urlscan.io logo urlscan.io
SecurityTrails logo

www.cshub.com Open in urlscan Pro
18.214.148.166  Public Scan

Go To Rescan Add Verdict Report
Submitted URL: http://app.connect.awspls.com/e/er?s=893759278&lid=75595&elqTrackId=052741E3ED7A89DC71F3A0F9714A7DBE&elq=eca45780138f40bb83d67...
Effective URL: https://www.cshub.com/threat-defense/whitepapers/deadringer-exposing-chinese-threat-actors-targeting-major-telcos?utm_...
Submission: On September 18 via api from SG — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 34 IPs in 3 countries across 31 domains to perform 70 HTTP transactions. The main IP is 18.214.148.166, located in Ashburn, United States and belongs to AMAZON-AES, US. The main domain is www.cshub.com.
TLS certificate: Issued by Amazon on February 23rd 2021. Valid for: a year.
This is the only time www.cshub.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 1 142.0.160.54 7160 (NETDYNAMICS)
1 2 142.0.160.53 7160 (NETDYNAMICS)
3 18.214.148.166 14618 (AMAZON-AES)
1 151.101.65.229 54113 (FASTLY)
3 172.67.214.69 13335 (CLOUDFLAR...)
1 69.16.175.10 20446 (HIGHWINDS3)
3 172.217.18.98 15169 (GOOGLE)
2 172.217.16.136 15169 (GOOGLE)
8 104.84.56.126 16625 (AKAMAI-AS)
1 13.224.193.9 16509 (AMAZON-02)
2 142.250.185.98 15169 (GOOGLE)
7 52.216.84.8 16509 (AMAZON-02)
3 104.111.233.140 16625 (AKAMAI-AS)
1 142.250.186.170 15169 (GOOGLE)
1 2.18.235.40 16625 (AKAMAI-AS)
2 34.96.102.137 15169 (GOOGLE)
1 2.18.234.132 16625 (AKAMAI-AS)
1 172.67.159.92 13335 (CLOUDFLAR...)
2 31.13.92.14 32934 (FACEBOOK)
2 52.208.138.90 16509 (AMAZON-02)
1 142.250.186.131 15169 (GOOGLE)
3 13.225.78.88 16509 (AMAZON-02)
1 37.252.172.250 29990 (ASN-APPNEX)
1 2 108.174.11.37 14413 (LINKEDIN)
1 1 13.107.42.14 8068 (MICROSOFT...)
2 31.13.92.36 32934 (FACEBOOK)
2 142.250.185.142 15169 (GOOGLE)
7 107.21.25.45 14618 (AMAZON-AES)
1 13.225.78.3 16509 (AMAZON-02)
1 104.111.229.66 16625 (AKAMAI-AS)
1 50.16.141.78 14618 (AMAZON-AES)
1 142.250.185.228 15169 (GOOGLE)
1 172.217.18.99 15169 (GOOGLE)
1 74.125.133.156 15169 (GOOGLE)
2 2 76.223.111.131 16509 (AMAZON-02)
1 35.167.195.195 16509 (AMAZON-02)
70 34
1    142.0.160.54 (Ashburn, United States)

ASN7160 (NETDYNAMICS, US)
app.connect.awspls.com
2    142.0.160.53 (Ashburn, United States)

ASN7160 (NETDYNAMICS, US)
s893759278.t.eloqua.com
3    18.214.148.166 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-18-214-148-166.compute-1.amazonaws.com
www.cshub.com
1    151.101.65.229 (United States)

ASN54113 (FASTLY, US)
cdn.jsdelivr.net
3    172.67.214.69 (United States)

ASN13335 (CLOUDFLARENET, US)
use.fontawesome.com
1    69.16.175.10 (United States)

ASN20446 (HIGHWINDS3, US)
PTR: hwcdn.net
code.jquery.com
3    172.217.18.98 (United States)

ASN15169 (GOOGLE, US)
PTR: zrh04s05-in-f98.1e100.net
securepubads.g.doubleclick.net
2    172.217.16.136 (United States)

ASN15169 (GOOGLE, US)
PTR: zrh04s06-in-f136.1e100.net
www.googletagmanager.com
8    104.84.56.126 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a104-84-56-126.deploy.static.akamaitechnologies.com
s7.addthis.com
v1.addthisedge.com
m.addthis.com
api-public.addthis.com
1    13.224.193.9 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-224-193-9.fra2.r.cloudfront.net
assets.pcrl.co
2    142.250.185.98 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s49-in-f2.1e100.net
www.googleadservices.com
googleads.g.doubleclick.net
7    52.216.84.8 (Ashburn, United States)

ASN16509 (AMAZON-02, US)
PTR: s3-1-w.amazonaws.com
plsadaptive.s3.amazonaws.com
3    104.111.233.140 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a104-111-233-140.deploy.static.akamaitechnologies.com
j.6sc.co
c.6sc.co
b.6sc.co
1    142.250.186.170 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s08-in-f10.1e100.net
fonts.googleapis.com
1    2.18.235.40 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a2-18-235-40.deploy.static.akamaitechnologies.com
z.moatads.com
2    34.96.102.137 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 137.102.96.34.bc.googleusercontent.com
dev.visualwebsiteoptimizer.com
1    2.18.234.132 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a2-18-234-132.deploy.static.akamaitechnologies.com
snap.licdn.com
1    172.67.159.92 (United States)

ASN13335 (CLOUDFLARENET, US)
cdn.feathr.co
2    31.13.92.14 (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)
PTR: xx-fbcdn-shv-01-frt3.fbcdn.net
connect.facebook.net
2    52.208.138.90 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-208-138-90.eu-west-1.compute.amazonaws.com
ml314.com
1    142.250.186.131 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s07-in-f3.1e100.net
fonts.gstatic.com
3    13.225.78.88 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-225-78-88.fra2.r.cloudfront.net
system.picreel.com
1    37.252.172.250 (Frankfurt am Main, Germany)

ASN29990 (ASN-APPNEX, US)
PTR: 538.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net
secure.adnxs.com
2    108.174.11.37 (United States)

ASN14413 (LINKEDIN, US)
PTR: 108-174-11-37.fwd.linkedin.com
px.ads.linkedin.com
1    13.107.42.14 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
www.linkedin.com
2    31.13.92.36 (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)
PTR: edge-star-mini-shv-01-frt3.facebook.com
www.facebook.com
2    142.250.185.142 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s50-in-f14.1e100.net
www.google-analytics.com
7    107.21.25.45 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-107-21-25-45.compute-1.amazonaws.com
polo.feathr.co
polo-v1.feathr.co
1    13.225.78.3 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-225-78-3.fra2.r.cloudfront.net
marco.feathr.co
1    104.111.229.66 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a104-111-229-66.deploy.static.akamaitechnologies.com
img04.en25.com
1    50.16.141.78 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-50-16-141-78.compute-1.amazonaws.com
in.ml314.com
1    142.250.185.228 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s53-in-f4.1e100.net
www.google.com
1    172.217.18.99 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s42-in-f3.1e100.net
www.google.de
1    74.125.133.156 (United States)

ASN15169 (GOOGLE, US)
PTR: wo-in-f156.1e100.net
stats.g.doubleclick.net
2    76.223.111.131 (United States)

ASN16509 (AMAZON-02, US)
PTR: a97adde81b00f2ca4.awsglobalaccelerator.com
match.adsrvr.org
1    35.167.195.195 (Boardman, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-35-167-195-195.us-west-2.compute.amazonaws.com
app.picreel.com
Apex Domain
Subdomains		 Transfer
9 feathr.co
cdn.feathr.co
polo.feathr.co
marco.feathr.co
polo-v1.feathr.co
43 KB
7 amazonaws.com
plsadaptive.s3.amazonaws.com
218 KB
7 addthis.com
s7.addthis.com
m.addthis.com
api-public.addthis.com
218 KB
5 doubleclick.net
securepubads.g.doubleclick.net
googleads.g.doubleclick.net
stats.g.doubleclick.net
144 KB
4 picreel.com
system.picreel.com
app.picreel.com
24 KB
3 linkedin.com
px.ads.linkedin.com
www.linkedin.com
3 KB
3 ml314.com
ml314.com
in.ml314.com
14 KB
3 6sc.co
j.6sc.co
c.6sc.co
b.6sc.co
8 KB
3 fontawesome.com
use.fontawesome.com
106 KB
3 cshub.com
www.cshub.com
702 KB
2 adsrvr.org
match.adsrvr.org
956 B
2 google-analytics.com
www.google-analytics.com
20 KB
2 facebook.com
www.facebook.com
442 B
2 facebook.net
connect.facebook.net
114 KB
2 visualwebsiteoptimizer.com
dev.visualwebsiteoptimizer.com
2 KB
2 googletagmanager.com
www.googletagmanager.com
72 KB
2 eloqua.com
s893759278.t.eloqua.com
1 KB
1 google.de
www.google.de
569 B
1 google.com
www.google.com
569 B
1 en25.com
img04.en25.com
6 KB
1 addthisedge.com
v1.addthisedge.com
983 B
1 adnxs.com
secure.adnxs.com
689 B
1 gstatic.com
fonts.gstatic.com
47 KB
1 licdn.com
snap.licdn.com
2 KB
1 moatads.com
z.moatads.com
1 KB
1 googleapis.com
fonts.googleapis.com
1 KB
1 googleadservices.com
www.googleadservices.com
17 KB
1 pcrl.co
assets.pcrl.co
2 KB
1 jquery.com
code.jquery.com
24 KB
1 jsdelivr.net
cdn.jsdelivr.net
4 KB
1 awspls.com
app.connect.awspls.com
755 B
70 31
Domain Requested by
7 plsadaptive.s3.amazonaws.com www.cshub.com
6 polo.feathr.co cdn.feathr.co
www.cshub.com
3 api-public.addthis.com s7.addthis.com
3 system.picreel.com assets.pcrl.co
system.picreel.com
3 s7.addthis.com www.cshub.com
s7.addthis.com
3 securepubads.g.doubleclick.net www.cshub.com
securepubads.g.doubleclick.net
3 use.fontawesome.com www.cshub.com
use.fontawesome.com
3 www.cshub.com www.cshub.com
2 match.adsrvr.org 2 redirects
2 www.google-analytics.com www.googletagmanager.com
www.google-analytics.com
2 www.facebook.com www.cshub.com
2 px.ads.linkedin.com 1 redirects www.cshub.com
2 ml314.com www.cshub.com
ml314.com
2 connect.facebook.net www.cshub.com
connect.facebook.net
2 dev.visualwebsiteoptimizer.com www.cshub.com
2 www.googletagmanager.com www.cshub.com
2 s893759278.t.eloqua.com 1 redirects www.cshub.com
1 app.picreel.com system.picreel.com
1 polo-v1.feathr.co www.cshub.com
1 stats.g.doubleclick.net www.google-analytics.com
1 www.google.de www.cshub.com
1 www.google.com www.cshub.com
1 in.ml314.com ml314.com
1 img04.en25.com www.cshub.com
1 m.addthis.com s7.addthis.com
1 v1.addthisedge.com s7.addthis.com
1 marco.feathr.co www.cshub.com
1 googleads.g.doubleclick.net www.googleadservices.com
1 b.6sc.co www.cshub.com
1 www.linkedin.com 1 redirects
1 secure.adnxs.com j.6sc.co
1 c.6sc.co j.6sc.co
1 fonts.gstatic.com fonts.googleapis.com
1 cdn.feathr.co www.cshub.com
1 snap.licdn.com www.cshub.com
1 z.moatads.com s7.addthis.com
1 fonts.googleapis.com www.cshub.com
1 j.6sc.co www.cshub.com
1 www.googleadservices.com www.cshub.com
1 assets.pcrl.co www.cshub.com
1 code.jquery.com www.cshub.com
1 cdn.jsdelivr.net www.cshub.com
1 app.connect.awspls.com 1 redirects
70 43
Subject Issuer Validity Valid
clninstitute.com
Amazon		 2021-02-23 -
2022-03-24		 a year crt.sh
jsdelivr.net
GlobalSign Atlas R3 DV TLS CA 2020		 2021-04-30 -
2022-06-01		 a year crt.sh
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3		 2021-07-07 -
2022-07-06		 a year crt.sh
*.jquery.com
Sectigo RSA Domain Validation Secure Server CA		 2021-07-14 -
2022-08-14		 a year crt.sh
*.g.doubleclick.net
GTS CA 1C3		 2021-08-30 -
2021-11-22		 3 months crt.sh
*.google-analytics.com
GTS CA 1C3		 2021-08-30 -
2021-11-22		 3 months crt.sh
odc-addthis-prod-01.oracle.com
DigiCert SHA2 Secure Server CA		 2021-04-25 -
2022-04-27		 a year crt.sh
assets.pcrl.co
Amazon		 2021-06-11 -
2022-07-10		 a year crt.sh
www.googleadservices.com
GTS CA 1C3		 2021-08-30 -
2021-11-22		 3 months crt.sh
*.s3.amazonaws.com
DigiCert Baltimore CA-2 G2		 2021-01-11 -
2022-02-11		 a year crt.sh
*.6sc.co
DigiCert SHA2 Secure Server CA		 2021-03-09 -
2022-03-16		 a year crt.sh
upload.video.google.com
GTS CA 1O1		 2021-08-30 -
2021-11-22		 3 months crt.sh
moatads.com
DigiCert SHA2 Secure Server CA		 2021-01-21 -
2022-01-25		 a year crt.sh
*.visualwebsiteoptimizer.com
Starfield Secure Certificate Authority - G2		 2020-06-19 -
2022-07-06		 2 years crt.sh
*.licdn.com
DigiCert SHA2 Secure Server CA		 2021-04-30 -
2022-05-11		 a year crt.sh
*.facebook.com
DigiCert SHA2 High Assurance Server CA		 2021-09-09 -
2021-12-08		 3 months crt.sh
*.ml314.com
Amazon		 2021-01-17 -
2022-02-14		 a year crt.sh
*.gstatic.com
GTS CA 1C3		 2021-08-30 -
2021-11-22		 3 months crt.sh
system.picreel.com
Amazon		 2020-12-27 -
2022-01-25		 a year crt.sh
*.adnxs.com
GeoTrust ECC CA 2018		 2021-03-05 -
2022-02-19		 a year crt.sh
px.ads.linkedin.com
DigiCert SHA2 Secure Server CA		 2021-09-16 -
2022-03-16		 6 months crt.sh
polo.feathr.co
R3		 2021-08-22 -
2021-11-20		 3 months crt.sh
marco.feathr.co
Amazon		 2020-08-22 -
2021-09-22		 a year crt.sh
*.en25.com
DigiCert SHA2 Secure Server CA		 2021-09-14 -
2022-09-14		 a year crt.sh
www.google.com
GTS CA 1C3		 2021-08-30 -
2021-11-22		 3 months crt.sh
www.google.de
GTS CA 1C3		 2021-08-30 -
2021-11-22		 3 months crt.sh
*.t.eloqua.com
DigiCert SHA2 Secure Server CA		 2020-03-09 -
2022-04-08		 2 years crt.sh
*.picreel.com
Amazon		 2020-12-27 -
2022-01-25		 a year crt.sh

This page contains 5 frames:

Primary Page: https://www.cshub.com/threat-defense/whitepapers/deadringer-exposing-chinese-threat-actors-targeting-major-telcos?utm_campaign=CSIQ-CD-21-09-16%20Cybereason%20-%20Content%20Syndication%20EM3&utm_medium=email&utm_source=internalemail&MAC=%7C1-OKRXKKD&elqContactId=16719758&disc=&elqCampId=104638&utm_content=CSIQ-CD-21-09-16%20Cybereason%20-%20Content%20Syndication%20EM3_A
Frame ID: 718A1298C203CB08D36C156E4257CAD0
Requests: 69 HTTP requests in this frame

Frame: https://s7.addthis.com/static/sh.f48a1a04fe8dbf021b4cda1d.html
Frame ID: 09BFEF5192A25DFF9501B3911ADC211F
Requests: 1 HTTP requests in this frame

Frame: https://s7.addthis.com/static/sh.f48a1a04fe8dbf021b4cda1d.html
Frame ID: 1BA6480A7C809F3C369F43919944F2B9
Requests: 1 HTTP requests in this frame

Frame: https://www.facebook.com/tr/
Frame ID: B7329BD373ECAC57240A7DD509167288
Requests: 1 HTTP requests in this frame

Frame: https://app.picreel.com/api/get_template?source_url=https%253A%252F%252Fwww.cshub.com%252Fthreat-defense%252Fwhitepapers%252Fdeadringer-exposing-chinese-threat-actors-targeting-major-telcos%253Futm_campaign%253DCSIQ-CD-21-09-16%252520Cybereason%252520-%252520Content%252520Syndication%252520EM3%2526utm_medium%253Demail%2526utm_source%253Dinternalemail%2526MAC%253D%25257C1-OKRXKKD%2526elqContactId%253D16719758%2526disc%253D%2526elqCampId%253D104638%2526utm_content%253DCSIQ-CD-21-09-16%252520Cybereason%252520-%252520Content%252520Syndication%252520EM3_A&source_host=https%253A%252F%252Fwww.cshub.com&templateId=&userAgent=Mozilla%252F5.0%2520(Windows%2520NT%252010.0%253B%2520Win64%253B%2520x64)%2520AppleWebKit%252F537.36%2520(KHTML%252C%2520like%2520Gecko)%2520Chrome%252F92.0.4515.159%2520Safari%252F537.36&referrer=&screenWight=1600&screenHeight=1200&pv=&pp=&sv=&sp=&nv=&np=&rb=&ret=&utm_source=Picreel&utm_medium=display&utm_campaign=Picreel
Frame ID: ACBE36E1D55E18CF98D8B36271B28DB4
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

DeadRinger: Exposing Chinese threat actors targeting major telcos | Cyber Security HubFacebookTwitterLinkedInEmailPrintAddThisFacebookTwitterLinkedInEmailPrintAddThisFacebookTwitterLinkedInEmailPrintAddThis

Page URL History Show full URLs

  1. http://app.connect.awspls.com/e/er?s=893759278&lid=75595&elqTrackId=052741E3ED7A89DC71F3A0F9714A7DBE&elq=e... HTTP 302
    https://s893759278.t.eloqua.com/e/er?s=893759278&lid=75595&elqTrackId=052741E3ED7A89DC71F3A0F9714A7DBE&elq=e... HTTP 302
    https://www.cshub.com/threat-defense/whitepapers/deadringer-exposing-chinese-threat-actors-targeti... Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • <link [^>]+(?:/([\d.]+)/)?animate\.(?:min\.)?css
Overall confidence: 100%
Detected patterns
  • <link rel="amphtml"
Overall confidence: 100%
Detected patterns
  • addthis\.com/js/
Overall confidence: 100%
Detected patterns
  • adnxs\.(?:net|com)
Overall confidence: 100%
Detected patterns
  • //connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js
Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
  • (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
Overall confidence: 100%
Detected patterns
  • google-analytics\.com/(?:ga|urchin|analytics)\.js
Overall confidence: 100%
Detected patterns
  • <!-- (?:End )?Google Tag Manager -->
  • googletagmanager\.com/gtag/js
  • googletagmanager\.com/gtm\.js
Overall confidence: 100%
Detected patterns
  • snap\.licdn\.com/li\.lms-analytics/insight\.min\.js
Overall confidence: 100%
Detected patterns
  • moatads\.com
Overall confidence: 100%
Detected patterns
  • jquery[.-]([\d.]*\d)[^/]*\.js
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Overall confidence: 100%
Detected patterns
  • <link [^>]*?href="?[a-zA-Z]*?:?//cdn\.jsdelivr\.net/
  • //cdn\.jsdelivr\.net/

Page Statistics

70
Requests

99 %
HTTPS

0 %
IPv6

31
Domains

43
Subdomains

34
IPs

3
Countries

1793 kB
Transfer

5671 kB
Size

43
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://app.connect.awspls.com/e/er?s=893759278&lid=75595&elqTrackId=052741E3ED7A89DC71F3A0F9714A7DBE&elq=eca45780138f40bb83d67fb46825d623&elqaid=120189&elqat=1&utm_campaign=CSIQ-CD-21-09-16%20Cybereason%20-%20Content%20Syndication%20EM3&utm_medium=email&utm_source=internalemail&MAC=%7C1-OKRXKKD&elqContactId=16719758&disc=&elqCampId=104638&utm_content=CSIQ-CD-21-09-16%20Cybereason%20-%20Content%20Syndication%20EM3_A HTTP 302
    https://s893759278.t.eloqua.com/e/er?s=893759278&lid=75595&elqTrackId=052741E3ED7A89DC71F3A0F9714A7DBE&elq=eca45780138f40bb83d67fb46825d623&elqaid=120189&elqat=1&utm_campaign=CSIQ-CD-21-09-16%20Cybereason%20-%20Content%20Syndication%20EM3&utm_medium=email&utm_source=internalemail&MAC=|1-OKRXKKD&elqContactId=16719758&disc=&elqCampId=104638&utm_content=CSIQ-CD-21-09-16%20Cybereason%20-%20Content%20Syndication%20EM3_A HTTP 302
    https://www.cshub.com/threat-defense/whitepapers/deadringer-exposing-chinese-threat-actors-targeting-major-telcos?utm_campaign=CSIQ-CD-21-09-16%20Cybereason%20-%20Content%20Syndication%20EM3&utm_medium=email&utm_source=internalemail&MAC=%7C1-OKRXKKD&elqContactId=16719758&disc=&elqCampId=104638&utm_content=CSIQ-CD-21-09-16%20Cybereason%20-%20Content%20Syndication%20EM3_A Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 28
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=49766&time=1631980272217&url=https%3A%2F%2Fwww.cshub.com%2Fthreat-defense%2Fwhitepapers%2Fdeadringer-exposing-chinese-threat-actors-targeting-major-telcos%3Futm_campaign%3DCSIQ-CD-21-09-16%2520Cybereason%2520-%2520Content%2520Syndication%2520EM3%26utm_medium%3Demail%26utm_source%3Dinternalemail%26MAC%3D%257C1-OKRXKKD%26elqContactId%3D16719758%26disc%3D%26elqCampId%3D104638%26utm_content%3DCSIQ-CD-21-09-16%2520Cybereason%2520-%2520Content%2520Syndication%2520EM3_A HTTP 302
  • https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D49766%26time%3D1631980272217%26url%3Dhttps%253A%252F%252Fwww.cshub.com%252Fthreat-defense%252Fwhitepapers%252Fdeadringer-exposing-chinese-threat-actors-targeting-major-telcos%253Futm_campaign%253DCSIQ-CD-21-09-16%252520Cybereason%252520-%252520Content%252520Syndication%252520EM3%2526utm_medium%253Demail%2526utm_source%253Dinternalemail%2526MAC%253D%25257C1-OKRXKKD%2526elqContactId%253D16719758%2526disc%253D%2526elqCampId%253D104638%2526utm_content%253DCSIQ-CD-21-09-16%252520Cybereason%252520-%252520Content%252520Syndication%252520EM3_A%26liSync%3Dtrue HTTP 302
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=49766&time=1631980272217&url=https%3A%2F%2Fwww.cshub.com%2Fthreat-defense%2Fwhitepapers%2Fdeadringer-exposing-chinese-threat-actors-targeting-major-telcos%3Futm_campaign%3DCSIQ-CD-21-09-16%2520Cybereason%2520-%2520Content%2520Syndication%2520EM3%26utm_medium%3Demail%26utm_source%3Dinternalemail%26MAC%3D%257C1-OKRXKKD%26elqContactId%3D16719758%26disc%3D%26elqCampId%3D104638%26utm_content%3DCSIQ-CD-21-09-16%2520Cybereason%2520-%2520Content%2520Syndication%2520EM3_A&liSync=true
Request Chain 59
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=6fgi4r1&ttd_tpi=1&ttd_puid=61460af009a693000711ff6c&gdpr=0 HTTP 302
  • https://match.adsrvr.org/track/cmb/generic?ttd_pid=6fgi4r1&ttd_tpi=1&ttd_puid=61460af009a693000711ff6c&gdpr=0 HTTP 302
  • https://polo-v1.feathr.co/v1/analytics/match?f_id=61460af009a693000711ff6c&ttd_id=a555adef-feee-45d5-a0a4-b850517d8081

70 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request deadringer-exposing-chinese-threat-actors-targeting-major-telcos
www.cshub.com/threat-defense/whitepapers/
Redirect Chain
  • http://app.connect.awspls.com/e/er?s=893759278&lid=75595&elqTrackId=052741E3ED7A89DC71F3A0F9714A7DBE&elq=eca45780138f40bb83d67fb46825d623&elqaid=120189&elqat=1&utm_campaign=CSIQ-CD-21-09-16%20Cyber...
  • https://s893759278.t.eloqua.com/e/er?s=893759278&lid=75595&elqTrackId=052741E3ED7A89DC71F3A0F9714A7DBE&elq=eca45780138f40bb83d67fb46825d623&elqaid=120189&elqat=1&utm_campaign=CSIQ-CD-21-09-16%20Cyb...
  • https://www.cshub.com/threat-defense/whitepapers/deadringer-exposing-chinese-threat-actors-targeting-major-telcos?utm_campaign=CSIQ-CD-21-09-16%20Cybereason%20-%20Content%20Syndication%20EM3&utm_me...
120 KB
23 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://www.cshub.com/threat-defense/whitepapers/deadringer-exposing-chinese-threat-actors-targeting-major-telcos?utm_campaign=CSIQ-CD-21-09-16%20Cybereason%20-%20Content%20Syndication%20EM3&utm_medium=email&utm_source=internalemail&MAC=%7C1-OKRXKKD&elqContactId=16719758&disc=&elqCampId=104638&utm_content=CSIQ-CD-21-09-16%20Cybereason%20-%20Content%20Syndication%20EM3_A
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
18.214.148.166 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-18-214-148-166.compute-1.amazonaws.com
Software
nginx /
Resource Hash
9d12f0ac8f9dfc0cd2ff63a7eb7d94b051113009a35f9f4875077108104ceda7
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:method
GET
:authority
www.cshub.com
:scheme
https
:path
/threat-defense/whitepapers/deadringer-exposing-chinese-threat-actors-targeting-major-telcos?utm_campaign=CSIQ-CD-21-09-16%20Cybereason%20-%20Content%20Syndication%20EM3&utm_medium=email&utm_source=internalemail&MAC=%7C1-OKRXKKD&elqContactId=16719758&disc=&elqCampId=104638&utm_content=CSIQ-CD-21-09-16%20Cybereason%20-%20Content%20Syndication%20EM3_A
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
accept-language
de-DE,de;q=0.9
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
none
sec-fetch-mode
navigate
sec-fetch-user
?1
sec-fetch-dest
document
accept-encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Accept-Language
de-DE,de;q=0.9

Response headers

date
Sat, 18 Sep 2021 15:51:11 GMT
content-type
text/html; charset=UTF-8
server
nginx
vary
Accept-Encoding
cache-control
no-cache, private
set-cookie
XSRF-TOKEN=eyJpdiI6ImUrTGdGM1djY1p2VzVXbEpNOGVZZUE9PSIsInZhbHVlIjoiQW8zSUorN3pxUE1TYk9PVWVYbGdrXC83cCtWek9kczhxNDVVbHlSQVRFbnI0T2NHWHhwa3k4ZWxvRHQwZDQybTNGcTQyd0VvU2wzNEdnc1RqTEp2aktBPT0iLCJtYWMiOiI2ZmRmOGY4NmExNjdmZGZkMjFhN2VmM2I3ZTkwOTdkMjBlZTNhOTg0OTc5ZTA3YTI1NjE3Yjc5OTFlNjYwYzEyIn0%3D; expires=Sat, 18-Sep-2021 17:51:11 GMT; Max-Age=7200; path=/ ecochannels_eco_app_session=eyJpdiI6Ild6YVVGdk1ZU1JEV1I2Njc3SThiTXc9PSIsInZhbHVlIjoiNmtFcUxIdWxKYlI2XC9CSkNOVkdwVzRibzBpd2U0Z2MxaituOUxVMzM2Wm1KeUVlNERXamhwajJqSWttN0RrakFIVmZPdWlhdXVzSEllblUxT2FabDN3PT0iLCJtYWMiOiI0MDIyNzE2NGMzNjNjZjgzN2M1Yjc5OTU0YjhmMjE3OGRkNjYxM2RlYWJkMjQwNTExYWRiOGUxNjJjYzY2ZjdkIn0%3D; expires=Sat, 18-Sep-2021 17:51:11 GMT; Max-Age=7200; path=/; httponly channel_id=eyJpdiI6IjdqTzJ3QWhvNldZYWlLNFhoQzhRdGc9PSIsInZhbHVlIjoiV3E2QnJPYkxxMnltazB2a0p2NFU3U2lWUWd0aEZBcTJpbUhtVXBnSHd1SFUzNUU1UG0xY2VHSU54QWFNb2FZZCIsIm1hYyI6IjRjYjAzYWQ1YzczZmM1YWY5Nzc5M2Q5ZjcyZDFkYWIyYWViYWE2MzIyZTMyYTE4MjFlYzg2NzcwMjMwMThkOGYifQ%3D%3D; path=/; httponly event_id=eyJpdiI6Ilh1MjJNTXU3Rko0ZWwrOFFYbVgxdXc9PSIsInZhbHVlIjoiQ21seXc2RTdpNWZhSE1GVHlqT20zQT09IiwibWFjIjoiZWJkNjA4MTQ0MDAyZDU5ZTI1MDhiZjhhNjI2MWFkYzZiMzY2ZWI0NDg5OTJjNjQ2ZDUzOTYwNDFjMjM1MjJmOSJ9; path=/; httponly client_dashboard=eyJpdiI6InN2K29JandXT2oyb25ZeHNjU3FKdnc9PSIsInZhbHVlIjoiSThWSWpHeThLSWtvd0gwUTlRdEUwQT09IiwibWFjIjoiNzIwYjk2ODExYzUyYWU1NDIwN2JlODA0YjQ0MDhkZDVhMDYyZWU1MmIxNGE1YjBiZjIwNzI0OGE1ZjdjOGY5NCJ9; path=/; httponly mac=eyJpdiI6IlhMcEhMSFpnYmdcL29uYzdXMFYrUUpBPT0iLCJ2YWx1ZSI6IjZXaVNlZ2hGMXV5S2VGekdBMGdtcm83UDlaQVp0dFFteGVPdXhyT1pDY2M9IiwibWFjIjoiNDgyMjJkOWVhZGUwZjQwY2VlYWZlN2Q4Y2Q4MDVjMDZmZmEyNmMwZjQxY2ExYTExOTRiNTZjNDhlYzUwMGNkMyJ9; expires=Tue, 19-Oct-2021 01:51:10 GMT; Max-Age=2627999; path=/; httponly elq_camp_id=eyJpdiI6Im1jTlQ1SExQR0NkVUhEQ1o5NjYwdFE9PSIsInZhbHVlIjoiREYwXC9tZmphRHhFSUVMNGhySXdhbWc9PSIsIm1hYyI6IjNlMjVmODUxMzdiMjY1ZDZhMjkyZjU4ZjEyOGJhNjZkMzA4NjhhNDVmNThjMmZkYTlmZDEwMzc5ZjE5ODNjMmUifQ%3D%3D; expires=Tue, 19-Oct-2021 01:51:10 GMT; Max-Age=2627999; path=/; httponly utm_campaign=eyJpdiI6IlAwd2xXTkFmYXJUWkNOTWdwbGlEclE9PSIsInZhbHVlIjoiaVZROE16SUFRN2NRbUtBMzJDNG53cG1cL2c5ZVZia2M4em9aeXpwOGg1NTFvdzI0d0xBXC91NlZORnB3TDlWK1wvengzWVFpVUVZSjZRZ3NjOTlGXC9GU2pRPT0iLCJtYWMiOiIzYWVmMzNhYzY5NWUwNWE5OWVmNjA3NzA3ZTIxMDM3ODQ0ZmEyZGI4ZjA3OWViODg4NmY1MTRkNTVlMDMwZDczIn0%3D; expires=Tue, 19-Oct-2021 01:51:10 GMT; Max-Age=2627999; path=/; httponly utm_source=eyJpdiI6ImNoRnVFWkhjVVEyMG0zVnk5czFNWWc9PSIsInZhbHVlIjoiRTM2dDd0aDZieGltNkw2WEhFN2pjRmpKN2poQ2ZuenpsMjZDUVFTblRLcz0iLCJtYWMiOiI4MTg3NTM0MzBiODBjOWVhZDcxZDk1ZGJlNWEyOWIzNjVhNDBjZjkyMzM0NGJhOGZhOTNhMmQ4NDcxMGFkNTRlIn0%3D; expires=Tue, 19-Oct-2021 01:51:10 GMT; Max-Age=2627999; path=/; httponly utm_medium=eyJpdiI6Ijk4RFFlMjRycFFjdzNDUUI3U2QyNFE9PSIsInZhbHVlIjoiVlBiWXViMHRScnRZVkhwdEJWcCtWZz09IiwibWFjIjoiNGVjZWFmMThhNDY0Y2U5Y2IzYjY5MWE2YzFmYzRjMWIzMjQ2YzVmODk0NTIzY2I4NjUwM2Y4OTdkNGVhZWRkMCJ9; expires=Tue, 19-Oct-2021 01:51:10 GMT; Max-Age=2627999; path=/; httponly elq_contact_id=eyJpdiI6IlBibklKc01GR0J3Z0xzMWpNMW5JYlE9PSIsInZhbHVlIjoicWp5QkFDd3Y2OVliSE45NmxSQW1jQT09IiwibWFjIjoiNjA3YTYxOTljZjFjMTAwMTA0NDY0ZTM0MTA2MjQ4Y2Y3ZDkzZWYyMDgxNmE1NjRhMDY4MzhjOGNjZmQ0MzVhYSJ9; expires=Tue, 19-Oct-2021 01:51:10 GMT; Max-Age=2627999; path=/; httponly
x-frame-options
SAMEORIGIN
x-xss-protection
1; mode=block
x-content-type-options
nosniff
content-encoding
gzip

Redirect headers

Cache-Control
no-store
Pragma
no-cache
Content-Type
text/html; charset=utf-8
Expires
-1
Location
https://www.cshub.com/threat-defense/whitepapers/deadringer-exposing-chinese-threat-actors-targeting-major-telcos?utm_campaign=CSIQ-CD-21-09-16%20Cybereason%20-%20Content%20Syndication%20EM3&utm_medium=email&utm_source=internalemail&MAC=%7C1-OKRXKKD&elqContactId=16719758&disc=&elqCampId=104638&utm_content=CSIQ-CD-21-09-16%20Cybereason%20-%20Content%20Syndication%20EM3_A
X-Robots-Tag
noindex, nofollow
X-Xss-Protection
1; mode=block
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
Set-Cookie
ELOQUA=GUID=16B97F1C998648C6A634074D3B5BEE63; domain=.eloqua.com; expires=Tue, 18-Oct-2022 15:51:10 GMT; path=/;SameSite=None; secure ELQSTATUS=OK; domain=.eloqua.com; expires=Tue, 18-Oct-2022 15:51:10 GMT; path=/;SameSite=None; secure
P3P
CP="IDC DSP COR DEVa TAIa OUR BUS PHY ONL UNI COM NAV CNT STA",
X-Content-Type-Options
nosniff
Date
Sat, 18 Sep 2021 15:51:09 GMT
Content-Length
517
animate.min.css
cdn.jsdelivr.net/npm/animate.css@3.5.2/ 		52 KB
4 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://cdn.jsdelivr.net/npm/animate.css@3.5.2/animate.min.css
Requested by
Host: www.cshub.com
URL: https://www.cshub.com/threat-defense/whitepapers/deadringer-exposing-chinese-threat-actors-targeting-major-telcos?utm_campaign=CSIQ-CD-21-09-16%20Cybereason%20-%20Content%20Syndication%20EM3&utm_medium=email&utm_source=internalemail&MAC=%7C1-OKRXKKD&elqContactId=16719758&disc=&elqCampId=104638&utm_content=CSIQ-CD-21-09-16%20Cybereason%20-%20Content%20Syndication%20EM3_A
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.65.229 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
8fe3fa119255adb5e0c12479331f9e092e85bcff56ab6ecc0510bfa2056b898d
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.cshub.com/
Origin
https://www.cshub.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
age
7326956
x-cache
HIT, HIT
cross-origin-resource-policy
cross-origin
content-length
3958
etag
W/"ce35-l6+hUVafBGsuAfJ8GHFkbpzYfK8"
x-served-by
cache-fra19138-FRA, cache-hhn4053-HHN
date
Sat, 18 Sep 2021 15:51:11 GMT
vary
Accept-Encoding
content-type
text/css; charset=utf-8
access-control-allow-origin
*
access-control-expose-headers
*
cache-control
public, max-age=31536000, s-maxage=31536000, immutable
accept-ranges
bytes
timing-allow-origin
*
all.css
use.fontawesome.com/releases/v5.0.10/css/ 		36 KB
9 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://use.fontawesome.com/releases/v5.0.10/css/all.css
Requested by
Host: www.cshub.com
URL: https://www.cshub.com/threat-defense/whitepapers/deadringer-exposing-chinese-threat-actors-targeting-major-telcos?utm_campaign=CSIQ-CD-21-09-16%20Cybereason%20-%20Content%20Syndication%20EM3&utm_medium=email&utm_source=internalemail&MAC=%7C1-OKRXKKD&elqContactId=16719758&disc=&elqCampId=104638&utm_content=CSIQ-CD-21-09-16%20Cybereason%20-%20Content%20Syndication%20EM3_A
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.67.214.69 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
cfac6241dd3aabb5f1552c17501790093015c006a8e13671823c1ff4872beaae

Request headers

Referer
https://www.cshub.com/
Origin
https://www.cshub.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Sat, 18 Sep 2021 15:51:12 GMT
content-encoding
br
vary
Origin, Access-Control-Request-Headers, Access-Control-Request-Method, Accept-Encoding
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
6043873
access-control-allow-methods
GET
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
x-amz-request-id
76Z5EP6AD87TZS89
x-amz-id-2
jn4ISO8q3oxGsb69A3jooBtnohj4AF+XbXrTvHhJcGJ0Xvj420AyypmVXuixFY4nMxtnPGJ58/A=
last-modified
Wed, 30 Jun 2021 15:26:49 GMT
server
cloudflare
etag
W/"d1acb8ad33b1526acbfd3f0028b859b0"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
access-control-max-age
3000
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=19BgIKp5JRhrCuekl9E2U6mM8qkFCbdPhwMPIM3HWn2hamqziUg0pw%2FIiYnqH%2FzDuTiUulcIHjCk3FnnKI%2Bk1tURwxG6iI3PFPJkVSDIM3xDuD6N3NVUUA2Bh2lDhakP0Za81gzq"}],"group":"cf-nel","max_age":604800}
content-type
text/css
access-control-allow-origin
*
cache-control
max-age=31556926
cf-ray
690bbbfc5c1b5968-IAD
jquery-3.2.1.slim.min.js
code.jquery.com/ 		68 KB
24 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://code.jquery.com/jquery-3.2.1.slim.min.js
Requested by
Host: www.cshub.com
URL: https://www.cshub.com/threat-defense/whitepapers/deadringer-exposing-chinese-threat-actors-targeting-major-telcos?utm_campaign=CSIQ-CD-21-09-16%20Cybereason%20-%20Content%20Syndication%20EM3&utm_medium=email&utm_source=internalemail&MAC=%7C1-OKRXKKD&elqContactId=16719758&disc=&elqCampId=104638&utm_content=CSIQ-CD-21-09-16%20Cybereason%20-%20Content%20Syndication%20EM3_A
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
69.16.175.10 , United States, ASN20446 (HIGHWINDS3, US),
Reverse DNS
hwcdn.net
Software
nginx /
Resource Hash
9365920887b11b33a3dc4ba28a0f93951f200341263e3b9cefd384798e4be398

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.cshub.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Sat, 18 Sep 2021 15:51:12 GMT
content-encoding
gzip
last-modified
Mon, 20 Mar 2017 19:01:15 GMT
server
nginx
etag
W/"58d026fb-10fdd"
vary
Accept-Encoding
x-hw
1631980272.dop206.am5.t,1631980272.cds117.am5.hn,1631980272.cds255.am5.c
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=315360000, public
accept-ranges
bytes
content-length
23856
gpt.js
securepubads.g.doubleclick.net/tag/js/ 		73 KB
25 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/tag/js/gpt.js
Requested by
Host: www.cshub.com
URL: https://www.cshub.com/threat-defense/whitepapers/deadringer-exposing-chinese-threat-actors-targeting-major-telcos?utm_campaign=CSIQ-CD-21-09-16%20Cybereason%20-%20Content%20Syndication%20EM3&utm_medium=email&utm_source=internalemail&MAC=%7C1-OKRXKKD&elqContactId=16719758&disc=&elqCampId=104638&utm_content=CSIQ-CD-21-09-16%20Cybereason%20-%20Content%20Syndication%20EM3_A
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.18.98 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
zrh04s05-in-f98.1e100.net
Software
sffe /
Resource Hash
f348a443d8113a40e7dffeec410f62424d9cb7ac521da1f0773bd15093d5d40b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.cshub.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Sat, 18 Sep 2021 15:51:12 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"990 / 378 of 1000 / last-modified: 1631916691"
vary
Accept-Encoding
report-to
{"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type
text/javascript
cache-control
private, max-age=900, stale-while-revalidate=3600
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
25035
x-xss-protection
0
cross-origin-opener-policy-report-only
same-origin; report-to="ads-gpt-scs"
expires
Sat, 18 Sep 2021 15:51:12 GMT
js
www.googletagmanager.com/gtag/ 		99 KB
40 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtag/js?id=UA-3734990-33
Requested by
Host: www.cshub.com
URL: https://www.cshub.com/threat-defense/whitepapers/deadringer-exposing-chinese-threat-actors-targeting-major-telcos?utm_campaign=CSIQ-CD-21-09-16%20Cybereason%20-%20Content%20Syndication%20EM3&utm_medium=email&utm_source=internalemail&MAC=%7C1-OKRXKKD&elqContactId=16719758&disc=&elqCampId=104638&utm_content=CSIQ-CD-21-09-16%20Cybereason%20-%20Content%20Syndication%20EM3_A
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.16.136 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
zrh04s06-in-f136.1e100.net
Software
Google Tag Manager /
Resource Hash
8d7fb472963065af1350318687f6baaa59a7b6848ed3570b00e2cd36b2e8060c
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.cshub.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Sat, 18 Sep 2021 15:51:12 GMT
content-encoding
br
vary
Accept-Encoding
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
40410
x-xss-protection
0
last-modified
Sat, 18 Sep 2021 15:00:00 GMT
server
Google Tag Manager
strict-transport-security
max-age=31536000; includeSubDomains
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Sat, 18 Sep 2021 15:51:12 GMT
app_web.css
www.cshub.com/css/ 		699 KB
88 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.cshub.com/css/app_web.css?id=879df91e8864e3e5a8b2
Requested by
Host: www.cshub.com
URL: https://www.cshub.com/threat-defense/whitepapers/deadringer-exposing-chinese-threat-actors-targeting-major-telcos?utm_campaign=CSIQ-CD-21-09-16%20Cybereason%20-%20Content%20Syndication%20EM3&utm_medium=email&utm_source=internalemail&MAC=%7C1-OKRXKKD&elqContactId=16719758&disc=&elqCampId=104638&utm_content=CSIQ-CD-21-09-16%20Cybereason%20-%20Content%20Syndication%20EM3_A
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
18.214.148.166 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-18-214-148-166.compute-1.amazonaws.com
Software
nginx /
Resource Hash
85982f240c98e8b2003f9bee604305967d540b614a7a8c08dc4109fa4270f106
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/css/app_web.css?id=879df91e8864e3e5a8b2
pragma
no-cache
cookie
XSRF-TOKEN=eyJpdiI6ImUrTGdGM1djY1p2VzVXbEpNOGVZZUE9PSIsInZhbHVlIjoiQW8zSUorN3pxUE1TYk9PVWVYbGdrXC83cCtWek9kczhxNDVVbHlSQVRFbnI0T2NHWHhwa3k4ZWxvRHQwZDQybTNGcTQyd0VvU2wzNEdnc1RqTEp2aktBPT0iLCJtYWMiOiI2ZmRmOGY4NmExNjdmZGZkMjFhN2VmM2I3ZTkwOTdkMjBlZTNhOTg0OTc5ZTA3YTI1NjE3Yjc5OTFlNjYwYzEyIn0%3D; ecochannels_eco_app_session=eyJpdiI6Ild6YVVGdk1ZU1JEV1I2Njc3SThiTXc9PSIsInZhbHVlIjoiNmtFcUxIdWxKYlI2XC9CSkNOVkdwVzRibzBpd2U0Z2MxaituOUxVMzM2Wm1KeUVlNERXamhwajJqSWttN0RrakFIVmZPdWlhdXVzSEllblUxT2FabDN3PT0iLCJtYWMiOiI0MDIyNzE2NGMzNjNjZjgzN2M1Yjc5OTU0YjhmMjE3OGRkNjYxM2RlYWJkMjQwNTExYWRiOGUxNjJjYzY2ZjdkIn0%3D; channel_id=eyJpdiI6IjdqTzJ3QWhvNldZYWlLNFhoQzhRdGc9PSIsInZhbHVlIjoiV3E2QnJPYkxxMnltazB2a0p2NFU3U2lWUWd0aEZBcTJpbUhtVXBnSHd1SFUzNUU1UG0xY2VHSU54QWFNb2FZZCIsIm1hYyI6IjRjYjAzYWQ1YzczZmM1YWY5Nzc5M2Q5ZjcyZDFkYWIyYWViYWE2MzIyZTMyYTE4MjFlYzg2NzcwMjMwMThkOGYifQ%3D%3D; event_id=eyJpdiI6Ilh1MjJNTXU3Rko0ZWwrOFFYbVgxdXc9PSIsInZhbHVlIjoiQ21seXc2RTdpNWZhSE1GVHlqT20zQT09IiwibWFjIjoiZWJkNjA4MTQ0MDAyZDU5ZTI1MDhiZjhhNjI2MWFkYzZiMzY2ZWI0NDg5OTJjNjQ2ZDUzOTYwNDFjMjM1MjJmOSJ9; client_dashboard=eyJpdiI6InN2K29JandXT2oyb25ZeHNjU3FKdnc9PSIsInZhbHVlIjoiSThWSWpHeThLSWtvd0gwUTlRdEUwQT09IiwibWFjIjoiNzIwYjk2ODExYzUyYWU1NDIwN2JlODA0YjQ0MDhkZDVhMDYyZWU1MmIxNGE1YjBiZjIwNzI0OGE1ZjdjOGY5NCJ9; mac=eyJpdiI6IlhMcEhMSFpnYmdcL29uYzdXMFYrUUpBPT0iLCJ2YWx1ZSI6IjZXaVNlZ2hGMXV5S2VGekdBMGdtcm83UDlaQVp0dFFteGVPdXhyT1pDY2M9IiwibWFjIjoiNDgyMjJkOWVhZGUwZjQwY2VlYWZlN2Q4Y2Q4MDVjMDZmZmEyNmMwZjQxY2ExYTExOTRiNTZjNDhlYzUwMGNkMyJ9; elq_camp_id=eyJpdiI6Im1jTlQ1SExQR0NkVUhEQ1o5NjYwdFE9PSIsInZhbHVlIjoiREYwXC9tZmphRHhFSUVMNGhySXdhbWc9PSIsIm1hYyI6IjNlMjVmODUxMzdiMjY1ZDZhMjkyZjU4ZjEyOGJhNjZkMzA4NjhhNDVmNThjMmZkYTlmZDEwMzc5ZjE5ODNjMmUifQ%3D%3D; utm_campaign=eyJpdiI6IlAwd2xXTkFmYXJUWkNOTWdwbGlEclE9PSIsInZhbHVlIjoiaVZROE16SUFRN2NRbUtBMzJDNG53cG1cL2c5ZVZia2M4em9aeXpwOGg1NTFvdzI0d0xBXC91NlZORnB3TDlWK1wvengzWVFpVUVZSjZRZ3NjOTlGXC9GU2pRPT0iLCJtYWMiOiIzYWVmMzNhYzY5NWUwNWE5OWVmNjA3NzA3ZTIxMDM3ODQ0ZmEyZGI4ZjA3OWViODg4NmY1MTRkNTVlMDMwZDczIn0%3D; utm_source=eyJpdiI6ImNoRnVFWkhjVVEyMG0zVnk5czFNWWc9PSIsInZhbHVlIjoiRTM2dDd0aDZieGltNkw2WEhFN2pjRmpKN2poQ2ZuenpsMjZDUVFTblRLcz0iLCJtYWMiOiI4MTg3NTM0MzBiODBjOWVhZDcxZDk1ZGJlNWEyOWIzNjVhNDBjZjkyMzM0NGJhOGZhOTNhMmQ4NDcxMGFkNTRlIn0%3D; utm_medium=eyJpdiI6Ijk4RFFlMjRycFFjdzNDUUI3U2QyNFE9PSIsInZhbHVlIjoiVlBiWXViMHRScnRZVkhwdEJWcCtWZz09IiwibWFjIjoiNGVjZWFmMThhNDY0Y2U5Y2IzYjY5MWE2YzFmYzRjMWIzMjQ2YzVmODk0NTIzY2I4NjUwM2Y4OTdkNGVhZWRkMCJ9; elq_contact_id=eyJpdiI6IlBibklKc01GR0J3Z0xzMWpNMW5JYlE9PSIsInZhbHVlIjoicWp5QkFDd3Y2OVliSE45NmxSQW1jQT09IiwibWFjIjoiNjA3YTYxOTljZjFjMTAwMTA0NDY0ZTM0MTA2MjQ4Y2Y3ZDkzZWYyMDgxNmE1NjRhMDY4MzhjOGNjZmQ0MzVhYSJ9
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode
no-cors
accept
text/css,*/*;q=0.1
cache-control
no-cache
sec-fetch-dest
style
:authority
www.cshub.com
referer
https://www.cshub.com/threat-defense/whitepapers/deadringer-exposing-chinese-threat-actors-targeting-major-telcos?utm_campaign=CSIQ-CD-21-09-16%20Cybereason%20-%20Content%20Syndication%20EM3&utm_medium=email&utm_source=internalemail&MAC=%7C1-OKRXKKD&elqContactId=16719758&disc=&elqCampId=104638&utm_content=CSIQ-CD-21-09-16%20Cybereason%20-%20Content%20Syndication%20EM3_A
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://www.cshub.com/threat-defense/whitepapers/deadringer-exposing-chinese-threat-actors-targeting-major-telcos?utm_campaign=CSIQ-CD-21-09-16%20Cybereason%20-%20Content%20Syndication%20EM3&utm_medium=email&utm_source=internalemail&MAC=%7C1-OKRXKKD&elqContactId=16719758&disc=&elqCampId=104638&utm_content=CSIQ-CD-21-09-16%20Cybereason%20-%20Content%20Syndication%20EM3_A
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Sat, 18 Sep 2021 15:51:11 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Wed, 08 Sep 2021 13:28:12 GMT
server
nginx
etag
W/"6138ba6c-aec56"
x-frame-options
SAMEORIGIN
content-type
text/css
cache-control
max-age=604800
vary
Accept-Encoding
x-xss-protection
1; mode=block
expires
Sat, 25 Sep 2021 15:51:11 GMT
addthis_widget.js
s7.addthis.com/js/300/ 		353 KB
114 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://s7.addthis.com/js/300/addthis_widget.js
Requested by
Host: www.cshub.com
URL: https://www.cshub.com/threat-defense/whitepapers/deadringer-exposing-chinese-threat-actors-targeting-major-telcos?utm_campaign=CSIQ-CD-21-09-16%20Cybereason%20-%20Content%20Syndication%20EM3&utm_medium=email&utm_source=internalemail&MAC=%7C1-OKRXKKD&elqContactId=16719758&disc=&elqCampId=104638&utm_content=CSIQ-CD-21-09-16%20Cybereason%20-%20Content%20Syndication%20EM3_A
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.84.56.126 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-84-56-126.deploy.static.akamaitechnologies.com
Software
nginx/1.15.8 /
Resource Hash
acd2f7ad78edeebad4b6b0fdd17ff57d81c3726c60fd5435ee8c5a0115d29403
Security Headers
Name Value
Strict-Transport-Security max-age=15724800; includeSubDomains

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.cshub.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

strict-transport-security
max-age=15724800; includeSubDomains
content-encoding
gzip
last-modified
Mon, 26 Oct 2020 18:11:48 GMT
server
nginx/1.15.8
etag
"5f971164-5834c"
vary
Accept-Encoding
x-distribution
99
content-type
application/javascript
cache-control
public, max-age=600
date
Sat, 18 Sep 2021 15:51:11 GMT
x-host
s7.addthis.com
content-length
116325
jstracker.min.js
assets.pcrl.co/js/ 		3 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://assets.pcrl.co/js/jstracker.min.js?geo=1
Requested by
Host: www.cshub.com
URL: https://www.cshub.com/threat-defense/whitepapers/deadringer-exposing-chinese-threat-actors-targeting-major-telcos?utm_campaign=CSIQ-CD-21-09-16%20Cybereason%20-%20Content%20Syndication%20EM3&utm_medium=email&utm_source=internalemail&MAC=%7C1-OKRXKKD&elqContactId=16719758&disc=&elqCampId=104638&utm_content=CSIQ-CD-21-09-16%20Cybereason%20-%20Content%20Syndication%20EM3_A
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
13.224.193.9 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-224-193-9.fra2.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
adf33148613cb07d00c1da3473cf3d7ce89a94c3e2075a065772bcb852f65b71

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.cshub.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

x-amz-version-id
ILWpFNHKyzE1o_od3IQyxMI3qjjCp8cy
Content-Encoding
gzip
ETag
"3b9aad01eeeb35815f6d1641a4650d6c"
Age
991
X-Cache
Hit from cloudfront
Connection
keep-alive
Content-Length
1356
Last-Modified
Thu, 16 May 2019 15:18:55 GMT
Server
AmazonS3
Date
Sat, 18 Sep 2021 15:35:33 GMT
Content-Type
application/javascript
Via
1.1 c3b74c81fdcb7942211a6c721efa13fd.cloudfront.net (CloudFront)
Cache-Control
max-age=21600, must-revalidate
X-Amz-Cf-Pop
FRA2-C1
Accept-Ranges
bytes
X-Amz-Cf-Id
FAaTvmJXxLg9I-l33xfKn1_V-C8iaRK9y8jtYCD0KZzcv129uDfqAQ==
conversion.js
www.googleadservices.com/pagead/ 		44 KB
17 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googleadservices.com/pagead/conversion.js
Requested by
Host: www.cshub.com
URL: https://www.cshub.com/threat-defense/whitepapers/deadringer-exposing-chinese-threat-actors-targeting-major-telcos?utm_campaign=CSIQ-CD-21-09-16%20Cybereason%20-%20Content%20Syndication%20EM3&utm_medium=email&utm_source=internalemail&MAC=%7C1-OKRXKKD&elqContactId=16719758&disc=&elqCampId=104638&utm_content=CSIQ-CD-21-09-16%20Cybereason%20-%20Content%20Syndication%20EM3_A
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.185.98 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s49-in-f2.1e100.net
Software
cafe /
Resource Hash
36e1c00cb349689663b0abb4b6d7dd216e943087d56ffd54ff29093e7315224e
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.cshub.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Sat, 18 Sep 2021 15:51:12 GMT
content-encoding
gzip
x-content-type-options
nosniff
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
17353
x-xss-protection
0
server
cafe
etag
4619952618947136886
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=3600
timing-allow-origin
*
expires
Sat, 18 Sep 2021 15:51:12 GMT
cshub-logo-lg_1.png
plsadaptive.s3.amazonaws.com/eco/images/channel_content/images/ 		14 KB
14 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://plsadaptive.s3.amazonaws.com/eco/images/channel_content/images/cshub-logo-lg_1.png
Requested by
Host: www.cshub.com
URL: https://www.cshub.com/threat-defense/whitepapers/deadringer-exposing-chinese-threat-actors-targeting-major-telcos?utm_campaign=CSIQ-CD-21-09-16%20Cybereason%20-%20Content%20Syndication%20EM3&utm_medium=email&utm_source=internalemail&MAC=%7C1-OKRXKKD&elqContactId=16719758&disc=&elqCampId=104638&utm_content=CSIQ-CD-21-09-16%20Cybereason%20-%20Content%20Syndication%20EM3_A
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.216.84.8 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
s3-1-w.amazonaws.com
Software
AmazonS3 /
Resource Hash
26638ae0340d7728d6ce89bd9d70d323400d22363d021426c007f3e172a0d566

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.cshub.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Date
Sat, 18 Sep 2021 15:51:13 GMT
Last-Modified
Wed, 21 Nov 2018 19:59:50 GMT
Server
AmazonS3
x-amz-request-id
9MTCC2887QNXFMC1
ETag
"4c74827af08c1b02b8751c7700c34f59"
Content-Type
image/png
x-amz-version-id
qPE5jO6aLXhbGvBRl2dLAndhIlaMB99z
Accept-Ranges
bytes
Content-Length
13898
x-amz-id-2
lNl5/9emPXL47DtHkLbeK5vCI4vBDMkHZPHWaXjs34UISP0QHiecArYjOfdBQAlTV2aprQH05Xo=
gtm.js
www.googletagmanager.com/ 		81 KB
33 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtm.js?id=GTM-WBSLLHZ
Requested by
Host: www.cshub.com
URL: https://www.cshub.com/threat-defense/whitepapers/deadringer-exposing-chinese-threat-actors-targeting-major-telcos?utm_campaign=CSIQ-CD-21-09-16%20Cybereason%20-%20Content%20Syndication%20EM3&utm_medium=email&utm_source=internalemail&MAC=%7C1-OKRXKKD&elqContactId=16719758&disc=&elqCampId=104638&utm_content=CSIQ-CD-21-09-16%20Cybereason%20-%20Content%20Syndication%20EM3_A
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.16.136 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
zrh04s06-in-f136.1e100.net
Software
Google Tag Manager /
Resource Hash
d96339a6f5ad7f4bbe3401f8c6d934869d64633b3ac3a4c760b947a1c7bcea9d
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.cshub.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Sat, 18 Sep 2021 15:51:12 GMT
content-encoding
br
vary
Accept-Encoding
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
33164
x-xss-protection
0
last-modified
Sat, 18 Sep 2021 15:00:00 GMT
server
Google Tag Manager
strict-transport-security
max-age=31536000; includeSubDomains
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Sat, 18 Sep 2021 15:51:12 GMT
6si.min.js
j.6sc.co/ 		14 KB
6 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://j.6sc.co/6si.min.js
Requested by
Host: www.cshub.com
URL: https://www.cshub.com/threat-defense/whitepapers/deadringer-exposing-chinese-threat-actors-targeting-major-telcos?utm_campaign=CSIQ-CD-21-09-16%20Cybereason%20-%20Content%20Syndication%20EM3&utm_medium=email&utm_source=internalemail&MAC=%7C1-OKRXKKD&elqContactId=16719758&disc=&elqCampId=104638&utm_content=CSIQ-CD-21-09-16%20Cybereason%20-%20Content%20Syndication%20EM3_A
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
104.111.233.140 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-111-233-140.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
e6752ac800583b3a55b604d99f1c4b87cca0479e3a4181085574f88af6fe04dd

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.cshub.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Date
Sat, 18 Sep 2021 15:51:12 GMT
Content-Encoding
gzip
Last-Modified
Mon, 10 May 2021 21:29:58 GMT
Server
nginx/1.14.0 (Ubuntu)
ETag
"6099a5d6-3955"
Vary
Accept-Encoding
Access-Control-Allow-Methods
GET,POST
Content-Type
application/javascript
Access-Control-Allow-Origin
Access-Control-Max-Age
86400
Access-Control-Allow-Credentials
true
Connection
keep-alive
Accept-Ranges
bytes
Access-Control-Allow-Headers
*
Content-Length
6003
app_web.js
www.cshub.com/js/ 		2 MB
591 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.cshub.com/js/app_web.js
Requested by
Host: www.cshub.com
URL: https://www.cshub.com/threat-defense/whitepapers/deadringer-exposing-chinese-threat-actors-targeting-major-telcos?utm_campaign=CSIQ-CD-21-09-16%20Cybereason%20-%20Content%20Syndication%20EM3&utm_medium=email&utm_source=internalemail&MAC=%7C1-OKRXKKD&elqContactId=16719758&disc=&elqCampId=104638&utm_content=CSIQ-CD-21-09-16%20Cybereason%20-%20Content%20Syndication%20EM3_A
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
18.214.148.166 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-18-214-148-166.compute-1.amazonaws.com
Software
nginx /
Resource Hash
dc9f5bd96e83b5c93bf4d25b4b37eec59405226267c62f696f93bc8f430485e0
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/js/app_web.js
pragma
no-cache
cookie
XSRF-TOKEN=eyJpdiI6ImUrTGdGM1djY1p2VzVXbEpNOGVZZUE9PSIsInZhbHVlIjoiQW8zSUorN3pxUE1TYk9PVWVYbGdrXC83cCtWek9kczhxNDVVbHlSQVRFbnI0T2NHWHhwa3k4ZWxvRHQwZDQybTNGcTQyd0VvU2wzNEdnc1RqTEp2aktBPT0iLCJtYWMiOiI2ZmRmOGY4NmExNjdmZGZkMjFhN2VmM2I3ZTkwOTdkMjBlZTNhOTg0OTc5ZTA3YTI1NjE3Yjc5OTFlNjYwYzEyIn0%3D; ecochannels_eco_app_session=eyJpdiI6Ild6YVVGdk1ZU1JEV1I2Njc3SThiTXc9PSIsInZhbHVlIjoiNmtFcUxIdWxKYlI2XC9CSkNOVkdwVzRibzBpd2U0Z2MxaituOUxVMzM2Wm1KeUVlNERXamhwajJqSWttN0RrakFIVmZPdWlhdXVzSEllblUxT2FabDN3PT0iLCJtYWMiOiI0MDIyNzE2NGMzNjNjZjgzN2M1Yjc5OTU0YjhmMjE3OGRkNjYxM2RlYWJkMjQwNTExYWRiOGUxNjJjYzY2ZjdkIn0%3D; channel_id=eyJpdiI6IjdqTzJ3QWhvNldZYWlLNFhoQzhRdGc9PSIsInZhbHVlIjoiV3E2QnJPYkxxMnltazB2a0p2NFU3U2lWUWd0aEZBcTJpbUhtVXBnSHd1SFUzNUU1UG0xY2VHSU54QWFNb2FZZCIsIm1hYyI6IjRjYjAzYWQ1YzczZmM1YWY5Nzc5M2Q5ZjcyZDFkYWIyYWViYWE2MzIyZTMyYTE4MjFlYzg2NzcwMjMwMThkOGYifQ%3D%3D; event_id=eyJpdiI6Ilh1MjJNTXU3Rko0ZWwrOFFYbVgxdXc9PSIsInZhbHVlIjoiQ21seXc2RTdpNWZhSE1GVHlqT20zQT09IiwibWFjIjoiZWJkNjA4MTQ0MDAyZDU5ZTI1MDhiZjhhNjI2MWFkYzZiMzY2ZWI0NDg5OTJjNjQ2ZDUzOTYwNDFjMjM1MjJmOSJ9; client_dashboard=eyJpdiI6InN2K29JandXT2oyb25ZeHNjU3FKdnc9PSIsInZhbHVlIjoiSThWSWpHeThLSWtvd0gwUTlRdEUwQT09IiwibWFjIjoiNzIwYjk2ODExYzUyYWU1NDIwN2JlODA0YjQ0MDhkZDVhMDYyZWU1MmIxNGE1YjBiZjIwNzI0OGE1ZjdjOGY5NCJ9; mac=eyJpdiI6IlhMcEhMSFpnYmdcL29uYzdXMFYrUUpBPT0iLCJ2YWx1ZSI6IjZXaVNlZ2hGMXV5S2VGekdBMGdtcm83UDlaQVp0dFFteGVPdXhyT1pDY2M9IiwibWFjIjoiNDgyMjJkOWVhZGUwZjQwY2VlYWZlN2Q4Y2Q4MDVjMDZmZmEyNmMwZjQxY2ExYTExOTRiNTZjNDhlYzUwMGNkMyJ9; elq_camp_id=eyJpdiI6Im1jTlQ1SExQR0NkVUhEQ1o5NjYwdFE9PSIsInZhbHVlIjoiREYwXC9tZmphRHhFSUVMNGhySXdhbWc9PSIsIm1hYyI6IjNlMjVmODUxMzdiMjY1ZDZhMjkyZjU4ZjEyOGJhNjZkMzA4NjhhNDVmNThjMmZkYTlmZDEwMzc5ZjE5ODNjMmUifQ%3D%3D; utm_campaign=eyJpdiI6IlAwd2xXTkFmYXJUWkNOTWdwbGlEclE9PSIsInZhbHVlIjoiaVZROE16SUFRN2NRbUtBMzJDNG53cG1cL2c5ZVZia2M4em9aeXpwOGg1NTFvdzI0d0xBXC91NlZORnB3TDlWK1wvengzWVFpVUVZSjZRZ3NjOTlGXC9GU2pRPT0iLCJtYWMiOiIzYWVmMzNhYzY5NWUwNWE5OWVmNjA3NzA3ZTIxMDM3ODQ0ZmEyZGI4ZjA3OWViODg4NmY1MTRkNTVlMDMwZDczIn0%3D; utm_source=eyJpdiI6ImNoRnVFWkhjVVEyMG0zVnk5czFNWWc9PSIsInZhbHVlIjoiRTM2dDd0aDZieGltNkw2WEhFN2pjRmpKN2poQ2ZuenpsMjZDUVFTblRLcz0iLCJtYWMiOiI4MTg3NTM0MzBiODBjOWVhZDcxZDk1ZGJlNWEyOWIzNjVhNDBjZjkyMzM0NGJhOGZhOTNhMmQ4NDcxMGFkNTRlIn0%3D; utm_medium=eyJpdiI6Ijk4RFFlMjRycFFjdzNDUUI3U2QyNFE9PSIsInZhbHVlIjoiVlBiWXViMHRScnRZVkhwdEJWcCtWZz09IiwibWFjIjoiNGVjZWFmMThhNDY0Y2U5Y2IzYjY5MWE2YzFmYzRjMWIzMjQ2YzVmODk0NTIzY2I4NjUwM2Y4OTdkNGVhZWRkMCJ9; elq_contact_id=eyJpdiI6IlBibklKc01GR0J3Z0xzMWpNMW5JYlE9PSIsInZhbHVlIjoicWp5QkFDd3Y2OVliSE45NmxSQW1jQT09IiwibWFjIjoiNjA3YTYxOTljZjFjMTAwMTA0NDY0ZTM0MTA2MjQ4Y2Y3ZDkzZWYyMDgxNmE1NjRhMDY4MzhjOGNjZmQ0MzVhYSJ9
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode
no-cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
script
:authority
www.cshub.com
referer
https://www.cshub.com/threat-defense/whitepapers/deadringer-exposing-chinese-threat-actors-targeting-major-telcos?utm_campaign=CSIQ-CD-21-09-16%20Cybereason%20-%20Content%20Syndication%20EM3&utm_medium=email&utm_source=internalemail&MAC=%7C1-OKRXKKD&elqContactId=16719758&disc=&elqCampId=104638&utm_content=CSIQ-CD-21-09-16%20Cybereason%20-%20Content%20Syndication%20EM3_A
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://www.cshub.com/threat-defense/whitepapers/deadringer-exposing-chinese-threat-actors-targeting-major-telcos?utm_campaign=CSIQ-CD-21-09-16%20Cybereason%20-%20Content%20Syndication%20EM3&utm_medium=email&utm_source=internalemail&MAC=%7C1-OKRXKKD&elqContactId=16719758&disc=&elqCampId=104638&utm_content=CSIQ-CD-21-09-16%20Cybereason%20-%20Content%20Syndication%20EM3_A
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Sat, 18 Sep 2021 15:51:12 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Wed, 08 Sep 2021 13:28:35 GMT
server
nginx
etag
W/"6138ba83-2374a8"
x-frame-options
SAMEORIGIN
content-type
application/javascript; charset=utf-8
cache-control
max-age=604800
vary
Accept-Encoding
x-xss-protection
1; mode=block
expires
Sat, 25 Sep 2021 15:51:12 GMT
css
fonts.googleapis.com/ 		11 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://fonts.googleapis.com/css?family=Raleway:300,400,500,600,700,800,900
Requested by
Host: www.cshub.com
URL: https://www.cshub.com/css/app_web.css?id=879df91e8864e3e5a8b2
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.186.170 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s08-in-f10.1e100.net
Software
ESF /
Resource Hash
48b2377c74c9ea0b87b9c14a63f3a93960ca119a0d31d34628442184dc64e325
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.cshub.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection
0
last-modified
Sat, 18 Sep 2021 15:40:29 GMT
server
ESF
date
Sat, 18 Sep 2021 15:51:12 GMT
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Sat, 18 Sep 2021 15:51:12 GMT
moatframe.js
z.moatads.com/addthismoatframe568911941483/ 		2 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://z.moatads.com/addthismoatframe568911941483/moatframe.js
Requested by
Host: s7.addthis.com
URL: https://s7.addthis.com/js/300/addthis_widget.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.18.235.40 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
05090f9390f5bc0cd23fe5f432037cc92d7cbce1ced9bfe8faf3d1c9abae85cd

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.cshub.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Sat, 18 Sep 2021 15:51:12 GMT
content-encoding
gzip
last-modified
Fri, 08 Nov 2019 20:13:52 GMT
server
AmazonS3
x-amz-request-id
D5503D14AA2F06AA
etag
"f14b4e1f799b14f798a195f43cf58376"
vary
Accept-Encoding
content-type
application/x-javascript
cache-control
max-age=41379
accept-ranges
bytes
content-length
948
x-amz-id-2
JgalEtxvSAtZmM7+naGfrhsdf0JFS0gJW8lypWF8Tp90EkcPp4c3eAnpK+RDOIL1ltWgpx8wc3s=
j.php
dev.visualwebsiteoptimizer.com/ 		3 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://dev.visualwebsiteoptimizer.com/j.php?a=47675&u=https%3A%2F%2Fwww.cshub.com%2Fthreat-defense%2Fwhitepapers%2Fdeadringer-exposing-chinese-threat-actors-targeting-major-telcos%3Futm_campaign%3DCSIQ-CD-21-09-16%2520Cybereason%2520-%2520Content%2520Syndication%2520EM3%26utm_medium%3Demail%26utm_source%3Dinternalemail%26MAC%3D%257C1-OKRXKKD%26elqContactId%3D16719758%26disc%3D%26elqCampId%3D104638%26utm_content%3DCSIQ-CD-21-09-16%2520Cybereason%2520-%2520Content%2520Syndication%2520EM3_A&r=0.9432405529249417
Requested by
Host: www.cshub.com
URL: https://www.cshub.com/threat-defense/whitepapers/deadringer-exposing-chinese-threat-actors-targeting-major-telcos?utm_campaign=CSIQ-CD-21-09-16%20Cybereason%20-%20Content%20Syndication%20EM3&utm_medium=email&utm_source=internalemail&MAC=%7C1-OKRXKKD&elqContactId=16719758&disc=&elqCampId=104638&utm_content=CSIQ-CD-21-09-16%20Cybereason%20-%20Content%20Syndication%20EM3_A
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.96.102.137 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
137.102.96.34.bc.googleusercontent.com
Software
gfra1 /
Resource Hash
2fd6fbdf6b72c1d0b3f04985b680c1e1bb31f65abdcefc1f9e7085a4597a3dd4

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.cshub.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

timing-allow-origin
*
date
Sat, 18 Sep 2021 15:51:12 GMT
via
1.1 google
server
gfra1
content-encoding
gzip
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-type
application/javascript; charset=UTF-8
insight.min.js
snap.licdn.com/li.lms-analytics/ 		5 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://snap.licdn.com/li.lms-analytics/insight.min.js
Requested by
Host: www.cshub.com
URL: https://www.cshub.com/threat-defense/whitepapers/deadringer-exposing-chinese-threat-actors-targeting-major-telcos?utm_campaign=CSIQ-CD-21-09-16%20Cybereason%20-%20Content%20Syndication%20EM3&utm_medium=email&utm_source=internalemail&MAC=%7C1-OKRXKKD&elqContactId=16719758&disc=&elqCampId=104638&utm_content=CSIQ-CD-21-09-16%20Cybereason%20-%20Content%20Syndication%20EM3_A
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2.18.234.132 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a2-18-234-132.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
fed785a6a8ca96fb67230fec5d85f9c508db49f4075aa0ef284af56cd89813e3

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.cshub.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Date
Sat, 18 Sep 2021 15:51:12 GMT
Content-Encoding
gzip
Last-Modified
Fri, 13 Aug 2021 21:34:05 GMT
X-CDN
AKAM
Vary
Accept-Encoding
Content-Type
application/x-javascript;charset=utf-8
Cache-Control
max-age=53016
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
2036
boomerang.min.js
cdn.feathr.co/js/ 		123 KB
39 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.feathr.co/js/boomerang.min.js
Requested by
Host: www.cshub.com
URL: https://www.cshub.com/threat-defense/whitepapers/deadringer-exposing-chinese-threat-actors-targeting-major-telcos?utm_campaign=CSIQ-CD-21-09-16%20Cybereason%20-%20Content%20Syndication%20EM3&utm_medium=email&utm_source=internalemail&MAC=%7C1-OKRXKKD&elqContactId=16719758&disc=&elqCampId=104638&utm_content=CSIQ-CD-21-09-16%20Cybereason%20-%20Content%20Syndication%20EM3_A
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.67.159.92 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
f8323c1a8560f0613e1d5cb4b5f586cbc5bbb33ee0a03786cd488df3dc69a7a8

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.cshub.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Sat, 18 Sep 2021 15:51:12 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
211
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
x-amz-request-id
208SH4DPHB6TPSPR
x-amz-id-2
82NUAHHMItWN8btyz5ikd81of59VJsHgDDeWqd1CSl+Xl+89PS4jFpzWyfBOifE37ugEz7nBnYc=
last-modified
Wed, 11 Aug 2021 16:12:01 GMT
server
cloudflare
etag
W/"91efa66eea9c35f1e7ede034e5728004"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=OEeJhpOAf9e2MDlsCT7q0QiV%2Bq7COmcZNrWVI1oVQOpQiZztX8dJUOaBPMecs1e2toz7iJ6VlrizdhYMWuN1dYpHB2W8UZ6f9BwdHN9SZrsnEnuUMoizrW8Dn3%2FsG9c1"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
cache-control
max-age=14400
cf-ray
690bbbfd6e443a93-CDG
fbevents.js
connect.facebook.net/en_US/ 		99 KB
26 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://connect.facebook.net/en_US/fbevents.js
Requested by
Host: www.cshub.com
URL: https://www.cshub.com/threat-defense/whitepapers/deadringer-exposing-chinese-threat-actors-targeting-major-telcos?utm_campaign=CSIQ-CD-21-09-16%20Cybereason%20-%20Content%20Syndication%20EM3&utm_medium=email&utm_source=internalemail&MAC=%7C1-OKRXKKD&elqContactId=16719758&disc=&elqCampId=104638&utm_content=CSIQ-CD-21-09-16%20Cybereason%20-%20Content%20Syndication%20EM3_A
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
31.13.92.14 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
xx-fbcdn-shv-01-frt3.fbcdn.net
Software
/
Resource Hash
335b59e615135313a66319e641cdad6ac3489a600e04d4181c859699bed4babe
Security Headers
Name Value
Content-Security-Policy default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.cshub.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

content-security-policy
default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=3600,h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length
25999
x-xss-protection
0
pragma
public
x-fb-debug
2qytGqR/0npJU3c6cE9GOwJWPZC52vPKAPKLl79p2oVgdUqJxqiTeYXB80w6mPU4tzZx5CPNHLCizTeztYP7+g==
x-fb-trip-id
686109401
x-frame-options
DENY
cross-origin-embedder-policy-report-only
require-corp;report-to="coep_report"
date
Sat, 18 Sep 2021 15:51:12 GMT
strict-transport-security
max-age=31536000; preload; includeSubDomains
report-to
{"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/?minimize=0"}],"group":"coep_report"}
content-type
application/x-javascript; charset=utf-8
vary
Accept-Encoding
cache-control
public, max-age=1200
x-fb-rlafr
0
priority
u=3,i
expires
Sat, 01 Jan 2000 00:00:00 GMT
tag.aspx
ml314.com/ 		28 KB
13 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://ml314.com/tag.aspx?1882021
Requested by
Host: www.cshub.com
URL: https://www.cshub.com/threat-defense/whitepapers/deadringer-exposing-chinese-threat-actors-targeting-major-telcos?utm_campaign=CSIQ-CD-21-09-16%20Cybereason%20-%20Content%20Syndication%20EM3&utm_medium=email&utm_source=internalemail&MAC=%7C1-OKRXKKD&elqContactId=16719758&disc=&elqCampId=104638&utm_content=CSIQ-CD-21-09-16%20Cybereason%20-%20Content%20Syndication%20EM3_A
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.208.138.90 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-208-138-90.eu-west-1.compute.amazonaws.com
Software
Microsoft-IIS/10.0 / ASP.NET
Resource Hash
1b05ce33469db78a252caf0e176e3cb56cd4d1d17aa3c3cda89f8088bb3eefda

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.cshub.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Date
Sat, 18 Sep 2021 15:51:12 GMT
Content-Encoding
gzip
Last-Modified
Sat, 18 Sep 2021 06:59:29 GMT
Server
Microsoft-IIS/10.0
X-AspNet-Version
4.0.30319
X-Powered-By
ASP.NET
Vary
Accept-Encoding
Content-Type
application/javascript; charset=utf-8
Cache-Control
public, max-age=54497
Connection
keep-alive
Content-Length
12574
Expires
Sun, 19 Sep 2021 06:59:29 GMT
truncated
/ 		330 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
793d351cc866196d17887ea6ef5ff0ea5458cb2e88a7e73e92c43ec0dcdb6285

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Content-Type
image/png
1Ptug8zYS_SKggPNyC0ITw.woff2
fonts.gstatic.com/s/raleway/v22/ 		46 KB
47 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/raleway/v22/1Ptug8zYS_SKggPNyC0ITw.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Raleway:300,400,500,600,700,800,900
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.186.131 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s07-in-f3.1e100.net
Software
sffe /
Resource Hash
2101735d43a8d486dbc5139500a78420766cc673a3610363ce9525526c3f5149
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://www.cshub.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Mon, 13 Sep 2021 20:10:53 GMT
x-content-type-options
nosniff
age
416419
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
47312
x-xss-protection
0
last-modified
Tue, 29 Jun 2021 19:40:30 GMT
server
sffe
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Tue, 13 Sep 2022 20:10:53 GMT
blocked_sites.js
system.picreel.com/js/ 		281 B
807 B 		Script
General
Check archive.org
Download Go to
Full URL
https://system.picreel.com/js/blocked_sites.js
Requested by
Host: assets.pcrl.co
URL: https://assets.pcrl.co/js/jstracker.min.js?geo=1
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
13.225.78.88 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-225-78-88.fra2.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
c65aa2b99ceeb0595c8d26af4d026a062fbfae7402667ccd7fa626e43c4f5cbc

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.cshub.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Date
Sat, 18 Sep 2021 03:38:41 GMT
Via
1.1 52f0756596448c36265861853c0a44a4.cloudfront.net (CloudFront)
Last-Modified
Tue, 14 May 2019 05:28:18 GMT
Server
AmazonS3
Age
43952
ETag
"cfe5c6de5d18b2265cc2f986399af585"
X-Cache
Hit from cloudfront
x-amz-version-id
tBnfWhrOfFymnPiDm.89fw0yzvTPUS4E
Connection
keep-alive
X-Amz-Cf-Pop
FRA2-C2
Accept-Ranges
bytes
Content-Type
application/javascript
Content-Length
281
X-Amz-Cf-Id
1QQpAvDIzImOXPLtsuCk0crVtrIu6O-TkSX0n1ZoU22VQ2mNrVKmTw==
/
c.6sc.co/ 		47 B
369 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://c.6sc.co/
Requested by
Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
104.111.233.140 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-111-233-140.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
f47e13da0d20e30ab1f3f07b1fa95435ce272121cbadbcaaf0fbef9a6b06e19e

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.cshub.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Date
Sat, 18 Sep 2021 15:51:12 GMT
Access-Control-Max-Age
86400
Access-Control-Allow-Methods
GET,POST
Content-Type
text/plain
Access-Control-Allow-Origin
https://www.cshub.com
Access-Control-Allow-Credentials
true
Connection
keep-alive
Access-Control-Allow-Headers
*
Content-Length
47
getuidj
secure.adnxs.com/ 		11 B
689 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://secure.adnxs.com/getuidj
Requested by
Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
37.252.172.250 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),
Reverse DNS
538.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net
Software
nginx/1.17.9 /
Resource Hash
31b45c462302ac175bfa43f9e5591491db780ca094f6ecdd2907f25ad578448d
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.cshub.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Pragma
no-cache
Date
Sat, 18 Sep 2021 15:51:12 GMT
X-Proxy-Origin
216.131.111.10; 216.131.111.10; 538.bm-nginx-loadbalancer.mgmt.fra1; adnxs.com
AN-X-Request-Uuid
946ab90e-ca4b-4623-bf4a-a1790827f02d
Server
nginx/1.17.9
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
https://www.cshub.com
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
application/json; charset=utf-8
Content-Length
11
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
fa-solid-900.woff2
use.fontawesome.com/releases/v5.0.10/webfonts/ 		43 KB
44 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://use.fontawesome.com/releases/v5.0.10/webfonts/fa-solid-900.woff2
Requested by
Host: use.fontawesome.com
URL: https://use.fontawesome.com/releases/v5.0.10/css/all.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.67.214.69 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
cb7aa6b06aa5a8eea3670662c4b0c37104041c14575fc170dc48677a0506a33a

Request headers

Referer
https://use.fontawesome.com/releases/v5.0.10/css/all.css
Origin
https://www.cshub.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Sat, 18 Sep 2021 15:51:12 GMT
access-control-allow-methods
GET
vary
Origin, Access-Control-Request-Headers, Access-Control-Request-Method, Accept-Encoding
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
6101763
cf-ray
690bbbfd9e335968-IAD
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length
44068
x-amz-id-2
aXC5Y6OAib4NgLPBJz5g+wiLZhKGPvraZnuG/AlJsD8Bb7qD7nSRp8kimaZD7gVOdrd5S6uLfQQ=
last-modified
Wed, 30 Jun 2021 15:27:03 GMT
server
cloudflare
etag
"84f351b3972185aed620f78489e48b2d"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
access-control-max-age
3000
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=kHxXlINMiDoEn4zksk0gvDAQTBcl%2B2CriWFca03jjncjENnU4tYHlhkspRsH4SgqM5x8kdpPjV6lj3AXM%2BuSaLVdIpmtgbadWwEwNoY70Pe%2FjTinZDSQZT91eNN44tjjBfrml8Qb"}],"group":"cf-nel","max_age":604800}
x-amz-request-id
Z2CV3CNKB1A4ZRXC
access-control-allow-origin
*
cache-control
max-age=31556926
accept-ranges
bytes
content-type
font/woff2
fa-brands-400.woff2
use.fontawesome.com/releases/v5.0.10/webfonts/ 		54 KB
54 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://use.fontawesome.com/releases/v5.0.10/webfonts/fa-brands-400.woff2
Requested by
Host: use.fontawesome.com
URL: https://use.fontawesome.com/releases/v5.0.10/css/all.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.67.214.69 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e8562087317b34c4b2ac60e28e272b7b33e37523aacd5f2adba7a4f108e415c6

Request headers

Referer
https://use.fontawesome.com/releases/v5.0.10/css/all.css
Origin
https://www.cshub.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Sat, 18 Sep 2021 15:51:12 GMT
access-control-allow-methods
GET
vary
Origin, Access-Control-Request-Headers, Access-Control-Request-Method, Accept-Encoding
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
6101763
cf-ray
690bbbfd9e345968-IAD
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length
55144
x-amz-id-2
kMibXZBksTWTLrErN9ZLm89zkVhv2ABF2BElUVe8mtlRyXjgxDgX0fprM34MPe3vPPsJlpaK88Q=
last-modified
Wed, 30 Jun 2021 15:27:03 GMT
server
cloudflare
etag
"2ac01f7650b5ab76bfebbc708928929e"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
access-control-max-age
3000
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=83dIUMBZbIuu%2BOfBBPPNMOgbXHuxbPENe3t9XgtdQDQF6Qis2pJeHt6AYhV5ED0jxjFSjp%2FR1tF9zWzA%2FQf8GwcdbHOdOKELbDUgDWfoKeJC%2BW9VnqZ4gDAXoMbHQle50GcPJFZx"}],"group":"cf-nel","max_age":604800}
x-amz-request-id
Z2CGM6HAWA6JN73H
access-control-allow-origin
*
cache-control
max-age=31556926
accept-ranges
bytes
content-type
font/woff2
v.gif
dev.visualwebsiteoptimizer.com/ 		35 B
214 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dev.visualwebsiteoptimizer.com/v.gif?cd=0&a=47675&d=cshub.com&u=DA5048D0CF8D7DF9D70D80FCDB1F91EE4&h=d2c8de0a75e67f0dbc664031fffc497c&t=false&r=0.2663244874783737
Requested by
Host: www.cshub.com
URL: https://www.cshub.com/threat-defense/whitepapers/deadringer-exposing-chinese-threat-actors-targeting-major-telcos?utm_campaign=CSIQ-CD-21-09-16%20Cybereason%20-%20Content%20Syndication%20EM3&utm_medium=email&utm_source=internalemail&MAC=%7C1-OKRXKKD&elqContactId=16719758&disc=&elqCampId=104638&utm_content=CSIQ-CD-21-09-16%20Cybereason%20-%20Content%20Syndication%20EM3_A
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.96.102.137 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
137.102.96.34.bc.googleusercontent.com
Software
gnv3c /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.cshub.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

pragma
no-cache
date
Sat, 18 Sep 2021 15:51:12 GMT
via
1.1 google
x-content-type-options
nosniff
server
gnv3c
content-type
image/gif
cache-control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
35
expires
Mon, 10 Jan 2005 00:00:01 GMT
collect
px.ads.linkedin.com/
Redirect Chain
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=49766&time=1631980272217&url=https%3A%2F%2Fwww.cshub.com%2Fthreat-defense%2Fwhitepapers%2Fdeadringer-exposing-chinese-threat-actors-targeting-majo...
  • https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D49766%26time%3D1631980272217%26url%3Dhttps%253A%252F%252Fwww.cshub.com%252Fthreat...
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=49766&time=1631980272217&url=https%3A%2F%2Fwww.cshub.com%2Fthreat-defense%2Fwhitepapers%2Fdeadringer-exposing-chinese-threat-actors-targeting-majo...
0
80 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=49766&time=1631980272217&url=https%3A%2F%2Fwww.cshub.com%2Fthreat-defense%2Fwhitepapers%2Fdeadringer-exposing-chinese-threat-actors-targeting-major-telcos%3Futm_campaign%3DCSIQ-CD-21-09-16%2520Cybereason%2520-%2520Content%2520Syndication%2520EM3%26utm_medium%3Demail%26utm_source%3Dinternalemail%26MAC%3D%257C1-OKRXKKD%26elqContactId%3D16719758%26disc%3D%26elqCampId%3D104638%26utm_content%3DCSIQ-CD-21-09-16%2520Cybereason%2520-%2520Content%2520Syndication%2520EM3_A&liSync=true
Requested by
Host: www.cshub.com
URL: https://www.cshub.com/threat-defense/whitepapers/deadringer-exposing-chinese-threat-actors-targeting-major-telcos?utm_campaign=CSIQ-CD-21-09-16%20Cybereason%20-%20Content%20Syndication%20EM3&utm_medium=email&utm_source=internalemail&MAC=%7C1-OKRXKKD&elqContactId=16719758&disc=&elqCampId=104638&utm_content=CSIQ-CD-21-09-16%20Cybereason%20-%20Content%20Syndication%20EM3_A
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
108.174.11.37 , United States, ASN14413 (LINKEDIN, US),
Reverse DNS
108-174-11-37.fwd.linkedin.com
Software
Play /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.cshub.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Sat, 18 Sep 2021 15:51:13 GMT
server
Play
linkedin-action
1
x-li-fabric
prod-lor1
x-li-proto
http/2
x-li-pop
prod-esv5
content-type
application/javascript
content-length
0
x-li-uuid
8gi6Z2n1pRZAUq3UDSsAAA==

Redirect headers

content-security-policy
default-src *; connect-src 'self' https://media-src.linkedin.com/media/ www.linkedin.com s.c.lnkd.licdn.com m.c.lnkd.licdn.com wss://*.linkedin.com dms.licdn.com https://dpm.demdex.net/id lnkd.demdex.net blob: https://accounts.google.com/gsi/status https://linkedin.sc.omtrdc.net/b/ss/ www.google-analytics.com static.licdn.com static-exp1.licdn.com static-exp2.licdn.com static-exp3.licdn.com media.licdn.com media-exp1.licdn.com media-exp2.licdn.com media-exp3.licdn.com; img-src data: blob: *; font-src data: *; style-src 'unsafe-inline' 'self' static-src.linkedin.com *.licdn.com; script-src 'report-sample' 'unsafe-inline' 'unsafe-eval' 'self' spdy.linkedin.com static-src.linkedin.com *.ads.linkedin.com *.licdn.com static.chartbeat.com www.google-analytics.com ssl.google-analytics.com bcvipva02.rightnowtech.com www.bizographics.com sjs.bizographics.com js.bizographics.com d.la4-c1-was.salesforceliveagent.com https://snap.licdn.com/li.lms-analytics/ platform.linkedin.com platform-akam.linkedin.com platform-ecst.linkedin.com platform-azur.linkedin.com; object-src 'none'; media-src blob: *; child-src blob: lnkd-communities: voyager: *; frame-ancestors 'self'; report-uri /security/csp?f=l
x-content-type-options
nosniff
linkedin-action
1
x-cache
CONFIG_NOCACHE
content-length
0
x-li-uuid
AAXMRwRx4OmQMMevaV+XvQ==
pragma
no-cache
x-li-pop
afd-prod-lor1-x
x-msedge-ref
Ref A: AF4B1415917949C284DE4D2349A66407 Ref B: FRAEDGE1414 Ref C: 2021-09-18T15:51:12Z
x-frame-options
sameorigin
date
Sat, 18 Sep 2021 15:51:12 GMT
expect-ct
max-age=86400, report-uri="https://www.linkedin.com/platform-telemetry/ct"
strict-transport-security
max-age=31536000
x-li-fabric
prod-lor1
location
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=49766&time=1631980272217&url=https%3A%2F%2Fwww.cshub.com%2Fthreat-defense%2Fwhitepapers%2Fdeadringer-exposing-chinese-threat-actors-targeting-major-telcos%3Futm_campaign%3DCSIQ-CD-21-09-16%2520Cybereason%2520-%2520Content%2520Syndication%2520EM3%26utm_medium%3Demail%26utm_source%3Dinternalemail%26MAC%3D%257C1-OKRXKKD%26elqContactId%3D16719758%26disc%3D%26elqCampId%3D104638%26utm_content%3DCSIQ-CD-21-09-16%2520Cybereason%2520-%2520Content%2520Syndication%2520EM3_A&liSync=true
cache-control
no-cache, no-store
x-li-proto
http/2
expires
Thu, 01 Jan 1970 00:00:00 GMT
img.gif
b.6sc.co/v1/beacon/ 		43 B
774 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=7bc85f9e154663454b5cb279cc5649c5&svisitor=&visitor=37bb6723-6ac7-4bcb-8989-8d2202f6965f&session=807fa34d-7f91-4bbe-8bf9-be3f9a9f2f59&event=a_pageload&q=%7B%7D&isIframe=false&m=%7B%22description%22%3A%22Download%20this%20report%20to%20discover%20how%20the%20Cybereason%20Nocturnus%20Team%20was%20able%20to%20identify%20threat%20actors%20targeting%20Southeast%20Asia%E2%80%99s%20telecommunications%20industry%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22DeadRinger%3A%20Exposing%20Chinese%20threat%20actors%20targeting%20major%20telcos%20%7C%20Cyber%20Security%20Hub%22%7D&cb=80272220&r=&thirdParty=%7B%7D&pageURL=https%3A%2F%2Fwww.cshub.com%2Fthreat-defense%2Fwhitepapers%2Fdeadringer-exposing-chinese-threat-actors-targeting-major-telcos%3Futm_campaign%3DCSIQ-CD-21-09-16%2520Cybereason%2520-%2520Content%2520Syndication%2520EM3%26utm_medium%3Demail%26utm_source%3Dinternalemail%26MAC%3D%257C1-OKRXKKD%26elqContactId%3D16719758%26disc%3D%26elqCampId%3D104638%26utm_content%3DCSIQ-CD-21-09-16%2520Cybereason%2520-%2520Content%2520Syndication%2520EM3_A
Requested by
Host: www.cshub.com
URL: https://www.cshub.com/threat-defense/whitepapers/deadringer-exposing-chinese-threat-actors-targeting-major-telcos?utm_campaign=CSIQ-CD-21-09-16%20Cybereason%20-%20Content%20Syndication%20EM3&utm_medium=email&utm_source=internalemail&MAC=%7C1-OKRXKKD&elqContactId=16719758&disc=&elqCampId=104638&utm_content=CSIQ-CD-21-09-16%20Cybereason%20-%20Content%20Syndication%20EM3_A
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
104.111.233.140 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-111-233-140.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.cshub.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Date
Sat, 18 Sep 2021 15:51:12 GMT
X-Content-Type-Options
nosniff
Connection
keep-alive
Content-Length
43
Pragma
no-cache
Last-Modified
Fri, 21 Feb 2020 18:57:20 GMT
Server
nginx/1.14.0 (Ubuntu)
ETag
"5e502810-2b"
Access-Control-Max-Age
86400
Access-Control-Allow-Methods
GET,POST
Content-Type
image/gif
Access-Control-Allow-Origin
Cache-Control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
Access-Control-Allow-Credentials
true
Accept-Ranges
bytes
Access-Control-Allow-Headers
*
Expires
Wed, 19 Apr 2000 11:43:00 GMT
697992860269740
connect.facebook.net/signals/config/ 		305 KB
88 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://connect.facebook.net/signals/config/697992860269740?v=2.9.45&r=stable
Requested by
Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
31.13.92.14 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
xx-fbcdn-shv-01-frt3.fbcdn.net
Software
/
Resource Hash
0bb1f990715a0826af97022b7844b230df70dc727f8a2ff7b3643d5ea89bb475
Security Headers
Name Value
Content-Security-Policy default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.cshub.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

content-security-policy
default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=3600,h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length
89158
x-xss-protection
0
pragma
public
x-fb-debug
UlaQWrqhdymryvVy5enkJZ9IG7jrvLsEoggmlQdeppV7RKtBNVlfjlrhW07X+DumI0PyoXXeDwwlee7/OpvWMQ==
x-fb-trip-id
686109401
x-frame-options
DENY
cross-origin-opener-policy
same-origin-allow-popups
cross-origin-embedder-policy-report-only
require-corp;report-to="coep_report"
date
Sat, 18 Sep 2021 15:51:12 GMT
strict-transport-security
max-age=31536000; preload; includeSubDomains
report-to
{"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/?minimize=0"}],"group":"coep_report"}
content-type
application/x-javascript; charset=utf-8
vary
Accept-Encoding
cache-control
public, max-age=1200
x-fb-rlafr
0
expires
Sat, 01 Jan 2000 00:00:00 GMT
pubads_impl_2021091001.js
securepubads.g.doubleclick.net/gpt/ 		333 KB
117 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021091001.js?31062638
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.217.18.98 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
zrh04s05-in-f98.1e100.net
Software
sffe /
Resource Hash
7345db8b8745d32b70fbbb0867ab8488760e99ce94aa40a78e73ad7fcba15866
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.cshub.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Sat, 18 Sep 2021 15:51:12 GMT
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
119453
x-xss-protection
0
last-modified
Fri, 10 Sep 2021 19:52:34 GMT
server
sffe
vary
Accept-Encoding
report-to
{"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type
text/javascript
cache-control
private, immutable, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="ads-gpt-scs"
expires
Sat, 18 Sep 2021 15:51:12 GMT
ppub_config
securepubads.g.doubleclick.net/pagead/ 		32 B
72 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/pagead/ppub_config?ippd=www.cshub.com
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.217.18.98 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
zrh04s05-in-f98.1e100.net
Software
cafe /
Resource Hash
0f0141e844398c216a4508d790c0fdea80241db9ccb6ee990428bbf3c789d958
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.cshub.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

timing-allow-origin
*
date
Sat, 18 Sep 2021 15:51:12 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private, max-age=3600, stale-while-revalidate=3600
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
application/json; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
48
x-xss-protection
0
expires
Sat, 18 Sep 2021 15:51:12 GMT
jstracker.content.min.js
system.picreel.com/js/ 		95 KB
22 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://system.picreel.com/js/jstracker.content.min.js?geo=1
Requested by
Host: assets.pcrl.co
URL: https://assets.pcrl.co/js/jstracker.min.js?geo=1
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
13.225.78.88 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-225-78-88.fra2.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
6da4b97d617f094ca9c057fa82bd86df862538195ff38fdd30ad08d212afc358

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.cshub.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

x-amz-version-id
cN8jAqOq5_9FbLW50PQYPNUEyDvkCmki
Content-Encoding
gzip
ETag
"94862a47a33a6d45257cbc7ab4af004d"
Age
11706
X-Cache
Hit from cloudfront
Connection
keep-alive
Content-Length
22000
Last-Modified
Wed, 16 Sep 2020 12:57:14 GMT
Server
AmazonS3
Date
Sat, 18 Sep 2021 12:36:07 GMT
Content-Type
application/javascript
Via
1.1 52f0756596448c36265861853c0a44a4.cloudfront.net (CloudFront)
Cache-Control
max-age=21600, must-revalidate
X-Amz-Cf-Pop
FRA2-C2
Accept-Ranges
bytes
X-Amz-Cf-Id
e2v_4gfTiclNqfIYNikdt-7nUEVHhtMj29XjJxl26DQN2IHUO1UVOQ==
/
www.facebook.com/tr/ 		44 B
424 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.facebook.com/tr/?id=697992860269740&ev=PageView&dl=https%3A%2F%2Fwww.cshub.com%2Fthreat-defense%2Fwhitepapers%2Fdeadringer-exposing-chinese-threat-actors-targeting-major-telcos%3Futm_campaign%3DCSIQ-CD-21-09-16%2520Cybereason%2520-%2520Content%2520Syndication%2520EM3%26utm_medium%3Demail%26utm_source%3Dinternalemail%26MAC%3D%257C1-OKRXKKD%26elqContactId%3D16719758%26disc%3D%26elqCampId%3D104638%26utm_content%3DCSIQ-CD-21-09-16%2520Cybereason%2520-%2520Content%2520Syndication%2520EM3_A&rl=&if=false&ts=1631980272272&sw=1600&sh=1200&v=2.9.45&r=stable&ec=0&o=30&fbp=fb.1.1631980272271.1595006987&it=1631980272233&coo=false&rqm=GET
Requested by
Host: www.cshub.com
URL: https://www.cshub.com/threat-defense/whitepapers/deadringer-exposing-chinese-threat-actors-targeting-major-telcos?utm_campaign=CSIQ-CD-21-09-16%20Cybereason%20-%20Content%20Syndication%20EM3&utm_medium=email&utm_source=internalemail&MAC=%7C1-OKRXKKD&elqContactId=16719758&disc=&elqCampId=104638&utm_content=CSIQ-CD-21-09-16%20Cybereason%20-%20Content%20Syndication%20EM3_A
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
31.13.92.36 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
edge-star-mini-shv-01-frt3.facebook.com
Software
proxygen-bolt /
Resource Hash
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.cshub.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Sat, 18 Sep 2021 15:51:12 GMT
last-modified
Fri, 21 Dec 2012 00:00:01 GMT
server
proxygen-bolt
strict-transport-security
max-age=31536000; includeSubDomains
content-type
image/gif
cache-control
no-cache, must-revalidate, max-age=0
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=3600, h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length
44
expires
Sat, 18 Sep 2021 15:51:12 GMT
/
googleads.g.doubleclick.net/pagead/viewthroughconversion/1064507893/ 		3 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/viewthroughconversion/1064507893/?random=1631980272292&cv=9&fst=1631980272292&num=1&guid=ON&resp=GooglemKTybQhCsO&eid=375603260&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&sendb=1&ig=1&frm=0&url=https%3A%2F%2Fwww.cshub.com%2Fthreat-defense%2Fwhitepapers%2Fdeadringer-exposing-chinese-threat-actors-targeting-major-telcos%3Futm_campaign%3DCSIQ-CD-21-09-16%2520Cybereason%2520-%2520Content%2520Syndication%2520EM3%26utm_medium%3Demail%26utm_source%3Dinternalemail%26MAC%3D%257C1-OKRXKKD%26elqContactId%3D16719758%26disc%3D%26elqCampId%3D104638%26utm_content%3DCSIQ-CD-21-09-16%2520Cybereason%2520-%2520Content%2520Syndication%2520EM3_A&tiba=DeadRinger%3A%20Exposing%20Chinese%20threat%20actors%20targeting%20major%20telcos%20%7C%20Cyber%20Security%20Hub&hn=www.googleadservices.com&rfmt=3&fmt=4
Requested by
Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.185.98 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s49-in-f2.1e100.net
Software
cafe /
Resource Hash
7217d688bfdc37c22c8fe106b97e2611cffa00ed46b5f078744de54e1dfc35a2
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.cshub.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

pragma
no-cache
date
Sat, 18 Sep 2021 15:51:12 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
text/javascript; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1244
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
analytics.js
www.google-analytics.com/ 		48 KB
20 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/analytics.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-3734990-33
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.185.142 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s50-in-f14.1e100.net
Software
Golfe2 /
Resource Hash
fd222137f245c06ddb4c4d44db41f12138dad6cf8ef5d4d4a5e500f38f0c8c62
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.cshub.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Wed, 11 Aug 2021 00:32:57 GMT
server
Golfe2
age
3855
date
Sat, 18 Sep 2021 14:46:57 GMT
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=7200
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
19747
expires
Sat, 18 Sep 2021 16:46:57 GMT
integrations
polo.feathr.co/v1/accounts/5850143e7c1fea34ebb31cca/ 		42 B
374 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://polo.feathr.co/v1/accounts/5850143e7c1fea34ebb31cca/integrations
Requested by
Host: cdn.feathr.co
URL: https://cdn.feathr.co/js/boomerang.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
107.21.25.45 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-107-21-25-45.compute-1.amazonaws.com
Software
nginx/1.17.8 /
Resource Hash
faa1444cbae74aad09a3bae4849dd1b0fead937d10b8b79321da628b461f59bd
Security Headers
Name Value
Strict-Transport-Security max-age=15724800; includeSubDomains

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.cshub.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Sat, 18 Sep 2021 15:51:12 GMT
server
nginx/1.17.8
strict-transport-security
max-age=15724800; includeSubDomains
access-control-allow-methods
GET, POST, PUT, OPTIONS
content-type
application/json
access-control-allow-origin
*
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
content-length
42
refresh
marco.feathr.co/v1/ 		43 B
591 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://marco.feathr.co/v1/refresh
Requested by
Host: www.cshub.com
URL: https://www.cshub.com/threat-defense/whitepapers/deadringer-exposing-chinese-threat-actors-targeting-major-telcos?utm_campaign=CSIQ-CD-21-09-16%20Cybereason%20-%20Content%20Syndication%20EM3&utm_medium=email&utm_source=internalemail&MAC=%7C1-OKRXKKD&elqContactId=16719758&disc=&elqCampId=104638&utm_content=CSIQ-CD-21-09-16%20Cybereason%20-%20Content%20Syndication%20EM3_A
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.225.78.3 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-225-78-3.fra2.r.cloudfront.net
Software
/
Resource Hash
98b3d9d20e032f90aca49e9b116225d539ff6fbdb7e42c3c363f63896ac03d2a

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.cshub.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Sat, 18 Sep 2021 15:51:12 GMT
via
1.1 a32f966fc5896281eb3de44fd8f57d40.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA2-C2
x-amzn-requestid
03494117-866a-4979-acdc-722f31ecd02a
access-control-allow-methods
*
content-type
image/gif
access-control-allow-origin
*
x-amzn-trace-id
Root=1-61460af0-1a31b7fd5f739cc12f9a4d34;Sampled=0
x-cache
Miss from cloudfront
x-amz-apigw-id
F3almFFvIAMFY1w=
content-length
43
x-amz-cf-id
Xta466cbVwJYKydm1slBzuqqTvDUx4TPGAsl7QNl9HWCNMh1SWd-UQ==
access-control-allow-headers
Content-Type,X-Amz-Date,Authorization,X-Api-Key
_ate.track.config_resp
v1.addthisedge.com/live/boost/ra-58c98c10e9fe273b/ 		3 KB
983 B 		Script
General
Check archive.org
Download Go to
Full URL
https://v1.addthisedge.com/live/boost/ra-58c98c10e9fe273b/_ate.track.config_resp
Requested by
Host: s7.addthis.com
URL: https://s7.addthis.com/js/300/addthis_widget.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.84.56.126 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-84-56-126.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
5c329a7f550d3ad4da104c51683286040480bf8e8d1922c7e825df1cd03b8b90

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.cshub.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Sat, 18 Sep 2021 15:51:12 GMT
content-encoding
gzip
etag
1989098345--gzip
vary
Accept-Encoding
content-type
application/javascript;charset=utf-8
cache-control
public, max-age=10, s-maxage=86400
content-disposition
attachment; filename=1.txt
content-length
807
300lo.json
m.addthis.com/live/red_lojson/ 		89 B
249 B 		Script
General
Check archive.org
Download Go to
Full URL
https://m.addthis.com/live/red_lojson/300lo.json?si=61460af021f3afae&bkl=0&bl=1&pdt=2127&sid=61460af021f3afae&pub=ra-58c98c10e9fe273b&rev=v8.28.8-wp&ln=en&pc=men&cb=0&ab=-&dp=www.cshub.com&fp=threat-defense%2Fwhitepapers%2Fdeadringer-exposing-chinese-threat-actors-targeting-major-telcos&fr=&of=0&pd=0&irt=0&vcl=0&md=0&ct=1&tct=0&abt=0&cdn=0&pi=1&rb=0&gen=100&chr=UTF-8&colc=1631980272559&jsl=1&uvs=61460af0c9242b63000&skipb=1&callback=addthis.cbs.jsonp__44502209277395920
Requested by
Host: s7.addthis.com
URL: https://s7.addthis.com/js/300/addthis_widget.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.84.56.126 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-84-56-126.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
d4cefc694bc46442d8a5c494d77ef254048839b37e117a54ffe78b46acc2ff08

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.cshub.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

pragma
no-cache
date
Sat, 18 Sep 2021 15:51:12 GMT
cache-control
max-age=0, no-cache, no-store, no-transform
content-disposition
attachment; filename=1.txt
content-length
89
content-type
application/javascript;charset=utf-8
sh.f48a1a04fe8dbf021b4cda1d.html
s7.addthis.com/static/ Frame 09BF 		0
0
sh.f48a1a04fe8dbf021b4cda1d.html
s7.addthis.com/static/ Frame 1BA6 		71 KB
26 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://s7.addthis.com/static/sh.f48a1a04fe8dbf021b4cda1d.html
Requested by
Host: s7.addthis.com
URL: https://s7.addthis.com/js/300/addthis_widget.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.84.56.126 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-84-56-126.deploy.static.akamaitechnologies.com
Software
nginx/1.15.8 /
Resource Hash
55d783462e6671fa985a6b0829db15474f4e57f0555c93e15cc2db6a1d1e6cab
Security Headers
Name Value
Strict-Transport-Security max-age=15724800; includeSubDomains

Request headers

:method
GET
:authority
s7.addthis.com
:scheme
https
:path
/static/sh.f48a1a04fe8dbf021b4cda1d.html
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
accept-language
de-DE,de;q=0.9
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://www.cshub.com/
accept-encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://www.cshub.com/

Response headers

server
nginx/1.15.8
content-type
text/html
last-modified
Thu, 04 Jun 2020 15:49:19 GMT
etag
W/"5ed917ff-11adc"
timing-allow-origin
*
cache-control
public, max-age=86313600
p3p
CP="NON ADM OUR DEV IND COM STA"
strict-transport-security
max-age=15724800; includeSubDomains
content-encoding
gzip
content-length
26421
date
Sat, 18 Sep 2021 15:51:12 GMT
vary
Accept-Encoding
x-host
s7.addthis.com
elqCfg.min.js
img04.en25.com/i/ 		6 KB
6 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://img04.en25.com/i/elqCfg.min.js
Requested by
Host: www.cshub.com
URL: https://www.cshub.com/threat-defense/whitepapers/deadringer-exposing-chinese-threat-actors-targeting-major-telcos?utm_campaign=CSIQ-CD-21-09-16%20Cybereason%20-%20Content%20Syndication%20EM3&utm_medium=email&utm_source=internalemail&MAC=%7C1-OKRXKKD&elqContactId=16719758&disc=&elqCampId=104638&utm_content=CSIQ-CD-21-09-16%20Cybereason%20-%20Content%20Syndication%20EM3_A
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.111.229.66 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-111-229-66.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
3346de8e2ae1bfde250c7ac5c06f79a0a60c7faef8e5e08a2c9e8fbf5ec2c9e8
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.cshub.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Pragma
no-cache
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
X-Content-Type-Options
nosniff
Content-Type
application/x-javascript
Last-Modified
Tue, 17 Aug 2021 17:49:31 GMT
ETag
"fac3963b9093d71:0"
P3P
CP="IDC DSP COR DEVa TAIa OUR BUS PHY ONL UNI COM NAV CNT STA",
Cache-Control
no-store
Date
Sat, 18 Sep 2021 15:51:12 GMT
Connection
keep-alive
Accept-Ranges
bytes
X-Robots-Tag
noindex, nofollow
Content-Length
6080
X-XSS-Protection
1; mode=block
Expires
Sat, 18 Sep 2021 15:51:12 GMT
utsync.ashx
ml314.com/ 		62 B
572 B 		Script
General
Check archive.org
Download Go to
Full URL
https://ml314.com/utsync.ashx?pub=&adv=&et=0&eid=82660&ct=js&pi=&fp=&clid=&if=0&ps=&cl=&mlt=&data=&&cp=https%3A%2F%2Fwww.cshub.com%2Fthreat-defense%2Fwhitepapers%2Fdeadringer-exposing-chinese-threat-actors-targeting-major-telcos%3Futm_campaign%3DCSIQ-CD-21-09-16%2520Cybereason%2520-%2520Content%2520Syndication%2520EM3%26utm_medium%3Demail%26utm_source%3Dinternalemail%26MAC%3D%257C1-OKRXKKD%26elqContactId%3D16719758%26disc%3D%26elqCampId%3D104638%26utm_content%3DCSIQ-CD-21-09-16%2520Cybereason%2520-%2520Content%2520Syndication%2520EM3_A&pv=1631980272659_plprae4yr&bl=en-us&cb=4593107&return=&ht=&d=&dc=&si=1631980272659_plprae4yr&cid=Cyber%20Security%20Hub-%2Fthreat-defense%2Fwhitepapers%2Fdeadringer-exposing-chinese-threat-actors-targeting-major-telcos&s=1600x1200&rp=
Requested by
Host: ml314.com
URL: https://ml314.com/tag.aspx?1882021
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.208.138.90 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-208-138-90.eu-west-1.compute.amazonaws.com
Software
Microsoft-IIS/10.0 / ASP.NET
Resource Hash
5a1ba6ff6db12f791bbbfc4da3cb389e06f0cd53eede09ef3eb3ceb074089ef1

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.cshub.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Pragma
no-cache
Date
Sat, 18 Sep 2021 15:51:11 GMT
Content-Encoding
gzip
Server
Microsoft-IIS/10.0
X-AspNet-Version
4.0.30319
X-Powered-By
ASP.NET
Vary
Accept-Encoding
p3P
CP="NON DSP COR ADMo PSAo DEVo BUS COM UNI NAV DEM STA"
Cache-Control
no-cache, no-store, must-revalidate
Connection
keep-alive
Content-Type
application/javascript; charset=utf-8
Content-Length
147
Expires
0
ud.ashx
in.ml314.com/ 		20 B
482 B 		Script
General
Check archive.org
Download Go to
Full URL
https://in.ml314.com/ud.ashx?topiclimit=&cb=1882021
Requested by
Host: ml314.com
URL: https://ml314.com/tag.aspx?1882021
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
50.16.141.78 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-50-16-141-78.compute-1.amazonaws.com
Software
Microsoft-IIS/10.0 / ASP.NET
Resource Hash
d0e4a6372d6fb5ffe9505dbe9e94aee8f1b9b96ec8e5e20684cce8b4c5a88fa7

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.cshub.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Date
Sat, 18 Sep 2021 15:51:12 GMT
Content-Encoding
gzip
Server
Microsoft-IIS/10.0
X-AspNet-Version
4.0.30319
X-Powered-By
ASP.NET
Vary
Accept-Encoding
Content-Type
application/javascript; charset=utf-8
Cache-Control
public
Connection
keep-alive
Content-Length
138
Expires
Sun, 19 Sep 2021 15:51:13 GMT
/
www.google.com/pagead/1p-user-list/1064507893/ 		42 B
569 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.com/pagead/1p-user-list/1064507893/?random=1631980272292&cv=9&fst=1631977200000&num=1&guid=ON&eid=375603260&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&sendb=1&frm=0&url=https%3A%2F%2Fwww.cshub.com%2Fthreat-defense%2Fwhitepapers%2Fdeadringer-exposing-chinese-threat-actors-targeting-major-telcos%3Futm_campaign%3DCSIQ-CD-21-09-16%2520Cybereason%2520-%2520Content%2520Syndication%2520EM3%26utm_medium%3Demail%26utm_source%3Dinternalemail%26MAC%3D%257C1-OKRXKKD%26elqContactId%3D16719758%26disc%3D%26elqCampId%3D104638%26utm_content%3DCSIQ-CD-21-09-16%2520Cybereason%2520-%2520Content%2520Syndication%2520EM3_A&tiba=DeadRinger%3A%20Exposing%20Chinese%20threat%20actors%20targeting%20major%20telcos%20%7C%20Cyber%20Security%20Hub&fmt=3&is_vtc=1&random=3765947168&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y
Requested by
Host: www.cshub.com
URL: https://www.cshub.com/threat-defense/whitepapers/deadringer-exposing-chinese-threat-actors-targeting-major-telcos?utm_campaign=CSIQ-CD-21-09-16%20Cybereason%20-%20Content%20Syndication%20EM3&utm_medium=email&utm_source=internalemail&MAC=%7C1-OKRXKKD&elqContactId=16719758&disc=&elqCampId=104638&utm_content=CSIQ-CD-21-09-16%20Cybereason%20-%20Content%20Syndication%20EM3_A
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.185.228 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s53-in-f4.1e100.net
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.cshub.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

pragma
no-cache
date
Sat, 18 Sep 2021 15:51:12 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-security-policy
script-src 'none'; object-src 'none'
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.de/pagead/1p-user-list/1064507893/ 		42 B
569 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.de/pagead/1p-user-list/1064507893/?random=1631980272292&cv=9&fst=1631977200000&num=1&guid=ON&eid=375603260&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&sendb=1&frm=0&url=https%3A%2F%2Fwww.cshub.com%2Fthreat-defense%2Fwhitepapers%2Fdeadringer-exposing-chinese-threat-actors-targeting-major-telcos%3Futm_campaign%3DCSIQ-CD-21-09-16%2520Cybereason%2520-%2520Content%2520Syndication%2520EM3%26utm_medium%3Demail%26utm_source%3Dinternalemail%26MAC%3D%257C1-OKRXKKD%26elqContactId%3D16719758%26disc%3D%26elqCampId%3D104638%26utm_content%3DCSIQ-CD-21-09-16%2520Cybereason%2520-%2520Content%2520Syndication%2520EM3_A&tiba=DeadRinger%3A%20Exposing%20Chinese%20threat%20actors%20targeting%20major%20telcos%20%7C%20Cyber%20Security%20Hub&fmt=3&is_vtc=1&random=3765947168&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y
Requested by
Host: www.cshub.com
URL: https://www.cshub.com/threat-defense/whitepapers/deadringer-exposing-chinese-threat-actors-targeting-major-telcos?utm_campaign=CSIQ-CD-21-09-16%20Cybereason%20-%20Content%20Syndication%20EM3&utm_medium=email&utm_source=internalemail&MAC=%7C1-OKRXKKD&elqContactId=16719758&disc=&elqCampId=104638&utm_content=CSIQ-CD-21-09-16%20Cybereason%20-%20Content%20Syndication%20EM3_A
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.18.99 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s42-in-f3.1e100.net
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.cshub.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

pragma
no-cache
date
Sat, 18 Sep 2021 15:51:12 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-security-policy
script-src 'none'; object-src 'none'
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
collect
www.google-analytics.com/j/ 		2 B
22 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/j/collect?v=1&_v=j93&aip=1&a=2044461160&t=pageview&_s=1&dl=https%3A%2F%2Fwww.cshub.com%2Fthreat-defense%2Fwhitepapers%2Fdeadringer-exposing-chinese-threat-actors-targeting-major-telcos%3Futm_campaign%3DCSIQ-CD-21-09-16%2520Cybereason%2520-%2520Content%2520Syndication%2520EM3%26utm_medium%3Demail%26utm_source%3Dinternalemail%26MAC%3D%257C1-OKRXKKD%26elqContactId%3D16719758%26disc%3D%26elqCampId%3D104638%26utm_content%3DCSIQ-CD-21-09-16%2520Cybereason%2520-%2520Content%2520Syndication%2520EM3_A&ul=en-us&de=UTF-8&dt=DeadRinger%3A%20Exposing%20Chinese%20threat%20actors%20targeting%20major%20telcos%20%7C%20Cyber%20Security%20Hub&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YEBAAUABAAAAAC~&jid=243149668&gjid=1025082517&cid=262104851.1631980273&tid=UA-3734990-33&_gid=1121210155.1631980273&_r=1&gtm=2ou9f0&z=1304068586
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.185.142 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s50-in-f14.1e100.net
Software
Golfe2 /
Resource Hash
de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://www.cshub.com/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Sat, 18 Sep 2021 15:51:12 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://www.cshub.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
2
expires
Fri, 01 Jan 1990 00:00:00 GMT
layers.fa6cd1947ce26e890d3d.js
s7.addthis.com/static/ 		263 KB
76 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://s7.addthis.com/static/layers.fa6cd1947ce26e890d3d.js
Requested by
Host: s7.addthis.com
URL: https://s7.addthis.com/js/300/addthis_widget.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.84.56.126 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-84-56-126.deploy.static.akamaitechnologies.com
Software
nginx/1.15.8 /
Resource Hash
6121ca306ad1045453d52517b8f436eb5a68055c82aefa46a9a77de36996a3df
Security Headers
Name Value
Strict-Transport-Security max-age=15724800; includeSubDomains

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.cshub.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

strict-transport-security
max-age=15724800; includeSubDomains
content-encoding
gzip
last-modified
Mon, 26 Oct 2020 18:11:48 GMT
server
nginx/1.15.8
etag
W/"5f971164-41cf5"
vary
Accept-Encoding
content-type
application/javascript
cache-control
public, max-age=86313600
date
Sat, 18 Sep 2021 15:51:12 GMT
x-host
s7.addthis.com
timing-allow-origin
*
content-length
77617
svrGP
s893759278.t.eloqua.com/visitor/v200/ 		49 B
448 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s893759278.t.eloqua.com/visitor/v200/svrGP?pps=3&siteid=893759278&ref2=elqNone&tzo=0&ms=683&optin=disabled
Requested by
Host: www.cshub.com
URL: https://www.cshub.com/threat-defense/whitepapers/deadringer-exposing-chinese-threat-actors-targeting-major-telcos?utm_campaign=CSIQ-CD-21-09-16%20Cybereason%20-%20Content%20Syndication%20EM3&utm_medium=email&utm_source=internalemail&MAC=%7C1-OKRXKKD&elqContactId=16719758&disc=&elqCampId=104638&utm_content=CSIQ-CD-21-09-16%20Cybereason%20-%20Content%20Syndication%20EM3_A
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
142.0.160.53 Ashburn, United States, ASN7160 (NETDYNAMICS, US),
Reverse DNS
Software
/
Resource Hash
f1ccea6b7204d9f7913ab45e1afa51d79f83bd4f0319de937b0132e6e02b1aab
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.cshub.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Pragma
no-cache
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
X-Content-Type-Options
nosniff
Content-Type
image/gif
Date
Sat, 18 Sep 2021 15:51:12 GMT
P3P
CP="IDC DSP COR DEVa TAIa OUR BUS PHY ONL UNI COM NAV CNT STA",
Cache-Control
no-store
X-Robots-Tag
noindex, nofollow
Content-Length
49
X-Xss-Protection
1; mode=block
Expires
-1
script.js
polo.feathr.co/v1/analytics/match/ 		290 B
565 B 		Script
General
Check archive.org
Download Go to
Full URL
https://polo.feathr.co/v1/analytics/match/script.js?pk=feathr&cb=1631980272697
Requested by
Host: cdn.feathr.co
URL: https://cdn.feathr.co/js/boomerang.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
107.21.25.45 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-107-21-25-45.compute-1.amazonaws.com
Software
nginx/1.17.8 /
Resource Hash
67f4e139475474e710fc40e5d48fe06acfdcef403415a70ebdd1befde2175d54
Security Headers
Name Value
Strict-Transport-Security max-age=15724800; includeSubDomains

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.cshub.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Sat, 18 Sep 2021 15:51:12 GMT
content-encoding
gzip
server
nginx/1.17.8
etag
W/"61460af009a693000711ff6c"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, PUT, OPTIONS
content-type
text/javascript
access-control-allow-origin
*
cache-control
no-cache, max-age=0
access-control-allow-credentials
true
strict-transport-security
max-age=15724800; includeSubDomains
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
pixel.js
polo.feathr.co/v1/accounts/5850143e7c1fea34ebb31cca/ 		32 B
397 B 		Script
General
Check archive.org
Download Go to
Full URL
https://polo.feathr.co/v1/accounts/5850143e7c1fea34ebb31cca/pixel.js?pk=feathr
Requested by
Host: cdn.feathr.co
URL: https://cdn.feathr.co/js/boomerang.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
107.21.25.45 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-107-21-25-45.compute-1.amazonaws.com
Software
nginx/1.17.8 /
Resource Hash
eacfa4f711eaca1336ff82619c8a2d310dec11266d594fbc7e5a91259cebf848
Security Headers
Name Value
Strict-Transport-Security max-age=15724800; includeSubDomains

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.cshub.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Sat, 18 Sep 2021 15:51:12 GMT
server
nginx/1.17.8
strict-transport-security
max-age=15724800; includeSubDomains
access-control-allow-methods
GET, POST, PUT, OPTIONS
content-type
text/javascript
access-control-allow-origin
*
cache-control
must-revalidate, max-age=14400
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
content-length
32
shares-post.json
api-public.addthis.com/url/serviceapi/ 		2 B
316 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://api-public.addthis.com/url/serviceapi/shares-post.json?services=sFbt&url=https%3A%2F%2Fwww.cshub.com%2Fthreat-defense%2Fwhitepapers%2Fdeadringer-exposing-chinese-threat-actors-targeting-major-telcos
Requested by
Host: s7.addthis.com
URL: https://s7.addthis.com/js/300/addthis_widget.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.84.56.126 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-84-56-126.deploy.static.akamaitechnologies.com
Software
nginx/1.15.8 /
Resource Hash
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
Security Headers
Name Value
Strict-Transport-Security max-age=15724800; includeSubDomains

Request headers

Referer
https://www.cshub.com/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Content-type
text/plain

Response headers

strict-transport-security
max-age=15724800; includeSubDomains
surrogate-key
sFbt=https://www.cshub.com/threat-defense/whitepapers/deadringer-exposing-chinese-threat-actors-targeting-major-telcos
last-modified
Sat, 18 Sep 2021 15:00:00 GMT
server
nginx/1.15.8
date
Sat, 18 Sep 2021 15:51:12 GMT
content-type
application/json
access-control-allow-origin
https://www.cshub.com
cache-control
no-transform, max-age=0, s-maxage=14400
access-control-allow-credentials
true
content-length
2
shares.json
api-public.addthis.com/url/ 		33 B
343 B 		Script
General
Check archive.org
Download Go to
Full URL
https://api-public.addthis.com/url/shares.json?url=https%3A%2F%2Fwww.cshub.com%2Fthreat-defense%2Fwhitepapers%2Fdeadringer-exposing-chinese-threat-actors-targeting-major-telcos&callback=_ate.cbs.rcb_jwp90
Requested by
Host: s7.addthis.com
URL: https://s7.addthis.com/js/300/addthis_widget.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.84.56.126 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-84-56-126.deploy.static.akamaitechnologies.com
Software
nginx/1.15.8 /
Resource Hash
f7592560bb9832fa430b1987cc46817e72cd346b87e057bbc78652f147a4bc6e
Security Headers
Name Value
Strict-Transport-Security max-age=15724800; includeSubDomains

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.cshub.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

strict-transport-security
max-age=15724800; includeSubDomains
content-encoding
gzip
surrogate-key
www.cshub.com/threat-defense/whitepapers/deadringer-exposing-chinese-threat-actors-targeting-major-telcos
last-modified
Sat, 18 Sep 2021 15:51:12 GMT
server
nginx/1.15.8
date
Sat, 18 Sep 2021 15:51:12 GMT
vary
Accept-Encoding
content-type
application/json
cache-control
no-transform, must-revalidate, max-age=0, s-maxage=3600
content-length
53
shares.json
api-public.addthis.com/url/ 		33 B
343 B 		Script
General
Check archive.org
Download Go to
Full URL
https://api-public.addthis.com/url/shares.json?url=http%3A%2F%2Fwww.cshub.com%2Fthreat-defense%2Fwhitepapers%2Fdeadringer-exposing-chinese-threat-actors-targeting-major-telcos&callback=_ate.cbs.rcb_4jjn0
Requested by
Host: s7.addthis.com
URL: https://s7.addthis.com/js/300/addthis_widget.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.84.56.126 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-84-56-126.deploy.static.akamaitechnologies.com
Software
nginx/1.15.8 /
Resource Hash
08d7f39c648ca44bbf1d781805d3cf57e18ffd1ac4560724809756d26afe8388
Security Headers
Name Value
Strict-Transport-Security max-age=15724800; includeSubDomains

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.cshub.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

strict-transport-security
max-age=15724800; includeSubDomains
content-encoding
gzip
surrogate-key
www.cshub.com/threat-defense/whitepapers/deadringer-exposing-chinese-threat-actors-targeting-major-telcos
last-modified
Sat, 18 Sep 2021 15:51:12 GMT
server
nginx/1.15.8
date
Sat, 18 Sep 2021 15:51:12 GMT
vary
Accept-Encoding
content-type
application/json
cache-control
no-transform, must-revalidate, max-age=0, s-maxage=3600
content-length
53
collect
stats.g.doubleclick.net/j/ 		1 B
459 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j93&tid=UA-3734990-33&cid=262104851.1631980273&jid=243149668&gjid=1025082517&_gid=1121210155.1631980273&_u=YEBAAUAAAAAAAC~&z=1354590663
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
74.125.133.156 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
wo-in-f156.1e100.net
Software
Golfe2 /
Resource Hash
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.cshub.com/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
strict-transport-security
max-age=10886400; includeSubDomains; preload
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
date
Sat, 18 Sep 2021 15:51:12 GMT
content-type
text/plain
access-control-allow-origin
https://www.cshub.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1
expires
Fri, 01 Jan 1990 00:00:00 GMT
truncated
/ 		443 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
5876d235b697479a9e5f476a33115aea1ddc21fd4b4740dd7180398c6224fdba

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Content-Type
image/png
/
www.facebook.com/tr/ Frame B732 		0
18 B 		Document
General
Check archive.org
Download Go to
Full URL
https://www.facebook.com/tr/
Requested by
Host: www.cshub.com
URL: https://www.cshub.com/threat-defense/whitepapers/deadringer-exposing-chinese-threat-actors-targeting-major-telcos?utm_campaign=CSIQ-CD-21-09-16%20Cybereason%20-%20Content%20Syndication%20EM3&utm_medium=email&utm_source=internalemail&MAC=%7C1-OKRXKKD&elqContactId=16719758&disc=&elqCampId=104638&utm_content=CSIQ-CD-21-09-16%20Cybereason%20-%20Content%20Syndication%20EM3_A
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
31.13.92.36 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
edge-star-mini-shv-01-frt3.facebook.com
Software
proxygen-bolt /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

:method
POST
:authority
www.facebook.com
:scheme
https
:path
/tr/
content-length
3314
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
origin
https://www.cshub.com
content-type
application/x-www-form-urlencoded
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
accept-language
de-DE,de;q=0.9
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://www.cshub.com/
accept-encoding
gzip, deflate, br
cookie
fr=0eGnDCncS3nVH0Ry1..BhRgrw...1.0.BhRgrw.
Upgrade-Insecure-Requests
1
Origin
https://www.cshub.com
Content-Type
application/x-www-form-urlencoded
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://www.cshub.com/

Response headers

content-type
text/plain
access-control-allow-origin
https://www.cshub.com
access-control-allow-credentials
true
strict-transport-security
max-age=31536000; includeSubDomains
cross-origin-resource-policy
cross-origin
content-length
0
server
proxygen-bolt
alt-svc
h3=":443"; ma=3600, h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
priority
u=3,i
date
Sat, 18 Sep 2021 15:51:12 GMT
match
polo-v1.feathr.co/v1/analytics/
Redirect Chain
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=6fgi4r1&ttd_tpi=1&ttd_puid=61460af009a693000711ff6c&gdpr=0
  • https://match.adsrvr.org/track/cmb/generic?ttd_pid=6fgi4r1&ttd_tpi=1&ttd_puid=61460af009a693000711ff6c&gdpr=0
  • https://polo-v1.feathr.co/v1/analytics/match?f_id=61460af009a693000711ff6c&ttd_id=a555adef-feee-45d5-a0a4-b850517d8081
43 B
402 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://polo-v1.feathr.co/v1/analytics/match?f_id=61460af009a693000711ff6c&ttd_id=a555adef-feee-45d5-a0a4-b850517d8081
Requested by
Host: www.cshub.com
URL: https://www.cshub.com/threat-defense/whitepapers/deadringer-exposing-chinese-threat-actors-targeting-major-telcos?utm_campaign=CSIQ-CD-21-09-16%20Cybereason%20-%20Content%20Syndication%20EM3&utm_medium=email&utm_source=internalemail&MAC=%7C1-OKRXKKD&elqContactId=16719758&disc=&elqCampId=104638&utm_content=CSIQ-CD-21-09-16%20Cybereason%20-%20Content%20Syndication%20EM3_A
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
107.21.25.45 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-107-21-25-45.compute-1.amazonaws.com
Software
nginx/1.17.8 /
Resource Hash
98b3d9d20e032f90aca49e9b116225d539ff6fbdb7e42c3c363f63896ac03d2a
Security Headers
Name Value
Strict-Transport-Security max-age=15724800; includeSubDomains

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.cshub.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Sat, 18 Sep 2021 15:51:13 GMT
server
nginx/1.17.8
strict-transport-security
max-age=15724800; includeSubDomains
access-control-allow-methods
GET, POST, PUT, OPTIONS
content-type
image/gif
access-control-allow-origin
*
cache-control
max-age=0,no-cache,no-store
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
content-length
43

Redirect headers

pragma
no-cache
date
Sat, 18 Sep 2021 15:51:13 GMT
x-aspnet-version
4.0.30319
p3p
CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location
https://polo-v1.feathr.co/v1/analytics/match?f_id=61460af009a693000711ff6c&ttd_id=a555adef-feee-45d5-a0a4-b850517d8081
cache-control
private,no-cache, must-revalidate
content-type
text/html
content-length
267
script.js
polo.feathr.co/v1/analytics/match/ 		207 B
590 B 		Script
General
Check archive.org
Download Go to
Full URL
https://polo.feathr.co/v1/analytics/match/script.js?pk=feathr&cb=1631980273281
Requested by
Host: cdn.feathr.co
URL: https://cdn.feathr.co/js/boomerang.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
107.21.25.45 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-107-21-25-45.compute-1.amazonaws.com
Software
nginx/1.17.8 /
Resource Hash
b38170ba210bf9506222ffe28e58159e04ff5037c349b4f2bc7c2026735a1bc1
Security Headers
Name Value
Strict-Transport-Security max-age=15724800; includeSubDomains

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.cshub.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Sat, 18 Sep 2021 15:51:13 GMT
server
nginx/1.17.8
etag
"61460af009a693000711ff6c"
strict-transport-security
max-age=15724800; includeSubDomains
access-control-allow-methods
GET, POST, PUT, OPTIONS
content-type
text/javascript
access-control-allow-origin
*
cache-control
no-cache, max-age=0
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
content-length
207
crumb
polo.feathr.co/v1/analytics/ 		43 B
499 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://polo.feathr.co/v1/analytics/crumb?cb=1631980273388&a_id=5850143e7c1fea34ebb31cca&f_id=61460af009a693000711ff6c&ses_id=61460af0d056075450fc2dbc&ttd_id=a555adef-feee-45d5-a0a4-b850517d8081&flvr=page_view&loc_url=https%3A%2F%2Fwww.cshub.com%2Fthreat-defense%2Fwhitepapers%2Fdeadringer-exposing-chinese-threat-actors-targeting-major-telcos%3Futm_campaign%3DCSIQ-CD-21-09-16%2520Cybereason%2520-%2520Content%2520Syndication%2520EM3%26utm_medium%3Demail%26utm_source%3Dinternalemail%26MAC%3D%257C1-OKRXKKD%26elqContactId%3D16719758%26disc%3D%26elqCampId%3D104638%26utm_content%3DCSIQ-CD-21-09-16%2520Cybereason%2520-%2520Content%2520Syndication%2520EM3_A&s_w=1600&s_h=1200&b_w=1600&b_h=1200&cust_params=e30=&utm_params=eyJ1dG1fY2FtcGFpZ24iOiJDU0lRLUNELTIxLTA5LTE2JTIwQ3liZXJlYXNvbiUyMC0lMjBDb250ZW50JTIwU3luZGljYXRpb24lMjBFTTMiLCJ1dG1fbWVkaXVtIjoiZW1haWwiLCJ1dG1fc291cmNlIjoiaW50ZXJuYWxlbWFpbCIsInV0bV9jb250ZW50IjoiQ1NJUS1DRC0yMS0wOS0xNiUyMEN5YmVyZWFzb24lMjAtJTIwQ29udGVudCUyMFN5bmRpY2F0aW9uJTIwRU0zX0EifQ==
Requested by
Host: www.cshub.com
URL: https://www.cshub.com/threat-defense/whitepapers/deadringer-exposing-chinese-threat-actors-targeting-major-telcos?utm_campaign=CSIQ-CD-21-09-16%20Cybereason%20-%20Content%20Syndication%20EM3&utm_medium=email&utm_source=internalemail&MAC=%7C1-OKRXKKD&elqContactId=16719758&disc=&elqCampId=104638&utm_content=CSIQ-CD-21-09-16%20Cybereason%20-%20Content%20Syndication%20EM3_A
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
107.21.25.45 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-107-21-25-45.compute-1.amazonaws.com
Software
nginx/1.17.8 /
Resource Hash
98b3d9d20e032f90aca49e9b116225d539ff6fbdb7e42c3c363f63896ac03d2a
Security Headers
Name Value
Strict-Transport-Security max-age=15724800; includeSubDomains

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.cshub.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Sat, 18 Sep 2021 15:51:13 GMT
server
nginx/1.17.8
strict-transport-security
max-age=15724800; includeSubDomains
access-control-allow-methods
GET, POST, PUT, OPTIONS
content-type
image/gif
access-control-allow-origin
*
cache-control
max-age=0,no-cache,no-store
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
content-length
43
truncated
/ 		43 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Content-Type
image/gif
deadringer_exposing_chinese_threat_actors_targeting_major_telcosWeKr9sD3Rk7HyoGf9SK5BzESj3s0QBqnG5IdKVwk.jpg
plsadaptive.s3.amazonaws.com/eco/images/channel_content/images/ 		36 KB
36 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://plsadaptive.s3.amazonaws.com/eco/images/channel_content/images/deadringer_exposing_chinese_threat_actors_targeting_major_telcosWeKr9sD3Rk7HyoGf9SK5BzESj3s0QBqnG5IdKVwk.jpg
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.216.84.8 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
s3-1-w.amazonaws.com
Software
AmazonS3 /
Resource Hash
8bef88499589af89088fef87e579ca5052021e6e0782d8a098737b9eaa4b3fce

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.cshub.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

x-amz-server-side-encryption
AES256
Date
Sat, 18 Sep 2021 15:51:14 GMT
Last-Modified
Thu, 19 Aug 2021 13:37:11 GMT
Server
AmazonS3
x-amz-request-id
EAG0KSE216S9Q20S
ETag
"74591abb9f15a060c1adfc18b40e7dc5"
x-amz-version-id
xegKH0SRUoLZKHIKoQtvmjGxZFE77INz
Accept-Ranges
bytes
Content-Type
image/jpeg
Content-Length
36833
x-amz-id-2
ExrDJnPL2CyDbn5ExcGt9VkNZRk2qdvDjK/TFmxXTGI5OxWJrtJMAs6yL5P6608ENTDE3sXHRhM=
deadringer_threat_actors_southeast_asian_telcoszc26TE3FrwcrmNBzYJBqpPRNzFjyFIoM7U7LMw1x.jpg
plsadaptive.s3.amazonaws.com/eco/images/channel_content/images/ 		29 KB
29 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://plsadaptive.s3.amazonaws.com/eco/images/channel_content/images/deadringer_threat_actors_southeast_asian_telcoszc26TE3FrwcrmNBzYJBqpPRNzFjyFIoM7U7LMw1x.jpg
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.216.84.8 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
s3-1-w.amazonaws.com
Software
AmazonS3 /
Resource Hash
b4d3792011680a1972c82790a41498f22516e8271ea46ce7d671be38634014ad

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.cshub.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

x-amz-server-side-encryption
AES256
Date
Sat, 18 Sep 2021 15:51:14 GMT
Last-Modified
Thu, 19 Aug 2021 13:49:07 GMT
Server
AmazonS3
x-amz-request-id
EAGDQW0ZT3PZE2NP
ETag
"ce22dc29d6763bc845e484a4c35754aa"
x-amz-version-id
GK.8swwq9PvUDADzY1C4f5uELyD1aF.A
Accept-Ranges
bytes
Content-Type
image/jpeg
Content-Length
29346
x-amz-id-2
U21EsWW7lLBICIsy+I7zezo3j1nJoeEIqh+mJX+h6SueeMQJZQFLmhMVRmrda6U6yKUbYMMBipM=
deadringer_exposing_chinese_threat_actors_targeting_major_telcosWeKr9sD3Rk7HyoGf9SK5BzESj3s0QBqnG5IdKVwk_medium.jpg
plsadaptive.s3.amazonaws.com/eco/images/channel_content/images/ 		36 KB
36 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://plsadaptive.s3.amazonaws.com/eco/images/channel_content/images/deadringer_exposing_chinese_threat_actors_targeting_major_telcosWeKr9sD3Rk7HyoGf9SK5BzESj3s0QBqnG5IdKVwk_medium.jpg
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.216.84.8 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
s3-1-w.amazonaws.com
Software
AmazonS3 /
Resource Hash
8bef88499589af89088fef87e579ca5052021e6e0782d8a098737b9eaa4b3fce

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.cshub.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

x-amz-server-side-encryption
AES256
Date
Sat, 18 Sep 2021 15:51:14 GMT
Last-Modified
Thu, 19 Aug 2021 13:37:12 GMT
Server
AmazonS3
x-amz-request-id
EAG4PK1XRT1WX99B
ETag
"74591abb9f15a060c1adfc18b40e7dc5"
x-amz-version-id
XEMbC5nmZej6.gxOzrR9Hv_UH9gwfzC6
Accept-Ranges
bytes
Content-Type
image/jpeg
Content-Length
36833
x-amz-id-2
X28Qrj4WW/f5xOwc1OyHwnD7AuRsUh2K9TzHaAMeDf9b75370qMpGoyyqzsDtZICzBri+wLW/GA=
pixel.js
polo.feathr.co/v1/accounts/5850143e7c1fea34ebb31cca/integrations/facebook/ 		0
319 B 		Script
General
Check archive.org
Download Go to
Full URL
https://polo.feathr.co/v1/accounts/5850143e7c1fea34ebb31cca/integrations/facebook/pixel.js?pk=feathr
Requested by
Host: cdn.feathr.co
URL: https://cdn.feathr.co/js/boomerang.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
107.21.25.45 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-107-21-25-45.compute-1.amazonaws.com
Software
nginx/1.17.8 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=15724800; includeSubDomains

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.cshub.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Sat, 18 Sep 2021 15:51:13 GMT
server
nginx/1.17.8
strict-transport-security
max-age=15724800; includeSubDomains
access-control-allow-methods
GET, POST, PUT, OPTIONS
content-type
text/html; charset=utf-8
access-control-allow-origin
*
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
content-length
0
cd.min.js
system.picreel.com/js/ 		947 B
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://system.picreel.com/js/cd.min.js
Requested by
Host: system.picreel.com
URL: https://system.picreel.com/js/jstracker.content.min.js?geo=1
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
13.225.78.88 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-225-78-88.fra2.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
19307946d5d21a01e4fe16453f2e51b9d7d6226458d5f7de2af9a8bfb127f05d

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.cshub.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

x-amz-version-id
n_c1cIpGEJcZhJ9hIDMWj._AdYJJJMpt
Content-Encoding
gzip
ETag
"6db0367a3eaf0edafdc6fd27eeb4cc14"
Age
5879
X-Cache
Hit from cloudfront
Connection
keep-alive
Content-Length
447
Last-Modified
Tue, 14 May 2019 05:30:06 GMT
Server
AmazonS3
Date
Sat, 18 Sep 2021 14:14:10 GMT
Content-Type
application/javascript
Via
1.1 52f0756596448c36265861853c0a44a4.cloudfront.net (CloudFront)
Cache-Control
max-age=21600, must-revalidate
X-Amz-Cf-Pop
FRA2-C2
Accept-Ranges
bytes
X-Amz-Cf-Id
huCZNYQ6-X9POmk8HGD-ipzA3oUMi2eFaYuYVloQgwsi06Ebw4SfCA==
get_template
app.picreel.com/api/ Frame ACBE 		0
251 B 		Document
General
Check archive.org
Download Go to
Full URL
https://app.picreel.com/api/get_template?source_url=https%253A%252F%252Fwww.cshub.com%252Fthreat-defense%252Fwhitepapers%252Fdeadringer-exposing-chinese-threat-actors-targeting-major-telcos%253Futm_campaign%253DCSIQ-CD-21-09-16%252520Cybereason%252520-%252520Content%252520Syndication%252520EM3%2526utm_medium%253Demail%2526utm_source%253Dinternalemail%2526MAC%253D%25257C1-OKRXKKD%2526elqContactId%253D16719758%2526disc%253D%2526elqCampId%253D104638%2526utm_content%253DCSIQ-CD-21-09-16%252520Cybereason%252520-%252520Content%252520Syndication%252520EM3_A&source_host=https%253A%252F%252Fwww.cshub.com&templateId=&userAgent=Mozilla%252F5.0%2520(Windows%2520NT%252010.0%253B%2520Win64%253B%2520x64)%2520AppleWebKit%252F537.36%2520(KHTML%252C%2520like%2520Gecko)%2520Chrome%252F92.0.4515.159%2520Safari%252F537.36&referrer=&screenWight=1600&screenHeight=1200&pv=&pp=&sv=&sp=&nv=&np=&rb=&ret=&utm_source=Picreel&utm_medium=display&utm_campaign=Picreel
Requested by
Host: system.picreel.com
URL: https://system.picreel.com/js/jstracker.content.min.js?geo=1
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.167.195.195 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-35-167-195-195.us-west-2.compute.amazonaws.com
Software
nginx/1.4.6 (Ubuntu) / PHP/5.5.9-1ubuntu4.21
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Host
app.picreel.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
cross-site
Sec-Fetch-Mode
navigate
Sec-Fetch-Dest
iframe
Referer
https://www.cshub.com/
Accept-Encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://www.cshub.com/

Response headers

Content-Encoding
gzip
Content-Type
text/html; charset=utf-8
Date
Sat, 18 Sep 2021 15:55:22 GMT
Server
nginx/1.4.6 (Ubuntu)
X-Powered-By
PHP/5.5.9-1ubuntu4.21
Content-Length
20
Connection
keep-alive
deadringer_exposing_chinese_threat_actors_targeting_major_telcosWeKr9sD3Rk7HyoGf9SK5BzESj3s0QBqnG5IdKVwk.jpg
plsadaptive.s3.amazonaws.com/eco/images/channel_content/images/ 		36 KB
36 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://plsadaptive.s3.amazonaws.com/eco/images/channel_content/images/deadringer_exposing_chinese_threat_actors_targeting_major_telcosWeKr9sD3Rk7HyoGf9SK5BzESj3s0QBqnG5IdKVwk.jpg
Requested by
Host: www.cshub.com
URL: https://www.cshub.com/js/app_web.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.216.84.8 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
s3-1-w.amazonaws.com
Software
AmazonS3 /
Resource Hash
8bef88499589af89088fef87e579ca5052021e6e0782d8a098737b9eaa4b3fce

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.cshub.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

x-amz-server-side-encryption
AES256
Date
Sat, 18 Sep 2021 15:51:14 GMT
Last-Modified
Thu, 19 Aug 2021 13:37:11 GMT
Server
AmazonS3
x-amz-request-id
EAG2D71B1SZ7HXDS
ETag
"74591abb9f15a060c1adfc18b40e7dc5"
x-amz-version-id
xegKH0SRUoLZKHIKoQtvmjGxZFE77INz
Accept-Ranges
bytes
Content-Type
image/jpeg
Content-Length
36833
x-amz-id-2
XoKlwo7XZIdy2H7HydVXOHT7/ZYrLdJYzqpKN4jMnj1tmY17Z0i0izbamqaHiAeU2seymugbTG4=
deadringer_threat_actors_southeast_asian_telcoszc26TE3FrwcrmNBzYJBqpPRNzFjyFIoM7U7LMw1x.jpg
plsadaptive.s3.amazonaws.com/eco/images/channel_content/images/ 		29 KB
29 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://plsadaptive.s3.amazonaws.com/eco/images/channel_content/images/deadringer_threat_actors_southeast_asian_telcoszc26TE3FrwcrmNBzYJBqpPRNzFjyFIoM7U7LMw1x.jpg
Requested by
Host: www.cshub.com
URL: https://www.cshub.com/js/app_web.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.216.84.8 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
s3-1-w.amazonaws.com
Software
AmazonS3 /
Resource Hash
b4d3792011680a1972c82790a41498f22516e8271ea46ce7d671be38634014ad

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.cshub.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

x-amz-server-side-encryption
AES256
Date
Sat, 18 Sep 2021 15:51:14 GMT
Last-Modified
Thu, 19 Aug 2021 13:49:07 GMT
Server
AmazonS3
x-amz-request-id
EAG33X31NNQPYWG6
ETag
"ce22dc29d6763bc845e484a4c35754aa"
x-amz-version-id
GK.8swwq9PvUDADzY1C4f5uELyD1aF.A
Accept-Ranges
bytes
Content-Type
image/jpeg
Content-Length
29346
x-amz-id-2
DrNy5q6rZlNhZ+Mx/jcvQILB6IfOCzKzYO07U9xY3mK3Ssrn2rtYt+8Ke/Nf+60RkmU9ZnBKjwk=
deadringer_exposing_chinese_threat_actors_targeting_major_telcosWeKr9sD3Rk7HyoGf9SK5BzESj3s0QBqnG5IdKVwk_medium.jpg
plsadaptive.s3.amazonaws.com/eco/images/channel_content/images/ 		36 KB
36 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://plsadaptive.s3.amazonaws.com/eco/images/channel_content/images/deadringer_exposing_chinese_threat_actors_targeting_major_telcosWeKr9sD3Rk7HyoGf9SK5BzESj3s0QBqnG5IdKVwk_medium.jpg
Requested by
Host: www.cshub.com
URL: https://www.cshub.com/js/app_web.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.216.84.8 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
s3-1-w.amazonaws.com
Software
AmazonS3 /
Resource Hash
8bef88499589af89088fef87e579ca5052021e6e0782d8a098737b9eaa4b3fce

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.cshub.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

x-amz-server-side-encryption
AES256
Date
Sat, 18 Sep 2021 15:51:15 GMT
Last-Modified
Thu, 19 Aug 2021 13:37:12 GMT
Server
AmazonS3
x-amz-request-id
T89GW43D5PR1T35Q
ETag
"74591abb9f15a060c1adfc18b40e7dc5"
x-amz-version-id
XEMbC5nmZej6.gxOzrR9Hv_UH9gwfzC6
Accept-Ranges
bytes
Content-Type
image/jpeg
Content-Length
36833
x-amz-id-2
Rq9h0sFlHCV5jSf3yavoRzN3QonD2Wk2XkspbNzxsoAgABsDnp3Uz3oiilAZ7Hyszv/uOPtLQ80=

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
s7.addthis.com
URL
https://s7.addthis.com/static/sh.f48a1a04fe8dbf021b4cda1d.html

Verdicts & Comments Add Verdict or Comment

146 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| 1 object| onbeforexrselect boolean| originAgentCluster object| googletag function| gtag string| gaTrackingId object| dataLayer object| _elqQ object| _6si function| playDemo function| atwpjp string| _atd function| _euc function| _duc object| _atc string| _atr object| addthis string| addthis_pub function| emdot object| _ate object| _adr object| addthis_conf function| addthis_open function| addthis_close function| addthis_sendto object| _vwo_code number| settings_timer number| _vwo_settings_timer string| _linkedin_data_partner_id function| feathr function| FeathrBoomerang object| google_conversion_id object| google_custom_params object| google_remarketing_only function| fbq function| _fbq object| _ml object| laravelCookieConsent function| isBlockedDomain function| loadScripts function| getParams function| getGetParameters function| getCookie object| linksArray string| link object| get_params boolean| script_loaded boolean| block_loading boolean| __@@##MUH boolean| _storagePopulated object| true undefined| b number| _vwo_j_e string| _vwo_mt string| _vwo_tm object| vwo_iehack_queue function| lintrk boolean| _already_called_lintrk function| $ function| jQuery object| ggeac object| google_js_reporting_queue object| google_tag_manager object| blocked_sites function| GooglemKTybQhCsO object| google_conversion_date object| google_conversion_time number| google_conversion_snippets number| google_conversion_first_time object| google_conversion_js_version object| google_conversion_format object| google_enable_display_cookie_match object| google_tag_data object| google_conversion_type object| google_conversion_order_id object| google_conversion_language object| google_conversion_value object| google_conversion_currency object| google_conversion_domain object| google_conversion_label object| google_conversion_color object| google_disable_viewthrough object| google_gtag_event_data object| google_conversion_linker object| google_tag_for_child_directed_treatment object| google_tag_for_under_age_of_consent object| google_allow_ad_personalization_signals object| google_restricted_data_processing object| google_conversion_items object| google_conversion_merchant_id object| google_user_id object| onload_callback object| opt_image_generator object| google_gtm_url_processor object| google_conversion_page_url object| google_conversion_referrer_url object| google_gtm object| google_gcl_cookie_prefix object| google_gcl_cookie_path object| google_gcl_cookie_flags object| google_gcl_cookie_domain object| google_gcl_cookie_max_age_seconds object| google_read_gcl_cookie_opt_out object| google_basket_feed_country object| google_basket_feed_language object| google_basket_discount object| google_basket_transaction_type object| google_additional_conversion_params object| google_additional_params object| google_transport_url object| google_gtm_experiments string| GoogleAnalyticsObject function| ga object| core undefined| feathr_account_id object| __feathrs object| picreel function| setImmediate function| clearImmediate function| Vue function| _ object| summerNote function| emitter function| Pusher object| addthis_share object| addthis_config boolean| initialized function| jQueryLazyLoad function| Goog_AdSense_getAdAdapterInstance function| Goog_AdSense_OsdAdapter undefined| google_measure_js_timing object| gaplugins object| gaGlobal object| gaData boolean| ga-disable-UA-3734990-33 object| _elq object| _atw string| addthis_exclude boolean| addthis_use_personalization string| addthis_options_default string| addthis_options_rank string| addthis_options object| __callbacks number| len object| PCD

43 Cookies

Domain/Path Name / Value
.eloqua.com/ Name: ELOQUA
Value: GUID=16B97F1C998648C6A634074D3B5BEE63
.eloqua.com/ Name: ELQSTATUS
Value: OK
www.cshub.com/ Name: XSRF-TOKEN
Value: eyJpdiI6ImUrTGdGM1djY1p2VzVXbEpNOGVZZUE9PSIsInZhbHVlIjoiQW8zSUorN3pxUE1TYk9PVWVYbGdrXC83cCtWek9kczhxNDVVbHlSQVRFbnI0T2NHWHhwa3k4ZWxvRHQwZDQybTNGcTQyd0VvU2wzNEdnc1RqTEp2aktBPT0iLCJtYWMiOiI2ZmRmOGY4NmExNjdmZGZkMjFhN2VmM2I3ZTkwOTdkMjBlZTNhOTg0OTc5ZTA3YTI1NjE3Yjc5OTFlNjYwYzEyIn0%3D
www.cshub.com/ Name: ecochannels_eco_app_session
Value: eyJpdiI6Ild6YVVGdk1ZU1JEV1I2Njc3SThiTXc9PSIsInZhbHVlIjoiNmtFcUxIdWxKYlI2XC9CSkNOVkdwVzRibzBpd2U0Z2MxaituOUxVMzM2Wm1KeUVlNERXamhwajJqSWttN0RrakFIVmZPdWlhdXVzSEllblUxT2FabDN3PT0iLCJtYWMiOiI0MDIyNzE2NGMzNjNjZjgzN2M1Yjc5OTU0YjhmMjE3OGRkNjYxM2RlYWJkMjQwNTExYWRiOGUxNjJjYzY2ZjdkIn0%3D
www.cshub.com/ Name: channel_id
Value: eyJpdiI6IjdqTzJ3QWhvNldZYWlLNFhoQzhRdGc9PSIsInZhbHVlIjoiV3E2QnJPYkxxMnltazB2a0p2NFU3U2lWUWd0aEZBcTJpbUhtVXBnSHd1SFUzNUU1UG0xY2VHSU54QWFNb2FZZCIsIm1hYyI6IjRjYjAzYWQ1YzczZmM1YWY5Nzc5M2Q5ZjcyZDFkYWIyYWViYWE2MzIyZTMyYTE4MjFlYzg2NzcwMjMwMThkOGYifQ%3D%3D
www.cshub.com/ Name: event_id
Value: eyJpdiI6Ilh1MjJNTXU3Rko0ZWwrOFFYbVgxdXc9PSIsInZhbHVlIjoiQ21seXc2RTdpNWZhSE1GVHlqT20zQT09IiwibWFjIjoiZWJkNjA4MTQ0MDAyZDU5ZTI1MDhiZjhhNjI2MWFkYzZiMzY2ZWI0NDg5OTJjNjQ2ZDUzOTYwNDFjMjM1MjJmOSJ9
www.cshub.com/ Name: client_dashboard
Value: eyJpdiI6InN2K29JandXT2oyb25ZeHNjU3FKdnc9PSIsInZhbHVlIjoiSThWSWpHeThLSWtvd0gwUTlRdEUwQT09IiwibWFjIjoiNzIwYjk2ODExYzUyYWU1NDIwN2JlODA0YjQ0MDhkZDVhMDYyZWU1MmIxNGE1YjBiZjIwNzI0OGE1ZjdjOGY5NCJ9
www.cshub.com/ Name: mac
Value: eyJpdiI6IlhMcEhMSFpnYmdcL29uYzdXMFYrUUpBPT0iLCJ2YWx1ZSI6IjZXaVNlZ2hGMXV5S2VGekdBMGdtcm83UDlaQVp0dFFteGVPdXhyT1pDY2M9IiwibWFjIjoiNDgyMjJkOWVhZGUwZjQwY2VlYWZlN2Q4Y2Q4MDVjMDZmZmEyNmMwZjQxY2ExYTExOTRiNTZjNDhlYzUwMGNkMyJ9
www.cshub.com/ Name: elq_camp_id
Value: eyJpdiI6Im1jTlQ1SExQR0NkVUhEQ1o5NjYwdFE9PSIsInZhbHVlIjoiREYwXC9tZmphRHhFSUVMNGhySXdhbWc9PSIsIm1hYyI6IjNlMjVmODUxMzdiMjY1ZDZhMjkyZjU4ZjEyOGJhNjZkMzA4NjhhNDVmNThjMmZkYTlmZDEwMzc5ZjE5ODNjMmUifQ%3D%3D
www.cshub.com/ Name: utm_campaign
Value: eyJpdiI6IlAwd2xXTkFmYXJUWkNOTWdwbGlEclE9PSIsInZhbHVlIjoiaVZROE16SUFRN2NRbUtBMzJDNG53cG1cL2c5ZVZia2M4em9aeXpwOGg1NTFvdzI0d0xBXC91NlZORnB3TDlWK1wvengzWVFpVUVZSjZRZ3NjOTlGXC9GU2pRPT0iLCJtYWMiOiIzYWVmMzNhYzY5NWUwNWE5OWVmNjA3NzA3ZTIxMDM3ODQ0ZmEyZGI4ZjA3OWViODg4NmY1MTRkNTVlMDMwZDczIn0%3D
www.cshub.com/ Name: utm_source
Value: eyJpdiI6ImNoRnVFWkhjVVEyMG0zVnk5czFNWWc9PSIsInZhbHVlIjoiRTM2dDd0aDZieGltNkw2WEhFN2pjRmpKN2poQ2ZuenpsMjZDUVFTblRLcz0iLCJtYWMiOiI4MTg3NTM0MzBiODBjOWVhZDcxZDk1ZGJlNWEyOWIzNjVhNDBjZjkyMzM0NGJhOGZhOTNhMmQ4NDcxMGFkNTRlIn0%3D
www.cshub.com/ Name: utm_medium
Value: eyJpdiI6Ijk4RFFlMjRycFFjdzNDUUI3U2QyNFE9PSIsInZhbHVlIjoiVlBiWXViMHRScnRZVkhwdEJWcCtWZz09IiwibWFjIjoiNGVjZWFmMThhNDY0Y2U5Y2IzYjY5MWE2YzFmYzRjMWIzMjQ2YzVmODk0NTIzY2I4NjUwM2Y4OTdkNGVhZWRkMCJ9
www.cshub.com/ Name: elq_contact_id
Value: eyJpdiI6IlBibklKc01GR0J3Z0xzMWpNMW5JYlE9PSIsInZhbHVlIjoicWp5QkFDd3Y2OVliSE45NmxSQW1jQT09IiwibWFjIjoiNjA3YTYxOTljZjFjMTAwMTA0NDY0ZTM0MTA2MjQ4Y2Y3ZDkzZWYyMDgxNmE1NjRhMDY4MzhjOGNjZmQ0MzVhYSJ9
.6sc.co/ Name: 6suuid
Value: 36bb10021b6b0000f00a4661ae0000001b0a4c00
.cshub.com/ Name: _vwo_uuid_v2
Value: DA5048D0CF8D7DF9D70D80FCDB1F91EE4|d2c8de0a75e67f0dbc664031fffc497c
www.cshub.com/ Name: _an_uid
Value: 0
www.cshub.com/ Name: _gd_visitor
Value: 37bb6723-6ac7-4bcb-8989-8d2202f6965f
www.cshub.com/ Name: _gd_session
Value: 807fa34d-7f91-4bbe-8bf9-be3f9a9f2f59
www.cshub.com/ Name: _gd_svisitor
Value: 36bb10021b6b0000f00a4661ae0000001b0a4c00
.cshub.com/ Name: _fbp
Value: fb.1.1631980272271.1595006987
.facebook.com/ Name: fr
Value: 0eGnDCncS3nVH0Ry1..BhRgrw...1.0.BhRgrw.
.www.cshub.com/ Name: feathr_session_id
Value: 61460af0d056075450fc2dbc
.doubleclick.net/ Name: test_cookie
Value: CheckForPermission
.feathr.co/ Name: f_id
Value: 61460af009a693000711ff6c
www.cshub.com/ Name: __atuvc
Value: 1%7C37
www.cshub.com/ Name: __atuvs
Value: 61460af0c9242b63000
.cshub.com/ Name: _ga
Value: GA1.2.262104851.1631980273
.cshub.com/ Name: _gid
Value: GA1.2.1121210155.1631980273
.cshub.com/ Name: _gat_gtag_UA_3734990_33
Value: 1
.addthis.com/ Name: uvc
Value: 1%7C37
.linkedin.com/ Name: UserMatchHistory
Value: AQL6PyuBkb0enwAAAXv5mrwAvLsp0JBaPYRrKa2EFw_dGJefsgn7szy4fTRorNr3L3kuYIFeLWCU9A
.linkedin.com/ Name: AnalyticsSyncHistory
Value: AQLfrQ3JZ32pcAAAAXv5mrwAj5H-DyNB0JW4grsZFGWgy5S8WdwdW6M-Mi0G3sWe5kt78Pyx9qlNvXQPQfBGTQ
.ads.linkedin.com/ Name: lang
Value: v=2&lang=en-us
.linkedin.com/ Name: bcookie
Value: "v=2&dec87028-58e9-42f5-8530-2b1e32cc833f"
.linkedin.com/ Name: lidc
Value: "b=OGST08:s=O:r=O:a=O:p=O:g=2122:u=1:x=1:i=1631980272:t=1632066672:v=2:sig=AQHkYQz1Th1_9PGj2Dwavux6NIi-lo_S"
.addthis.com/ Name: loc
Value: MDAwMDBFVURFQlkyMjk3MTkwMDAwNTAwMDBDSA==
.linkedin.com/ Name: lang
Value: v=2&lang=de-de
.www.linkedin.com/ Name: bscookie
Value: "v=1&20210918155112e112c3d0-36e5-4515-8d52-81210741c5eaAQE-W9EvrwjqPY2rVxTxSK4XOUTk-lr3"
.adsrvr.org/ Name: TDID
Value: a555adef-feee-45d5-a0a4-b850517d8081
.adsrvr.org/ Name: TDCPM
Value: CAEYBSABKAIyCwj8rqX227H9ORAFOAE.
www.cshub.com/ Name: picreel_tracker__page_views
Value: 1
www.cshub.com/ Name: picreel_tracker__first_visit
Value: Sat%20Sep%2018%202021%2015%3A51%3A13%20GMT%2B0000%20(GMT)
www.cshub.com/ Name: picreel_tracker__visited
Value: 1

1 Console Messages

Source Level URL
Text
javascript warning URL: https://www.googleadservices.com/pagead/conversion.js(Line 21)
Message:
Failed to execute 'write' on 'Document': It isn't possible to write into a document from an asynchronously-loaded external script unless it is explicitly opened.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

api-public.addthis.com
app.connect.awspls.com
app.picreel.com
assets.pcrl.co
b.6sc.co
c.6sc.co
cdn.feathr.co
cdn.jsdelivr.net
code.jquery.com
connect.facebook.net
dev.visualwebsiteoptimizer.com
fonts.googleapis.com
fonts.gstatic.com
googleads.g.doubleclick.net
img04.en25.com
in.ml314.com
j.6sc.co
m.addthis.com
marco.feathr.co
match.adsrvr.org
ml314.com
plsadaptive.s3.amazonaws.com
polo-v1.feathr.co
polo.feathr.co
px.ads.linkedin.com
s7.addthis.com
s893759278.t.eloqua.com
secure.adnxs.com
securepubads.g.doubleclick.net
snap.licdn.com
stats.g.doubleclick.net
system.picreel.com
use.fontawesome.com
v1.addthisedge.com
www.cshub.com
www.facebook.com
www.google-analytics.com
www.google.com
www.google.de
www.googleadservices.com
www.googletagmanager.com
www.linkedin.com
z.moatads.com
s7.addthis.com
104.111.229.66
104.111.233.140
104.84.56.126
107.21.25.45
108.174.11.37
13.107.42.14
13.224.193.9
13.225.78.3
13.225.78.88
142.0.160.53
142.0.160.54
142.250.185.142
142.250.185.228
142.250.185.98
142.250.186.131
142.250.186.170
151.101.65.229
172.217.16.136
172.217.18.98
172.217.18.99
172.67.159.92
172.67.214.69
18.214.148.166
2.18.234.132
2.18.235.40
31.13.92.14
31.13.92.36
34.96.102.137
35.167.195.195
37.252.172.250
50.16.141.78
52.208.138.90
52.216.84.8
69.16.175.10
74.125.133.156
76.223.111.131
05090f9390f5bc0cd23fe5f432037cc92d7cbce1ced9bfe8faf3d1c9abae85cd
08d7f39c648ca44bbf1d781805d3cf57e18ffd1ac4560724809756d26afe8388
0bb1f990715a0826af97022b7844b230df70dc727f8a2ff7b3643d5ea89bb475
0f0141e844398c216a4508d790c0fdea80241db9ccb6ee990428bbf3c789d958
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
19307946d5d21a01e4fe16453f2e51b9d7d6226458d5f7de2af9a8bfb127f05d
1b05ce33469db78a252caf0e176e3cb56cd4d1d17aa3c3cda89f8088bb3eefda
2101735d43a8d486dbc5139500a78420766cc673a3610363ce9525526c3f5149
26638ae0340d7728d6ce89bd9d70d323400d22363d021426c007f3e172a0d566
2fd6fbdf6b72c1d0b3f04985b680c1e1bb31f65abdcefc1f9e7085a4597a3dd4
31b45c462302ac175bfa43f9e5591491db780ca094f6ecdd2907f25ad578448d
3346de8e2ae1bfde250c7ac5c06f79a0a60c7faef8e5e08a2c9e8fbf5ec2c9e8
335b59e615135313a66319e641cdad6ac3489a600e04d4181c859699bed4babe
36e1c00cb349689663b0abb4b6d7dd216e943087d56ffd54ff29093e7315224e
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
48b2377c74c9ea0b87b9c14a63f3a93960ca119a0d31d34628442184dc64e325
55d783462e6671fa985a6b0829db15474f4e57f0555c93e15cc2db6a1d1e6cab
5876d235b697479a9e5f476a33115aea1ddc21fd4b4740dd7180398c6224fdba
5a1ba6ff6db12f791bbbfc4da3cb389e06f0cd53eede09ef3eb3ceb074089ef1
5c329a7f550d3ad4da104c51683286040480bf8e8d1922c7e825df1cd03b8b90
6121ca306ad1045453d52517b8f436eb5a68055c82aefa46a9a77de36996a3df
67f4e139475474e710fc40e5d48fe06acfdcef403415a70ebdd1befde2175d54
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
6da4b97d617f094ca9c057fa82bd86df862538195ff38fdd30ad08d212afc358
7217d688bfdc37c22c8fe106b97e2611cffa00ed46b5f078744de54e1dfc35a2
7345db8b8745d32b70fbbb0867ab8488760e99ce94aa40a78e73ad7fcba15866
793d351cc866196d17887ea6ef5ff0ea5458cb2e88a7e73e92c43ec0dcdb6285
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
85982f240c98e8b2003f9bee604305967d540b614a7a8c08dc4109fa4270f106
8bef88499589af89088fef87e579ca5052021e6e0782d8a098737b9eaa4b3fce
8d7fb472963065af1350318687f6baaa59a7b6848ed3570b00e2cd36b2e8060c
8fe3fa119255adb5e0c12479331f9e092e85bcff56ab6ecc0510bfa2056b898d
9365920887b11b33a3dc4ba28a0f93951f200341263e3b9cefd384798e4be398
98b3d9d20e032f90aca49e9b116225d539ff6fbdb7e42c3c363f63896ac03d2a
9d12f0ac8f9dfc0cd2ff63a7eb7d94b051113009a35f9f4875077108104ceda7
acd2f7ad78edeebad4b6b0fdd17ff57d81c3726c60fd5435ee8c5a0115d29403
adf33148613cb07d00c1da3473cf3d7ce89a94c3e2075a065772bcb852f65b71
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b38170ba210bf9506222ffe28e58159e04ff5037c349b4f2bc7c2026735a1bc1
b4d3792011680a1972c82790a41498f22516e8271ea46ce7d671be38634014ad
c65aa2b99ceeb0595c8d26af4d026a062fbfae7402667ccd7fa626e43c4f5cbc
cb7aa6b06aa5a8eea3670662c4b0c37104041c14575fc170dc48677a0506a33a
cfac6241dd3aabb5f1552c17501790093015c006a8e13671823c1ff4872beaae
d0e4a6372d6fb5ffe9505dbe9e94aee8f1b9b96ec8e5e20684cce8b4c5a88fa7
d4cefc694bc46442d8a5c494d77ef254048839b37e117a54ffe78b46acc2ff08
d96339a6f5ad7f4bbe3401f8c6d934869d64633b3ac3a4c760b947a1c7bcea9d
dc9f5bd96e83b5c93bf4d25b4b37eec59405226267c62f696f93bc8f430485e0
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e6752ac800583b3a55b604d99f1c4b87cca0479e3a4181085574f88af6fe04dd
e8562087317b34c4b2ac60e28e272b7b33e37523aacd5f2adba7a4f108e415c6
eacfa4f711eaca1336ff82619c8a2d310dec11266d594fbc7e5a91259cebf848
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f1ccea6b7204d9f7913ab45e1afa51d79f83bd4f0319de937b0132e6e02b1aab
f348a443d8113a40e7dffeec410f62424d9cb7ac521da1f0773bd15093d5d40b
f47e13da0d20e30ab1f3f07b1fa95435ce272121cbadbcaaf0fbef9a6b06e19e
f7592560bb9832fa430b1987cc46817e72cd346b87e057bbc78652f147a4bc6e
f8323c1a8560f0613e1d5cb4b5f586cbc5bbb33ee0a03786cd488df3dc69a7a8
faa1444cbae74aad09a3bae4849dd1b0fead937d10b8b79321da628b461f59bd
fd222137f245c06ddb4c4d44db41f12138dad6cf8ef5d4d4a5e500f38f0c8c62
fed785a6a8ca96fb67230fec5d85f9c508db49f4075aa0ef284af56cd89813e3