www.cybereason.com Open in urlscan Pro
45.60.107.106 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://www.cybereason.com/blog/i-am-goot-loader
Submission: On June 26 via api (June 26th 2024, 2:14:24 am UTC) from TR — Scanned from DE

Summary HTTP 120 Redirects Links 32 Behaviour Indicators

Summary

This website contacted 28 IPs in 4 countries across 23 domains to perform 120 HTTP transactions. The main IP is 45.60.107.106, located in United States and belongs to INCAPSULA, US. The main domain is www.cybereason.com.
TLS certificate: Issued by GeoTrust TLS RSA CA G1 on May 2nd 2024. Valid for: a year.

This is the only time www.cybereason.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
31	45.60.107.106 45.60.107.106	19551 (INCAPSULA) (INCAPSULA)
29	104.18.88.62 104.18.88.62	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	2a00:1450:400... 2a00:1450:4001:830::2008	15169 (GOOGLE) (GOOGLE)
10	2a02:26f0:350... 2a02:26f0:3500:16::215:1495	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	2a00:1450:400... 2a00:1450:4001:82a::200a	15169 (GOOGLE) (GOOGLE)
1	2606:2800:233... 2606:2800:233:66b5:799a:7cd3:f74d:7071	15133 (EDGECAST) (EDGECAST)
2	104.17.24.14 104.17.24.14	13335 (CLOUDFLAR...) (CLOUDFLARENET)
4	2a00:1450:400... 2a00:1450:4001:81d::200a	15169 (GOOGLE) (GOOGLE)
1	2606:4700::68... 2606:4700::6811:ae5b	13335 (CLOUDFLAR...) (CLOUDFLARENET)
7	2a00:1450:400... 2a00:1450:4001:829::2003	15169 (GOOGLE) (GOOGLE)
1	2a03:2880:f08... 2a03:2880:f084:105:face:b00c:0:3	32934 (FACEBOOK) (FACEBOOK)
1	2606:2800:234... 2606:2800:234:46c:e8b:1e2f:2bd:694	15133 (EDGECAST) (EDGECAST)
1	157.240.0.6 157.240.0.6	32934 (FACEBOOK) (FACEBOOK)
1	2606:2800:234... 2606:2800:234:59:254c:406:2366:268c	15133 (EDGECAST) (EDGECAST)
5	2606:4700::68... 2606:4700::6810:7674	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700::68... 2606:4700::6812:8b11	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	2606:4700:440... 2606:4700:4400::ac40:991b	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700::68... 2606:4700::6811:afc9	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	2a00:1450:400... 2a00:1450:4001:828::200e	15169 (GOOGLE) (GOOGLE)
9	2606:4700::68... 2606:4700::6813:b134	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a00:1450:400... 2a00:1450:400c:c06::9b	15169 (GOOGLE) (GOOGLE)
1	142.250.185.132 142.250.185.132	15169 (GOOGLE) (GOOGLE)
1	142.250.185.99 142.250.185.99	15169 (GOOGLE) (GOOGLE)
1	2606:4700:440... 2606:4700:4400::ac40:9b77	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	104.19.175.188 104.19.175.188	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700::68... 2606:4700::6810:89d1	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	2001:4860:480... 2001:4860:4802:32::36	15169 (GOOGLE) (GOOGLE)
120	28

31 45.60.107.106 (United States)

ASN19551 (INCAPSULA, US)

www.cybereason.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

29 104.18.88.62 (None, )

ASN13335 (CLOUDFLARENET, US)

cdn2.hubspot.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:830::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 2a02:26f0:3500:16::215:1495 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)

use.typekit.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
p.typekit.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:82a::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

ajax.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:2800:233:66b5:799a:7cd3:f74d:7071 (United States)

ASN15133 (EDGECAST, US)

platform.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 104.17.24.14 (None, )

ASN13335 (CLOUDFLARENET, US)

cdnjs.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:81d::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6811:ae5b (United States)

ASN13335 (CLOUDFLARENET, US)

static.hsappstatic.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 2a00:1450:4001:829::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a03:2880:f084:105:face:b00c:0:3 (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:2800:234:46c:e8b:1e2f:2bd:694 (United States)

ASN15133 (EDGECAST, US)

platform.twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 157.240.0.6 (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)
PTR: xx-fbcdn-shv-02-fra3.fbcdn.net

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:2800:234:59:254c:406:2366:268c (United States)

ASN15133 (EDGECAST, US)

platform.twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2606:4700::6810:7674 (United States)

ASN13335 (CLOUDFLARENET, US)

app.hubspot.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
js.hubspot.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
cta-service-cms2.hubspot.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
track.hubspot.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
forms.hubspot.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6812:8b11 (United States)

ASN13335 (CLOUDFLARENET, US)

js.hsleadflows.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700:4400::ac40:991b (United States)

ASN13335 (CLOUDFLARENET, US)

js.hs-banner.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6811:afc9 (United States)

ASN13335 (CLOUDFLARENET, US)

js.hs-analytics.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:828::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 2606:4700::6813:b134 (United States)

ASN13335 (CLOUDFLARENET, US)

cdn.cookielaw.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:400c:c06::9b (Brussels, Belgium)

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.185.132 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s50-in-f4.1e100.net

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.185.99 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s49-in-f3.1e100.net

www.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:4400::ac40:9b77 (United States)

ASN13335 (CLOUDFLARENET, US)

geolocation.onetrust.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.19.175.188 (None, )

ASN13335 (CLOUDFLARENET, US)

perf-na1.hsforms.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6810:89d1 (United States)

ASN13335 (CLOUDFLARENET, US)

js.hs-scripts.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2001:4860:4802:32::36 (United States)

ASN15169 (GOOGLE, US)

region1.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
31	cybereason.com www.cybereason.com	3 MB
29	hubspot.net cdn2.hubspot.net — Cisco Umbrella Rank: 9957	86 KB
10	typekit.net use.typekit.net — Cisco Umbrella Rank: 649 p.typekit.net — Cisco Umbrella Rank: 807	142 KB
9	cookielaw.org cdn.cookielaw.org — Cisco Umbrella Rank: 378	148 KB
7	gstatic.com fonts.gstatic.com	201 KB
5	hubspot.com app.hubspot.com — Cisco Umbrella Rank: 6027 js.hubspot.com — Cisco Umbrella Rank: 4457 cta-service-cms2.hubspot.com — Cisco Umbrella Rank: 4515 track.hubspot.com — Cisco Umbrella Rank: 2823 forms.hubspot.com — Cisco Umbrella Rank: 6172	28 KB
5	googleapis.com ajax.googleapis.com — Cisco Umbrella Rank: 469 fonts.googleapis.com — Cisco Umbrella Rank: 83	37 KB
4	google-analytics.com www.google-analytics.com — Cisco Umbrella Rank: 71 region1.google-analytics.com — Cisco Umbrella Rank: 2355	21 KB
2	hs-banner.com js.hs-banner.com — Cisco Umbrella Rank: 2607	26 KB
2	twitter.com platform.twitter.com — Cisco Umbrella Rank: 1433	28 KB
2	facebook.net connect.facebook.net — Cisco Umbrella Rank: 204	89 KB
2	cloudflare.com cdnjs.cloudflare.com — Cisco Umbrella Rank: 268	11 KB
2	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 81	232 KB
1	hs-scripts.com js.hs-scripts.com — Cisco Umbrella Rank: 2984	1 KB
1	hsforms.com perf-na1.hsforms.com — Cisco Umbrella Rank: 4790	928 B
1	onetrust.com geolocation.onetrust.com — Cisco Umbrella Rank: 653	304 B
1	google.de www.google.de — Cisco Umbrella Rank: 8088	63 B
1	google.com www.google.com — Cisco Umbrella Rank: 5	63 B
1	doubleclick.net stats.g.doubleclick.net — Cisco Umbrella Rank: 136	351 B
1	hs-analytics.net js.hs-analytics.net — Cisco Umbrella Rank: 2634	25 KB
1	hsleadflows.net js.hsleadflows.net — Cisco Umbrella Rank: 5910	92 KB
1	hsappstatic.net static.hsappstatic.net — Cisco Umbrella Rank: 6258	5 KB
1	linkedin.com platform.linkedin.com — Cisco Umbrella Rank: 3746	160 KB
120	23

	Domain	Requested by
31	www.cybereason.com	www.cybereason.com cdn2.hubspot.net
29	cdn2.hubspot.net	www.cybereason.com
9	cdn.cookielaw.org	www.googletagmanager.com cdn.cookielaw.org
9	use.typekit.net	www.cybereason.com
7	fonts.gstatic.com	fonts.googleapis.com
4	fonts.googleapis.com	www.cybereason.com cdn2.hubspot.net
2	region1.google-analytics.com	www.googletagmanager.com
2	www.google-analytics.com	www.cybereason.com www.google-analytics.com
2	js.hs-banner.com	www.cybereason.com js.hs-banner.com
2	platform.twitter.com	www.cybereason.com platform.twitter.com
2	connect.facebook.net	www.cybereason.com connect.facebook.net
2	cdnjs.cloudflare.com	www.cybereason.com cdn2.hubspot.net
2	www.googletagmanager.com	www.cybereason.com
1	js.hs-scripts.com	www.googletagmanager.com
1	perf-na1.hsforms.com
1	geolocation.onetrust.com	cdn.cookielaw.org
1	www.google.de
1	www.google.com
1	forms.hubspot.com	js.hsleadflows.net
1	track.hubspot.com
1	stats.g.doubleclick.net	www.google-analytics.com
1	cta-service-cms2.hubspot.com	js.hubspot.com
1	js.hubspot.com	www.cybereason.com
1	js.hs-analytics.net	www.cybereason.com
1	js.hsleadflows.net	www.cybereason.com
1	p.typekit.net	www.cybereason.com
1	app.hubspot.com	www.cybereason.com
1	static.hsappstatic.net	www.cybereason.com
1	platform.linkedin.com	www.cybereason.com
1	ajax.googleapis.com	www.cybereason.com
120	30

This site contains links to these domains. Also see Links.

Domain
www.bleepingcomputer.com
cyware.com
www.mandiant.com
www.crowdstrike.com
bloodhound.readthedocs.io
securityintelligence.com
attack.mitre.org
learn.microsoft.com
www.trendmicro.com
www.malwarebytes.com
github.com
docs.sheetjs.com
philogb.github.io
jquery.com
underscorejs.org
d3js.org
twitter.com
www.facebook.com
www.linkedin.com
www.youtube.com
www.instagram.com
cookiepedia.co.uk
www.onetrust.com

Subject Issuer	Validity	Valid
*.cybereason.com GeoTrust TLS RSA CA G1	`2024-05-02` - `2025-05-17`	a year	crt.sh
hubspot.net Cloudflare Inc ECC CA-3	`2024-03-06` - `2024-12-31`	10 months	crt.sh
*.google-analytics.com WR2	`2024-06-03` - `2024-08-26`	3 months	crt.sh
use.typekit.net DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2024-02-01` - `2025-03-03`	a year	crt.sh
upload.video.google.com WR2	`2024-06-03` - `2024-08-26`	3 months	crt.sh
platform.linkedin.com DigiCert SHA2 Secure Server CA	`2024-06-13` - `2025-06-13`	a year	crt.sh
cdnjs.cloudflare.com E1	`2024-06-02` - `2024-08-31`	3 months	crt.sh
hsappstatic.net E1	`2024-05-08` - `2024-08-06`	3 months	crt.sh
*.gstatic.com WR2	`2024-06-03` - `2024-08-26`	3 months	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2024-04-03` - `2024-07-02`	3 months	crt.sh
*.twimg.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-07-28` - `2024-07-26`	a year	crt.sh
hubspot.com E1	`2024-05-23` - `2024-08-21`	3 months	crt.sh
hsleadflows.net E1	`2024-06-02` - `2024-08-31`	3 months	crt.sh
hs-banner.com E1	`2024-05-30` - `2024-08-28`	3 months	crt.sh
hs-analytics.net WE1	`2024-06-11` - `2024-09-09`	3 months	crt.sh
cookielaw.org Cloudflare Inc ECC CA-3	`2024-03-01` - `2024-12-31`	10 months	crt.sh
*.g.doubleclick.net WR2	`2024-06-03` - `2024-08-26`	3 months	crt.sh
*.google.com WR2	`2024-06-03` - `2024-08-26`	3 months	crt.sh
*.google.de WR2	`2024-06-03` - `2024-08-26`	3 months	crt.sh
onetrust.com Cloudflare Inc ECC CA-3	`2023-11-13` - `2024-11-12`	a year	crt.sh
hsforms.com WE1	`2024-06-14` - `2024-09-12`	3 months	crt.sh
hs-scripts.com E1	`2024-05-31` - `2024-08-29`	3 months	crt.sh

This page contains 2 frames:

Primary Page: https://www.cybereason.com/blog/i-am-goot-loader
Frame ID: D2BCBA6A61CA5C2AA4C595AE860BB979
Requests: 120 HTTP requests in this frame

Frame: https://platform.twitter.com/widgets/widget_iframe.2f70fb173b9000da126c79afe2098f02.html?origin=https%3A%2F%2Fwww.cybereason.com
Frame ID: 02EE401C5EEBBE2D8EEB52064A58F75E
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

I am Goot (Loader)

Detected technologies

AMP (JavaScript frameworks) Expand

Overall confidence: 100%
Detected patterns

<link rel="amphtml"

Facebook (Widgets) Expand

Overall confidence: 100%
Detected patterns

//connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js

Font Awesome (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

google-analytics\.com/(?:ga|urchin|analytics)\.js

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtm\.js
googletagmanager\.com/gtag/js

HubSpot Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

js\.hs-analytics\.net/analytics

Imperva (Security) Expand

Overall confidence: 100%
Detected patterns

/_Incapsula_Resource

Linkedin (Widgets) Expand

Overall confidence: 100%
Detected patterns

//platform\.linkedin\.com/in\.js

OneTrust (Cookie compliance) Expand

Overall confidence: 100%
Detected patterns

cdn\.cookielaw\.org
otSDKStub\.js

Twitter (Widgets) Expand

Overall confidence: 100%
Detected patterns

//platform\.twitter\.com/widgets\.js

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

/([\d.]+)/jquery(?:\.min)?\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

120
Requests

100 %
HTTPS

74 %
IPv6

23
Domains

30
Subdomains

28
IPs

4
Countries

4401 kB
Transfer

7776 kB
Size

17
Cookies

32 Outgoing links

These are links going to different origins than the main page.

URL: https://www.bleepingcomputer.com/news/security/gootkit-malware-returns-to-life-alongside-revil-ransomware/
Title: 2020

Search URL Search Domain Scan URL

URL: https://cyware.com/news/what-is-the-difference-between-gootkit-bootkit-and-rootkit-e124308c
Title: GootKit

Search URL Search Domain Scan URL

URL: https://www.mandiant.com/resources/blog/tracking-evolution-gootloader-operations
Title: UNC2565

Search URL Search Domain Scan URL

URL: https://www.bleepingcomputer.com/news/security/gootkit-malware-returns-to-life-alongside-revil-ransomware/#google_vignette
Title: REvil ransomware

Search URL Search Domain Scan URL

URL: https://www.crowdstrike.com/cybersecurity-101/kerberoasting/
Title: Kerberoast

Search URL Search Domain Scan URL

URL: https://bloodhound.readthedocs.io/en/latest/index.html
Title: BloodHound

Search URL Search Domain Scan URL

URL: https://securityintelligence.com/x-force/gootbot-gootloaders-new-approach-to-post-exploitation/
Title: GootBot

Search URL Search Domain Scan URL

URL: https://attack.mitre.org/techniques/T1608/006/
Title: Search Engine Optimization (SEO) poisoning

Search URL Search Domain Scan URL

URL: https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/wscript
Title: wscript

Search URL Search Domain Scan URL

URL: https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/cscript
Title: cscript

Search URL Search Domain Scan URL

URL: https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-samr/47492d59-e095-4398-b03e-8a062b989123
Title: MS-SAMR SamrLookupDomainInSamServer

Search URL Search Domain Scan URL

URL: https://www.trendmicro.com/en_za/research/20/l/investigating-the-gootkit-loader.html
Title: REvil campaign

Search URL Search Domain Scan URL

URL: https://www.malwarebytes.com/blog/news/2020/11/german-users-targeted-with-gootkit-banker-or-revil-ransomware
Title: GootKit and REvi Ransomware together

Search URL Search Domain Scan URL

URL: https://github.com/danielemoraschi/maplace.js
Title: JavaScript library

Search URL Search Domain Scan URL

URL: https://docs.sheetjs.com/docs/getting-started/installation/extendscript
Title: ExtendedScript

Search URL Search Domain Scan URL

URL: https://philogb.github.io/jit/
Title: JavaScript Infovis ToolKit

Search URL Search Domain Scan URL

URL: https://github.com/nhn/tui.chart
Title: TOAST UI Chart

Search URL Search Domain Scan URL

URL: https://github.com/google/material-design-lite
Title: Material Design Lite

Search URL Search Domain Scan URL

URL: https://github.com/lodash/lodash
Title: JavaScript utility libraries

Search URL Search Domain Scan URL

URL: https://jquery.com/
Title: Popular JavaScript library

Search URL Search Domain Scan URL

URL: https://underscorejs.org/
Title: JavaScript libraries

Search URL Search Domain Scan URL

URL: https://d3js.org/
Title: JavaScript Library

Search URL Search Domain Scan URL

URL: https://twitter.com/intent/tweet?original_referer=https://www.cybereason.com/blog/i-am-goot-loader&utm_medium=social&utm_source=twitter&url=https://www.cybereason.com/blog/i-am-goot-loader&utm_medium=social&utm_source=twitter&source=tweetbutton&text=

Search URL Search Domain Scan URL

URL: http://www.facebook.com/share.php?u=https://www.cybereason.com/blog/i-am-goot-loader&utm_medium=social&utm_source=facebook

Search URL Search Domain Scan URL

URL: http://www.linkedin.com/shareArticle?mini=true&url=https://www.cybereason.com/blog/i-am-goot-loader&utm_medium=social&utm_source=linkedin

Search URL Search Domain Scan URL

URL: https://www.facebook.com/Cybereason/

Search URL Search Domain Scan URL

URL: https://twitter.com/cybereason

Search URL Search Domain Scan URL

URL: https://www.youtube.com/channel/UCOm7AaB0HiNH4Phe66sK0Ew

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/company/cybereason

Search URL Search Domain Scan URL

URL: https://www.instagram.com/cybereason

Search URL Search Domain Scan URL

URL: https://cookiepedia.co.uk/giving-consent-to-cookies
Title: More information

Search URL Search Domain Scan URL

URL: https://www.onetrust.com/products/cookie-consent/

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

120 HTTP transactions
1 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request i-am-goot-loader Show response
www.cybereason.com/blog/ 113 KB
24 KB 383ms
162ms Document
text/html 45.60.107.106
INCAPSULA

General

Check archive.org

Show headers Download Go to

Full URL

https://www.cybereason.com/blog/i-am-goot-loader

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

45.60.107.106 , United States, ASN19551 (INCAPSULA, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5282c4c2ad4eae12ce8ec81c386393254df5da769c7d8fb8155351165fb2eab4

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	deny

Request headers

Accept-Language: de-DE,de;q=0.9;q=0.9
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Win32"

Response headers

alt-svc: h3=":443"; ma=86400
cache-control: s-maxage=10800, max-age=0
cf-ray: 8999aedd58e1aaf7-YYZ
content-encoding: gzip
content-security-policy: upgrade-insecure-requests
content-type: text/html; charset=UTF-8
date: Wed, 26 Jun 2024 02:14:18 GMT
edge-cache-tag: CT-153642400843,CT-168880427019,CT-59362482235,CG-3354902,CG-5272851739,P-3354902,L-42870461961,CW-34473990280,CW-41681847227,CW-41682410610,CW-42867014566,CW-43300360745,CW-44252461159,CW-86933076631,E-34470223313,E-34470224480,E-34470477360,E-35275979682,E-35291999472,E-42363645447,E-42507089303,E-42507091846,E-42760289143,PGS-ALL,SW-0,B-5272851739,GC-36042052587
etag: W/"2ee0c673f80d6f78d44150012bc614bd"
last-modified: Wed, 26 Jun 2024 00:03:50 GMT
link: </hs/hsstatic/cos-i18n/static-1.53/bundles/project.js>; rel=preload; as=script
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
referrer-policy: no-referrer-when-downgrade
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=4N9OqKymgW%2FWm2Bia%2BhjUfvdWRKrEsbDB%2Fe6esOZqM%2FVpwqEwSD7Lf%2FH0UHHNenWMPWO4xvRPqVRYGA9rlhQBg1ZsHPVdZPgOb5waQq9vGFnLh5E2kDq94vkq3DeKEZe4%2Fm33Q%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
strict-transport-security: max-age=31536000; includeSubDomains
vary: Accept-Encoding
x-cdn: Imperva
x-content-type-options: nosniff
x-frame-options: deny
x-hs-cache-config: BrowserCache-5s-EdgeCache-30s
x-hs-cache-control: s-maxage=10800, max-age=0
x-hs-cf-cache-status: HIT
x-hs-content-campaign-id: cc48f9df-345d-4e45-a2a3-9ab7fab8275a
x-hs-content-id: 168880427019
x-hs-hub-id: 3354902
x-hs-prerendered: Wed, 26 Jun 2024 00:03:50 GMT
x-iinfo: 0-3675347-3675351 NNNN CT(1 6 0) RT(1719368058113 104) q(0 0 0 13) r(0 0) U12

GET
H2 200 project.js Show response
www.cybereason.com/hs/hsstatic/cos-i18n/static-1.53/bundles/ 1 KB
758 B 105ms
103ms Script
application/javascript 45.60.107.106
INCAPSULA

General

Check archive.org

Show headers Download Go to

Full URL

https://www.cybereason.com/hs/hsstatic/cos-i18n/static-1.53/bundles/project.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

45.60.107.106 , United States, ASN19551 (INCAPSULA, US),

Reverse DNS

Software

Resource Hash

8da927b6b1240ffca4323fbb2a12c8e5abb541040965c2bc5b7d09a2eb963b02

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://www.cybereason.com/blog/i-am-goot-loader
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 26 Jun 2024 02:14:18 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
last-modified: Tue, 09 Nov 2021 16:12:42 GMT
x-cdn: Imperva
etag: W/"61ca66de658cab9587e4636894680d5d"
content-type: application/javascript
x-iinfo: 0-3675347-0 0CNN RT(1719368058113 277) q(0 -1 -1 -1) r(0 -1)
cache-control: max-age=25364029, public
content-length: 562
expires: Tue, 15 Apr 2025 15:48:07 GMT

GET
H3 200 module_41681847227_CR_-_Malicious_Life_Network_--_Tier_One_Header.min.css
cdn2.hubspot.net/hub/3354902/hub_generated/module_assets/41681847227/1644941386203/ 3 KB
2 KB 257ms
163ms Stylesheet
text/css 104.18.88.62
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn2.hubspot.net/hub/3354902/hub_generated/module_assets/41681847227/1644941386203/module_41681847227_CR_-_Malicious_Life_Network_--_Tier_One_Header.min.css
Requested by: Host: www.cybereason.com
URL: https://www.cybereason.com/blog/i-am-goot-loader
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.88.62 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9cec59b071d9d61e74c42ac4db8d2815aaace7e51983afe2481c14b97f332258

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://www.cybereason.com/blog/i-am-goot-loader
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

content-encoding: gzip
age: 1246741
x-evy-trace-route-service-name: envoyset-translator
x-amz-server-side-encryption: AES256
x-amz-replication-status: COMPLETED
x-hs-cf-lambda: us-east-1.EnforceAclForReads 3
x-evy-trace-listener: listener_https
etag: W/"38a0b2ad68cbd188720dcc11cc435ad6"
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: text/css
access-control-allow-origin: *
x-amz-meta-created-unix-time-millis: 1644941386203
cache-control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900
x-evy-trace-virtual-host: all
x-hs-cf-lambda-enforce: us-east-1.EnforceAclForReads 3
date: Wed, 26 Jun 2024 02:14:18 GMT
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-amz-cf-pop: IAD89-C1
x-hs-alternate-content-type: text/plain
x-hubspot-correlation-id: f2d419b0-d800-4021-b40a-223eeaf53a25
x-envoy-upstream-service-time: 150
alt-svc: h3=":443"; ma=86400
x-evy-trace-route-configuration: listener_https/all
x-request-id: f2d419b0-d800-4021-b40a-223eeaf53a25
last-modified: Tue, 15 Feb 2022 16:09:47 GMT
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=jnQPFz7AbfdA9uR4fhv%2F9PMFN3sYN57SqQmXNIrMqXaV2G1Fd%2FrF6sCKr9wMB9aV7uAVifbsUGfv329JFoQd0%2FjsjJBn0ETl4y07wX8um5mFCwv7UpSImv3DwEoHZH0SV38%3D"}],"group":"cf-nel","max_age":604800}
x-evy-trace-served-by-pod: iad02/cms-cdn2-td/envoy-proxy-c8b596779-fckn5
cf-ray: 8999aede998f90fb-FRA
timing-allow-origin: cdn2.hubspot.net

GET
H3 200 module_41682410610_CR_-_Malicious_Life_Network_--_Main_Hero.min.css
cdn2.hubspot.net/hub/3354902/hub_generated/module_assets/41682410610/1644941443237/ 6 KB
3 KB 257ms
164ms Stylesheet
text/css 104.18.88.62
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn2.hubspot.net/hub/3354902/hub_generated/module_assets/41682410610/1644941443237/module_41682410610_CR_-_Malicious_Life_Network_--_Main_Hero.min.css
Requested by: Host: www.cybereason.com
URL: https://www.cybereason.com/blog/i-am-goot-loader
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.88.62 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b6c9f9a48bd0a163671773a199c876dc64d66947d47ac509c95e29177046c9a3

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://www.cybereason.com/blog/i-am-goot-loader
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

content-encoding: gzip
age: 1233447
x-evy-trace-route-service-name: envoyset-translator
x-amz-server-side-encryption: AES256
x-amz-replication-status: COMPLETED
x-hs-cf-lambda: us-east-1.EnforceAclForReads 3
x-evy-trace-listener: listener_https
etag: W/"af924b62631098b8dc817f28551a6908"
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: text/css
access-control-allow-origin: *
x-amz-meta-created-unix-time-millis: 1644941443237
cache-control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900
x-evy-trace-virtual-host: all
x-hs-cf-lambda-enforce: us-east-1.EnforceAclForReads 3
date: Wed, 26 Jun 2024 02:14:18 GMT
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-amz-cf-pop: IAD89-C1
x-hs-alternate-content-type: text/plain
x-hubspot-correlation-id: 29c0f70a-a452-4627-aa23-563370736f83
x-envoy-upstream-service-time: 165
alt-svc: h3=":443"; ma=86400
x-evy-trace-route-configuration: listener_https/all
x-request-id: 29c0f70a-a452-4627-aa23-563370736f83
last-modified: Tue, 15 Feb 2022 16:10:44 GMT
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=g45QY2QZCRjdaYTqsOwjKzpJ3t1nGhYeZFVSWQsZ%2BnPxEDcWrwQIvKOZc08dlB7fLLjxoCEj1k1zaJD880n006sCBqCcAFGwC0bt5oL6r6wlZV7et%2BVCjdG8EEC%2FO1KtTtI%3D"}],"group":"cf-nel","max_age":604800}
x-evy-trace-served-by-pod: iad02/cms-cdn2-td/envoy-proxy-5896745bbb-7fw4c
cf-ray: 8999aede999090fb-FRA
timing-allow-origin: cdn2.hubspot.net

GET
H3 200 module_43300360745_CR_-_Malicious_Life_Network_--_Related_Posts.min.css
cdn2.hubspot.net/hub/3354902/hub_generated/module_assets/43300360745/1649424828375/ 1 KB
1 KB 240ms
146ms Stylesheet
text/css 104.18.88.62
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn2.hubspot.net/hub/3354902/hub_generated/module_assets/43300360745/1649424828375/module_43300360745_CR_-_Malicious_Life_Network_--_Related_Posts.min.css
Requested by: Host: www.cybereason.com
URL: https://www.cybereason.com/blog/i-am-goot-loader
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.88.62 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f533e083f3d896349ecf4b75a3b17a2e5155b309318af9dc44965ce50c66a1dd

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://www.cybereason.com/blog/i-am-goot-loader
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

content-encoding: gzip
age: 795437
x-evy-trace-route-service-name: envoyset-translator
x-amz-server-side-encryption: AES256
x-amz-replication-status: COMPLETED
x-hs-cf-lambda: us-east-1.EnforceAclForReads 3
x-evy-trace-listener: listener_https
etag: W/"65a7b4b8acda13ea823f6b3cd6887d8d"
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: text/css
access-control-allow-origin: *
x-amz-meta-created-unix-time-millis: 1649424828375
cache-control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900
x-evy-trace-virtual-host: all
x-hs-cf-lambda-enforce: us-east-1.EnforceAclForReads 3
date: Wed, 26 Jun 2024 02:14:18 GMT
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-amz-cf-pop: IAD55-P1
x-hs-alternate-content-type: text/plain
x-hubspot-correlation-id: d09b55b0-ca28-4fc6-b467-63fd9d4e0a71
x-envoy-upstream-service-time: 165
alt-svc: h3=":443"; ma=86400
x-evy-trace-route-configuration: listener_https/all
x-request-id: d09b55b0-ca28-4fc6-b467-63fd9d4e0a71
last-modified: Fri, 08 Apr 2022 13:33:49 GMT
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=OQi0YNHWdBdxeZSjXetDEPFp8tlW7jQPt2OB3HvdoS7jqv1MeXoALTU1ZsMNQXiExY0D6JBb1zUagkhlKF%2BROEKvPruvvHf1et8O04J92kYj3US%2B1%2FWJCYuwlsb3i008rjk%3D"}],"group":"cf-nel","max_age":604800}
x-evy-trace-served-by-pod: iad02/cms-cdn2-td/envoy-proxy-5745477c8b-fc8qf
cf-ray: 8999aede999190fb-FRA
timing-allow-origin: cdn2.hubspot.net

GET
H3 200 module_86933076631_CR_-_Sticky_CTA_Bar.css
cdn2.hubspot.net/hub/3354902/hub_generated/module_assets/1669911113479/ 2 KB
2 KB 241ms
148ms Stylesheet
text/css 104.18.88.62
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn2.hubspot.net/hub/3354902/hub_generated/module_assets/1669911113479/module_86933076631_CR_-_Sticky_CTA_Bar.css
Requested by: Host: www.cybereason.com
URL: https://www.cybereason.com/blog/i-am-goot-loader
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.88.62 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3a9e725bae41656623ccda8be25cbdd295ee1c73c8d3016023549a83c261a3ab

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://www.cybereason.com/blog/i-am-goot-loader
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

content-encoding: gzip
age: 1241825
x-evy-trace-route-service-name: envoyset-translator
x-amz-server-side-encryption: AES256
x-amz-replication-status: COMPLETED
x-hs-cf-lambda: us-east-1.EnforceAclForReads 3
x-evy-trace-listener: listener_https
etag: W/"c21ee1fe9f984d7f96a03cbd5dffeba0"
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: text/css
access-control-allow-origin: *
x-amz-meta-created-unix-time-millis: 1669911113479
cache-control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900
x-evy-trace-virtual-host: all
x-hs-cf-lambda-enforce: us-east-1.EnforceAclForReads 3
date: Wed, 26 Jun 2024 02:14:18 GMT
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-amz-cf-pop: IAD89-C1
x-hs-alternate-content-type: text/plain
x-hubspot-correlation-id: fefc5761-ceab-4d62-844b-17b1a7d99940
x-amz-storage-class: INTELLIGENT_TIERING
x-envoy-upstream-service-time: 197
alt-svc: h3=":443"; ma=86400
x-evy-trace-route-configuration: listener_https/all
x-request-id: fefc5761-ceab-4d62-844b-17b1a7d99940
last-modified: Thu, 01 Dec 2022 16:11:54 GMT
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=DA0M4XyiRSsxKhSk3POiH8kkBESLAq9tHQ6hmykmfTucMYQlxDaZO4Z%2Fqu7dJIH7deIau0ps0xK%2B6rgu85gc3XP87LJ6zvDRWIhg%2FiQNNLYrSRnyFnW4fY8P1J5sXO%2BH9kA%3D"}],"group":"cf-nel","max_age":604800}
x-evy-trace-served-by-pod: iad02/cms-cdn2-td/envoy-proxy-5896745bbb-5tx8p
cf-ray: 8999aede999290fb-FRA
timing-allow-origin: cdn2.hubspot.net

GET
H3 200 module_34473990280_CR_-_Footer_Full__en_US.min.css
cdn2.hubspot.net/hub/3354902/hub_generated/module_assets/34473990280/1704383554067/ 3 KB
2 KB 241ms
147ms Stylesheet
text/css 104.18.88.62
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn2.hubspot.net/hub/3354902/hub_generated/module_assets/34473990280/1704383554067/module_34473990280_CR_-_Footer_Full__en_US.min.css
Requested by: Host: www.cybereason.com
URL: https://www.cybereason.com/blog/i-am-goot-loader
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.88.62 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: abb03b2160dd9f75fa8eb557ca242d7cd93f159d53708c58f4d2887bd4f05ead

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://www.cybereason.com/blog/i-am-goot-loader
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

content-encoding: gzip
age: 1232732
x-evy-trace-route-service-name: envoyset-translator
x-amz-server-side-encryption: AES256
x-amz-replication-status: COMPLETED
x-hs-cf-lambda: us-east-1.EnforceAclForReads 3
x-evy-trace-listener: listener_https
etag: W/"2d832f69213af1582ea19a1326d20337"
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: text/css
access-control-allow-origin: *
x-amz-meta-created-unix-time-millis: 1704383554067
cache-control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900
x-evy-trace-virtual-host: all
x-hs-cf-lambda-enforce: us-east-1.EnforceAclForReads 3
date: Wed, 26 Jun 2024 02:14:18 GMT
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-amz-cf-pop: IAD89-C1
x-hs-alternate-content-type: text/plain
x-hubspot-correlation-id: 0010efde-c737-4bf8-9263-8756ea7420f1
x-amz-storage-class: INTELLIGENT_TIERING
x-envoy-upstream-service-time: 163
alt-svc: h3=":443"; ma=86400
x-evy-trace-route-configuration: listener_https/all
x-request-id: 0010efde-c737-4bf8-9263-8756ea7420f1
last-modified: Thu, 04 Jan 2024 15:52:35 GMT
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2FgT%2F52kl4rOaw%2BZAHOwDdb%2FAYRNeYipVAiNmbdwGxusE2ve0v%2B7YarnIcQrKp4tzdorCAiuwbmQ%2F0Vddg6xF12RUueK2iqcCfMD5pGitQsA8tQFD66seczIkznIGtO1pQuk%3D"}],"group":"cf-nel","max_age":604800}
x-evy-trace-served-by-pod: iad02/cms-cdn2-td/envoy-proxy-c8b596779-fckn5
cf-ray: 8999aede999390fb-FRA
timing-allow-origin: cdn2.hubspot.net

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 355 KB
111 KB 57ms
30ms Script
application/javascript 2a00:1450:4001:830::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-PZ3FE06790

Requested by

Host: www.cybereason.com
URL: https://www.cybereason.com/blog/i-am-goot-loader

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

8dcc3e8e69dda9701f64d4b6dc75044a79c4887b85629e7282683214a28ea605

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://www.cybereason.com/blog/i-am-goot-loader
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 26 Jun 2024 02:14:19 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 113114
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Wed, 26 Jun 2024 02:14:19 GMT

GET
H2 200 vyv2ljd.js Show response
use.typekit.net/ 19 KB
7 KB 725ms
664ms Script
text/javascript 2a02:26f0:3500:16::215:1495
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://use.typekit.net/vyv2ljd.js

Requested by

Host: www.cybereason.com
URL: https://www.cybereason.com/blog/i-am-goot-loader

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:3500:16::215:1495 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

nginx /

Resource Hash

458235328e4f7da4ccbe1e308d9f688e6cc5079212285f307cfa43e076c1dbee

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains;

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://www.cybereason.com/blog/i-am-goot-loader
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

strict-transport-security: max-age=31536000; includeSubDomains;
content-encoding: gzip
date: Wed, 26 Jun 2024 02:14:19 GMT
server: nginx
vary: Accept-Encoding
content-type: text/javascript;charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=600, stale-while-revalidate=604800
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 6894

GET
H2 200 jquery.min.js Show response
ajax.googleapis.com/ajax/libs/jquery/3.5.1/ 87 KB
31 KB 67ms
7ms Script
text/javascript 2a00:1450:4001:82a::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.googleapis.com/ajax/libs/jquery/3.5.1/jquery.min.js

Requested by

Host: www.cybereason.com
URL: https://www.cybereason.com/blog/i-am-goot-loader

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://www.cybereason.com/blog/i-am-goot-loader
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 25 Jun 2024 19:45:57 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 23301
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 31021
x-xss-protection: 0
last-modified: Fri, 08 May 2020 07:05:03 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="hosted-libraries-pushers"
vary: Accept-Encoding
report-to: {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 25 Jun 2025 19:45:57 GMT

GET
H2 200 ionicons.eot
www.cybereason.com/hubfs/__dam/fonts/ 118 KB
68 KB 103ms
103ms Font
application/vnd.ms-fontobject 45.60.107.106
INCAPSULA

General

Check archive.org

Show headers Download Go to

Full URL

https://www.cybereason.com/hubfs/__dam/fonts/ionicons.eot

Requested by

Host: www.cybereason.com
URL: https://www.cybereason.com/blog/i-am-goot-loader

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

45.60.107.106 , United States, ASN19551 (INCAPSULA, US),

Reverse DNS

Software

Resource Hash

a4803d7bdeb478a5b9238fe74d8aaa98dafe2e8e68fccbd0e3f4dced823f27f0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://www.cybereason.com/blog/i-am-goot-loader
Origin: https://www.cybereason.com
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 26 Jun 2024 02:14:18 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
last-modified: Fri, 25 Sep 2020 09:38:01 GMT
x-cdn: Imperva
etag: W/"2c2ae068be3b089e0a5b59abb1831550"
content-type: application/vnd.ms-fontobject
x-iinfo: 0-3675347-0 0CNN RT(1719368058113 311) q(0 -1 -1 -1) r(0 -1)
cache-control: max-age=0, s-maxage=795936, public
content-length: 68940

GET
H2 200 Criteria-CF-Regular.woff2
www.cybereason.com/hubfs/dam/fonts/criteria/ 14 KB
14 KB 204ms
203ms Font
application/font-woff2 45.60.107.106
INCAPSULA

General

Check archive.org

Show headers Download Go to

Full URL

https://www.cybereason.com/hubfs/dam/fonts/criteria/Criteria-CF-Regular.woff2

Requested by

Host: www.cybereason.com
URL: https://www.cybereason.com/blog/i-am-goot-loader

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

45.60.107.106 , United States, ASN19551 (INCAPSULA, US),

Reverse DNS

Software

Resource Hash

fcba0ef5c17fd435aaa6cfac66375e7bfae52f5116b7a6e126c8b0f38b841613

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://www.cybereason.com/blog/i-am-goot-loader
Origin: https://www.cybereason.com
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 26 Jun 2024 02:14:18 GMT
strict-transport-security: max-age=31536000; includeSubDomains
last-modified: Thu, 13 Jan 2022 17:33:57 GMT
x-cdn: Imperva
etag: "8c4e317165d35f99602a1c625d63a040"
content-type: application/font-woff2
x-iinfo: 0-3675347-0 0CNN RT(1719368058113 314) q(0 -1 -1 -1) r(0 -1)
cache-control: max-age=0, s-maxage=795936, public
content-length: 14572

GET
H2 200 Criteria-CF-Medium.woff2
www.cybereason.com/hubfs/dam/fonts/criteria/ 14 KB
15 KB 204ms
204ms Font
application/font-woff2 45.60.107.106
INCAPSULA

General

Check archive.org

Show headers Download Go to

Full URL

https://www.cybereason.com/hubfs/dam/fonts/criteria/Criteria-CF-Medium.woff2

Requested by

Host: www.cybereason.com
URL: https://www.cybereason.com/blog/i-am-goot-loader

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

45.60.107.106 , United States, ASN19551 (INCAPSULA, US),

Reverse DNS

Software

Resource Hash

f24560f5b81158a42b8d38ffe5795d9959eb2308ee6780ea912a6594bb999d1e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://www.cybereason.com/blog/i-am-goot-loader
Origin: https://www.cybereason.com
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 26 Jun 2024 02:14:18 GMT
strict-transport-security: max-age=31536000; includeSubDomains
last-modified: Thu, 13 Jan 2022 17:33:57 GMT
x-cdn: Imperva
etag: "32457643e2ecf8bcf7fdba1110db901c"
content-type: application/font-woff2
x-iinfo: 0-3675347-0 0CNN RT(1719368058113 316) q(0 -1 -1 -1) r(0 -1)
cache-control: max-age=0, s-maxage=795936, public
content-length: 14772

GET
H2 200 Peristyle-Black.woff2
www.cybereason.com/hubfs/dam/fonts/peristyle/ 14 KB
14 KB 254ms
254ms Font
application/font-woff2 45.60.107.106
INCAPSULA

General

Check archive.org

Show headers Download Go to

Full URL

https://www.cybereason.com/hubfs/dam/fonts/peristyle/Peristyle-Black.woff2

Requested by

Host: www.cybereason.com
URL: https://www.cybereason.com/blog/i-am-goot-loader

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

45.60.107.106 , United States, ASN19551 (INCAPSULA, US),

Reverse DNS

Software

Resource Hash

9d943fe5fde08d5b742d383b625031f75e3e89035369f2cde2778f4c6cf5c119

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://www.cybereason.com/blog/i-am-goot-loader
Origin: https://www.cybereason.com
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 26 Jun 2024 02:14:18 GMT
strict-transport-security: max-age=31536000; includeSubDomains
last-modified: Fri, 15 Oct 2021 16:32:36 GMT
x-cdn: Imperva
etag: "a17b2e1c032fa4a5eea1eeb1416eb385"
content-type: application/font-woff2
x-iinfo: 0-3675347-0 0CNN RT(1719368058113 317) q(0 -1 -1 -1) r(0 -1)
cache-control: max-age=0, s-maxage=795937, public
content-length: 14136

GET
H2 200 in.js Show response
platform.linkedin.com/ 510 KB
160 KB 67ms
9ms Script
text/javascript 2606:2800:233:66b5:799a:7cd3:f74d:7071
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL

https://platform.linkedin.com/in.js

Requested by

Host: www.cybereason.com
URL: https://www.cybereason.com/blog/i-am-goot-loader

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2606:2800:233:66b5:799a:7cd3:f74d:7071 , United States, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECAcc (frc/4CE6) /

Resource Hash

f16a9696b3176614d3fe439def6fd9754fd489877999517b99b3b2f265cb7990

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://www.cybereason.com/blog/i-am-goot-loader
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 26 Jun 2024 02:14:18 GMT
content-encoding: gzip
x-content-type-options: nosniff
x-cdn-client-ip-version: IPV6
x-cdn: ECST
age: 1624
x-cache: HIT
x-cdn-proto: HTTP2
content-length: 163630
x-li-uuid: AAYbwTGLKmSeX+iJJRAXUA==
last-modified: Wed, 26 Jun 2024 01:47:14 GMT
server: ECAcc (frc/4CE6)
x-li-pop: prod-lva1-x
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
x-li-fabric: prod-lva1
cache-control: public, max-age=3600
x-li-proto: http/1.1
accept-ranges: bytes
expires: Wed, 26 Jun 2024 02:47:14 GMT

GET
H3 200 layout.min.css
cdn2.hubspot.net/hub/7052064/hub_generated/template_assets/1718971370482/hubspot/hubspot_default/shared/responsive/ 4 KB
2 KB 100ms
46ms Stylesheet
text/css 104.18.88.62
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn2.hubspot.net/hub/7052064/hub_generated/template_assets/1718971370482/hubspot/hubspot_default/shared/responsive/layout.min.css
Requested by: Host: www.cybereason.com
URL: https://www.cybereason.com/blog/i-am-goot-loader
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.88.62 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 356bb4bf2245a68ee5de5732b5574260dd2016a2c3987e17ad97fb2586a883d1

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://www.cybereason.com/blog/i-am-goot-loader
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

content-encoding: gzip
age: 396651
x-evy-trace-route-service-name: envoyset-translator
x-amz-server-side-encryption: AES256
x-amz-replication-status: PENDING
x-hs-cf-lambda: us-east-1.EnforceAclForReads 3
x-evy-trace-listener: listener_https
etag: W/"fda5882b24ca5a84d04d090722dc713b"
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: text/css
access-control-allow-origin: *
x-amz-meta-created-unix-time-millis: 1718971371107
cache-control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900
x-evy-trace-virtual-host: all
x-hs-cf-lambda-enforce: us-east-1.EnforceAclForReads 3
date: Wed, 26 Jun 2024 02:14:18 GMT
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-amz-cf-pop: IAD89-C1
x-hs-alternate-content-type: text/plain
x-hubspot-correlation-id: 8594e77f-16b7-4d00-9186-3d83d952639a
x-amz-storage-class: INTELLIGENT_TIERING
x-envoy-upstream-service-time: 173
alt-svc: h3=":443"; ma=86400
x-evy-trace-route-configuration: listener_https/all
x-request-id: 8594e77f-16b7-4d00-9186-3d83d952639a
last-modified: Fri, 21 Jun 2024 12:02:52 GMT
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=T0DSMsBn7B8HtEvK3ok0Lgy5s7NcuzMy1LRmivsV7c%2FQYibwUtlZ9UcaCZjevJ6pqGp%2FwElM%2Bvu7E7Svgx5n5jHggN%2B0VYlG4SPyMOC%2BK1iRlBGZSQe%2FzlihHJMZ1WAB%2FR8%3D"}],"group":"cf-nel","max_age":604800}
x-evy-trace-served-by-pod: iad02/cms-cdn2-td/envoy-proxy-6f9f79465b-qd96f
cf-ray: 8999aede998390fb-FRA
timing-allow-origin: cdn2.hubspot.net

GET
H3 200 cr-master__cta.min.css
cdn2.hubspot.net/hub/3354902/hub_generated/template_assets/34470223313/1696396395659/__CR_Web_Platform/CSS/ 3 KB
2 KB 206ms
151ms Stylesheet
text/css 104.18.88.62
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn2.hubspot.net/hub/3354902/hub_generated/template_assets/34470223313/1696396395659/__CR_Web_Platform/CSS/cr-master__cta.min.css
Requested by: Host: www.cybereason.com
URL: https://www.cybereason.com/blog/i-am-goot-loader
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.88.62 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0c33072c2e37faa2b2acd3f76a15c44139cadb7999ec9405382b67eab4161003

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://www.cybereason.com/blog/i-am-goot-loader
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

content-encoding: gzip
age: 1236623
x-evy-trace-route-service-name: envoyset-translator
x-amz-server-side-encryption: AES256
x-amz-replication-status: COMPLETED
x-hs-cf-lambda: us-east-1.EnforceAclForReads 3
x-evy-trace-listener: listener_https
etag: W/"008f2c66892c6d50330665f22668fc4b"
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: text/css
access-control-allow-origin: *
x-amz-meta-created-unix-time-millis: 1696396396421
cache-control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900
x-evy-trace-virtual-host: all
x-hs-cf-lambda-enforce: us-east-1.EnforceAclForReads 3
date: Wed, 26 Jun 2024 02:14:18 GMT
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-amz-cf-pop: IAD89-C1
x-hs-alternate-content-type: text/plain
x-hubspot-correlation-id: 1717b0c3-f670-43ad-a262-099698f14526
x-amz-storage-class: INTELLIGENT_TIERING
x-envoy-upstream-service-time: 240
alt-svc: h3=":443"; ma=86400
x-evy-trace-route-configuration: listener_https/all
x-request-id: 1717b0c3-f670-43ad-a262-099698f14526
last-modified: Wed, 04 Oct 2023 05:13:17 GMT
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=WsVNieavM%2BKy%2F8i0vK1E5sclxyuUAcZuVvmxo3tObVrZ9uNlGimiWDTdXAtc5hIj7i1fLi2N74qCqNbHqY5x8xMg38sFG%2Fbpvr64sFS60g049AgbFtrbInBXUsXavocJHOA%3D"}],"group":"cf-nel","max_age":604800}
x-evy-trace-served-by-pod: iad02/cms-cdn2-td/envoy-proxy-5745477c8b-xgsnc
cf-ray: 8999aede998490fb-FRA
timing-allow-origin: cdn2.hubspot.net

GET
H3 200 cr-master__main.min.css
cdn2.hubspot.net/hub/3354902/hub_generated/template_assets/34470477360/1710134689941/__CR_Web_Platform/CSS/ 49 KB
12 KB 212ms
158ms Stylesheet
text/css 104.18.88.62
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn2.hubspot.net/hub/3354902/hub_generated/template_assets/34470477360/1710134689941/__CR_Web_Platform/CSS/cr-master__main.min.css
Requested by: Host: www.cybereason.com
URL: https://www.cybereason.com/blog/i-am-goot-loader
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.88.62 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 09edf98c454b11870a1a667cacab183aaf34e51f53dedb3fa735b9afac34f402

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://www.cybereason.com/blog/i-am-goot-loader
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

content-encoding: gzip
age: 618013
x-evy-trace-route-service-name: envoyset-translator
x-amz-server-side-encryption: AES256
x-amz-replication-status: COMPLETED
x-hs-cf-lambda: us-east-1.EnforceAclForReads 3
x-evy-trace-listener: listener_https
etag: W/"c7c193ff64da90ae6964f13804257f02"
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: text/css
access-control-allow-origin: *
x-amz-meta-created-unix-time-millis: 1710134690758
cache-control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900
x-evy-trace-virtual-host: all
x-hs-cf-lambda-enforce: us-east-1.EnforceAclForReads 3
date: Wed, 26 Jun 2024 02:14:18 GMT
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-amz-cf-pop: IAD89-C1
x-hs-alternate-content-type: text/plain
x-hubspot-correlation-id: f292c797-7219-4bb4-821a-bc7bd971af44
x-amz-storage-class: INTELLIGENT_TIERING
x-envoy-upstream-service-time: 240
alt-svc: h3=":443"; ma=86400
x-evy-trace-route-configuration: listener_https/all
x-request-id: f292c797-7219-4bb4-821a-bc7bd971af44
last-modified: Mon, 11 Mar 2024 05:24:51 GMT
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=fnoMdHwH46%2F4%2BU2T8KqBfCAwUUivvzeK0Wssi8gpgvLqyHCmKZAEBqJxfQfqh1FUEMuyY10iZW1KLBjT80OWtfOaqBeBxEBafIo8XnyfbyaEjCfH81k2oGWEQAw0gFCRBgk%3D"}],"group":"cf-nel","max_age":604800}
x-evy-trace-served-by-pod: iad02/cms-cdn2-td/envoy-proxy-6f9f79465b-qd96f
cf-ray: 8999aede998590fb-FRA
timing-allow-origin: cdn2.hubspot.net

GET
H3 200 ionicons.min.css
cdn2.hubspot.net/hub/3354902/hub_generated/template_assets/35275979682/1642096258129/__CR_Web_Platform/CSS/ 50 KB
11 KB 209ms
154ms Stylesheet
text/css 104.18.88.62
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn2.hubspot.net/hub/3354902/hub_generated/template_assets/35275979682/1642096258129/__CR_Web_Platform/CSS/ionicons.min.css
Requested by: Host: www.cybereason.com
URL: https://www.cybereason.com/blog/i-am-goot-loader
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.88.62 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 72fe18777ebf37b44d58c82be9b67edceefb88c2c6984c614c72991d6e3b8853

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://www.cybereason.com/blog/i-am-goot-loader
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

content-encoding: gzip
age: 1236623
x-evy-trace-route-service-name: envoyset-translator
x-amz-server-side-encryption: AES256
x-amz-replication-status: COMPLETED
x-hs-cf-lambda: us-east-1.EnforceAclForReads 3
x-evy-trace-listener: listener_https
etag: W/"71c8c946791f3411c42a4cb1e9cdb5ed"
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: text/css
access-control-allow-origin: *
x-amz-meta-created-unix-time-millis: 1642096258332
cache-control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900
x-evy-trace-virtual-host: all
x-hs-cf-lambda-enforce: us-east-1.EnforceAclForReads 3
date: Wed, 26 Jun 2024 02:14:18 GMT
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-amz-cf-pop: IAD89-C1
x-hs-alternate-content-type: text/plain
x-hubspot-correlation-id: 36ee93fa-d93d-4482-b55b-55ab8cc53a0f
x-envoy-upstream-service-time: 239
alt-svc: h3=":443"; ma=86400
x-evy-trace-route-configuration: listener_https/all
x-request-id: 36ee93fa-d93d-4482-b55b-55ab8cc53a0f
last-modified: Thu, 13 Jan 2022 17:50:59 GMT
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=HXi8G59P9obbHMB8pimi%2BVdAs2I3phLjw9qRtIWlVNARJlVKtV3BY%2FzOwIcxTnY4Ng5GNEkU3InOYJvg0fnMVI0sJP4LC6MVetolxVFhTdk%2BWKMWXBCb8si0iFxgI%2BXxkDE%3D"}],"group":"cf-nel","max_age":604800}
x-evy-trace-served-by-pod: iad02/cms-cdn2-td/envoy-proxy-64786dc485-64hnd
cf-ray: 8999aede998690fb-FRA
timing-allow-origin: cdn2.hubspot.net

GET
H3 200 cr-mln__build.min.css
cdn2.hubspot.net/hub/3354902/hub_generated/template_assets/42760289143/1663004429410/__CR_Web_Platform/CSS/ 22 KB
5 KB 206ms
151ms Stylesheet
text/css 104.18.88.62
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn2.hubspot.net/hub/3354902/hub_generated/template_assets/42760289143/1663004429410/__CR_Web_Platform/CSS/cr-mln__build.min.css
Requested by: Host: www.cybereason.com
URL: https://www.cybereason.com/blog/i-am-goot-loader
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.88.62 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e18234d885ed9a551c15b4a6db8a66f519058a512c928a61e22c9d479203feb5

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://www.cybereason.com/blog/i-am-goot-loader
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

content-encoding: gzip
age: 419929
x-evy-trace-route-service-name: envoyset-translator
x-amz-server-side-encryption: AES256
x-amz-replication-status: COMPLETED
x-hs-cf-lambda: us-east-1.EnforceAclForReads 3
x-evy-trace-listener: listener_https
etag: W/"9e4d00bd62ca17db2fb876fa39ba3022"
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: text/css
access-control-allow-origin: *
x-amz-meta-created-unix-time-millis: 1663004430214
cache-control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900
x-evy-trace-virtual-host: all
x-hs-cf-lambda-enforce: us-east-1.EnforceAclForReads 3
date: Wed, 26 Jun 2024 02:14:18 GMT
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-amz-cf-pop: IAD89-C1
x-hs-alternate-content-type: text/plain
x-hubspot-correlation-id: 313afd5f-f19b-4540-a0ee-0549b73414b7
x-amz-storage-class: INTELLIGENT_TIERING
x-envoy-upstream-service-time: 193
alt-svc: h3=":443"; ma=86400
x-evy-trace-route-configuration: listener_https/all
x-request-id: 313afd5f-f19b-4540-a0ee-0549b73414b7
last-modified: Mon, 12 Sep 2022 17:40:31 GMT
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=4zqpqg2tT9h0stcxhGZmWqrpwrfUzoHjdc8qoE7EtHaCu3aKeqW7NvvfbuK53Y8EdvacQVHlLLrPl9%2FZLngZSlDORpqqCTQsNJG2MklRkE%2BjwHwV9a1kSSjHaL%2FDf0oPDCs%3D"}],"group":"cf-nel","max_age":604800}
x-evy-trace-served-by-pod: iad02/cms-cdn2-td/envoy-proxy-64d59778d6-f6gc6
cf-ray: 8999aede998790fb-FRA
timing-allow-origin: cdn2.hubspot.net

GET
H3 200 cr-framework__bulma-columns.min.css
cdn2.hubspot.net/hub/3354902/hub_generated/template_assets/34470224480/1635957556830/__CR_Web_Platform/CSS/bulma/ 19 KB
4 KB 215ms
160ms Stylesheet
text/css 104.18.88.62
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn2.hubspot.net/hub/3354902/hub_generated/template_assets/34470224480/1635957556830/__CR_Web_Platform/CSS/bulma/cr-framework__bulma-columns.min.css
Requested by: Host: www.cybereason.com
URL: https://www.cybereason.com/blog/i-am-goot-loader
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.88.62 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 81c836c05ab1f2d37b7aa60d509a656c7a441e2a4fabf035c1b0666a4daa50fa

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://www.cybereason.com/blog/i-am-goot-loader
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

content-encoding: gzip
age: 1241946
x-evy-trace-route-service-name: envoyset-translator
x-amz-server-side-encryption: AES256
x-amz-replication-status: COMPLETED
x-hs-cf-lambda: us-east-1.EnforceAclForReads 3
x-evy-trace-listener: listener_https
etag: W/"636c18615b58fca9536b2e1c578c6db7"
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: text/css
access-control-allow-origin: *
x-amz-meta-created-unix-time-millis: 1635957556893
cache-control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900
x-evy-trace-virtual-host: all
x-hs-cf-lambda-enforce: us-east-1.EnforceAclForReads 3
date: Wed, 26 Jun 2024 02:14:18 GMT
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-amz-cf-pop: IAD89-C1
x-hs-alternate-content-type: text/plain
x-hubspot-correlation-id: 1a5a1c86-a268-4356-9638-7bb06c550a9b
x-envoy-upstream-service-time: 217
alt-svc: h3=":443"; ma=86400
x-evy-trace-route-configuration: listener_https/all
x-request-id: 1a5a1c86-a268-4356-9638-7bb06c550a9b
last-modified: Wed, 03 Nov 2021 16:39:17 GMT
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=NZfOAfcaYQiJ2INzZgmS8CaAukrGIbxjwcQ2XNTAuTlfkhf4%2FsGNdoXYvaTLdH0l5rrEJX9Qe4ItTt84I8x5utbbo1egYVhAY3lbCU7Ayb43b5MKwHxiAey92SIkSmGmfUI%3D"}],"group":"cf-nel","max_age":604800}
x-evy-trace-served-by-pod: iad02/cms-cdn2-td/envoy-proxy-5896745bbb-7fw4c
cf-ray: 8999aede998990fb-FRA
timing-allow-origin: cdn2.hubspot.net

GET
H3 200 cr-framework__bulma.min.css
cdn2.hubspot.net/hub/3354902/hub_generated/template_assets/35291999472/1696396871390/__CR_Web_Platform/CSS/bulma/ 62 KB
12 KB 216ms
161ms Stylesheet
text/css 104.18.88.62
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn2.hubspot.net/hub/3354902/hub_generated/template_assets/35291999472/1696396871390/__CR_Web_Platform/CSS/bulma/cr-framework__bulma.min.css
Requested by: Host: www.cybereason.com
URL: https://www.cybereason.com/blog/i-am-goot-loader
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.88.62 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 85ce42d99ae7d93a9df2304eedc16e1b26d492c38f5b9d034ea5c09c8a996c8f

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://www.cybereason.com/blog/i-am-goot-loader
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

content-encoding: gzip
age: 1241946
x-evy-trace-route-service-name: envoyset-translator
x-amz-server-side-encryption: AES256
x-amz-replication-status: COMPLETED
x-hs-cf-lambda: us-east-1.EnforceAclForReads 3
x-evy-trace-listener: listener_https
etag: W/"d320036a903c067c37b9ccf5619f0cb2"
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: text/css
access-control-allow-origin: *
x-amz-meta-created-unix-time-millis: 1696396872359
cache-control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900
x-evy-trace-virtual-host: all
x-hs-cf-lambda-enforce: us-east-1.EnforceAclForReads 3
date: Wed, 26 Jun 2024 02:14:18 GMT
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-amz-cf-pop: IAD89-C1
x-hs-alternate-content-type: text/plain
x-hubspot-correlation-id: 16099d8e-f982-4db4-9464-039624da113d
x-amz-storage-class: INTELLIGENT_TIERING
x-envoy-upstream-service-time: 205
alt-svc: h3=":443"; ma=86400
x-evy-trace-route-configuration: listener_https/all
x-request-id: 16099d8e-f982-4db4-9464-039624da113d
last-modified: Wed, 04 Oct 2023 05:21:13 GMT
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=CCwusxiqHOTz8k99H7jMnu6qd%2B%2BfjF5BZjOn3yKHIvOY4dVhnbu6kMs3Ui9whXXmJ9TbZxbNetGPUcS%2BD8%2BoRUwlnUnxdW9O7R%2BLyC4FzVpK988UCzb0Mq1syokeWgN3IhE%3D"}],"group":"cf-nel","max_age":604800}
x-evy-trace-served-by-pod: iad02/cms-cdn2-td/envoy-proxy-64d59778d6-jrv7z
cf-ray: 8999aede998b90fb-FRA
timing-allow-origin: cdn2.hubspot.net

GET
H3 200 hamburger-animation.min.css
cdn2.hubspot.net/hub/3354902/hub_generated/template_assets/42363645447/1635957556555/__CR_Web_Platform/CSS/ 22 KB
4 KB 229ms
174ms Stylesheet
text/css 104.18.88.62
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn2.hubspot.net/hub/3354902/hub_generated/template_assets/42363645447/1635957556555/__CR_Web_Platform/CSS/hamburger-animation.min.css
Requested by: Host: www.cybereason.com
URL: https://www.cybereason.com/blog/i-am-goot-loader
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.88.62 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c9130ee8c979a74ab038cf5e8a06db5cb94253eab35ea5242f515d605f4781ad

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://www.cybereason.com/blog/i-am-goot-loader
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

content-encoding: gzip
age: 1246741
x-evy-trace-route-service-name: envoyset-translator
x-amz-server-side-encryption: AES256
x-amz-replication-status: COMPLETED
x-hs-cf-lambda: us-east-1.EnforceAclForReads 3
x-evy-trace-listener: listener_https
etag: W/"a0b451fd96744fa455495e022542ab86"
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: text/css
access-control-allow-origin: *
x-amz-meta-created-unix-time-millis: 1635957556622
cache-control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900
x-evy-trace-virtual-host: all
x-hs-cf-lambda-enforce: us-east-1.EnforceAclForReads 3
date: Wed, 26 Jun 2024 02:14:18 GMT
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-amz-cf-pop: IAD61-P1
x-hs-alternate-content-type: text/plain
x-hubspot-correlation-id: 3282a97e-58d6-42f8-a9e9-19c3984a060b
x-envoy-upstream-service-time: 179
alt-svc: h3=":443"; ma=86400
x-evy-trace-route-configuration: listener_https/all
x-request-id: 3282a97e-58d6-42f8-a9e9-19c3984a060b
last-modified: Wed, 03 Nov 2021 16:39:17 GMT
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=dU6g2fv3wanFiG2EgBTfJJftVhH2eWIlv4jhOu89TrzImxIm00eFroidvJtmTpuNhVPVQBrbLUBz7Tlr8gfJVf9D%2FSJRalVQT63C%2FLZkmwplr51mONUmvs7O%2BBFaC4xCPfE%3D"}],"group":"cf-nel","max_age":604800}
x-evy-trace-served-by-pod: iad02/cms-cdn2-td/envoy-proxy-64d59778d6-f6gc6
cf-ray: 8999aede998c90fb-FRA
timing-allow-origin: cdn2.hubspot.net

GET
H3 200 animate.min.css
cdn2.hubspot.net/hub/3354902/hub_generated/template_assets/42507091846/1635957557027/__CR_Web_Platform/CSS/ 52 KB
6 KB 216ms
161ms Stylesheet
text/css 104.18.88.62
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn2.hubspot.net/hub/3354902/hub_generated/template_assets/42507091846/1635957557027/__CR_Web_Platform/CSS/animate.min.css
Requested by: Host: www.cybereason.com
URL: https://www.cybereason.com/blog/i-am-goot-loader
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.88.62 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b48f9a7031474a0f73f92f2e6cbbfad730b5466cda96d86a4459c06efc986173

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://www.cybereason.com/blog/i-am-goot-loader
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

content-encoding: gzip
age: 1238613
x-evy-trace-route-service-name: envoyset-translator
x-amz-server-side-encryption: AES256
x-amz-replication-status: COMPLETED
x-hs-cf-lambda: us-east-1.EnforceAclForReads 3
x-evy-trace-listener: listener_https
etag: W/"55009d64191e6f9e712a841773ee6611"
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: text/css
access-control-allow-origin: *
x-amz-meta-created-unix-time-millis: 1635957557027
cache-control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900
x-evy-trace-virtual-host: all
x-hs-cf-lambda-enforce: us-east-1.EnforceAclForReads 3
date: Wed, 26 Jun 2024 02:14:18 GMT
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-amz-cf-pop: IAD89-C1
x-hs-alternate-content-type: text/plain
x-hubspot-correlation-id: a8a7872d-3e2b-4216-b8b8-465b48e8dd51
x-envoy-upstream-service-time: 161
alt-svc: h3=":443"; ma=86400
x-evy-trace-route-configuration: listener_https/all
x-request-id: a8a7872d-3e2b-4216-b8b8-465b48e8dd51
last-modified: Wed, 03 Nov 2021 16:39:18 GMT
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2Br10SRAOl53dopcaH1epJAm5SubZAmbz%2F0mNmRm4GBP5IgCdOK%2B2d%2FlzZ1s7jhbWXpOxkeW2WPR%2B7GuY7fnUN51LfsbOPZQJj0lBIVPE%2BDVpsalrFjpSxCT95MNqqdvDmTg%3D"}],"group":"cf-nel","max_age":604800}
x-evy-trace-served-by-pod: iad02/cms-cdn2-td/envoy-proxy-c8b596779-qb4kw
cf-ray: 8999aede998d90fb-FRA
timing-allow-origin: cdn2.hubspot.net

GET
H3 200 font-awesome.min.css
cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/css/ 30 KB
6 KB 75ms
19ms Stylesheet
text/css 104.17.24.14
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/css/font-awesome.min.css

Requested by

Host: www.cybereason.com
URL: https://www.cybereason.com/blog/i-am-goot-loader

Protocol

Security

QUIC, , AES_128_GCM

Server

104.17.24.14 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://www.cybereason.com/blog/i-am-goot-loader
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 26 Jun 2024 02:14:18 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
age: 6768
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 5631
last-modified: Mon, 04 May 2020 16:10:07 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb03e5f-7918"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Nnaf2thkXi28LC0RwUmoy6YEpOZWgnmBbC87g77AHCkKjuYtd3qwyFyVoDFYTZRxUsTzfe69XX1S%2BG4VeZMPMM6yLmOKxVkilYnhOVtb75843kn8KpEUEle%2BriixPT5KXMoENk5h"}],"group":"cf-nel","max_age":604800}
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 8999aede9bcc9176-FRA
expires: Mon, 16 Jun 2025 02:14:18 GMT

GET
H2 200 css2
fonts.googleapis.com/ 21 KB
1 KB 72ms
16ms Stylesheet
text/css 2a00:1450:4001:81d::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Inter:wght@100;200;300;400;500;600;700;800;900&display=swap

Requested by

Host: www.cybereason.com
URL: https://www.cybereason.com/blog/i-am-goot-loader

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81d::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

90c4f0951056e5a82b2150c8b3fe6d011a08ea2abc957453d080b8179504e2d7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://www.cybereason.com/blog/i-am-goot-loader
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

strict-transport-security: max-age=31536000
date: Wed, 26 Jun 2024 02:14:18 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Wed, 26 Jun 2024 01:09:24 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Wed, 26 Jun 2024 02:14:18 GMT

GET
H2 200 marker-animation.js Show response
www.cybereason.com/hubfs/dam/plugins/ 6 KB
3 KB 252ms
251ms Script
application/javascript 45.60.107.106
INCAPSULA

General

Check archive.org

Show headers Download Go to

Full URL

https://www.cybereason.com/hubfs/dam/plugins/marker-animation.js

Requested by

Host: www.cybereason.com
URL: https://www.cybereason.com/blog/i-am-goot-loader

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

45.60.107.106 , United States, ASN19551 (INCAPSULA, US),

Reverse DNS

Software

Resource Hash

843803aeba82f94da6f1cbe1f853ccd12f5d7cc6a3afa20923e57e5df60c412d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://www.cybereason.com/blog/i-am-goot-loader
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 26 Jun 2024 02:14:18 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
last-modified: Tue, 27 Oct 2020 17:09:14 GMT
x-cdn: Imperva
etag: W/"c789451d244987df6815383a74c748e9"
content-type: application/javascript
x-iinfo: 0-3675347-0 0CNN RT(1719368058113 318) q(0 -1 -1 -1) r(0 -1)
cache-control: max-age=0, s-maxage=966691, public
content-length: 2419

GET
H2 200 cr-logo-inline--primary-black.png
www.cybereason.com/hubfs/dam/images/images-web/logos/cr-brand/ 5 KB
5 KB 253ms
251ms Image
image/png 45.60.107.106
INCAPSULA

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.cybereason.com/hubfs/dam/images/images-web/logos/cr-brand/cr-logo-inline--primary-black.png

Requested by

Host: www.cybereason.com
URL: https://www.cybereason.com/blog/i-am-goot-loader

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

45.60.107.106 , United States, ASN19551 (INCAPSULA, US),

Reverse DNS

Software

Resource Hash

fd6c0f5026c29648ab8887658f23e6c57faedfe7f9d85e702823ae5dfcbdc8f0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://www.cybereason.com/blog/i-am-goot-loader
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 26 Jun 2024 02:14:18 GMT
strict-transport-security: max-age=31536000; includeSubDomains
last-modified: Fri, 03 Dec 2021 18:08:59 GMT
x-cdn: Imperva
etag: "0200a44af913040fda048d2ccd029463"
content-type: image/png
x-iinfo: 0-3675347-0 0CNN RT(1719368058113 320) q(0 -1 -1 -1) r(0 -1)
cache-control: max-age=0, s-maxage=1054305, public
content-length: 5084

GET
H2 200 cr-malicious-life-logo-v2.png
www.cybereason.com/hubfs/dam/images/images-web/logos/cr-brand/ 35 KB
35 KB 254ms
252ms Image
image/png 45.60.107.106
INCAPSULA

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.cybereason.com/hubfs/dam/images/images-web/logos/cr-brand/cr-malicious-life-logo-v2.png

Requested by

Host: www.cybereason.com
URL: https://www.cybereason.com/blog/i-am-goot-loader

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

45.60.107.106 , United States, ASN19551 (INCAPSULA, US),

Reverse DNS

Software

Resource Hash

1ef8b59b832109ecbec2f9ed52e8073e2ab73862fa5e6697e1fe05d1c8358a02

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://www.cybereason.com/blog/i-am-goot-loader
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 26 Jun 2024 02:14:18 GMT
strict-transport-security: max-age=31536000; includeSubDomains
last-modified: Wed, 15 Dec 2021 18:41:35 GMT
x-cdn: Imperva
etag: "4f8f695cfdda0e2a9e41271fd3ef4840"
content-type: image/png
x-iinfo: 0-3675347-0 0CNN RT(1719368058113 321) q(0 -1 -1 -1) r(0 -1)
cache-control: max-age=0, s-maxage=839700, public
content-length: 35653

GET
H2 200 cr-blog-icon--search-dark-gray.png
www.cybereason.com/hubfs/dam/images/images-web/blog-images/template-images/ 440 B
572 B 102ms
102ms Image
image/png 45.60.107.106
INCAPSULA

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.cybereason.com/hubfs/dam/images/images-web/blog-images/template-images/cr-blog-icon--search-dark-gray.png

Requested by

Host: www.cybereason.com
URL: https://www.cybereason.com/blog/i-am-goot-loader

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

45.60.107.106 , United States, ASN19551 (INCAPSULA, US),

Reverse DNS

Software

Resource Hash

e90344957225c9e0caa52e2591fd6066740e0650bc100c422435762160fb2e33

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://www.cybereason.com/blog/i-am-goot-loader
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 26 Jun 2024 02:14:18 GMT
strict-transport-security: max-age=31536000; includeSubDomains
last-modified: Wed, 03 Mar 2021 03:19:57 GMT
x-cdn: Imperva
etag: "5285e68f20ece59da650da19c81751e2"
content-type: image/png
x-iinfo: 0-3675347-0 0CNN RT(1719368058113 570) q(0 -1 -1 -1) r(0 -1)
cache-control: max-age=0, s-maxage=839700, public
content-length: 440

GET
H2 200 goot-loader-blog-featured.png
www.cybereason.com/hubfs/dam/images/images-web/featured-images/ 1 MB
1 MB 103ms
102ms Image
image/png 45.60.107.106
INCAPSULA

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.cybereason.com/hubfs/dam/images/images-web/featured-images/goot-loader-blog-featured.png

Requested by

Host: www.cybereason.com
URL: https://www.cybereason.com/blog/i-am-goot-loader

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

45.60.107.106 , United States, ASN19551 (INCAPSULA, US),

Reverse DNS

Software

Resource Hash

28acd7b513f08e4f3d6e941227479bdf8585005aa8c42824e610e9e986df35b9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://www.cybereason.com/blog/i-am-goot-loader
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 26 Jun 2024 02:14:18 GMT
strict-transport-security: max-age=31536000; includeSubDomains
last-modified: Thu, 30 May 2024 15:35:40 GMT
x-cdn: Imperva
etag: "7d140a3742bc76dd022e8418fdfba6e9"
content-type: image/png
x-iinfo: 0-3675347-0 0CNN RT(1719368058113 616) q(0 -1 -1 -1) r(0 -1)
cache-control: max-age=0, s-maxage=307303, public
content-length: 1088341

GET
H2 200 twitter-gray.svg
www.cybereason.com/hubfs/dam/images/images-web/blog-images/template-images/ 749 B
585 B 148ms
148ms Image
image/svg+xml 45.60.107.106
INCAPSULA

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.cybereason.com/hubfs/dam/images/images-web/blog-images/template-images/twitter-gray.svg

Requested by

Host: www.cybereason.com
URL: https://www.cybereason.com/blog/i-am-goot-loader

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

45.60.107.106 , United States, ASN19551 (INCAPSULA, US),

Reverse DNS

Software

Resource Hash

f9db6465a204cc4186368b72a0ba4f063e64569aa4fc96e0f40c7ac69423121b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://www.cybereason.com/blog/i-am-goot-loader
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 26 Jun 2024 02:14:18 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
last-modified: Thu, 01 Apr 2021 02:23:43 GMT
x-cdn: Imperva
etag: W/"5c103d0cd978b3a8d7ccab6bff714599"
content-type: image/svg+xml
x-iinfo: 0-3675347-0 0CNN RT(1719368058113 674) q(0 -1 -1 -1) r(0 -1)
cache-control: max-age=0, s-maxage=795937, public
content-length: 438

GET
H2 200 facebook-gray.svg
www.cybereason.com/hubfs/dam/images/images-web/blog-images/template-images/ 372 B
435 B 106ms
106ms Image
image/svg+xml 45.60.107.106
INCAPSULA

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.cybereason.com/hubfs/dam/images/images-web/blog-images/template-images/facebook-gray.svg

Requested by

Host: www.cybereason.com
URL: https://www.cybereason.com/blog/i-am-goot-loader

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

45.60.107.106 , United States, ASN19551 (INCAPSULA, US),

Reverse DNS

Software

Resource Hash

d82231820461c83d1b0966caae71bd2732bd89e9a910fdb90d193c3dca16dbc7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://www.cybereason.com/blog/i-am-goot-loader
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 26 Jun 2024 02:14:19 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
last-modified: Thu, 01 Apr 2021 02:23:43 GMT
x-cdn: Imperva
etag: W/"8c22d0d78005c386bf29edacfdd2360d"
content-type: image/svg+xml
x-iinfo: 0-3675347-0 0CNN RT(1719368058113 1036) q(0 -1 -1 -1) r(0 -1)
cache-control: max-age=0, s-maxage=795936, public
content-length: 299

GET
H2 200 linkedin-gray.svg
www.cybereason.com/hubfs/dam/images/images-web/blog-images/template-images/ 742 B
766 B 102ms
102ms Image
image/svg+xml 45.60.107.106
INCAPSULA

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.cybereason.com/hubfs/dam/images/images-web/blog-images/template-images/linkedin-gray.svg

Requested by

Host: www.cybereason.com
URL: https://www.cybereason.com/blog/i-am-goot-loader

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

45.60.107.106 , United States, ASN19551 (INCAPSULA, US),

Reverse DNS

Software

Resource Hash

12127e3110351f54262db955bafe353593dd58c89c7f6b6fc159c10515e93c61

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://www.cybereason.com/blog/i-am-goot-loader
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 26 Jun 2024 02:14:19 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
last-modified: Wed, 07 Apr 2021 01:13:30 GMT
x-cdn: Imperva
etag: W/"446340b1a8e73ee28b1a47837a13fdf3"
content-type: image/svg+xml
x-iinfo: 0-3675347-0 0CNN RT(1719368058113 1075) q(0 -1 -1 -1) r(0 -1)
cache-control: max-age=0, s-maxage=795936, public
content-length: 630

GET
H2 200 Cybereason%20Logo-1.png
www.cybereason.com/hubfs/Cybereason%20Logos/ 20 KB
20 KB 104ms
102ms Image
image/png 45.60.107.106
INCAPSULA

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.cybereason.com/hubfs/Cybereason%20Logos/Cybereason%20Logo-1.png

Requested by

Host: www.cybereason.com
URL: https://www.cybereason.com/blog/i-am-goot-loader

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

45.60.107.106 , United States, ASN19551 (INCAPSULA, US),

Reverse DNS

Software

Resource Hash

95d5bb11fee6ddf9b6af49e5c0621d6dd3b84fdc5798795e38254ff8bbaace63

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://www.cybereason.com/blog/i-am-goot-loader
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 26 Jun 2024 02:14:19 GMT
strict-transport-security: max-age=31536000; includeSubDomains
last-modified: Thu, 04 Aug 2022 15:52:18 GMT
x-cdn: Imperva
etag: "bb8af0e3289ae9b68724e089579b56f2"
content-type: image/png
x-iinfo: 0-3675347-0 0CNN RT(1719368058113 1121) q(0 -1 -1 -1) r(0 -1)
cache-control: max-age=0, s-maxage=978951, public
content-length: 20589

GET
H2 200 Threat%20Alert%20template%20%284%29.png
www.cybereason.com/hubfs/ 414 KB
414 KB 105ms
103ms Image
image/png 45.60.107.106
INCAPSULA

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.cybereason.com/hubfs/Threat%20Alert%20template%20%284%29.png

Requested by

Host: www.cybereason.com
URL: https://www.cybereason.com/blog/i-am-goot-loader

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

45.60.107.106 , United States, ASN19551 (INCAPSULA, US),

Reverse DNS

Software

Resource Hash

48354b41323305716c9fd1314dbfc4ca0ca3b41aeafb995cc65b2205b1f9dd35

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://www.cybereason.com/blog/i-am-goot-loader
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 26 Jun 2024 02:14:19 GMT
strict-transport-security: max-age=31536000; includeSubDomains
last-modified: Thu, 11 Nov 2021 15:08:21 GMT
x-cdn: Imperva
etag: "3e06b5060a8c7134943b5d2faf0f5cab"
content-type: image/png
x-iinfo: 0-3675347-0 0CNN RT(1719368058113 1123) q(0 -1 -1 -1) r(0 -1)
cache-control: max-age=0, s-maxage=931738, public
content-length: 423980

GET
H2 200 youtube-malware-blog-featured.png
www.cybereason.com/hubfs/dam/images/images-web/featured-images/ 301 KB
302 KB 108ms
106ms Image
image/png 45.60.107.106
INCAPSULA

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.cybereason.com/hubfs/dam/images/images-web/featured-images/youtube-malware-blog-featured.png

Requested by

Host: www.cybereason.com
URL: https://www.cybereason.com/blog/i-am-goot-loader

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

45.60.107.106 , United States, ASN19551 (INCAPSULA, US),

Reverse DNS

Software

Resource Hash

db3795e97fd1a0e19c52e7ff057e74206b7ccdaa0cb0902510b567a7065f130e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://www.cybereason.com/blog/i-am-goot-loader
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 26 Jun 2024 02:14:19 GMT
strict-transport-security: max-age=31536000; includeSubDomains
last-modified: Fri, 19 Jan 2024 20:01:46 GMT
x-cdn: Imperva
etag: "c634c935f843ff98e06450235f59ebab"
content-type: image/png
x-iinfo: 0-3675347-0 0CNN RT(1719368058113 1125) q(0 -1 -1 -1) r(0 -1)
cache-control: max-age=0, s-maxage=881848, public
content-length: 308550

GET
H2 200 cr-logo-inline--primary-white.png
www.cybereason.com/hubfs/dam/images/images-web/logos/cr-brand/ 5 KB
5 KB 109ms
108ms Image
image/png 45.60.107.106
INCAPSULA

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.cybereason.com/hubfs/dam/images/images-web/logos/cr-brand/cr-logo-inline--primary-white.png

Requested by

Host: www.cybereason.com
URL: https://www.cybereason.com/blog/i-am-goot-loader

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

45.60.107.106 , United States, ASN19551 (INCAPSULA, US),

Reverse DNS

Software

Resource Hash

8f657cd3617d00d51bbc4dee693b71bde939c80310034a8d82641804d4eb7e16

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://www.cybereason.com/blog/i-am-goot-loader
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 26 Jun 2024 02:14:19 GMT
strict-transport-security: max-age=31536000; includeSubDomains
last-modified: Fri, 03 Dec 2021 18:09:12 GMT
x-cdn: Imperva
etag: "9fa007f86be3dd9a921a2d00bf86f36e"
content-type: image/png
x-iinfo: 0-3675347-0 0CNN RT(1719368058113 1126) q(0 -1 -1 -1) r(0 -1)
cache-control: max-age=0, s-maxage=839700, public
content-length: 4953

GET
H2 200 embed.js Show response
static.hsappstatic.net/content-cwv-embed/static-1.971/ 13 KB
5 KB 37ms
18ms Script
application/javascript 2606:4700::6811:ae5b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://static.hsappstatic.net/content-cwv-embed/static-1.971/embed.js

Requested by

Host: www.cybereason.com
URL: https://www.cybereason.com/blog/i-am-goot-loader

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:ae5b , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

98dfeb1d061e8788b320a130a84723813efed0b2518921f30b40cc8a09bf8ecf

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://www.cybereason.com/blog/i-am-goot-loader
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 26 Jun 2024 02:14:19 GMT
x-amz-version-id: 1gm1MaaLzWiIBc2FerIVtLdckhSMSaY7
content-encoding: gzip
cf-cache-status: HIT
via: 1.1 18fab39b23fb6b3013058d6df5faf0bc.cloudfront.net (CloudFront)
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-amz-cf-pop: FRA60-P6
age: 1613073
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
last-modified: Wed, 05 Jun 2024 15:05:39 GMT
server: cloudflare
etag: W/"26c40482b55a607cd44486a2958741d4"
vary: Origin,Accept-Encoding,Access-Control-Request-Headers,Access-Control-Request-Method
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=pxbrGGUeedINSfvDN0EJWbpT3GvXCrgVo1%2FcY5gfPmQXC50RUTTerSgTiPMCCVapLSkTUhfIRrkVSgRtABClXcpbLrlY1Pgm5tnRjgjjw%2FkdwmpMWOpUYI%2Baw6kA%2Bm86p%2BNGp8K7%2BLNZhdGTHn3B14D3sDc%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: public, max-age=31536000
cf-ray: 8999aee368ed3a60-FRA
x-amz-cf-id: lEGvwrTGJqZ2O6fxk0_3bnjSm4fK8__hUDVF23Uszs_fPcZWhCrfhQ==
expires: Thu, 26 Jun 2025 02:14:19 GMT

GET
H3 200 animatedModal.min.js Show response
cdn2.hubspot.net/hub/3354902/hub_generated/template_assets/42507089303/1644440411417/__CR_Web_Platform/JS/animatedModal/ 2 KB
2 KB 23ms
22ms Script
application/javascript 104.18.88.62
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn2.hubspot.net/hub/3354902/hub_generated/template_assets/42507089303/1644440411417/__CR_Web_Platform/JS/animatedModal/animatedModal.min.js
Requested by: Host: www.cybereason.com
URL: https://www.cybereason.com/blog/i-am-goot-loader
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.88.62 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0f94c946a13b9ebe43281550b7d0c00edf4694ad06bcb4c8679bee6d48df5115

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://www.cybereason.com/blog/i-am-goot-loader
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

content-encoding: br
age: 1240095
x-evy-trace-route-service-name: envoyset-translator
x-amz-server-side-encryption: AES256
x-amz-replication-status: COMPLETED
x-hs-cf-lambda: us-east-1.EnforceAclForReads 3
x-evy-trace-listener: listener_https
etag: W/"690ad93d1d2a9fc11f9df295692413fe"
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
x-amz-meta-created-unix-time-millis: 1644440411792
cache-control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900
x-evy-trace-virtual-host: all
x-hs-cf-lambda-enforce: us-east-1.EnforceAclForReads 3
date: Wed, 26 Jun 2024 02:14:19 GMT
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-amz-cf-pop: IAD61-P1
x-hs-alternate-content-type: text/plain
x-hubspot-correlation-id: c96bd0b6-8507-47cd-b86c-1f5f5f70319f
x-envoy-upstream-service-time: 734
alt-svc: h3=":443"; ma=86400
x-evy-trace-route-configuration: listener_https/all
x-request-id: c96bd0b6-8507-47cd-b86c-1f5f5f70319f
last-modified: Wed, 09 Feb 2022 21:00:12 GMT
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=aiO9dOACwxxjcyGin1drx2EOgpZx9BXIW%2BXaeiS9X8uy8lAeOXpxWdV8%2Bh2PvTHZPG1n3Tkn%2FcHYjBfExJDXFnBV1CpsVx5%2FNtQM%2FmaJ5qYm9ED7XJnzVjDFHN1OGGc5uq8%3D"}],"group":"cf-nel","max_age":604800}
x-evy-trace-served-by-pod: iad02/cms-cdn2-td/envoy-proxy-64d59778d6-jrv7z
cf-ray: 8999aee16aaf90fb-FRA
timing-allow-origin: cdn2.hubspot.net

GET
H3 200 module_41681847227_CR_-_Malicious_Life_Network_--_Tier_One_Header.min.js Show response
cdn2.hubspot.net/hub/3354902/hub_generated/module_assets/41681847227/1644941386128/ 374 B
1 KB 23ms
23ms Script
application/javascript 104.18.88.62
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn2.hubspot.net/hub/3354902/hub_generated/module_assets/41681847227/1644941386128/module_41681847227_CR_-_Malicious_Life_Network_--_Tier_One_Header.min.js
Requested by: Host: www.cybereason.com
URL: https://www.cybereason.com/blog/i-am-goot-loader
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.88.62 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 119bf322a2ce6d2a82422b51404bc54b375c881f12a120205598d1691fa48820

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://www.cybereason.com/blog/i-am-goot-loader
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

content-encoding: br
age: 1240095
x-evy-trace-route-service-name: envoyset-translator
x-amz-server-side-encryption: AES256
x-amz-replication-status: COMPLETED
x-hs-cf-lambda: us-east-1.EnforceAclForReads 3
x-evy-trace-listener: listener_https
etag: W/"1d7f81aaf24568ea5d90a82b829960fd"
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
x-amz-meta-created-unix-time-millis: 1644941386128
cache-control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900
x-evy-trace-virtual-host: all
x-hs-cf-lambda-enforce: us-east-1.EnforceAclForReads 3
date: Wed, 26 Jun 2024 02:14:19 GMT
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-amz-cf-pop: IAD61-P1
x-hs-alternate-content-type: text/plain
x-hubspot-correlation-id: e77e5727-b408-4997-9a6a-e88d798bbd10
x-envoy-upstream-service-time: 161
alt-svc: h3=":443"; ma=86400
x-evy-trace-route-configuration: listener_https/all
x-request-id: e77e5727-b408-4997-9a6a-e88d798bbd10
last-modified: Tue, 15 Feb 2022 16:09:47 GMT
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=FZxYS4DtWVcLuaV%2FW1nT9k7EAVnNyuQr8H1KGUpED%2BaXuggJKO8EoEOZrxapQyay3JMCFhR6ME%2BKTlfxmet9rYgIdFXOG0WTvTeCJL2CaGw24xxD3PfChE4Be56vBX94woA%3D"}],"group":"cf-nel","max_age":604800}
x-evy-trace-served-by-pod: iad02/cms-cdn2-td/envoy-proxy-64d59778d6-f6gc6
cf-ray: 8999aee19abc90fb-FRA
timing-allow-origin: cdn2.hubspot.net

GET
H3 200 module_41682410610_CR_-_Malicious_Life_Network_--_Main_Hero.min.js Show response
cdn2.hubspot.net/hub/3354902/hub_generated/module_assets/41682410610/1644941443113/ 305 B
1 KB 26ms
26ms Script
application/javascript 104.18.88.62
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn2.hubspot.net/hub/3354902/hub_generated/module_assets/41682410610/1644941443113/module_41682410610_CR_-_Malicious_Life_Network_--_Main_Hero.min.js
Requested by: Host: www.cybereason.com
URL: https://www.cybereason.com/blog/i-am-goot-loader
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.88.62 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 66ba9d76c09ad6dd52135d52c368f6d87ac40b5b4ce418e41a105fb221c7e470

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://www.cybereason.com/blog/i-am-goot-loader
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

content-encoding: br
age: 1246742
x-evy-trace-route-service-name: envoyset-translator
x-amz-server-side-encryption: AES256
x-amz-replication-status: COMPLETED
x-hs-cf-lambda: us-east-1.EnforceAclForReads 3
x-evy-trace-listener: listener_https
etag: W/"86f1ecf1077302d6bd359676a0142438"
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
x-amz-meta-created-unix-time-millis: 1644941443113
cache-control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900
x-evy-trace-virtual-host: all
x-hs-cf-lambda-enforce: us-east-1.EnforceAclForReads 3
date: Wed, 26 Jun 2024 02:14:19 GMT
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-amz-cf-pop: IAD89-C1
x-hs-alternate-content-type: text/plain
x-hubspot-correlation-id: 3bcf7d09-07a4-4645-9b5e-1fc9711d2695
x-envoy-upstream-service-time: 199
alt-svc: h3=":443"; ma=86400
x-evy-trace-route-configuration: listener_https/all
x-request-id: 3bcf7d09-07a4-4645-9b5e-1fc9711d2695
last-modified: Tue, 15 Feb 2022 16:10:44 GMT
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Rdv3WN1U0AaE6foWNLC7Db2603l5ZtNZAlF3Mkai1amCc6Htz3UNT%2FOrIcuxCyX0keRMcZcWrRGh%2BW4Rl213x%2FcQ9S1dNCs5Tc%2Fi117ARJt62lk3BFOkgXt8m2O6BRoznsk%3D"}],"group":"cf-nel","max_age":604800}
x-evy-trace-served-by-pod: iad02/cms-cdn2-td/envoy-proxy-64d59778d6-f6gc6
cf-ray: 8999aee1bacc90fb-FRA
timing-allow-origin: cdn2.hubspot.net

GET
H3 200 module_43300360745_CR_-_Malicious_Life_Network_--_Related_Posts.min.js Show response
cdn2.hubspot.net/hub/3354902/hub_generated/module_assets/43300360745/1649424828285/ 401 B
1 KB 24ms
24ms Script
application/javascript 104.18.88.62
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn2.hubspot.net/hub/3354902/hub_generated/module_assets/43300360745/1649424828285/module_43300360745_CR_-_Malicious_Life_Network_--_Related_Posts.min.js
Requested by: Host: www.cybereason.com
URL: https://www.cybereason.com/blog/i-am-goot-loader
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.88.62 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: fe9ce59aa6f3f2c6d0be658bec3e8515959f544fed27adc4506480cb9ead5157

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://www.cybereason.com/blog/i-am-goot-loader
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

content-encoding: br
age: 467207
x-evy-trace-route-service-name: envoyset-translator
x-amz-server-side-encryption: AES256
x-amz-replication-status: COMPLETED
x-hs-cf-lambda: us-east-1.EnforceAclForReads 3
x-evy-trace-listener: listener_https
etag: W/"c559951fe9a2b257ae98f9aeb1c4d6a2"
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
x-amz-meta-created-unix-time-millis: 1649424828285
cache-control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900
x-evy-trace-virtual-host: all
x-hs-cf-lambda-enforce: us-east-1.EnforceAclForReads 3
date: Wed, 26 Jun 2024 02:14:19 GMT
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-amz-cf-pop: IAD89-C1
x-hs-alternate-content-type: text/plain
x-hubspot-correlation-id: abf8e117-45ab-488d-914e-b154cf800dfc
x-envoy-upstream-service-time: 176
alt-svc: h3=":443"; ma=86400
x-evy-trace-route-configuration: listener_https/all
x-request-id: abf8e117-45ab-488d-914e-b154cf800dfc
last-modified: Fri, 08 Apr 2022 13:33:49 GMT
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=sEa7JYiV2VRh0uotRWVo0lLuA%2F7dpDUTJsnI5pzdvUdVvUtXmRVNorpm7EzbEtUvxSn2Bnz2%2BxxcvQmPzulVK%2FxpfwNwQ5CyzwqiVrUCIcu1oogxMr8twuMoFOei5aQ8jsQ%3D"}],"group":"cf-nel","max_age":604800}
x-evy-trace-served-by-pod: iad02/cms-cdn2-td/envoy-proxy-64d59778d6-jrv7z
cf-ray: 8999aee1eadd90fb-FRA
timing-allow-origin: cdn2.hubspot.net

GET
H3 200 module_86933076631_CR_-_Sticky_CTA_Bar.min.js Show response
cdn2.hubspot.net/hub/3354902/hub_generated/module_assets/86933076631/1669911113440/ 694 B
1 KB 25ms
25ms Script
application/javascript 104.18.88.62
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn2.hubspot.net/hub/3354902/hub_generated/module_assets/86933076631/1669911113440/module_86933076631_CR_-_Sticky_CTA_Bar.min.js
Requested by: Host: www.cybereason.com
URL: https://www.cybereason.com/blog/i-am-goot-loader
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.88.62 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 65a923b747d84787bc4e01270fa29f4314d3d36df432cd3eb801c30f8adfd466

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://www.cybereason.com/blog/i-am-goot-loader
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

content-encoding: br
age: 1240095
x-evy-trace-route-service-name: envoyset-translator
x-amz-server-side-encryption: AES256
x-amz-replication-status: COMPLETED
x-hs-cf-lambda: us-east-1.EnforceAclForReads 3
x-evy-trace-listener: listener_https
etag: W/"de347f1a06cbb5270942bfc43d48cf48"
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
x-amz-meta-created-unix-time-millis: 1669911113440
cache-control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900
x-evy-trace-virtual-host: all
x-hs-cf-lambda-enforce: us-east-1.EnforceAclForReads 3
date: Wed, 26 Jun 2024 02:14:19 GMT
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-amz-cf-pop: IAD61-P1
x-hs-alternate-content-type: text/plain
x-hubspot-correlation-id: 0c43b6ed-fd1a-4249-b609-a8625edb811d
x-amz-storage-class: INTELLIGENT_TIERING
x-envoy-upstream-service-time: 269
alt-svc: h3=":443"; ma=86400
x-evy-trace-route-configuration: listener_https/all
x-request-id: 0c43b6ed-fd1a-4249-b609-a8625edb811d
last-modified: Thu, 01 Dec 2022 16:11:54 GMT
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=y4uzzWfxNQWgA191zbZ%2FnA%2BRIomoP7bAp88LNThNZvBsbW0J4OKtSrOMU4E%2FBwqSfmtdcTB8xFP3QoOIiuwxU55r7G2kIOx7Mc48X2bcb1Y%2FkoBR2frYmIyWT7x4wE38TDs%3D"}],"group":"cf-nel","max_age":604800}
x-evy-trace-served-by-pod: iad02/cms-cdn2-td/envoy-proxy-b79697d9-vsnvs
cf-ray: 8999aee21aee90fb-FRA
timing-allow-origin: cdn2.hubspot.net

GET
H2 200 3354902.js Show response
www.cybereason.com/hs/scriptloader/ 2 KB
852 B 342ms
341ms Script
application/javascript 45.60.107.106
INCAPSULA

General

Check archive.org

Show headers Download Go to

Full URL

https://www.cybereason.com/hs/scriptloader/3354902.js

Requested by

Host: www.cybereason.com
URL: https://www.cybereason.com/blog/i-am-goot-loader

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

45.60.107.106 , United States, ASN19551 (INCAPSULA, US),

Reverse DNS

Software

Resource Hash

471396e29b06693a8ac67bdea63c6c03bb251d4fcd52d3203e20897642f25f79

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://www.cybereason.com/blog/i-am-goot-loader
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 26 Jun 2024 02:14:18 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
last-modified: Wed, 26 Jun 2024 02:11:17 GMT
x-cdn: Imperva
etag: "a3cb76a2"
content-type: application/javascript;charset=utf-8
x-iinfo: 0-3675347-3671190 3CNN RT(1719368058113 1127) q(0 0 0 -1) r(2 2)
cache-control: max-age=20, public
content-length: 645
expires: Wed, 26 Jun 2024 02:14:38 GMT

GET
H2 200 index.js Show response
www.cybereason.com/hs/hsstatic/HubspotToolsMenu/static-1.321/js/ 12 KB
4 KB 217ms
216ms Script
application/javascript 45.60.107.106
INCAPSULA

General

Check archive.org

Show headers Download Go to

Full URL

https://www.cybereason.com/hs/hsstatic/HubspotToolsMenu/static-1.321/js/index.js

Requested by

Host: www.cybereason.com
URL: https://www.cybereason.com/blog/i-am-goot-loader

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

45.60.107.106 , United States, ASN19551 (INCAPSULA, US),

Reverse DNS

Software

Resource Hash

f826bcac220a5475477ee65fae659b0d8292d038d180a122df67fadb6742ed52

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://www.cybereason.com/blog/i-am-goot-loader
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 26 Jun 2024 02:14:19 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
last-modified: Wed, 20 Mar 2024 15:59:57 GMT
x-cdn: Imperva
etag: W/"5885ac5129ee80f8b7e1e228e142587d"
content-type: application/javascript
x-iinfo: 0-3675347-0 0CNN RT(1719368058113 1129) q(0 -1 -1 -1) r(0 -1)
cache-control: max-age=27318406, public
content-length: 4307
expires: Thu, 08 May 2025 06:41:05 GMT

GET
H2 200 _Incapsula_Resource Show response
www.cybereason.com/ 145 KB
20 KB 220ms
218ms Script
application/javascript 45.60.107.106
INCAPSULA

General

Check archive.org

Show headers Download Go to

Full URL

https://www.cybereason.com/_Incapsula_Resource?SWJIYLWA=719d34d31c8e3a6e6fffd425f7e032f3&ns=1&cb=1558121308

Requested by

Host: www.cybereason.com
URL: https://www.cybereason.com/blog/i-am-goot-loader

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

45.60.107.106 , United States, ASN19551 (INCAPSULA, US),

Reverse DNS

Software

Resource Hash

2746bfb43c93f079e563d17726cb1ff69a63464ffa03b89c0f0427e11585d864

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://www.cybereason.com/blog/i-am-goot-loader
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
cache-control: no-cache, no-store
content-encoding: gzip
x-robots-tag: noindex
content-length: 20771
content-type: application/javascript

GET
H3 200 animate.min.css
cdnjs.cloudflare.com/ajax/libs/animate.css/4.1.1/ 70 KB
5 KB 16ms
15ms Stylesheet
text/css 104.17.24.14
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/animate.css/4.1.1/animate.min.css

Requested by

Host: cdn2.hubspot.net
URL: https://cdn2.hubspot.net/hub/3354902/hub_generated/template_assets/34470477360/1710134689941/__CR_Web_Platform/CSS/cr-master__main.min.css

Protocol

Security

QUIC, , AES_128_GCM

Server

104.17.24.14 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5fbaeb9f8e25d7e0143bae61d4b1802c16ce7390b96ceb2d498b0d96ff4c853f

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://cdn2.hubspot.net/hub/3354902/hub_generated/template_assets/34470477360/1710134689941/__CR_Web_Platform/CSS/cr-master__main.min.css
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 26 Jun 2024 02:14:19 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
age: 474863
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 4216
last-modified: Mon, 07 Sep 2020 12:33:38 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5f5628a2-11846"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=FikkWOhiI5kbm5fX%2F0J3sgALI%2FzfsyF2xzGVxxymyoSiqidmJTlUl%2FDUAeJojamAKYlK2zPdRiqqvtsslY9mW%2BPv1Y80Hodj23c9N2DSYpw8LzJWEJN2mMtcY%2BBeKN5m4Iu1uml3"}],"group":"cf-nel","max_age":604800}
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 8999aee31e2e9176-FRA
expires: Mon, 16 Jun 2025 02:14:19 GMT

GET
H2 200 css2
fonts.googleapis.com/ 21 KB
1007 B 17ms
16ms Stylesheet
text/css 2a00:1450:4001:81d::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Barlow:ital,wght@0,100;0,200;0,300;0,400;0,500;0,600;0,700;0,800;0,900;1,100;1,200;1,300;1,400;1,500;1,600;1,700;1,800;1,900&display=swap

Requested by

Host: cdn2.hubspot.net
URL: https://cdn2.hubspot.net/hub/3354902/hub_generated/template_assets/34470477360/1710134689941/__CR_Web_Platform/CSS/cr-master__main.min.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81d::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

0f62e3e5f677efe75860052589b895e2252887cb0831bec361b5130ea2a67bc0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://cdn2.hubspot.net/hub/3354902/hub_generated/template_assets/34470477360/1710134689941/__CR_Web_Platform/CSS/cr-master__main.min.css
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

strict-transport-security: max-age=31536000
date: Wed, 26 Jun 2024 02:14:19 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Wed, 26 Jun 2024 01:44:16 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Wed, 26 Jun 2024 02:14:19 GMT

GET
H2 200 css2
fonts.googleapis.com/ 22 KB
1006 B 17ms
17ms Stylesheet
text/css 2a00:1450:4001:81d::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Barlow+Condensed:ital,wght@0,100;0,200;0,300;0,400;0,500;0,600;0,700;0,800;0,900;1,100;1,200;1,300;1,400;1,500;1,600;1,700;1,800;1,900&display=swap

Requested by

Host: cdn2.hubspot.net
URL: https://cdn2.hubspot.net/hub/3354902/hub_generated/template_assets/34470477360/1710134689941/__CR_Web_Platform/CSS/cr-master__main.min.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81d::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

b66b9b351cf699e4269a636d7dc515b51aaadbcf14af4a756d8a00b1929e9fe0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://cdn2.hubspot.net/hub/3354902/hub_generated/template_assets/34470477360/1710134689941/__CR_Web_Platform/CSS/cr-master__main.min.css
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

strict-transport-security: max-age=31536000
date: Wed, 26 Jun 2024 02:14:19 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Wed, 26 Jun 2024 02:10:04 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Wed, 26 Jun 2024 02:14:19 GMT

GET
H2 200 css2
fonts.googleapis.com/ 78 KB
3 KB 20ms
20ms Stylesheet
text/css 2a00:1450:4001:81d::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Barlow:ital,wght@0,100;0,200;0,300;0,400;0,500;0,600;0,700;0,800;0,900;1,100;1,200;1,300;1,400;1,500;1,600;1,700;1,800;1,900&family=Open+Sans:ital,wght@0,300;0,400;0,600;0,700;0,800;1,300;1,400;1,600;1,700;1,800&display=swap

Requested by

Host: cdn2.hubspot.net
URL: https://cdn2.hubspot.net/hub/3354902/hub_generated/template_assets/34470477360/1710134689941/__CR_Web_Platform/CSS/cr-master__main.min.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81d::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

d2733f3936960eead81ec9f71738a38869367d6711831096d3aad134338c2795

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://cdn2.hubspot.net/hub/3354902/hub_generated/template_assets/34470477360/1710134689941/__CR_Web_Platform/CSS/cr-master__main.min.css
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

strict-transport-security: max-age=31536000
date: Wed, 26 Jun 2024 02:14:19 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Wed, 26 Jun 2024 02:14:19 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Wed, 26 Jun 2024 02:14:19 GMT

GET
H3 200 cr-master__cta.min.css
cdn2.hubspot.net/hub/3354902/hub_generated/template_assets/34470223313/1696396395659/__CR_Web_Platform/CSS/ 3 KB
1 KB 27ms
26ms Other
text/css 104.18.88.62
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn2.hubspot.net/hub/3354902/hub_generated/template_assets/34470223313/1696396395659/__CR_Web_Platform/CSS/cr-master__cta.min.css
Requested by: Host: www.cybereason.com
URL: https://www.cybereason.com/blog/i-am-goot-loader
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.88.62 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0c33072c2e37faa2b2acd3f76a15c44139cadb7999ec9405382b67eab4161003

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://www.cybereason.com/blog/i-am-goot-loader
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

content-encoding: gzip
age: 1236624
x-evy-trace-route-service-name: envoyset-translator
x-amz-server-side-encryption: AES256
x-amz-replication-status: COMPLETED
x-hs-cf-lambda: us-east-1.EnforceAclForReads 3
x-evy-trace-listener: listener_https
etag: W/"008f2c66892c6d50330665f22668fc4b"
vary: Accept-Encoding
access-control-allow-methods: GET
x-amz-meta-created-unix-time-millis: 1696396396421
access-control-allow-origin: *
x-evy-trace-virtual-host: all
content-type: text/css
cache-control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900
x-hs-cf-lambda-enforce: us-east-1.EnforceAclForReads 3
date: Wed, 26 Jun 2024 02:14:19 GMT
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-amz-cf-pop: IAD89-C1
x-hs-alternate-content-type: text/plain
x-hubspot-correlation-id: 1717b0c3-f670-43ad-a262-099698f14526
x-amz-storage-class: INTELLIGENT_TIERING
x-envoy-upstream-service-time: 240
alt-svc: h3=":443"; ma=86400
x-evy-trace-route-configuration: listener_https/all
x-request-id: 1717b0c3-f670-43ad-a262-099698f14526
last-modified: Wed, 04 Oct 2023 05:13:17 GMT
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2BSxk7PD2kE3E7WaNwnl2fyWN9k39c%2BponYcdtuXpJUuldHGufOGvoZCic5hrp6mO6HUa02Ne9kpcyZaP6dUeW4c2%2Fur8kFj9kfXnYJhHDMbLhxZP4NEFYGkdBOt75ATw2gc%3D"}],"group":"cf-nel","max_age":604800}
x-evy-trace-served-by-pod: iad02/cms-cdn2-td/envoy-proxy-5745477c8b-xgsnc
cf-ray: 8999aee34b6a90fb-FRA
timing-allow-origin: cdn2.hubspot.net

GET
H3 200 ionicons.min.css
cdn2.hubspot.net/hub/3354902/hub_generated/template_assets/35275979682/1642096258129/__CR_Web_Platform/CSS/ 50 KB
1019 B 29ms
28ms Other
text/css 104.18.88.62
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn2.hubspot.net/hub/3354902/hub_generated/template_assets/35275979682/1642096258129/__CR_Web_Platform/CSS/ionicons.min.css
Requested by: Host: www.cybereason.com
URL: https://www.cybereason.com/blog/i-am-goot-loader
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.88.62 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 28d99ad8103f148a1cf63a25d1369e0bd7d220f97ca36ac12cf8a8c7b2060fcc

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://www.cybereason.com/blog/i-am-goot-loader
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

content-encoding: gzip
age: 1236624
x-evy-trace-route-service-name: envoyset-translator
x-amz-server-side-encryption: AES256
x-amz-replication-status: COMPLETED
x-hs-cf-lambda: us-east-1.EnforceAclForReads 3
x-evy-trace-listener: listener_https
etag: W/"71c8c946791f3411c42a4cb1e9cdb5ed"
vary: Accept-Encoding
access-control-allow-methods: GET
x-amz-meta-created-unix-time-millis: 1642096258332
access-control-allow-origin: *
x-evy-trace-virtual-host: all
content-type: text/css
cache-control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900
x-hs-cf-lambda-enforce: us-east-1.EnforceAclForReads 3
date: Wed, 26 Jun 2024 02:14:19 GMT
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-amz-cf-pop: IAD89-C1
x-hs-alternate-content-type: text/plain
x-hubspot-correlation-id: 36ee93fa-d93d-4482-b55b-55ab8cc53a0f
x-envoy-upstream-service-time: 239
alt-svc: h3=":443"; ma=86400
x-evy-trace-route-configuration: listener_https/all
x-request-id: 36ee93fa-d93d-4482-b55b-55ab8cc53a0f
last-modified: Thu, 13 Jan 2022 17:50:59 GMT
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=1jyXfaxAycif09nUb0riKi4%2FMJVQ%2BrF0l9zjKw%2Fvo%2FGOP%2FJc5eRl1fduGBXPaHa9%2FoW6XtLq1l3XLkcQ0WlBvhmotNP%2F4F1MT4J%2BpprJ8AWPyG2dx7GC9NQruLfaGwy2ges%3D"}],"group":"cf-nel","max_age":604800}
x-evy-trace-served-by-pod: iad02/cms-cdn2-td/envoy-proxy-64786dc485-64hnd
cf-ray: 8999aee34b6b90fb-FRA
timing-allow-origin: cdn2.hubspot.net

GET
H3 200 cr-framework__bulma-columns.min.css
cdn2.hubspot.net/hub/3354902/hub_generated/template_assets/34470224480/1635957556830/__CR_Web_Platform/CSS/bulma/ 19 KB
1018 B 25ms
24ms Other
text/css 104.18.88.62
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn2.hubspot.net/hub/3354902/hub_generated/template_assets/34470224480/1635957556830/__CR_Web_Platform/CSS/bulma/cr-framework__bulma-columns.min.css
Requested by: Host: www.cybereason.com
URL: https://www.cybereason.com/blog/i-am-goot-loader
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.88.62 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 81c836c05ab1f2d37b7aa60d509a656c7a441e2a4fabf035c1b0666a4daa50fa

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://www.cybereason.com/blog/i-am-goot-loader
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

content-encoding: gzip
age: 1241947
x-evy-trace-route-service-name: envoyset-translator
x-amz-server-side-encryption: AES256
x-amz-replication-status: COMPLETED
x-hs-cf-lambda: us-east-1.EnforceAclForReads 3
x-evy-trace-listener: listener_https
etag: W/"636c18615b58fca9536b2e1c578c6db7"
vary: Accept-Encoding
access-control-allow-methods: GET
x-amz-meta-created-unix-time-millis: 1635957556893
access-control-allow-origin: *
x-evy-trace-virtual-host: all
content-type: text/css
cache-control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900
x-hs-cf-lambda-enforce: us-east-1.EnforceAclForReads 3
date: Wed, 26 Jun 2024 02:14:19 GMT
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-amz-cf-pop: IAD89-C1
x-hs-alternate-content-type: text/plain
x-hubspot-correlation-id: 1a5a1c86-a268-4356-9638-7bb06c550a9b
x-envoy-upstream-service-time: 217
alt-svc: h3=":443"; ma=86400
x-evy-trace-route-configuration: listener_https/all
x-request-id: 1a5a1c86-a268-4356-9638-7bb06c550a9b
last-modified: Wed, 03 Nov 2021 16:39:17 GMT
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=F9r%2FhA6AdBEYO4BW%2F6Ym7uy2hmOaQS369ErS8ec%2BUMCfGWaKkmu0FVpdtzT6z8SNRZ93XzvyhqZ%2B6ECwN%2FnGQI%2BIooS64uxxhKkmL0KjnjIv4cugKCLLLvLctYvHFnHyQiw%3D"}],"group":"cf-nel","max_age":604800}
x-evy-trace-served-by-pod: iad02/cms-cdn2-td/envoy-proxy-5896745bbb-7fw4c
cf-ray: 8999aee34b6c90fb-FRA
timing-allow-origin: cdn2.hubspot.net

GET
H3 200 cr-framework__bulma.min.css
cdn2.hubspot.net/hub/3354902/hub_generated/template_assets/35291999472/1696396871390/__CR_Web_Platform/CSS/bulma/ 62 KB
1 KB 30ms
29ms Other
text/css 104.18.88.62
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn2.hubspot.net/hub/3354902/hub_generated/template_assets/35291999472/1696396871390/__CR_Web_Platform/CSS/bulma/cr-framework__bulma.min.css
Requested by: Host: www.cybereason.com
URL: https://www.cybereason.com/blog/i-am-goot-loader
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.88.62 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 85ce42d99ae7d93a9df2304eedc16e1b26d492c38f5b9d034ea5c09c8a996c8f

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://www.cybereason.com/blog/i-am-goot-loader
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

content-encoding: gzip
age: 1241947
x-evy-trace-route-service-name: envoyset-translator
x-amz-server-side-encryption: AES256
x-amz-replication-status: COMPLETED
x-hs-cf-lambda: us-east-1.EnforceAclForReads 3
x-evy-trace-listener: listener_https
etag: W/"d320036a903c067c37b9ccf5619f0cb2"
vary: Accept-Encoding
access-control-allow-methods: GET
x-amz-meta-created-unix-time-millis: 1696396872359
access-control-allow-origin: *
x-evy-trace-virtual-host: all
content-type: text/css
cache-control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900
x-hs-cf-lambda-enforce: us-east-1.EnforceAclForReads 3
date: Wed, 26 Jun 2024 02:14:19 GMT
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-amz-cf-pop: IAD89-C1
x-hs-alternate-content-type: text/plain
x-hubspot-correlation-id: 16099d8e-f982-4db4-9464-039624da113d
x-amz-storage-class: INTELLIGENT_TIERING
x-envoy-upstream-service-time: 205
alt-svc: h3=":443"; ma=86400
x-evy-trace-route-configuration: listener_https/all
x-request-id: 16099d8e-f982-4db4-9464-039624da113d
last-modified: Wed, 04 Oct 2023 05:21:13 GMT
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=9F7XyaXRAyr6cGxnyyOmx5zhLtOeSxYrpA5lY2sfIb3Iz7AsAFc%2FukNrOsy1dUi1leh24VyCnJBwntkmD3RC1jqlljdQSfPVR%2F0UC%2BejQApzfz%2BAfzB83r%2F6zWxNZrFBbV4%3D"}],"group":"cf-nel","max_age":604800}
x-evy-trace-served-by-pod: iad02/cms-cdn2-td/envoy-proxy-64d59778d6-jrv7z
cf-ray: 8999aee34b6d90fb-FRA
timing-allow-origin: cdn2.hubspot.net

GET
H3 200 hamburger-animation.min.css
cdn2.hubspot.net/hub/3354902/hub_generated/template_assets/42363645447/1635957556555/__CR_Web_Platform/CSS/ 22 KB
1011 B 32ms
31ms Other
text/css 104.18.88.62
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn2.hubspot.net/hub/3354902/hub_generated/template_assets/42363645447/1635957556555/__CR_Web_Platform/CSS/hamburger-animation.min.css
Requested by: Host: www.cybereason.com
URL: https://www.cybereason.com/blog/i-am-goot-loader
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.88.62 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c9130ee8c979a74ab038cf5e8a06db5cb94253eab35ea5242f515d605f4781ad

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://www.cybereason.com/blog/i-am-goot-loader
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

content-encoding: gzip
age: 1246742
x-evy-trace-route-service-name: envoyset-translator
x-amz-server-side-encryption: AES256
x-amz-replication-status: COMPLETED
x-hs-cf-lambda: us-east-1.EnforceAclForReads 3
x-evy-trace-listener: listener_https
etag: W/"a0b451fd96744fa455495e022542ab86"
vary: Accept-Encoding
access-control-allow-methods: GET
x-amz-meta-created-unix-time-millis: 1635957556622
access-control-allow-origin: *
x-evy-trace-virtual-host: all
content-type: text/css
cache-control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900
x-hs-cf-lambda-enforce: us-east-1.EnforceAclForReads 3
date: Wed, 26 Jun 2024 02:14:19 GMT
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-amz-cf-pop: IAD61-P1
x-hs-alternate-content-type: text/plain
x-hubspot-correlation-id: 3282a97e-58d6-42f8-a9e9-19c3984a060b
x-envoy-upstream-service-time: 179
alt-svc: h3=":443"; ma=86400
x-evy-trace-route-configuration: listener_https/all
x-request-id: 3282a97e-58d6-42f8-a9e9-19c3984a060b
last-modified: Wed, 03 Nov 2021 16:39:17 GMT
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Pba48bTWuRsb2C0geccYNQnPTal7fPSA3XWtcw1A6xLboK%2BvQIoIAg2P6XhNwSpk1CwLohF30LszW1U8uJYDQ4NN6XpExSbvYfzg6VftM%2BO738Low0bj9Eo279GbkWXRp8k%3D"}],"group":"cf-nel","max_age":604800}
x-evy-trace-served-by-pod: iad02/cms-cdn2-td/envoy-proxy-64d59778d6-f6gc6
cf-ray: 8999aee34b6e90fb-FRA
timing-allow-origin: cdn2.hubspot.net

GET
H3 200 animate.min.css
cdn2.hubspot.net/hub/3354902/hub_generated/template_assets/42507091846/1635957557027/__CR_Web_Platform/CSS/ 52 KB
1012 B 26ms
25ms Other
text/css 104.18.88.62
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn2.hubspot.net/hub/3354902/hub_generated/template_assets/42507091846/1635957557027/__CR_Web_Platform/CSS/animate.min.css
Requested by: Host: www.cybereason.com
URL: https://www.cybereason.com/blog/i-am-goot-loader
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.88.62 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b48f9a7031474a0f73f92f2e6cbbfad730b5466cda96d86a4459c06efc986173

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://www.cybereason.com/blog/i-am-goot-loader
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

content-encoding: gzip
age: 1238614
x-evy-trace-route-service-name: envoyset-translator
x-amz-server-side-encryption: AES256
x-amz-replication-status: COMPLETED
x-hs-cf-lambda: us-east-1.EnforceAclForReads 3
x-evy-trace-listener: listener_https
etag: W/"55009d64191e6f9e712a841773ee6611"
vary: Accept-Encoding
access-control-allow-methods: GET
x-amz-meta-created-unix-time-millis: 1635957557027
access-control-allow-origin: *
x-evy-trace-virtual-host: all
content-type: text/css
cache-control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900
x-hs-cf-lambda-enforce: us-east-1.EnforceAclForReads 3
date: Wed, 26 Jun 2024 02:14:19 GMT
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-amz-cf-pop: IAD89-C1
x-hs-alternate-content-type: text/plain
x-hubspot-correlation-id: a8a7872d-3e2b-4216-b8b8-465b48e8dd51
x-envoy-upstream-service-time: 161
alt-svc: h3=":443"; ma=86400
x-evy-trace-route-configuration: listener_https/all
x-request-id: a8a7872d-3e2b-4216-b8b8-465b48e8dd51
last-modified: Wed, 03 Nov 2021 16:39:18 GMT
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=lx5FAN%2FgcZeRrlDpbqhLAzXTq4sSnGGTvo2ZyBvoLB2ZwcaerUU6YJm65QPtjE76mNEQ7%2F2DRGO3LjOa0OrmlkouqfKWwtTjQBgOsbEEoEqeAhjFbS06REmq7Vyf7Ls%2BGXc%3D"}],"group":"cf-nel","max_age":604800}
x-evy-trace-served-by-pod: iad02/cms-cdn2-td/envoy-proxy-c8b596779-qb4kw
cf-ray: 8999aee34b6f90fb-FRA
timing-allow-origin: cdn2.hubspot.net

GET
H2 200 cr-blog-hero-owl-transparent.png
www.cybereason.com/hubfs/dam/images/images-web/blog-images/template-images/ 670 KB
670 KB 210ms
210ms Image
image/png 45.60.107.106
INCAPSULA

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.cybereason.com/hubfs/dam/images/images-web/blog-images/template-images/cr-blog-hero-owl-transparent.png

Requested by

Host: cdn2.hubspot.net
URL: https://cdn2.hubspot.net/hub/3354902/hub_generated/module_assets/41682410610/1644941443237/module_41682410610_CR_-_Malicious_Life_Network_--_Main_Hero.min.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

45.60.107.106 , United States, ASN19551 (INCAPSULA, US),

Reverse DNS

Software

Resource Hash

266d85b7ad351501b8651b0e659d6d74fbe07085d3226cd3f7601f6522fbdf97

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://cdn2.hubspot.net/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 26 Jun 2024 02:14:19 GMT
strict-transport-security: max-age=31536000; includeSubDomains
last-modified: Fri, 19 Feb 2021 04:27:31 GMT
x-cdn: Imperva
etag: "cd208635457bf65f33aa7c8849efcf21"
content-type: image/png
x-iinfo: 0-3675347-0 0CNN RT(1719368058113 1137) q(0 -1 -1 -1) r(0 -1)
cache-control: max-age=0, s-maxage=830498, public
content-length: 685987

GET
H2 200 cr-ml-sidebar-subscribe-bg.jpg
www.cybereason.com/hubfs/dam/images/images-web/backgrounds/ 34 KB
34 KB 208ms
208ms Image
image/jpeg 45.60.107.106
INCAPSULA

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.cybereason.com/hubfs/dam/images/images-web/backgrounds/cr-ml-sidebar-subscribe-bg.jpg

Requested by

Host: cdn2.hubspot.net
URL: https://cdn2.hubspot.net/hub/3354902/hub_generated/template_assets/42760289143/1663004429410/__CR_Web_Platform/CSS/cr-mln__build.min.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

45.60.107.106 , United States, ASN19551 (INCAPSULA, US),

Reverse DNS

Software

Resource Hash

9967a27efc89a8cefe9665100ec51cded3a8c89f95cdca1285bfce207666cd11

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://cdn2.hubspot.net/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 26 Jun 2024 02:14:19 GMT
strict-transport-security: max-age=31536000; includeSubDomains
last-modified: Thu, 31 Mar 2022 18:30:54 GMT
x-cdn: Imperva
etag: "c2444af5dedceb18b268a01a640beb72"
content-type: image/jpeg
x-iinfo: 0-3675347-0 0CNN RT(1719368058113 1138) q(0 -1 -1 -1) r(0 -1)
cache-control: max-age=0, s-maxage=839701, public
content-length: 34358

GET
H2 200 cr-mln-network__footer-subscribe-bg.png
www.cybereason.com/hubfs/dam/images/images-web/blog-images/template-images/ 38 KB
38 KB 209ms
209ms Image
image/png 45.60.107.106
INCAPSULA

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.cybereason.com/hubfs/dam/images/images-web/blog-images/template-images/cr-mln-network__footer-subscribe-bg.png

Requested by

Host: cdn2.hubspot.net
URL: https://cdn2.hubspot.net/hub/3354902/hub_generated/template_assets/42760289143/1663004429410/__CR_Web_Platform/CSS/cr-mln__build.min.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

45.60.107.106 , United States, ASN19551 (INCAPSULA, US),

Reverse DNS

Software

Resource Hash

38b5fa249791d286db654d516dfb6173cc332a8d725c41b58d08c642b26bc641

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://cdn2.hubspot.net/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 26 Jun 2024 02:14:19 GMT
strict-transport-security: max-age=31536000; includeSubDomains
last-modified: Wed, 10 Mar 2021 19:10:18 GMT
x-cdn: Imperva
etag: "c28026bc6a6d55f395e2227b7b19c8c9"
content-type: image/png
x-iinfo: 0-3675347-0 0CNN RT(1719368058113 1140) q(0 -1 -1 -1) r(0 -1)
cache-control: max-age=0, s-maxage=839701, public
content-length: 38595

GET
H2 200 ionicons.ttf
www.cybereason.com/hubfs/__dam/fonts/ 184 KB
107 KB 188ms
186ms Font
font/ttf 45.60.107.106
INCAPSULA

General

Check archive.org

Show headers Download Go to

Full URL

https://www.cybereason.com/hubfs/__dam/fonts/ionicons.ttf

Requested by

Host: cdn2.hubspot.net
URL: https://cdn2.hubspot.net/hub/3354902/hub_generated/template_assets/35275979682/1642096258129/__CR_Web_Platform/CSS/ionicons.min.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

45.60.107.106 , United States, ASN19551 (INCAPSULA, US),

Reverse DNS

Software

Resource Hash

2ba7f20b1d8990e17a47fe3d88e4c766628aaa2baf1dd30fca0a0db59836f5f9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://cdn2.hubspot.net/
Origin: https://www.cybereason.com
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 26 Jun 2024 02:14:19 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
last-modified: Fri, 25 Sep 2020 09:38:00 GMT
x-cdn: Imperva
etag: W/"24712f6c47821394fba7942fbb52c3b2"
content-type: font/ttf
x-iinfo: 0-3675347-0 0CNN RT(1719368058113 1176) q(0 -1 -1 -1) r(0 -1)
cache-control: max-age=0, s-maxage=795935, public
content-length: 109801

GET
H2 200 Criteria-CF-Bold.woff2
www.cybereason.com/hubfs/dam/fonts/criteria/ 14 KB
14 KB 189ms
188ms Font
application/font-woff2 45.60.107.106
INCAPSULA

General

Check archive.org

Show headers Download Go to

Full URL

https://www.cybereason.com/hubfs/dam/fonts/criteria/Criteria-CF-Bold.woff2

Requested by

Host: cdn2.hubspot.net
URL: https://cdn2.hubspot.net/hub/3354902/hub_generated/template_assets/34470477360/1710134689941/__CR_Web_Platform/CSS/cr-master__main.min.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

45.60.107.106 , United States, ASN19551 (INCAPSULA, US),

Reverse DNS

Software

Resource Hash

17a31aae550a664382ab9d8085efc03a10a4548985f33ac4e5a533d5ab5e9339

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://cdn2.hubspot.net/
Origin: https://www.cybereason.com
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 26 Jun 2024 02:14:19 GMT
strict-transport-security: max-age=31536000; includeSubDomains
last-modified: Thu, 13 Jan 2022 17:33:57 GMT
x-cdn: Imperva
etag: "ba487b98622054117d0be2f92f3f45b2"
content-type: application/font-woff2
x-iinfo: 0-3675347-0 0CNN RT(1719368058113 1178) q(0 -1 -1 -1) r(0 -1)
cache-control: max-age=0, s-maxage=795935, public
content-length: 14332

GET
H2 200 FlamCondBook.woff2
www.cybereason.com/hubfs/dam/fonts/flama/ 14 KB
14 KB 190ms
188ms Font
application/font-woff2 45.60.107.106
INCAPSULA

General

Check archive.org

Show headers Download Go to

Full URL

https://www.cybereason.com/hubfs/dam/fonts/flama/FlamCondBook.woff2

Requested by

Host: cdn2.hubspot.net
URL: https://cdn2.hubspot.net/hub/3354902/hub_generated/template_assets/34470477360/1710134689941/__CR_Web_Platform/CSS/cr-master__main.min.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

45.60.107.106 , United States, ASN19551 (INCAPSULA, US),

Reverse DNS

Software

Resource Hash

2ca281bdcd543e2e3559e6505c323c8d64df73f2a594a043780df3007e16d161

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://cdn2.hubspot.net/
Origin: https://www.cybereason.com
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 26 Jun 2024 02:14:19 GMT
strict-transport-security: max-age=31536000; includeSubDomains
last-modified: Fri, 10 Dec 2021 14:25:11 GMT
x-cdn: Imperva
etag: "9b97cc4b573f2e8b6ead12339a15b141"
content-type: application/font-woff2
x-iinfo: 0-3675347-0 0CNN RT(1719368058113 1180) q(0 -1 -1 -1) r(0 -1)
cache-control: max-age=0, s-maxage=795935, public
content-length: 14544

GET
H2 200 HTx3L3I-JCGChYJ8VI-L6OO_au7B6xHT2g.woff2
fonts.gstatic.com/s/barlowcondensed/v12/ 20 KB
20 KB 48ms
26ms Font
font/woff2 2a00:1450:4001:829::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/barlowcondensed/v12/HTx3L3I-JCGChYJ8VI-L6OO_au7B6xHT2g.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Barlow+Condensed:ital,wght@0,100;0,200;0,300;0,400;0,500;0,600;0,700;0,800;0,900;1,100;1,200;1,300;1,400;1,500;1,600;1,700;1,800;1,900&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

af91213cd670d6270b32ebdeb00a09625f6b74ccd780d12ff6724a14ea1efaff

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://fonts.googleapis.com/
Origin: https://www.cybereason.com
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 25 Jun 2024 22:08:34 GMT
x-content-type-options: nosniff
age: 14745
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 20200
x-xss-protection: 0
last-modified: Tue, 19 Apr 2022 18:28:11 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 25 Jun 2025 22:08:34 GMT

GET
H2 200 memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2
fonts.gstatic.com/s/opensans/v40/ 47 KB
47 KB 37ms
15ms Font
font/woff2 2a00:1450:4001:829::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Barlow:ital,wght@0,100;0,200;0,300;0,400;0,500;0,600;0,700;0,800;0,900;1,100;1,200;1,300;1,400;1,500;1,600;1,700;1,800;1,900&family=Open+Sans:ital,wght@0,300;0,400;0,600;0,700;0,800;1,300;1,400;1,600;1,700;1,800&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3c4d6a1421c7ddb7e404521fe8c4cd5be5af446d7689cd880be26612eaad3cfa

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://fonts.googleapis.com/
Origin: https://www.cybereason.com
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 25 Jun 2024 22:23:56 GMT
x-content-type-options: nosniff
age: 13823
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 48236
x-xss-protection: 0
last-modified: Thu, 14 Dec 2023 02:08:40 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 25 Jun 2025 22:23:56 GMT

GET
H2 200 memtYaGs126MiZpBA-UFUIcVXSCEkx2cmqvXlWqWuU6F.woff2
fonts.gstatic.com/s/opensans/v40/ 49 KB
50 KB 30ms
8ms Font
font/woff2 2a00:1450:4001:829::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v40/memtYaGs126MiZpBA-UFUIcVXSCEkx2cmqvXlWqWuU6F.woff2

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0d8601a776b7dc777cd23bc42392d05a43df0d6402328e8913b58811083b513d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://fonts.googleapis.com/
Origin: https://www.cybereason.com
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 25 Jun 2024 15:03:14 GMT
x-content-type-options: nosniff
age: 40265
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 50296
x-xss-protection: 0
last-modified: Thu, 14 Dec 2023 02:10:01 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 25 Jun 2025 15:03:14 GMT

GET
H2 200 HTxwL3I-JCGChYJ8VI-L6OO_au7B4-Lwz3bWuQ.woff2
fonts.gstatic.com/s/barlowcondensed/v12/ 20 KB
20 KB 51ms
29ms Font
font/woff2 2a00:1450:4001:829::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/barlowcondensed/v12/HTxwL3I-JCGChYJ8VI-L6OO_au7B4-Lwz3bWuQ.woff2

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2d2c4912162eaa41299aaf5063ecb92a26d76071fe6d1f77742b32c833daab99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://fonts.googleapis.com/
Origin: https://www.cybereason.com
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 25 Jun 2024 15:06:21 GMT
x-content-type-options: nosniff
age: 40078
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 20432
x-xss-protection: 0
last-modified: Tue, 19 Apr 2022 18:38:09 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 25 Jun 2025 15:06:21 GMT

GET
H2 200 HTxwL3I-JCGChYJ8VI-L6OO_au7B4873z3bWuQ.woff2
fonts.gstatic.com/s/barlowcondensed/v12/ 21 KB
21 KB 45ms
23ms Font
font/woff2 2a00:1450:4001:829::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/barlowcondensed/v12/HTxwL3I-JCGChYJ8VI-L6OO_au7B4873z3bWuQ.woff2

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0b281bf2f4179c06ba68f0a427f2341287c41eacc2ce9d534c6f5c513ac633fb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://fonts.googleapis.com/
Origin: https://www.cybereason.com
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 25 Jun 2024 15:06:21 GMT
x-content-type-options: nosniff
age: 40078
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 21352
x-xss-protection: 0
last-modified: Tue, 19 Apr 2022 18:30:34 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 25 Jun 2025 15:06:21 GMT

GET
H2 200 7cHqv4kjgoGqM7E30-8s51os.woff2
fonts.gstatic.com/s/barlow/v12/ 21 KB
21 KB 44ms
22ms Font
font/woff2 2a00:1450:4001:829::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/barlow/v12/7cHqv4kjgoGqM7E30-8s51os.woff2

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2b14e8397d552f351a4396dec25ec5da1348865683100e94c4ab0faea4a9a254

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://fonts.googleapis.com/
Origin: https://www.cybereason.com
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 25 Jun 2024 15:15:04 GMT
x-content-type-options: nosniff
age: 39555
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 21796
x-xss-protection: 0
last-modified: Tue, 19 Apr 2022 19:35:19 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 25 Jun 2025 15:15:04 GMT

GET
H2 200 7cHqv4kjgoGqM7E3t-4s51os.woff2
fonts.gstatic.com/s/barlow/v12/ 21 KB
21 KB 49ms
27ms Font
font/woff2 2a00:1450:4001:829::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/barlow/v12/7cHqv4kjgoGqM7E3t-4s51os.woff2

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

65a47caa5183b035bf78d0f93adbe5cea500333410259c54abf2de356740df7e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://fonts.googleapis.com/
Origin: https://www.cybereason.com
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 25 Jun 2024 14:42:05 GMT
x-content-type-options: nosniff
age: 41534
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 21724
x-xss-protection: 0
last-modified: Tue, 19 Apr 2022 19:29:44 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 25 Jun 2025 14:42:05 GMT

GET
H2 200 HOSP.woff2
www.cybereason.com/hubfs/dam/fonts/hsop/ 154 KB
154 KB 190ms
189ms Font
application/font-woff2 45.60.107.106
INCAPSULA

General

Check archive.org

Show headers Download Go to

Full URL

https://www.cybereason.com/hubfs/dam/fonts/hsop/HOSP.woff2

Requested by

Host: cdn2.hubspot.net
URL: https://cdn2.hubspot.net/hub/3354902/hub_generated/template_assets/34470477360/1710134689941/__CR_Web_Platform/CSS/cr-master__main.min.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

45.60.107.106 , United States, ASN19551 (INCAPSULA, US),

Reverse DNS

Software

Resource Hash

a6728e3326fe3805e12f697731cbc97f2a5b773533c1cb4be0c56da998a94db6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://cdn2.hubspot.net/
Origin: https://www.cybereason.com
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 26 Jun 2024 02:14:19 GMT
strict-transport-security: max-age=31536000; includeSubDomains
last-modified: Fri, 11 Feb 2022 15:12:37 GMT
x-cdn: Imperva
etag: "2ffd5c598df2d32b13ebd689e6daa668"
content-type: application/font-woff2
x-iinfo: 0-3675347-0 0CNN RT(1719368058113 1181) q(0 -1 -1 -1) r(0 -1)
cache-control: max-age=0, s-maxage=795936, public
content-length: 157664

GET
H2 200 goot-loader-blog-1.png
www.cybereason.com/hs-fs/hubfs/dam/images/images-web/blog-images/ 22 KB
23 KB 185ms
184ms Image
image/webp 45.60.107.106
INCAPSULA

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.cybereason.com/hs-fs/hubfs/dam/images/images-web/blog-images/goot-loader-blog-1.png?width=879&height=176&name=goot-loader-blog-1.png

Requested by

Host: www.cybereason.com
URL: https://www.cybereason.com/blog/i-am-goot-loader

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

45.60.107.106 , United States, ASN19551 (INCAPSULA, US),

Reverse DNS

Software

Resource Hash

366120e2326e2bdd429018ada075a3e1b3df7d776f74ae9fb98c7f666a0d632a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://www.cybereason.com/blog/i-am-goot-loader
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 26 Jun 2024 02:14:19 GMT
strict-transport-security: max-age=31536000; includeSubDomains
last-modified: Thu, 30 May 2024 15:18:49 GMT
x-cdn: Imperva
etag: "cf-DT7ne8yLHBW7f-ZYjoocaHN53osi7stuIxUBe7UDQ:76abd7df5a084a96053f5271c9411498"
content-type: image/webp
x-iinfo: 0-3675347-0 0CNN RT(1719368058113 1182) q(0 -1 -1 -1) r(0 -1)
cache-control: max-age=633531, s-maxage=2015931, public
content-length: 22840

GET
H3 200 animatedModal.min.js
cdn2.hubspot.net/hub/3354902/hub_generated/template_assets/42507089303/1644440411417/__CR_Web_Platform/JS/animatedModal/ 2 KB
1015 B 25ms
24ms Other
application/javascript 104.18.88.62
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn2.hubspot.net/hub/3354902/hub_generated/template_assets/42507089303/1644440411417/__CR_Web_Platform/JS/animatedModal/animatedModal.min.js
Requested by: Host: www.cybereason.com
URL: https://www.cybereason.com/blog/i-am-goot-loader
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.88.62 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0f94c946a13b9ebe43281550b7d0c00edf4694ad06bcb4c8679bee6d48df5115

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://www.cybereason.com/blog/i-am-goot-loader
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

content-encoding: br
age: 1240095
x-evy-trace-route-service-name: envoyset-translator
x-amz-server-side-encryption: AES256
x-amz-replication-status: COMPLETED
x-hs-cf-lambda: us-east-1.EnforceAclForReads 3
x-evy-trace-listener: listener_https
etag: W/"690ad93d1d2a9fc11f9df295692413fe"
vary: Accept-Encoding
access-control-allow-methods: GET
x-amz-meta-created-unix-time-millis: 1644440411792
access-control-allow-origin: *
x-evy-trace-virtual-host: all
content-type: application/javascript; charset=utf-8
cache-control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900
x-hs-cf-lambda-enforce: us-east-1.EnforceAclForReads 3
date: Wed, 26 Jun 2024 02:14:19 GMT
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-amz-cf-pop: IAD61-P1
x-hs-alternate-content-type: text/plain
x-hubspot-correlation-id: c96bd0b6-8507-47cd-b86c-1f5f5f70319f
x-envoy-upstream-service-time: 734
alt-svc: h3=":443"; ma=86400
x-evy-trace-route-configuration: listener_https/all
x-request-id: c96bd0b6-8507-47cd-b86c-1f5f5f70319f
last-modified: Wed, 09 Feb 2022 21:00:12 GMT
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=f%2Fo9QN%2BKhv2LJKSXzMqtA83bpwyYir%2B1T75mL8DwY2IDOrsQCEE7XrHNMrBXO%2FKmYHYkhD7K5A9fDs5IJHNygMJJLRQi3Clx4nwVfc4wMmsVWGk%2B6U5NnmEft5t8KAW2EDg%3D"}],"group":"cf-nel","max_age":604800}
x-evy-trace-served-by-pod: iad02/cms-cdn2-td/envoy-proxy-64d59778d6-jrv7z
cf-ray: 8999aee39b8690fb-FRA
timing-allow-origin: cdn2.hubspot.net

GET
H3 200 module_41681847227_CR_-_Malicious_Life_Network_--_Tier_One_Header.min.js
cdn2.hubspot.net/hub/3354902/hub_generated/module_assets/41681847227/1644941386128/ 374 B
1008 B 23ms
22ms Other
application/javascript 104.18.88.62
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn2.hubspot.net/hub/3354902/hub_generated/module_assets/41681847227/1644941386128/module_41681847227_CR_-_Malicious_Life_Network_--_Tier_One_Header.min.js
Requested by: Host: www.cybereason.com
URL: https://www.cybereason.com/blog/i-am-goot-loader
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.88.62 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 119bf322a2ce6d2a82422b51404bc54b375c881f12a120205598d1691fa48820

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://www.cybereason.com/blog/i-am-goot-loader
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

content-encoding: br
age: 1240095
x-evy-trace-route-service-name: envoyset-translator
x-amz-server-side-encryption: AES256
x-amz-replication-status: COMPLETED
x-hs-cf-lambda: us-east-1.EnforceAclForReads 3
x-evy-trace-listener: listener_https
etag: W/"1d7f81aaf24568ea5d90a82b829960fd"
vary: Accept-Encoding
access-control-allow-methods: GET
x-amz-meta-created-unix-time-millis: 1644941386128
access-control-allow-origin: *
x-evy-trace-virtual-host: all
content-type: application/javascript; charset=utf-8
cache-control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900
x-hs-cf-lambda-enforce: us-east-1.EnforceAclForReads 3
date: Wed, 26 Jun 2024 02:14:19 GMT
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-amz-cf-pop: IAD61-P1
x-hs-alternate-content-type: text/plain
x-hubspot-correlation-id: e77e5727-b408-4997-9a6a-e88d798bbd10
x-envoy-upstream-service-time: 161
alt-svc: h3=":443"; ma=86400
x-evy-trace-route-configuration: listener_https/all
x-request-id: e77e5727-b408-4997-9a6a-e88d798bbd10
last-modified: Tue, 15 Feb 2022 16:09:47 GMT
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=r0w0R0Y7xpe1i80864CuEaFLXwURG9MAXINK3yXvTGbEroV3RDR5QMvhZdb5W%2Bh1uokfYOZSpOluynQG7lLe16HjnrYBEnuTtZZzQodZrRymQEUKWFoGGBFHLx982at8Mdg%3D"}],"group":"cf-nel","max_age":604800}
x-evy-trace-served-by-pod: iad02/cms-cdn2-td/envoy-proxy-64d59778d6-f6gc6
cf-ray: 8999aee39b8790fb-FRA
timing-allow-origin: cdn2.hubspot.net

GET
H3 200 module_41682410610_CR_-_Malicious_Life_Network_--_Main_Hero.min.js
cdn2.hubspot.net/hub/3354902/hub_generated/module_assets/41682410610/1644941443113/ 305 B
1017 B 21ms
20ms Other
application/javascript 104.18.88.62
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn2.hubspot.net/hub/3354902/hub_generated/module_assets/41682410610/1644941443113/module_41682410610_CR_-_Malicious_Life_Network_--_Main_Hero.min.js
Requested by: Host: www.cybereason.com
URL: https://www.cybereason.com/blog/i-am-goot-loader
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.88.62 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 66ba9d76c09ad6dd52135d52c368f6d87ac40b5b4ce418e41a105fb221c7e470

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://www.cybereason.com/blog/i-am-goot-loader
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

content-encoding: br
age: 1246742
x-evy-trace-route-service-name: envoyset-translator
x-amz-server-side-encryption: AES256
x-amz-replication-status: COMPLETED
x-hs-cf-lambda: us-east-1.EnforceAclForReads 3
x-evy-trace-listener: listener_https
etag: W/"86f1ecf1077302d6bd359676a0142438"
vary: Accept-Encoding
access-control-allow-methods: GET
x-amz-meta-created-unix-time-millis: 1644941443113
access-control-allow-origin: *
x-evy-trace-virtual-host: all
content-type: application/javascript; charset=utf-8
cache-control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900
x-hs-cf-lambda-enforce: us-east-1.EnforceAclForReads 3
date: Wed, 26 Jun 2024 02:14:19 GMT
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-amz-cf-pop: IAD89-C1
x-hs-alternate-content-type: text/plain
x-hubspot-correlation-id: 3bcf7d09-07a4-4645-9b5e-1fc9711d2695
x-envoy-upstream-service-time: 199
alt-svc: h3=":443"; ma=86400
x-evy-trace-route-configuration: listener_https/all
x-request-id: 3bcf7d09-07a4-4645-9b5e-1fc9711d2695
last-modified: Tue, 15 Feb 2022 16:10:44 GMT
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=N9E6rikIgqQTaQSfwO%2Fdz5YZEdhCpB7eIqxraBs%2BNi8wZOOm25y7uHYVI8kbUZVuVNyQ%2FGfuuoVaJVmK9oA8mvhxLIt%2FWN7ldOQ3zyS06d0TtF40ACIjepHkhNsM%2BDkbM%2BU%3D"}],"group":"cf-nel","max_age":604800}
x-evy-trace-served-by-pod: iad02/cms-cdn2-td/envoy-proxy-64d59778d6-f6gc6
cf-ray: 8999aee39b8890fb-FRA
timing-allow-origin: cdn2.hubspot.net

GET
H2 200 sdk.js Show response
connect.facebook.net/en_GB/ 3 KB
4 KB 33ms
7ms Script
application/x-javascript 2a03:2880:f084:105:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_GB/sdk.js

Requested by

Host: www.cybereason.com
URL: https://www.cybereason.com/blog/i-am-goot-loader

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f084:105:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

d007331178e80dc9232205c02741fb76fb25d27d8df7a1dab38f46d04e4f670e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://www.cybereason.com/blog/i-am-goot-loader
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
date: Wed, 26 Jun 2024 02:14:19 GMT
content-md5: WUywxFo1FhkMiyR/uZ5PrQ==
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 1687
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
x-fb-connection-quality: EXCELLENT; q=0.9, rtt=5, rtx=0, c=12, mss=1297, tbw=2785, tp=-1, tpl=-1, uplat=0, ullat=-1
x-fb-debug: ogN5iBq75w622vr4LCCrqpZKrY2bpu1urovbQbT2Jk694hFdLNJXxv8XDEvH25c1PpxWCophi7Ww7QnbhcnE7g==
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
x-fb-content-md5: 8a47d0a05c77983c1e32c2e3de225c3c
cross-origin-opener-policy: same-origin-allow-popups;report-to="coop_report"
etag: "e35c8d37876653021afedca63728d3a2"
vary: Accept-Encoding
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: *
origin-agent-cluster: ?0
access-control-expose-headers: X-FB-Content-MD5
cache-control: public,max-age=1200,stale-while-revalidate=3600
permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), battery=(self), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), usb-unrestricted=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
x-frame-options: DENY
timing-allow-origin: *
expires: Wed, 26 Jun 2024 02:18:24 GMT

GET
H/1.1 200
OK widgets.js Show response
platform.twitter.com/ 91 KB
28 KB 50ms
6ms Script
application/javascript 2606:2800:234:46c:e8b:1e2f:2bd:694
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/widgets.js
Requested by: Host: www.cybereason.com
URL: https://www.cybereason.com/blog/i-am-goot-loader
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:234:46c:e8b:1e2f:2bd:694 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECS (frb/668B) /
Resource Hash: 173460e89e6a7244218badae2016f65c48a3eae9d400802273eeca18b07336f1

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://www.cybereason.com/blog/i-am-goot-loader
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Wed, 26 Jun 2024 02:14:19 GMT
Content-Encoding: gzip
Age: 1174
x-amz-server-side-encryption: AES256
X-Cache: HIT
P3P: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Server-Timing: x-cache;desc= HIT,x-tw-cdn;desc=VZ
Content-Length: 27597
Last-Modified: Mon, 11 Dec 2023 17:20:28 GMT
Server: ECS (frb/668B)
Etag: "824beb891744db98ccbd3a456e59e0f7+gzip"
Access-Control-Max-Age: 3000
Access-Control-Allow-Methods: GET
Content-Type: application/javascript; charset=utf-8
Access-Control-Allow-Origin: *
x-tw-cdn: VZ
Cache-Control: public, max-age=1800
Vary: Accept-Encoding

GET
H3 200 module_86933076631_CR_-_Sticky_CTA_Bar.min.js
cdn2.hubspot.net/hub/3354902/hub_generated/module_assets/86933076631/1669911113440/ 694 B
1 KB 21ms
21ms Other
application/javascript 104.18.88.62
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn2.hubspot.net/hub/3354902/hub_generated/module_assets/86933076631/1669911113440/module_86933076631_CR_-_Sticky_CTA_Bar.min.js
Requested by: Host: www.cybereason.com
URL: https://www.cybereason.com/blog/i-am-goot-loader
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.88.62 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 65a923b747d84787bc4e01270fa29f4314d3d36df432cd3eb801c30f8adfd466

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://www.cybereason.com/blog/i-am-goot-loader
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

content-encoding: br
age: 1240095
x-evy-trace-route-service-name: envoyset-translator
x-amz-server-side-encryption: AES256
x-amz-replication-status: COMPLETED
x-hs-cf-lambda: us-east-1.EnforceAclForReads 3
x-evy-trace-listener: listener_https
etag: W/"de347f1a06cbb5270942bfc43d48cf48"
vary: Accept-Encoding
access-control-allow-methods: GET
x-amz-meta-created-unix-time-millis: 1669911113440
access-control-allow-origin: *
x-evy-trace-virtual-host: all
content-type: application/javascript; charset=utf-8
cache-control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900
x-hs-cf-lambda-enforce: us-east-1.EnforceAclForReads 3
date: Wed, 26 Jun 2024 02:14:19 GMT
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-amz-cf-pop: IAD61-P1
x-hs-alternate-content-type: text/plain
x-hubspot-correlation-id: 0c43b6ed-fd1a-4249-b609-a8625edb811d
x-amz-storage-class: INTELLIGENT_TIERING
x-envoy-upstream-service-time: 269
alt-svc: h3=":443"; ma=86400
x-evy-trace-route-configuration: listener_https/all
x-request-id: 0c43b6ed-fd1a-4249-b609-a8625edb811d
last-modified: Thu, 01 Dec 2022 16:11:54 GMT
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2F9XN5qUfLNJdJv4CPrEHbEN3z%2FBWOLIPbPuwWWS7p3fu7RS1ClxyjpKTqudf3aL8XAxNlrv4Z0U5YOiAI6xCK3o0IrKeor9qncIcASufoEdtxlLTZbLUkZRZJs2wue9VjSA%3D"}],"group":"cf-nel","max_age":604800}
x-evy-trace-served-by-pod: iad02/cms-cdn2-td/envoy-proxy-b79697d9-vsnvs
cf-ray: 8999aee39b8b90fb-FRA
timing-allow-origin: cdn2.hubspot.net

GET
H3 200 sdk.js Show response
connect.facebook.net/en_GB/ 299 KB
86 KB 19ms
11ms Script
application/x-javascript 157.240.0.6
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_GB/sdk.js?hash=4d06779ab7a44692f9dc2d097a2a196f

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_GB/sdk.js

Protocol

Security

QUIC, , AES_128_GCM

Server

157.240.0.6 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

xx-fbcdn-shv-02-fra3.fbcdn.net

Software

Resource Hash

d66d63ef49d9f05d4cfacb6e2405e0c5d02800aa437b6aaf7d4f8f057b334fdb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://www.cybereason.com/blog/i-am-goot-loader
Origin: https://www.cybereason.com
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
date: Wed, 26 Jun 2024 02:14:19 GMT
content-md5: 7LQ0/YrCucpRjmc1p+MARg==
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 87608
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
x-fb-connection-quality: EXCELLENT; q=0.9, rtt=6, rtx=0, c=23, mss=1232, tbw=4278, tp=9, tpl=0, uplat=4, ullat=-1
x-fb-debug: OpLdKmjvltowokPb5r3frmSGKOy1UzTslCsNCIMVqAkOT9ZllUMFIZsOPUibW55/sewyL4ERNuQ/rG0EX/pKxw==
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
x-fb-content-md5: 80392ed3bf28dd00e0e5befa80d4f6e4
cross-origin-opener-policy: same-origin-allow-popups;report-to="coop_report"
etag: "f2c52a0e76a91ff6c54ea50a7d2d8f01"
vary: Accept-Encoding
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: *
origin-agent-cluster: ?0
access-control-expose-headers: X-FB-Content-MD5
cache-control: public,max-age=31536000,stale-while-revalidate=3600,immutable
permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), battery=(self), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), usb-unrestricted=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
x-frame-options: DENY
timing-allow-origin: *
priority: u=3,i
expires: Thu, 26 Jun 2025 00:58:21 GMT

GET
H/1.1 200
OK widget_iframe.2f70fb173b9000da126c79afe2098f02.html
platform.twitter.com/widgets/ Frame 02EE 0
0 25ms
6ms Document
text/html 2606:2800:234:59:254c:406:2366:268c
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/widgets/widget_iframe.2f70fb173b9000da126c79afe2098f02.html?origin=https%3A%2F%2Fwww.cybereason.com
Requested by: Host: platform.twitter.com
URL: https://platform.twitter.com/widgets.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:234:59:254c:406:2366:268c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECS (frb/67BA) /
Resource Hash

Request headers

Accept-Language: de-DE,de;q=0.9;q=0.9
Referer: https://www.cybereason.com/blog/i-am-goot-loader
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Win32"

Response headers

Access-Control-Allow-Methods: GET
Access-Control-Allow-Origin: *
Age: 8025728
Cache-Control: public, max-age=315360000
Content-Encoding: gzip
Content-Length: 105429
Content-Type: text/html; charset=utf-8
Date: Wed, 26 Jun 2024 02:14:19 GMT
Etag: "81267302efdfb3e4524a22631a8fc99e+gzip"
Last-Modified: Mon, 11 Dec 2023 17:19:49 GMT
P3P: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Server: ECS (frb/67BA)
Server-Timing: x-cache;desc= HIT,x-tw-cdn;desc=VZ
Vary: Accept-Encoding
X-Cache: HIT
x-amz-server-side-encryption: AES256
x-tw-cdn: VZ

GET
H2 204 has-permission-json Show response
app.hubspot.com/content-tools-menu/api/v1/tools-menu/ 0
1 KB 220ms
184ms XHR
text/plain 2606:4700::6810:7674
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://app.hubspot.com/content-tools-menu/api/v1/tools-menu/has-permission-json?portalId=3354902

Requested by

Host: www.cybereason.com
URL: https://www.cybereason.com/hs/hsstatic/HubspotToolsMenu/static-1.321/js/index.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7674 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	no-sniff

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://www.cybereason.com/blog/i-am-goot-loader
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 26 Jun 2024 02:14:19 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: no-sniff
cf-cache-status: DYNAMIC
x-hs-worker-debug-mode: false
x-evy-trace-route-service-name: envoyset-translator
x-hubspot-correlation-id: dfea6a26-6447-4ca5-9909-93f336bafcc3
x-envoy-upstream-service-time: 5
x-evy-trace-route-configuration: listener_https/all
reporting-endpoints: default="https://send.hsbrowserreports.com/csp/reports?cfRay=8999aee4ef3a71ac&resource=unknown"
x-evy-trace-listener: listener_https
x-request-id: dfea6a26-6447-4ca5-9909-93f336bafcc3
server: cloudflare
vary: origin, Accept-Encoding
access-control-allow-methods: GET
report-to: {"group":"default","max_age":86400,"endpoints":[{"url":"https://send.hsbrowserreports.com/csp/reports"}]}
access-control-allow-origin: https://www.cybereason.com
x-evy-trace-served-by-pod: iad02/app-td/envoy-proxy-65f7f7c749-2hwf8
cache-control: max-age=0
access-control-allow-credentials: true
x-evy-trace-virtual-host: all
cf-ray: 8999aee4ef3a71ac-FRA

GET
H2 200 l
use.typekit.net/af/343335/00000000000000003b9b0ad0/27/ 16 KB
16 KB 38ms
8ms Font
application/font-woff2 2a02:26f0:3500:16::215:1495
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://use.typekit.net/af/343335/00000000000000003b9b0ad0/27/l?primer=7cdcb44be4a7db8877ffa5c0007b8dd865b3bbc383831fe2ea177f62257a9191&fvd=n3&v=3
Requested by: Host: www.cybereason.com
URL: https://www.cybereason.com/blog/i-am-goot-loader
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:3500:16::215:1495 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: nginx /
Resource Hash: 599dd661a1d9e0af96d614fab0ea7396bf06de4265029166a265c2b10cc1a1b0

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://www.cybereason.com/
Origin: https://www.cybereason.com
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 26 Jun 2024 02:14:19 GMT
server: nginx
etag: "eedb93b5a9ba82f97df21a2548066c304a8baad8"
content-type: application/font-woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 16112

GET
H2 200 l
use.typekit.net/af/4b34d2/00000000000000003b9b0acf/27/ 16 KB
16 KB 48ms
18ms Font
application/font-woff2 2a02:26f0:3500:16::215:1495
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://use.typekit.net/af/4b34d2/00000000000000003b9b0acf/27/l?primer=7cdcb44be4a7db8877ffa5c0007b8dd865b3bbc383831fe2ea177f62257a9191&fvd=i4&v=3
Requested by: Host: www.cybereason.com
URL: https://www.cybereason.com/blog/i-am-goot-loader
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:3500:16::215:1495 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: nginx /
Resource Hash: f3f2822ba3d24c1f7f53bff8959801c644b2c1c556eb8c15ca36a86717f1ae7d

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://www.cybereason.com/
Origin: https://www.cybereason.com
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 26 Jun 2024 02:14:19 GMT
server: nginx
etag: "2d91046573f0e4458e7737f18f00bb9c13388e11"
content-type: application/font-woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 16256

GET
H2 200 l
use.typekit.net/af/cb6232/00000000000000003b9b0ad8/27/ 15 KB
15 KB 40ms
10ms Font
application/font-woff2 2a02:26f0:3500:16::215:1495
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://use.typekit.net/af/cb6232/00000000000000003b9b0ad8/27/l?primer=7cdcb44be4a7db8877ffa5c0007b8dd865b3bbc383831fe2ea177f62257a9191&fvd=n4&v=3
Requested by: Host: www.cybereason.com
URL: https://www.cybereason.com/blog/i-am-goot-loader
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:3500:16::215:1495 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: nginx /
Resource Hash: f64368e7be69abe40585911860d83acfa8b14179d3008b2594166ae4c10ec0fd

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://www.cybereason.com/
Origin: https://www.cybereason.com
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 26 Jun 2024 02:14:19 GMT
server: nginx
etag: "865da7d2ecc4da3cb6bd5574f01738cfc5c8bb11"
content-type: application/font-woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 15452

GET
H2 200 l
use.typekit.net/af/abc1c3/00000000000000003b9b0ac9/27/ 16 KB
16 KB 41ms
10ms Font
application/font-woff2 2a02:26f0:3500:16::215:1495
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://use.typekit.net/af/abc1c3/00000000000000003b9b0ac9/27/l?primer=7cdcb44be4a7db8877ffa5c0007b8dd865b3bbc383831fe2ea177f62257a9191&fvd=n6&v=3
Requested by: Host: www.cybereason.com
URL: https://www.cybereason.com/blog/i-am-goot-loader
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:3500:16::215:1495 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: nginx /
Resource Hash: 72493a3f42ed0260f03b6ffd3ea131be38a1070845bfae24927f643a3fcf3255

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://www.cybereason.com/
Origin: https://www.cybereason.com
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 26 Jun 2024 02:14:19 GMT
server: nginx
etag: "8c3ee2b4e977df4e0f73e1b985c24fba9611fc49"
content-type: application/font-woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 16660

GET
H2 200 l
use.typekit.net/af/62203f/00000000000000003b9b0ac8/27/ 17 KB
17 KB 45ms
15ms Font
application/font-woff2 2a02:26f0:3500:16::215:1495
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://use.typekit.net/af/62203f/00000000000000003b9b0ac8/27/l?primer=7cdcb44be4a7db8877ffa5c0007b8dd865b3bbc383831fe2ea177f62257a9191&fvd=i7&v=3
Requested by: Host: www.cybereason.com
URL: https://www.cybereason.com/blog/i-am-goot-loader
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:3500:16::215:1495 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: nginx /
Resource Hash: 5c8d63abd4075c4ebd692fbd02e35fb72950f214a6486607c1819d4279ad526f

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://www.cybereason.com/
Origin: https://www.cybereason.com
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 26 Jun 2024 02:14:19 GMT
server: nginx
etag: "7b5be73a29b093f7ae3c099f5a521c9274f6db28"
content-type: application/font-woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 17152

GET
H2 200 l
use.typekit.net/af/19a2f0/00000000000000003b9b0ac7/27/ 16 KB
16 KB 42ms
12ms Font
application/font-woff2 2a02:26f0:3500:16::215:1495
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://use.typekit.net/af/19a2f0/00000000000000003b9b0ac7/27/l?primer=7cdcb44be4a7db8877ffa5c0007b8dd865b3bbc383831fe2ea177f62257a9191&fvd=n7&v=3
Requested by: Host: www.cybereason.com
URL: https://www.cybereason.com/blog/i-am-goot-loader
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:3500:16::215:1495 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: nginx /
Resource Hash: dd8ce52adc4b0ab60f82c29ba12f25e2f6446245fc8c0b5f4bd6dab3146f9ef7

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://www.cybereason.com/
Origin: https://www.cybereason.com
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 26 Jun 2024 02:14:19 GMT
server: nginx
etag: "b9e1ecdf0fe601a7e9dfc362b400290203e7b31c"
content-type: application/font-woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 16464

GET
H2 200 l
use.typekit.net/af/cfbead/0000000000000000000146b3/27/ 23 KB
23 KB 97ms
67ms Font
application/font-woff2 2a02:26f0:3500:16::215:1495
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://use.typekit.net/af/cfbead/0000000000000000000146b3/27/l?primer=7cdcb44be4a7db8877ffa5c0007b8dd865b3bbc383831fe2ea177f62257a9191&fvd=n4&v=3
Requested by: Host: www.cybereason.com
URL: https://www.cybereason.com/blog/i-am-goot-loader
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:3500:16::215:1495 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: nginx /
Resource Hash: 875f8e591b4fbc6567e2b33553bea9ca2d0e18593bd857783a569fe7bf4ba097

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://www.cybereason.com/
Origin: https://www.cybereason.com
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 26 Jun 2024 02:14:19 GMT
server: nginx
etag: "122498e3424e674610da39fb441d661549879239"
content-type: application/font-woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 23244

GET
H2 200 l
use.typekit.net/af/f50d41/00000000000000003b9b2c84/27/ 15 KB
15 KB 47ms
17ms Font
application/font-woff2 2a02:26f0:3500:16::215:1495
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://use.typekit.net/af/f50d41/00000000000000003b9b2c84/27/l?primer=7cdcb44be4a7db8877ffa5c0007b8dd865b3bbc383831fe2ea177f62257a9191&fvd=n3&v=3
Requested by: Host: www.cybereason.com
URL: https://www.cybereason.com/blog/i-am-goot-loader
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:3500:16::215:1495 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: nginx /
Resource Hash: 0b454edb897d49bf8a73b07627b670a55f0972988094770495a308e5a5e39d1b

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://www.cybereason.com/
Origin: https://www.cybereason.com
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 26 Jun 2024 02:14:19 GMT
server: nginx
etag: "13c2813ff67959226aaa4eccfcdd1399bd756b8d"
content-type: application/font-woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 15336

GET
H2 200 _Incapsula_Resource
www.cybereason.com/ 1 B
36 B 101ms
100ms Image
text/plain 45.60.107.106
INCAPSULA

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.cybereason.com/_Incapsula_Resource?SWKMTFSR=1&e=0.38691080151828294

Requested by

Host: www.cybereason.com
URL: https://www.cybereason.com/blog/i-am-goot-loader

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

45.60.107.106 , United States, ASN19551 (INCAPSULA, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://www.cybereason.com/blog/i-am-goot-loader
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
cache-control: no-cache, no-store
x-robots-tag: noindex
content-length: 1
content-type: text/plain

GET
H2 200 p.gif
p.typekit.net/ 35 B
205 B 13ms
7ms Image
image/gif 2a02:26f0:3500:16::215:1495
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://p.typekit.net/p.gif?s=1&k=vyv2ljd&ht=tk&h=www.cybereason.com&f=32224.32226.32227.32228.32230.32231.10875.32265&a=657783&js=1.21.0&app=typekit&e=js&_=1719368059730
Requested by: Host: www.cybereason.com
URL: https://www.cybereason.com/blog/i-am-goot-loader
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:3500:16::215:1495 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: nginx /
Resource Hash: 9b9265c69a5cc295d1ab0d04e0273b3677db1a6216ce2ccf4efc8c277ed84b39

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://www.cybereason.com/blog/i-am-goot-loader
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 26 Jun 2024 02:14:19 GMT
last-modified: Fri, 28 Jul 2023 12:40:18 GMT
server: nginx
etag: "64c3b732-23"
content-type: image/gif
access-control-allow-origin: *
cache-control: public, max-age=604800
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
content-length: 35

GET
H2 200 leadflows.js Show response
js.hsleadflows.net/ 551 KB
92 KB 62ms
15ms Script
application/javascript 2606:4700::6812:8b11
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://js.hsleadflows.net/leadflows.js

Requested by

Host: www.cybereason.com
URL: https://www.cybereason.com/hs/scriptloader/3354902.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:8b11 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

dd26d9d88899d0587c9377964b7d1ab478a318b0fdbee7b9d6a084e4aa6425f7

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://www.cybereason.com/blog/i-am-goot-loader
Origin: https://www.cybereason.com
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

content-encoding: gzip
age: 20974
x-evy-trace-route-service-name: envoyset-translator
x-amz-server-side-encryption: AES256
content-security-policy-report-only: frame-ancestors 'self'; report-uri https://send.hsbrowserreports.com/csp/report?resource=lead-flows-js/static-1.1355/bundle/main/lead-flows-release.js&cfRay=8997aed20e4c371a-FRA
x-amz-replication-status: COMPLETED
x-evy-trace-listener: listener_https
etag: W/"be45bdb720f44c8db4ee42bc228ff2a8"
vary: Accept-Encoding,Origin,Access-Control-Request-Headers,Access-Control-Request-Method
access-control-allow-methods: GET
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
x-evy-trace-virtual-host: all
cache-control: s-maxage=86400, max-age=0
x-hs-target-asset: lead-flows-js/static-1.1355/bundle/main/lead-flows-release.js
date: Wed, 26 Jun 2024 02:14:19 GMT
x-amz-version-id: HLkmxotJV8gQ_mnvhNwLT9fnVmh1uWjb
x-content-type-options: nosniff
cf-cache-status: HIT
via: 1.1 2a3aa853116c0a37d6c7762eca54d208.cloudfront.net (CloudFront)
x-amz-cf-pop: IAD12-P3
x-hubspot-correlation-id: 5f861e7a-48f0-4c5a-9493-3ff00cdb97f0
x-cache: Hit from cloudfront
cache-tag: staticjsapp-lead-flows-cloudflare-web-prod,staticjsapp-prod
x-envoy-upstream-service-time: 10
x-evy-trace-route-configuration: listener_https/all
x-request-id: 5f861e7a-48f0-4c5a-9493-3ff00cdb97f0
last-modified: Thu, 30 May 2024 10:22:15 UTC
server: cloudflare
access-control-max-age: 3000
x-hs-cache-status: MISS
x-evy-trace-served-by-pod: iad02/app-td/envoy-proxy-65f7f7c749-kt4hg
cf-ray: 8999aee5be84917a-FRA
x-amz-cf-id: wJrmpFdBH8cxbEpQDvVbZIhCaJ4oPelTvYcOZKOeK3KpFTwFir0oUw==

GET
H2 200 banner.js Show response
js.hs-banner.com/v2/3354902/ 71 KB
26 KB 181ms
134ms Script
text/javascript 2606:4700:4400::ac40:991b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js.hs-banner.com/v2/3354902/banner.js
Requested by: Host: www.cybereason.com
URL: https://www.cybereason.com/hs/scriptloader/3354902.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:4400::ac40:991b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b0bb6a25cef0b27119b7598fd8dd56f38a4563ca0ee0fcbba8f7638c487f0b2d

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://www.cybereason.com/blog/i-am-goot-loader
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 26 Jun 2024 02:14:19 GMT
x-amz-version-id: Co8AfSziKycL5TNawfAq6.rHd8NdqvSw
content-encoding: gzip
cf-cache-status: REVALIDATED
x-amz-request-id: SBPRCY6SZXGCYDWM
x-evy-trace-route-service-name: envoyset-translator
x-amz-server-side-encryption: AES256
x-hubspot-correlation-id: 1e44c7fd-1bd1-4235-bd22-8d59f9686c9c
x-envoy-upstream-service-time: 78
x-amz-id-2: gtNN+h7UEUxD9uJwfJ0E8nS/H+zO33P1C8Rw9ZLXEWfJSPzqgtTOodWVY4Y5N/q0602ecC/Cwh8=
x-evy-trace-listener: listener_https
x-request-id: 1e44c7fd-1bd1-4235-bd22-8d59f9686c9c
x-evy-trace-route-configuration: listener_https/all
last-modified: Wed, 12 Jun 2024 15:32:48 GMT
server: cloudflare
etag: W/"e7c4a4b6ee290d79b80dfb3f67de34c7"
access-control-max-age: 604800
access-control-allow-methods: GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: https://www.cybereason.com
x-evy-trace-virtual-host: all
access-control-expose-headers: x-last-modified-timestamp, X-HubSpot-NotFound, X-HS-User-Request, Link, Server-Timing
cache-control: max-age=300,public
access-control-allow-credentials: true
x-evy-trace-served-by-pod: iad02/analytics-js-proxy-td/envoy-proxy-78cb6f459b-2r68v
vary: origin, Accept-Encoding
timing-allow-origin: *
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Accept-Charset, Accept-Encoding, X-Override-Internal-Permissions, X-Properties-Source, X-Properties-SourceId, X-Properties-Flag, X-Hubspot-User-Id, X-Hubspot-Trace, X-Hubspot-Callee, X-Hubspot-Offset, X-Hubspot-No-Trace, X-HubSpot-Static-App-Info, X-HubSpot-Messages-Uri, X-HubSpot-Request-Source, X-HubSpot-Request-Reason, Subscription-Billing-Auth-Token, X-App-CSRF, X-Tools-CSRF, Online-Payment-Signing-UUID, X-Source, X-SourceId, X-Origin-UserId, X-Biden-Request-Source, X-HubSpot-CSRF-hubspotapi, X-Force-Cookie-Refresh, X-Force-Cookie-Refresh-No-Cache, X-HS-User-Request, X-Application-Id, X-HS-Referer, X-HubSpot-Correlation-Id
cf-ray: 8999aee5bca2a03a-FRA
expires: Wed, 26 Jun 2024 02:19:19 GMT

GET
H2 200 3354902.js Show response
js.hs-analytics.net/analytics/1719367800000/ 68 KB
25 KB 186ms
139ms Script
text/javascript 2606:4700::6811:afc9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js.hs-analytics.net/analytics/1719367800000/3354902.js
Requested by: Host: www.cybereason.com
URL: https://www.cybereason.com/hs/scriptloader/3354902.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6811:afc9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 05b6bbd7223cfe57d1edbcf2b1f3a7a2570a7dbbb730183185b43d9eb45f193d

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://www.cybereason.com/blog/i-am-goot-loader
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 26 Jun 2024 02:14:19 GMT
x-amz-version-id: null
content-encoding: gzip
cf-cache-status: MISS
x-amz-request-id: WAMWSTH1FCAW0M4A
x-evy-trace-route-service-name: envoyset-translator
x-amz-server-side-encryption: AES256
x-hubspot-correlation-id: 54d35429-734c-4986-a161-e436b3d289da
x-envoy-upstream-service-time: 30
x-amz-id-2: aiHSGUH/snruUV9oIsb+LrdE7vM0cx0YKR+foKhdiw6S7b81CCdf0AOUO963NqL+gDGGSfDXNln4M0JxIA39HoyxAJjQFDvF
x-evy-trace-listener: listener_https
x-request-id: 54d35429-734c-4986-a161-e436b3d289da
x-evy-trace-route-configuration: listener_https/all
last-modified: Fri, 21 Jun 2024 21:02:58 GMT
server: cloudflare
etag: W/"c674de89598551aa7c5f49d52e160690"
vary: origin, Accept-Encoding
content-type: text/javascript
x-evy-trace-virtual-host: all
x-evy-trace-served-by-pod: iad02/analytics-js-proxy-td/envoy-proxy-7bfb89fbf6-rslzw
cache-control: max-age=300,public
access-control-allow-credentials: false
cf-ray: 8999aee5bbce3723-FRA
expires: Wed, 26 Jun 2024 02:19:19 GMT

GET
H2 200 web-interactives-embed.js Show response
js.hubspot.com/ 82 KB
24 KB 166ms
120ms Script
application/javascript 2606:4700::6810:7674
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://js.hubspot.com/web-interactives-embed.js

Requested by

Host: www.cybereason.com
URL: https://www.cybereason.com/hs/scriptloader/3354902.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7674 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ab1fca31f7e7a89c198881e69c42c6bb3578b7d55f2cee7463b96360feaf7eaa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://www.cybereason.com/blog/i-am-goot-loader
Origin: https://www.cybereason.com
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

content-encoding: gzip
x-evy-trace-route-service-name: envoyset-translator
x-amz-server-side-encryption: AES256
content-security-policy-report-only: frame-ancestors 'self'; report-uri https://send.hsbrowserreports.com/csp/report?resource=web-interactives-embed/static-2.1194/bundles/project.js&cfRay=8999aee5bf982c63-FRA
x-amz-replication-status: COMPLETED
x-evy-trace-listener: listener_https
etag: W/"50f2e99c1f025777ca05bdae3cfcf91d"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
x-evy-trace-virtual-host: all
cache-control: max-age=600
x-hs-target-asset: web-interactives-embed/static-2.1194/bundles/project.js
date: Wed, 26 Jun 2024 02:14:19 GMT
x-amz-version-id: MDb_7hFyElKIrRJmReYAEj96Es7nef4a
x-content-type-options: nosniff
cf-cache-status: EXPIRED
via: 1.1 16d910967d343c8da7828222a653755e.cloudfront.net (CloudFront)
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-amz-cf-pop: IAD12-P3
x-hubspot-correlation-id: fa8afe98-a94c-4dae-9f61-1922caf76e21
x-cache: Hit from cloudfront
cache-tag: staticjsapp-web-interactives-embed-web-prod,staticjsapp-prod
x-envoy-upstream-service-time: 1
x-evy-trace-route-configuration: listener_https/all
x-request-id: fa8afe98-a94c-4dae-9f61-1922caf76e21
last-modified: Thu, 20 Jun 2024 14:37:30 UTC
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Nfi%2BIJrXCfpxPeNo7i0zHGov2ENcSPqCbWyigeGM311uCzladrcKYEJ6q5gysB3PonGTb2jE9aHKTKBBW467BFEpmuy%2FOmQrgNObA11qIXWGDuu%2FTwssShmyDqS9Aa%2Bmk42IRbf%2F3rbvr%2FFd"}],"group":"cf-nel","max_age":604800}
x-hs-cache-status: HIT
x-evy-trace-served-by-pod: iad02/app-td/envoy-proxy-65f7f7c749-th2td
cf-ray: 8999aee5bf982c63-FRA
x-amz-cf-id: TLBG4eXJ7k3VrMsdGI_2qv-tpWGfhezkUf0BDQENtqX4xFfLchnsAQ==

GET
H2 200 combinedConfigs Show response
cta-service-cms2.hubspot.com/web-interactives/public/v1/embed/ 108 B
1 KB 324ms
316ms Fetch
application/json 2606:4700::6810:7674
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cta-service-cms2.hubspot.com/web-interactives/public/v1/embed/combinedConfigs?portalId=3354902&currentUrl=https%3A%2F%2Fwww.cybereason.com%2Fblog%2Fi-am-goot-loader&contentId=168880427019

Requested by

Host: js.hubspot.com
URL: https://js.hubspot.com/web-interactives-embed.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7674 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

9a45c89da6cfa94009a61215c8921175ec1bf18444adb5bcba07e22e9b12954d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://www.cybereason.com/blog/i-am-goot-loader
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 26 Jun 2024 02:14:20 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-evy-trace-route-service-name: envoyset-translator
x-hubspot-correlation-id: 294299c8-44db-45a9-8b19-df0f1ef25f6a
content-encoding: br
x-envoy-upstream-service-time: 10
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: 294299c8-44db-45a9-8b19-df0f1ef25f6a
server: cloudflare
vary: origin
access-control-allow-methods: OPTIONS, GET
content-type: application/json;charset=utf-8
access-control-allow-origin: https://www.cybereason.com
x-evy-trace-virtual-host: all
access-control-max-age: 180
access-control-allow-credentials: true
cache-control: max-age=0, no-cache, no-store
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=yryn4wp63uwHuCXGykT2qoawpPOCIB92SpjXsPSWm0rjjNbhWE6vgku5nXJT0i%2FZOsXI%2FUcCOsVIBRsaQ%2Bu%2BE05HiM78PLbVUAfQDFYQzEa%2FLGvVnDAb29DTa%2F9nPjc%2Fgzt4teElBuVxIDuIkH8gtH0NkKKOYmlcb08%3D"}],"group":"cf-nel","max_age":604800}
x-robots-tag: noindex, follow
access-control-allow-headers: Accept, Accept-Charset, Accept-Encoding, Accept-Language, Content-Type, Host, Origin, Referer, User-Agent
cf-ray: 8999aee6c8102c63-FRA
x-evy-trace-served-by-pod: iad02/star-hubspot-td/envoy-proxy-776cb5686f-2gsfg

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 52 KB
21 KB 65ms
7ms Script
text/javascript 2a00:1450:4001:828::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.cybereason.com
URL: https://www.cybereason.com/blog/i-am-goot-loader

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://www.cybereason.com/blog/i-am-goot-loader
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
date: Wed, 26 Jun 2024 00:29:07 GMT
last-modified: Tue, 12 Dec 2023 18:09:08 GMT
server: Golfe2
age: 6313
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 20994
expires: Wed, 26 Jun 2024 02:29:07 GMT

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 414 KB
121 KB 40ms
39ms Script
application/javascript 2a00:1450:4001:830::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-TJVVB7C

Requested by

Host: www.cybereason.com
URL: https://www.cybereason.com/blog/i-am-goot-loader

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

cf26830a024aba2d001dbd04f1fe4332f5e5d4fb5ae52052eb47213892c6a1c9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://www.cybereason.com/blog/i-am-goot-loader
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 26 Jun 2024 02:14:19 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 123546
x-xss-protection: 0
last-modified: Wed, 26 Jun 2024 00:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Wed, 26 Jun 2024 02:14:19 GMT

GET
H2 200 cf-location Show response
js.hs-banner.com/v2/ 2 B
145 B 35ms
17ms Fetch
text/plain 2606:4700:4400::ac40:991b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js.hs-banner.com/v2/cf-location
Requested by: Host: js.hs-banner.com
URL: https://js.hs-banner.com/v2/3354902/banner.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:4400::ac40:991b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6814ef46f686990cf4e946f966167b0507e1d642c44e51f61bffb0bba2d4672b

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://www.cybereason.com/blog/i-am-goot-loader
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 26 Jun 2024 02:14:19 GMT
server: cloudflare
vary: Accept-Encoding
content-type: text/plain;charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=1500
cf-ray: 8999aee6edea3aa2-FRA
content-length: 2

POST
H2 200 collect Show response
www.google-analytics.com/j/ 4 B
211 B 14ms
14ms XHR
text/plain 2a00:1450:4001:828::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j101&a=1431941494&t=pageview&_s=1&dl=https%3A%2F%2Fwww.cybereason.com%2Fblog%2Fi-am-goot-loader&ul=de-de&de=UTF-8&dt=I%20am%20Goot%20(Loader)&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=IEBAAEABAAAAACAAI~&jid=2055976085&gjid=1362556925&cid=129924175.1719368060&tid=UA-56367941-1&_gid=1769223654.1719368060&_r=1&_slc=1&z=1506082034

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

aec60bc104db041b1512185839f18f52986df7e569e5445f740dd60f763fbca8

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
sec-ch-ua-platform: "Win32"
Referer: https://www.cybereason.com/blog/i-am-goot-loader
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Wed, 26 Jun 2024 02:14:20 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.cybereason.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 otSDKStub.js Show response
cdn.cookielaw.org/scripttemplates/ 21 KB
7 KB 36ms
19ms Script
application/javascript 2606:4700::6813:b134
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/otSDKStub.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TJVVB7C

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6813:b134 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

022e2f39deba7f332eabe69b27b31d98d4d5f2535116745957a691d1b1ec4cc5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://www.cybereason.com/blog/i-am-goot-loader
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-ms-blob-type: BlockBlob
date: Wed, 26 Jun 2024 02:14:20 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
content-md5: ceCldLDyZN6bSQL6yyKLMg==
age: 20041
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-length: 6882
x-ms-lease-status: unlocked
last-modified: Tue, 25 Jun 2024 02:35:41 GMT
server: cloudflare
etag: 0x8DC94BF8198F6A8
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-ms-request-id: 27c9e704-601e-00db-1f1a-c7375c000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=86400
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 8999aee78e57bb65-FRA
expires: Wed, 26 Jun 2024 20:40:19 GMT

POST
H2 200 collect Show response
stats.g.doubleclick.net/j/ 4 B
351 B 72ms
19ms XHR
text/plain 2a00:1450:400c:c06::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j101&tid=UA-56367941-1&cid=129924175.1719368060&jid=2055976085&gjid=1362556925&_gid=1769223654.1719368060&_u=IEBAAEAAAAAAACAAI~&z=1765792900

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400c:c06::9b Brussels, Belgium, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
sec-ch-ua-platform: "Win32"
Referer: https://www.cybereason.com/blog/i-am-goot-loader
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Wed, 26 Jun 2024 02:14:20 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.cybereason.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 26b02624-42c7-456d-82c2-9669db762671.json Show response
cdn.cookielaw.org/consent/26b02624-42c7-456d-82c2-9669db762671/ 5 KB
2 KB 44ms
27ms XHR
application/x-javascript 2606:4700::6813:b134
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/consent/26b02624-42c7-456d-82c2-9669db762671/26b02624-42c7-456d-82c2-9669db762671.json

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6813:b134 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0dfb22afe7173c577144301206aee5fa3939268bfefb7adb44906fa81cb7a1d2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://www.cybereason.com/blog/i-am-goot-loader
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-ms-blob-type: BlockBlob
date: Wed, 26 Jun 2024 02:14:20 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
strict-transport-security: max-age=31536000; includeSubDomains; preload
age: 4065
content-md5: IGr7iWost09FKtc8kbZS7g==
content-length: 1798
x-ms-lease-status: unlocked
last-modified: Mon, 03 Jun 2024 14:14:24 GMT
server: cloudflare
etag: 0x8DC83D7788B18D7
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: *
x-ms-request-id: 92a7e383-601e-0054-64c0-b5abe3000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=86400
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 8999aee7c9a22bb5-FRA
expires: Thu, 27 Jun 2024 02:14:20 GMT

GET
H2 200 __ptq.gif
track.hubspot.com/ 45 B
614 B 147ms
139ms Image
image/gif 2606:4700::6810:7674
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://track.hubspot.com/__ptq.gif?k=1&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=de-de&bfp=3598200494&v=1.1&a=3354902&pi=168880427019&ct=blog-post&ccu=https%3A%2F%2Fwww.cybereason.com%2Fblog%2Fi-am-goot-loader&cpi=168880427019&cgi=5272851739&lpi=168880427019&lvi=168880427019&lvc=en&pu=https%3A%2F%2Fwww.cybereason.com%2Fblog%2Fi-am-goot-loader&t=I+am+Goot+(Loader)&cts=1719368060113&vi=3bb0509c69db413087f3411b83018fc3&nc=true&u=85683782.3bb0509c69db413087f3411b83018fc3.1719368060112.1719368060112.1719368060112.1&b=85683782.1.1719368060112&cc=15

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7674 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://www.cybereason.com/blog/i-am-goot-loader
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 26 Jun 2024 02:14:20 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-evy-trace-route-service-name: envoyset-translator
x-hubspot-correlation-id: 0414471c-5ce4-4b69-98a2-124d995fa238
p3p: CP="NOI CUR ADM OUR NOR STA NID"
x-envoy-upstream-service-time: 12
content-length: 45
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: 0414471c-5ce4-4b69-98a2-124d995fa238
server: cloudflare
vary: origin, Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ksWR7Ub3hJiklz7bFO2fLTeRpSBnmAHMqTbPh6%2Buk6cnOe7B1rw897tPw1M3nC898A300%2FXdiNQ44pLH4ctzOFu3hkSic1dtNYLnhUzTduy0tV0GfcyhYLS9Ma0w%2FpEck%2BtTkwQa%2Bh%2BUHxwzsaZC"}],"group":"cf-nel","max_age":604800}
content-type: image/gif
x-evy-trace-served-by-pod: iad02/analytics-tracking-td/envoy-proxy-756b8c8b56-lq8k5
x-evy-trace-virtual-host: all
cache-control: no-cache, no-store, no-transform
access-control-allow-credentials: false
cf-ray: 8999aee7c99a71ac-FRA
x-robots-tag: none

GET
H2 200 cr-favicon-1.png
www.cybereason.com/hubfs/ 3 KB
3 KB 106ms
105ms Other
image/png 45.60.107.106
INCAPSULA

General

Check archive.org

Show headers Download Go to

Full URL

https://www.cybereason.com/hubfs/cr-favicon-1.png

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

45.60.107.106 , United States, ASN19551 (INCAPSULA, US),

Reverse DNS

Software

Resource Hash

33ff6b6486bdc5883c2c63e8278e8a547ca86b1f6026667f7733fec6b52a1303

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://www.cybereason.com/blog/i-am-goot-loader
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 26 Jun 2024 02:14:19 GMT
strict-transport-security: max-age=31536000; includeSubDomains
last-modified: Fri, 10 Dec 2021 18:39:27 GMT
x-cdn: Imperva
etag: "191c614ca975bba9737fcf4fc024f8e7"
content-type: image/png
x-iinfo: 0-3675347-0 0CNN RT(1719368058113 1842) q(0 -1 -1 -1) r(0 -1)
cache-control: max-age=0, s-maxage=916960, public
content-length: 3186

GET
H2 200 json Show response
forms.hubspot.com/lead-flows-config/v1/config/ 178 B
1 KB 222ms
221ms XHR
application/json 2606:4700::6810:7674
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://forms.hubspot.com/lead-flows-config/v1/config/json?portalId=3354902&utk=3bb0509c69db413087f3411b83018fc3&__hstc=85683782.3bb0509c69db413087f3411b83018fc3.1719368060112.1719368060112.1719368060112.1&__hssc=85683782.1.1719368060112&contentId=168880427019&currentUrl=https%3A%2F%2Fwww.cybereason.com%2Fblog%2Fi-am-goot-loader

Requested by

Host: js.hsleadflows.net
URL: https://js.hsleadflows.net/leadflows.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7674 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7ec3b76de15bcc7d610ebb0768a74983824ed88e17ef343875a4bafc792e53cb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://www.cybereason.com/blog/i-am-goot-loader
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 26 Jun 2024 02:14:20 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-evy-trace-route-service-name: envoyset-translator
x-hubspot-correlation-id: f4b4ecc6-efa6-4ca8-ab69-6e0e9c0b3f79
content-encoding: br
x-envoy-upstream-service-time: 111
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: f4b4ecc6-efa6-4ca8-ab69-6e0e9c0b3f79
server: cloudflare
vary: origin
access-control-allow-methods: GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD
content-type: application/json;charset=utf-8
access-control-allow-origin: https://www.cybereason.com
x-evy-trace-virtual-host: all
cache-control: max-age=0, no-cache, no-store
access-control-allow-credentials: false
x-evy-trace-served-by-pod: iad02/star-hubspot-td/envoy-proxy-776cb5686f-jxrsm
access-control-max-age: 180
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=WZXffFf%2BMomT0I26Oix4K2dojT%2FRi5xv0AR8RaiaRIKLKn6wUhcAuyB4aiSlt3b9%2Fo2GojREgM8XoY8bi%2FdU3rIDcP%2BpE786s5Eb99Y6Kk1tz0lCfDr3HjEi4jCZGvvwCaw0KGV2QcSoY8VBWUs3"}],"group":"cf-nel","max_age":604800}
x-robots-tag: none
access-control-allow-headers: Accept, Accept-Charset, Accept-Encoding, Accept-Language, Content-Type, Host, Origin, Referer, User-Agent
cf-ray: 8999aee7c8992c63-FRA

GET
H3 200 ga-audiences
www.google.com/ads/ 42 B
63 B 46ms
17ms Image
image/gif 142.250.185.132
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j101&tid=UA-56367941-1&cid=129924175.1719368060&jid=2055976085&_u=IEBAAEAAAAAAACAAI~&z=1743887039

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s50-in-f4.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://www.cybereason.com/blog/i-am-goot-loader
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Wed, 26 Jun 2024 02:14:20 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ga-audiences
www.google.de/ads/ 42 B
63 B 42ms
17ms Image
image/gif 142.250.185.99
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j101&tid=UA-56367941-1&cid=129924175.1719368060&jid=2055976085&_u=IEBAAEAAAAAAACAAI~&z=1743887039

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.99 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s49-in-f3.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://www.cybereason.com/blog/i-am-goot-loader
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Wed, 26 Jun 2024 02:14:20 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 location Show response
geolocation.onetrust.com/cookieconsentpub/v1/geo/ 59 B
304 B 55ms
29ms XHR
application/json 2606:4700:4400::ac40:9b77
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://geolocation.onetrust.com/cookieconsentpub/v1/geo/location

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::ac40:9b77 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2157361193375a79ade3559e960f982daa8d599cf7f4a92d36e3eef257738f16

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
accept: application/json
Referer: https://www.cybereason.com/blog/i-am-goot-loader
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 26 Jun 2024 02:14:20 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
server: cloudflare
vary: Accept-Encoding
access-control-allow-methods: GET, OPTIONS
content-type: application/json
access-control-allow-origin: *
cf-ray: 8999aee82e462bd5-FRA
access-control-allow-headers: Content-Type

GET
H2 200 otBannerSdk.js Show response
cdn.cookielaw.org/scripttemplates/6.38.0/ 369 KB
88 KB 21ms
21ms Script
application/javascript 2606:4700::6813:b134
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/6.38.0/otBannerSdk.js

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6813:b134 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

42b2b9d16fbf8d3c6be72420699360790966e58fe30d8794fd90a71c8aef122d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://www.cybereason.com/blog/i-am-goot-loader
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-ms-blob-type: BlockBlob
date: Wed, 26 Jun 2024 02:14:20 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
content-md5: jz950M8ZW7RakPP2zlLHZQ==
age: 24691
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-length: 89624
x-ms-lease-status: unlocked
last-modified: Thu, 21 Jul 2022 06:31:17 GMT
server: cloudflare
etag: 0x8DA6AE29E465D1D
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-ms-request-id: 3fb1c7f5-001e-0086-25a8-21f53a000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: max-age=86400
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 8999aee85eb1bb65-FRA

GET
H2 200 en.json Show response
cdn.cookielaw.org/consent/26b02624-42c7-456d-82c2-9669db762671/018fde6f-6675-73cf-9c58-d1b434fa99f3/ 149 KB
25 KB 28ms
25ms Fetch
application/x-javascript 2606:4700::6813:b134
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/consent/26b02624-42c7-456d-82c2-9669db762671/018fde6f-6675-73cf-9c58-d1b434fa99f3/en.json

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/6.38.0/otBannerSdk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6813:b134 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

30b918c4b19f852851c6ed2e69766306b1ab23c761e5eff8d2a0b7a5e759e2aa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://www.cybereason.com/blog/i-am-goot-loader
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-ms-blob-type: BlockBlob
date: Wed, 26 Jun 2024 02:14:20 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
strict-transport-security: max-age=31536000; includeSubDomains; preload
age: 62489
content-md5: vvZSqZWVyPivuO59J1KvMg==
content-length: 25568
x-ms-lease-status: unlocked
last-modified: Mon, 03 Jun 2024 14:14:34 GMT
server: cloudflare
etag: 0x8DC83D77E9F37E2
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: *
x-ms-request-id: 25acde2f-401e-0048-79c0-b573f4000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=86400
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 8999aee8aa1d2bb5-FRA
expires: Thu, 27 Jun 2024 02:14:20 GMT

GET
H3 200 counters.gif
perf-na1.hsforms.com/embed/v3/ 35 B
928 B 145ms
124ms Image
image/gif 104.19.175.188
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://perf-na1.hsforms.com/embed/v3/counters.gif?key=config-loaded-success&value=1

Protocol

Security

QUIC, , AES_128_GCM

Server

104.19.175.188 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://www.cybereason.com/blog/i-am-goot-loader
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 26 Jun 2024 02:14:20 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: MISS
x-evy-trace-route-service-name: envoyset-translator
x-hubspot-correlation-id: 98927add-e53f-4f6b-9a5a-805576936b48
x-envoy-upstream-service-time: 4
alt-svc: h3=":443"; ma=86400
content-length: 35
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: 98927add-e53f-4f6b-9a5a-805576936b48
last-modified: Wed, 26 Jun 2024 02:14:20 GMT
server: cloudflare
vary: origin, Accept-Encoding
content-type: image/gif
x-evy-trace-virtual-host: all
x-evy-trace-served-by-pod: iad02/star-hubspot-td/envoy-proxy-776cb5686f-k4hjn
access-control-expose-headers: X-Origin-Hublet
cache-control: max-age=0, no-cache, no-store
access-control-allow-credentials: false
accept-ranges: bytes
x-robots-tag: none
cf-ray: 8999aee8ef4b19ab-FRA

GET
H2 200 otFlat.json Show response
cdn.cookielaw.org/scripttemplates/6.38.0/assets/ 13 KB
3 KB 20ms
20ms Fetch
application/json 2606:4700::6813:b134
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/6.38.0/assets/otFlat.json

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/6.38.0/otBannerSdk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6813:b134 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

14e4d1596c6b58896dfce1fc1ec45372bab4d2259ba82828fa3f96cc4f859fc4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://www.cybereason.com/blog/i-am-goot-loader
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-ms-blob-type: BlockBlob
date: Wed, 26 Jun 2024 02:14:20 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
content-md5: l8TaFfqEBdbGRIscoE5PLQ==
age: 47634
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-length: 3007
x-ms-lease-status: unlocked
last-modified: Thu, 21 Jul 2022 06:31:09 GMT
server: cloudflare
etag: 0x8DA6AE29925C8FF
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: *
x-ms-request-id: 231785ec-101e-006e-1cb2-126cac000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: max-age=86400
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 8999aee8fa472bb5-FRA

GET
H2 200 otPcCenter.json Show response
cdn.cookielaw.org/scripttemplates/6.38.0/assets/v2/ 62 KB
13 KB 23ms
23ms Fetch
application/json 2606:4700::6813:b134
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/6.38.0/assets/v2/otPcCenter.json

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/6.38.0/otBannerSdk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6813:b134 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c0c36470d3b6f534495768bdd7ed92dbb0d6d8d1f3b7b69adba7153b68b90f35

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://www.cybereason.com/blog/i-am-goot-loader
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-ms-blob-type: BlockBlob
date: Wed, 26 Jun 2024 02:14:20 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
content-md5: JtD7zjxzBe/apQLaCwCdaw==
age: 4064
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-length: 13258
x-ms-lease-status: unlocked
last-modified: Thu, 21 Jul 2022 06:31:11 GMT
server: cloudflare
etag: 0x8DA6AE29A87E4A6
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: *
x-ms-request-id: 6ac2ca45-e01e-0018-1667-79e6e4000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: max-age=86400
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 8999aee8fa482bb5-FRA

GET
H2 200 otCookieSettingsButton.json Show response
cdn.cookielaw.org/scripttemplates/6.38.0/assets/ 5 KB
2 KB 22ms
21ms Fetch
application/json 2606:4700::6813:b134
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/6.38.0/assets/otCookieSettingsButton.json

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/6.38.0/otBannerSdk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6813:b134 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a09d0f89e99cf5a081315ff701187632005dabd23f3ca116a75790003faa7e8f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://www.cybereason.com/blog/i-am-goot-loader
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-ms-blob-type: BlockBlob
date: Wed, 26 Jun 2024 02:14:20 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
content-md5: keZk8SpZZgHvyFwdMFhvhQ==
age: 34677
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-length: 1767
x-ms-lease-status: unlocked
last-modified: Thu, 21 Jul 2022 06:31:10 GMT
server: cloudflare
etag: 0x8DA6AE29A3CDCC9
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: *
x-ms-request-id: 5b063f02-301e-0024-20c0-12cf23000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: max-age=86400
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 8999aee8fa492bb5-FRA

GET
H2 200 otCommonStyles.css Show response
cdn.cookielaw.org/scripttemplates/6.38.0/assets/ 22 KB
5 KB 22ms
22ms Fetch
text/css 2606:4700::6813:b134
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/6.38.0/assets/otCommonStyles.css

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/6.38.0/otBannerSdk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6813:b134 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

17770d05051a8a4f270ba5bdf049b90cc166ac42bd4513f419308a5804d7a161

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://www.cybereason.com/blog/i-am-goot-loader
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-ms-blob-type: BlockBlob
date: Wed, 26 Jun 2024 02:14:20 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: gzip
content-md5: TLLtdkuMahUQRVIfmZNHNw==
age: 47042
x-ms-lease-status: unlocked
last-modified: Thu, 21 Jul 2022 06:31:23 GMT
server: cloudflare
vary: Accept-Encoding
content-type: text/css
access-control-allow-origin: *
x-ms-request-id: 35257943-701e-000a-07dc-129d34000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: max-age=86400
x-ms-version: 2009-09-19
cf-ray: 8999aee8fa4a2bb5-FRA

GET
H2 200 3354902.js Show response
js.hs-scripts.com/ 2 KB
1 KB 152ms
117ms Script
application/javascript 2606:4700::6810:89d1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://js.hs-scripts.com/3354902.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TJVVB7C

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:89d1 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b8b5533e59b5ab7cc281c0db4913f5ac2b68c633696b5b150506854949f465ce

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://www.cybereason.com/blog/i-am-goot-loader
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 26 Jun 2024 02:14:20 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: EXPIRED
x-evy-trace-route-service-name: envoyset-translator
x-hubspot-correlation-id: f51a5473-736a-4b09-8c2e-75e36c547bcf
x-envoy-upstream-service-time: 4
content-length: 642
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: f51a5473-736a-4b09-8c2e-75e36c547bcf
last-modified: Wed, 26 Jun 2024 01:21:31 GMT
server: cloudflare
vary: origin, Accept-Encoding
access-control-max-age: 3600
content-type: application/javascript;charset=utf-8
access-control-allow-origin: https://www.cybereason.com
x-evy-trace-virtual-host: all
x-evy-trace-served-by-pod: iad02/hubapi-td/envoy-proxy-7dd59b876-7cw97
access-control-allow-credentials: true
cache-control: public, max-age=90
accept-ranges: bytes
cf-ray: 8999aee93e5c1965-FRA
expires: Wed, 26 Jun 2024 02:15:50 GMT

GET
DATA 200
OK truncated
/ 817 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: db311174b0e3c340727b63c055cfb5b317808e909503e1bda11cc58af444f12b

Request headers

Accept-Language: de-DE,de;q=0.9;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H2 200 powered_by_logo.svg
cdn.cookielaw.org/logos/static/ 5 KB
2 KB 16ms
16ms Image
image/svg+xml 2606:4700::6813:b134
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cdn.cookielaw.org/logos/static/powered_by_logo.svg

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6813:b134 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5fa00d047acd959697b9d7772c31dcd37bec33c70c6fbf80ab8316205d1d286d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://www.cybereason.com/blog/i-am-goot-loader
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-ms-blob-type: BlockBlob
date: Wed, 26 Jun 2024 02:14:20 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: gzip
content-md5: Y+c301RBZNK39PvKQWrIBw==
age: 6943
x-ms-lease-status: unlocked
last-modified: Tue, 25 Jun 2024 02:35:43 GMT
server: cloudflare
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
x-ms-request-id: 7db24059-e01e-000d-0d32-c77c86000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: max-age=86400
x-ms-version: 2009-09-19
cf-ray: 8999aee94f21bb65-FRA

POST
H2 204 collect
region1.google-analytics.com/g/ 0
0 61ms
13ms Fetch
text/plain 2001:4860:4802:32::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://region1.google-analytics.com/g/collect?v=2&tid=G-PZ3FE06790&gtm=45je46o1v893336776za200&_p=1719368058820&gcs=G100&gcd=13p3pPp2p5&npa=1&dma_cps=-&dma=1&tag_exp=0&gdid=dZTQ1Zm&cid=1933585023.1719368061&ul=de-de&sr=1600x1200&ir=1&uaa=x86&uab=64&uafvl=Not%252FA)Brand%3B8.0.0.0%7CChromium%3B126.0.6478.126%7CGoogle%2520Chrome%3B126.0.6478.126&uamb=0&uam=&uap=Win32&uapv=10.0.0&uaw=0&are=1&frm=0&pscdl=denied&_eu=Eg&_s=1&sid=1719368059&sct=1&seg=0&dl=https%3A%2F%2Fwww.cybereason.com%2Fblog%2Fi-am-goot-loader&dt=I%20am%20Goot%20(Loader)&en=page_view&_fv=1&_nsi=1&_ss=1&_ee=1&tfd=2970&_z=fetch
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-PZ3FE06790
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:32::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://www.cybereason.com/blog/i-am-goot-loader
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Wed, 26 Jun 2024 02:14:21 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.cybereason.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 collect
region1.google-analytics.com/g/ 0
0 26ms
14ms Fetch
text/plain 2001:4860:4802:32::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://region1.google-analytics.com/g/collect?v=2&tid=G-PZ3FE06790&gtm=45je46o1v893336776za200&_p=1719368058820&gcs=G100&gcd=13p3pPp2p5&npa=1&dma_cps=-&dma=1&tag_exp=0&gdid=dZTQ1Zm&cid=1933585023.1719368061&ul=de-de&sr=1600x1200&ir=1&uaa=x86&uab=64&uafvl=Not%252FA)Brand%3B8.0.0.0%7CChromium%3B126.0.6478.126%7CGoogle%2520Chrome%3B126.0.6478.126&uamb=0&uam=&uap=Win32&uapv=10.0.0&uaw=0&are=1&frm=0&pscdl=denied&_eu=EEA&_s=2&sid=1719368059&sct=1&seg=0&dl=https%3A%2F%2Fwww.cybereason.com%2Fblog%2Fi-am-goot-loader&dt=I%20am%20Goot%20(Loader)&en=scroll&epn.percent_scrolled=90&_et=10&tfd=3000&_z=fetch
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-PZ3FE06790
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:32::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://www.cybereason.com/blog/i-am-goot-loader
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Wed, 26 Jun 2024 02:14:21 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.cybereason.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Verdicts & Comments Add Verdict or Comment

92 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

17 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.www.cybereason.com/	1970-01-20 21:36:09	Name: __cf_bm Value: m4qKO1VBou83DMXXafNKYTUJQH53XeE.f8bJJkoi5C4-1719368058-1.0.1.1-D6M.iM2hICkezWEjK3hPFwv4JWULyEpm7lH4IweOevOif9NOFgFqcIKfWVIT1LQCcXSJF66dYBLM6iBCK78NXQ
.www.cybereason.com/	1969-12-31 23:59:59	Name: __cfruid Value: 836c74f94642ea8fd2c3e5bff5d5cc1ad1d19083-1719368058
.cybereason.com/	1970-01-21 06:20:37	Name: visid_incap_2710048 Value: 8BYARxw4RsmBW6KeuGAByXp5e2YAAAAAQUIPAAAAAAAau9E1MhJNbHczJ3+oSAy+
.cybereason.com/	1969-12-31 23:59:59	Name: nlbi_2710048 Value: qnKxEHiAyzNEQfSg2P/mMAAAAABzTQvnZo/BtjTKmjpYxWjG
.cybereason.com/	1969-12-31 23:59:59	Name: incap_ses_532_2710048 Value: WPe+BhYN3whsKZ0NQQtiB3p5e2YAAAAAZP5U7gigjZQXx3xVR2t6ig==
.hubspot.com/	1970-01-20 21:36:09	Name: __cf_bm Value: uNniUpZLPvn_uWyNvJsXRIpI1Cv7Isbt._2vDVklP30-1719368059-1.0.1.1-0xGhcA9b_uqa7wGTX7sMzn37dOjpPjfZGtYHH2jgvCYgXi1jiRzqmiEO3sNStjwfgJ8_M5tvhz63p0YY36.4PA
.hubspot.com/	1969-12-31 23:59:59	Name: _cfuvid Value: O6WeFVXU5QwElxMixa.GnHQWsZro0RdLdBEPi.uF7CA-1719368059838-0.0.1.1-604800000
.cybereason.com/	1970-01-21 07:12:08	Name: _ga Value: GA1.2.129924175.1719368060
.cybereason.com/	1970-01-20 21:37:34	Name: _gid Value: GA1.2.1769223654.1719368060
.cybereason.com/	1970-01-20 21:36:08	Name: _gat Value: 1
.cybereason.com/	1970-01-21 01:55:20	Name: __hstc Value: 85683782.3bb0509c69db413087f3411b83018fc3.1719368060112.1719368060112.1719368060112.1
.cybereason.com/	1970-01-21 01:55:20	Name: hubspotutk Value: 3bb0509c69db413087f3411b83018fc3
.cybereason.com/	1969-12-31 23:59:59	Name: __hssrc Value: 1
.cybereason.com/	1970-01-20 21:36:09	Name: __hssc Value: 85683782.1.1719368060112
.cybereason.com/	1970-01-21 06:21:44	Name: OptanonConsent Value: isGpcEnabled=0&datestamp=Wed+Jun+26+2024+04%3A14%3A20+GMT%2B0200+(Mitteleurop%C3%A4ische+Sommerzeit)&version=6.38.0&isIABGlobal=false&hosts=&landingPath=https%3A%2F%2Fwww.cybereason.com%2Fblog%2Fi-am-goot-loader&groups=C0001%3A1%2CC0004%3A0%2CC0002%3A0%2CC0003%3A0
.hsforms.com/	1970-01-20 21:36:09	Name: __cf_bm Value: b_OusczXHwc1sd1qXJGWP6_n29UnLaqVIcWRrrbX0qs-1719368060-1.0.1.1-9AkaK74_QAxB7nE9CGoA9DqJOGF3o4F9J5xg4qwZHjFFj9a_S2NsonCm6KtWl9zgsjwblaHafcqpu.OslCiGRw
.hsforms.com/	1969-12-31 23:59:59	Name: _cfuvid Value: eXBP5HDLEsLdefb_lmHYIHqJeic4EZVi6gm0gxfsrZs-1719368060413-0.0.1.1-604800000

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
javascript	warning	URL: https://www.cybereason.com/blog/i-am-goot-loader Message: The resource https://www.cybereason.com/hubfs/__dam/fonts/ionicons.eot was preloaded using link preload but not used within a few seconds from the window's load event. Please make sure it has an appropriate `as` value and it is preloaded intentionally.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	deny

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ajax.googleapis.com
app.hubspot.com
cdn.cookielaw.org
cdn2.hubspot.net
cdnjs.cloudflare.com
connect.facebook.net
cta-service-cms2.hubspot.com
fonts.googleapis.com
fonts.gstatic.com
forms.hubspot.com
geolocation.onetrust.com
js.hs-analytics.net
js.hs-banner.com
js.hs-scripts.com
js.hsleadflows.net
js.hubspot.com
p.typekit.net
perf-na1.hsforms.com
platform.linkedin.com
platform.twitter.com
region1.google-analytics.com
static.hsappstatic.net
stats.g.doubleclick.net
track.hubspot.com
use.typekit.net
www.cybereason.com
www.google-analytics.com
www.google.com
www.google.de
www.googletagmanager.com
104.17.24.14
104.18.88.62
104.19.175.188
142.250.185.132
142.250.185.99
157.240.0.6
2001:4860:4802:32::36
2606:2800:233:66b5:799a:7cd3:f74d:7071
2606:2800:234:46c:e8b:1e2f:2bd:694
2606:2800:234:59:254c:406:2366:268c
2606:4700:4400::ac40:991b
2606:4700:4400::ac40:9b77
2606:4700::6810:7674
2606:4700::6810:89d1
2606:4700::6811:ae5b
2606:4700::6811:afc9
2606:4700::6812:8b11
2606:4700::6813:b134
2a00:1450:4001:81d::200a
2a00:1450:4001:828::200e
2a00:1450:4001:829::2003
2a00:1450:4001:82a::200a
2a00:1450:4001:830::2008
2a00:1450:400c:c06::9b
2a02:26f0:3500:16::215:1495
2a03:2880:f084:105:face:b00c:0:3
45.60.107.106
022e2f39deba7f332eabe69b27b31d98d4d5f2535116745957a691d1b1ec4cc5
05b6bbd7223cfe57d1edbcf2b1f3a7a2570a7dbbb730183185b43d9eb45f193d
09edf98c454b11870a1a667cacab183aaf34e51f53dedb3fa735b9afac34f402
0b281bf2f4179c06ba68f0a427f2341287c41eacc2ce9d534c6f5c513ac633fb
0b454edb897d49bf8a73b07627b670a55f0972988094770495a308e5a5e39d1b
0c33072c2e37faa2b2acd3f76a15c44139cadb7999ec9405382b67eab4161003
0d8601a776b7dc777cd23bc42392d05a43df0d6402328e8913b58811083b513d
0dfb22afe7173c577144301206aee5fa3939268bfefb7adb44906fa81cb7a1d2
0f62e3e5f677efe75860052589b895e2252887cb0831bec361b5130ea2a67bc0
0f94c946a13b9ebe43281550b7d0c00edf4694ad06bcb4c8679bee6d48df5115
119bf322a2ce6d2a82422b51404bc54b375c881f12a120205598d1691fa48820
12127e3110351f54262db955bafe353593dd58c89c7f6b6fc159c10515e93c61
14e4d1596c6b58896dfce1fc1ec45372bab4d2259ba82828fa3f96cc4f859fc4
173460e89e6a7244218badae2016f65c48a3eae9d400802273eeca18b07336f1
17770d05051a8a4f270ba5bdf049b90cc166ac42bd4513f419308a5804d7a161
17a31aae550a664382ab9d8085efc03a10a4548985f33ac4e5a533d5ab5e9339
1ef8b59b832109ecbec2f9ed52e8073e2ab73862fa5e6697e1fe05d1c8358a02
2157361193375a79ade3559e960f982daa8d599cf7f4a92d36e3eef257738f16
266d85b7ad351501b8651b0e659d6d74fbe07085d3226cd3f7601f6522fbdf97
2746bfb43c93f079e563d17726cb1ff69a63464ffa03b89c0f0427e11585d864
28acd7b513f08e4f3d6e941227479bdf8585005aa8c42824e610e9e986df35b9
28d99ad8103f148a1cf63a25d1369e0bd7d220f97ca36ac12cf8a8c7b2060fcc
2b14e8397d552f351a4396dec25ec5da1348865683100e94c4ab0faea4a9a254
2ba7f20b1d8990e17a47fe3d88e4c766628aaa2baf1dd30fca0a0db59836f5f9
2ca281bdcd543e2e3559e6505c323c8d64df73f2a594a043780df3007e16d161
2d2c4912162eaa41299aaf5063ecb92a26d76071fe6d1f77742b32c833daab99
30b918c4b19f852851c6ed2e69766306b1ab23c761e5eff8d2a0b7a5e759e2aa
33ff6b6486bdc5883c2c63e8278e8a547ca86b1f6026667f7733fec6b52a1303
356bb4bf2245a68ee5de5732b5574260dd2016a2c3987e17ad97fb2586a883d1
366120e2326e2bdd429018ada075a3e1b3df7d776f74ae9fb98c7f666a0d632a
38b5fa249791d286db654d516dfb6173cc332a8d725c41b58d08c642b26bc641
3a9e725bae41656623ccda8be25cbdd295ee1c73c8d3016023549a83c261a3ab
3c4d6a1421c7ddb7e404521fe8c4cd5be5af446d7689cd880be26612eaad3cfa
42b2b9d16fbf8d3c6be72420699360790966e58fe30d8794fd90a71c8aef122d
458235328e4f7da4ccbe1e308d9f688e6cc5079212285f307cfa43e076c1dbee
471396e29b06693a8ac67bdea63c6c03bb251d4fcd52d3203e20897642f25f79
48354b41323305716c9fd1314dbfc4ca0ca3b41aeafb995cc65b2205b1f9dd35
5282c4c2ad4eae12ce8ec81c386393254df5da769c7d8fb8155351165fb2eab4
599dd661a1d9e0af96d614fab0ea7396bf06de4265029166a265c2b10cc1a1b0
5c8d63abd4075c4ebd692fbd02e35fb72950f214a6486607c1819d4279ad526f
5fa00d047acd959697b9d7772c31dcd37bec33c70c6fbf80ab8316205d1d286d
5fbaeb9f8e25d7e0143bae61d4b1802c16ce7390b96ceb2d498b0d96ff4c853f
65a47caa5183b035bf78d0f93adbe5cea500333410259c54abf2de356740df7e
65a923b747d84787bc4e01270fa29f4314d3d36df432cd3eb801c30f8adfd466
66ba9d76c09ad6dd52135d52c368f6d87ac40b5b4ce418e41a105fb221c7e470
6814ef46f686990cf4e946f966167b0507e1d642c44e51f61bffb0bba2d4672b
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992
72493a3f42ed0260f03b6ffd3ea131be38a1070845bfae24927f643a3fcf3255
72fe18777ebf37b44d58c82be9b67edceefb88c2c6984c614c72991d6e3b8853
799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd
7ec3b76de15bcc7d610ebb0768a74983824ed88e17ef343875a4bafc792e53cb
81c836c05ab1f2d37b7aa60d509a656c7a441e2a4fabf035c1b0666a4daa50fa
843803aeba82f94da6f1cbe1f853ccd12f5d7cc6a3afa20923e57e5df60c412d
84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80
85ce42d99ae7d93a9df2304eedc16e1b26d492c38f5b9d034ea5c09c8a996c8f
875f8e591b4fbc6567e2b33553bea9ca2d0e18593bd857783a569fe7bf4ba097
8da927b6b1240ffca4323fbb2a12c8e5abb541040965c2bc5b7d09a2eb963b02
8dcc3e8e69dda9701f64d4b6dc75044a79c4887b85629e7282683214a28ea605
8f657cd3617d00d51bbc4dee693b71bde939c80310034a8d82641804d4eb7e16
90c4f0951056e5a82b2150c8b3fe6d011a08ea2abc957453d080b8179504e2d7
95d5bb11fee6ddf9b6af49e5c0621d6dd3b84fdc5798795e38254ff8bbaace63
98dfeb1d061e8788b320a130a84723813efed0b2518921f30b40cc8a09bf8ecf
9967a27efc89a8cefe9665100ec51cded3a8c89f95cdca1285bfce207666cd11
9a45c89da6cfa94009a61215c8921175ec1bf18444adb5bcba07e22e9b12954d
9b9265c69a5cc295d1ab0d04e0273b3677db1a6216ce2ccf4efc8c277ed84b39
9cec59b071d9d61e74c42ac4db8d2815aaace7e51983afe2481c14b97f332258
9d943fe5fde08d5b742d383b625031f75e3e89035369f2cde2778f4c6cf5c119
a09d0f89e99cf5a081315ff701187632005dabd23f3ca116a75790003faa7e8f
a4803d7bdeb478a5b9238fe74d8aaa98dafe2e8e68fccbd0e3f4dced823f27f0
a6728e3326fe3805e12f697731cbc97f2a5b773533c1cb4be0c56da998a94db6
ab1fca31f7e7a89c198881e69c42c6bb3578b7d55f2cee7463b96360feaf7eaa
abb03b2160dd9f75fa8eb557ca242d7cd93f159d53708c58f4d2887bd4f05ead
aec60bc104db041b1512185839f18f52986df7e569e5445f740dd60f763fbca8
af91213cd670d6270b32ebdeb00a09625f6b74ccd780d12ff6724a14ea1efaff
b0bb6a25cef0b27119b7598fd8dd56f38a4563ca0ee0fcbba8f7638c487f0b2d
b48f9a7031474a0f73f92f2e6cbbfad730b5466cda96d86a4459c06efc986173
b66b9b351cf699e4269a636d7dc515b51aaadbcf14af4a756d8a00b1929e9fe0
b6c9f9a48bd0a163671773a199c876dc64d66947d47ac509c95e29177046c9a3
b8b5533e59b5ab7cc281c0db4913f5ac2b68c633696b5b150506854949f465ce
c0c36470d3b6f534495768bdd7ed92dbb0d6d8d1f3b7b69adba7153b68b90f35
c9130ee8c979a74ab038cf5e8a06db5cb94253eab35ea5242f515d605f4781ad
cf26830a024aba2d001dbd04f1fe4332f5e5d4fb5ae52052eb47213892c6a1c9
d007331178e80dc9232205c02741fb76fb25d27d8df7a1dab38f46d04e4f670e
d2733f3936960eead81ec9f71738a38869367d6711831096d3aad134338c2795
d66d63ef49d9f05d4cfacb6e2405e0c5d02800aa437b6aaf7d4f8f057b334fdb
d82231820461c83d1b0966caae71bd2732bd89e9a910fdb90d193c3dca16dbc7
db311174b0e3c340727b63c055cfb5b317808e909503e1bda11cc58af444f12b
db3795e97fd1a0e19c52e7ff057e74206b7ccdaa0cb0902510b567a7065f130e
dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4
dd26d9d88899d0587c9377964b7d1ab478a318b0fdbee7b9d6a084e4aa6425f7
dd8ce52adc4b0ab60f82c29ba12f25e2f6446245fc8c0b5f4bd6dab3146f9ef7
de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd
e18234d885ed9a551c15b4a6db8a66f519058a512c928a61e22c9d479203feb5
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e90344957225c9e0caa52e2591fd6066740e0650bc100c422435762160fb2e33
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f16a9696b3176614d3fe439def6fd9754fd489877999517b99b3b2f265cb7990
f24560f5b81158a42b8d38ffe5795d9959eb2308ee6780ea912a6594bb999d1e
f3f2822ba3d24c1f7f53bff8959801c644b2c1c556eb8c15ca36a86717f1ae7d
f533e083f3d896349ecf4b75a3b17a2e5155b309318af9dc44965ce50c66a1dd
f64368e7be69abe40585911860d83acfa8b14179d3008b2594166ae4c10ec0fd
f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d
f826bcac220a5475477ee65fae659b0d8292d038d180a122df67fadb6742ed52
f9db6465a204cc4186368b72a0ba4f063e64569aa4fc96e0f40c7ac69423121b
fcba0ef5c17fd435aaa6cfac66375e7bfae52f5116b7a6e126c8b0f38b841613
fd6c0f5026c29648ab8887658f23e6c57faedfe7f9d85e702823ae5dfcbdc8f0
fe9ce59aa6f3f2c6d0be658bec3e8515959f544fed27adc4506480cb9ead5157

www.cybereason.com Open in urlscan Pro 45.60.107.106 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

120 Requests

100 %HTTPS

74 %IPv6

23 Domains

30 Subdomains

28 IPs

4 Countries

4401 kBTransfer

7776 kBSize

17 Cookies

32 Outgoing links

Redirected requests

120 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

www.cybereason.com Open in urlscan Pro
45.60.107.106 Public Scan

Screenshot
Live screenshot

Full Image

120
Requests

100 %
HTTPS

74 %
IPv6

23
Domains

30
Subdomains

28
IPs

4
Countries

4401 kB
Transfer

7776 kB
Size

17
Cookies

120 HTTP transactions
1 data transactions