urlscan.io logo urlscan.io
SecurityTrails logo

www.mandiant.com Open in urlscan Pro
2606:4700:300b::a29f:f17d  Public Scan

Go To Rescan Add Verdict Report
URL: https://www.mandiant.com/resources/blog/dprk-whatsapp-phishing'
Submission: On April 03 via api from BG — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 32 IPs in 4 countries across 24 domains to perform 77 HTTP transactions. The main IP is 2606:4700:300b::a29f:f17d, located in United States and belongs to CLOUDFLARENET, US. The main domain is www.mandiant.com. The Cisco Umbrella rank of the primary domain is 523923.
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on March 2nd 2024. Valid for: 10 months.
This is the only time www.mandiant.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
20 2606:4700:300... 13335 (CLOUDFLAR...)
1 104.17.24.14 13335 (CLOUDFLAR...)
1 2a00:1450:400... 15169 (GOOGLE)
2 2a00:1450:400... 15169 (GOOGLE)
1 172.66.41.45 13335 (CLOUDFLAR...)
5 142.250.184.228 15169 (GOOGLE)
3 172.67.39.148 13335 (CLOUDFLAR...)
2 2a00:1450:400... 15169 (GOOGLE)
1 146.75.120.157 54113 (FASTLY)
1 2a02:26f0:280... 20940 (AKAMAI-ASN1)
2 2a03:2880:f08... 32934 (FACEBOOK)
3 2620:1ec:c11:... 8068 (MICROSOFT...)
2 2a00:1450:400... 15169 (GOOGLE)
1 18.66.102.53 16509 (AMAZON-02)
2 23.192.243.198 16625 (AKAMAI-AS)
1 2606:4700::68... 13335 (CLOUDFLAR...)
2 142.250.185.99 15169 (GOOGLE)
1 13.32.27.21 16509 (AMAZON-02)
2 2a00:1450:400... 15169 (GOOGLE)
2 52.44.115.82 14618 (AMAZON-AES)
1 104.244.42.69 13414 (TWITTER)
1 104.244.42.195 13414 (TWITTER)
4 5 2620:1ec:22::14 8068 (MICROSOFT...)
1 13.107.42.14 8068 (MICROSOFT...)
1 2a03:2880:f17... 32934 (FACEBOOK)
1 192.28.144.124 15224 (OMNITURE)
1 2001:4860:480... 15169 (GOOGLE)
1 172.217.16.195 15169 (GOOGLE)
2 2a00:1450:400... 15169 (GOOGLE)
9 2.16.1.168 20940 (AKAMAI-ASN1)
2 172.217.18.14 15169 (GOOGLE)
1 2a02:26f0:280... 20940 (AKAMAI-ASN1)
77 32
20    2606:4700:300b::a29f:f17d (United States)

ASN13335 (CLOUDFLARENET, US)
www.mandiant.com
1    104.17.24.14 (None, )

ASN13335 (CLOUDFLARENET, US)
cdnjs.cloudflare.com
1    2a00:1450:4001:810::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
fonts.googleapis.com
2    2a00:1450:4001:80f::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.gstatic.com
1    172.66.41.45 (United States)

ASN13335 (CLOUDFLARENET, US)
cdn4.iconfinder.com
5    142.250.184.228 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s12-in-f4.1e100.net
www.google.com
3    172.67.39.148 (United States)

ASN13335 (CLOUDFLARENET, US)
static.addtoany.com
2    2a00:1450:4001:811::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.googletagmanager.com
1    146.75.120.157 (Frankfurt am Main, Germany)

ASN54113 (FASTLY, US)
static.ads-twitter.com
1    2a02:26f0:280:6::213:7ad8 (Düsseldorf, Germany)

ASN20940 (AKAMAI-ASN1, NL)
snap.licdn.com
2    2a03:2880:f084:105:face:b00c:0:3 (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)
connect.facebook.net
3    2620:1ec:c11::200 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
bat.bing.com
2    2a00:1450:4001:81c::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.google-analytics.com
1    18.66.102.53 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-66-102-53.fra56.r.cloudfront.net
static.hotjar.com
2    23.192.243.198 (Düsseldorf, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a23-192-243-198.deploy.static.akamaitechnologies.com
munchkin.marketo.net
1    2606:4700::6810:4869 (United States)

ASN13335 (CLOUDFLARENET, US)
scout-cdn.salesloft.com
2    142.250.185.99 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s49-in-f3.1e100.net
www.gstatic.com
1    13.32.27.21 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-32-27-21.fra56.r.cloudfront.net
script.hotjar.com
2    2a00:1450:400c:c00::9d (Brussels, Belgium)

ASN15169 (GOOGLE, US)
stats.g.doubleclick.net
2    52.44.115.82 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-44-115-82.compute-1.amazonaws.com
scout.salesloft.com
1    104.244.42.69 (United States)

ASN13414 (TWITTER, US)
t.co
1    104.244.42.195 (United States)

ASN13414 (TWITTER, US)
analytics.twitter.com
5    2620:1ec:22::14 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
px.ads.linkedin.com
www.linkedin.com
1    13.107.42.14 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
px4.ads.linkedin.com
1    2a03:2880:f177:185:face:b00c:0:25de (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)
www.facebook.com
1    192.28.144.124 (United States)

ASN15224 (OMNITURE, US)
565-pei-952.mktoresp.com
1    2001:4860:4802:34::36 (United States)

ASN15169 (GOOGLE, US)
region1.analytics.google.com
1    172.217.16.195 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s65-in-f3.1e100.net
www.google.de
2    2a00:1450:4001:82a::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
fonts.gstatic.com
9    2.16.1.168 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)
PTR: a2-16-1-168.deploy.static.akamaitechnologies.com
j.6sc.co
c.6sc.co
b.6sc.co
2    172.217.18.14 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s22-in-f14.1e100.net
www.google-analytics.com
1    2a02:26f0:280:4::213:784c (Düsseldorf, Germany)

ASN20940 (AKAMAI-ASN1, NL)
ipv6.6sc.co
Apex Domain
Subdomains		 Transfer
20 mandiant.com
www.mandiant.com — Cisco Umbrella Rank: 523923
911 KB
10 6sc.co
j.6sc.co — Cisco Umbrella Rank: 5872
c.6sc.co — Cisco Umbrella Rank: 9222
ipv6.6sc.co — Cisco Umbrella Rank: 5999
b.6sc.co — Cisco Umbrella Rank: 3952
21 KB
6 linkedin.com
px.ads.linkedin.com — Cisco Umbrella Rank: 320
www.linkedin.com — Cisco Umbrella Rank: 581
px4.ads.linkedin.com — Cisco Umbrella Rank: 6476
3 KB
6 google.com
www.google.com — Cisco Umbrella Rank: 2
region1.analytics.google.com — Cisco Umbrella Rank: 3274
1 KB
6 gstatic.com
www.gstatic.com
fonts.gstatic.com
246 KB
4 google-analytics.com
www.google-analytics.com — Cisco Umbrella Rank: 35
21 KB
3 salesloft.com
scout-cdn.salesloft.com — Cisco Umbrella Rank: 10796
scout.salesloft.com — Cisco Umbrella Rank: 13652
4 KB
3 bing.com
bat.bing.com — Cisco Umbrella Rank: 329
14 KB
3 addtoany.com
static.addtoany.com — Cisco Umbrella Rank: 3965
28 KB
2 doubleclick.net
stats.g.doubleclick.net — Cisco Umbrella Rank: 96
403 B
2 marketo.net
munchkin.marketo.net — Cisco Umbrella Rank: 3780
6 KB
2 hotjar.com
static.hotjar.com — Cisco Umbrella Rank: 780
script.hotjar.com — Cisco Umbrella Rank: 1035
59 KB
2 facebook.net
connect.facebook.net — Cisco Umbrella Rank: 176
70 KB
2 googletagmanager.com
www.googletagmanager.com — Cisco Umbrella Rank: 43
216 KB
1 google.de
www.google.de — Cisco Umbrella Rank: 7528
63 B
1 mktoresp.com
565-pei-952.mktoresp.com
318 B
1 facebook.com
www.facebook.com — Cisco Umbrella Rank: 99
274 B
1 twitter.com
analytics.twitter.com — Cisco Umbrella Rank: 816
395 B
1 t.co
t.co — Cisco Umbrella Rank: 663
376 B
1 licdn.com
snap.licdn.com — Cisco Umbrella Rank: 811
17 KB
1 ads-twitter.com
static.ads-twitter.com — Cisco Umbrella Rank: 787
15 KB
1 iconfinder.com
cdn4.iconfinder.com — Cisco Umbrella Rank: 111692
5 KB
1 googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 38
2 KB
1 cloudflare.com
cdnjs.cloudflare.com — Cisco Umbrella Rank: 237
5 KB
77 24
Domain Requested by
20 www.mandiant.com www.mandiant.com
7 b.6sc.co
5 www.google.com www.mandiant.com
www.gstatic.com
4 px.ads.linkedin.com 3 redirects snap.licdn.com
4 www.google-analytics.com www.googletagmanager.com
www.google-analytics.com
4 www.gstatic.com www.mandiant.com
www.google.com
www.gstatic.com
3 bat.bing.com www.googletagmanager.com
bat.bing.com
www.mandiant.com
3 static.addtoany.com www.mandiant.com
static.addtoany.com
2 fonts.gstatic.com fonts.googleapis.com
2 scout.salesloft.com scout-cdn.salesloft.com
2 stats.g.doubleclick.net www.google-analytics.com
www.googletagmanager.com
2 munchkin.marketo.net www.mandiant.com
munchkin.marketo.net
2 connect.facebook.net www.googletagmanager.com
connect.facebook.net
2 www.googletagmanager.com www.mandiant.com
www.googletagmanager.com
1 ipv6.6sc.co j.6sc.co
1 c.6sc.co j.6sc.co
1 j.6sc.co www.mandiant.com
1 www.google.de www.mandiant.com
1 region1.analytics.google.com www.googletagmanager.com
1 565-pei-952.mktoresp.com munchkin.marketo.net
1 www.facebook.com www.mandiant.com
1 px4.ads.linkedin.com www.mandiant.com
1 www.linkedin.com 1 redirects
1 analytics.twitter.com www.mandiant.com
1 t.co www.mandiant.com
1 script.hotjar.com static.hotjar.com
1 scout-cdn.salesloft.com www.mandiant.com
1 static.hotjar.com www.googletagmanager.com
1 snap.licdn.com www.googletagmanager.com
1 static.ads-twitter.com www.googletagmanager.com
1 cdn4.iconfinder.com www.mandiant.com
1 fonts.googleapis.com www.mandiant.com
1 cdnjs.cloudflare.com www.mandiant.com
77 33
Subject Issuer Validity Valid
mandiant.com
Cloudflare Inc ECC CA-3		 2024-03-02 -
2024-12-31		 10 months crt.sh
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3		 2023-07-03 -
2024-07-02		 a year crt.sh
upload.video.google.com
GTS CA 1C3		 2024-03-04 -
2024-05-27		 3 months crt.sh
*.gstatic.com
GTS CA 1C3		 2024-03-04 -
2024-05-27		 3 months crt.sh
iconfinder.com
E1		 2024-03-30 -
2024-06-28		 3 months crt.sh
*.google.com
GTS CA 1C3		 2024-03-04 -
2024-05-27		 3 months crt.sh
static.addtoany.com
E1		 2024-02-24 -
2024-05-24		 3 months crt.sh
*.google-analytics.com
GTS CA 1C3		 2024-03-04 -
2024-05-27		 3 months crt.sh
ads-twitter.com
DigiCert Global G2 TLS RSA SHA256 2020 CA1		 2023-07-21 -
2024-07-19		 a year crt.sh
snap.licdn.com
DigiCert SHA2 Secure Server CA		 2023-12-13 -
2024-12-12		 a year crt.sh
*.facebook.com
DigiCert SHA2 High Assurance Server CA		 2024-01-11 -
2024-04-10		 3 months crt.sh
www.bing.com
Microsoft Azure TLS Issuing CA 06		 2024-04-02 -
2024-06-27		 3 months crt.sh
*.hotjar.com
Amazon ECDSA 256 M03		 2024-02-07 -
2025-03-08		 a year crt.sh
*.marketo.net
DigiCert TLS RSA SHA256 2020 CA1		 2023-12-08 -
2024-12-11		 a year crt.sh
salesloft.com
Sectigo RSA Domain Validation Secure Server CA		 2024-03-20 -
2025-04-19		 a year crt.sh
*.g.doubleclick.net
GTS CA 1C3		 2024-03-04 -
2024-05-27		 3 months crt.sh
t.co
DigiCert Global G2 TLS RSA SHA256 2020 CA1		 2024-01-07 -
2025-01-06		 a year crt.sh
*.twitter.com
DigiCert Global G2 TLS RSA SHA256 2020 CA1		 2023-10-31 -
2024-10-29		 a year crt.sh
*.mktoresp.com
DigiCert Global G2 TLS RSA SHA256 2020 CA1		 2023-09-07 -
2024-10-07		 a year crt.sh
*.google.de
GTS CA 1C3		 2024-03-04 -
2024-05-27		 3 months crt.sh
www.linkedin.com
DigiCert SHA2 Secure Server CA		 2024-01-30 -
2024-07-30		 6 months crt.sh
6sc.co
R3		 2024-01-29 -
2024-04-28		 3 months crt.sh

This page contains 6 frames:

Primary Page: https://www.mandiant.com/resources/blog/dprk-whatsapp-phishing'
Frame ID: F6F0DC75D1BB9C250F55454613E2848B
Requests: 72 HTTP requests in this frame

Frame: https://static.addtoany.com/menu/sm.25.html
Frame ID: B768B3C2945D34FEBB200413FC564568
Requests: 1 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LdhgBgUAAAAAILakhHCM8iL5pygGB4jLnJbJFfq&co=aHR0cHM6Ly93d3cubWFuZGlhbnQuY29tOjQ0Mw..&hl=de&v=moV1mTgQ6S91nuTnmll4Y9yf&size=normal&cb=6b100u4ga2o6
Frame ID: 434A59F219E6084AE49BFA7EFCE7D3DD
Requests: 1 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LdhgBgUAAAAAILakhHCM8iL5pygGB4jLnJbJFfq&co=aHR0cHM6Ly93d3cubWFuZGlhbnQuY29tOjQ0Mw..&hl=de&v=moV1mTgQ6S91nuTnmll4Y9yf&size=compact&cb=hxwfuw1yc97c
Frame ID: B4CEFE0FD8F2C3D04428EBBD555AE0A9
Requests: 1 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/bframe?hl=de&v=moV1mTgQ6S91nuTnmll4Y9yf&k=6LdhgBgUAAAAAILakhHCM8iL5pygGB4jLnJbJFfq
Frame ID: 006649C748AE78B8C2E1C152AF6B3FEE
Requests: 1 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/bframe?hl=de&v=moV1mTgQ6S91nuTnmll4Y9yf&k=6LdhgBgUAAAAAILakhHCM8iL5pygGB4jLnJbJFfq
Frame ID: 3B287F0394300ECBD2A5A8A898930A7C
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

404 page | Mandiant

Detected technologies

Overall confidence: 100%
Detected patterns
  • addtoany\.com/menu/page\.js
Overall confidence: 100%
Detected patterns
  • //connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js
Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]+(?:([\d.]+)/)?(?:css/)?font-awesome(?:\.min)?\.css
  • <link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
  • (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
Overall confidence: 100%
Detected patterns
  • google-analytics\.com/(?:ga|urchin|analytics)\.js
Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com
Overall confidence: 100%
Detected patterns
  • googletagmanager\.com/ns\.html[^>]+></iframe>
  • googletagmanager\.com/gtm\.js
  • googletagmanager\.com/gtag/js
Overall confidence: 100%
Detected patterns
  • //static\.hotjar\.com/
Overall confidence: 100%
Detected patterns
  • snap\.licdn\.com/li\.lms-analytics/insight\.min\.js
Overall confidence: 100%
Detected patterns
  • munchkin\.marketo\.\w+/(?:([\d.]+)/)?munchkin\.js
Overall confidence: 100%
Detected patterns
  • <div[^>]+class="g-recaptcha"
  • /recaptcha/api\.js

Page Statistics

77
Requests

99 %
HTTPS

47 %
IPv6

24
Domains

33
Subdomains

32
IPs

4
Countries

1644 kB
Transfer

4215 kB
Size

28
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 44
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=3460746&time=1712151752052&li_adsId=565c9d7d-92df-4250-beef-07665aa36492&url=https%3A%2F%2Fwww.mandiant.com%2Fresources%2Fblog%2Fdprk-whatsapp-phishing%27 HTTP 302
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=3460746&time=1712151752052&li_adsId=565c9d7d-92df-4250-beef-07665aa36492&url=https%3A%2F%2Fwww.mandiant.com%2Fresources%2Fblog%2Fdprk-whatsapp-phishing%27&cookiesTest=true HTTP 302
  • https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D3460746%26time%3D1712151752052%26li_adsId%3D565c9d7d-92df-4250-beef-07665aa36492%26url%3Dhttps%253A%252F%252Fwww.mandiant.com%252Fresources%252Fblog%252Fdprk-whatsapp-phishing%2527%26cookiesTest%3Dtrue%26liSync%3Dtrue HTTP 302
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=3460746&time=1712151752052&li_adsId=565c9d7d-92df-4250-beef-07665aa36492&url=https%3A%2F%2Fwww.mandiant.com%2Fresources%2Fblog%2Fdprk-whatsapp-phishing%27&cookiesTest=true&liSync=true HTTP 302
  • https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=3460746&time=1712151752052&li_adsId=565c9d7d-92df-4250-beef-07665aa36492&url=https%3A%2F%2Fwww.mandiant.com%2Fresources%2Fblog%2Fdprk-whatsapp-phishing%27&cookiesTest=true&liSync=true&e_ipv6=AQI4iggKd-xocwAAAY6kMnCKzEEXt-5EhXo0KEZAzRPgcDWi2iEqJ0eCUd5LmoMTL91J1f7AXjIU

77 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request dprk-whatsapp-phishing'
www.mandiant.com/resources/blog/ 		77 KB
17 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://www.mandiant.com/resources/blog/dprk-whatsapp-phishing'
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:300b::a29f:f17d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
eff90f9963c3d3750fb8160f6bb1d751843ce289283efd295b2ebd1583dccb91
Security Headers
Name Value
Content-Security-Policy report-uri /report-csp-violation
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
accept-language
de-DE,de;q=0.9
sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-mobile
?0
sec-ch-ua-platform
"Win32"

Response headers

cache-control
public, max-age=86400
cf-cache-status
EXPIRED
cf-ray
86e97b76d9493738-FRA
content-encoding
gzip
content-language
en
content-security-policy
report-uri /report-csp-violation
content-type
text/html; charset=UTF-8
date
Wed, 03 Apr 2024 13:42:30 GMT
expect-ct
max-age=86400
expires
Thu, 04 Apr 2024 13:42:30 GMT
last-modified
Wed, 03 Apr 2024 13:37:10 GMT
referrer-policy
strict-origin
server
cloudflare
strict-transport-security
max-age=31536000; includeSubDomains; preload
vary
Cookie, Accept-Encoding
via
varnish
x-ah-environment
prod
x-cache
HIT
x-cache-hits
2
x-content-type-options
nosniff
x-frame-options
SAMEORIGIN
x-request-id
v-4587f000-f1bf-11ee-907c-af007da817a0
x-xss-protection
1; mode=block
css_eGShP42FMNf5hkLhBKw-fR8oyvnV5REbZNLiAzW2C8c.css
www.mandiant.com/sites/default/files/css/ 		23 KB
5 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.mandiant.com/sites/default/files/css/css_eGShP42FMNf5hkLhBKw-fR8oyvnV5REbZNLiAzW2C8c.css?delta=0&language=en&theme=mandiant_theme&include=eJxtUNFuwzAI_CG3fJJFMEm92CYC0sh_P69du0rZCzoOuDsxi1bPm8H8CwKm5IKtwwtcZ5XmgXZzqbFyygifTSSzYN2cK0xoHCq2QTePfuPKsLQhfTHvhe3_2deJv7N6JiwXx8kCrcPHRSMSiaYsDd7omY5b-pNQJtycbghvFPPYWRR9XHx4HYyrQUVd2SX-vOA03FQWZbM4oYaCXXaPKRvJiNhBGpOUFz_tuSRW8EMGG43p4XfPfBg86rVK2gufXJZ8jnVk5Vmx8je6jqaq
Requested by
Host: www.mandiant.com
URL: https://www.mandiant.com/resources/blog/dprk-whatsapp-phishing'
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:300b::a29f:f17d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
6cdc249fe2d6f4d8e895f3033d11e4b917dcfa03ef5447665ba53b92192a59f4
Security Headers
Name Value
Content-Security-Policy report-uri /report-csp-violation
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
https://www.mandiant.com/
accept-language
de-DE,de;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Wed, 03 Apr 2024 13:42:31 GMT
content-encoding
gzip
via
varnish
cf-cache-status
EXPIRED
x-content-type-options
nosniff
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-security-policy
report-uri /report-csp-violation
x-cache
MISS
x-ah-environment
prod
content-length
5278
x-xss-protection
1; mode=block
x-request-id
v-04da833c-f1c0-11ee-b338-371848e35c13
referrer-policy
strict-origin
last-modified
Wed, 03 Apr 2024 13:37:12 GMT
server
cloudflare
expect-ct
max-age=86400
vary
Accept-Encoding
x-frame-options
SAMEORIGIN
content-type
text/css; charset=UTF-8
content-language
en
cache-control
public, max-age=300
accept-ranges
bytes
cf-ray
86e97b7afd2d3738-FRA
expires
Wed, 03 Apr 2024 13:47:31 GMT
css_Yw6OVXvPezay5yis2fK3Ww_gPGJFkqY8-dShIrZV6nI.css
www.mandiant.com/sites/default/files/css/ 		707 KB
83 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.mandiant.com/sites/default/files/css/css_Yw6OVXvPezay5yis2fK3Ww_gPGJFkqY8-dShIrZV6nI.css?delta=1&language=en&theme=mandiant_theme&include=eJxtUNFuwzAI_CG3fJJFMEm92CYC0sh_P69du0rZCzoOuDsxi1bPm8H8CwKm5IKtwwtcZ5XmgXZzqbFyygifTSSzYN2cK0xoHCq2QTePfuPKsLQhfTHvhe3_2deJv7N6JiwXx8kCrcPHRSMSiaYsDd7omY5b-pNQJtycbghvFPPYWRR9XHx4HYyrQUVd2SX-vOA03FQWZbM4oYaCXXaPKRvJiNhBGpOUFz_tuSRW8EMGG43p4XfPfBg86rVK2gufXJZ8jnVk5Vmx8je6jqaq
Requested by
Host: www.mandiant.com
URL: https://www.mandiant.com/resources/blog/dprk-whatsapp-phishing'
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:300b::a29f:f17d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
8a7b82ca2e7779906e5ed103e6aea92ad41856bf2265ac009947b59b0d752f06
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
https://www.mandiant.com/
accept-language
de-DE,de;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

x-cache-hits
16
date
Wed, 03 Apr 2024 13:42:31 GMT
content-encoding
gzip
via
varnish
cf-cache-status
REVALIDATED
x-content-type-options
nosniff
x-cache
HIT
x-ah-environment
prod
content-length
84381
x-request-id
v-92d5d740-e8fb-11ee-95ec-bb1aecd7e3de
last-modified
Sun, 17 Mar 2024 20:43:25 GMT
server
cloudflare
vary
Accept-Encoding
content-type
text/css
cache-control
public, max-age=1209600
accept-ranges
bytes
cf-ray
86e97b7afd333738-FRA
expires
Wed, 17 Apr 2024 13:42:31 GMT
font-awesome.min.css
cdnjs.cloudflare.com/ajax/libs/font-awesome/4.3.0/css/ 		23 KB
5 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://cdnjs.cloudflare.com/ajax/libs/font-awesome/4.3.0/css/font-awesome.min.css
Requested by
Host: www.mandiant.com
URL: https://www.mandiant.com/resources/blog/dprk-whatsapp-phishing'
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.17.24.14 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
541ac58217a8ade1a5e292a65a0661dc9db7a49ae13654943817a4fbc6761afd
Security Headers
Name Value
Strict-Transport-Security max-age=15780000
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
https://www.mandiant.com/
accept-language
de-DE,de;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Wed, 03 Apr 2024 13:42:30 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security
max-age=15780000
age
1104153
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
content-length
4364
last-modified
Sat, 06 Jan 2024 12:19:44 GMT
server
cloudflare
cf-cdnjs-via
cfworker/kv
etag
"65993750-110c"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Fv7grY1kpnCYRlJJFhL9yiHi7vKT1fu%2Bub%2Fe9%2B0Nn3Qsl86VfCo8j21edTxoEgojx4yXx8S%2FFj%2BWjjNL7WL3BLThGCaGOq0kOe24eDf2Kh5PDLj5rd7%2BSdZmghncVT%2BljDEmtMdp"}],"group":"cf-nel","max_age":604800}
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=30672000
accept-ranges
bytes
timing-allow-origin
*
cf-ray
86e97b7b2d36699b-FRA
expires
Mon, 24 Mar 2025 13:42:30 GMT
css2
fonts.googleapis.com/ 		10 KB
2 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://fonts.googleapis.com/css2?family=Google+Sans+Text:wght@400&family=Google+Sans:wght@500&display=swap
Requested by
Host: www.mandiant.com
URL: https://www.mandiant.com/resources/blog/dprk-whatsapp-phishing'
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:810::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
a9b7a66985bebc105b4b12f2f466fae88b9b16fe17ea5bc1d515753258a0be19
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
https://www.mandiant.com/
accept-language
de-DE,de;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

strict-transport-security
max-age=31536000
date
Wed, 03 Apr 2024 13:42:30 GMT
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection
0
last-modified
Wed, 03 Apr 2024 13:42:30 GMT
server
ESF
cross-origin-opener-policy
same-origin-allow-popups
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Wed, 03 Apr 2024 13:42:30 GMT
cookienotificationbar.min.css
www.gstatic.com/glue/cookienotificationbar/ 		9 KB
2 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.gstatic.com/glue/cookienotificationbar/cookienotificationbar.min.css
Requested by
Host: www.mandiant.com
URL: https://www.mandiant.com/resources/blog/dprk-whatsapp-phishing'
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
591ec898579fc34d46d85f9b22fa8fcfa88465454caa0d86d03e9e6dc0675f9b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
https://www.mandiant.com/
accept-language
de-DE,de;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Wed, 03 Apr 2024 13:42:30 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/uxe-owners-acl/gstatic
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
1670
x-xss-protection
0
last-modified
Tue, 02 Apr 2024 16:16:07 GMT
server
sffe
vary
Accept-Encoding
report-to
{"group":"uxe-owners-acl/gstatic","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/uxe-owners-acl/gstatic"}]}
content-type
text/css
access-control-allow-origin
*
cache-control
private, max-age=3000
accept-ranges
bytes
cross-origin-opener-policy-report-only
same-origin; report-to="uxe-owners-acl/gstatic"
expires
Wed, 03 Apr 2024 13:42:30 GMT
icon-close-512.png
cdn4.iconfinder.com/data/icons/ionicons/512/ 		4 KB
5 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cdn4.iconfinder.com/data/icons/ionicons/512/icon-close-512.png
Requested by
Host: www.mandiant.com
URL: https://www.mandiant.com/resources/blog/dprk-whatsapp-phishing'
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.66.41.45 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
7762b4265e6050c33745fd1fae5110f9f265564f0a85d9ac01efaa65029db59c
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
https://www.mandiant.com/
accept-language
de-DE,de;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Wed, 03 Apr 2024 13:42:31 GMT
via
1.1 vegur
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"report_to":"heroku-nel","max_age":3600,"success_fraction":0.005,"failure_fraction":0.05,"response_headers":["Via"]}
strict-transport-security
max-age=15552000; includeSubDomains; preload
age
756613
cf-polished
origFmt=png, origSize=8351
content-disposition
inline; filename="icon-close-512.webp"
alt-svc
h3=":443"; ma=86400
content-length
3858
x-request-id
c127fd81-f9b6-40af-9552-e223a249e4ee
reporting-endpoints
heroku-nel=https://nel.heroku.com/reports?ts=1709463889&sid=c46efe9b-d3d2-4a0c-8c76-bfafa16c5add&s=hpRA6QxZ6EMJ549Kj72oh2hYsIKdr5HHvPYRdfBwM0s%3D
cf-bgj
imgq:100,h2pri
last-modified
Sat, 23 Mar 2024 09:59:24 GMT
server
cloudflare
vary
Accept
report-to
{"group":"heroku-nel","max_age":3600,"endpoints":[{"url":"https://nel.heroku.com/reports?ts=1709463889&sid=c46efe9b-d3d2-4a0c-8c76-bfafa16c5add&s=hpRA6QxZ6EMJ549Kj72oh2hYsIKdr5HHvPYRdfBwM0s%3D"}]}
content-type
image/webp
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
cf-ray
86e97b7fab146aec-FRA
expires
Thu, 03 Apr 2025 13:42:31 GMT
hero-short-bg.jpg
www.mandiant.com/sites/default/files/2021-08/ 		56 KB
56 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.mandiant.com/sites/default/files/2021-08/hero-short-bg.jpg
Requested by
Host: www.mandiant.com
URL: https://www.mandiant.com/resources/blog/dprk-whatsapp-phishing'
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:300b::a29f:f17d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e1cd8e9c3c0e2ec3111f46d6ba125fe1726b7933055503563d7d88ec48089ea8
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
https://www.mandiant.com/
accept-language
de-DE,de;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

x-cache-hits
11912
date
Wed, 03 Apr 2024 13:42:30 GMT
via
varnish
x-content-type-options
nosniff
cf-cache-status
HIT
age
50
x-cache
HIT
x-ah-environment
prod
content-length
57567
x-request-id
v-08f73596-d2f8-11ee-99d9-3beee52e0fc8
last-modified
Mon, 16 Aug 2021 23:56:30 GMT
cf-bgj
h2pri
server
cloudflare
vary
Accept-Encoding
content-type
image/jpeg
cache-control
public, max-age=1209600
accept-ranges
bytes
cf-ray
86e97b7afd363738-FRA
expires
Wed, 17 Apr 2024 13:42:30 GMT
js_WNFXtt-P3rJDIE_50T2GRhGmsUE5jFLHjoH4Z_qCRh4.js
www.mandiant.com/sites/default/files/js/ 		95 KB
33 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.mandiant.com/sites/default/files/js/js_WNFXtt-P3rJDIE_50T2GRhGmsUE5jFLHjoH4Z_qCRh4.js?scope=footer&delta=0&language=en&theme=mandiant_theme&include=eJxtUNFuwzAI_CG3fJJFMEm92CYC0sh_P69du0rZCzoOuDsxi1bPm8H8CwKm5IKtwwtcZ5XmgXZzqbFyygifTSSzYN2cK0xoHCq2QTePfuPKsLQhfTHvhe3_2deJv7N6JiwXx8kCrcPHRSMSiaYsDd7omY5b-pNQJtycbghvFPPYWRR9XHx4HYyrQUVd2SX-vOA03FQWZbM4oYaCXXaPKRvJiNhBGpOUFz_tuSRW8EMGG43p4XfPfBg86rVK2gufXJZ8jnVk5Vmx8je6jqaq
Requested by
Host: www.mandiant.com
URL: https://www.mandiant.com/resources/blog/dprk-whatsapp-phishing'
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:300b::a29f:f17d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
f3212d7385c327317abf55280e4e949368eeda26977bbed7761a5a22fc2e2202
Security Headers
Name Value
Content-Security-Policy report-uri /report-csp-violation
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
https://www.mandiant.com/
accept-language
de-DE,de;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Wed, 03 Apr 2024 13:42:31 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
via
varnish
cf-cache-status
EXPIRED
content-encoding
gzip
x-content-type-options
nosniff
content-security-policy
report-uri /report-csp-violation
x-cache
MISS
x-ah-environment
prod
x-xss-protection
1; mode=block
x-request-id
v-04d92e92-f1c0-11ee-91d8-673955a5d5cc
referrer-policy
strict-origin
last-modified
Wed, 03 Apr 2024 13:37:12 GMT
server
cloudflare
expect-ct
max-age=86400
vary
Accept-Encoding
x-frame-options
SAMEORIGIN
content-language
en
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=300
cf-ray
86e97b7afd3a3738-FRA
expires
Wed, 03 Apr 2024 13:47:31 GMT
api.js
www.google.com/recaptcha/ 		1 KB
880 B 		Script
General
Check archive.org
Download Go to
Full URL
https://www.google.com/recaptcha/api.js?onload=CaptchaCallback&render=explicit
Requested by
Host: www.mandiant.com
URL: https://www.mandiant.com/resources/blog/dprk-whatsapp-phishing'
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.184.228 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s12-in-f4.1e100.net
Software
GSE /
Resource Hash
d1f342663d93d5a097621c882599f5d389e4a54d813696b147a61af2fdae182b
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self'
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
https://www.mandiant.com/
accept-language
de-DE,de;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Wed, 03 Apr 2024 13:42:31 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-security-policy
frame-ancestors 'self'
server
GSE
x-frame-options
SAMEORIGIN
content-type
text/javascript; charset=utf-8
cache-control
private, max-age=300
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection
1; mode=block
expires
Wed, 03 Apr 2024 13:42:31 GMT
js_qR8g0supp19B_VPg5JpfovBZSl9y0mAWlZC4abqjhpo.js
www.mandiant.com/sites/default/files/js/ 		3 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.mandiant.com/sites/default/files/js/js_qR8g0supp19B_VPg5JpfovBZSl9y0mAWlZC4abqjhpo.js?scope=footer&delta=2&language=en&theme=mandiant_theme&include=eJxtUNFuwzAI_CG3fJJFMEm92CYC0sh_P69du0rZCzoOuDsxi1bPm8H8CwKm5IKtwwtcZ5XmgXZzqbFyygifTSSzYN2cK0xoHCq2QTePfuPKsLQhfTHvhe3_2deJv7N6JiwXx8kCrcPHRSMSiaYsDd7omY5b-pNQJtycbghvFPPYWRR9XHx4HYyrQUVd2SX-vOA03FQWZbM4oYaCXXaPKRvJiNhBGpOUFz_tuSRW8EMGG43p4XfPfBg86rVK2gufXJZ8jnVk5Vmx8je6jqaq
Requested by
Host: www.mandiant.com
URL: https://www.mandiant.com/resources/blog/dprk-whatsapp-phishing'
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:300b::a29f:f17d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
d8885f82460cd5977ef2f391c02cad23cd0262b3d9ec42c4aa92a1ecad0bf461
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
https://www.mandiant.com/
accept-language
de-DE,de;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

x-cache-hits
7646
date
Wed, 03 Apr 2024 13:42:31 GMT
content-encoding
gzip
via
varnish
cf-cache-status
REVALIDATED
x-content-type-options
nosniff
x-cache
HIT
x-ah-environment
prod
content-length
1063
x-request-id
v-2534742c-ea67-11ee-9269-a7826a55a3d7
last-modified
Fri, 15 Mar 2024 05:57:50 GMT
server
cloudflare
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=1209600
accept-ranges
bytes
cf-ray
86e97b7b6da43738-FRA
expires
Wed, 17 Apr 2024 13:42:31 GMT
page.js
static.addtoany.com/menu/ 		3 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://static.addtoany.com/menu/page.js
Requested by
Host: www.mandiant.com
URL: https://www.mandiant.com/resources/blog/dprk-whatsapp-phishing'
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.39.148 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
8a3d8c061a2a585985a71d5b1a45c424c5bc79b310c86b4731b5bececf5ea5df
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
https://www.mandiant.com/
accept-language
de-DE,de;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Wed, 03 Apr 2024 13:42:31 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
22686
content-encoding
br
alt-svc
h3=":443"; ma=86400
referrer-policy
strict-origin-when-cross-origin
cf-bgj
minify
server
cloudflare
etag
W/"257f9651f9cfd949f6dde30f51352116"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=TlqvEtGrpe33E%2FkJgSpRZr2IQ1UsCyRyIlXzeaXxPrmmk0yURGeSdLlhxm0ue8029fuVRa6tvOSEwcRw9%2F4qFCtiAJ9kS6FNRZoU46zugeocsFBJ3IJaeik7VFEj%2BcXyYs891q3hl3OyzCe03dI106ia"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=86400, stale-while-revalidate=30, public
cf-ray
86e97b7f8e683816-FRA
js_I9wQ_8iDNCyIShn6p_-v3LsAPo4eGoxJCTGyM0JdrMc.js
www.mandiant.com/sites/default/files/js/ 		416 KB
125 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.mandiant.com/sites/default/files/js/js_I9wQ_8iDNCyIShn6p_-v3LsAPo4eGoxJCTGyM0JdrMc.js?scope=footer&delta=4&language=en&theme=mandiant_theme&include=eJxtUNFuwzAI_CG3fJJFMEm92CYC0sh_P69du0rZCzoOuDsxi1bPm8H8CwKm5IKtwwtcZ5XmgXZzqbFyygifTSSzYN2cK0xoHCq2QTePfuPKsLQhfTHvhe3_2deJv7N6JiwXx8kCrcPHRSMSiaYsDd7omY5b-pNQJtycbghvFPPYWRR9XHx4HYyrQUVd2SX-vOA03FQWZbM4oYaCXXaPKRvJiNhBGpOUFz_tuSRW8EMGG43p4XfPfBg86rVK2gufXJZ8jnVk5Vmx8je6jqaq
Requested by
Host: www.mandiant.com
URL: https://www.mandiant.com/resources/blog/dprk-whatsapp-phishing'
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:300b::a29f:f17d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
4fa7ca84dc3a040c7199206d3554b4b57d6cbb5c49ef435f674103587640d26a
Security Headers
Name Value
Content-Security-Policy report-uri /report-csp-violation
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
https://www.mandiant.com/
accept-language
de-DE,de;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Wed, 03 Apr 2024 13:42:37 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
via
varnish
cf-cache-status
EXPIRED
content-encoding
gzip
x-content-type-options
nosniff
content-security-policy
report-uri /report-csp-violation
x-cache
MISS
x-ah-environment
prod
x-xss-protection
1; mode=block
x-request-id
v-053338e2-f1c0-11ee-adc5-2f560fe95975
referrer-policy
strict-origin
last-modified
Wed, 03 Apr 2024 13:37:17 GMT
server
cloudflare
expect-ct
max-age=86400
vary
Accept-Encoding
x-frame-options
SAMEORIGIN
content-language
en
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=300
cf-ray
86e97b7e99263738-FRA
expires
Wed, 03 Apr 2024 13:47:37 GMT
accordion.frontend.min.js
www.mandiant.com/modules/contrib/ckeditor_accordion/js/ 		4 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.mandiant.com/modules/contrib/ckeditor_accordion/js/accordion.frontend.min.js?sbdaev
Requested by
Host: www.mandiant.com
URL: https://www.mandiant.com/resources/blog/dprk-whatsapp-phishing'
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:300b::a29f:f17d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e9474894bf64b11c40884f83b0ba6888635bf90bfaae11db1944d99771f1c820
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
https://www.mandiant.com/
accept-language
de-DE,de;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

x-cache-hits
1444
date
Wed, 03 Apr 2024 13:42:31 GMT
content-encoding
gzip
via
varnish
cf-cache-status
DYNAMIC
x-content-type-options
nosniff
age
3001
x-cache
HIT
x-ah-environment
prod
content-length
1535
x-request-id
v-07f8b446-f1b9-11ee-aff2-d37b3f2eeaf9
last-modified
Wed, 28 Feb 2024 06:27:06 GMT
server
cloudflare
vary
Accept-Encoding
content-type
application/javascript
cache-control
max-age=1209600
accept-ranges
bytes
cf-ray
86e97b7f59e73738-FRA
expires
Wed, 17 Apr 2024 12:52:30 GMT
js_6DthxGuw7lf5cXVR99WG124nN2awPT-l9m4m8jmeuPI.js
www.mandiant.com/sites/default/files/js/ 		20 KB
6 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.mandiant.com/sites/default/files/js/js_6DthxGuw7lf5cXVR99WG124nN2awPT-l9m4m8jmeuPI.js?scope=footer&delta=6&language=en&theme=mandiant_theme&include=eJxtUNFuwzAI_CG3fJJFMEm92CYC0sh_P69du0rZCzoOuDsxi1bPm8H8CwKm5IKtwwtcZ5XmgXZzqbFyygifTSSzYN2cK0xoHCq2QTePfuPKsLQhfTHvhe3_2deJv7N6JiwXx8kCrcPHRSMSiaYsDd7omY5b-pNQJtycbghvFPPYWRR9XHx4HYyrQUVd2SX-vOA03FQWZbM4oYaCXXaPKRvJiNhBGpOUFz_tuSRW8EMGG43p4XfPfBg86rVK2gufXJZ8jnVk5Vmx8je6jqaq
Requested by
Host: www.mandiant.com
URL: https://www.mandiant.com/resources/blog/dprk-whatsapp-phishing'
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:300b::a29f:f17d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
3245f6cb8d40eebea048a60b056d9a48cbc3e1b0309a0a4cb0e51280f6b0c712
Security Headers
Name Value
Content-Security-Policy report-uri /report-csp-violation
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
https://www.mandiant.com/
accept-language
de-DE,de;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Wed, 03 Apr 2024 13:42:32 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
via
varnish
cf-cache-status
EXPIRED
content-encoding
gzip
x-content-type-options
nosniff
content-security-policy
report-uri /report-csp-violation
x-cache
MISS
x-ah-environment
prod
x-xss-protection
1; mode=block
x-request-id
v-0544576c-f1c0-11ee-91fb-43815278ea2a
referrer-policy
strict-origin
last-modified
Wed, 03 Apr 2024 13:37:13 GMT
server
cloudflare
expect-ct
max-age=86400
vary
Accept-Encoding
x-frame-options
SAMEORIGIN
content-language
en
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=300
cf-ray
86e97b7f59e83738-FRA
expires
Wed, 03 Apr 2024 13:47:32 GMT
cookienotificationbar.min.js
www.gstatic.com/glue/cookienotificationbar/ 		18 KB
7 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.gstatic.com/glue/cookienotificationbar/cookienotificationbar.min.js
Requested by
Host: www.mandiant.com
URL: https://www.mandiant.com/resources/blog/dprk-whatsapp-phishing'
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
74397437d41d0ef91b6ac1cbd4edb0c5fb809cd9299cccf6adde7b5b8937e79f
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
https://www.mandiant.com/
accept-language
de-DE,de;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Wed, 03 Apr 2024 13:42:31 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/uxe-owners-acl/gstatic
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
6872
x-xss-protection
0
last-modified
Tue, 02 Apr 2024 16:16:07 GMT
server
sffe
vary
Accept-Encoding
report-to
{"group":"uxe-owners-acl/gstatic","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/uxe-owners-acl/gstatic"}]}
content-type
text/javascript
access-control-allow-origin
*
cache-control
private, max-age=3000
accept-ranges
bytes
cross-origin-opener-policy-report-only
same-origin; report-to="uxe-owners-acl/gstatic"
expires
Wed, 03 Apr 2024 13:42:31 GMT
fontloader.built.js
www.mandiant.com/themes/custom/mandiant_theme/gnorm/build/scripts/ 		7 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.mandiant.com/themes/custom/mandiant_theme/gnorm/build/scripts/fontloader.built.js
Requested by
Host: www.mandiant.com
URL: https://www.mandiant.com/resources/blog/dprk-whatsapp-phishing'
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:300b::a29f:f17d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
0b617a1a9d405a304eae1f3337639a1be619633a047ccac0a61d70cf2d2032e4
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
https://www.mandiant.com/
accept-language
de-DE,de;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

x-cache-hits
14954
date
Wed, 03 Apr 2024 13:42:31 GMT
content-encoding
gzip
via
varnish
cf-cache-status
HIT
x-content-type-options
nosniff
age
129
x-cache
HIT
x-ah-environment
prod
content-length
2334
x-request-id
v-4ef85e98-ddf8-11ee-8c13-8f2cfea07ca1
last-modified
Wed, 28 Feb 2024 06:27:09 GMT
server
cloudflare
vary
Accept-Encoding
content-type
application/javascript
cache-control
public, max-age=1209600
accept-ranges
bytes
cf-ray
86e97b7f59e93738-FRA
expires
Wed, 17 Apr 2024 13:42:31 GMT
gtm.js
www.googletagmanager.com/ 		422 KB
119 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtm.js?id=GTM-T72STLD
Requested by
Host: www.mandiant.com
URL: https://www.mandiant.com/resources/blog/dprk-whatsapp-phishing'
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:811::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
3f62182e24e60ce1bb83311468aa98d9a5f35ee93c65755aa82047fc9be72f5c
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
https://www.mandiant.com/
accept-language
de-DE,de;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Wed, 03 Apr 2024 13:42:31 GMT
content-encoding
br
strict-transport-security
max-age=31536000; includeSubDomains
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
121510
x-xss-protection
0
last-modified
Wed, 03 Apr 2024 12:00:00 GMT
server
Google Tag Manager
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Wed, 03 Apr 2024 13:42:31 GMT
footer-bg-transparent.png
www.mandiant.com/themes/custom/mandiant_theme/gnorm/build/images/ 		134 KB
134 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.mandiant.com/themes/custom/mandiant_theme/gnorm/build/images/footer-bg-transparent.png
Requested by
Host: www.mandiant.com
URL: https://www.mandiant.com/sites/default/files/css/css_Yw6OVXvPezay5yis2fK3Ww_gPGJFkqY8-dShIrZV6nI.css?delta=1&language=en&theme=mandiant_theme&include=eJxtUNFuwzAI_CG3fJJFMEm92CYC0sh_P69du0rZCzoOuDsxi1bPm8H8CwKm5IKtwwtcZ5XmgXZzqbFyygifTSSzYN2cK0xoHCq2QTePfuPKsLQhfTHvhe3_2deJv7N6JiwXx8kCrcPHRSMSiaYsDd7omY5b-pNQJtycbghvFPPYWRR9XHx4HYyrQUVd2SX-vOA03FQWZbM4oYaCXXaPKRvJiNhBGpOUFz_tuSRW8EMGG43p4XfPfBg86rVK2gufXJZ8jnVk5Vmx8je6jqaq
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:300b::a29f:f17d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
0f2e61cd1a10aebb0eae1a2f6914784a4d9be90a46b1c67700311d0f66d3e379
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
https://www.mandiant.com/sites/default/files/css/css_Yw6OVXvPezay5yis2fK3Ww_gPGJFkqY8-dShIrZV6nI.css?delta=1&language=en&theme=mandiant_theme&include=eJxtUNFuwzAI_CG3fJJFMEm92CYC0sh_P69du0rZCzoOuDsxi1bPm8H8CwKm5IKtwwtcZ5XmgXZzqbFyygifTSSzYN2cK0xoHCq2QTePfuPKsLQhfTHvhe3_2deJv7N6JiwXx8kCrcPHRSMSiaYsDd7omY5b-pNQJtycbghvFPPYWRR9XHx4HYyrQUVd2SX-vOA03FQWZbM4oYaCXXaPKRvJiNhBGpOUFz_tuSRW8EMGG43p4XfPfBg86rVK2gufXJZ8jnVk5Vmx8je6jqaq
accept-language
de-DE,de;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

x-cache-hits
72716
date
Wed, 03 Apr 2024 13:42:31 GMT
via
varnish
x-content-type-options
nosniff
cf-cache-status
HIT
age
129
x-cache
HIT
x-ah-environment
prod
content-length
136986
x-request-id
v-5de57d1e-ddf8-11ee-bf8a-dbca44bad052
last-modified
Wed, 28 Feb 2024 06:27:09 GMT
server
cloudflare
vary
Accept-Encoding
content-type
image/png
cache-control
public, max-age=1209600
accept-ranges
bytes
cf-ray
86e97b7f7a033738-FRA
expires
Wed, 17 Apr 2024 13:42:31 GMT
MaterialIcons-Outlined.woff2
www.mandiant.com/themes/custom/mandiant_theme/gnorm/build/fonts/material-icons/ 		148 KB
148 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://www.mandiant.com/themes/custom/mandiant_theme/gnorm/build/fonts/material-icons/MaterialIcons-Outlined.woff2
Requested by
Host: www.mandiant.com
URL: https://www.mandiant.com/sites/default/files/css/css_Yw6OVXvPezay5yis2fK3Ww_gPGJFkqY8-dShIrZV6nI.css?delta=1&language=en&theme=mandiant_theme&include=eJxtUNFuwzAI_CG3fJJFMEm92CYC0sh_P69du0rZCzoOuDsxi1bPm8H8CwKm5IKtwwtcZ5XmgXZzqbFyygifTSSzYN2cK0xoHCq2QTePfuPKsLQhfTHvhe3_2deJv7N6JiwXx8kCrcPHRSMSiaYsDd7omY5b-pNQJtycbghvFPPYWRR9XHx4HYyrQUVd2SX-vOA03FQWZbM4oYaCXXaPKRvJiNhBGpOUFz_tuSRW8EMGG43p4XfPfBg86rVK2gufXJZ8jnVk5Vmx8je6jqaq
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:300b::a29f:f17d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
6b9c3158d7700a96a2fc4de59adc0c4724338c900d14b9447653c52d50df1621
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
https://www.mandiant.com/sites/default/files/css/css_Yw6OVXvPezay5yis2fK3Ww_gPGJFkqY8-dShIrZV6nI.css?delta=1&language=en&theme=mandiant_theme&include=eJxtUNFuwzAI_CG3fJJFMEm92CYC0sh_P69du0rZCzoOuDsxi1bPm8H8CwKm5IKtwwtcZ5XmgXZzqbFyygifTSSzYN2cK0xoHCq2QTePfuPKsLQhfTHvhe3_2deJv7N6JiwXx8kCrcPHRSMSiaYsDd7omY5b-pNQJtycbghvFPPYWRR9XHx4HYyrQUVd2SX-vOA03FQWZbM4oYaCXXaPKRvJiNhBGpOUFz_tuSRW8EMGG43p4XfPfBg86rVK2gufXJZ8jnVk5Vmx8je6jqaq
Origin
https://www.mandiant.com
accept-language
de-DE,de;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

x-cache-hits
83364
date
Wed, 03 Apr 2024 13:42:31 GMT
via
varnish
x-content-type-options
nosniff
cf-cache-status
HIT
age
129
x-cache
HIT
x-ah-environment
prod
content-length
151244
x-request-id
v-4912f81c-ddf8-11ee-b814-07b9af2de1ab
last-modified
Wed, 28 Feb 2024 06:27:09 GMT
server
cloudflare
vary
Accept-Encoding
cache-control
public, max-age=1209600
accept-ranges
bytes
cf-ray
86e97b7f7a063738-FRA
expires
Wed, 17 Apr 2024 13:42:31 GMT
Barlow-Regular.woff2
www.mandiant.com/themes/custom/mandiant_theme/gnorm/build/fonts/barlow/ 		55 KB
55 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://www.mandiant.com/themes/custom/mandiant_theme/gnorm/build/fonts/barlow/Barlow-Regular.woff2
Requested by
Host: www.mandiant.com
URL: https://www.mandiant.com/sites/default/files/css/css_Yw6OVXvPezay5yis2fK3Ww_gPGJFkqY8-dShIrZV6nI.css?delta=1&language=en&theme=mandiant_theme&include=eJxtUNFuwzAI_CG3fJJFMEm92CYC0sh_P69du0rZCzoOuDsxi1bPm8H8CwKm5IKtwwtcZ5XmgXZzqbFyygifTSSzYN2cK0xoHCq2QTePfuPKsLQhfTHvhe3_2deJv7N6JiwXx8kCrcPHRSMSiaYsDd7omY5b-pNQJtycbghvFPPYWRR9XHx4HYyrQUVd2SX-vOA03FQWZbM4oYaCXXaPKRvJiNhBGpOUFz_tuSRW8EMGG43p4XfPfBg86rVK2gufXJZ8jnVk5Vmx8je6jqaq
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:300b::a29f:f17d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
f269cafacd48c650b7c76973b7192a4593125d9b957bfa3b57a89e835ec0df1f
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
https://www.mandiant.com/sites/default/files/css/css_Yw6OVXvPezay5yis2fK3Ww_gPGJFkqY8-dShIrZV6nI.css?delta=1&language=en&theme=mandiant_theme&include=eJxtUNFuwzAI_CG3fJJFMEm92CYC0sh_P69du0rZCzoOuDsxi1bPm8H8CwKm5IKtwwtcZ5XmgXZzqbFyygifTSSzYN2cK0xoHCq2QTePfuPKsLQhfTHvhe3_2deJv7N6JiwXx8kCrcPHRSMSiaYsDd7omY5b-pNQJtycbghvFPPYWRR9XHx4HYyrQUVd2SX-vOA03FQWZbM4oYaCXXaPKRvJiNhBGpOUFz_tuSRW8EMGG43p4XfPfBg86rVK2gufXJZ8jnVk5Vmx8je6jqaq
Origin
https://www.mandiant.com
accept-language
de-DE,de;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

x-cache-hits
83255
date
Wed, 03 Apr 2024 13:42:31 GMT
via
varnish
x-content-type-options
nosniff
cf-cache-status
HIT
age
129
x-cache
HIT
x-ah-environment
prod
content-length
56020
x-request-id
v-4b571f0e-ddf8-11ee-9c66-eb2eaabdb6fc
last-modified
Wed, 28 Feb 2024 06:27:09 GMT
server
cloudflare
vary
Accept-Encoding
cache-control
public, max-age=1209600
accept-ranges
bytes
cf-ray
86e97b7fba2d3738-FRA
expires
Wed, 17 Apr 2024 13:42:31 GMT
PTMono-Regular.woff2
www.mandiant.com/themes/custom/mandiant_theme/gnorm/build/fonts/mono/ 		71 KB
71 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://www.mandiant.com/themes/custom/mandiant_theme/gnorm/build/fonts/mono/PTMono-Regular.woff2
Requested by
Host: www.mandiant.com
URL: https://www.mandiant.com/sites/default/files/css/css_Yw6OVXvPezay5yis2fK3Ww_gPGJFkqY8-dShIrZV6nI.css?delta=1&language=en&theme=mandiant_theme&include=eJxtUNFuwzAI_CG3fJJFMEm92CYC0sh_P69du0rZCzoOuDsxi1bPm8H8CwKm5IKtwwtcZ5XmgXZzqbFyygifTSSzYN2cK0xoHCq2QTePfuPKsLQhfTHvhe3_2deJv7N6JiwXx8kCrcPHRSMSiaYsDd7omY5b-pNQJtycbghvFPPYWRR9XHx4HYyrQUVd2SX-vOA03FQWZbM4oYaCXXaPKRvJiNhBGpOUFz_tuSRW8EMGG43p4XfPfBg86rVK2gufXJZ8jnVk5Vmx8je6jqaq
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:300b::a29f:f17d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
dfaed587b938cc953c5008f257ed1e661e9d2e2f907bd5b520fc4b9348985a88
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
https://www.mandiant.com/sites/default/files/css/css_Yw6OVXvPezay5yis2fK3Ww_gPGJFkqY8-dShIrZV6nI.css?delta=1&language=en&theme=mandiant_theme&include=eJxtUNFuwzAI_CG3fJJFMEm92CYC0sh_P69du0rZCzoOuDsxi1bPm8H8CwKm5IKtwwtcZ5XmgXZzqbFyygifTSSzYN2cK0xoHCq2QTePfuPKsLQhfTHvhe3_2deJv7N6JiwXx8kCrcPHRSMSiaYsDd7omY5b-pNQJtycbghvFPPYWRR9XHx4HYyrQUVd2SX-vOA03FQWZbM4oYaCXXaPKRvJiNhBGpOUFz_tuSRW8EMGG43p4XfPfBg86rVK2gufXJZ8jnVk5Vmx8je6jqaq
Origin
https://www.mandiant.com
accept-language
de-DE,de;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

x-cache-hits
32439
date
Wed, 03 Apr 2024 13:42:31 GMT
via
varnish
x-content-type-options
nosniff
cf-cache-status
HIT
age
128
x-cache
HIT
x-ah-environment
prod
content-length
72380
x-request-id
v-4b2da6b0-ddf8-11ee-942d-8b0c7c83bef1
last-modified
Wed, 28 Feb 2024 06:27:09 GMT
server
cloudflare
vary
Accept-Encoding
cache-control
public, max-age=1209600
accept-ranges
bytes
cf-ray
86e97b7fba2f3738-FRA
expires
Wed, 17 Apr 2024 13:42:31 GMT
Barlow-Bold.woff2
www.mandiant.com/themes/custom/mandiant_theme/gnorm/build/fonts/barlow/ 		56 KB
56 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://www.mandiant.com/themes/custom/mandiant_theme/gnorm/build/fonts/barlow/Barlow-Bold.woff2
Requested by
Host: www.mandiant.com
URL: https://www.mandiant.com/sites/default/files/css/css_Yw6OVXvPezay5yis2fK3Ww_gPGJFkqY8-dShIrZV6nI.css?delta=1&language=en&theme=mandiant_theme&include=eJxtUNFuwzAI_CG3fJJFMEm92CYC0sh_P69du0rZCzoOuDsxi1bPm8H8CwKm5IKtwwtcZ5XmgXZzqbFyygifTSSzYN2cK0xoHCq2QTePfuPKsLQhfTHvhe3_2deJv7N6JiwXx8kCrcPHRSMSiaYsDd7omY5b-pNQJtycbghvFPPYWRR9XHx4HYyrQUVd2SX-vOA03FQWZbM4oYaCXXaPKRvJiNhBGpOUFz_tuSRW8EMGG43p4XfPfBg86rVK2gufXJZ8jnVk5Vmx8je6jqaq
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:300b::a29f:f17d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
9ec192b1be13b5eb7d11e7c8a0f1466ef236e4ba88182bb4cec76a2c7919464e
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
https://www.mandiant.com/sites/default/files/css/css_Yw6OVXvPezay5yis2fK3Ww_gPGJFkqY8-dShIrZV6nI.css?delta=1&language=en&theme=mandiant_theme&include=eJxtUNFuwzAI_CG3fJJFMEm92CYC0sh_P69du0rZCzoOuDsxi1bPm8H8CwKm5IKtwwtcZ5XmgXZzqbFyygifTSSzYN2cK0xoHCq2QTePfuPKsLQhfTHvhe3_2deJv7N6JiwXx8kCrcPHRSMSiaYsDd7omY5b-pNQJtycbghvFPPYWRR9XHx4HYyrQUVd2SX-vOA03FQWZbM4oYaCXXaPKRvJiNhBGpOUFz_tuSRW8EMGG43p4XfPfBg86rVK2gufXJZ8jnVk5Vmx8je6jqaq
Origin
https://www.mandiant.com
accept-language
de-DE,de;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

x-cache-hits
32582
date
Wed, 03 Apr 2024 13:42:31 GMT
via
varnish
x-content-type-options
nosniff
cf-cache-status
HIT
age
129
x-cache
HIT
x-ah-environment
prod
content-length
57572
x-request-id
v-67bad12c-ddf8-11ee-95b0-07d34ccd6218
last-modified
Wed, 28 Feb 2024 06:27:09 GMT
server
cloudflare
vary
Accept-Encoding
cache-control
public, max-age=1209600
accept-ranges
bytes
cf-ray
86e97b805abb3738-FRA
expires
Wed, 17 Apr 2024 13:42:31 GMT
Barlow-SemiBold.woff2
www.mandiant.com/themes/custom/mandiant_theme/gnorm/build/fonts/barlow/ 		56 KB
57 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://www.mandiant.com/themes/custom/mandiant_theme/gnorm/build/fonts/barlow/Barlow-SemiBold.woff2
Requested by
Host: www.mandiant.com
URL: https://www.mandiant.com/sites/default/files/css/css_Yw6OVXvPezay5yis2fK3Ww_gPGJFkqY8-dShIrZV6nI.css?delta=1&language=en&theme=mandiant_theme&include=eJxtUNFuwzAI_CG3fJJFMEm92CYC0sh_P69du0rZCzoOuDsxi1bPm8H8CwKm5IKtwwtcZ5XmgXZzqbFyygifTSSzYN2cK0xoHCq2QTePfuPKsLQhfTHvhe3_2deJv7N6JiwXx8kCrcPHRSMSiaYsDd7omY5b-pNQJtycbghvFPPYWRR9XHx4HYyrQUVd2SX-vOA03FQWZbM4oYaCXXaPKRvJiNhBGpOUFz_tuSRW8EMGG43p4XfPfBg86rVK2gufXJZ8jnVk5Vmx8je6jqaq
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:300b::a29f:f17d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
1bb508d41bf1d0c5d56340c7df789b6589350a5f967e1fa937bee5c148d0cb0d
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
https://www.mandiant.com/sites/default/files/css/css_Yw6OVXvPezay5yis2fK3Ww_gPGJFkqY8-dShIrZV6nI.css?delta=1&language=en&theme=mandiant_theme&include=eJxtUNFuwzAI_CG3fJJFMEm92CYC0sh_P69du0rZCzoOuDsxi1bPm8H8CwKm5IKtwwtcZ5XmgXZzqbFyygifTSSzYN2cK0xoHCq2QTePfuPKsLQhfTHvhe3_2deJv7N6JiwXx8kCrcPHRSMSiaYsDd7omY5b-pNQJtycbghvFPPYWRR9XHx4HYyrQUVd2SX-vOA03FQWZbM4oYaCXXaPKRvJiNhBGpOUFz_tuSRW8EMGG43p4XfPfBg86rVK2gufXJZ8jnVk5Vmx8je6jqaq
Origin
https://www.mandiant.com
accept-language
de-DE,de;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

x-cache-hits
26053
date
Wed, 03 Apr 2024 13:42:31 GMT
via
varnish
x-content-type-options
nosniff
cf-cache-status
HIT
age
129
x-cache
HIT
x-ah-environment
prod
content-length
57764
x-request-id
v-489a5f92-ddf8-11ee-99b9-4f0725c99a4b
last-modified
Wed, 28 Feb 2024 06:27:09 GMT
server
cloudflare
vary
Accept-Encoding
cache-control
public, max-age=1209600
accept-ranges
bytes
cf-ray
86e97b805abc3738-FRA
expires
Wed, 17 Apr 2024 13:42:31 GMT
Barlow-Medium.woff2
www.mandiant.com/themes/custom/mandiant_theme/gnorm/build/fonts/barlow/ 		55 KB
55 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://www.mandiant.com/themes/custom/mandiant_theme/gnorm/build/fonts/barlow/Barlow-Medium.woff2
Requested by
Host: www.mandiant.com
URL: https://www.mandiant.com/sites/default/files/css/css_Yw6OVXvPezay5yis2fK3Ww_gPGJFkqY8-dShIrZV6nI.css?delta=1&language=en&theme=mandiant_theme&include=eJxtUNFuwzAI_CG3fJJFMEm92CYC0sh_P69du0rZCzoOuDsxi1bPm8H8CwKm5IKtwwtcZ5XmgXZzqbFyygifTSSzYN2cK0xoHCq2QTePfuPKsLQhfTHvhe3_2deJv7N6JiwXx8kCrcPHRSMSiaYsDd7omY5b-pNQJtycbghvFPPYWRR9XHx4HYyrQUVd2SX-vOA03FQWZbM4oYaCXXaPKRvJiNhBGpOUFz_tuSRW8EMGG43p4XfPfBg86rVK2gufXJZ8jnVk5Vmx8je6jqaq
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:300b::a29f:f17d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
fe3bfdac05de97234a1a81c7f09c87f14708cf7bd9a341a63e68613c3c6e40d6
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
https://www.mandiant.com/sites/default/files/css/css_Yw6OVXvPezay5yis2fK3Ww_gPGJFkqY8-dShIrZV6nI.css?delta=1&language=en&theme=mandiant_theme&include=eJxtUNFuwzAI_CG3fJJFMEm92CYC0sh_P69du0rZCzoOuDsxi1bPm8H8CwKm5IKtwwtcZ5XmgXZzqbFyygifTSSzYN2cK0xoHCq2QTePfuPKsLQhfTHvhe3_2deJv7N6JiwXx8kCrcPHRSMSiaYsDd7omY5b-pNQJtycbghvFPPYWRR9XHx4HYyrQUVd2SX-vOA03FQWZbM4oYaCXXaPKRvJiNhBGpOUFz_tuSRW8EMGG43p4XfPfBg86rVK2gufXJZ8jnVk5Vmx8je6jqaq
Origin
https://www.mandiant.com
accept-language
de-DE,de;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

x-cache-hits
5588
date
Wed, 03 Apr 2024 13:42:31 GMT
via
varnish
x-content-type-options
nosniff
cf-cache-status
HIT
age
128
x-cache
HIT
x-ah-environment
prod
content-length
55968
x-request-id
v-70156526-ddf8-11ee-90a9-6fca93429f7b
last-modified
Wed, 28 Feb 2024 06:27:09 GMT
server
cloudflare
vary
Accept-Encoding
cache-control
public, max-age=1209600
accept-ranges
bytes
cf-ray
86e97b805abe3738-FRA
expires
Wed, 17 Apr 2024 13:42:31 GMT
js
www.googletagmanager.com/gtag/ 		293 KB
97 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtag/js?id=G-X6642ZTDJ7&l=dataLayer&cx=c
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-T72STLD
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:811::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
938b626c492d3a7a1a0c5c7c5ecfe2fdcb66be5d7fa8022b94472827db2c2d15
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
https://www.mandiant.com/
accept-language
de-DE,de;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Wed, 03 Apr 2024 13:42:31 GMT
content-encoding
br
strict-transport-security
max-age=31536000; includeSubDomains
server
Google Tag Manager
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
access-control-allow-headers
Cache-Control
content-length
99610
x-xss-protection
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires
Wed, 03 Apr 2024 13:42:31 GMT
uwt.js
static.ads-twitter.com/ 		56 KB
15 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://static.ads-twitter.com/uwt.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-T72STLD
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
146.75.120.157 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
4d15ff2317e16ccd8ca1d3248fea7d91130e022369bb032824a84ad9967064df

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
https://www.mandiant.com/
accept-language
de-DE,de;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Wed, 03 Apr 2024 13:42:31 GMT
content-encoding
gzip
last-modified
Fri, 22 Mar 2024 21:07:24 GMT
x-amz-server-side-encryption
AES256
etag
"bbbcf811d8437a575d796a4c1e5d4fad+gzip+gzip"
vary
Accept-Encoding,Host
x-cache
HIT, HIT
content-type
application/javascript; charset=utf-8
p3p
CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
x-tw-cdn
FT
cache-control
no-cache
accept-ranges
bytes
content-length
15412
x-served-by
cache-iad-kcgs7200135-IAD, cache-fra-etou8220082-FRA
insight.min.js
snap.licdn.com/li.lms-analytics/ 		48 KB
17 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://snap.licdn.com/li.lms-analytics/insight.min.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-T72STLD
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:280:6::213:7ad8 Düsseldorf, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
85a881fba590ac097d83e7d5397c82c99d9538ac482af8f10a3e5886393cfc85
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
https://www.mandiant.com/
accept-language
de-DE,de;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Wed, 03 Apr 2024 13:42:31 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Mon, 11 Mar 2024 16:03:53 GMT
x-cdn
AKAM
x-amz-server-side-encryption
AES256
vary
Accept-Encoding
content-type
application/javascript;charset=utf-8
cache-control
max-age=52327
accept-ranges
bytes
content-length
17224
fbevents.js
connect.facebook.net/en_US/ 		218 KB
59 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://connect.facebook.net/en_US/fbevents.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-T72STLD
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f084:105:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
047e3259b6f0b42d781532fa122b2d8de9aed187d766fd45efcf119450eeb4c4
Security Headers
Name Value
Content-Security-Policy default-src 'self' data: blob: facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script';
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 0

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
https://www.mandiant.com/
accept-language
de-DE,de;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

content-security-policy
default-src 'self' data: blob: facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script';
content-encoding
gzip
x-content-type-options
nosniff
strict-transport-security
max-age=31536000; preload; includeSubDomains
date
Wed, 03 Apr 2024 13:42:31 GMT
document-policy
force-load-at-top
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
content-length
58040
x-xss-protection
0
reporting-endpoints
coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
x-fb-connection-quality
EXCELLENT; q=0.9, rtt=19, rtx=0, c=12, mss=1294, tbw=2798, tp=-1, tpl=-1, uplat=0, ullat=-1
pragma
public
x-fb-debug
lY//Ajb7BeWqrZGHwcNU8P4A71M9pIAcf5+gQ6FoRijAnFefHhQh1583zY6D2dqdpMQPHpT63trHxjK/2XXpxA==
cross-origin-embedder-policy-report-only
require-corp;report-to="coep_report"
cross-origin-opener-policy
same-origin-allow-popups;report-to="coop_report"
vary
Accept-Encoding
report-to
{"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
content-type
application/x-javascript; charset=utf-8
x-frame-options
DENY
cache-control
public, max-age=1200
permissions-policy
accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), clipboard-read=(), clipboard-write=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), usb=(), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
timing-allow-origin
*
expires
Sat, 01 Jan 2000 00:00:00 GMT
bat.js
bat.bing.com/ 		45 KB
13 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://bat.bing.com/bat.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-T72STLD
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
823804a7807864b44093a3843788f4cd076e89cf4a6fdeb8d153ae5c2c2df721
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
https://www.mandiant.com/
accept-language
de-DE,de;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
content-encoding
gzip
date
Wed, 03 Apr 2024 13:42:31 GMT
last-modified
Thu, 29 Feb 2024 19:58:06 GMT
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref
Ref A: F019D9333F804E62ADCD68EA9E552F26 Ref B: DUS30EDGE0318 Ref C: 2024-04-03T13:42:31Z
etag
"01b4e9c496bda1:0"
vary
Accept-Encoding
x-cache
CONFIG_NOCACHE
content-type
application/javascript
cache-control
private,max-age=1800
accept-ranges
bytes
content-length
13261
analytics.js
www.google-analytics.com/ 		52 KB
21 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/analytics.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-T72STLD
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81c::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
https://www.mandiant.com/
accept-language
de-DE,de;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
date
Wed, 03 Apr 2024 13:38:42 GMT
last-modified
Tue, 12 Dec 2023 18:09:08 GMT
server
Golfe2
age
229
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=7200
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
20994
expires
Wed, 03 Apr 2024 15:38:42 GMT
hotjar-3008912.js
static.hotjar.com/c/ 		9 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://static.hotjar.com/c/hotjar-3008912.js?sv=7
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-T72STLD
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.102.53 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-102-53.fra56.r.cloudfront.net
Software
/
Resource Hash
5d0ae0d3e2662265f917891f158ecc5de9fbfcd40cbe8a42a584fd8f132e66f0
Security Headers
Name Value
Strict-Transport-Security max-age=2592000; includeSubDomains
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
https://www.mandiant.com/
accept-language
de-DE,de;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

strict-transport-security
max-age=2592000; includeSubDomains
content-encoding
br
x-content-type-options
nosniff
date
Wed, 03 Apr 2024 13:41:40 GMT
via
1.1 3a3c1dcacd115187f53f40028ae4bd24.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA56-P2
age
51
x-cache
Hit from cloudfront
cross-origin-resource-policy
cross-origin
etag
W/a06b4faf5f8738594ff2b86858959d04
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
x-cache-hit
1
cache-control
max-age=60
x-amz-cf-id
6nggfp_vRGFwvge5p0qKOtNWT_bJdgStAus_sy_QD4AvSZycZn4Fyw==
munchkin.js
munchkin.marketo.net/ 		1 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://munchkin.marketo.net/munchkin.js
Requested by
Host: www.mandiant.com
URL: https://www.mandiant.com/resources/blog/dprk-whatsapp-phishing'
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
23.192.243.198 Düsseldorf, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-192-243-198.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
5206536707c84baa892d3c3231b351985ee828cb8b9c0bd8db42cd3363995fc4

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
https://www.mandiant.com/
accept-language
de-DE,de;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Date
Wed, 03 Apr 2024 13:42:31 GMT
Content-Encoding
gzip
Last-Modified
Fri, 17 Mar 2023 01:24:48 GMT
Server
AkamaiNetStorage
ETag
"cb731cc5c2bd9f31d6bfeb19f3c8b1ff:1679016288.730763"
Vary
Accept-Encoding
Content-Type
application/x-javascript
P3P
policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR"
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
729
sl.js
scout-cdn.salesloft.com/ 		6 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://scout-cdn.salesloft.com/sl.js
Requested by
Host: www.mandiant.com
URL: https://www.mandiant.com/resources/blog/dprk-whatsapp-phishing'
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:4869 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
4a007af67f716c30c8848ab0ad0bfaab8a5fcf3e36dedf918b59c9429d522440
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
https://www.mandiant.com/
accept-language
de-DE,de;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Wed, 03 Apr 2024 13:42:31 GMT
x-amz-version-id
6anzvBQcvmaBDc8BSO9zI6Th.IIiwArc
x-content-type-options
nosniff
cf-cache-status
HIT
content-encoding
br
strict-transport-security
max-age=31536000; includeSubDomains
x-amz-request-id
MKFGWBQTHPETC9R7
age
2395
alt-svc
h3=":443"; ma=86400
x-amz-id-2
y2Sge8SvXa/3la/RRnCSL6fyLRrtegcr4vnea2ovtWrr0FoGP5Idk0qy697UslwJl/UmIODT4t4=
last-modified
Mon, 13 Dec 2021 16:28:37 GMT
server
cloudflare
etag
W/"d74cc4825c8e333b2116da3fcc649db1"
vary
Accept-Encoding
x-frame-options
SAMEORIGIN
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=14400
cf-ray
86e97b81ae3c917a-FRA
expires
Wed, 03 Apr 2024 17:42:31 GMT
recaptcha__de.js
www.gstatic.com/recaptcha/releases/moV1mTgQ6S91nuTnmll4Y9yf/ 		502 KB
200 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.gstatic.com/recaptcha/releases/moV1mTgQ6S91nuTnmll4Y9yf/recaptcha__de.js
Requested by
Host: www.google.com
URL: https://www.google.com/recaptcha/api.js?onload=CaptchaCallback&render=explicit
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.185.99 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s49-in-f3.1e100.net
Software
sffe /
Resource Hash
aa4ddb0e0c3bda5d6e61d56a544a7ff9ea3691eaa5126187daa6ed1875ba93e7
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
https://www.mandiant.com/
Origin
https://www.mandiant.com
accept-language
de-DE,de;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Tue, 02 Apr 2024 14:10:04 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
84747
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
204859
x-xss-protection
0
last-modified
Mon, 25 Mar 2024 04:00:24 GMT
server
sffe
cross-origin-opener-policy
same-origin-allow-popups; report-to="recaptcha"
vary
Accept-Encoding
report-to
{"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type
text/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Wed, 02 Apr 2025 14:10:04 GMT
sm.25.html
static.addtoany.com/menu/ Frame B768 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://static.addtoany.com/menu/sm.25.html
Requested by
Host: static.addtoany.com
URL: https://static.addtoany.com/menu/page.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.39.148 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.mandiant.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
accept-language
de-DE,de;q=0.9
sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-mobile
?0
sec-ch-ua-platform
"Win32"

Response headers

access-control-allow-origin
*
age
11268
alt-svc
h3=":443"; ma=86400
cache-control
max-age=315360000, immutable
cf-cache-status
HIT
cf-ray
86e97b81c999695d-FRA
content-encoding
br
content-type
text/html; charset=utf-8
date
Wed, 03 Apr 2024 13:42:32 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
referrer-policy
strict-origin-when-cross-origin
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=1tXzSjrBK%2BxxO%2FU8O8Q9Ka8sPQGY19Q3uCLC09HLCVaCvEo9pBN0eWNIg33eYqyOhvvNlnvBnljHQiVok3H6QpVzsdpXL5ha1l1mb3qy4bcZtxR5pMW7PmEKSgeSu5sm%2B1muH%2FKB"}],"group":"cf-nel","max_age":604800}
server
cloudflare
strict-transport-security
max-age=31536000; includeSubDomains; preload
vary
Accept-Encoding
x-content-type-options
nosniff
core.Ep5bSEmr.js
static.addtoany.com/menu/modules/ 		70 KB
26 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://static.addtoany.com/menu/modules/core.Ep5bSEmr.js
Requested by
Host: static.addtoany.com
URL: https://static.addtoany.com/menu/page.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.39.148 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
219b652de3176257072749c876811cc963494f5fbdee3f92eb38e7392f724ce0
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
https://www.mandiant.com/
Origin
https://www.mandiant.com
accept-language
de-DE,de;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Wed, 03 Apr 2024 13:42:31 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
18775
content-encoding
br
alt-svc
h3=":443"; ma=86400
referrer-policy
strict-origin-when-cross-origin
cf-bgj
minify
server
cloudflare
etag
W/"a995aaed2cd978eb5749462d1dc3635e"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=uVD%2BKu9dT67wdlSnPNOXdcp4ZLy4%2FNL%2Bp7HE4LRca88ERMOaopgqXyHc9MLs1UyyWnPI4V6Ik1eqWenz%2B35mqzniykVCOroLMRqePgDszAF718r2e7OluzPH%2Bn%2BfqUTin25mc6q5"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=315360000, immutable
cf-ray
86e97b81c8475d7f-FRA
modules.4bbac2bdc7f1b66d3009.js
script.hotjar.com/ 		221 KB
55 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://script.hotjar.com/modules.4bbac2bdc7f1b66d3009.js
Requested by
Host: static.hotjar.com
URL: https://static.hotjar.com/c/hotjar-3008912.js?sv=7
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.32.27.21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-32-27-21.fra56.r.cloudfront.net
Software
/
Resource Hash
261e44bd5998183c1bde239149a4be112fd5afd76c1efb12da82f24cf20561d4
Security Headers
Name Value
Strict-Transport-Security max-age=2592000; includeSubDomains
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
https://www.mandiant.com/
accept-language
de-DE,de;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Tue, 02 Apr 2024 12:55:06 GMT
content-encoding
br
x-content-type-options
nosniff
strict-transport-security
max-age=2592000; includeSubDomains
via
1.1 e6959f77d21557f69683da8f0cd5578a.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA56-C2
age
89246
x-cache
Hit from cloudfront
cross-origin-resource-policy
cross-origin
content-length
55706
last-modified
Tue, 02 Apr 2024 12:54:16 GMT
etag
"d8eecaf9ad4fc4bf64b1230f03df9166"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000
accept-ranges
bytes
x-robots-tag
none
x-amz-cf-id
k8MIczsgfGtO7U23ld3JjQ_hijfau6gu_u_8nqpYNXjOPc13ajoL4A==
collect
www.google-analytics.com/j/ 		3 B
209 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/j/collect?v=1&_v=j101&aip=1&a=231277543&t=pageview&_s=1&dl=https%3A%2F%2Fwww.mandiant.com%2Fresources%2Fblog%2Fdprk-whatsapp-phishing%27&ul=en-us&de=UTF-8&dt=404%20page%20%7C%20Mandiant&sd=24-bit&sr=800x600&vp=1600x1113&je=0&_u=YGBAgEABAAAAACAEK~&jid=94102031&gjid=659245418&cid=1657819941.1712151752&tid=UA-203244293-1&_gid=474147855.1712151752&_slc=1&gtm=45He4410n81T72STLDv849727317za200&cg1=null&cg2=resources&cd2=Pageview&cd3=1712151751818.cwfn4kxn&cd4=2024-04-03T15%3A42%3A31.818%2B02%3A00&cd5=&cd15=null&cd16=null&cd24=unknown&gcd=13l3l3l2l1&dma_cps=sypham&dma=1&cd1=1657819941.1712151752&npa=1&z=1833411106
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81c::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
1cffc2b3146584685cd72751d7f28aa030ab9ae2f1bc78f2c27909f8d8287b26
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-platform
"Win32"
Referer
https://www.mandiant.com/
accept-language
de-DE,de;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Wed, 03 Apr 2024 13:42:32 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://www.mandiant.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
3
expires
Fri, 01 Jan 1990 00:00:00 GMT
collect
stats.g.doubleclick.net/j/ 		1 B
347 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j101&tid=UA-203244293-1&cid=1657819941.1712151752&jid=94102031&gjid=659245418&_gid=474147855.1712151752&npa=1&_u=YGBAgEABAAAAAGAEK~&z=73729357
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:400c:c00::9d Brussels, Belgium, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-platform
"Win32"
Referer
https://www.mandiant.com/
accept-language
de-DE,de;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
strict-transport-security
max-age=10886400; includeSubDomains; preload
date
Wed, 03 Apr 2024 13:42:32 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://www.mandiant.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
1
expires
Fri, 01 Jan 1990 00:00:00 GMT
880805232811859
connect.facebook.net/signals/config/ 		55 KB
12 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://connect.facebook.net/signals/config/880805232811859?v=2.9.151&r=stable&domain=www.mandiant.com&hme=8ce74e881727851b4427183947937854816d72704925561b9de6420cd43214ee&ex_m=66%2C111%2C98%2C102%2C57%2C3%2C92%2C65%2C15%2C90%2C83%2C48%2C50%2C157%2C160%2C171%2C167%2C168%2C170%2C28%2C93%2C49%2C72%2C169%2C152%2C155%2C164%2C165%2C172%2C120%2C14%2C47%2C176%2C175%2C122%2C17%2C32%2C36%2C1%2C40%2C61%2C62%2C63%2C67%2C87%2C16%2C13%2C89%2C86%2C85%2C99%2C101%2C35%2C100%2C29%2C25%2C153%2C156%2C129%2C27%2C10%2C11%2C12%2C5%2C6%2C24%2C21%2C22%2C53%2C58%2C60%2C70%2C94%2C26%2C71%2C8%2C7%2C75%2C45%2C20%2C96%2C95%2C9%2C19%2C18%2C77%2C82%2C44%2C43%2C81%2C37%2C39%2C80%2C52%2C78%2C31%2C41%2C34%2C69%2C0%2C88%2C4%2C84%2C76%2C79%2C2%2C33%2C59%2C38%2C97%2C42%2C74%2C64%2C103%2C56%2C55%2C30%2C91%2C54%2C51%2C46%2C73%2C68%2C23%2C104
Requested by
Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f084:105:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
7a4a5963f0b2a67a210867692d0f09d9c8a203dbaf7856b5617650260aa422d2
Security Headers
Name Value
Content-Security-Policy default-src 'self' data: blob: facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script';
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 0

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
https://www.mandiant.com/
accept-language
de-DE,de;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

content-security-policy
default-src 'self' data: blob: facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script';
content-encoding
gzip
x-content-type-options
nosniff
strict-transport-security
max-age=31536000; preload; includeSubDomains
date
Wed, 03 Apr 2024 13:42:32 GMT
document-policy
force-load-at-top
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
content-length
11706
x-xss-protection
0
reporting-endpoints
coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
x-fb-connection-quality
EXCELLENT; q=0.9, rtt=20, rtx=0, c=64, mss=1294, tbw=63191, tp=-1, tpl=-1, uplat=1, ullat=-1
pragma
public
x-fb-debug
KaYAHpLbNuiCrOnsTMhbXXtiHCGcLkxn8f5vOb9KIG6rqIgaS05zNR0rjmc4GkoynwmatZ6lvsT+nyRBQI7c+A==
cross-origin-embedder-policy-report-only
require-corp;report-to="coep_report"
cross-origin-opener-policy
same-origin-allow-popups;report-to="coop_report"
vary
Accept-Encoding
report-to
{"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
content-type
application/x-javascript; charset=utf-8
x-frame-options
DENY
origin-agent-cluster
?0
cache-control
public, max-age=1200
permissions-policy
accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), clipboard-read=(), clipboard-write=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), usb=(), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
timing-allow-origin
*
expires
Sat, 01 Jan 2000 00:00:00 GMT
munchkin.js
munchkin.marketo.net/163/ 		11 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://munchkin.marketo.net/163/munchkin.js
Requested by
Host: munchkin.marketo.net
URL: https://munchkin.marketo.net/munchkin.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
23.192.243.198 Düsseldorf, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-192-243-198.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
68cc280ce370c6f1f51a4fc5950103fc38df80a429552c549add04ebd8bd3a23

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
https://www.mandiant.com/
accept-language
de-DE,de;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Date
Wed, 03 Apr 2024 13:42:32 GMT
Content-Encoding
gzip
Last-Modified
Fri, 06 Jan 2023 02:26:40 GMT
Server
AkamaiNetStorage
ETag
"ea7826f34518d7c2295738f39c7640fa:1672972000.238769"
Vary
Accept-Encoding
Content-Type
application/x-javascript
P3P
policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR"
Cache-Control
max-age=8640000
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
4741
Expires
Fri, 12 Jul 2024 13:42:32 GMT
r
scout.salesloft.com/ 		41 B
358 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://scout.salesloft.com/r?tid=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJ0IjoxMDUwMDl9.GHpZgHyRyFl9iN7anlcbMbmW3chPCQZrSX98AJ7UjM8
Requested by
Host: scout-cdn.salesloft.com
URL: https://scout-cdn.salesloft.com/sl.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
52.44.115.82 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-52-44-115-82.compute-1.amazonaws.com
Software
/
Resource Hash
1cfea949b0b2925d27b84d56d18f2ea1c6b948fdf3ae95c534a14706043da178
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
https://www.mandiant.com/
accept-language
de-DE,de;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Wed, 03 Apr 2024 13:42:32 GMT
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-methods
GET
content-type
application/json; charset=utf-8
access-control-allow-origin
https://www.mandiant.com
access-control-expose-headers
cache-control
max-age=0, private, must-revalidate
access-control-allow-credentials
true
content-length
41
x-request-id
080c4d80e0095584cff3065203580b78
adsct
t.co/i/ 		43 B
376 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://t.co/i/adsct?bci=3&eci=2&event_id=ada88199-f40e-4ad8-9673-09609b4421f5&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=9bfcb349-1468-4eb2-899b-690bb70f4dec&tw_document_href=https%3A%2F%2Fwww.mandiant.com%2Fresources%2Fblog%2Fdprk-whatsapp-phishing%27&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=o5b0k&type=javascript&version=2.3.30
Requested by
Host: www.mandiant.com
URL: https://www.mandiant.com/resources/blog/dprk-whatsapp-phishing'
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.244.42.69 , United States, ASN13414 (TWITTER, US),
Reverse DNS
Software
tsa_o /
Resource Hash
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
Security Headers
Name Value
Strict-Transport-Security max-age=0

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
https://www.mandiant.com/
accept-language
de-DE,de;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

x-response-time
110
date
Wed, 03 Apr 2024 13:42:31 GMT
strict-transport-security
max-age=0
server
tsa_o
content-type
image/gif;charset=utf-8
x-transaction-id
745f1f05a6584d95
cache-control
no-cache, no-store, max-age=0
perf
7469935968
x-connection-hash
d62d881169531c582c64a7b687adba8bea9f24df8c6ed21999dcca5427e176ca
content-length
43
adsct
analytics.twitter.com/i/ 		43 B
395 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://analytics.twitter.com/i/adsct?bci=3&eci=2&event_id=ada88199-f40e-4ad8-9673-09609b4421f5&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=9bfcb349-1468-4eb2-899b-690bb70f4dec&tw_document_href=https%3A%2F%2Fwww.mandiant.com%2Fresources%2Fblog%2Fdprk-whatsapp-phishing%27&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=o5b0k&type=javascript&version=2.3.30
Requested by
Host: www.mandiant.com
URL: https://www.mandiant.com/resources/blog/dprk-whatsapp-phishing'
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.244.42.195 , United States, ASN13414 (TWITTER, US),
Reverse DNS
Software
tsa_o /
Resource Hash
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
Security Headers
Name Value
Strict-Transport-Security max-age=631138519

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
https://www.mandiant.com/
accept-language
de-DE,de;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

x-response-time
179
date
Wed, 03 Apr 2024 13:42:31 GMT
strict-transport-security
max-age=631138519
server
tsa_o
content-type
image/gif;charset=utf-8
x-transaction-id
f19b52ddd4c0c6f9
cache-control
no-cache, no-store, max-age=0
perf
7469935968
x-connection-hash
4e19944e85f88c0aaa4f501215245e77f5a7e03207f3478cf05969818c39258d
content-length
43
collect
px4.ads.linkedin.com/
Redirect Chain
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=3460746&time=1712151752052&li_adsId=565c9d7d-92df-4250-beef-07665aa36492&url=https%3A%2F%2Fwww.mandiant.com%2Fresources%2Fblog%2Fdprk-whatsapp-phi...
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=3460746&time=1712151752052&li_adsId=565c9d7d-92df-4250-beef-07665aa36492&url=https%3A%2F%2Fwww.mandiant.com%2Fresources%2Fblog%2Fdprk-whatsapp-phi...
  • https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D3460746%26time%3D1712151752052%26li_adsId%3D565c9d7d-92df-4250-beef-07665aa36492%...
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=3460746&time=1712151752052&li_adsId=565c9d7d-92df-4250-beef-07665aa36492&url=https%3A%2F%2Fwww.mandiant.com%2Fresources%2Fblog%2Fdprk-whatsapp-phi...
  • https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=3460746&time=1712151752052&li_adsId=565c9d7d-92df-4250-beef-07665aa36492&url=https%3A%2F%2Fwww.mandiant.com%2Fresources%2Fblog%2Fdprk-whatsapp-ph...
0
268 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=3460746&time=1712151752052&li_adsId=565c9d7d-92df-4250-beef-07665aa36492&url=https%3A%2F%2Fwww.mandiant.com%2Fresources%2Fblog%2Fdprk-whatsapp-phishing%27&cookiesTest=true&liSync=true&e_ipv6=AQI4iggKd-xocwAAAY6kMnCKzEEXt-5EhXo0KEZAzRPgcDWi2iEqJ0eCUd5LmoMTL91J1f7AXjIU
Requested by
Host: www.mandiant.com
URL: https://www.mandiant.com/resources/blog/dprk-whatsapp-phishing'
Protocol
H2
Server
13.107.42.14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.mandiant.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36

Response headers

date
Wed, 03 Apr 2024 13:42:32 GMT
x-li-pop
afd-prod-ltx1-x
x-msedge-ref
Ref A: 19B0117E5D2D498BA69AEC4AD6E13680 Ref B: DUS30EDGE0721 Ref C: 2024-04-03T13:42:33Z
linkedin-action
1
x-cache
CONFIG_NOCACHE
content-type
application/javascript
x-li-fabric
prod-ltx1
x-li-proto
http/2
content-length
0
x-li-uuid
AAYVMWULFn0+qMAWi+U+QQ==

Redirect headers

date
Wed, 03 Apr 2024 13:42:32 GMT
x-li-pop
afd-prod-ltx1-x
x-msedge-ref
Ref A: 66B59458A63F41DF9875B1E2822C27BF Ref B: VIEEDGE2010 Ref C: 2024-04-03T13:42:32Z
linkedin-action
1
x-cache
CONFIG_NOCACHE
x-li-fabric
prod-ltx1
location
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=3460746&time=1712151752052&li_adsId=565c9d7d-92df-4250-beef-07665aa36492&url=https%3A%2F%2Fwww.mandiant.com%2Fresources%2Fblog%2Fdprk-whatsapp-phishing%27&cookiesTest=true&liSync=true&e_ipv6=AQI4iggKd-xocwAAAY6kMnCKzEEXt-5EhXo0KEZAzRPgcDWi2iEqJ0eCUd5LmoMTL91J1f7AXjIU
x-li-proto
http/2
content-length
0
x-li-uuid
AAYVMWUGsVsih+BI70jnDw==
5870833.js
bat.bing.com/p/action/ 		0
118 B 		Script
General
Check archive.org
Download Go to
Full URL
https://bat.bing.com/p/action/5870833.js
Requested by
Host: bat.bing.com
URL: https://bat.bing.com/bat.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
https://www.mandiant.com/
accept-language
de-DE,de;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
cache-control
private,max-age=1800
date
Wed, 03 Apr 2024 13:42:31 GMT
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref
Ref A: AC616B089AB1410592DC9E21EC7ACFE7 Ref B: DUS30EDGE0318 Ref C: 2024-04-03T13:42:32Z
x-cache
CONFIG_NOCACHE
/
www.facebook.com/tr/ 		0
274 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.facebook.com/tr/?id=880805232811859&ev=PageView&dl=https%3A%2F%2Fwww.mandiant.com%2Fresources%2Fblog%2Fdprk-whatsapp-phishing%27&rl=&if=false&ts=1712151752090&sw=800&sh=600&v=2.9.151&r=stable&a=tmSimo-GTM-WebTemplate&ec=0&o=4125&fbp=fb.1.1712151752089.1566227149&ler=empty&cdl=API_unavailable&it=1712151752031&coo=false&tm=1&rqm=GET
Requested by
Host: www.mandiant.com
URL: https://www.mandiant.com/resources/blog/dprk-whatsapp-phishing'
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f177:185:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
proxygen-bolt /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
https://www.mandiant.com/
accept-language
de-DE,de;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

x-fb-connection-quality
EXCELLENT; q=0.9, rtt=19, rtx=0, c=10, mss=1294, tbw=2788, tp=-1, tpl=-1, uplat=0, ullat=0
strict-transport-security
max-age=31536000; includeSubDomains
date
Wed, 03 Apr 2024 13:42:32 GMT
server
proxygen-bolt
content-type
text/plain
access-control-allow-origin
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
content-length
0
visitWebPage
565-pei-952.mktoresp.com/webevents/ 		2 B
318 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://565-pei-952.mktoresp.com/webevents/visitWebPage?_mchNc=1712151752098&_mchCn=&_mchId=565-PEI-952&_mchTk=_mch-mandiant.com-1712151752097-15610&_mchHo=www.mandiant.com&_mchPo=&_mchRu=%2Fresources%2Fblog%2Fdprk-whatsapp-phishing%27&_mchPc=https%3A&_mchVr=163&_mchEcid=&_mchHa=&_mchRe=&_mchQp=
Requested by
Host: munchkin.marketo.net
URL: https://munchkin.marketo.net/163/munchkin.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
192.28.144.124 , United States, ASN15224 (OMNITURE, US),
Reverse DNS
Software
nginx/1.20.1 /
Resource Hash
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
https://www.mandiant.com/
accept-language
de-DE,de;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Date
Wed, 03 Apr 2024 13:42:32 GMT
Content-Encoding
gzip
Server
nginx/1.20.1
Transfer-Encoding
chunked
Content-Type
text/plain; charset=UTF-8
Access-Control-Allow-Origin
*
Connection
keep-alive
X-Request-Id
30f78c03-79ca-4821-b415-b99b596a844f
i
scout.salesloft.com/ 		48 B
466 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://scout.salesloft.com/i
Requested by
Host: scout-cdn.salesloft.com
URL: https://scout-cdn.salesloft.com/sl.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
52.44.115.82 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-52-44-115-82.compute-1.amazonaws.com
Software
/
Resource Hash
0bfa1752ac3abc016e5400217138461e45bb2c28a9b6e7798bbc077f7fc8dba1
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
https://www.mandiant.com/
accept-language
de-DE,de;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Wed, 03 Apr 2024 13:42:32 GMT
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-methods
GET
content-type
application/json; charset=utf-8
access-control-allow-origin
https://www.mandiant.com
access-control-expose-headers
cache-control
max-age=0, private, must-revalidate
access-control-allow-credentials
true
content-length
48
x-request-id
4de6180e97c98c4d2e9e9bf9282638d5
collect
region1.analytics.google.com/g/ 		0
255 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://region1.analytics.google.com/g/collect?v=2&tid=G-X6642ZTDJ7&_ono=1&gtm=45je4410v883779794z8849727317za200&_p=1712151751564&_gaz=1&gcs=G111&gcd=13t3tPl2l5&npa=1&dma_cps=sypham&dma=1&cid=1657819941.1712151752&ul=en-us&sr=800x600&ir=1&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B123.0.6312.105%7CNot%253AA-Brand%3B8.0.0.0%7CChromium%3B123.0.6312.105&uamb=0&uam=&uap=Win32&uapv=10.0.0&uaw=0&pscdl=noapi&_eu=EA&_s=1&sid=1712151751&sct=1&seg=0&dl=https%3A%2F%2Fwww.mandiant.com%2Fresources%2Fblog%2Fdprk-whatsapp-phishing%27&dt=404%20page%20%7C%20Mandiant&en=page_view&_fv=1&_ss=1&tfd=2347
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-X6642ZTDJ7&l=dataLayer&cx=c
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:4860:4802:34::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
https://www.mandiant.com/
accept-language
de-DE,de;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

pragma
no-cache
date
Wed, 03 Apr 2024 13:42:32 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://www.mandiant.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
collect
stats.g.doubleclick.net/g/ 		0
56 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://stats.g.doubleclick.net/g/collect?v=2&_ono=1&tid=G-X6642ZTDJ7&cid=1657819941.1712151752&gtm=45je4410v883779794z8849727317za200&aip=1&dma=1&dma_cps=sypham&gcs=G111&gcd=13t3tPl2l5&npa=1
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-X6642ZTDJ7&l=dataLayer&cx=c
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:400c:c00::9d Brussels, Belgium, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
https://www.mandiant.com/
accept-language
de-DE,de;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

pragma
no-cache
date
Wed, 03 Apr 2024 13:42:32 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://www.mandiant.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
ga-audiences
www.google.de/ads/ 		42 B
63 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.de/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&_ono=1&tid=G-X6642ZTDJ7&cid=1657819941.1712151752&gtm=45je4410v883779794z8849727317za200&aip=1&dma=1&dma_cps=sypham&gcs=G111&gcd=13t3tPl2l5&npa=1&z=1086514310
Requested by
Host: www.mandiant.com
URL: https://www.mandiant.com/resources/blog/dprk-whatsapp-phishing'
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.217.16.195 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s65-in-f3.1e100.net
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
https://www.mandiant.com/
accept-language
de-DE,de;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

pragma
no-cache
date
Wed, 03 Apr 2024 13:42:32 GMT
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
px.ads.linkedin.com/wa/ 		0
198 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://px.ads.linkedin.com/wa/
Requested by
Host: snap.licdn.com
URL: https://snap.licdn.com/li.lms-analytics/insight.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:22::14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
accept-language
de-DE,de;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Content-Type
text/plain;charset=UTF-8
Accept
*
Referer
https://www.mandiant.com/
sec-ch-ua-platform
"Win32"

Response headers

date
Wed, 03 Apr 2024 13:42:32 GMT
x-li-pop
afd-prod-ltx1-x
x-msedge-ref
Ref A: CD6C8B9FA91B4645A88EEAFDC773AE1A Ref B: VIEEDGE2010 Ref C: 2024-04-03T13:42:33Z
linkedin-action
1
vary
Origin
x-cache
CONFIG_NOCACHE
x-li-fabric
prod-ltx1
access-control-allow-origin
https://www.mandiant.com
x-li-proto
http/2
access-control-allow-credentials
true
x-li-uuid
AAYVMWUODMM8p4umy+nLVQ==
974.bundle.js
www.mandiant.com/themes/custom/mandiant_theme/gnorm/build/scripts/ 		11 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.mandiant.com/themes/custom/mandiant_theme/gnorm/build/scripts/974.bundle.js?ed9f0d
Requested by
Host: www.mandiant.com
URL: https://www.mandiant.com/sites/default/files/js/js_I9wQ_8iDNCyIShn6p_-v3LsAPo4eGoxJCTGyM0JdrMc.js?scope=footer&delta=4&language=en&theme=mandiant_theme&include=eJxtUNFuwzAI_CG3fJJFMEm92CYC0sh_P69du0rZCzoOuDsxi1bPm8H8CwKm5IKtwwtcZ5XmgXZzqbFyygifTSSzYN2cK0xoHCq2QTePfuPKsLQhfTHvhe3_2deJv7N6JiwXx8kCrcPHRSMSiaYsDd7omY5b-pNQJtycbghvFPPYWRR9XHx4HYyrQUVd2SX-vOA03FQWZbM4oYaCXXaPKRvJiNhBGpOUFz_tuSRW8EMGG43p4XfPfBg86rVK2gufXJZ8jnVk5Vmx8je6jqaq
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:300b::a29f:f17d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
201492c149f68b701455a2d046549a318a76ed5bca4ab13ebd913dbd14710246
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
https://www.mandiant.com/
accept-language
de-DE,de;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

x-cache-hits
30655
date
Wed, 03 Apr 2024 13:42:37 GMT
content-encoding
gzip
via
varnish
cf-cache-status
HIT
x-content-type-options
nosniff
age
128
x-cache
HIT
x-ah-environment
prod
content-length
3375
x-request-id
v-4924b6d8-ddf8-11ee-a5b9-cf9ab82847f3
last-modified
Wed, 28 Feb 2024 06:27:09 GMT
server
cloudflare
vary
Accept-Encoding
content-type
application/javascript
cache-control
public, max-age=1209600
accept-ranges
bytes
cf-ray
86e97ba4c8033738-FRA
expires
Wed, 17 Apr 2024 13:42:37 GMT
404.bundle.js
www.mandiant.com/themes/custom/mandiant_theme/gnorm/build/scripts/ 		406 B
368 B 		Script
General
Check archive.org
Download Go to
Full URL
https://www.mandiant.com/themes/custom/mandiant_theme/gnorm/build/scripts/404.bundle.js?2c5f80
Requested by
Host: www.mandiant.com
URL: https://www.mandiant.com/sites/default/files/js/js_I9wQ_8iDNCyIShn6p_-v3LsAPo4eGoxJCTGyM0JdrMc.js?scope=footer&delta=4&language=en&theme=mandiant_theme&include=eJxtUNFuwzAI_CG3fJJFMEm92CYC0sh_P69du0rZCzoOuDsxi1bPm8H8CwKm5IKtwwtcZ5XmgXZzqbFyygifTSSzYN2cK0xoHCq2QTePfuPKsLQhfTHvhe3_2deJv7N6JiwXx8kCrcPHRSMSiaYsDd7omY5b-pNQJtycbghvFPPYWRR9XHx4HYyrQUVd2SX-vOA03FQWZbM4oYaCXXaPKRvJiNhBGpOUFz_tuSRW8EMGG43p4XfPfBg86rVK2gufXJZ8jnVk5Vmx8je6jqaq
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:300b::a29f:f17d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
b2cb383a30bee467e40ecebb49e4229b1b57efcc2c7632c921cd170a75c74d24
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
https://www.mandiant.com/
accept-language
de-DE,de;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

x-cache-hits
75996
date
Wed, 03 Apr 2024 13:42:37 GMT
content-encoding
gzip
via
varnish
cf-cache-status
HIT
x-content-type-options
nosniff
age
128
x-cache
HIT
x-ah-environment
prod
content-length
263
x-request-id
v-4e8a7900-ddf8-11ee-a0cd-ff489e3b05ac
last-modified
Wed, 28 Feb 2024 06:27:09 GMT
server
cloudflare
vary
Accept-Encoding
content-type
application/javascript
cache-control
public, max-age=1209600
accept-ranges
bytes
cf-ray
86e97ba4c8063738-FRA
expires
Wed, 17 Apr 2024 13:42:37 GMT
2a.json
www.gstatic.com/glue/cookienotificationbar/config/ 		428 B
224 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://www.gstatic.com/glue/cookienotificationbar/config/2a.json?hl=en
Requested by
Host: www.gstatic.com
URL: https://www.gstatic.com/glue/cookienotificationbar/cookienotificationbar.min.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.185.99 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s49-in-f3.1e100.net
Software
sffe /
Resource Hash
7a1a28e26e577545cac3166880d39b6188156245e5d4b532f559be34ef1476f2
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
https://www.mandiant.com/
accept-language
de-DE,de;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Wed, 03 Apr 2024 13:42:37 GMT
content-encoding
br
x-content-type-options
nosniff
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/uxe-owners-acl/gstatic
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
198
x-xss-protection
0
last-modified
Thu, 01 Feb 2024 19:58:00 GMT
server
sffe
vary
Accept-Encoding
report-to
{"group":"uxe-owners-acl/gstatic","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/uxe-owners-acl/gstatic"}]}
content-type
application/json
access-control-allow-origin
*
cache-control
private, max-age=3000
accept-ranges
bytes
cross-origin-opener-policy-report-only
same-origin; report-to="uxe-owners-acl/gstatic"
expires
Wed, 03 Apr 2024 13:42:37 GMT
0
bat.bing.com/action/ 		0
288 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://bat.bing.com/action/0?ti=5870833&tm=gtm002&Ver=2&mid=9b641985-d084-4aee-8331-accdf1490781&sid=08b057e0f1c011eeaee86379df40876f&vid=08b11d30f1c011eeb57ac71f07f01719&vids=1&msclkid=N&pi=918639831&lg=en-US&sw=800&sh=600&sc=24&tl=404%20page%20%7C%20Mandiant&p=https%3A%2F%2Fwww.mandiant.com%2Fresources%2Fblog%2Fdprk-whatsapp-phishing%27&r=&lt=7462&evt=pageLoad&sv=1&rn=448266
Requested by
Host: www.mandiant.com
URL: https://www.mandiant.com/resources/blog/dprk-whatsapp-phishing'
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
https://www.mandiant.com/
accept-language
de-DE,de;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

pragma
no-cache
strict-transport-security
max-age=31536000; includeSubDomains; preload
date
Wed, 03 Apr 2024 13:42:37 GMT
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref
Ref A: B0920487D6FF4C2F81FE34D6F1F21FC6 Ref B: DUS30EDGE0318 Ref C: 2024-04-03T13:42:37Z
x-cache
CONFIG_NOCACHE
access-control-allow-origin
*
cache-control
no-cache, must-revalidate
expires
Fri, 01 Jan 1990 00:00:00 GMT
5aUu9-KzpRiLCAt4Unrc-xIKmCU5qEp2iw.woff2
fonts.gstatic.com/s/googlesanstext/v21/ 		14 KB
15 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/googlesanstext/v21/5aUu9-KzpRiLCAt4Unrc-xIKmCU5qEp2iw.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Google+Sans+Text:wght@400&family=Google+Sans:wght@500&display=swap
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82a::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
8300ba70904617a47a80e9098fe00b3f7aefd328519318c420289b0bbdfb5e2c
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
https://fonts.googleapis.com/
Origin
https://www.mandiant.com
accept-language
de-DE,de;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Tue, 02 Apr 2024 04:48:31 GMT
x-content-type-options
nosniff
age
118446
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
14796
x-xss-protection
0
last-modified
Tue, 19 Apr 2022 18:47:06 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Wed, 02 Apr 2025 04:48:31 GMT
4Ua_rENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iqcsih3SAyH6cAwhX9RFD48TE63OOYKtrw2IJllpyk.woff2
fonts.gstatic.com/s/googlesans/v58/ 		22 KB
22 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/googlesans/v58/4Ua_rENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iqcsih3SAyH6cAwhX9RFD48TE63OOYKtrw2IJllpyk.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Google+Sans+Text:wght@400&family=Google+Sans:wght@500&display=swap
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82a::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
d7f62ccd6d9784466fb9b92202b71a63182de790d0575e13641e027b39e0590e
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
https://fonts.googleapis.com/
Origin
https://www.mandiant.com
accept-language
de-DE,de;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Mon, 01 Apr 2024 20:44:26 GMT
x-content-type-options
nosniff
age
147491
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
22308
x-xss-protection
0
last-modified
Tue, 23 May 2023 16:35:38 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Tue, 01 Apr 2025 20:44:26 GMT
6si.min.js
j.6sc.co/ 		64 KB
18 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://j.6sc.co/6si.min.js
Requested by
Host: www.mandiant.com
URL: https://www.mandiant.com/resources/blog/dprk-whatsapp-phishing'
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.16.1.168 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a2-16-1-168.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
8c1781ec4483c6fb3bd9ad005d312800eaf24e232c12976624bff84f8ab908b3
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
https://www.mandiant.com/
accept-language
de-DE,de;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

pragma
no-cache
date
Wed, 03 Apr 2024 13:42:37 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Thu, 22 Feb 2024 19:00:41 GMT
server
nginx/1.14.0 (Ubuntu)
etag
"65d799d9-101dd"
vary
Accept-Encoding
content-type
application/javascript
cache-control
private, no-cache, proxy-revalidate
accept-ranges
bytes
content-length
17693
expires
Wed, 03 Apr 2024 13:42:37 GMT
collect
www.google-analytics.com/ 		35 B
55 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google-analytics.com/collect?v=1&_v=j101&aip=1&a=231277543&t=event&ni=1&_s=1&dl=https%3A%2F%2Fwww.mandiant.com%2Fresources%2Fblog%2Fdprk-whatsapp-phishing%27&ul=en-us&de=UTF-8&dt=404%20page%20%7C%20Mandiant&sd=24-bit&sr=800x600&vp=1600x1113&je=0&ec=Resource%20Type&ea=null&el=null&_u=aGDAgEABAAAAAGAEK~&jid=&gjid=&cid=1657819941.1712151752&tid=UA-203244293-1&_gid=474147855.1712151752&gtm=45He4410n81T72STLDv849727317za200&cg1=null&cg2=resources&cd3=1712151757862.cqyvluan&cd4=2024-04-03T15%3A42%3A37.862%2B02%3A00&cd5=&cd15=null&cd16=null&cd24=unknown&gcd=13t3t3l2l5&dma_cps=sypham&dma=1&cd1=1657819941.1712151752&gcs=G111&npa=1&z=1520652025
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.217.18.14 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s22-in-f14.1e100.net
Software
Golfe2 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
https://www.mandiant.com/
accept-language
de-DE,de;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

pragma
no-cache
date
Tue, 02 Apr 2024 21:50:35 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
age
57122
content-type
image/gif
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
35
expires
Mon, 01 Jan 1990 00:00:00 GMT
collect
www.google-analytics.com/ 		35 B
55 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google-analytics.com/collect?v=1&_v=j101&aip=1&a=231277543&t=event&ni=1&_s=1&dl=https%3A%2F%2Fwww.mandiant.com%2Fresources%2Fblog%2Fdprk-whatsapp-phishing%27&ul=en-us&de=UTF-8&dt=404%20page%20%7C%20Mandiant&sd=24-bit&sr=800x600&vp=1600x1113&je=0&ec=page%20scroll&ea=25%25&el=%2Fresources%2Fblog%2Fdprk-whatsapp-phishing%27&_u=aGDAgEABAAAAAGAEK~&jid=&gjid=&cid=1657819941.1712151752&tid=UA-203244293-1&_gid=474147855.1712151752&gtm=45He4410n81T72STLDv849727317za200&cg1=null&cg2=resources&cd2=Event&cd3=1712151757923.9sa7jpwf&cd4=2024-04-03T15%3A42%3A37.923%2B02%3A00&cd5=&cd15=null&cd16=null&cd24=unknown&gcd=13t3t3l2l5&dma_cps=sypham&dma=1&cd1=1657819941.1712151752&gcs=G111&npa=1&z=1430255431
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.217.18.14 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s22-in-f14.1e100.net
Software
Golfe2 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
https://www.mandiant.com/
accept-language
de-DE,de;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

pragma
no-cache
date
Tue, 02 Apr 2024 21:50:35 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
age
57122
content-type
image/gif
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
35
expires
Mon, 01 Jan 1990 00:00:00 GMT
favicon.ico
www.mandiant.com/themes/custom/mandiant_theme/ 		41 KB
1 KB 		Other
General
Check archive.org
Download Go to
Full URL
https://www.mandiant.com/themes/custom/mandiant_theme/favicon.ico
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:300b::a29f:f17d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
41d8731c789eeefe8cfc070d37c21cf501f733c1fd736d94772b2f0d7b46a610
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
https://www.mandiant.com/
accept-language
de-DE,de;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

x-cache-hits
16778
date
Wed, 03 Apr 2024 13:42:37 GMT
via
varnish
x-content-type-options
nosniff
cf-cache-status
HIT
content-encoding
gzip
age
55
x-cache
HIT
x-ah-environment
prod
x-request-id
v-81e8be88-ddf8-11ee-adaf-cfbcd0f36ae4
last-modified
Wed, 28 Feb 2024 06:27:09 GMT
server
cloudflare
vary
Accept-Encoding
content-type
image/vnd.microsoft.icon
cache-control
public, max-age=1209600
cf-ray
86e97ba72a293738-FRA
expires
Wed, 17 Apr 2024 13:42:37 GMT
/
c.6sc.co/ 		7 B
194 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://c.6sc.co/
Requested by
Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.16.1.168 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a2-16-1-168.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
fe04a9dc88d3f3be8d4f6bc63a9a80f45a4c6d8460e7551dab849457c091920a

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
https://www.mandiant.com/
accept-language
de-DE,de;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Wed, 03 Apr 2024 13:42:38 GMT
access-control-max-age
86400
access-control-allow-methods
GET,POST
content-type
text/html
access-control-allow-origin
https://www.mandiant.com
access-control-allow-credentials
true
access-control-allow-headers
*
content-length
7
/
ipv6.6sc.co/ 		23 B
315 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://ipv6.6sc.co/
Requested by
Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:280:4::213:784c Düsseldorf, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
9396a03f992569985b844f39a0e20187bd4f89bd03b35137050ba22c50798297

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
https://www.mandiant.com/
accept-language
de-DE,de;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

pragma
no-cache
date
Wed, 03 Apr 2024 13:42:38 GMT
vary
Origin
content-type
text/html
access-control-allow-origin
https://www.mandiant.com
cache-control
max-age=0, no-cache, no-store
6si-ipv6
2001:1b60:2:240:3247::2
server-timing
cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="1712151758092_34830156_82718091_14_552_33_69_219";dur=1
content-length
23
expires
Wed, 03 Apr 2024 13:42:38 GMT
img.gif
b.6sc.co/v1/beacon/ 		43 B
484 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=627b22264f359a2be8e661bd05849ae6&svisitor=null&visitor=1507a071-e664-48da-803c-0f3574b2d17d&session=a74ec338-8900-4856-8e36-bf495a38d56d&event=a_pageload&q=%7B%22pageLoadTime%22%3A%22Wed%2C%2003%20Apr%202024%2013%3A42%3A38%20GMT%22%7D&isIframe=false&m=%7B%22description%22%3A%22%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22404%20page%20%7C%20Mandiant%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.mandiant.com%2Fresources%2Fblog%2Fdprk-whatsapp-phishing%27&pageViewId=7928f357-32e7-4d33-849c-6b5a32fb2b42&v=1.1.15
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.16.1.168 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a2-16-1-168.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
https://www.mandiant.com/
accept-language
de-DE,de;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Wed, 03 Apr 2024 13:42:38 GMT
x-content-type-options
nosniff
content-length
43
pragma
no-cache
last-modified
Sat, 05 Jun 2021 07:56:05 GMT
server
nginx/1.14.0 (Ubuntu)
etag
"60bb2e15-2b"
access-control-max-age
86400
access-control-allow-methods
GET,POST
content-type
image/gif
access-control-allow-origin
cache-control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials
true
accept-ranges
bytes
access-control-allow-headers
*
expires
Wed, 19 Apr 2000 11:43:00 GMT
img.gif
b.6sc.co/v1/beacon/ 		43 B
483 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=627b22264f359a2be8e661bd05849ae6&svisitor=null&visitor=1507a071-e664-48da-803c-0f3574b2d17d&session=a74ec338-8900-4856-8e36-bf495a38d56d&event=ni%3AasyncSettingsAudit&q=%7B%22settings%22%3A%22%5B%7B%5C%22name%5C%22%3A%5C%22enableEventTracking%5C%22%2C%5C%22value%5C%22%3A%5C%22true%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Wed%2C%2003%20Apr%202024%2013%3A42%3A38%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setToken%5C%22%2C%5C%22value%5C%22%3A%5C%22627b22264f359a2be8e661bd05849ae6%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Wed%2C%2003%20Apr%202024%2013%3A42%3A38%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setEndpoint%5C%22%2C%5C%22value%5C%22%3A%5C%22b.6sc.co%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Wed%2C%2003%20Apr%202024%2013%3A42%3A38%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22enableRetargeting%5C%22%2C%5C%22value%5C%22%3A%5C%22false%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Wed%2C%2003%20Apr%202024%2013%3A42%3A38%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%5D%22%7D&isIframe=false&m=%7B%22description%22%3A%22%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22404%20page%20%7C%20Mandiant%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.mandiant.com%2Fresources%2Fblog%2Fdprk-whatsapp-phishing%27&pageViewId=7928f357-32e7-4d33-849c-6b5a32fb2b42&v=1.1.15
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.16.1.168 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a2-16-1-168.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
https://www.mandiant.com/
accept-language
de-DE,de;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Wed, 03 Apr 2024 13:42:38 GMT
x-content-type-options
nosniff
content-length
43
pragma
no-cache
last-modified
Tue, 05 Oct 2021 22:17:52 GMT
server
nginx/1.14.0 (Ubuntu)
etag
"615ccf10-2b"
access-control-max-age
86400
access-control-allow-methods
GET,POST
content-type
image/gif
access-control-allow-origin
cache-control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials
true
accept-ranges
bytes
access-control-allow-headers
*
expires
Wed, 19 Apr 2000 11:43:00 GMT
img.gif
b.6sc.co/v1/beacon/ 		43 B
483 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=627b22264f359a2be8e661bd05849ae6&svisitor=null&visitor=1507a071-e664-48da-803c-0f3574b2d17d&session=a74ec338-8900-4856-8e36-bf495a38d56d&event=ipv6&q=%7B%22address%22%3A%222001%3A1b60%3A2%3A240%3A3247%3A%3A2%22%7D&isIframe=false&m=%7B%22description%22%3A%22%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22404%20page%20%7C%20Mandiant%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.mandiant.com%2Fresources%2Fblog%2Fdprk-whatsapp-phishing%27&pageViewId=7928f357-32e7-4d33-849c-6b5a32fb2b42&v=1.1.15
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.16.1.168 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a2-16-1-168.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
https://www.mandiant.com/
accept-language
de-DE,de;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Wed, 03 Apr 2024 13:42:38 GMT
x-content-type-options
nosniff
content-length
43
pragma
no-cache
last-modified
Tue, 05 Oct 2021 22:17:52 GMT
server
nginx/1.14.0 (Ubuntu)
etag
"615ccf10-2b"
access-control-max-age
86400
access-control-allow-methods
GET,POST
content-type
image/gif
access-control-allow-origin
cache-control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials
true
accept-ranges
bytes
access-control-allow-headers
*
expires
Wed, 19 Apr 2000 11:43:00 GMT
img.gif
b.6sc.co/v1/beacon/ 		43 B
484 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=627b22264f359a2be8e661bd05849ae6&svisitor=null&visitor=1507a071-e664-48da-803c-0f3574b2d17d&session=a74ec338-8900-4856-8e36-bf495a38d56d&event=active_time_track&q=%7B%22currentTime%22%3A%22Wed%2C%2003%20Apr%202024%2013%3A42%3A39%20GMT%22%2C%22lastTrackTime%22%3A%22Wed%2C%2003%20Apr%202024%2013%3A42%3A38%20GMT%22%2C%22timeSpent%22%3A%221004%22%2C%22totalTimeSpent%22%3A%221004%22%7D&isIframe=false&m=%7B%22description%22%3A%22%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22404%20page%20%7C%20Mandiant%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.mandiant.com%2Fresources%2Fblog%2Fdprk-whatsapp-phishing%27&pageViewId=7928f357-32e7-4d33-849c-6b5a32fb2b42&v=1.1.15
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.16.1.168 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a2-16-1-168.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
https://www.mandiant.com/
accept-language
de-DE,de;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Wed, 03 Apr 2024 13:42:39 GMT
x-content-type-options
nosniff
content-length
43
pragma
no-cache
last-modified
Sat, 18 Feb 2023 01:45:17 GMT
server
nginx/1.14.0 (Ubuntu)
etag
"63f02dad-2b"
access-control-max-age
86400
access-control-allow-methods
GET,POST
content-type
image/gif
access-control-allow-origin
cache-control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials
true
accept-ranges
bytes
access-control-allow-headers
*
expires
Wed, 19 Apr 2000 11:43:00 GMT
anchor
www.google.com/recaptcha/api2/ Frame 434A 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LdhgBgUAAAAAILakhHCM8iL5pygGB4jLnJbJFfq&co=aHR0cHM6Ly93d3cubWFuZGlhbnQuY29tOjQ0Mw..&hl=de&v=moV1mTgQ6S91nuTnmll4Y9yf&size=normal&cb=6b100u4ga2o6
Requested by
Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/moV1mTgQ6S91nuTnmll4Y9yf/recaptcha__de.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.184.228 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s12-in-f4.1e100.net
Software
GSE /
Resource Hash
Security Headers
Name Value
Content-Security-Policy script-src 'report-sample' 'nonce-RiG_OvxnuGGOs8wuucdG1g' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.mandiant.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
accept-language
de-DE,de;q=0.9
sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-mobile
?0
sec-ch-ua-platform
"Win32"

Response headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
no-cache, no-store, max-age=0, must-revalidate
content-encoding
gzip
content-security-policy
script-src 'report-sample' 'nonce-RiG_OvxnuGGOs8wuucdG1g' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type
text/html; charset=utf-8
cross-origin-embedder-policy
require-corp
cross-origin-resource-policy
cross-origin
date
Wed, 03 Apr 2024 13:42:39 GMT
expires
Mon, 01 Jan 1990 00:00:00 GMT
pragma
no-cache
report-to
{"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server
GSE
x-content-type-options
nosniff
x-xss-protection
1; mode=block
anchor
www.google.com/recaptcha/api2/ Frame B4CE 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LdhgBgUAAAAAILakhHCM8iL5pygGB4jLnJbJFfq&co=aHR0cHM6Ly93d3cubWFuZGlhbnQuY29tOjQ0Mw..&hl=de&v=moV1mTgQ6S91nuTnmll4Y9yf&size=compact&cb=hxwfuw1yc97c
Requested by
Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/moV1mTgQ6S91nuTnmll4Y9yf/recaptcha__de.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.184.228 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s12-in-f4.1e100.net
Software
GSE /
Resource Hash
Security Headers
Name Value
Content-Security-Policy script-src 'report-sample' 'nonce-irQtn6DqixP_sxcqAiW9Vg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.mandiant.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
accept-language
de-DE,de;q=0.9
sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-mobile
?0
sec-ch-ua-platform
"Win32"

Response headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
no-cache, no-store, max-age=0, must-revalidate
content-encoding
gzip
content-security-policy
script-src 'report-sample' 'nonce-irQtn6DqixP_sxcqAiW9Vg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type
text/html; charset=utf-8
cross-origin-embedder-policy
require-corp
cross-origin-resource-policy
cross-origin
date
Wed, 03 Apr 2024 13:42:39 GMT
expires
Mon, 01 Jan 1990 00:00:00 GMT
pragma
no-cache
report-to
{"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server
GSE
x-content-type-options
nosniff
x-xss-protection
1; mode=block
img.gif
b.6sc.co/v1/beacon/ 		43 B
483 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=627b22264f359a2be8e661bd05849ae6&svisitor=null&visitor=1507a071-e664-48da-803c-0f3574b2d17d&session=a74ec338-8900-4856-8e36-bf495a38d56d&event=active_time_track&q=%7B%22currentTime%22%3A%22Wed%2C%2003%20Apr%202024%2013%3A42%3A40%20GMT%22%2C%22lastTrackTime%22%3A%22Wed%2C%2003%20Apr%202024%2013%3A42%3A39%20GMT%22%2C%22timeSpent%22%3A%221002%22%2C%22totalTimeSpent%22%3A%222006%22%7D&isIframe=false&m=%7B%22description%22%3A%22%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22404%20page%20%7C%20Mandiant%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.mandiant.com%2Fresources%2Fblog%2Fdprk-whatsapp-phishing%27&pageViewId=7928f357-32e7-4d33-849c-6b5a32fb2b42&v=1.1.15
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.16.1.168 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a2-16-1-168.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
https://www.mandiant.com/
accept-language
de-DE,de;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Wed, 03 Apr 2024 13:42:40 GMT
x-content-type-options
nosniff
content-length
43
pragma
no-cache
last-modified
Sat, 18 Feb 2023 00:49:36 GMT
server
nginx/1.14.0 (Ubuntu)
etag
"63f020a0-2b"
access-control-max-age
86400
access-control-allow-methods
GET,POST
content-type
image/gif
access-control-allow-origin
cache-control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials
true
accept-ranges
bytes
access-control-allow-headers
*
expires
Wed, 19 Apr 2000 11:43:00 GMT
bframe
www.google.com/recaptcha/api2/ Frame 0066 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://www.google.com/recaptcha/api2/bframe?hl=de&v=moV1mTgQ6S91nuTnmll4Y9yf&k=6LdhgBgUAAAAAILakhHCM8iL5pygGB4jLnJbJFfq
Requested by
Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/moV1mTgQ6S91nuTnmll4Y9yf/recaptcha__de.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.184.228 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s12-in-f4.1e100.net
Software
GSE /
Resource Hash
Security Headers
Name Value
Content-Security-Policy script-src 'report-sample' 'nonce-fP9ZATjv0e6q094LPr5bmA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.mandiant.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
accept-language
de-DE,de;q=0.9
sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-mobile
?0
sec-ch-ua-platform
"Win32"

Response headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
no-cache, no-store, max-age=0, must-revalidate
content-encoding
gzip
content-security-policy
script-src 'report-sample' 'nonce-fP9ZATjv0e6q094LPr5bmA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type
text/html; charset=utf-8
cross-origin-embedder-policy
require-corp
cross-origin-resource-policy
cross-origin
date
Wed, 03 Apr 2024 13:42:40 GMT
expires
Mon, 01 Jan 1990 00:00:00 GMT
pragma
no-cache
report-to
{"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server
GSE
x-content-type-options
nosniff
x-xss-protection
1; mode=block
bframe
www.google.com/recaptcha/api2/ Frame 3B28 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://www.google.com/recaptcha/api2/bframe?hl=de&v=moV1mTgQ6S91nuTnmll4Y9yf&k=6LdhgBgUAAAAAILakhHCM8iL5pygGB4jLnJbJFfq
Requested by
Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/moV1mTgQ6S91nuTnmll4Y9yf/recaptcha__de.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.184.228 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s12-in-f4.1e100.net
Software
GSE /
Resource Hash
Security Headers
Name Value
Content-Security-Policy script-src 'report-sample' 'nonce-xNcktohGy2br9-wVcPsNYA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.mandiant.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
accept-language
de-DE,de;q=0.9
sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-mobile
?0
sec-ch-ua-platform
"Win32"

Response headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
no-cache, no-store, max-age=0, must-revalidate
content-encoding
gzip
content-security-policy
script-src 'report-sample' 'nonce-xNcktohGy2br9-wVcPsNYA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type
text/html; charset=utf-8
cross-origin-embedder-policy
require-corp
cross-origin-resource-policy
cross-origin
date
Wed, 03 Apr 2024 13:42:40 GMT
expires
Mon, 01 Jan 1990 00:00:00 GMT
pragma
no-cache
report-to
{"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server
GSE
x-content-type-options
nosniff
x-xss-protection
1; mode=block
img.gif
b.6sc.co/v1/beacon/ 		43 B
484 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=627b22264f359a2be8e661bd05849ae6&svisitor=null&visitor=1507a071-e664-48da-803c-0f3574b2d17d&session=a74ec338-8900-4856-8e36-bf495a38d56d&event=active_time_track&q=%7B%22currentTime%22%3A%22Wed%2C%2003%20Apr%202024%2013%3A42%3A41%20GMT%22%2C%22lastTrackTime%22%3A%22Wed%2C%2003%20Apr%202024%2013%3A42%3A40%20GMT%22%2C%22timeSpent%22%3A%221002%22%2C%22totalTimeSpent%22%3A%223008%22%7D&isIframe=false&m=%7B%22description%22%3A%22%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22404%20page%20%7C%20Mandiant%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.mandiant.com%2Fresources%2Fblog%2Fdprk-whatsapp-phishing%27&pageViewId=7928f357-32e7-4d33-849c-6b5a32fb2b42&v=1.1.15
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.16.1.168 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a2-16-1-168.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
https://www.mandiant.com/
accept-language
de-DE,de;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Wed, 03 Apr 2024 13:42:41 GMT
x-content-type-options
nosniff
content-length
43
pragma
no-cache
last-modified
Sat, 18 Feb 2023 01:45:17 GMT
server
nginx/1.14.0 (Ubuntu)
etag
"63f02dad-2b"
access-control-max-age
86400
access-control-allow-methods
GET,POST
content-type
image/gif
access-control-allow-origin
cache-control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials
true
accept-ranges
bytes
access-control-allow-headers
*
expires
Wed, 19 Apr 2000 11:43:00 GMT
img.gif
b.6sc.co/v1/beacon/ 		43 B
484 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=627b22264f359a2be8e661bd05849ae6&svisitor=null&visitor=1507a071-e664-48da-803c-0f3574b2d17d&session=a74ec338-8900-4856-8e36-bf495a38d56d&event=active_time_track&q=%7B%22currentTime%22%3A%22Wed%2C%2003%20Apr%202024%2013%3A42%3A42%20GMT%22%2C%22lastTrackTime%22%3A%22Wed%2C%2003%20Apr%202024%2013%3A42%3A41%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%224009%22%7D&isIframe=false&m=%7B%22description%22%3A%22%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22404%20page%20%7C%20Mandiant%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.mandiant.com%2Fresources%2Fblog%2Fdprk-whatsapp-phishing%27&pageViewId=7928f357-32e7-4d33-849c-6b5a32fb2b42&v=1.1.15
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.16.1.168 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a2-16-1-168.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
https://www.mandiant.com/
accept-language
de-DE,de;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Wed, 03 Apr 2024 13:42:42 GMT
x-content-type-options
nosniff
content-length
43
pragma
no-cache
last-modified
Sat, 18 Feb 2023 01:45:17 GMT
server
nginx/1.14.0 (Ubuntu)
etag
"63f02dad-2b"
access-control-max-age
86400
access-control-allow-methods
GET,POST
content-type
image/gif
access-control-allow-origin
cache-control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials
true
accept-ranges
bytes
access-control-allow-headers
*
expires
Wed, 19 Apr 2000 11:43:00 GMT

Verdicts & Comments Add Verdict or Comment

80 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| 1 object| 2 object| 3 object| 4 object| 5 object| 6 object| a2a_config object| script object| dataLayer object| google_tag_manager object| google_tag_data function| twq string| _linkedin_data_partner_id function| fbq function| _fbq object| _fbq_gtm_ids string| GoogleAnalyticsObject function| ga function| hj object| _hjSettings function| gtag string| SLScoutObject function| slscout function| once undefined| $ function| jQuery object| drupalSettings object| Drupal object| ___grecaptcha_cfg object| grecaptcha string| __recaptcha_api boolean| __google_recaptcha_client object| a2a function| a2a_init function| onYouTubeIframeAPIReady object| hjSiteSettings function| hjBootstrap object| hjLazyModules object| hjBootstrapCalled object| gaplugins object| gaGlobal object| gaData function| UET function| UET_init function| UET_push function| mktoMunchkinFunction object| Munchkin function| mktoMunchkin object| regeneratorRuntime object| twttr function| lintrk boolean| _already_called_lintrk object| ueto_d391de3b46 object| uetq object| recaptcha object| MunchkinTracker object| ORIBILI function| ScrollReveal number| piesiteFired undefined| timer undefined| timerFinish undefined| timerSeconds undefined| b function| drawTimer function| stoppie object| owl function| isInViewport object| webpackChunk function| setImmediate function| clearImmediate object| lazySizes object| AOS object| google function| onVidyardAPI object| module$exports$google3$marketing$glue$lib$cookienotificationbar$cdn object| glue function| CaptchaCallback object| _6si object| closure_lm_837025

28 Cookies

Domain/Path Name / Value
.mandiant.com/ Name: __cf_bm
Value: ZPKQtpzggen_xCdAuVvAMqmktCANZnCmVX1Rnir8EGQ-1712151750-1.0.1.1-pVhyEy9hbSkwhnMyUdFOer0hnoMw9OhCV02adhsH0PSeM637SxfjPMeEnlcnSYQIelgCsJ4ONcZGxEPhTy0SBQ
.mandiant.com/ Name: _gcl_au
Value: 1.1.1643445624.1712151752
.mandiant.com/ Name: _gid
Value: GA1.2.474147855.1712151752
.mandiant.com/ Name: _dc_gtm_UA-203244293-1
Value: 1
.mandiant.com/ Name: _fbp
Value: fb.1.1712151752089.1566227149
.mandiant.com/ Name: _mkto_trk
Value: id:565-PEI-952&token:_mch-mandiant.com-1712151752097-15610
.t.co/ Name: muc_ads
Value: 32160b19-8822-466e-be2d-ecc212bcf4e7
.twitter.com/ Name: personalization_id
Value: "v1_DCL3Y0dBb5ajDLPKl0AjMw=="
.linkedin.com/ Name: li_sugr
Value: c002ca50-dedf-4a56-846d-5ec82447527f
.linkedin.com/ Name: bcookie
Value: "v=2&fb5793c1-e229-41a8-8840-fda764f3026b"
.linkedin.com/ Name: lidc
Value: "b=TGST09:s=T:r=T:a=T:p=T:g=2734:u=1:x=1:i=1712151752:t=1712238152:v=2:sig=AQHvWkXpo8GtgKd4PPlzLq9GA9HGT_87"
www.mandiant.com/ Name: slireg
Value: https://scout.us3.salesloft.com
.linkedin.com/ Name: UserMatchHistory
Value: AQKK5lZNr0UppwAAAY6kMm7WzkzgoCd4pYinaomkU8aPbbXdeq3wmwK_8aaQcYys0AwJXdF4RLdfDw
.linkedin.com/ Name: AnalyticsSyncHistory
Value: AQIKWXbtlv-wOwAAAY6kMm7Wx0czD9sSHiG8JjnIA8s8aGVm-rzaDqm2l73C99SeQ8CPrYuEZ0hypqrcnSYsgQ
www.mandiant.com/ Name: sliguid
Value: 80a61727-6ff3-4726-8a2e-3cafc30f6978
www.mandiant.com/ Name: slirequested
Value: true
.www.linkedin.com/ Name: bscookie
Value: "v=1&20240403134232c77bac97-7f15-4493-8a8a-6c60658900afAQGg9LRztzBxCumeXqvFRyx3Rek3C5t7"
.linkedin.com/ Name: li_gc
Value: MTswOzE3MTIxNTE3NTI7MjswMjFASYfx10dgwsW4enbGBeUvd1OhLuqDpZfWR+c0Lis+fQ==
.mandiant.com/ Name: _hjSessionUser_3008912
Value: eyJpZCI6ImFmNzU2N2UzLTljYmQtNWM0Yy05MDBjLWI5ZmE4ZTBjZTVmMSIsImNyZWF0ZWQiOjE3MTIxNTE3NTc2MDIsImV4aXN0aW5nIjpmYWxzZX0=
.mandiant.com/ Name: _hjSession_3008912
Value: eyJpZCI6IjJkODRkNGZlLTM4NjQtNGFlNS05ZGRhLTg3MTYyYjRlMGE1ZiIsImMiOjE3MTIxNTE3NTc2MDgsInMiOjAsInIiOjAsInNiIjowLCJzciI6MCwic2UiOjAsImZzIjoxLCJzcCI6MH0=
.mandiant.com/ Name: _uetsid
Value: 08b057e0f1c011eeaee86379df40876f
.mandiant.com/ Name: _uetvid
Value: 08b11d30f1c011eeb57ac71f07f01719
.bing.com/ Name: MUID
Value: 05A3ABA2E8766A56214ABFF4E9B66B1A
.mandiant.com/ Name: _ga
Value: GA1.2.1657819941.1712151752
.mandiant.com/ Name: _ga_X6642ZTDJ7
Value: GS1.1.1712151751.1.0.1712151757.54.0.0
www.mandiant.com/ Name: _gd_visitor
Value: 1507a071-e664-48da-803c-0f3574b2d17d
www.mandiant.com/ Name: _gd_session
Value: a74ec338-8900-4856-8e36-bf495a38d56d
.6sc.co/ Name: 6suuid
Value: a401100214a40000ce5c0d668201000043140400

51 Console Messages

Source Level URL
Text
network error URL: https://www.mandiant.com/resources/blog/dprk-whatsapp-phishing'
Message:
Failed to load resource: the server responded with a status of 404 ()
other warning URL: https://connect.facebook.net/signals/config/880805232811859?v=2.9.151&r=stable&domain=www.mandiant.com&hme=8ce74e881727851b4427183947937854816d72704925561b9de6420cd43214ee&ex_m=66%2C111%2C98%2C102%2C57%2C3%2C92%2C65%2C15%2C90%2C83%2C48%2C50%2C157%2C160%2C171%2C167%2C168%2C170%2C28%2C93%2C49%2C72%2C169%2C152%2C155%2C164%2C165%2C172%2C120%2C14%2C47%2C176%2C175%2C122%2C17%2C32%2C36%2C1%2C40%2C61%2C62%2C63%2C67%2C87%2C16%2C13%2C89%2C86%2C85%2C99%2C101%2C35%2C100%2C29%2C25%2C153%2C156%2C129%2C27%2C10%2C11%2C12%2C5%2C6%2C24%2C21%2C22%2C53%2C58%2C60%2C70%2C94%2C26%2C71%2C8%2C7%2C75%2C45%2C20%2C96%2C95%2C9%2C19%2C18%2C77%2C82%2C44%2C43%2C81%2C37%2C39%2C80%2C52%2C78%2C31%2C41%2C34%2C69%2C0%2C88%2C4%2C84%2C76%2C79%2C2%2C33%2C59%2C38%2C97%2C42%2C74%2C64%2C103%2C56%2C55%2C30%2C91%2C54%2C51%2C46%2C73%2C68%2C23%2C104(Line 97)
Message:
Unrecognized feature: 'attribution-reporting'.
other warning URL: https://www.mandiant.com/resources/blog/dprk-whatsapp-phishing'
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://www.mandiant.com/resources/blog/dprk-whatsapp-phishing'
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://www.mandiant.com/resources/blog/dprk-whatsapp-phishing'
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://www.mandiant.com/resources/blog/dprk-whatsapp-phishing'
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://www.mandiant.com/resources/blog/dprk-whatsapp-phishing'
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://www.mandiant.com/resources/blog/dprk-whatsapp-phishing'
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://www.mandiant.com/resources/blog/dprk-whatsapp-phishing'
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://www.mandiant.com/resources/blog/dprk-whatsapp-phishing'
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://www.mandiant.com/resources/blog/dprk-whatsapp-phishing'
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://www.mandiant.com/resources/blog/dprk-whatsapp-phishing'
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://www.mandiant.com/resources/blog/dprk-whatsapp-phishing'
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://www.mandiant.com/resources/blog/dprk-whatsapp-phishing'
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://www.mandiant.com/resources/blog/dprk-whatsapp-phishing'
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://www.mandiant.com/resources/blog/dprk-whatsapp-phishing'
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://www.mandiant.com/resources/blog/dprk-whatsapp-phishing'
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://www.mandiant.com/resources/blog/dprk-whatsapp-phishing'
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://www.mandiant.com/resources/blog/dprk-whatsapp-phishing'
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://www.mandiant.com/resources/blog/dprk-whatsapp-phishing'
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://www.mandiant.com/resources/blog/dprk-whatsapp-phishing'
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://www.mandiant.com/resources/blog/dprk-whatsapp-phishing'
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://www.mandiant.com/resources/blog/dprk-whatsapp-phishing'
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://www.mandiant.com/resources/blog/dprk-whatsapp-phishing'
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://www.mandiant.com/resources/blog/dprk-whatsapp-phishing'
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://www.mandiant.com/resources/blog/dprk-whatsapp-phishing'
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://www.mandiant.com/resources/blog/dprk-whatsapp-phishing'
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://www.mandiant.com/resources/blog/dprk-whatsapp-phishing'
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://www.mandiant.com/resources/blog/dprk-whatsapp-phishing'
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://www.mandiant.com/resources/blog/dprk-whatsapp-phishing'
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://www.mandiant.com/resources/blog/dprk-whatsapp-phishing'
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://www.mandiant.com/resources/blog/dprk-whatsapp-phishing'
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://www.mandiant.com/resources/blog/dprk-whatsapp-phishing'
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://www.mandiant.com/resources/blog/dprk-whatsapp-phishing'
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://www.mandiant.com/resources/blog/dprk-whatsapp-phishing'
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://www.mandiant.com/resources/blog/dprk-whatsapp-phishing'
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://www.mandiant.com/resources/blog/dprk-whatsapp-phishing'
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://www.mandiant.com/resources/blog/dprk-whatsapp-phishing'
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://www.mandiant.com/resources/blog/dprk-whatsapp-phishing'
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://www.mandiant.com/resources/blog/dprk-whatsapp-phishing'
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://www.mandiant.com/resources/blog/dprk-whatsapp-phishing'
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://www.mandiant.com/resources/blog/dprk-whatsapp-phishing'
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://www.mandiant.com/resources/blog/dprk-whatsapp-phishing'
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://www.mandiant.com/resources/blog/dprk-whatsapp-phishing'
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://www.mandiant.com/resources/blog/dprk-whatsapp-phishing'
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://www.mandiant.com/resources/blog/dprk-whatsapp-phishing'
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://www.mandiant.com/resources/blog/dprk-whatsapp-phishing'
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://www.mandiant.com/resources/blog/dprk-whatsapp-phishing'
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://www.mandiant.com/resources/blog/dprk-whatsapp-phishing'
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://www.mandiant.com/resources/blog/dprk-whatsapp-phishing'
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://www.mandiant.com/resources/blog/dprk-whatsapp-phishing'
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Content-Security-Policy report-uri /report-csp-violation
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

565-pei-952.mktoresp.com
analytics.twitter.com
b.6sc.co
bat.bing.com
c.6sc.co
cdn4.iconfinder.com
cdnjs.cloudflare.com
connect.facebook.net
fonts.googleapis.com
fonts.gstatic.com
ipv6.6sc.co
j.6sc.co
munchkin.marketo.net
px.ads.linkedin.com
px4.ads.linkedin.com
region1.analytics.google.com
scout-cdn.salesloft.com
scout.salesloft.com
script.hotjar.com
snap.licdn.com
static.addtoany.com
static.ads-twitter.com
static.hotjar.com
stats.g.doubleclick.net
t.co
www.facebook.com
www.google-analytics.com
www.google.com
www.google.de
www.googletagmanager.com
www.gstatic.com
www.linkedin.com
www.mandiant.com
104.17.24.14
104.244.42.195
104.244.42.69
13.107.42.14
13.32.27.21
142.250.184.228
142.250.185.99
146.75.120.157
172.217.16.195
172.217.18.14
172.66.41.45
172.67.39.148
18.66.102.53
192.28.144.124
2.16.1.168
2001:4860:4802:34::36
23.192.243.198
2606:4700:300b::a29f:f17d
2606:4700::6810:4869
2620:1ec:22::14
2620:1ec:c11::200
2a00:1450:4001:80f::2003
2a00:1450:4001:810::200a
2a00:1450:4001:811::2008
2a00:1450:4001:81c::200e
2a00:1450:4001:82a::2003
2a00:1450:400c:c00::9d
2a02:26f0:280:4::213:784c
2a02:26f0:280:6::213:7ad8
2a03:2880:f084:105:face:b00c:0:3
2a03:2880:f177:185:face:b00c:0:25de
52.44.115.82
047e3259b6f0b42d781532fa122b2d8de9aed187d766fd45efcf119450eeb4c4
0b617a1a9d405a304eae1f3337639a1be619633a047ccac0a61d70cf2d2032e4
0bfa1752ac3abc016e5400217138461e45bb2c28a9b6e7798bbc077f7fc8dba1
0f2e61cd1a10aebb0eae1a2f6914784a4d9be90a46b1c67700311d0f66d3e379
1bb508d41bf1d0c5d56340c7df789b6589350a5f967e1fa937bee5c148d0cb0d
1cfea949b0b2925d27b84d56d18f2ea1c6b948fdf3ae95c534a14706043da178
1cffc2b3146584685cd72751d7f28aa030ab9ae2f1bc78f2c27909f8d8287b26
201492c149f68b701455a2d046549a318a76ed5bca4ab13ebd913dbd14710246
219b652de3176257072749c876811cc963494f5fbdee3f92eb38e7392f724ce0
261e44bd5998183c1bde239149a4be112fd5afd76c1efb12da82f24cf20561d4
3245f6cb8d40eebea048a60b056d9a48cbc3e1b0309a0a4cb0e51280f6b0c712
3f62182e24e60ce1bb83311468aa98d9a5f35ee93c65755aa82047fc9be72f5c
41d8731c789eeefe8cfc070d37c21cf501f733c1fd736d94772b2f0d7b46a610
4a007af67f716c30c8848ab0ad0bfaab8a5fcf3e36dedf918b59c9429d522440
4d15ff2317e16ccd8ca1d3248fea7d91130e022369bb032824a84ad9967064df
4fa7ca84dc3a040c7199206d3554b4b57d6cbb5c49ef435f674103587640d26a
5206536707c84baa892d3c3231b351985ee828cb8b9c0bd8db42cd3363995fc4
541ac58217a8ade1a5e292a65a0661dc9db7a49ae13654943817a4fbc6761afd
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3
591ec898579fc34d46d85f9b22fa8fcfa88465454caa0d86d03e9e6dc0675f9b
5d0ae0d3e2662265f917891f158ecc5de9fbfcd40cbe8a42a584fd8f132e66f0
68cc280ce370c6f1f51a4fc5950103fc38df80a429552c549add04ebd8bd3a23
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
6b9c3158d7700a96a2fc4de59adc0c4724338c900d14b9447653c52d50df1621
6cdc249fe2d6f4d8e895f3033d11e4b917dcfa03ef5447665ba53b92192a59f4
74397437d41d0ef91b6ac1cbd4edb0c5fb809cd9299cccf6adde7b5b8937e79f
7762b4265e6050c33745fd1fae5110f9f265564f0a85d9ac01efaa65029db59c
7a1a28e26e577545cac3166880d39b6188156245e5d4b532f559be34ef1476f2
7a4a5963f0b2a67a210867692d0f09d9c8a203dbaf7856b5617650260aa422d2
823804a7807864b44093a3843788f4cd076e89cf4a6fdeb8d153ae5c2c2df721
8300ba70904617a47a80e9098fe00b3f7aefd328519318c420289b0bbdfb5e2c
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
85a881fba590ac097d83e7d5397c82c99d9538ac482af8f10a3e5886393cfc85
8a3d8c061a2a585985a71d5b1a45c424c5bc79b310c86b4731b5bececf5ea5df
8a7b82ca2e7779906e5ed103e6aea92ad41856bf2265ac009947b59b0d752f06
8c1781ec4483c6fb3bd9ad005d312800eaf24e232c12976624bff84f8ab908b3
938b626c492d3a7a1a0c5c7c5ecfe2fdcb66be5d7fa8022b94472827db2c2d15
9396a03f992569985b844f39a0e20187bd4f89bd03b35137050ba22c50798297
9ec192b1be13b5eb7d11e7c8a0f1466ef236e4ba88182bb4cec76a2c7919464e
a9b7a66985bebc105b4b12f2f466fae88b9b16fe17ea5bc1d515753258a0be19
aa4ddb0e0c3bda5d6e61d56a544a7ff9ea3691eaa5126187daa6ed1875ba93e7
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
b2cb383a30bee467e40ecebb49e4229b1b57efcc2c7632c921cd170a75c74d24
d1f342663d93d5a097621c882599f5d389e4a54d813696b147a61af2fdae182b
d7f62ccd6d9784466fb9b92202b71a63182de790d0575e13641e027b39e0590e
d8885f82460cd5977ef2f391c02cad23cd0262b3d9ec42c4aa92a1ecad0bf461
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd
dfaed587b938cc953c5008f257ed1e661e9d2e2f907bd5b520fc4b9348985a88
e1cd8e9c3c0e2ec3111f46d6ba125fe1726b7933055503563d7d88ec48089ea8
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e9474894bf64b11c40884f83b0ba6888635bf90bfaae11db1944d99771f1c820
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
eff90f9963c3d3750fb8160f6bb1d751843ce289283efd295b2ebd1583dccb91
f269cafacd48c650b7c76973b7192a4593125d9b957bfa3b57a89e835ec0df1f
f3212d7385c327317abf55280e4e949368eeda26977bbed7761a5a22fc2e2202
fe04a9dc88d3f3be8d4f6bc63a9a80f45a4c6d8460e7551dab849457c091920a
fe3bfdac05de97234a1a81c7f09c87f14708cf7bd9a341a63e68613c3c6e40d6