMT
GET H2	200	/ Show response googleads.g.doubleclick.net/pagead/viewthroughconversion/10882981508/	3 KB 2 KB	53ms 50ms	Script text/javascript	2a00:1450:4001:800::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://googleads.g.doubleclick.net/pagead/viewthroughconversion/10882981508/?random=1697653811013&cv=11&fst=1697653811013&bg=ffffff&guid=ON&async=1&gtm=45be3ag0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fsidewinder-apt-report%2F&ref=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fsidewinder-apt-report%2F&hn=www.googleadservices.com&frm=0&tiba=Molted%20skin%3A%20APT%20SideWinder%202021%20campaign%20that%20targeted%20over%2060%20companies%20in%20the%20Asia-Pacific%20%7C%20Group-IB&did=dZTQ1Zm&gdid=dZTQ1Zm&auid=889656904.1697653811&uamb=0&uaw=0&data=event%3Dgtag.config&rfmt=3&fmt=4 Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtag/js?id=AW-10882981508&l=dataLayer&cx=c Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash 5136c378d5bf83a78f6fbb0c8aea9489f908fc89c649b731c21d85e6cb458336 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers pragma no-cache date Wed, 18 Oct 2023 18:30:11 GMT content-encoding br x-content-type-options nosniff server cafe content-type text/javascript; charset=UTF-8 p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" cache-control no-cache, must-revalidate cross-origin-resource-policy cross-origin content-disposition attachment; filename="f.txt" timing-allow-origin * alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 1425 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	/ www.google.com/pagead/1p-user-list/10882981508/	42 B 108 B	30ms 29ms	Image image/gif	2a00:1450:4001:803::2004 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.com/pagead/1p-user-list/10882981508/?random=1697653811013&cv=11&fst=1697652000000&bg=ffffff&guid=ON&async=1&gtm=45be3ag0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fsidewinder-apt-report%2F&ref=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fsidewinder-apt-report%2F&frm=0&tiba=Molted%20skin%3A%20APT%20SideWinder%202021%20campaign%20that%20targeted%20over%2060%20companies%20in%20the%20Asia-Pacific%20%7C%20Group-IB&data=event%3Dgtag.config&fmt=3&is_vtc=1&random=1231181063&rmt_tld=0&ipr=y Requested by Host: www.group-ib.com URL: https://www.group-ib.com/media-center/press-releases/sidewinder-apt-report/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:803::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value Content-Security-Policy script-src 'none'; object-src 'none' X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers pragma no-cache date Wed, 18 Oct 2023 18:30:11 GMT content-security-policy script-src 'none'; object-src 'none' x-content-type-options nosniff server cafe content-type image/gif p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin timing-allow-origin * alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	/ www.google.de/pagead/1p-user-list/10882981508/	42 B 108 B	29ms 28ms	Image image/gif	2a00:1450:4001:830::2003 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.de/pagead/1p-user-list/10882981508/?random=1697653811013&cv=11&fst=1697652000000&bg=ffffff&guid=ON&async=1&gtm=45be3ag0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fsidewinder-apt-report%2F&ref=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fsidewinder-apt-report%2F&frm=0&tiba=Molted%20skin%3A%20APT%20SideWinder%202021%20campaign%20that%20targeted%20over%2060%20companies%20in%20the%20Asia-Pacific%20%7C%20Group-IB&data=event%3Dgtag.config&fmt=3&is_vtc=1&random=1231181063&rmt_tld=1&ipr=y Requested by Host: www.group-ib.com URL: https://www.group-ib.com/media-center/press-releases/sidewinder-apt-report/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:830::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value Content-Security-Policy script-src 'none'; object-src 'none' X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers pragma no-cache date Wed, 18 Oct 2023 18:30:11 GMT content-security-policy script-src 'none'; object-src 'none' x-content-type-options nosniff server cafe content-type image/gif p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin timing-allow-origin * alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	/ www.facebook.com/tr/	0 185 B	35ms 7ms	Image text/plain	2a03:2880:f176:84:face:b00c:0:25de FACEBOOK
General Check archive.org Show headers Download Go to Show image Full URL https://www.facebook.com/tr/?id=649324202964935&ev=PageView&dl=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fsidewinder-apt-report%2F&rl=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fsidewinder-apt-report%2F&if=false&ts=1697653811158&sw=1600&sh=1200&v=2.9.134&r=stable&ec=0&o=30&fbp=fb.1.1697653811156.1438752596&cs_est=true&it=1697653810923&coo=false&rqm=GET Requested by Host: www.group-ib.com URL: https://www.group-ib.com/media-center/press-releases/sidewinder-apt-report/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a03:2880:f176:84:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US), Reverse DNS Software proxygen-bolt / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers strict-transport-security max-age=31536000; includeSubDomains date Wed, 18 Oct 2023 18:30:11 GMT server proxygen-bolt content-type text/plain access-control-allow-origin access-control-allow-credentials true cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400 content-length 0
GET H2	200	1 Show response mc.yandex.com/watch/26812653/ Redirect Chain https://mc.yandex.com/watch/26812653?wmode=7&page-url=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fsidewinder-apt-report%2F&charset=utf-8&site-info=%7B%22shareVersion%22%3A2%2C%... https://mc.yandex.com/watch/26812653/1?wmode=7&page-url=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fsidewinder-apt-report%2F&charset=utf-8&site-info=%7B%22shareVersion%22%3A2%2...	427 B 546 B	57ms 56ms	XHR application/json	2a02:6b8::1:119 GLOBAL_DC
General Check archive.org Show headers Download Go to Full URL https://mc.yandex.com/watch/26812653/1?wmode=7&page-url=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fsidewinder-apt-report%2F&charset=utf-8&site-info=%7B%22shareVersion%22%3A2%2C%22strategy%22%3A%22d%2Fn%2Fq%2Fr%2Fs%2Ft%22%7D&uah=chm%0A%3F0&browser-info=pv%3A1%3Avf%3A3qm6qq812ez2u52y4wzrnbv%3Afp%3A498%3Afu%3A1%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A1135%3Acn%3A1%3Adp%3A0%3Als%3A810756797713%3Ahid%3A831156496%3Az%3A120%3Ai%3A20231018203010%3Aet%3A1697653811%3Ac%3A1%3Arn%3A507436145%3Arqn%3A1%3Au%3A1697653811210564030%3Aw%3A1600x1200%3As%3A1600x1200x24%3Ask%3A1%3Awv%3A2%3Ads%3A0%2C0%2C49%2C18%2C1%2C0%2C%2C414%2C0%2C%2C%2C%2C668%3Aco%3A0%3Acpf%3A1%3Ans%3A1697653809974%3Aadb%3A2%3Arqnl%3A1%3Ast%3A1697653811%3At%3AMolted%20skin%3A%20APT%20SideWinder%202021%20campaign%20that%20targeted%20over%2060%20companies%20in%20the%20Asia-Pacific%20%7C%20Group-IB&t=gdpr%2814%29clc%280-0-0%29rqnt%281%29aw%281%29ti%282%29 Requested by Host: www.group-ib.com URL: https://www.group-ib.com/media-center/press-releases/sidewinder-apt-report/ Protocol H2 Server 2a02:6b8::1:119 Ulyanovsk, Russian Federation, ASN208722 (GLOBAL_DC, FI), Reverse DNS Software / Resource Hash d9f38d4ddd42d21dce4b098a759a36fe6a41eb693a93ea280953628257642182 Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers pragma no-cache date Wed, 18 Oct 2023 18:30:11 GMT strict-transport-security max-age=31536000 x-content-type-options nosniff last-modified Wed, 18-Oct-2023 18:30:11 GMT accept-ch Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA content-type application/json; charset=utf-8 access-control-allow-origin https://www.group-ib.com cache-control private, no-cache, no-store, must-revalidate, max-age=0 access-control-allow-credentials true content-length 427 x-xss-protection 1; mode=block expires Wed, 18-Oct-2023 18:30:11 GMT Redirect headers pragma no-cache date Wed, 18 Oct 2023 18:30:11 GMT strict-transport-security max-age=31536000 last-modified Wed, 18-Oct-2023 18:30:11 GMT accept-ch Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA location /watch/26812653/1?wmode=7&page-url=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fsidewinder-apt-report%2F&charset=utf-8&site-info=%7B%22shareVersion%22%3A2%2C%22strategy%22%3A%22d%2Fn%2Fq%2Fr%2Fs%2Ft%22%7D&uah=chm%0A%3F0&browser-info=pv%3A1%3Avf%3A3qm6qq812ez2u52y4wzrnbv%3Afp%3A498%3Afu%3A1%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A1135%3Acn%3A1%3Adp%3A0%3Als%3A810756797713%3Ahid%3A831156496%3Az%3A120%3Ai%3A20231018203010%3Aet%3A1697653811%3Ac%3A1%3Arn%3A507436145%3Arqn%3A1%3Au%3A1697653811210564030%3Aw%3A1600x1200%3As%3A1600x1200x24%3Ask%3A1%3Awv%3A2%3Ads%3A0%2C0%2C49%2C18%2C1%2C0%2C%2C414%2C0%2C%2C%2C%2C668%3Aco%3A0%3Acpf%3A1%3Ans%3A1697653809974%3Aadb%3A2%3Arqnl%3A1%3Ast%3A1697653811%3At%3AMolted%20skin%3A%20APT%20SideWinder%202021%20campaign%20that%20targeted%20over%2060%20companies%20in%20the%20Asia-Pacific%20%7C%20Group-IB&t=gdpr%2814%29clc%280-0-0%29rqnt%281%29aw%281%29ti%282%29 access-control-allow-origin https://www.group-ib.com cache-control private, no-cache, no-store, must-revalidate, max-age=0 access-control-allow-credentials true x-xss-protection 1; mode=block expires Wed, 18-Oct-2023 18:30:11 GMT
POST H2	200	fl Show response www.group-ib.com/api/	665 B 985 B	40ms 40ms	XHR application/json	3.72.181.255 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://www.group-ib.com/api/fl?u=078c8cd0-6dd4-11ee-991f-4be53f4f36ab&cfidsgib-w-61354c22-16cc-40a8-a871-6901f1a76e24=fw8kF3a81FtkqCuLnjnmvxupvWDjyjuMEMy0KgSoTSRQyTgO8S4cxYTNM0gVuMqjqd9fFzQZ51v2byMsjINHO7grxlBvzYkg6q9djpJeJL6sekktDlNxsE0cAEwG6P59Z5f7JMZ8YbnISiFw7ceiHXSg9XIB0RELyVCo Requested by Host: fhp-de-js.group-ib.com URL: https://fhp-de-js.group-ib.com/d/bt-autoinject.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 3.72.181.255 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-3-72-181-255.eu-central-1.compute.amazonaws.com Software nginx / Resource Hash 133440d0da07aeb034e7192ac1f5a576d4927fb36c2a0ae1a732ccbc13219e5b Request headers X-GIB-GSSCgib-w-61354c22-16cc-40a8-a871-6901f1a76e24 PJeSeZlD9/+TPUTkPpqACdjt3TOPIgbNX9+cB5gOfM5phFZHmDIdt9/nZ7tf8Oxpuyxvg7nPWEMqfRq4feQT2gZyPD0z+vZ0Ocry6BiVEf/yyAVjhfnYkqrZpMjTJkqkZeWoWE7d0dDBdfWFNQXLY5wQZpaVjDmHlqzdqJ5CYsZ3hh5rTRYeN9LLOQwdy59459xFNcO/v0W1nHqvtrvpNX7vHLz5hGjg7ZY83bHBVhebda7RHnp+xojLF/ZVOA== Referer https://www.group-ib.com/media-center/press-releases/sidewinder-apt-report/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 X-GIB-FGSSCgib-w-61354c22-16cc-40a8-a871-6901f1a76e24 0G2u3c3196874a122746221791cd48616405e7a7 Content-Type text/plain;charset=UTF-8 Response headers date Wed, 18 Oct 2023 18:30:11 GMT content-encoding gzip server nginx vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS content-type application/json; charset=utf-8 access-control-allow-origin https://www.group-ib.com cache-control no-store access-control-allow-credentials true x-envoy-upstream-service-time 3 access-control-allow-headers Accept,DNT,Keep-Alive,User-Agent,If-Modified-Since,Cache-Control,Content-Type,Origin,ETag,If-None-Match,X-Cfids,Authorization
POST H2	200	1 Show response mc.yandex.com/watch/26812653/	43 B 86 B	63ms 63ms	XHR image/gif	2a02:6b8::1:119 GLOBAL_DC
General Check archive.org Show headers Download Go to Full URL https://mc.yandex.com/watch/26812653/1?page-url=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fsidewinder-apt-report%2F&charset=utf-8&hittoken=1697653811_c7a7e8ffff9a1dcb904026d6e4897b6b31e84006861f2bef70d7bba40b67c11f&browser-info=pa%3A1%3Aar%3A1%3Avf%3A3qm6qq812ez2u52y4wzrnbv%3Afu%3A1%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A1135%3Acn%3A1%3Adp%3A1%3Als%3A810756797713%3Ahid%3A831156496%3Az%3A120%3Ai%3A20231018203011%3Aet%3A1697653811%3Ac%3A1%3Arn%3A394343540%3Arqn%3A2%3Au%3A1697653811210564030%3Aw%3A1600x1200%3As%3A1600x1200x24%3Ask%3A1%3Awv%3A2%3Aco%3A0%3Acpf%3A1%3Ans%3A1697653809974%3Aadb%3A2%3Arqnl%3A1%3Ast%3A1697653811&t=gdpr(14)mc(p-1)clc(0-0-0)rqnt(2)lt(11900)aw(1)ti(2) Requested by Host: fhp-de-js.group-ib.com URL: https://fhp-de-js.group-ib.com/d/bt-autoinject.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:6b8::1:119 Ulyanovsk, Russian Federation, ASN208722 (GLOBAL_DC, FI), Reverse DNS Software / Resource Hash 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87 Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Xss-Protection 1; mode=block Request headers Referer https://www.group-ib.com/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Content-Type application/x-www-form-urlencoded Response headers pragma no-cache date Wed, 18 Oct 2023 18:30:11 GMT strict-transport-security max-age=31536000 last-modified Wed, 18-Oct-2023 18:30:11 GMT accept-ch Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA content-type image/gif access-control-allow-origin https://www.group-ib.com cache-control private, no-cache, no-store, must-revalidate, max-age=0 access-control-allow-credentials true content-length 43 x-xss-protection 1; mode=block expires Wed, 18-Oct-2023 18:30:11 GMT
GET H2	200	img.gif b.6sc.co/v1/beacon/	43 B 484 B	211ms 211ms	Image image/gif	2.17.100.184 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=e84d9c08a990af8592952e7ac9a983ad&svisitor=null&visitor=b0ec56dd-7979-448a-8bcc-3d3c1239d033&session=1823748f-0aa5-4e1b-8735-fb6c2888a48f&event=active_time_track&q=%7B%22currentTime%22%3A%22Wed%2C%2018%20Oct%202023%2018%3A30%3A11%20GMT%22%2C%22lastTrackTime%22%3A%22Wed%2C%2018%20Oct%202023%2018%3A30%3A10%20GMT%22%2C%22timeSpent%22%3A%221004%22%2C%22totalTimeSpent%22%3A%221004%22%7D&isIframe=false&m=%7B%22description%22%3A%22Group-IB%20has%20documented%20previously%20unreported%20phishing%20operations%20carried%20out%20by%20the%20nation-state%20cyber%20threat%20actor%20SideWinder%20between%20June%20and%20November%202021.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Molted%20skin%3A%20APT%20SideWinder%202021%20campaign%20that%20targeted%20over%2060%20companies%20in%20the%20Asia-Pacific%20%7C%20Group-IB%22%7D&cb=&r=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fsidewinder-apt-report%2F&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fsidewinder-apt-report%2F&pageViewId=0242a1e3-25d5-4ade-8c10-917a2020184e&v=1.1.7 Requested by Host: www.group-ib.com URL: https://www.group-ib.com/media-center/press-releases/sidewinder-apt-report/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2.17.100.184 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS a2-17-100-184.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers date Wed, 18 Oct 2023 18:30:12 GMT x-content-type-options nosniff content-length 43 pragma no-cache last-modified Sat, 05 Jun 2021 07:56:05 GMT server nginx/1.14.0 (Ubuntu) etag "60bb2e15-2b" access-control-max-age 86400 access-control-allow-methods GET,POST content-type image/gif access-control-allow-origin cache-control private, no-cache, no-cache=Set-Cookie, proxy-revalidate access-control-allow-credentials true accept-ranges bytes access-control-allow-headers * expires Wed, 19 Apr 2000 11:43:00 GMT
GET H3	200	709834390277869 Show response connect.facebook.net/signals/config/	138 KB 36 KB	149ms 149ms	Script application/x-javascript	2a03:2880:f084:d:face:b00c:0:3 FACEBOOK
General Check archive.org Show headers Download Go to Full URL https://connect.facebook.net/signals/config/709834390277869?v=2.9.134&r=stable&domain=www.group-ib.com Requested by Host: connect.facebook.net URL: https://connect.facebook.net/en_US/fbevents.js Protocol H3 Security QUIC, , AES_128_GCM Server 2a03:2880:f084:d:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US), Reverse DNS Software / Resource Hash 76631339cbb636125ff94e2d21652dbf0f83343cb2afa962f14840f80525de9a Security Headers Name Value Content-Security-Policy default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script'; Strict-Transport-Security max-age=31536000; preload; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers content-security-policy default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script'; content-encoding gzip x-content-type-options nosniff strict-transport-security max-age=31536000; preload; includeSubDomains date Wed, 18 Oct 2023 18:30:12 GMT document-policy force-load-at-top cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400 x-xss-protection 0 pragma public x-fb-debug DZPlhmMagh32x6p8O5iA7XX0LCSPZ1g0zFSZ/IFR62ouaYCwi5TJog9Ks1rZ/kNmbOQMaDyf2Ik/YUjvUXFzwg== cross-origin-opener-policy same-origin-allow-popups vary Accept-Encoding x-frame-options DENY content-type application/x-javascript; charset=utf-8 origin-agent-cluster ?0 cache-control public, max-age=1200 permissions-policy accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(), gyroscope=(), hid=(), idle-detection=(), magnetometer=(), microphone=(), midi=(), payment=(), screen-wake-lock=(), serial=(), usb=() timing-allow-origin * priority u=3,i expires Sat, 01 Jan 2000 00:00:00 GMT
GET H2	200	__ptq.gif track-eu1.hubspot.com/	45 B 1 KB	88ms 62ms	Image image/gif	172.65.240.166 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://track-eu1.hubspot.com/__ptq.gif?k=1&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=en-us&bfp=3857904254&v=1.1&a=25755956&rcu=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fsidewinder-apt-report%2F&r=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fsidewinder-apt-report%2F&pu=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fsidewinder-apt-report%2F&t=Molted+skin%3A+APT+SideWinder+2021+campaign+that+targeted+over+60+companies+in+the+Asia-Pacific+%7C+Group-IB&cts=1697653812089&vi=df25866c9f52c9de43d4eb94807db7b4&nc=true&u=84897990.df25866c9f52c9de43d4eb94807db7b4.1697653812084.1697653812084.1697653812084.1&b=84897990.1.1697653812084&cc=15 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.65.240.166 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers date Wed, 18 Oct 2023 18:30:12 GMT strict-transport-security max-age=31536000; includeSubDomains; preload x-content-type-options nosniff cf-cache-status MISS nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} x-evy-trace-route-service-name envoyset-translator x-hubspot-correlation-id ccbaa3db-b307-4f4c-b3cb-04cb5e5533ea p3p CP="NOI CUR ADM OUR NOR STA NID" x-envoy-upstream-service-time 6 content-length 45 x-evy-trace-route-configuration listener_https/all x-evy-trace-listener listener_https x-request-id ccbaa3db-b307-4f4c-b3cb-04cb5e5533ea last-modified Wed, 18 Oct 2023 18:30:12 GMT server cloudflare vary origin, Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=m%2B6IHCqXNkhhsrDKkEKEzsCiLbmpqzEOkoaWkfDmeZVziGmJXrzPpQGg7PioLaJRGBcmgNQ9OXvDD5G%2Bq4OIf3%2F44G%2B%2FaWgBR8fQN9tPnYcsRw2KenLcxHLIruHviHh2GFens5F6IQ%3D%3D"}],"group":"cf-nel","max_age":604800} content-type image/gif x-evy-trace-served-by-pod fra04/analytics-tracking-td/envoy-proxy-74554d9fd-xz7cd x-evy-trace-virtual-host all cache-control no-cache, no-store, no-transform access-control-allow-credentials false accept-ranges bytes cf-ray 8182d9e5c9523636-FRA x-robots-tag none
GET H2	200	__ptq.gif track-eu1.hubspot.com/	45 B 1 KB	57ms 56ms	Image image/gif	172.65.240.166 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://track-eu1.hubspot.com/__ptq.gif?k=15&fi=044e7558-8073-478a-ad3c-5807dd76840f&fci=ec477d9c-5f0a-4c95-8743-d2eb894f58e6&ft=0&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=en-us&bfp=3857904254&v=1.1&a=25755956&rcu=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fsidewinder-apt-report%2F&r=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fsidewinder-apt-report%2F&pu=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fsidewinder-apt-report%2F&t=Molted+skin%3A+APT+SideWinder+2021+campaign+that+targeted+over+60+companies+in+the+Asia-Pacific+%7C+Group-IB&cts=1697653812090&vi=df25866c9f52c9de43d4eb94807db7b4&nc=true&u=84897990.df25866c9f52c9de43d4eb94807db7b4.1697653812084.1697653812084.1697653812084.1&b=84897990.1.1697653812084&cc=15 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.65.240.166 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers date Wed, 18 Oct 2023 18:30:12 GMT strict-transport-security max-age=31536000; includeSubDomains; preload x-content-type-options nosniff cf-cache-status MISS nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} x-evy-trace-route-service-name envoyset-translator x-hubspot-correlation-id b45c686e-b791-42cd-bece-023af0986e9a p3p CP="NOI CUR ADM OUR NOR STA NID" x-envoy-upstream-service-time 2 content-length 45 x-evy-trace-route-configuration listener_https/all x-evy-trace-listener listener_https x-request-id b45c686e-b791-42cd-bece-023af0986e9a last-modified Wed, 18 Oct 2023 18:30:12 GMT server cloudflare vary origin, Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=hhM3I6nkcT10iz87NS1FMlFxkDfaixImiCaiBzsViNYj8iivSGXaBi38ZQGJgY7QwBZREYsvDNzRkOJZ0VPqthEJ3%2BmpX4QZsON0GlJhOZVf8dBjiexP5ba6dYVVVvfSxo2%2B3qCbYA%3D%3D"}],"group":"cf-nel","max_age":604800} content-type image/gif x-evy-trace-served-by-pod fra04/analytics-tracking-td/envoy-proxy-74554d9fd-7vcxx x-evy-trace-virtual-host all cache-control no-cache, no-store, no-transform access-control-allow-credentials false accept-ranges bytes cf-ray 8182d9e5e9853636-FRA x-robots-tag none
GET H2	200	__ptq.gif track-eu1.hubspot.com/	45 B 637 B	67ms 66ms	Image image/gif	172.65.240.166 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://track-eu1.hubspot.com/__ptq.gif?k=15&fi=5a995f05-701c-48e3-b25a-d1548ba3c0b3&fci=10c44a01-58b3-48cf-8696-b8db7867081a&ft=0&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=en-us&bfp=3857904254&v=1.1&a=25755956&rcu=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fsidewinder-apt-report%2F&r=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fsidewinder-apt-report%2F&pu=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fsidewinder-apt-report%2F&t=Molted+skin%3A+APT+SideWinder+2021+campaign+that+targeted+over+60+companies+in+the+Asia-Pacific+%7C+Group-IB&cts=1697653812092&vi=df25866c9f52c9de43d4eb94807db7b4&nc=true&u=84897990.df25866c9f52c9de43d4eb94807db7b4.1697653812084.1697653812084.1697653812084.1&b=84897990.1.1697653812084&cc=15 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.65.240.166 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers date Wed, 18 Oct 2023 18:30:12 GMT strict-transport-security max-age=31536000; includeSubDomains; preload x-content-type-options nosniff cf-cache-status MISS nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} x-evy-trace-route-service-name envoyset-translator x-hubspot-correlation-id afba2e95-f7a7-4597-a4c1-1af30f86e58d p3p CP="NOI CUR ADM OUR NOR STA NID" x-envoy-upstream-service-time 2 content-length 45 x-evy-trace-route-configuration listener_https/all x-evy-trace-listener listener_https x-request-id afba2e95-f7a7-4597-a4c1-1af30f86e58d last-modified Wed, 18 Oct 2023 18:30:12 GMT server cloudflare vary origin, Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=f%2Fv37hHWiIUYla04wH7AkJk3W70VPoVAXNHdsSLhwdsn2tCqfiSF0rPHLFlOKSYTt7u%2F94MAExNXNsmXOVY7H%2FjLwqd9%2BU5LyygYMXNy2E5b%2BzTyEQhwCbYnBFXboq9Ee1mRJGv%2F9w%3D%3D"}],"group":"cf-nel","max_age":604800} content-type image/gif x-evy-trace-served-by-pod fra04/analytics-tracking-td/envoy-proxy-74554d9fd-lr4nj x-evy-trace-virtual-host all cache-control no-cache, no-store, no-transform access-control-allow-credentials false accept-ranges bytes cf-ray 8182d9e5e9883636-FRA x-robots-tag none
GET H2	200	__ptq.gif track-eu1.hubspot.com/	45 B 635 B	68ms 67ms	Image image/gif	172.65.240.166 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://track-eu1.hubspot.com/__ptq.gif?k=15&fi=4dbceae1-75ae-423a-9c12-dee8f1ca3345&fci=ef4eb9f3-96fc-4fca-93e3-37a1c45a557f&ft=0&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=en-us&bfp=3857904254&v=1.1&a=25755956&rcu=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fsidewinder-apt-report%2F&r=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fsidewinder-apt-report%2F&pu=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fsidewinder-apt-report%2F&t=Molted+skin%3A+APT+SideWinder+2021+campaign+that+targeted+over+60+companies+in+the+Asia-Pacific+%7C+Group-IB&cts=1697653812093&vi=df25866c9f52c9de43d4eb94807db7b4&nc=true&u=84897990.df25866c9f52c9de43d4eb94807db7b4.1697653812084.1697653812084.1697653812084.1&b=84897990.1.1697653812084&cc=15 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.65.240.166 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers date Wed, 18 Oct 2023 18:30:12 GMT strict-transport-security max-age=31536000; includeSubDomains; preload x-content-type-options nosniff cf-cache-status MISS nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} x-evy-trace-route-service-name envoyset-translator x-hubspot-correlation-id 6587cbbc-4f15-450d-969d-eb43f5f8a294 p3p CP="NOI CUR ADM OUR NOR STA NID" x-envoy-upstream-service-time 2 content-length 45 x-evy-trace-route-configuration listener_https/all x-evy-trace-listener listener_https x-request-id 6587cbbc-4f15-450d-969d-eb43f5f8a294 last-modified Wed, 18 Oct 2023 18:30:12 GMT server cloudflare vary origin, Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ul8KOaKFxI%2FmewZLjN%2Fcg2SovL1hfL9IYuOOygDmBkGco8hP%2FhcajW3lgGrPxMYaS01J1wdFlKifjFyWCU07%2Bu6PwN4j2ZvQRNrEAwbJhagqQP1odiso5mVVYeQxSCQvuammNoJ%2BjQ%3D%3D"}],"group":"cf-nel","max_age":604800} content-type image/gif x-evy-trace-served-by-pod fra04/analytics-tracking-td/envoy-proxy-74554d9fd-nzf8k x-evy-trace-virtual-host all cache-control no-cache, no-store, no-transform access-control-allow-credentials false accept-ranges bytes cf-ray 8182d9e5e98b3636-FRA x-robots-tag none
GET H2	200	__ptq.gif track-eu1.hubspot.com/	45 B 636 B	70ms 68ms	Image image/gif	172.65.240.166 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://track-eu1.hubspot.com/__ptq.gif?k=15&fi=55a22738-d5a5-43f9-9c1c-fa4c1a6eb349&fci=b9968545-90b7-41cd-8f0a-fccac9cdb21d&ft=0&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=en-us&bfp=3857904254&v=1.1&a=25755956&rcu=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fsidewinder-apt-report%2F&r=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fsidewinder-apt-report%2F&pu=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fsidewinder-apt-report%2F&t=Molted+skin%3A+APT+SideWinder+2021+campaign+that+targeted+over+60+companies+in+the+Asia-Pacific+%7C+Group-IB&cts=1697653812094&vi=df25866c9f52c9de43d4eb94807db7b4&nc=true&u=84897990.df25866c9f52c9de43d4eb94807db7b4.1697653812084.1697653812084.1697653812084.1&b=84897990.1.1697653812084&cc=15 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.65.240.166 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers date Wed, 18 Oct 2023 18:30:12 GMT strict-transport-security max-age=31536000; includeSubDomains; preload x-content-type-options nosniff cf-cache-status MISS nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} x-evy-trace-route-service-name envoyset-translator x-hubspot-correlation-id e43d1ed5-2217-47c8-b1ce-fb313b8ff970 p3p CP="NOI CUR ADM OUR NOR STA NID" x-envoy-upstream-service-time 6 content-length 45 x-evy-trace-route-configuration listener_https/all x-evy-trace-listener listener_https x-request-id e43d1ed5-2217-47c8-b1ce-fb313b8ff970 last-modified Wed, 18 Oct 2023 18:30:12 GMT server cloudflare vary origin, Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=bRBLkcKB96X%2F4uieBxeu5d2H3bfv1blMklwgDZyx0Czhok2ZnKHSfgNOf0%2Bw%2FxkWEN3godtpgJuZ7ZQDt0a2PIF3JX7tR9K5%2B3cb5%2FDI94FCX2HOYZ6BkPNTFfzeAbWZ2GOhu%2BWPkA%3D%3D"}],"group":"cf-nel","max_age":604800} content-type image/gif x-evy-trace-served-by-pod fra04/analytics-tracking-td/envoy-proxy-74554d9fd-7vcxx x-evy-trace-virtual-host all cache-control no-cache, no-store, no-transform access-control-allow-credentials false accept-ranges bytes cf-ray 8182d9e5e98c3636-FRA x-robots-tag none
GET H2	200	__ptq.gif track-eu1.hubspot.com/	45 B 1 KB	69ms 67ms	Image image/gif	172.65.240.166 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://track-eu1.hubspot.com/__ptq.gif?k=15&fi=eb903dab-0ef3-43b5-bdeb-71372e6ad0f0&fci=ac928ae5-6b64-4059-b658-c75d2801c003&ft=0&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=en-us&bfp=3857904254&v=1.1&a=25755956&rcu=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fsidewinder-apt-report%2F&r=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fsidewinder-apt-report%2F&pu=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fsidewinder-apt-report%2F&t=Molted+skin%3A+APT+SideWinder+2021+campaign+that+targeted+over+60+companies+in+the+Asia-Pacific+%7C+Group-IB&cts=1697653812095&vi=df25866c9f52c9de43d4eb94807db7b4&nc=true&u=84897990.df25866c9f52c9de43d4eb94807db7b4.1697653812084.1697653812084.1697653812084.1&b=84897990.1.1697653812084&cc=15 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.65.240.166 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers date Wed, 18 Oct 2023 18:30:12 GMT strict-transport-security max-age=31536000; includeSubDomains; preload x-content-type-options nosniff cf-cache-status MISS nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} x-evy-trace-route-service-name envoyset-translator x-hubspot-correlation-id d6b597bf-b090-42ee-9402-c465f791cfa3 p3p CP="NOI CUR ADM OUR NOR STA NID" x-envoy-upstream-service-time 3 content-length 45 x-evy-trace-route-configuration listener_https/all x-evy-trace-listener listener_https x-request-id d6b597bf-b090-42ee-9402-c465f791cfa3 last-modified Wed, 18 Oct 2023 18:30:12 GMT server cloudflare vary origin, Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2Faah%2FHqtZNMEG0RxP7jWh8%2Bti9V1nrLwsO%2FJovTFlpylLOcYKprXcMrukX%2BUv5ZdSb0HgS%2Bk4ie1XlLzSN5%2BZKz7muosZ9%2Bzl76BdznwYBs0olIxoVPNGaZgRDR%2BNWdx%2By%2BwAvdJGQ%3D%3D"}],"group":"cf-nel","max_age":604800} content-type image/gif x-evy-trace-served-by-pod fra04/analytics-tracking-td/envoy-proxy-74554d9fd-f8bzw x-evy-trace-virtual-host all cache-control no-cache, no-store, no-transform access-control-allow-credentials false accept-ranges bytes cf-ray 8182d9e5e98f3636-FRA x-robots-tag none
GET H2	200	__ptq.gif track-eu1.hubspot.com/	45 B 634 B	78ms 77ms	Image image/gif	172.65.240.166 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://track-eu1.hubspot.com/__ptq.gif?k=17&fi=5a995f05-701c-48e3-b25a-d1548ba3c0b3&fci=10c44a01-58b3-48cf-8696-b8db7867081a&ft=0&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=en-us&bfp=3857904254&v=1.1&a=25755956&rcu=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fsidewinder-apt-report%2F&r=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fsidewinder-apt-report%2F&pu=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fsidewinder-apt-report%2F&t=Molted+skin%3A+APT+SideWinder+2021+campaign+that+targeted+over+60+companies+in+the+Asia-Pacific+%7C+Group-IB&cts=1697653812096&vi=df25866c9f52c9de43d4eb94807db7b4&nc=true&u=84897990.df25866c9f52c9de43d4eb94807db7b4.1697653812084.1697653812084.1697653812084.1&b=84897990.1.1697653812084&cc=15 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.65.240.166 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers date Wed, 18 Oct 2023 18:30:12 GMT strict-transport-security max-age=31536000; includeSubDomains; preload x-content-type-options nosniff cf-cache-status MISS nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} x-evy-trace-route-service-name envoyset-translator x-hubspot-correlation-id 2142e999-958a-4062-84a9-fbdff11ef1fd p3p CP="NOI CUR ADM OUR NOR STA NID" x-envoy-upstream-service-time 16 content-length 45 x-evy-trace-route-configuration listener_https/all x-evy-trace-listener listener_https x-request-id 2142e999-958a-4062-84a9-fbdff11ef1fd last-modified Wed, 18 Oct 2023 18:30:12 GMT server cloudflare vary origin, Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=kdpKUpXZRl5%2BrTAQm6L4jFWRiMmxOjckGXcUWkidgXYmdpRzyF7MMylx2uEXubFxoJ0FM%2FOyEqni0JCA8hUt9IUDM5gDeUjMDGh%2FBIt5Gsk70QWZF%2B36GDdtW27MPhWcwdMvtHxbfA%3D%3D"}],"group":"cf-nel","max_age":604800} content-type image/gif x-evy-trace-served-by-pod fra04/analytics-tracking-td/envoy-proxy-74554d9fd-f4fv2 x-evy-trace-virtual-host all cache-control no-cache, no-store, no-transform access-control-allow-credentials false accept-ranges bytes cf-ray 8182d9e5e9913636-FRA x-robots-tag none
GET H2	200	__ptq.gif track-eu1.hubspot.com/	45 B 634 B	51ms 50ms	Image image/gif	172.65.240.166 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://track-eu1.hubspot.com/__ptq.gif?k=17&fi=4dbceae1-75ae-423a-9c12-dee8f1ca3345&fci=ef4eb9f3-96fc-4fca-93e3-37a1c45a557f&ft=0&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=en-us&bfp=3857904254&v=1.1&a=25755956&rcu=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fsidewinder-apt-report%2F&r=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fsidewinder-apt-report%2F&pu=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fsidewinder-apt-report%2F&t=Molted+skin%3A+APT+SideWinder+2021+campaign+that+targeted+over+60+companies+in+the+Asia-Pacific+%7C+Group-IB&cts=1697653812097&vi=df25866c9f52c9de43d4eb94807db7b4&nc=true&u=84897990.df25866c9f52c9de43d4eb94807db7b4.1697653812084.1697653812084.1697653812084.1&b=84897990.1.1697653812084&cc=15 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.65.240.166 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers date Wed, 18 Oct 2023 18:30:12 GMT strict-transport-security max-age=31536000; includeSubDomains; preload x-content-type-options nosniff cf-cache-status MISS nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} x-evy-trace-route-service-name envoyset-translator x-hubspot-correlation-id d86b685c-7e15-418e-b2e3-22ceedd6b233 p3p CP="NOI CUR ADM OUR NOR STA NID" x-envoy-upstream-service-time 3 content-length 45 x-evy-trace-route-configuration listener_https/all x-evy-trace-listener listener_https x-request-id d86b685c-7e15-418e-b2e3-22ceedd6b233 last-modified Wed, 18 Oct 2023 18:30:12 GMT server cloudflare vary origin, Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=gGDlfprDebe7am5%2Fv%2FBwf6WcW1lciuUj0ewBOnLPWGuw%2B%2Bz4Ijefuas8Llrr1NijfW1%2F1WU1oDIaZyZC4LAp9BSMmyBjYQ0FZMakwtUViR10jg6neCNbY7i9jurlK3qB1BRYpbNB1A%3D%3D"}],"group":"cf-nel","max_age":604800} content-type image/gif x-evy-trace-served-by-pod fra04/analytics-tracking-td/envoy-proxy-74554d9fd-5jnpb x-evy-trace-virtual-host all cache-control no-cache, no-store, no-transform access-control-allow-credentials false accept-ranges bytes cf-ray 8182d9e5e9923636-FRA x-robots-tag none
GET H2	200	__ptq.gif track-eu1.hubspot.com/	45 B 631 B	50ms 49ms	Image image/gif	172.65.240.166 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://track-eu1.hubspot.com/__ptq.gif?k=17&fi=044e7558-8073-478a-ad3c-5807dd76840f&fci=ec477d9c-5f0a-4c95-8743-d2eb894f58e6&ft=0&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=en-us&bfp=3857904254&v=1.1&a=25755956&rcu=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fsidewinder-apt-report%2F&r=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fsidewinder-apt-report%2F&pu=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fsidewinder-apt-report%2F&t=Molted+skin%3A+APT+SideWinder+2021+campaign+that+targeted+over+60+companies+in+the+Asia-Pacific+%7C+Group-IB&cts=1697653812098&vi=df25866c9f52c9de43d4eb94807db7b4&nc=true&u=84897990.df25866c9f52c9de43d4eb94807db7b4.1697653812084.1697653812084.1697653812084.1&b=84897990.1.1697653812084&cc=15 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.65.240.166 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers date Wed, 18 Oct 2023 18:30:12 GMT strict-transport-security max-age=31536000; includeSubDomains; preload x-content-type-options nosniff cf-cache-status MISS nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} x-evy-trace-route-service-name envoyset-translator x-hubspot-correlation-id 572382a4-5c3a-460a-860e-a1e920924f30 p3p CP="NOI CUR ADM OUR NOR STA NID" x-envoy-upstream-service-time 5 content-length 45 x-evy-trace-route-configuration listener_https/all x-evy-trace-listener listener_https x-request-id 572382a4-5c3a-460a-860e-a1e920924f30 last-modified Wed, 18 Oct 2023 18:30:12 GMT server cloudflare vary origin, Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=4TguvHe6oL8rArz0JnTL8v3IJY%2BFFEnUijwqfPNDaCUOhBrLfbAYAEtvDUC%2F62fUmNKgJS%2BL01OOysRDVP2efoFk0PRYXOR4xWmCt2TPosnNXJMqsfpV2Sa2hN1YhvfOIdHir1J2wg%3D%3D"}],"group":"cf-nel","max_age":604800} content-type image/gif x-evy-trace-served-by-pod fra04/analytics-tracking-td/envoy-proxy-74554d9fd-6dqn6 x-evy-trace-virtual-host all cache-control no-cache, no-store, no-transform access-control-allow-credentials false accept-ranges bytes cf-ray 8182d9e5e9943636-FRA x-robots-tag none
GET H2	200	facebook-64.svg website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/socials/	627 B 1 KB	33ms 33ms	Image image/svg+xml	2600:9000:238d:1a00:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/socials/facebook-64.svg Requested by Host: website.cdn.group-ib.com URL: https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-press-release.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:238d:1a00:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash f006e8bbfa4f0537780571436b5bed50ff10ff28759924c53b67732ec5af28ba Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-press-release.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; content-encoding gzip x-content-type-options nosniff strict-transport-security max-age=31536000; includeSubDomains via 1.1 b26a5eb677aed7368a2c7fd7f1d673dc.cloudfront.net (CloudFront) date Wed, 18 Oct 2023 18:30:12 GMT x-amz-cf-pop AMS1-P1 x-cache RefreshHit from cloudfront content-length 376 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Tue, 29 Nov 2022 07:39:21 GMT server nginx etag "273-5ee9716178eea-gzip" x-frame-options sameorigin vary Accept-Encoding content-type image/svg+xml access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id Gbs_-dVCr9yFYWO-5OnC6Mw-h9j707L_Hm_i0esubgnvTjbOTWPqmA== expires Wed, 18 Oct 2023 19:00:12 GMT
GET H2	200	facebook-blue.svg website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/socials/	627 B 1 KB	32ms 31ms	Image image/svg+xml	2600:9000:238d:1a00:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/socials/facebook-blue.svg Requested by Host: website.cdn.group-ib.com URL: https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-press-release.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:238d:1a00:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software cloudflare / Resource Hash 746b0aea019090232091568f0790cf4d479b06a4e1fd9987069881ad5d1590ca Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-press-release.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers strict-transport-security max-age=31536000; includeSubDomains content-security-policy frame-ancestors 'self'; x-content-type-options nosniff cf-cache-status BYPASS nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} date Wed, 18 Oct 2023 18:30:12 GMT content-encoding br x-amz-cf-pop AMS1-P1 via 1.1 b26a5eb677aed7368a2c7fd7f1d673dc.cloudfront.net (CloudFront) x-cache RefreshHit from cloudfront x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Tue, 29 Nov 2022 07:39:21 GMT server cloudflare etag W/"273-5ee9716178eea-gzip" x-frame-options sameorigin report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=v3r%2BJyq3HjsfZE6ezLJG%2BUs%2FPfczHJZqecmX16w9l%2BmJTrl2gnYJ7dtZpyKi9U9l8P1M6cRav4irA%2BxZU8U7Jd52Yp4GNU3xMdagzpSDvNRL4TvfEEg40R5ejDjdJA4AM%2Fk%3D"}],"group":"cf-nel","max_age":604800} content-type image/svg+xml access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() vary Accept-Encoding cf-ray 8144d1a23cfe9238-FRA x-amz-cf-id aHbKFjdGFvgYosZQeX7W5u8gsVCnCU_4V1huF2tQpc8mjRAJ6cFZlA== expires Wed, 18 Oct 2023 19:00:12 GMT
GET H2	200	/ www.facebook.com/tr/	0 54 B	10ms 9ms	Image text/plain	2a03:2880:f176:84:face:b00c:0:25de FACEBOOK
General Check archive.org Show headers Download Go to Show image Full URL https://www.facebook.com/tr/?id=709834390277869&ev=PageView&dl=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fsidewinder-apt-report%2F&rl=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fsidewinder-apt-report%2F&if=false&ts=1697653812268&sw=1600&sh=1200&ud[external_id]=df25866c9f52c9de43d4eb94807db7b4&v=2.9.134&r=stable&ec=0&o=30&fbp=fb.1.1697653811156.1438752596&cs_est=true&it=1697653810923&coo=false&rqm=GET Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a03:2880:f176:84:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US), Reverse DNS Software proxygen-bolt / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers strict-transport-security max-age=31536000; includeSubDomains date Wed, 18 Oct 2023 18:30:12 GMT server proxygen-bolt content-type text/plain access-control-allow-origin access-control-allow-credentials true cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400 content-length 0
POST H2	200	fl Show response www.group-ib.com/api/	665 B 779 B	17ms 16ms	XHR application/json	3.72.181.255 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://www.group-ib.com/api/fl?u=078c8cd0-6dd4-11ee-991f-4be53f4f36ab&cfidsgib-w-61354c22-16cc-40a8-a871-6901f1a76e24=c3IHb9ETcxYKG50fe2A6IK3JcDfxNIXEXnvcf%2BFQl8aKSBsJtHYm%2F%2FQRo3Zs36TXyhiPyjOq7BmnFbxhZN0SmEJg8E085wJgsolfPRR%2FOUN%2FBY8Sgrdr2FKb%2BNn5pkZ2wFQoqw0xvDzX5UDWxJmpd%2FU8KRq%2BDvYV6r2E Requested by Host: fhp-de-js.group-ib.com URL: https://fhp-de-js.group-ib.com/d/bt-autoinject.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 3.72.181.255 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-3-72-181-255.eu-central-1.compute.amazonaws.com Software nginx / Resource Hash 7576b5221586f92442852265926cdb25ed4978c2f92fd0d88838334705760ce0 Request headers X-GIB-GSSCgib-w-61354c22-16cc-40a8-a871-6901f1a76e24 VZHZwGxRCgKoFFrnmITrfkSkjWzoupq3K+LPcgDEJkOlY9CK5t5mLQ4r8Ue/eILXcdqnSOK+TO7h9Rmm6OV2QsLiCVM0if79E9NlrPzfem9s1sv7VsRUT6Xt2ZDocE8C/3EVRJ9OXThVe/lX0YW+d8q1e5ns9A9/6dsq/ygGpHI1QmlvznHwImh6EQsCDL2w/SXHc9PP+l6WUs5/ZFWoPpqOcH7KdLjb1PsqH3J5STTbaIYjchxqr0Y8asZ1sw== Referer https://www.group-ib.com/media-center/press-releases/sidewinder-apt-report/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 X-GIB-FGSSCgib-w-61354c22-16cc-40a8-a871-6901f1a76e24 SNrZ41613b03993ca428bc124d933601544132b2 Content-Type text/plain;charset=UTF-8 Response headers date Wed, 18 Oct 2023 18:30:12 GMT content-encoding gzip server nginx vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS content-type application/json; charset=utf-8 access-control-allow-origin https://www.group-ib.com cache-control no-store access-control-allow-credentials true x-envoy-upstream-service-time 1 access-control-allow-headers Accept,DNT,Keep-Alive,User-Agent,If-Modified-Since,Cache-Control,Content-Type,Origin,ETag,If-None-Match,X-Cfids,Authorization
GET H2	200	img.gif b.6sc.co/v1/beacon/	43 B 483 B	229ms 229ms	Image image/gif	2.17.100.184 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=e84d9c08a990af8592952e7ac9a983ad&svisitor=null&visitor=b0ec56dd-7979-448a-8bcc-3d3c1239d033&session=1823748f-0aa5-4e1b-8735-fb6c2888a48f&event=active_time_track&q=%7B%22currentTime%22%3A%22Wed%2C%2018%20Oct%202023%2018%3A30%3A12%20GMT%22%2C%22lastTrackTime%22%3A%22Wed%2C%2018%20Oct%202023%2018%3A30%3A11%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%222005%22%7D&isIframe=false&m=%7B%22description%22%3A%22Group-IB%20has%20documented%20previously%20unreported%20phishing%20operations%20carried%20out%20by%20the%20nation-state%20cyber%20threat%20actor%20SideWinder%20between%20June%20and%20November%202021.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Molted%20skin%3A%20APT%20SideWinder%202021%20campaign%20that%20targeted%20over%2060%20companies%20in%20the%20Asia-Pacific%20%7C%20Group-IB%22%7D&cb=&r=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fsidewinder-apt-report%2F&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fsidewinder-apt-report%2F&pageViewId=0242a1e3-25d5-4ade-8c10-917a2020184e&v=1.1.7 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2.17.100.184 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS a2-17-100-184.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers date Wed, 18 Oct 2023 18:30:13 GMT x-content-type-options nosniff content-length 43 pragma no-cache last-modified Fri, 21 Feb 2020 18:57:20 GMT server nginx/1.14.0 (Ubuntu) etag "5e502810-2b" access-control-max-age 86400 access-control-allow-methods GET,POST content-type image/gif access-control-allow-origin cache-control private, no-cache, no-cache=Set-Cookie, proxy-revalidate access-control-allow-credentials true accept-ranges bytes access-control-allow-headers * expires Wed, 19 Apr 2000 11:43:00 GMT
GET		img.gif b.6sc.co/v1/beacon/	0 0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain

b.6sc.co

URL

https://b.6sc.co/v1/beacon/img.gif?token=e84d9c08a990af8592952e7ac9a983ad&svisitor=null&visitor=b0ec56dd-7979-448a-8bcc-3d3c1239d033&session=1823748f-0aa5-4e1b-8735-fb6c2888a48f&event=active_time_track&q=%7B%22currentTime%22%3A%22Wed%2C%2018%20Oct%202023%2018%3A30%3A13%20GMT%22%2C%22lastTrackTime%22%3A%22Wed%2C%2018%20Oct%202023%2018%3A30%3A12%20GMT%22%2C%22timeSpent%22%3A%221009%22%2C%22totalTimeSpent%22%3A%223014%22%7D&isIframe=false&m=%7B%22description%22%3A%22Group-IB%20has%20documented%20previously%20unreported%20phishing%20operations%20carried%20out%20by%20the%20nation-state%20cyber%20threat%20actor%20SideWinder%20between%20June%20and%20November%202021.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Molted%20skin%3A%20APT%20SideWinder%202021%20campaign%20that%20targeted%20over%2060%20companies%20in%20the%20Asia-Pacific%20%7C%20Group-IB%22%7D&cb=&r=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fsidewinder-apt-report%2F&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fsidewinder-apt-report%2F&pageViewId=0242a1e3-25d5-4ade-8c10-917a2020184e&v=1.1.7