www.group-ib.com Open in urlscan Pro
3.72.181.255  Public Scan

15 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

1. https://www.group-ib.com/media-center/press-releases/phishing-kits-2022/ Page URL
2. https://www.group-ib.com/media-center/press-releases/phishing-kits-2022/ Page URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 71

• https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=4443393&time=1685011318110&url=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fphishing-kits-2022%2F HTTP 302
• https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=4443393&time=1685011318110&url=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fphishing-kits-2022%2F&cookiesTest=true HTTP 302
• https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D4443393%26time%3D1685011318110%26url%3Dhttps%253A%252F%252Fwww.group-ib.com%252Fmedia-center%252Fpress-releases%252Fphishing-kits-2022%252F%26cookiesTest%3Dtrue%26liSync%3Dtrue HTTP 302
• https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=4443393&time=1685011318110&url=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fphishing-kits-2022%2F&cookiesTest=true&liSync=true HTTP 302
• https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=4443393&time=1685011318110&url=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fphishing-kits-2022%2F&cookiesTest=true&liSync=true&e_ipv6=AQLVClXIL-NskAAAAYhSgEhnZc3I7j8kQHPOxryfXRvJHJbqRir-1HKA7ILu_uZJLKtE2yOogu962Q

Request Chain 78

• https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=4496601%2C4443393&time=1685011318135&url=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fphishing-kits-2022%2F&tm=gtmv2 HTTP 302
• https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=4496601%2C4443393&time=1685011318135&url=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fphishing-kits-2022%2F&tm=gtmv2&cookiesTest=true HTTP 302
• https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D4496601%252C4443393%26time%3D1685011318135%26url%3Dhttps%253A%252F%252Fwww.group-ib.com%252Fmedia-center%252Fpress-releases%252Fphishing-kits-2022%252F%26tm%3Dgtmv2%26cookiesTest%3Dtrue%26liSync%3Dtrue HTTP 302
• https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=4496601%2C4443393&time=1685011318135&url=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fphishing-kits-2022%2F&tm=gtmv2&cookiesTest=true&liSync=true HTTP 302
• https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=4496601%2C4443393&time=1685011318135&url=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fphishing-kits-2022%2F&tm=gtmv2&cookiesTest=true&liSync=true&e_ipv6=AQK19AnB-foAUgAAAYhSgEhKdcPZLvJr2Wx_cdsCgN00Y71luxYyPhEihkIM24ny-751N_mvF-JV8w

Request Chain 104

• https://mc.yandex.com/sync_cookie_image_check HTTP 302
• https://mc.yandex.ru/sync_cookie_image_start?redirect_domain=mc.yandex.com&token=10014.inN2DBfdWeehpwJE74w-ZVReqbiA9egIzBzmWiFhUP1u1FziI0zvteBCGvgx3-TQ.1jw36qzXssbcAinIe5ZEDdwLW9I%2C HTTP 302
• https://mc.yandex.com/sync_cookie_image_decide?token=10014.23_0YRMQBRARh9lCXFxxdaSmU58tKttTos1QIDfOWBOT0fM4wL-_H240AJsFf798dTbC8JuySBT-KEgIzBgO_5k_KavG4sczVdM9Ajj49ok%2C.fo-m3nYkEddwgfvcwGmFyNKd0Ko%2C

Request Chain 114

• https://mc.yandex.com/watch/26812653?wmode=7&page-url=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fphishing-kits-2022%2F&charset=utf-8&site-info=%7B%22shareVersion%22%3A2%2C%22strategy%22%3A%22d%2Fn%2Fq%2Fr%2Fs%2Ft%22%7D&uah=chm%0A%3F0&browser-info=pv%3A1%3Avf%3A1xbwdxt5f7y09z8vpduka1r%3Afp%3A451%3Afu%3A1%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A1043%3Acn%3A1%3Adp%3A0%3Als%3A153567322540%3Ahid%3A538565779%3Az%3A0%3Ai%3A20230525104158%3Aet%3A1685011318%3Ac%3A1%3Arn%3A17465501%3Arqn%3A1%3Au%3A1685011318734949506%3Aw%3A1600x1200%3As%3A1600x1200x24%3Ask%3A1%3Awv%3A2%3Ads%3A0%2C0%2C35%2C18%2C0%2C0%2C%2C392%2C1%2C%2C%2C%2C586%3Aco%3A0%3Acpf%3A1%3Ans%3A1685011317372%3Aadb%3A2%3Arqnl%3A1%3Ast%3A1685011319%3At%3AGroup-IB%3A%20the%20use%20of%20phishing%20kits%20surges%20by%2025%25%20in%202022%20as%20they%20become%20more%20evasive%20and%20advanced%20%7C%20Group-IB&t=gdpr(14)clc(0-0-0)rqnt(1)aw(1)ti(2) HTTP 302
• https://mc.yandex.com/watch/26812653/1?wmode=7&page-url=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fphishing-kits-2022%2F&charset=utf-8&site-info=%7B%22shareVersion%22%3A2%2C%22strategy%22%3A%22d%2Fn%2Fq%2Fr%2Fs%2Ft%22%7D&uah=chm%0A%3F0&browser-info=pv%3A1%3Avf%3A1xbwdxt5f7y09z8vpduka1r%3Afp%3A451%3Afu%3A1%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A1043%3Acn%3A1%3Adp%3A0%3Als%3A153567322540%3Ahid%3A538565779%3Az%3A0%3Ai%3A20230525104158%3Aet%3A1685011318%3Ac%3A1%3Arn%3A17465501%3Arqn%3A1%3Au%3A1685011318734949506%3Aw%3A1600x1200%3As%3A1600x1200x24%3Ask%3A1%3Awv%3A2%3Ads%3A0%2C0%2C35%2C18%2C0%2C0%2C%2C392%2C1%2C%2C%2C%2C586%3Aco%3A0%3Acpf%3A1%3Ans%3A1685011317372%3Aadb%3A2%3Arqnl%3A1%3Ast%3A1685011319%3At%3AGroup-IB%3A%20the%20use%20of%20phishing%20kits%20surges%20by%2025%25%20in%202022%20as%20they%20become%20more%20evasive%20and%20advanced%20%7C%20Group-IB&t=gdpr%2814%29clc%280-0-0%29rqnt%281%29aw%281%29ti%282%29

Request Chain 115

• https://mc.yandex.com/sync_cookie_image_check_secondary HTTP 302
• https://mc.yandex.ru/sync_cookie_image_start_secondary?redirect_domain=mc.yandex.com&token=10014.nepNHzb_wUOdLFU0lgDst-W63_zaNllexfAw7CfylFhq5BfenzJAHeltHcJlN1Ii.BlXOi-KxiLEnBuJoE0RbLsgWVDY%2C HTTP 302
• https://mc.yandex.com/sync_cookie_image_decide_secondary?token=10014.Rbqp68vlKAGM5NiX8VMf3UdVUYPNRNadnjs43Z20_IVcqCB2KrM33ubt6cDT9UyHFyefC0fnIotiSaJ3PVSQQ-QQJ973piFTTr-fUBSGZ5w%2C.U9cepjrb_9vBjgfoxTQQOLs6oKU%2C

122 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
12 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	403	/ Show response www.group-ib.com/media-center/press-releases/phishing-kits-2022/	7 KB 7 KB	116ms 19ms	Document text/html	3.72.181.255 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://www.group-ib.com/media-center/press-releases/phishing-kits-2022/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 3.72.181.255 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-3-72-181-255.eu-central-1.compute.amazonaws.com Software / Resource Hash 0bf147e29fddd3e2d60d7b26e75cc472bfd067c75cc641452a7c82086da61f6a Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers cache-control no-cache, no-store, must-revalidate content-type text/html date Thu, 25 May 2023 10:41:55 GMT
GET H2	200	bt-autoinject.js Show response fhp-aws-antibot-back.group-ib.com/d/	344 KB 145 KB	141ms 65ms	Script text/javascript	3.72.191.153 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://fhp-aws-antibot-back.group-ib.com/d/bt-autoinject.js Requested by Host: www.group-ib.com URL: https://www.group-ib.com/media-center/press-releases/phishing-kits-2022/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 3.72.191.153 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-3-72-191-153.eu-central-1.compute.amazonaws.com Software istio-envoy / Resource Hash 467802806d1daa7006c76b1855852eca2d16dcf02a0d076667b3dae889b8dfea Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36 Response headers date Thu, 25 May 2023 10:41:56 GMT content-encoding gzip x-envoy-upstream-service-time 0 server istio-envoy vary Accept-Encoding content-type text/javascript; charset=UTF-8
GET DATA	200 OK	truncated /	487 B 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash f082fe5f9f85aa9415c5c9ae568376b1c7d8fc87b601642a1204912e6ef279b8 Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	4 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash df197930bb9ca239d2a914050ab5c323c8959669e9c14453ea505eb6e7a4722d Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36 Response headers Content-Type image/png
GET H2	200	idgib-w-61354c22-16cc-40a8-a871-6901f1a76e24 Show response www.group-ib.com/api/fl/	205 B 696 B	25ms 25ms	XHR application/json	3.72.181.255 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://www.group-ib.com/api/fl/idgib-w-61354c22-16cc-40a8-a871-6901f1a76e24 Requested by Host: fhp-aws-antibot-back.group-ib.com URL: https://fhp-aws-antibot-back.group-ib.com/d/bt-autoinject.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 3.72.181.255 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-3-72-181-255.eu-central-1.compute.amazonaws.com Software istio-envoy / Resource Hash 4a72d353c1d06fb41ccccbd61208b6f01fb4c7b105eed0ecef43ccbf89ca454e Request headers Referer https://www.group-ib.com/media-center/press-releases/phishing-kits-2022/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36 x-cfids - Response headers date Thu, 25 May 2023 10:41:56 GMT content-encoding gzip server istio-envoy etag W/"3HhQG2Ac20/7tub7I/tk596t1aWVva+pq36GNqj5kdJhFE7QR4JCwBoLP2MflTlAvIjeAF5KtZ27NjMICdpp7V0qvb3eFUX5xkAD4Tg89LVSzMmfBS5KOGN+q0bLser27DPjkX8zLu+WSIFR+u4ZAj/p" vary Accept-Encoding content-type application/json; charset=utf-8 cache-control no-cache x-envoy-upstream-service-time 2
POST H2	200	fl Show response www.group-ib.com/api/	665 B 839 B	44ms 43ms	XHR application/json	3.72.181.255 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://www.group-ib.com/api/fl?u=2dc77450-fa2a-11ed-b340-a8bb7d12174f&cfidsgib-w-61354c22-16cc-40a8-a871-6901f1a76e24=3HhQG2Ac20%2F7tub7I%2Ftk596t1aWVva%2Bpq36GNqj5kdJhFE7QR4JCwBoLP2MflTlAvIjeAF5KtZ27NjMICdpp7V0qvb3eFUX5xkAD4Tg89LVSzMmfBS5KOGN%2Bq0bLser27DPjkX8zLu%2BWSIFR%2Bu4ZAj%2Fp Requested by Host: fhp-aws-antibot-back.group-ib.com URL: https://fhp-aws-antibot-back.group-ib.com/d/bt-autoinject.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 3.72.181.255 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-3-72-181-255.eu-central-1.compute.amazonaws.com Software istio-envoy / Resource Hash 6aaab9ae498a5e37160891901a7e20fdbfe027bd21f84aa4a912abb4e76fa99e Request headers Referer https://www.group-ib.com/media-center/press-releases/phishing-kits-2022/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36 Content-Type text/plain;charset=UTF-8 Response headers date Thu, 25 May 2023 10:41:57 GMT content-encoding gzip server istio-envoy vary Accept-Encoding content-type application/json; charset=utf-8 access-control-allow-origin https://www.group-ib.com cache-control no-store access-control-allow-credentials true x-envoy-upstream-service-time 3
POST H2	200	fl www.group-ib.com/api/	665 B 696 B	25ms 24ms	Ping application/json	3.72.181.255 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://www.group-ib.com/api/fl?u=2dc77450-fa2a-11ed-b340-a8bb7d12174f&cfidsgib-w-61354c22-16cc-40a8-a871-6901f1a76e24=xGIJZk%2F%2B9cg3J5O%2B3ygP5UwC75J%2BdYrle%2BzUVqb9z5f4LsY5E%2FbizFa1B55JuaDUqUjuRL5wJO8Wss5bN4BklBhHk4m9TkqkBsvo%2BqVh7s%2B6FdiWw8rrc1XwnR3BCKrhCwiCdh6rPEFvbgmMsf%2BjuDbXwRFTf5k6Jdub Requested by Host: fhp-aws-antibot-back.group-ib.com URL: https://fhp-aws-antibot-back.group-ib.com/d/bt-autoinject.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 3.72.181.255 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-3-72-181-255.eu-central-1.compute.amazonaws.com Software istio-envoy / Resource Hash Request headers Referer https://www.group-ib.com/media-center/press-releases/phishing-kits-2022/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36 Content-Type text/plain;charset=UTF-8 Response headers date Thu, 25 May 2023 10:41:57 GMT content-encoding gzip server istio-envoy vary Accept-Encoding content-type application/json; charset=utf-8 access-control-allow-origin https://www.group-ib.com cache-control no-store access-control-allow-credentials true x-envoy-upstream-service-time 2
GET H2	200	Primary Request / Show response www.group-ib.com/media-center/press-releases/phishing-kits-2022/	72 KB 16 KB	36ms 35ms	Document text/html	3.72.181.255 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://www.group-ib.com/media-center/press-releases/phishing-kits-2022/ Requested by Host: www.group-ib.com URL: https://www.group-ib.com/media-center/press-releases/phishing-kits-2022/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 3.72.181.255 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-3-72-181-255.eu-central-1.compute.amazonaws.com Software nginx / Resource Hash 4d958708ec9a5f6dd1af7f8f67b6c6ba337fbd8d0a41943dd93cb4cc189bb2ca Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers Referer https://www.group-ib.com/media-center/press-releases/phishing-kits-2022/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers accept-ranges bytes access-control-allow-origin https://www.group-ib.com cache-control private, max-age=3600 content-encoding gzip content-length 15432 content-security-policy frame-ancestors 'self'; content-type text/html; charset=UTF-8 date Thu, 25 May 2023 10:41:57 GMT etag "3bdd-5fc8006cc7837" last-modified Thu, 25 May 2023 08:01:23 GMT permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() referrer-policy strict-origin-when-cross-origin server nginx strict-transport-security max-age=31536000; includeSubDomains vary X-Forwarded-Proto,Accept-Encoding,Cookie x-content-type-options nosniff x-frame-options sameorigin x-xss-protection 1; mode=block
GET H2	200	bt-autoinject.js Show response fhp-aws-antibot-back.group-ib.com/d/	344 KB 145 KB	115ms 113ms	Script text/javascript	3.72.191.153 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://fhp-aws-antibot-back.group-ib.com/d/bt-autoinject.js Requested by Host: www.group-ib.com URL: https://www.group-ib.com/media-center/press-releases/phishing-kits-2022/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 3.72.191.153 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-3-72-191-153.eu-central-1.compute.amazonaws.com Software istio-envoy / Resource Hash 467802806d1daa7006c76b1855852eca2d16dcf02a0d076667b3dae889b8dfea Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36 Response headers date Thu, 25 May 2023 10:41:57 GMT content-encoding gzip x-envoy-upstream-service-time 2 server istio-envoy vary Accept-Encoding content-type text/javascript; charset=UTF-8
GET H2	200	lazyload.min.js Show response www.group-ib.com/wp-content/plugins/w3-total-cache/pub/js/	6 KB 2 KB	35ms 33ms	Script application/x-javascript	3.72.181.255 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://www.group-ib.com/wp-content/plugins/w3-total-cache/pub/js/lazyload.min.js Requested by Host: www.group-ib.com URL: https://www.group-ib.com/media-center/press-releases/phishing-kits-2022/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 3.72.181.255 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-3-72-181-255.eu-central-1.compute.amazonaws.com Software nginx / Resource Hash 1a54a1907a6443e3c81608130bfed4546eb0ce5d0c8897e1d7a3b43d89ecc367 Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/media-center/press-releases/phishing-kits-2022/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; content-encoding gzip x-content-type-options nosniff date Thu, 25 May 2023 10:41:57 GMT strict-transport-security max-age=31536000; includeSubDomains content-length 2356 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Tue, 16 May 2023 12:06:50 GMT server nginx etag "1883-5fbce6804f8ae-gzip" vary X-Forwarded-Proto,Accept-Encoding x-frame-options sameorigin content-type application/x-javascript access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes expires Thu, 25 May 2023 11:11:57 GMT
GET H2	200	swiper-bundle.min.js Show response website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/js/	140 KB 39 KB	267ms 164ms	Script application/x-javascript	2600:9000:225b:1400:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/js/swiper-bundle.min.js Requested by Host: www.group-ib.com URL: https://www.group-ib.com/media-center/press-releases/phishing-kits-2022/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:225b:1400:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash b624e1e378abe009ef0de69a698b0a3e734af47efcdbd6816d5fcb8fc64c8bfe Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; content-encoding gzip x-content-type-options nosniff date Thu, 25 May 2023 10:41:57 GMT via 1.1 8c1abfbb8460bed752668233d296dba8.cloudfront.net (CloudFront) strict-transport-security max-age=31536000; includeSubDomains x-amz-cf-pop MUC50-P1 x-cache Miss from cloudfront content-length 39504 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Mon, 05 Sep 2022 07:41:14 GMT server nginx etag "22ede-5e7e9344df9f2-gzip" x-frame-options sameorigin vary Accept-Encoding content-type application/x-javascript access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id H6LHUwon1Z3g4ndbfbs9ROjOWxNVuTzbN-VXDrTdKWHayISZtUlaFg== expires Thu, 25 May 2023 11:11:57 GMT
GET H2	200	classic-themes.min.css website.cdn.group-ib.com/wp-includes/css/	217 B 1008 B	245ms 142ms	Stylesheet text/css	2600:9000:225b:1400:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://website.cdn.group-ib.com/wp-includes/css/classic-themes.min.css Requested by Host: www.group-ib.com URL: https://www.group-ib.com/media-center/press-releases/phishing-kits-2022/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:225b:1400:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash 5a5f39391fbf5b06db84b8f9716d53de575ee97a627d2c5f12f79a991a671eb5 Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; content-encoding gzip x-content-type-options nosniff date Thu, 25 May 2023 10:41:57 GMT via 1.1 8c1abfbb8460bed752668233d296dba8.cloudfront.net (CloudFront) strict-transport-security max-age=31536000; includeSubDomains x-amz-cf-pop MUC50-P1 x-cache Miss from cloudfront content-length 189 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Fri, 11 Nov 2022 11:58:50 GMT server nginx etag "d9-5ed309cf15c82-gzip" x-frame-options sameorigin vary Accept-Encoding content-type text/css access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id U1PsN4RxuZlC9vOTTsPw6tsyVNuFCeFakXPBZ-k8ZguHiMALfti3Gw== expires Thu, 25 May 2023 11:11:57 GMT
GET H2	200	dashicons.min.css website.cdn.group-ib.com/wp-includes/css/	58 KB 36 KB	241ms 139ms	Stylesheet text/css	2600:9000:225b:1400:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://website.cdn.group-ib.com/wp-includes/css/dashicons.min.css Requested by Host: www.group-ib.com URL: https://www.group-ib.com/media-center/press-releases/phishing-kits-2022/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:225b:1400:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash c21e5a2b32c47bc5f9d9efc97bc0e29fd081946d1d3ebffc5621cfafb1d3960e Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; content-encoding gzip x-content-type-options nosniff date Thu, 25 May 2023 10:41:57 GMT via 1.1 8c1abfbb8460bed752668233d296dba8.cloudfront.net (CloudFront) strict-transport-security max-age=31536000; includeSubDomains x-amz-cf-pop MUC50-P1 x-cache Miss from cloudfront content-length 35730 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Fri, 10 Jun 2022 07:03:36 GMT server nginx etag "e688-5e112897ec200-gzip" x-frame-options sameorigin vary Accept-Encoding content-type text/css access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id 6t4W1-clm--jL-__DKzgC8WDf4sm5P0EZ84eJgTa82LN303p_VsV2w== expires Thu, 25 May 2023 11:11:57 GMT
GET H2	200	frontend.min.css www.group-ib.com/wp-content/plugins/post-views-counter/css/	215 B 251 B	35ms 35ms	Stylesheet text/css	3.72.181.255 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://www.group-ib.com/wp-content/plugins/post-views-counter/css/frontend.min.css Requested by Host: www.group-ib.com URL: https://www.group-ib.com/media-center/press-releases/phishing-kits-2022/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 3.72.181.255 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-3-72-181-255.eu-central-1.compute.amazonaws.com Software nginx / Resource Hash ed70c2cf61d0f24d03299ffc5896c7abd86bb858501987dc10e3afec086c01df Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/media-center/press-releases/phishing-kits-2022/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; content-encoding gzip x-content-type-options nosniff date Thu, 25 May 2023 10:41:57 GMT strict-transport-security max-age=31536000; includeSubDomains content-length 160 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Wed, 26 Apr 2023 07:26:40 GMT server nginx etag "d7-5fa38293ec798-gzip" vary X-Forwarded-Proto,Accept-Encoding x-frame-options sameorigin content-type text/css access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes expires Thu, 25 May 2023 11:11:57 GMT
GET H2	200	jquery.min.js Show response website.cdn.group-ib.com/wp-includes/js/jquery/	88 KB 31 KB	221ms 118ms	Script application/x-javascript	2600:9000:225b:1400:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://website.cdn.group-ib.com/wp-includes/js/jquery/jquery.min.js Requested by Host: www.group-ib.com URL: https://www.group-ib.com/media-center/press-releases/phishing-kits-2022/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:225b:1400:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash cc7403bab52ed166e24ea9324241045af370be482f5b594468f4a6ac6e7e7981 Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; content-encoding gzip x-content-type-options nosniff date Thu, 25 May 2023 10:41:57 GMT via 1.1 8c1abfbb8460bed752668233d296dba8.cloudfront.net (CloudFront) strict-transport-security max-age=31536000; includeSubDomains x-amz-cf-pop MUC50-P1 x-cache Miss from cloudfront content-length 30995 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Fri, 11 Nov 2022 11:58:50 GMT server nginx etag "15e54-5ed309cf21802-gzip" x-frame-options sameorigin vary Accept-Encoding content-type application/x-javascript access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id IUNl4kH_380Yx9QPKb2qrUXXyaihUUsP_mtPYXXdONaWZMvfoCjsEA== expires Thu, 25 May 2023 11:11:57 GMT
GET H2	200	single-press-release.css website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/	221 KB 33 KB	182ms 80ms	Stylesheet text/css	2600:9000:225b:1400:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-press-release.css Requested by Host: www.group-ib.com URL: https://www.group-ib.com/media-center/press-releases/phishing-kits-2022/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:225b:1400:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash 56e40e9297da4bf3a466686e4b70bb0f86f8300e584f0b461cc96f7aec9cc7e2 Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; content-encoding gzip x-content-type-options nosniff date Thu, 25 May 2023 10:41:57 GMT via 1.1 8c1abfbb8460bed752668233d296dba8.cloudfront.net (CloudFront) strict-transport-security max-age=31536000; includeSubDomains x-amz-cf-pop MUC50-P1 x-cache Miss from cloudfront content-length 33135 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Thu, 25 May 2023 10:41:55 GMT server nginx etag "37214-5fc8244e04c54-gzip" x-frame-options sameorigin vary Accept-Encoding content-type text/css access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id xRGgOK3K6Pot_Fd9lPb48Zdq4taZvBnNEonaOzVZbLDWjPOFecGM2Q== expires Thu, 25 May 2023 11:11:57 GMT
GET H2	200	v2.js Show response js-eu1.hsforms.net/forms/	526 KB 165 KB	117ms 42ms	Script application/javascript	172.65.255.172 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://js-eu1.hsforms.net/forms/v2.js Requested by Host: www.group-ib.com URL: https://www.group-ib.com/media-center/press-releases/phishing-kits-2022/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.65.255.172 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 6068122af5aaf3871c283132bb19ddafc391f4cb78126882ca18a7c5f4c03611 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36 Response headers content-encoding br age 272 x-evy-trace-route-service-name envoyset-translator x-amz-server-side-encryption AES256 content-security-policy-report-only frame-ancestors 'self'; report-uri https://send.hsbrowserreports.com/csp/report?resource=forms-embed/static-1.3243/bundles/project-v2.js&cfRay=7ccd24994155927f-FRA x-amz-replication-status COMPLETED x-evy-trace-listener listener_https etag W/"a5301b6f08ed64649a3390f949aa4175" vary Accept-Encoding content-type application/javascript; charset=utf-8 access-control-allow-origin * x-evy-trace-virtual-host all cache-control s-maxage=600, max-age=300 x-hs-target-asset forms-embed/static-1.3243/bundles/project-v2.js date Thu, 25 May 2023 10:41:57 GMT x-amz-version-id l7bHRIBQ6TE8MnbN5jsE1ccMSwu0_dqN via 1.1 22993faf725ff29c940e58cb14ddf668.cloudfront.net (CloudFront) cf-cache-status HIT nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} strict-transport-security max-age=31536000; includeSubDomains; preload x-amz-cf-pop FRA56-P2 x-cache Hit from cloudfront cache-tag staticjsapp-forms-embed-v2-web-prod,staticjsapp-prod x-envoy-upstream-service-time 2 alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 x-evy-trace-route-configuration listener_https/all x-request-id 788a3ada-2080-494b-ba39-884dfdf8a753 last-modified Tue, 23 May 2023 10:19:29 UTC server cloudflare report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=5diTdkwkztWxgtN9VeJKz%2FdqyPMvbnXpDDJaU%2B9zXXF2nuFUWh6gCl24lOLWHIdoa5Qathag9GKdNg5chpZDx%2BLjRrUnFVZANN38Cr5CiZSb8lvKRqPk70tEelaUC3%2B6IO5tEw%3D%3D"}],"group":"cf-nel","max_age":604800} x-hs-cache-status HIT x-evy-trace-served-by-pod fra04/app-td/envoy-proxy-5b45bc9bc5-p7df5 cf-ray 7ccd2b3e59af928f-FRA x-amz-cf-id gO1bUT3l7I29AXHmO5IhILlliOuyWBxHx803tv-1ss2RnEbYce6oKw==
GET H2	200	sdk.js Show response connect.facebook.net/en_US/	3 KB 3 KB	61ms 20ms	Script application/x-javascript	2a03:2880:f084:d:face:b00c:0:3 FACEBOOK
General Check archive.org Show headers Download Go to Full URL https://connect.facebook.net/en_US/sdk.js Requested by Host: www.group-ib.com URL: https://www.group-ib.com/media-center/press-releases/phishing-kits-2022/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a03:2880:f084:d:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US), Reverse DNS Software / Resource Hash 216d7e2b0c4a9ff2dd61f27ad96a0bdcae2f3806525ab1da1e71bd4fd6591ac3 Security Headers Name Value Strict-Transport-Security max-age=31536000; preload; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options DENY Request headers Referer https://www.group-ib.com/ Origin https://www.group-ib.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36 Response headers strict-transport-security max-age=31536000; preload; includeSubDomains content-encoding gzip x-content-type-options nosniff date Thu, 25 May 2023 10:41:57 GMT content-md5 yjFAdV2dNcMhspzbAcSo6w== document-policy force-load-at-top cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400 content-length 1688 x-fb-rlafr 0 x-fb-debug Q6CAIUPZJUAnCZIL2pIjg4WKbU++6fSHqRdaWWP1NgqSOjgQ1tgwvdjfsuBRRVz9DwH1qZ6TCbM9XmU2/2VTag== cross-origin-embedder-policy-report-only require-corp;report-to="coep_report" x-fb-trip-id 1679558926 x-fb-content-md5 79fc30625bbd877f9497b326c7b91c42 cross-origin-opener-policy same-origin-allow-popups etag "14f98d55de2af2dc5a354b57fb31d02f" vary Accept-Encoding report-to {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/?minimize=0"}],"group":"coep_report"} content-type application/x-javascript; charset=utf-8 access-control-allow-origin * access-control-expose-headers X-FB-Content-MD5 cache-control public,max-age=1200,stale-while-revalidate=3600 permissions-policy accelerometer=(), ambient-light-sensor=(), bluetooth=(), gyroscope=(), hid=(), idle-detection=(), magnetometer=(), midi=(), screen-wake-lock=(), serial=(), usb=() x-frame-options DENY timing-allow-origin * expires Thu, 25 May 2023 10:48:32 GMT
GET H2	200	jquery-ui.js Show response website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/libs/jquery-ui/	517 KB 125 KB	98ms 97ms	Script application/x-javascript	2600:9000:225b:1400:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/libs/jquery-ui/jquery-ui.js Requested by Host: www.group-ib.com URL: https://www.group-ib.com/media-center/press-releases/phishing-kits-2022/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:225b:1400:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash e97315234cc1f1c4737d98ea29c0f4d4f06c032dc5943012ae50bc4b10a92276 Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; content-encoding gzip x-content-type-options nosniff date Thu, 25 May 2023 10:41:57 GMT via 1.1 8c1abfbb8460bed752668233d296dba8.cloudfront.net (CloudFront) strict-transport-security max-age=31536000; includeSubDomains x-amz-cf-pop MUC50-P1 x-cache Miss from cloudfront x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Mon, 05 Sep 2022 07:24:28 GMT server nginx etag "812a6-5e7e8f85cb376-gzip" x-frame-options sameorigin vary Accept-Encoding content-type application/x-javascript access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id Bf3WS_gO94F8tJO8HzeSc__GVuqvdy1Ws8I2Txtomj6kYXnCT10QEw== expires Thu, 25 May 2023 11:11:57 GMT
GET H2	200	fancybox.umd.js Show response website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/libs/fancybox/	103 KB 30 KB	233ms 144ms	Script application/x-javascript	2600:9000:225b:1400:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/libs/fancybox/fancybox.umd.js Requested by Host: www.group-ib.com URL: https://www.group-ib.com/media-center/press-releases/phishing-kits-2022/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:225b:1400:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash 942e02acf640c0308f65e057a8afaed63dfaf995034cda9cfc75532a1009ec72 Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; content-encoding gzip x-content-type-options nosniff date Thu, 25 May 2023 10:41:57 GMT via 1.1 8c1abfbb8460bed752668233d296dba8.cloudfront.net (CloudFront) strict-transport-security max-age=31536000; includeSubDomains x-amz-cf-pop MUC50-P1 x-cache Miss from cloudfront content-length 29634 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Mon, 05 Sep 2022 07:24:28 GMT server nginx etag "19ca6-5e7e8f85cb376-gzip" x-frame-options sameorigin vary Accept-Encoding content-type application/x-javascript access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id MoriFqaECrjmvrWyASK8mMjD9p1vgSeVrAOGjPGYzhk49WmzXBDQzA== expires Thu, 25 May 2023 11:11:57 GMT
GET H2	200	main.js Show response website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/js/	210 KB 46 KB	104ms 103ms	Script application/x-javascript	2600:9000:225b:1400:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/js/main.js Requested by Host: www.group-ib.com URL: https://www.group-ib.com/media-center/press-releases/phishing-kits-2022/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:225b:1400:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash 6ef1f43c331150d23e01b41927542d8dc5e0d363422a2909e5343bcd6f2082e9 Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; content-encoding gzip x-content-type-options nosniff date Thu, 25 May 2023 10:41:57 GMT via 1.1 8c1abfbb8460bed752668233d296dba8.cloudfront.net (CloudFront) strict-transport-security max-age=31536000; includeSubDomains x-amz-cf-pop MUC50-P1 x-cache Miss from cloudfront content-length 45725 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Fri, 05 May 2023 14:00:53 GMT server nginx etag "34848-5faf2b7a83925-gzip" x-frame-options sameorigin vary Accept-Encoding content-type application/x-javascript access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id LeVNuEC3WA0ATkmCVIaY3hYJlShySzeia-JTxtJp2YLqtaF1Ma3dlA== expires Thu, 25 May 2023 11:11:57 GMT
GET H2	200	25755956.js Show response js-eu1.hs-scripts.com/	2 KB 1 KB	115ms 42ms	Script application/javascript	172.65.208.22 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://js-eu1.hs-scripts.com/25755956.js Requested by Host: www.group-ib.com URL: https://www.group-ib.com/media-center/press-releases/phishing-kits-2022/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.65.208.22 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 16ffe9e2b579d175bddabc6a93965f8baacc0e70d598308639db7f085f442a22 Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36 Response headers date Thu, 25 May 2023 10:41:57 GMT content-encoding br cf-cache-status EXPIRED x-hubspot-correlation-id 39acefe3-ea47-4e40-9a16-8bad72108135 x-evy-trace-route-service-name envoyset-translator x-envoy-upstream-service-time 4 x-evy-trace-route-configuration listener_https/all x-evy-trace-listener listener_https x-request-id c7b6b368-f796-482b-bda5-d60c4b423b36 last-modified Thu, 25 May 2023 10:38:50 GMT server cloudflare x-trace 2B93535257A3231A6B3EBEF46371EDA5D7B5163E41000000000000000000 vary origin, Accept-Encoding access-control-max-age 3600 content-type application/javascript;charset=utf-8 access-control-allow-origin https://www.group-ib.com x-evy-trace-virtual-host all cache-control public, max-age=30 access-control-allow-credentials true x-evy-trace-served-by-pod fra04/hubapi-td/envoy-proxy-6568b767df-vkcjk cf-ray 7ccd2b403b2f2c5f-FRA
GET H2	200	js Show response www.googletagmanager.com/gtag/	117 KB 46 KB	79ms 32ms	Script application/javascript	2a00:1450:4001:82f::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtag/js?id=UA-25492706-2 Requested by Host: www.group-ib.com URL: https://www.group-ib.com/media-center/press-releases/phishing-kits-2022/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:82f::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash 676b5bd8f119240e4c378e023c48ecb68b3f14fac79820b5b70dbad7300ea062 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36 Response headers date Thu, 25 May 2023 10:41:57 GMT content-encoding br strict-transport-security max-age=31536000; includeSubDomains cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 46688 x-xss-protection 0 last-modified Thu, 25 May 2023 09:00:00 GMT server Google Tag Manager vary Accept-Encoding content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true access-control-allow-headers Cache-Control expires Thu, 25 May 2023 10:41:57 GMT
GET DATA	200 OK	truncated /	488 B 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 18fc8752ea5d3992f3f829bed9cae8b79617492f2fddc522c2256382614e7ac2 Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	4 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash bc2e906bdb4eeb3494d9cd50a4571aea29a6eee909c6da1c0faf831258719d88 Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36 Response headers Content-Type image/png
GET H2	200	idgib-w-61354c22-16cc-40a8-a871-6901f1a76e24 Show response www.group-ib.com/api/fl/	217 B 622 B	24ms 23ms	XHR application/json	3.72.181.255 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://www.group-ib.com/api/fl/idgib-w-61354c22-16cc-40a8-a871-6901f1a76e24 Requested by Host: fhp-aws-antibot-back.group-ib.com URL: https://fhp-aws-antibot-back.group-ib.com/d/bt-autoinject.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 3.72.181.255 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-3-72-181-255.eu-central-1.compute.amazonaws.com Software istio-envoy / Resource Hash d356042fc98ea22f671b5c769e3d57bb519276ffc57741a8d2ecc3c2a343135f Request headers X-GIB-GSSCgib-w-61354c22-16cc-40a8-a871-6901f1a76e24 y3bOKskqj/qw+IYS9pgl44hDV0LXN9biwuQIgBvzQGOGDyg7ZAqpShQmHrbS7fMZIWJbeaE5ie074U4C+c0RVY7ZEheDaPWVHZttgx+sZxoJfpFz/DfBvrs1F85d56jaO8UzGMCWTYxFul5rYlIWvKIK2JmmUvz/C3SIpzFDwNbEHGY/s4QzU1E4PnB9bEAy/BWwhP1mFVANribOKRz8KJQUi6JMhn4oIeuWBSWY55hkFJ+5EXxpLRZ91STl+Q== Referer https://www.group-ib.com/media-center/press-releases/phishing-kits-2022/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36 X-GIB-FGSSCgib-w-61354c22-16cc-40a8-a871-6901f1a76e24 TiJR6f211a704d4eef8a05940a28bfd2bba034f6 x-cfids xGIJZk/+9cg3J5O+3ygP5UwC75J+dYrle+zUVqb9z5f4LsY5E/bizFa1B55JuaDUqUjuRL5wJO8Wss5bN4BklBhHk4m9TkqkBsvo+qVh7s+6FdiWw8rrc1XwnR3BCKrhCwiCdh6rPEFvbgmMsf+juDbXwRFTf5k6Jdub Response headers date Thu, 25 May 2023 10:41:57 GMT content-encoding gzip server istio-envoy etag W/"Ojqyn7c+3nazbdsgU10NXxTXZHne9pVMg/PTaraiqhEbDodQY36fk6UdR5px07WBVapv5s7Q/e2PcyhAWUgiW9gGPhBvbJB5FcTHdGoHhRZwMuXEx5I8iDSQOJFr6iwCI3IOhibqHN3yy4FwN5rekoTevu0N8l/kwBmV" vary Accept-Encoding content-type application/json; charset=utf-8 cache-control no-cache x-envoy-upstream-service-time 1
GET H2	200	G-font-Medium.otf website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/fonts/G-font/	60 KB 35 KB	140ms 89ms	Font application/x-font-otf	2600:9000:225b:1400:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/fonts/G-font/G-font-Medium.otf Requested by Host: website.cdn.group-ib.com URL: https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-press-release.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:225b:1400:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash 1efe16c9efbadde5e242d88a315eca3906a55669fcd4882a904fbc723306a4e4 Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers Referer https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-press-release.css Origin https://www.group-ib.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; content-encoding gzip x-content-type-options nosniff date Thu, 25 May 2023 10:41:57 GMT via 1.1 aedc37d054398c84a361f8542a82efea.cloudfront.net (CloudFront) strict-transport-security max-age=31536000; includeSubDomains x-amz-cf-pop MUC50-P1 x-cache Miss from cloudfront content-length 35382 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Tue, 28 Jun 2022 07:55:26 GMT server nginx etag "eed4-5e27d5c025780-gzip" x-frame-options sameorigin vary Accept-Encoding content-type application/x-font-otf access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id fE6Y2r5WknDH2DRnhy0XL86R8kpi6yp2PQKvmkkzIf8A1xY1WjsQ0w== expires Thu, 25 May 2023 11:11:57 GMT
GET H2	200	G-font-Regular.otf website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/fonts/G-font/	47 KB 31 KB	102ms 52ms	Font application/x-font-otf	2600:9000:225b:1400:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/fonts/G-font/G-font-Regular.otf Requested by Host: website.cdn.group-ib.com URL: https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-press-release.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:225b:1400:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash 6cee0fb06339ba13e1f15d044e0e4904bbeeb7fbe4351e3f102b6d80b2465061 Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers Referer https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-press-release.css Origin https://www.group-ib.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; content-encoding gzip x-content-type-options nosniff date Thu, 25 May 2023 10:41:57 GMT via 1.1 aedc37d054398c84a361f8542a82efea.cloudfront.net (CloudFront) strict-transport-security max-age=31536000; includeSubDomains x-amz-cf-pop MUC50-P1 x-cache Miss from cloudfront content-length 30798 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Tue, 28 Jun 2022 07:55:26 GMT server nginx etag "bbf8-5e27d5c025780-gzip" x-frame-options sameorigin vary Accept-Encoding content-type application/x-font-otf access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id 805Re8TA8-rG7M91BzqUEQXC3JOg_BMr4WeFKZbe0FBg7NRh43bTWA== expires Thu, 25 May 2023 11:11:57 GMT
GET H2	200	json Show response forms-eu1.hsforms.com/embed/v3/form/25755956/044e7558-8073-478a-ad3c-5807dd76840f/	9 KB 2 KB	150ms 61ms	XHR application/json	172.65.232.43 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://forms-eu1.hsforms.com/embed/v3/form/25755956/044e7558-8073-478a-ad3c-5807dd76840f/json?hs_static_app=forms-embed&hs_static_app_version=1.3243&X-HubSpot-Static-App-Info=forms-embed-1.3243 Requested by Host: fhp-aws-antibot-back.group-ib.com URL: https://fhp-aws-antibot-back.group-ib.com/d/bt-autoinject.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.65.232.43 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 7f5207e6e8687c3861350aa6aaefb1456af4afc69a8431153db15769080f1560 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload Request headers Accept application/json, text/plain, */* Referer https://www.group-ib.com/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36 Response headers x-origin-hublet eu1 date Thu, 25 May 2023 10:41:57 GMT strict-transport-security max-age=31536000; includeSubDomains; preload content-encoding br cf-cache-status DYNAMIC x-hubspot-correlation-id f0bc4afa-ff0d-4c6c-89f7-71325d7134be x-evy-trace-route-service-name envoyset-translator x-envoy-upstream-service-time 8 alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 x-evy-trace-route-configuration listener_https/all x-evy-trace-listener listener_https x-request-id 6cae7688-7bfe-4a13-a6ce-27a757de179e server cloudflare x-trace 2B0196E73959960ABD2A24BDE979A503ABAECC4096000000000000000000 vary origin access-control-allow-methods OPTIONS, GET content-type application/json;charset=utf-8 access-control-allow-origin https://www.group-ib.com x-evy-trace-virtual-host all access-control-expose-headers X-Origin-Hublet access-control-max-age 180 access-control-allow-credentials false cache-control max-age=0, no-cache, no-store x-robots-tag none access-control-allow-headers * cf-ray 7ccd2b408b619974-FRA x-evy-trace-served-by-pod fra04/star-hubspot-td/envoy-proxy-79bb87d888-p4pw9
GET H2	200	cross.svg website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/main-nav/	342 B 1 KB	88ms 87ms	Image image/svg+xml	2600:9000:225b:1400:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/main-nav/cross.svg Requested by Host: website.cdn.group-ib.com URL: https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-press-release.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:225b:1400:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash dfb059f8aa219769088fd6c85d85aae789f1e72bfe3d314748f1f3ccfffffb1c Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-press-release.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; content-encoding gzip x-content-type-options nosniff date Thu, 25 May 2023 10:41:57 GMT via 1.1 8c1abfbb8460bed752668233d296dba8.cloudfront.net (CloudFront) strict-transport-security max-age=31536000; includeSubDomains x-amz-cf-pop MUC50-P1 x-cache Miss from cloudfront content-length 207 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Tue, 28 Jun 2022 07:55:26 GMT server nginx etag "156-5e27d5c025780-gzip" x-frame-options sameorigin vary Accept-Encoding content-type image/svg+xml access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id rnxIErNJfSu9OJhSJXSH0jdncDdc1Ki3O-y3iqJcY39A0yPO-n4vgA== expires Thu, 25 May 2023 11:11:57 GMT
GET H2	200	json Show response forms-eu1.hsforms.com/embed/v3/form/25755956/4dbceae1-75ae-423a-9c12-dee8f1ca3345/	112 KB 29 KB	145ms 69ms	XHR application/json	172.65.232.43 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://forms-eu1.hsforms.com/embed/v3/form/25755956/4dbceae1-75ae-423a-9c12-dee8f1ca3345/json?hs_static_app=forms-embed&hs_static_app_version=1.3243&X-HubSpot-Static-App-Info=forms-embed-1.3243 Requested by Host: fhp-aws-antibot-back.group-ib.com URL: https://fhp-aws-antibot-back.group-ib.com/d/bt-autoinject.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.65.232.43 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 4625fb72c884f78551a9e55c998af63f79b383fb365182382e45a4abc87299cf Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload Request headers Accept application/json, text/plain, */* Referer https://www.group-ib.com/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36 Response headers x-origin-hublet eu1 date Thu, 25 May 2023 10:41:57 GMT strict-transport-security max-age=31536000; includeSubDomains; preload content-encoding br cf-cache-status DYNAMIC x-hubspot-correlation-id a6e15fd2-8222-4867-9021-be594061e135 x-evy-trace-route-service-name envoyset-translator x-envoy-upstream-service-time 17 alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 x-evy-trace-route-configuration listener_https/all x-evy-trace-listener listener_https x-request-id 9f06c446-0f31-458e-93d8-6ca2959a9970 server cloudflare x-trace 2B74D34D87056FAC59DF7C7ADE6A5C81857317B14F000000000000000000 vary origin access-control-allow-methods OPTIONS, GET content-type application/json;charset=utf-8 access-control-allow-origin https://www.group-ib.com x-evy-trace-virtual-host all access-control-expose-headers X-Origin-Hublet access-control-max-age 180 access-control-allow-credentials false cache-control max-age=0, no-cache, no-store x-robots-tag none access-control-allow-headers * cf-ray 7ccd2b408b639974-FRA x-evy-trace-served-by-pod fra04/star-hubspot-td/envoy-proxy-79bb87d888-p4pw9
GET DATA	200 OK	truncated /	64 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 01caf20e667c8e300960582162f912d9405e9895c32cff1a9ee95511fd509a2c Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	69 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 8cf03002cc76f44aa90d9925963f6173ac50650b2395bed48247f9ff85bf3107 Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	68 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash f5ff6d9d9a42ed8dc64cf6d1418511eb4b9cb2f0aa76fdc471ecf442e43a037f Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	69 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 4b4ac4b4f853c196ff40dc87a1d718ecaae240c7b18c22fff9e6fa821754a393 Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	69 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash b9b8b105f0cfb5d331bc9a9f6d3647064056448701cb909f3bfc56e928d73668 Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	69 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 548a7cf3c1f1288382772d6f67d0e44aa6c13843f96eebc7e81387f6f474c077 Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	69 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash dd3f698315e3aa70d07ac2f2c5b7d3b95d7fff6bb0d73dc10b1b62ef3fe89b07 Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	69 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash e49578a11ce3d469b33d24c6f46f144b3262a59ecfe81ff0d200fb605ed03a15 Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36 Response headers Content-Type image/svg+xml
GET H2	200	dropdown_before.svg website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/main-nav/	154 B 972 B	88ms 87ms	Image image/svg+xml	2600:9000:225b:1400:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/main-nav/dropdown_before.svg Requested by Host: website.cdn.group-ib.com URL: https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-press-release.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:225b:1400:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash 574ab1a3d7b47add5d43a927f62c87698264f63572acd70b42081dd4a1dc5ced Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-press-release.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; content-encoding gzip x-content-type-options nosniff date Thu, 25 May 2023 10:41:57 GMT via 1.1 8c1abfbb8460bed752668233d296dba8.cloudfront.net (CloudFront) strict-transport-security max-age=31536000; includeSubDomains x-amz-cf-pop MUC50-P1 x-cache Miss from cloudfront content-length 150 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Tue, 28 Jun 2022 07:55:26 GMT server nginx etag "9a-5e27d5c025780-gzip" x-frame-options sameorigin vary Accept-Encoding content-type image/svg+xml access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id BC4btul1GIsfv70WW0paWJGoe_WZszfg9dbX_J0tF13cwk8zDjxn5w== expires Thu, 25 May 2023 11:11:57 GMT
GET H2	200	link-arrow.svg website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/	409 B 1 KB	82ms 82ms	Image image/svg+xml	2600:9000:225b:1400:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/link-arrow.svg Requested by Host: website.cdn.group-ib.com URL: https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-press-release.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:225b:1400:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash e91c5731358570d3e4cd684118251d243fc799059648b152403dcd775ceba632 Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-press-release.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; content-encoding gzip x-content-type-options nosniff date Thu, 25 May 2023 10:41:57 GMT via 1.1 8c1abfbb8460bed752668233d296dba8.cloudfront.net (CloudFront) strict-transport-security max-age=31536000; includeSubDomains x-amz-cf-pop MUC50-P1 x-cache Miss from cloudfront content-length 267 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Tue, 28 Jun 2022 07:55:26 GMT server nginx etag "199-5e27d5c025780-gzip" x-frame-options sameorigin vary Accept-Encoding content-type image/svg+xml access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id WWvdUkQOkQHMPrP-nyR6kcZhkmQjHJuQ5_TzVfvj4ycfRNWf8W8a1A== expires Thu, 25 May 2023 11:11:57 GMT
GET H2	200	G-font-Bold.otf website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/fonts/G-font/	49 KB 32 KB	90ms 74ms	Font application/x-font-otf	2600:9000:225b:1400:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/fonts/G-font/G-font-Bold.otf Requested by Host: website.cdn.group-ib.com URL: https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-press-release.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:225b:1400:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash 8d15a221986226efe4f742f390f46f9d5ae8b2008a6edd40e10ff121ef9cca9b Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers Referer https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-press-release.css Origin https://www.group-ib.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; content-encoding gzip x-content-type-options nosniff date Thu, 25 May 2023 10:41:57 GMT via 1.1 aedc37d054398c84a361f8542a82efea.cloudfront.net (CloudFront) strict-transport-security max-age=31536000; includeSubDomains x-amz-cf-pop MUC50-P1 x-cache Miss from cloudfront content-length 31918 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Tue, 28 Jun 2022 07:55:26 GMT server nginx etag "c320-5e27d5c025780-gzip" x-frame-options sameorigin vary Accept-Encoding content-type application/x-font-otf access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id mCsqbDxQQNEa24gHVxhU0UweDfnmiwEPVFMMhtAqWHzKjk9h874iRA== expires Thu, 25 May 2023 11:11:57 GMT
GET H2	200	json Show response forms-eu1.hsforms.com/embed/v3/form/25755956/55a22738-d5a5-43f9-9c1c-fa4c1a6eb349/	8 KB 3 KB	86ms 50ms	XHR application/json	172.65.232.43 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://forms-eu1.hsforms.com/embed/v3/form/25755956/55a22738-d5a5-43f9-9c1c-fa4c1a6eb349/json?hs_static_app=forms-embed&hs_static_app_version=1.3243&X-HubSpot-Static-App-Info=forms-embed-1.3243 Requested by Host: fhp-aws-antibot-back.group-ib.com URL: https://fhp-aws-antibot-back.group-ib.com/d/bt-autoinject.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.65.232.43 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 474861a5caef0197f864307414167c42c55b5324b67a4c1ca8e2a3ce2e8b5988 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload Request headers Accept application/json, text/plain, */* Referer https://www.group-ib.com/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36 Response headers x-origin-hublet eu1 date Thu, 25 May 2023 10:41:57 GMT strict-transport-security max-age=31536000; includeSubDomains; preload content-encoding br cf-cache-status DYNAMIC x-hubspot-correlation-id 2466cb9a-ecf9-44c2-bad8-fdc134aa019f x-evy-trace-route-service-name envoyset-translator x-envoy-upstream-service-time 8 alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 x-evy-trace-route-configuration listener_https/all x-evy-trace-listener listener_https x-request-id 6e67dec5-7301-469f-97a7-a173a8de3557 server cloudflare x-trace 2BA9D58650E96AA6236AAE365B31C8E3828FD3B164000000000000000000 vary origin access-control-allow-methods OPTIONS, GET content-type application/json;charset=utf-8 access-control-allow-origin https://www.group-ib.com x-evy-trace-virtual-host all access-control-expose-headers X-Origin-Hublet access-control-max-age 180 access-control-allow-credentials false cache-control max-age=0, no-cache, no-store x-robots-tag none access-control-allow-headers * cf-ray 7ccd2b408b669974-FRA x-evy-trace-served-by-pod fra04/star-hubspot-td/envoy-proxy-79bb87d888-m76dn
GET H2	200	gtm.js Show response www.googletagmanager.com/	269 KB 87 KB	47ms 46ms	Script application/javascript	2a00:1450:4001:82f::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtm.js?id=GTM-PW7265 Requested by Host: www.group-ib.com URL: https://www.group-ib.com/media-center/press-releases/phishing-kits-2022/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:82f::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash bd2792c1cd705b632f2723120ae2fb0803d8d37828fd442776ab0edead8878f7 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36 Response headers date Thu, 25 May 2023 10:41:57 GMT content-encoding br strict-transport-security max-age=31536000; includeSubDomains cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 89424 x-xss-protection 0 last-modified Thu, 25 May 2023 09:00:00 GMT server Google Tag Manager vary Accept-Encoding content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true access-control-allow-headers Cache-Control expires Thu, 25 May 2023 10:41:57 GMT
GET H2	200	insight.min.js Show response website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/js/	8 KB 4 KB	83ms 82ms	Script application/x-javascript	2600:9000:225b:1400:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/js/insight.min.js Requested by Host: www.group-ib.com URL: https://www.group-ib.com/media-center/press-releases/phishing-kits-2022/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:225b:1400:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash 14f2ec002b176e0dee403cb7dd4ef2274a1353080e1e3e4084678770f4c15b9c Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; content-encoding gzip x-content-type-options nosniff date Thu, 25 May 2023 10:41:57 GMT via 1.1 8c1abfbb8460bed752668233d296dba8.cloudfront.net (CloudFront) strict-transport-security max-age=31536000; includeSubDomains x-amz-cf-pop MUC50-P1 x-cache Miss from cloudfront content-length 3085 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Fri, 15 Jul 2022 14:12:57 GMT server nginx etag "1e5a-5e3d89d6a8c40-gzip" x-frame-options sameorigin vary Accept-Encoding content-type application/x-javascript access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id 33eHJqUGka3NpysNDf8zCTgeYlEeTbM_XdDeDLog8S12wxcFNX5cng== expires Thu, 25 May 2023 11:11:57 GMT
GET H2	200	sdk.js Show response connect.facebook.net/en_US/	306 KB 87 KB	22ms 21ms	Script application/x-javascript	2a03:2880:f084:d:face:b00c:0:3 FACEBOOK
General Check archive.org Show headers Download Go to Full URL https://connect.facebook.net/en_US/sdk.js?hash=3c2742967c014ff3123c2b9c78718440 Requested by Host: connect.facebook.net URL: https://connect.facebook.net/en_US/sdk.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a03:2880:f084:d:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US), Reverse DNS Software / Resource Hash 0767076565064b02fd527a77d52e235ff550d34615f68784d7b4c917d08aeed1 Security Headers Name Value Strict-Transport-Security max-age=31536000; preload; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options DENY Request headers Referer https://www.group-ib.com/ Origin https://www.group-ib.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36 Response headers strict-transport-security max-age=31536000; preload; includeSubDomains content-encoding gzip x-content-type-options nosniff date Thu, 25 May 2023 10:41:57 GMT content-md5 TGkmU5JAK09pfz3DJWj7fQ== document-policy force-load-at-top cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400 content-length 88619 x-fb-rlafr 0 x-fb-debug xhRubOivMzBp6GiDLqOf5NLAHnEXZKcsYaX3Mp99av2lQlufMv1dXlZT+G9be1gnOZg7cm8/EAngIDc0zfwfew== cross-origin-embedder-policy-report-only require-corp;report-to="coep_report" x-fb-trip-id 1679558926 x-fb-content-md5 3341215064bb8db4b659bc693284f2fa cross-origin-opener-policy same-origin-allow-popups etag "26aa8a85c4ec2e462ab38cbbdd0e5334" vary Accept-Encoding report-to {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/?minimize=0"}],"group":"coep_report"} content-type application/x-javascript; charset=utf-8 access-control-allow-origin * access-control-expose-headers X-FB-Content-MD5 cache-control public,max-age=31536000,stale-while-revalidate=3600,immutable permissions-policy accelerometer=(), ambient-light-sensor=(), bluetooth=(), gyroscope=(), hid=(), idle-detection=(), magnetometer=(), midi=(), screen-wake-lock=(), serial=(), usb=() x-frame-options DENY timing-allow-origin * expires Fri, 24 May 2024 10:08:30 GMT
GET H2	200	main-logo.svg www.group-ib.com/wp-content/themes/gib-theme/assets/images/	3 KB 2 KB	36ms 33ms	Image image/svg+xml	3.72.181.255 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://www.group-ib.com/wp-content/themes/gib-theme/assets/images/main-logo.svg Requested by Host: www.group-ib.com URL: https://www.group-ib.com/media-center/press-releases/phishing-kits-2022/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 3.72.181.255 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-3-72-181-255.eu-central-1.compute.amazonaws.com Software nginx / Resource Hash 589c9a6a159cf2ecc8555bc4457827f21002eaec9a24e3bc54401ed0b4d30ac8 Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/media-center/press-releases/phishing-kits-2022/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; content-encoding gzip x-content-type-options nosniff date Thu, 25 May 2023 10:41:57 GMT strict-transport-security max-age=31536000; includeSubDomains content-length 1527 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Mon, 30 Jan 2023 11:16:06 GMT server nginx etag "d82-5f379576be685-gzip" vary Accept-Encoding x-frame-options sameorigin content-type image/svg+xml access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes expires Thu, 25 May 2023 11:11:57 GMT
GET H2	200	ti.png website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/main-nav/	6 KB 7 KB	48ms 45ms	Image image/png	2600:9000:225b:1400:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/main-nav/ti.png Requested by Host: www.group-ib.com URL: https://www.group-ib.com/media-center/press-releases/phishing-kits-2022/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:225b:1400:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash f0e3a799744c0c67782742af2c13b85f769b58abd04800a04853d26f60cf7314 Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; date Thu, 25 May 2023 10:41:57 GMT x-content-type-options nosniff strict-transport-security max-age=31536000; includeSubDomains via 1.1 8c1abfbb8460bed752668233d296dba8.cloudfront.net (CloudFront) x-amz-cf-pop MUC50-P1 x-cache Miss from cloudfront content-length 5919 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Tue, 28 Jun 2022 07:55:26 GMT server nginx etag "171f-5e27d5c025780" x-frame-options sameorigin content-type image/png access-control-allow-origin https://www.group-ib.com cache-control no-cache, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id wNKuAXe-aNczCEk-V-z680ihq1cPnk7S-FBn3oC_VVP6Uyv0XzUbmA== expires Thu, 25 May 2023 10:41:56 GMT
GET H2	200	asm.png website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/main-nav/	6 KB 7 KB	49ms 47ms	Image image/png	2600:9000:225b:1400:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/main-nav/asm.png Requested by Host: www.group-ib.com URL: https://www.group-ib.com/media-center/press-releases/phishing-kits-2022/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:225b:1400:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash 997d49d316b533985208f14602a1ff15a76bf6a567afbb6b6980629ca8d78bab Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; date Thu, 25 May 2023 10:41:57 GMT x-content-type-options nosniff strict-transport-security max-age=31536000; includeSubDomains via 1.1 8c1abfbb8460bed752668233d296dba8.cloudfront.net (CloudFront) x-amz-cf-pop MUC50-P1 x-cache Miss from cloudfront content-length 5941 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Tue, 28 Jun 2022 07:55:26 GMT server nginx etag "1735-5e27d5c025780" x-frame-options sameorigin content-type image/png access-control-allow-origin https://www.group-ib.com cache-control no-cache, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id inH3nafnFfWoEiwfQi82OX9HH-zrsNGfP8oehuD8Pwv9F0s7N3T4rw== expires Thu, 25 May 2023 10:41:56 GMT
GET H2	200	fp.png website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/main-nav/	8 KB 8 KB	44ms 41ms	Image image/png	2600:9000:225b:1400:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/main-nav/fp.png Requested by Host: www.group-ib.com URL: https://www.group-ib.com/media-center/press-releases/phishing-kits-2022/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:225b:1400:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash 15534f98c260c3c3caaedf53335d912010b2de1731477a9fd4dbea89fb4995d9 Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; date Thu, 25 May 2023 10:41:57 GMT x-content-type-options nosniff strict-transport-security max-age=31536000; includeSubDomains via 1.1 8c1abfbb8460bed752668233d296dba8.cloudfront.net (CloudFront) x-amz-cf-pop MUC50-P1 x-cache Miss from cloudfront content-length 7844 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Tue, 28 Jun 2022 07:55:26 GMT server nginx etag "1ea4-5e27d5c025780" x-frame-options sameorigin content-type image/png access-control-allow-origin https://www.group-ib.com cache-control no-cache, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id 5xqb8lGNPvNRZcO6Gsg-11xQX596qPisyfXF0IXNQEeoyoMrMmF0eQ== expires Thu, 25 May 2023 10:41:56 GMT
GET H2	200	drp.png website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/main-nav/	5 KB 6 KB	47ms 45ms	Image image/png	2600:9000:225b:1400:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/main-nav/drp.png Requested by Host: www.group-ib.com URL: https://www.group-ib.com/media-center/press-releases/phishing-kits-2022/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:225b:1400:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash a300a894e169169882504968fae71958a87e0a4322e2aee1b6b0bbd63fd9621f Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; date Thu, 25 May 2023 10:41:57 GMT x-content-type-options nosniff strict-transport-security max-age=31536000; includeSubDomains via 1.1 8c1abfbb8460bed752668233d296dba8.cloudfront.net (CloudFront) x-amz-cf-pop MUC50-P1 x-cache Miss from cloudfront content-length 5398 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Tue, 28 Jun 2022 07:55:26 GMT server nginx etag "1516-5e27d5c025780" x-frame-options sameorigin content-type image/png access-control-allow-origin https://www.group-ib.com cache-control no-cache, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id 6aL6jhD54iH8t-g_r9fd6E4WDlurlyDB5e25kDe2vdOM4Ee-1HsGaQ== expires Thu, 25 May 2023 10:41:56 GMT
GET H2	200	mxdr.png website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/main-nav/	6 KB 7 KB	48ms 46ms	Image image/png	2600:9000:225b:1400:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/main-nav/mxdr.png Requested by Host: www.group-ib.com URL: https://www.group-ib.com/media-center/press-releases/phishing-kits-2022/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:225b:1400:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash 2be8ce2b065360537771ed230d5d72cbd84758ec127ffa035e6d260ed14af5b0 Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; date Thu, 25 May 2023 10:41:57 GMT x-content-type-options nosniff strict-transport-security max-age=31536000; includeSubDomains via 1.1 8c1abfbb8460bed752668233d296dba8.cloudfront.net (CloudFront) x-amz-cf-pop MUC50-P1 x-cache Miss from cloudfront content-length 6506 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Tue, 28 Jun 2022 07:55:26 GMT server nginx etag "196a-5e27d5c025780" x-frame-options sameorigin content-type image/png access-control-allow-origin https://www.group-ib.com cache-control no-cache, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id oWkqy3N36D4zI8-sa5W0XBi_8kqatHKsjmVuMbu3kXWCMgv4flhDxQ== expires Thu, 25 May 2023 10:41:56 GMT
GET H2	200	bep.png website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/main-nav/	6 KB 7 KB	44ms 43ms	Image image/png	2600:9000:225b:1400:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/main-nav/bep.png Requested by Host: www.group-ib.com URL: https://www.group-ib.com/media-center/press-releases/phishing-kits-2022/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:225b:1400:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash 7574ba97d4ee7e81bd60873a52a31ff13359f246d0ac492ef2dabf96233a99e6 Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; date Thu, 25 May 2023 10:41:57 GMT x-content-type-options nosniff strict-transport-security max-age=31536000; includeSubDomains via 1.1 8c1abfbb8460bed752668233d296dba8.cloudfront.net (CloudFront) x-amz-cf-pop MUC50-P1 x-cache Miss from cloudfront content-length 6362 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Tue, 28 Jun 2022 07:55:26 GMT server nginx etag "18da-5e27d5c025780" x-frame-options sameorigin content-type image/png access-control-allow-origin https://www.group-ib.com cache-control no-cache, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id oswJbWmAvveebT1zDN8ly7iCYovsBO_Do567j8o9HtUnXLLJqXOUbA== expires Thu, 25 May 2023 10:41:56 GMT
GET H2	200	blog1-9-min.png website.cdn.group-ib.com/wp-content/uploads/	716 KB 717 KB	109ms 107ms	Image image/png	2600:9000:225b:1400:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://website.cdn.group-ib.com/wp-content/uploads/blog1-9-min.png Requested by Host: www.group-ib.com URL: https://www.group-ib.com/media-center/press-releases/phishing-kits-2022/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:225b:1400:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash acfe9b50dd8005d4a757810c1c48ea6a41b7ac8f4a9d74400d3aa22e0593ee9c Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; date Thu, 25 May 2023 10:41:57 GMT x-content-type-options nosniff strict-transport-security max-age=31536000; includeSubDomains via 1.1 8c1abfbb8460bed752668233d296dba8.cloudfront.net (CloudFront) x-amz-cf-pop MUC50-P1 x-cache Miss from cloudfront content-length 732950 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Wed, 24 May 2023 11:34:06 GMT server nginx etag "b2f16-5fc6ee1b3d501" x-frame-options sameorigin content-type image/png access-control-allow-origin https://www.group-ib.com cache-control no-cache, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id 5KCSZ-tAH_HB8os9uOWj1jKxG3ADdHGcCpOoH9gLa8DUCWIZEI6mxQ== expires Thu, 25 May 2023 10:41:56 GMT
GET H2	200	evolution-of-phishing-kits-in-2022_group-ib-min.png website.cdn.group-ib.com/wp-content/uploads/	240 KB 241 KB	83ms 81ms	Image image/png	2600:9000:225b:1400:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://website.cdn.group-ib.com/wp-content/uploads/evolution-of-phishing-kits-in-2022_group-ib-min.png Requested by Host: www.group-ib.com URL: https://www.group-ib.com/media-center/press-releases/phishing-kits-2022/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:225b:1400:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash 06e8729365301cd2abb3b9b7cdb2316965b5ee42a0558b1e127ccacd08e83ac0 Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; date Thu, 25 May 2023 10:41:57 GMT x-content-type-options nosniff strict-transport-security max-age=31536000; includeSubDomains via 1.1 8c1abfbb8460bed752668233d296dba8.cloudfront.net (CloudFront) x-amz-cf-pop MUC50-P1 x-cache Miss from cloudfront content-length 245447 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Wed, 24 May 2023 11:34:13 GMT server nginx etag "3bec7-5fc6ee2186b84" x-frame-options sameorigin content-type image/png access-control-allow-origin https://www.group-ib.com cache-control no-cache, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id f98ttaYKfQZ272J6HUMzOSLrN8VUCW_OaFLMBe1QW5vASVeh5wAt6A== expires Thu, 25 May 2023 10:41:56 GMT
GET H2	200	tag.js Show response mc.yandex.ru/metrika/	213 KB 73 KB	281ms 139ms	Script application/javascript	2a02:6b8::1:119 GLOBAL_DC
General Check archive.org Show headers Download Go to Full URL https://mc.yandex.ru/metrika/tag.js Requested by Host: website.cdn.group-ib.com URL: https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/js/main.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:6b8::1:119 Moscow, Russian Federation, ASN208722 (GLOBAL_DC, FI), Reverse DNS Software / Resource Hash 7a4c91e180fbb469a728719050b0ab5c95266ca474f1ae2d599e1b3354487e65 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36 Response headers date Thu, 25 May 2023 10:41:58 GMT content-encoding br strict-transport-security max-age=31536000 last-modified Wed, 24 May 2023 11:18:57 GMT accept-ch Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA etag "646dc871-122ce" content-type application/javascript access-control-allow-origin * cache-control max-age=3600 content-length 74446 expires Thu, 25 May 2023 11:41:58 GMT
GET H2	200	telegram-64.svg website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/socials/	1 KB 2 KB	114ms 113ms	Image image/svg+xml	2600:9000:225b:1400:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/socials/telegram-64.svg Requested by Host: website.cdn.group-ib.com URL: https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-press-release.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:225b:1400:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash cdc4d10b6b74ad79b55333b9882e854f054ee8b9953c6203dc46c68dc74eb0fb Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-press-release.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; content-encoding gzip x-content-type-options nosniff date Thu, 25 May 2023 10:41:58 GMT via 1.1 8c1abfbb8460bed752668233d296dba8.cloudfront.net (CloudFront) strict-transport-security max-age=31536000; includeSubDomains x-amz-cf-pop MUC50-P1 x-cache Miss from cloudfront content-length 787 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Tue, 29 Nov 2022 07:39:21 GMT server nginx etag "5fc-5ee9716179e8a-gzip" x-frame-options sameorigin vary Accept-Encoding content-type image/svg+xml access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id cbzPGoLBBOGlOYn6L1BFIj-BFrMEkeWbN6mVL5g4Ic9AYrEtOGZzFQ== expires Thu, 25 May 2023 11:11:58 GMT
GET H2	200	telegram-blue.svg website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/socials/	1 KB 2 KB	118ms 117ms	Image image/svg+xml	2600:9000:225b:1400:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/socials/telegram-blue.svg Requested by Host: website.cdn.group-ib.com URL: https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-press-release.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:225b:1400:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash f134669d195076302131981e5fbcff6cf42dc48f5642c1a8e392862f7b4ca412 Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-press-release.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; content-encoding gzip x-content-type-options nosniff date Thu, 25 May 2023 10:41:58 GMT via 1.1 8c1abfbb8460bed752668233d296dba8.cloudfront.net (CloudFront) strict-transport-security max-age=31536000; includeSubDomains x-amz-cf-pop MUC50-P1 x-cache Miss from cloudfront content-length 792 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Tue, 29 Nov 2022 07:39:21 GMT server nginx etag "5fb-5ee9716179e8a-gzip" x-frame-options sameorigin vary Accept-Encoding content-type image/svg+xml access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id f5MVhERlxmGI7okwkME-TH1wEeEb0BnbeN_rE4-5P7KEjVq_yiV-Jg== expires Thu, 25 May 2023 11:11:58 GMT
GET H2	200	twitter-64.svg website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/socials/	1 KB 1 KB	119ms 117ms	Image image/svg+xml	2600:9000:225b:1400:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/socials/twitter-64.svg Requested by Host: website.cdn.group-ib.com URL: https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-press-release.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:225b:1400:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash ae9dad69229703dfa3b6d226c4c7d692e2f2809bf2475f22612824c2f7602efc Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-press-release.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; content-encoding gzip x-content-type-options nosniff date Thu, 25 May 2023 10:41:58 GMT via 1.1 8c1abfbb8460bed752668233d296dba8.cloudfront.net (CloudFront) strict-transport-security max-age=31536000; includeSubDomains x-amz-cf-pop MUC50-P1 x-cache Miss from cloudfront content-length 554 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Tue, 29 Nov 2022 07:39:21 GMT server nginx etag "426-5ee9716179e8a-gzip" x-frame-options sameorigin vary Accept-Encoding content-type image/svg+xml access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id IrsICrb3-WgQFxAbWWp60q_oDcTC2oOid27p4uH5N_DNBldW5Hontg== expires Thu, 25 May 2023 11:11:58 GMT
GET H2	200	twitter-blue.svg website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/socials/	1 KB 1 KB	117ms 115ms	Image image/svg+xml	2600:9000:225b:1400:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/socials/twitter-blue.svg Requested by Host: website.cdn.group-ib.com URL: https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-press-release.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:225b:1400:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash 811a0ac7da35a5fd342022f6587eec2f5ad3aa69dfdb05a7cea5224030617507 Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-press-release.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; content-encoding gzip x-content-type-options nosniff date Thu, 25 May 2023 10:41:58 GMT via 1.1 8c1abfbb8460bed752668233d296dba8.cloudfront.net (CloudFront) strict-transport-security max-age=31536000; includeSubDomains x-amz-cf-pop MUC50-P1 x-cache Miss from cloudfront content-length 556 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Tue, 29 Nov 2022 07:39:21 GMT server nginx etag "426-5ee9716179e8a-gzip" x-frame-options sameorigin vary Accept-Encoding content-type image/svg+xml access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id mQmstGPSbBV9D7F0m0iuef1bagOAPlwqT93sEH2ygU3RwIiBR4PsQA== expires Thu, 25 May 2023 11:11:58 GMT
GET H2	200	linkedin-64.svg website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/socials/	919 B 1 KB	112ms 111ms	Image image/svg+xml	2600:9000:225b:1400:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/socials/linkedin-64.svg Requested by Host: website.cdn.group-ib.com URL: https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-press-release.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:225b:1400:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash f4991587d5312981e74087707ed399bd3820d83f773e7773c013ce00d6835f28 Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-press-release.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; content-encoding gzip x-content-type-options nosniff date Thu, 25 May 2023 10:41:58 GMT via 1.1 8c1abfbb8460bed752668233d296dba8.cloudfront.net (CloudFront) strict-transport-security max-age=31536000; includeSubDomains x-amz-cf-pop MUC50-P1 x-cache Miss from cloudfront content-length 470 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Tue, 29 Nov 2022 07:39:21 GMT server nginx etag "397-5ee9716179e8a-gzip" x-frame-options sameorigin vary Accept-Encoding content-type image/svg+xml access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id lyviVPJbJzOL-lR5o9zPnT92oWiJ6gyXRA61O83D4TYsvOdEXC4KEQ== expires Thu, 25 May 2023 11:11:58 GMT
GET H2	200	linkedin-blue.svg website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/socials/	919 B 1 KB	117ms 116ms	Image image/svg+xml	2600:9000:225b:1400:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/socials/linkedin-blue.svg Requested by Host: website.cdn.group-ib.com URL: https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-press-release.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:225b:1400:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash dbc32b11b85805050a7fbd85361a52e9c84a34cff6fa03d7d764b190c75fefe3 Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-press-release.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; content-encoding gzip x-content-type-options nosniff date Thu, 25 May 2023 10:41:58 GMT via 1.1 8c1abfbb8460bed752668233d296dba8.cloudfront.net (CloudFront) strict-transport-security max-age=31536000; includeSubDomains x-amz-cf-pop MUC50-P1 x-cache Miss from cloudfront content-length 470 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Tue, 29 Nov 2022 07:39:21 GMT server nginx etag "397-5ee9716179e8a-gzip" x-frame-options sameorigin vary Accept-Encoding content-type image/svg+xml access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id zUTRwgnr2t8C4dt6zKt_wNNvZmtk5Db3HDEsiZYbjh6jqrxefMSYdA== expires Thu, 25 May 2023 11:11:58 GMT
GET H2	200	whatsapp-64.svg website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/socials/	2 KB 2 KB	92ms 91ms	Image image/svg+xml	2600:9000:225b:1400:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/socials/whatsapp-64.svg Requested by Host: website.cdn.group-ib.com URL: https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-press-release.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:225b:1400:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash 45d44c2f23a04d49dbbb3f216ba72782ad80278cf7c4c330b1f03b8263c544ee Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-press-release.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; content-encoding gzip x-content-type-options nosniff date Thu, 25 May 2023 10:41:58 GMT via 1.1 8c1abfbb8460bed752668233d296dba8.cloudfront.net (CloudFront) strict-transport-security max-age=31536000; includeSubDomains x-amz-cf-pop MUC50-P1 x-cache Miss from cloudfront content-length 1046 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Tue, 29 Nov 2022 07:39:21 GMT server nginx etag "7e8-5ee9716179e8a-gzip" x-frame-options sameorigin vary Accept-Encoding content-type image/svg+xml access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id GHXx0AzZh0ACi6j7aSUujW-sPWkZ_-x9zbiL8AHtnvnDFmnn6VSaDg== expires Thu, 25 May 2023 11:11:58 GMT
GET H2	200	whatsapp-blue.svg website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/socials/	2 KB 2 KB	116ms 115ms	Image image/svg+xml	2600:9000:225b:1400:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/socials/whatsapp-blue.svg Requested by Host: website.cdn.group-ib.com URL: https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-press-release.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:225b:1400:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash d3689b014c0ffdfe6c70af7141a0d708166ba120d136838de16b50a7394947a9 Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-press-release.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; content-encoding gzip x-content-type-options nosniff date Thu, 25 May 2023 10:41:58 GMT via 1.1 8c1abfbb8460bed752668233d296dba8.cloudfront.net (CloudFront) strict-transport-security max-age=31536000; includeSubDomains x-amz-cf-pop MUC50-P1 x-cache Miss from cloudfront content-length 1047 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Tue, 29 Nov 2022 07:39:21 GMT server nginx etag "7e7-5ee9716179e8a-gzip" x-frame-options sameorigin vary Accept-Encoding content-type image/svg+xml access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id N8xXEZ_TGcu8-7UqfT34KlnE-0fJTtP4HDT2JU4c_qErVFmAf2a_Kw== expires Thu, 25 May 2023 11:11:58 GMT
GET H2	200	counters.gif forms.hsforms.com/embed/v3/	35 B 689 B	180ms 135ms	Image image/gif	2606:4700::6811:d6f3 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://forms.hsforms.com/embed/v3/counters.gif?key=forms-embed-v2-DEFINITION_SUCCESS&count=1 Requested by Host: www.group-ib.com URL: https://www.group-ib.com/media-center/press-releases/phishing-kits-2022/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6811:d6f3 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36 Response headers date Thu, 25 May 2023 10:41:58 GMT strict-transport-security max-age=31536000; includeSubDomains; preload cf-cache-status DYNAMIC x-hubspot-correlation-id 95aa5f1f-0b84-42ba-a5f6-586609818b92 x-evy-trace-route-service-name envoyset-translator x-envoy-upstream-service-time 3 alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 content-length 35 x-evy-trace-route-configuration listener_https/all x-evy-trace-listener listener_https x-request-id 7b3bce9b-72fa-42f5-886e-e1251e99c35e server cloudflare x-trace 2B7D321A4F8E4537B03CD6F9226FFE1E7ACCAE6B87000000000000000000 vary origin content-type image/gif x-evy-trace-virtual-host all x-evy-trace-served-by-pod iad02/star-hubspot-td/envoy-proxy-759c64d45c-w9hvc access-control-expose-headers X-Origin-Hublet cache-control max-age=0, no-cache, no-store access-control-allow-credentials false x-robots-tag none cf-ray 7ccd2b41aef630f4-FRA
GET H2	200	analytics.js Show response www.google-analytics.com/	51 KB 21 KB	66ms 19ms	Script text/javascript	2a00:1450:4001:800::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google-analytics.com/analytics.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtag/js?id=UA-25492706-2 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:800::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash e7b90d32907f89c49e9e2a2ccca95133277f756f13a14187936d9b948ff67b44 Security Headers Name Value Strict-Transport-Security max-age=10886400; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36 Response headers strict-transport-security max-age=10886400; includeSubDomains; preload content-encoding gzip x-content-type-options nosniff date Thu, 25 May 2023 10:35:34 GMT last-modified Mon, 17 Apr 2023 22:36:01 GMT server Golfe2 age 384 vary Accept-Encoding content-type text/javascript cache-control public, max-age=7200 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 20737 expires Thu, 25 May 2023 12:35:34 GMT
GET H2	200	collectedforms.js Show response js-eu1.hscollectedforms.net/	69 KB 25 KB	107ms 29ms	Script application/javascript	172.65.192.122 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://js-eu1.hscollectedforms.net/collectedforms.js Requested by Host: js-eu1.hs-scripts.com URL: https://js-eu1.hs-scripts.com/25755956.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.65.192.122 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 1e1bce508370a6994bd3e0e67c257f06875e16ca2038c27f498616a0f0d55687 Request headers Referer https://www.group-ib.com/ Origin https://www.group-ib.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36 Response headers date Thu, 25 May 2023 10:41:58 GMT x-amz-version-id SGo7xq5b6d1kUu6c8SU5YR.mobmUICUY via 1.1 7ed0982309781d390a105a3ead66dbfa.cloudfront.net (CloudFront) cf-cache-status HIT content-encoding br x-amz-cf-pop FRA56-P2 age 24 x-amz-server-side-encryption AES256 x-evy-trace-route-service-name envoyset-translator content-security-policy-report-only frame-ancestors 'self'; report-uri https://send.hsbrowserreports.com/csp/report?resource=collected-forms-embed-js/static-1.370/bundles/project.js&cfRay=7ccd2ab06ac02bdc-FRA x-cache Hit from cloudfront cache-tag staticjsapp-collected-forms-embed-js-web-prod,staticjsapp-prod x-envoy-upstream-service-time 2 x-amz-replication-status COMPLETED x-evy-trace-route-configuration listener_https/all x-evy-trace-listener listener_https x-request-id a66d1480-447d-43a4-9748-62fe5f695131 last-modified Tue, 09 May 2023 08:44:18 UTC server cloudflare etag W/"d1b16df440198d59c993c4956b7fded6" vary Accept-Encoding content-type application/javascript; charset=utf-8 access-control-allow-origin * x-evy-trace-virtual-host all x-hs-cache-status HIT cache-control s-maxage=600, max-age=300 x-evy-trace-served-by-pod fra04/app-td/envoy-proxy-5b45bc9bc5-nqkr5 cf-ray 7ccd2b421c1c2be8-FRA x-amz-cf-id nqngZF_yzUzoUt8eFqhZ-s2nKWSgcUwZIYF8Eo2CqhxjgwEmnisY8A== x-hs-target-asset collected-forms-embed-js/static-1.370/bundles/project.js
GET H2	200	banner.js Show response js-eu1.hs-banner.com/v2/25755956/	208 KB 64 KB	111ms 33ms	Script text/javascript	172.65.202.201 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://js-eu1.hs-banner.com/v2/25755956/banner.js Requested by Host: js-eu1.hs-scripts.com URL: https://js-eu1.hs-scripts.com/25755956.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.65.202.201 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 7b505661e730cee3a577f971defb04a68e5882846ca94bca825f3c7c210849e2 Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36 Response headers date Thu, 25 May 2023 10:41:58 GMT x-amz-version-id 2rLrOlFzlyHeenwmL2TxNVl4OQM9W_gC content-encoding br cf-cache-status HIT x-amz-request-id 0YB968NYZ03GTTC2 x-evy-trace-route-service-name envoyset-translator x-amz-server-side-encryption AES256 age 281 x-envoy-upstream-service-time 24 x-amz-id-2 4IDBiYR3VL05tlh6aRha0+viLAM8TxwPIlLLdplVWuav+U1AI8WTyYfCluIXuTF50aB1qBgz54s= x-evy-trace-listener listener_https x-request-id 4c6def24-5112-441f-817c-ae6d9db67926 x-evy-trace-route-configuration listener_https/all last-modified Mon, 15 May 2023 07:10:06 GMT server cloudflare etag W/"7ea966efc161a8e41f870e6b8ea867a1" access-control-max-age 604800 access-control-allow-methods GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD content-type text/javascript; charset=UTF-8 access-control-allow-origin https://www.group-ib.com x-evy-trace-virtual-host all access-control-expose-headers x-last-modified-timestamp, X-HubSpot-NotFound, X-HS-User-Request, Link, Server-Timing cache-control max-age=300,public access-control-allow-credentials true x-evy-trace-served-by-pod fra04/analytics-js-proxy-td/envoy-proxy-699b4f88b6-9vfl9 vary origin, Accept-Encoding timing-allow-origin * access-control-allow-headers Origin, X-Requested-With, Content-Type, Accept, Accept-Charset, Accept-Encoding, X-Override-Internal-Permissions, X-Properties-Source, X-Properties-SourceId, X-Properties-Flag, X-Hubspot-User-Id, X-Hubspot-Trace, X-Hubspot-Callee, X-Hubspot-Offset, X-Hubspot-No-Trace, X-HubSpot-Static-App-Info, X-HubSpot-Messages-Uri, X-HubSpot-Request-Source, X-HubSpot-Request-Reason, Subscription-Billing-Auth-Token, X-App-CSRF, X-Tools-CSRF, Online-Payment-Signing-UUID, X-Source, X-SourceId, X-Origin-UserId, X-Biden-Request-Source, X-HubSpot-CSRF-hubspotapi, X-Force-Cookie-Refresh, X-Force-Cookie-Refresh-No-Cache, X-HS-User-Request, X-Application-Id, X-HS-Referer, X-HubSpot-Correlation-Id cf-ray 7ccd2b421d2037f2-FRA expires Thu, 25 May 2023 10:42:17 GMT
GET H2	200	25755956.js Show response js-eu1.hs-analytics.net/analytics/1685011200000/	65 KB 21 KB	132ms 54ms	Script text/javascript	172.65.238.60 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://js-eu1.hs-analytics.net/analytics/1685011200000/25755956.js Requested by Host: js-eu1.hs-scripts.com URL: https://js-eu1.hs-scripts.com/25755956.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.65.238.60 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash f6d8b2d60702ecc04d9622f888d014a3efc6742c7c109dcbff7efe0c2a9a01b6 Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36 Response headers date Thu, 25 May 2023 10:41:58 GMT content-encoding br cf-cache-status MISS x-amz-request-id 21XXQ11ZTRNT3MAG x-evy-trace-route-service-name envoyset-translator x-amz-server-side-encryption AES256 x-envoy-upstream-service-time 17 x-amz-id-2 WBq3jRsYVrAzE+FvDAcFn6aquMWe5MIfn1GJyDlqBZbQs8oTFGJA3kzWjic2s0mPYekbnh1WBFw= x-evy-trace-listener listener_https x-request-id 96bddc60-700c-477d-b414-8bb4ab17742d x-evy-trace-route-configuration listener_https/all last-modified Mon, 15 May 2023 07:55:55 GMT server cloudflare etag W/"a35ed32b033314a238d48c009a09fdc0" vary origin, Accept-Encoding content-type text/javascript x-evy-trace-virtual-host all x-evy-trace-served-by-pod fra04/analytics-js-proxy-td/envoy-proxy-85d65fb994-5xgrz cache-control max-age=300,public access-control-allow-credentials false cf-ray 7ccd2b4218c13764-FRA expires Thu, 25 May 2023 10:46:58 GMT
GET H2	200	fb.js Show response js-eu1.hsadspixel.net/	6 KB 3 KB	103ms 34ms	Script application/javascript	172.65.219.229 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://js-eu1.hsadspixel.net/fb.js Requested by Host: js-eu1.hs-scripts.com URL: https://js-eu1.hs-scripts.com/25755956.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.65.219.229 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 483ec486a8c947a82da6462397dbe386bebab6b2921f517c35e2b9cb53498c89 Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36 Response headers date Thu, 25 May 2023 10:41:58 GMT x-amz-version-id UWz6VDoRBzzIc_vph_dNl5MbrO6eX90N via 1.1 3f52d342c56014599dee37446f6c9f2e.cloudfront.net (CloudFront) cf-cache-status HIT content-encoding br x-amz-cf-pop FRA56-P2 age 294 x-amz-server-side-encryption AES256 x-evy-trace-route-service-name envoyset-translator content-security-policy-report-only frame-ancestors 'self'; report-uri https://send.hsbrowserreports.com/csp/report?resource=adsscriptloaderstatic/static-1.377/bundles/pixels-release.js&cfRay=7ccd2414de6718c3-FRA x-cache Hit from cloudfront cache-tag staticjsapp-AdsScriptLoaderCloudflare-web-prod,staticjsapp-prod x-envoy-upstream-service-time 0 x-amz-replication-status COMPLETED x-evy-trace-route-configuration listener_https/all x-evy-trace-listener listener_https x-request-id dfb05199-5c27-411d-a811-553fdf97766d last-modified Mon, 22 May 2023 03:15:08 UTC server cloudflare etag W/"862fe95a42e7a27927f5d04635cd29ab" vary Accept-Encoding content-type application/javascript; charset=utf-8 x-hs-cache-status HIT x-evy-trace-virtual-host all cache-control max-age=600 x-evy-trace-served-by-pod fra04/app-td/envoy-proxy-5b45bc9bc5-p7df5 cf-ray 7ccd2b420e81367a-FRA x-amz-cf-id I3qz0WjJNDAXZKbu9N_fAVKAfpyTGKackrcMGyc6M3ulvZo7catiIA== x-hs-target-asset adsscriptloaderstatic/static-1.377/bundles/pixels-release.js
GET H2	200	counters.gif forms-eu1.hsforms.com/embed/v3/	35 B 689 B	392ms 46ms	Image image/gif	172.65.232.43 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://forms-eu1.hsforms.com/embed/v3/counters.gif?key=forms-embed-v2-RENDER_SUCCESS&count=1 Requested by Host: www.group-ib.com URL: https://www.group-ib.com/media-center/press-releases/phishing-kits-2022/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.65.232.43 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36 Response headers date Thu, 25 May 2023 10:41:58 GMT strict-transport-security max-age=31536000; includeSubDomains; preload cf-cache-status DYNAMIC x-hubspot-correlation-id edc176ff-8ecf-4390-89f3-338cd6cee7e1 x-evy-trace-route-service-name envoyset-translator x-envoy-upstream-service-time 2 alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 content-length 35 x-evy-trace-route-configuration listener_https/all x-evy-trace-listener listener_https x-request-id 2f168dde-2e3f-49aa-ac02-c850821f6344 server cloudflare x-trace 2B69183FB24FAA0010807650F9CE974C9BBEE5B28B000000000000000000 vary origin content-type image/gif x-evy-trace-virtual-host all x-evy-trace-served-by-pod fra04/star-hubspot-td/envoy-proxy-79bb87d888-m76dn access-control-expose-headers X-Origin-Hublet cache-control max-age=0, no-cache, no-store access-control-allow-credentials false x-robots-tag none cf-ray 7ccd2b445b4c2c65-FRA
GET H2	200	/ www.facebook.com/tr/	0 185 B	67ms 19ms	Image text/plain	2a03:2880:f176:181:face:b00c:0:25de FACEBOOK
General Check archive.org Show headers Download Go to Show image Full URL https://www.facebook.com/tr/?id=497358181835759&ev=fb_page_view&dl=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fphishing-kits-2022%2F&rl=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fphishing-kits-2022%2F&if=false&ts=1685011318109&sw=1600&sh=1200&at= Requested by Host: www.group-ib.com URL: https://www.group-ib.com/media-center/press-releases/phishing-kits-2022/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a03:2880:f176:181:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US), Reverse DNS Software proxygen-bolt / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36 Response headers strict-transport-security max-age=31536000; includeSubDomains date Thu, 25 May 2023 10:41:58 GMT server proxygen-bolt content-type text/plain access-control-allow-origin access-control-allow-credentials true cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400 content-length 0
GET H2	200	collect px4.ads.linkedin.com/ Redirect Chain https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=4443393&time=1685011318110&url=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fphishing-kits-2022%2F https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=4443393&time=1685011318110&url=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fphishing-kits-2022%2F&cookiesTest=true https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D4443393%26time%3D1685011318110%26url%3Dhttps%253A%252F%252Fwww.group-ib.com%252Fm... https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=4443393&time=1685011318110&url=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fphishing-kits-2022%2F&cookiesTest=true&liSync=true https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=4443393&time=1685011318110&url=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fphishing-kits-2022%2F&cookiesTest=true&liSync=tru...	0 143 B	236ms 210ms	Image application/javascript	13.107.42.14 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Show image Full URL https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=4443393&time=1685011318110&url=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fphishing-kits-2022%2F&cookiesTest=true&liSync=true&e_ipv6=AQLVClXIL-NskAAAAYhSgEhnZc3I7j8kQHPOxryfXRvJHJbqRir-1HKA7ILu_uZJLKtE2yOogu962Q Requested by Host: www.group-ib.com URL: https://www.group-ib.com/media-center/press-releases/phishing-kits-2022/ Protocol H2 Server 13.107.42.14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36 Response headers date Thu, 25 May 2023 10:41:58 GMT x-li-pop afd-prod-lor1-x x-msedge-ref Ref A: F5FCD28B14C94FEABD086C8295082841 Ref B: FRAEDGE1820 Ref C: 2023-05-25T10:41:59Z linkedin-action 1 x-cache CONFIG_NOCACHE content-type application/javascript x-li-fabric prod-lor1 x-li-proto http/2 content-length 0 x-li-uuid AAX8gkUeF9M61RYPZDRRvw== Redirect headers date Thu, 25 May 2023 10:41:58 GMT x-li-pop afd-prod-lor1-x x-msedge-ref Ref A: B737EC7B14B448BBB99644F0D702B407 Ref B: DUS30EDGE0709 Ref C: 2023-05-25T10:41:58Z linkedin-action 1 x-cache CONFIG_NOCACHE x-li-fabric prod-lor1 location https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=4443393&time=1685011318110&url=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fphishing-kits-2022%2F&cookiesTest=true&liSync=true&e_ipv6=AQLVClXIL-NskAAAAYhSgEhnZc3I7j8kQHPOxryfXRvJHJbqRir-1HKA7ILu_uZJLKtE2yOogu962Q x-li-proto http/2 content-length 0 x-li-uuid AAX8gkUatamQ6e7iCpFsdg==
GET H2	200	6si.min.js Show response j.6sc.co/	35 KB 11 KB	132ms 20ms	Script application/javascript	23.36.162.208 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://j.6sc.co/6si.min.js Requested by Host: www.group-ib.com URL: https://www.group-ib.com/media-center/press-releases/phishing-kits-2022/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 23.36.162.208 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS a23-36-162-208.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash 4aec96eddab69454e554bb60664da2e5043c363ebef6921644f619523e7274d7 Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36 Response headers pragma no-cache date Thu, 25 May 2023 10:41:58 GMT content-encoding gzip x-content-type-options nosniff last-modified Wed, 17 May 2023 00:27:16 GMT server nginx/1.14.0 (Ubuntu) etag "64641f64-8a3f" vary Accept-Encoding content-type application/javascript cache-control private, no-cache, proxy-revalidate accept-ranges bytes content-length 11052 expires Thu, 25 May 2023 10:41:58 GMT
GET H2	200	uwt.js Show response static.ads-twitter.com/	56 KB 15 KB	91ms 18ms	Script application/javascript	146.75.116.157 FASTLY
General Check archive.org Show headers Download Go to Full URL https://static.ads-twitter.com/uwt.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-PW7265 Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 146.75.116.157 Frankfurt am Main, Germany, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash cf7fcc9f75c8717897bfaef72f303fab423ce1b70c98512aeb3677e4af988dee Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36 Response headers date Thu, 25 May 2023 10:41:58 GMT content-encoding gzip last-modified Thu, 27 Oct 2022 16:56:53 GMT etag "32ad004436155ec972bc50e6238b5b67+gzip+gzip" vary Accept-Encoding,Host x-cache HIT, HIT content-type application/javascript; charset=utf-8 p3p CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT" x-tw-cdn FT cache-control no-cache accept-ranges bytes content-length 15375 x-served-by cache-iad-kjyo7100081-IAD, cache-fra-eddf8230118-FRA
GET H3	200	fbevents.js Show response connect.facebook.net/en_US/	106 KB 27 KB	40ms 19ms	Script application/x-javascript	2a03:2880:f084:d:face:b00c:0:3 FACEBOOK
General Check archive.org Show headers Download Go to Full URL https://connect.facebook.net/en_US/fbevents.js Requested by Host: www.group-ib.com URL: https://www.group-ib.com/media-center/press-releases/phishing-kits-2022/ Protocol H3 Security QUIC, , AES_128_GCM Server 2a03:2880:f084:d:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US), Reverse DNS Software / Resource Hash 7fee08728b501812ba1c44658ad4ef459c107d78bd6e5b27c8ff80f110c34c04 Security Headers Name Value Content-Security-Policy default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0; Strict-Transport-Security max-age=31536000; preload; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36 Response headers content-security-policy default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0; content-encoding gzip x-content-type-options nosniff strict-transport-security max-age=31536000; preload; includeSubDomains date Thu, 25 May 2023 10:41:58 GMT document-policy force-load-at-top cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400 content-length 27500 x-fb-rlafr 0 x-xss-protection 0 pragma public x-fb-debug ymPlMEk3GMs4JJ1ZTEweuSnLplVw4NsanHbxro2B3I6ha6JO6py7jPEw5DeTE1YnZg9moaCg/cm9hx/zM3NHOg== cross-origin-embedder-policy-report-only require-corp;report-to="coep_report" cross-origin-opener-policy same-origin-allow-popups vary Accept-Encoding report-to {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/?minimize=0"}],"group":"coep_report"} content-type application/x-javascript; charset=utf-8 x-frame-options DENY cache-control public, max-age=1200 permissions-policy accelerometer=(), ambient-light-sensor=(), bluetooth=(), gyroscope=(), hid=(), idle-detection=(), magnetometer=(), midi=(), payment=(), screen-wake-lock=(), serial=(), usb=() priority u=3,i expires Sat, 01 Jan 2000 00:00:00 GMT
GET H2	200	NeverBounce.js Show response cdn.neverbounce.com/widget/dist/	96 KB 29 KB	148ms 28ms	Script application/javascript	18.66.192.94 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://cdn.neverbounce.com/widget/dist/NeverBounce.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-PW7265 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.66.192.94 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-18-66-192-94.muc50.r.cloudfront.net Software AmazonS3 / Resource Hash c99d11cb4960d6e1918ed55d5bcbb316d38b51098e2efc1201904d7274d3273e Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36 Response headers date Wed, 24 May 2023 13:30:46 GMT content-encoding gzip via 1.1 ae6c2eb8d653982f5df6a91a4b14b518.cloudfront.net (CloudFront) last-modified Mon, 02 Mar 2020 18:37:33 GMT server AmazonS3 x-amz-cf-pop MUC50-P1 age 83881 etag W/"c1e06621030dfcba15b88abbcaa546eb" vary Accept-Encoding x-cache Hit from cloudfront content-type application/javascript x-amz-cf-id 0H_wasx2wZA47hB0PkB-Od31pdvVku9KmZ9XFO52UHfSsC7HgnGq4w==
GET H2	200	63e267f61a03d71ea3df5fe7 Show response ws.zoominfo.com/pixel/	3 KB 2 KB	246ms 192ms	Script text/javascript	2606:4700::6810:650c CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://ws.zoominfo.com/pixel/63e267f61a03d71ea3df5fe7 Requested by Host: www.group-ib.com URL: https://www.group-ib.com/media-center/press-releases/phishing-kits-2022/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6810:650c , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Express Resource Hash 3cb86a7204bdecb0407e95c54570cb0f942ef900c1063f6fbf3df21b4a6470dd Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/media-center/press-releases/phishing-kits-2022/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36 Response headers date Thu, 25 May 2023 10:41:58 GMT content-encoding gzip x-content-type-options nosniff cf-cache-status DYNAMIC via 1.1 google server cloudflare x-powered-by Express vary Accept-Encoding content-type text/javascript access-control-allow-origin * access-control-allow-credentials true cf-ray 7ccd2b42bba00368-FRA access-control-allow-headers Content-Type,cf-ipcountry,service-version,x-appengine-user-ip,x-forwarded-for, x-ws-collect-type,requestFromZITag,unifiedScriptVerified,_zitok alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400
GET H3	200	js Show response www.googletagmanager.com/gtag/	260 KB 87 KB	41ms 41ms	Script application/javascript	2a00:1450:4001:82f::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtag/js?id=G-QMES53K3Y2&l=dataLayer&cx=c Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-PW7265 Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:82f::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash ec3ffad2941453e6e425bb9a48950e4c7513d3fe43bd8da56e50d15b679137a5 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36 Response headers date Thu, 25 May 2023 10:41:58 GMT content-encoding br strict-transport-security max-age=31536000; includeSubDomains server Google Tag Manager vary Accept-Encoding content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true cross-origin-resource-policy cross-origin access-control-allow-headers Cache-Control content-length 88544 x-xss-protection 0 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 expires Thu, 25 May 2023 10:41:58 GMT
GET H2	200	collect px4.ads.linkedin.com/ Redirect Chain https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=4496601%2C4443393&time=1685011318135&url=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fphishing-kits-2022%2F&tm=gtmv2 https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=4496601%2C4443393&time=1685011318135&url=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fphishing-kits-2022%2F&tm=gtmv2&cookiesTe... https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D4496601%252C4443393%26time%3D1685011318135%26url%3Dhttps%253A%252F%252Fwww.group-... https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=4496601%2C4443393&time=1685011318135&url=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fphishing-kits-2022%2F&tm=gtmv2&cookiesTe... https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=4496601%2C4443393&time=1685011318135&url=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fphishing-kits-2022%2F&tm=gtmv2&cookiesT...	0 265 B	245ms 191ms	Image application/javascript	13.107.42.14 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Show image Full URL https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=4496601%2C4443393&time=1685011318135&url=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fphishing-kits-2022%2F&tm=gtmv2&cookiesTest=true&liSync=true&e_ipv6=AQK19AnB-foAUgAAAYhSgEhKdcPZLvJr2Wx_cdsCgN00Y71luxYyPhEihkIM24ny-751N_mvF-JV8w Requested by Host: www.group-ib.com URL: https://www.group-ib.com/media-center/press-releases/phishing-kits-2022/ Protocol H2 Server 13.107.42.14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36 Response headers date Thu, 25 May 2023 10:41:58 GMT x-li-pop afd-prod-lor1-x x-msedge-ref Ref A: B92CA5442BAA4E38B8F70961434D7D90 Ref B: FRAEDGE1820 Ref C: 2023-05-25T10:41:59Z linkedin-action 1 x-cache CONFIG_NOCACHE content-type application/javascript x-li-fabric prod-lor1 x-li-proto http/2 content-length 0 x-li-uuid AAX8gkUeFNfglc+aKBoSjA== Redirect headers date Thu, 25 May 2023 10:41:58 GMT x-li-pop afd-prod-lor1-x x-msedge-ref Ref A: 5918492EBE7F4C48A0C0E46FF19FF656 Ref B: DUS30EDGE0709 Ref C: 2023-05-25T10:41:58Z linkedin-action 1 x-cache CONFIG_NOCACHE x-li-fabric prod-lor1 location https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=4496601%2C4443393&time=1685011318135&url=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fphishing-kits-2022%2F&tm=gtmv2&cookiesTest=true&liSync=true&e_ipv6=AQK19AnB-foAUgAAAYhSgEhKdcPZLvJr2Wx_cdsCgN00Y71luxYyPhEihkIM24ny-751N_mvF-JV8w x-li-proto http/2 content-length 0 x-li-uuid AAX8gkUaSDL0sOO5rfjqXg==
POST H2	200	collect Show response www.google-analytics.com/j/	2 B 146 B	30ms 29ms	XHR text/plain	2a00:1450:4001:800::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google-analytics.com/j/collect?v=1&_v=j100&a=1865675737&t=pageview&_s=1&dl=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fphishing-kits-2022%2F&ul=en-us&de=UTF-8&dt=Group-IB%3A%20the%20use%20of%20phishing%20kits%20surges%20by%2025%25%20in%202022%20as%20they%20become%20more%20evasive%20and%20advanced%20%7C%20Group-IB&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YEBAAUABAAAAACAAI~&jid=345067419&gjid=842974355&cid=933712172.1685011318&tid=UA-25492706-2&_gid=880331990.1685011318&_r=1&gtm=457e35m0&jsscut=1&z=1883892971 Requested by Host: fhp-aws-antibot-back.group-ib.com URL: https://fhp-aws-antibot-back.group-ib.com/d/bt-autoinject.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:800::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af Security Headers Name Value X-Content-Type-Options nosniff Request headers Referer https://www.group-ib.com/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36 Content-Type text/plain Response headers pragma no-cache date Thu, 25 May 2023 10:41:58 GMT x-content-type-options nosniff last-modified Sun, 17 May 1998 03:00:00 GMT server Golfe2 content-type text/plain access-control-allow-origin https://www.group-ib.com cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 2 expires Fri, 01 Jan 1990 00:00:00 GMT
POST H2	200	collect Show response stats.g.doubleclick.net/j/	4 B 350 B	83ms 27ms	XHR text/plain	2a00:1450:400c:c04::9b GOOGLE
General Check archive.org Show headers Download Go to Full URL https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j100&tid=UA-25492706-2&cid=933712172.1685011318&jid=95604123&gjid=1279589325&_gid=880331990.1685011318&_u=YGDAgUABAAAAAGAEK~&z=1989033854 Requested by Host: fhp-aws-antibot-back.group-ib.com URL: https://fhp-aws-antibot-back.group-ib.com/d/bt-autoinject.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:400c:c04::9b Brussels, Belgium, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash 84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80 Security Headers Name Value Strict-Transport-Security max-age=10886400; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer https://www.group-ib.com/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36 Content-Type text/plain Response headers pragma no-cache strict-transport-security max-age=10886400; includeSubDomains; preload date Thu, 25 May 2023 10:41:58 GMT x-content-type-options nosniff last-modified Sun, 17 May 1998 03:00:00 GMT server Golfe2 content-type text/plain access-control-allow-origin https://www.group-ib.com cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 4 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	collect www.google-analytics.com/	35 B 194 B	19ms 19ms	Image image/gif	2a00:1450:4001:800::200e GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google-analytics.com/collect?v=1&_v=j100&a=1865675737&t=pageview&_s=1&dl=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fphishing-kits-2022%2F&ul=en-us&de=UTF-8&dt=Group-IB%3A%20the%20use%20of%20phishing%20kits%20surges%20by%2025%25%20in%202022%20as%20they%20become%20more%20evasive%20and%20advanced%20%7C%20Group-IB&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YGDAgUABAAAAACAEK~&jid=95604123&gjid=1279589325&cid=933712172.1685011318&tid=UA-25492706-2&_gid=880331990.1685011318&gtm=45He35m0n71PW7265&cd1=933712172.1685011318&z=412609354 Requested by Host: www.group-ib.com URL: https://www.group-ib.com/media-center/press-releases/phishing-kits-2022/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:800::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash 8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015 Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36 Response headers pragma no-cache date Thu, 25 May 2023 05:17:13 GMT x-content-type-options nosniff last-modified Sun, 17 May 1998 03:00:00 GMT server Golfe2 age 19485 content-type image/gif access-control-allow-origin * cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 35 expires Mon, 01 Jan 1990 00:00:00 GMT
GET H2	200	json Show response api-eu1.hubapi.com/hs-script-loader-public/v1/config/pixels-and-events/	250 B 1 KB	125ms 64ms	XHR application/json	2a06:98c1:3200::90:1 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://api-eu1.hubapi.com/hs-script-loader-public/v1/config/pixels-and-events/json?portalId=25755956 Requested by Host: fhp-aws-antibot-back.group-ib.com URL: https://fhp-aws-antibot-back.group-ib.com/d/bt-autoinject.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a06:98c1:3200::90:1 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash fc50d7c745b4b7ad268ab0c4a71b545dab230889a7f171a29e4a6534041f65bc Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36 Response headers date Thu, 25 May 2023 10:41:58 GMT strict-transport-security max-age=31536000; includeSubDomains; preload content-encoding br cf-cache-status DYNAMIC nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} x-hubspot-correlation-id 9c8de49c-37d7-41fb-8099-93753e4f5c5d x-evy-trace-route-service-name envoyset-translator x-envoy-upstream-service-time 9 alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 x-evy-trace-route-configuration listener_https/all x-evy-trace-listener listener_https x-request-id e10ea14f-c0c2-40f8-9e1e-6326c488fb3a server cloudflare x-trace 2BC0803EA7CA04709D58A69A759D006741704BA8EB000000000000000000 vary origin access-control-allow-methods GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD content-type application/json;charset=utf-8 access-control-allow-origin https://www.group-ib.com x-evy-trace-virtual-host all access-control-max-age 180 access-control-allow-credentials false x-evy-trace-served-by-pod fra04/hubapi-td/envoy-proxy-6568b767df-q8448 report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=DnbwcS7aN2t%2FKPLxpWXnE3%2FEIHfwC2jUn4f6bpJazU1lpnYQhpWvkfbB3bUsKjMla7v6l%2B6C%2BxMR3W9w%2FAsDAp7K84twzRniIIonAAvkhvliWHFVXVjNwpRDbbpdAMoH9MpjmCnwCjQz6jUsi7C6Mg%3D%3D"}],"group":"cf-nel","max_age":604800} cf-ray 7ccd2b432801bb53-FRA access-control-allow-headers *
GET H2	200	json Show response forms-eu1.hscollectedforms.net/collected-forms/v1/config/	116 B 451 B	56ms 37ms	XHR application/json	172.65.192.122 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://forms-eu1.hscollectedforms.net/collected-forms/v1/config/json?portalId=25755956&utk= Requested by Host: fhp-aws-antibot-back.group-ib.com URL: https://fhp-aws-antibot-back.group-ib.com/d/bt-autoinject.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.65.192.122 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 43f22362329b9705cf8629061fb5b1d1a38f1cc2bc9fd46728f73e5cd9eb77cf Request headers Accept application/json, text/plain, */* Referer https://www.group-ib.com/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36 Response headers date Thu, 25 May 2023 10:41:58 GMT content-encoding br cf-cache-status DYNAMIC x-hubspot-correlation-id 37aacf95-7325-48fe-83c2-3a28d533071d x-evy-trace-route-service-name envoyset-translator x-envoy-upstream-service-time 8 x-evy-trace-route-configuration listener_https/all x-evy-trace-listener listener_https x-request-id 8584ca72-9b0f-4138-87d7-512db8134868 server cloudflare vary Accept-Encoding access-control-allow-methods GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD content-type application/json;charset=utf-8 access-control-allow-origin https://www.group-ib.com x-evy-trace-virtual-host all cache-control max-age=0 x-evy-trace-served-by-pod fra04/app-td/envoy-proxy-5b45bc9bc5-p7df5 access-control-max-age 180 x-robots-tag none access-control-allow-headers * cf-ray 7ccd2b42ed3b2be8-FRA
POST H2	200	collect Show response stats.g.doubleclick.net/j/	4 B 70 B	49ms 28ms	XHR text/plain	2a00:1450:400c:c04::9b GOOGLE
General Check archive.org Show headers Download Go to Full URL https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j100&tid=UA-25492706-2&cid=933712172.1685011318&jid=345067419&gjid=842974355&_gid=880331990.1685011318&_u=YEBAAUAAAAAAACAAI~&z=1736955778 Requested by Host: fhp-aws-antibot-back.group-ib.com URL: https://fhp-aws-antibot-back.group-ib.com/d/bt-autoinject.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:400c:c04::9b Brussels, Belgium, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash 84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80 Security Headers Name Value Strict-Transport-Security max-age=10886400; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer https://www.group-ib.com/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36 Content-Type text/plain Response headers pragma no-cache strict-transport-security max-age=10886400; includeSubDomains; preload date Thu, 25 May 2023 10:41:58 GMT x-content-type-options nosniff last-modified Sun, 17 May 1998 03:00:00 GMT server Golfe2 content-type text/plain access-control-allow-origin https://www.group-ib.com cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 4 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H3	200	649324202964935 Show response connect.facebook.net/signals/config/	379 KB 108 KB	69ms 69ms	Script application/x-javascript	2a03:2880:f084:d:face:b00c:0:3 FACEBOOK
General Check archive.org Show headers Download Go to Full URL https://connect.facebook.net/signals/config/649324202964935?v=2.9.104&r=stable Requested by Host: connect.facebook.net URL: https://connect.facebook.net/en_US/fbevents.js Protocol H3 Security QUIC, , AES_128_GCM Server 2a03:2880:f084:d:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US), Reverse DNS Software / Resource Hash 12d3f6c46cfa13bd4236130c8388e8722111e88cfc3a53b22f6dd6b499db3633 Security Headers Name Value Content-Security-Policy default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0; Strict-Transport-Security max-age=31536000; preload; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36 Response headers content-security-policy default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0; content-encoding gzip x-content-type-options nosniff strict-transport-security max-age=31536000; preload; includeSubDomains date Thu, 25 May 2023 10:41:58 GMT document-policy force-load-at-top cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400 x-fb-rlafr 0 x-xss-protection 0 pragma public x-fb-debug Ci61ExhATWRCiqXN+HjAo8DGek8/uj7wHrq0mBIXzOjdz4nGPPfnhWvY5Y9VofZYaEz0wz9FseEno7ZqqllAKw== cross-origin-embedder-policy-report-only require-corp;report-to="coep_report" cross-origin-opener-policy same-origin-allow-popups vary Accept-Encoding report-to {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/?minimize=0"}],"group":"coep_report"} content-type application/x-javascript; charset=utf-8 x-frame-options DENY origin-agent-cluster ?0 cache-control public, max-age=1200 permissions-policy accelerometer=(), ambient-light-sensor=(), bluetooth=(), gyroscope=(), hid=(), idle-detection=(), magnetometer=(), midi=(), screen-wake-lock=(), serial=(), usb=() priority u=3,i expires Sat, 01 Jan 2000 00:00:00 GMT
POST H2	204	collect region1.analytics.google.com/g/	0 255 B	75ms 28ms	Ping text/plain	2001:4860:4802:34::36 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://region1.analytics.google.com/g/collect?v=2&tid=G-QMES53K3Y2&gtm=45je35m0&_p=1865675737&_gaz=1&cid=933712172.1685011318&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_s=1&sid=1685011318&sct=1&seg=0&dl=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fphishing-kits-2022%2F&dr=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fphishing-kits-2022%2F&dt=Group-IB%3A%20the%20use%20of%20phishing%20kits%20surges%20by%2025%25%20in%202022%20as%20they%20become%20more%20evasive%20and%20advanced%20%7C%20Group-IB&en=page_view&_fv=1&_ss=1 Requested by Host: fhp-aws-antibot-back.group-ib.com URL: https://fhp-aws-antibot-back.group-ib.com/d/bt-autoinject.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2001:4860:4802:34::36 , United States, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36 Response headers pragma no-cache date Thu, 25 May 2023 10:41:58 GMT server Golfe2 content-type text/plain access-control-allow-origin https://www.group-ib.com cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 0 expires Fri, 01 Jan 1990 00:00:00 GMT
POST H2	204	collect stats.g.doubleclick.net/g/	0 56 B	28ms 27ms	Ping text/plain	2a00:1450:400c:c04::9b GOOGLE
General Check archive.org Show headers Download Go to Full URL https://stats.g.doubleclick.net/g/collect?v=2&tid=G-QMES53K3Y2&cid=933712172.1685011318&gtm=45je35m0&aip=1 Requested by Host: fhp-aws-antibot-back.group-ib.com URL: https://fhp-aws-antibot-back.group-ib.com/d/bt-autoinject.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:400c:c04::9b Brussels, Belgium, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36 Response headers pragma no-cache date Thu, 25 May 2023 10:41:58 GMT server Golfe2 content-type text/plain access-control-allow-origin https://www.group-ib.com cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	ga-audiences www.google.de/ads/	42 B 107 B	115ms 60ms	Image image/gif	2a00:1450:4001:82f::2003 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.de/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&tid=G-QMES53K3Y2&cid=933712172.1685011318&gtm=45je35m0&aip=1&z=410397406 Requested by Host: www.group-ib.com URL: https://www.group-ib.com/media-center/press-releases/phishing-kits-2022/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:82f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36 Response headers pragma no-cache date Thu, 25 May 2023 10:41:58 GMT x-content-type-options nosniff server cafe content-type image/gif p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin timing-allow-origin * alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	ga-audiences www.google.com/ads/	42 B 107 B	103ms 56ms	Image image/gif	2a00:1450:4001:831::2004 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j100&tid=UA-25492706-2&cid=933712172.1685011318&jid=95604123&_u=YGDAgUABAAAAAGAEK~&z=1332731627 Requested by Host: www.group-ib.com URL: https://www.group-ib.com/media-center/press-releases/phishing-kits-2022/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:831::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36 Response headers pragma no-cache date Thu, 25 May 2023 10:41:58 GMT x-content-type-options nosniff server cafe content-type image/gif p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin timing-allow-origin * alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	ga-audiences www.google.de/ads/	42 B 107 B	97ms 59ms	Image image/gif	2a00:1450:4001:82f::2003 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j100&tid=UA-25492706-2&cid=933712172.1685011318&jid=95604123&_u=YGDAgUABAAAAAGAEK~&z=1332731627 Requested by Host: www.group-ib.com URL: https://www.group-ib.com/media-center/press-releases/phishing-kits-2022/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:82f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36 Response headers pragma no-cache date Thu, 25 May 2023 10:41:58 GMT x-content-type-options nosniff server cafe content-type image/gif p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin timing-allow-origin * alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	ga-audiences www.google.com/ads/	42 B 408 B	101ms 56ms	Image image/gif	2a00:1450:4001:831::2004 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j100&tid=UA-25492706-2&cid=933712172.1685011318&jid=345067419&_u=YEBAAUAAAAAAACAAI~&z=794844405 Requested by Host: www.group-ib.com URL: https://www.group-ib.com/media-center/press-releases/phishing-kits-2022/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:831::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36 Response headers pragma no-cache date Thu, 25 May 2023 10:41:58 GMT x-content-type-options nosniff server cafe content-type image/gif p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin timing-allow-origin * alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	ga-audiences www.google.de/ads/	42 B 408 B	87ms 58ms	Image image/gif	2a00:1450:4001:82f::2003 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j100&tid=UA-25492706-2&cid=933712172.1685011318&jid=345067419&_u=YEBAAUAAAAAAACAAI~&z=794844405 Requested by Host: www.group-ib.com URL: https://www.group-ib.com/media-center/press-releases/phishing-kits-2022/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:82f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36 Response headers pragma no-cache date Thu, 25 May 2023 10:41:58 GMT x-content-type-options nosniff server cafe content-type image/gif p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin timing-allow-origin * alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	counters.gif forms-eu1.hsforms.com/embed/v3/	35 B 205 B	347ms 46ms	Image image/gif	172.65.232.43 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://forms-eu1.hsforms.com/embed/v3/counters.gif?key=collected-forms-embed-js-form-bind&count=3 Requested by Host: www.group-ib.com URL: https://www.group-ib.com/media-center/press-releases/phishing-kits-2022/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.65.232.43 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36 Response headers date Thu, 25 May 2023 10:41:58 GMT strict-transport-security max-age=31536000; includeSubDomains; preload cf-cache-status DYNAMIC x-hubspot-correlation-id 185c90f4-3968-412a-91ca-6f21480e5541 x-evy-trace-route-service-name envoyset-translator x-envoy-upstream-service-time 2 alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 content-length 35 x-evy-trace-route-configuration listener_https/all x-evy-trace-listener listener_https x-request-id e13207fb-05f3-434a-8494-8248e2bedb19 server cloudflare x-trace 2B9879824F7F5DCB1F90EC65ACBB55573C98ACCB89000000000000000000 vary origin content-type image/gif x-evy-trace-virtual-host all x-evy-trace-served-by-pod fra04/star-hubspot-td/envoy-proxy-79bb87d888-m76dn access-control-expose-headers X-Origin-Hublet cache-control max-age=0, no-cache, no-store access-control-allow-credentials false x-robots-tag none cf-ray 7ccd2b452c832c65-FRA
GET H2	200	adsct t.co/i/	43 B 377 B	168ms 128ms	Image image/gif	104.244.42.69 TWITTER
General Check archive.org Show headers Download Go to Show image Full URL https://t.co/i/adsct?bci=3&eci=2&event_id=30501cb2-05e3-4f19-8e84-577157b0cbb6&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=4b33c4c6-bb66-4e51-914b-4dd5fe3dec05&tw_document_href=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fphishing-kits-2022%2F&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=o6fwj&type=javascript&version=2.3.29 Requested by Host: www.group-ib.com URL: https://www.group-ib.com/media-center/press-releases/phishing-kits-2022/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.244.42.69 , United States, ASN13414 (TWITTER, US), Reverse DNS Software tsa_o / Resource Hash ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957 Security Headers Name Value Strict-Transport-Security max-age=0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36 Response headers x-response-time 109 date Thu, 25 May 2023 10:41:58 GMT strict-transport-security max-age=0 server tsa_o content-type image/gif;charset=utf-8 x-transaction-id 5368aa32ffc02783 cache-control no-cache, no-store, max-age=0 perf 7626143928 x-connection-hash 9560c633aaae975b7ea1d30c3779ca2964eb104355461dfcca0152d5febe5ade content-length 43
GET H2	200	adsct analytics.twitter.com/i/	43 B 396 B	189ms 125ms	Image image/gif	104.244.42.3 TWITTER
General Check archive.org Show headers Download Go to Show image Full URL https://analytics.twitter.com/i/adsct?bci=3&eci=2&event_id=30501cb2-05e3-4f19-8e84-577157b0cbb6&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=4b33c4c6-bb66-4e51-914b-4dd5fe3dec05&tw_document_href=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fphishing-kits-2022%2F&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=o6fwj&type=javascript&version=2.3.29 Requested by Host: www.group-ib.com URL: https://www.group-ib.com/media-center/press-releases/phishing-kits-2022/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.244.42.3 , United States, ASN13414 (TWITTER, US), Reverse DNS Software tsa_o / Resource Hash ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957 Security Headers Name Value Strict-Transport-Security max-age=631138519 Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36 Response headers x-response-time 105 date Thu, 25 May 2023 10:41:57 GMT strict-transport-security max-age=631138519 server tsa_o content-type image/gif;charset=utf-8 x-transaction-id 10fe298f98532d76 cache-control no-cache, no-store, max-age=0 perf 7626143928 x-connection-hash 7b79361a3fb3260ad8b258272767fe7094b497f616bc8edc96a9f0086880cf4b content-length 43
GET H2	200	/ Show response c.6sc.co/	7 B 203 B	53ms 36ms	XHR text/html	23.36.162.208 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://c.6sc.co/ Requested by Host: fhp-aws-antibot-back.group-ib.com URL: https://fhp-aws-antibot-back.group-ib.com/d/bt-autoinject.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 23.36.162.208 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS a23-36-162-208.deploy.static.akamaitechnologies.com Software / Resource Hash fe04a9dc88d3f3be8d4f6bc63a9a80f45a4c6d8460e7551dab849457c091920a Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36 Response headers date Thu, 25 May 2023 10:41:58 GMT access-control-max-age 86400 access-control-allow-methods GET,POST content-type text/html access-control-allow-origin https://www.group-ib.com access-control-allow-credentials true access-control-allow-headers * content-length 7
GET H2	200	/ Show response ipv6.6sc.co/	24 B 318 B	260ms 39ms	XHR text/html	2a02:26f0:6c00::210:bb9b AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://ipv6.6sc.co/ Requested by Host: fhp-aws-antibot-back.group-ib.com URL: https://fhp-aws-antibot-back.group-ib.com/d/bt-autoinject.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:6c00::210:bb9b Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software / Resource Hash 2722cb522f4fe3f0f788fb0b73cb835e95cfc60e6808e5e401f1add3d186da92 Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36 Response headers pragma no-cache date Thu, 25 May 2023 10:41:58 GMT vary Origin content-type text/html access-control-allow-origin https://www.group-ib.com cache-control max-age=0, no-cache, no-store 6si-ipv6 2001:1b60:2:240:3247::11 server-timing cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="468058_34651031_95342042_18_846_48_0";dur=1 content-length 24 expires Thu, 25 May 2023 10:41:58 GMT
GET H2	200	img.gif b.6sc.co/v1/beacon/	43 B 493 B	253ms 243ms	Image image/gif	23.36.162.208 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=e84d9c08a990af8592952e7ac9a983ad&svisitor=null&visitor=cca16b57-1443-4a84-8e1e-66453d08ca12&session=722419ce-987e-4bf7-82c2-ab7ab7717c0b&event=a_pageload&q=%7B%22pageLoadTime%22%3A%22Thu%2C%2025%20May%202023%2010%3A41%3A58%20GMT%22%2C%22settings%22%3A%22%5B%7B%5C%22name%5C%22%3A%5C%22enableEventTracking%5C%22%2C%5C%22value%5C%22%3A%5C%22true%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Thu%2C%2025%20May%202023%2010%3A41%3A58%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setToken%5C%22%2C%5C%22value%5C%22%3A%5C%22e84d9c08a990af8592952e7ac9a983ad%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Thu%2C%2025%20May%202023%2010%3A41%3A58%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setEndpoint%5C%22%2C%5C%22value%5C%22%3A%5C%22b.6sc.co%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Thu%2C%2025%20May%202023%2010%3A41%3A58%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%5D%22%7D&isIframe=false&m=%7B%22description%22%3A%22Group-IB%2C%20a%20global%20cybersecurity%20leader%20headquartered%20in%20Singapore%2C%20has%20recorded%20a%2025%25%20increase%20in%20the%20use%20of%20phishing%20kits%20in%202022.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Group-IB%3A%20the%20use%20of%20phishing%20kits%20surges%20by%2025%25%20in%202022%20as%20they%20become%20more%20evasive%20and%20advanced%20%7C%20Group-IB%22%7D&cb=&r=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fphishing-kits-2022%2F&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fphishing-kits-2022%2F&pageViewId=c1e9d031-19df-43ba-8519-cf95dd163b74 Requested by Host: www.group-ib.com URL: https://www.group-ib.com/media-center/press-releases/phishing-kits-2022/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 23.36.162.208 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS a23-36-162-208.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36 Response headers date Thu, 25 May 2023 10:41:58 GMT x-content-type-options nosniff content-length 43 pragma no-cache last-modified Tue, 05 Oct 2021 22:17:52 GMT server nginx/1.14.0 (Ubuntu) etag "615ccf10-2b" access-control-max-age 86400 access-control-allow-methods GET,POST content-type image/gif access-control-allow-origin cache-control private, no-cache, no-cache=Set-Cookie, proxy-revalidate access-control-allow-credentials true accept-ranges bytes access-control-allow-headers * expires Wed, 19 Apr 2000 11:43:00 GMT
GET H2	200	notify Show response api.neverbounce.com/v4/poe/	63 B 283 B	383ms 122ms	Script application/javascript	52.0.6.237 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://api.neverbounce.com/v4/poe/notify?key=public_feedec8c69cd171b06421bb96273f04d&event=form.load&callback=__neverbounce_826903 Requested by Host: cdn.neverbounce.com URL: https://cdn.neverbounce.com/widget/dist/NeverBounce.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.0.6.237 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-52-0-6-237.compute-1.amazonaws.com Software nginx / Resource Hash 5ccaa91a4ae6e40cfe6b1c6769cd383c868f148dc310554f9d9d2b738499276f Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36 Response headers date Thu, 25 May 2023 10:41:58 GMT content-encoding gzip strict-transport-security max-age=31536000; includeSubDomains server nginx vary Accept-Encoding content-type application/javascript cache-control no-cache, private x-ua-compatible IE=Edge
GET H2	200	notify Show response api.neverbounce.com/v4/poe/	63 B 282 B	382ms 123ms	Script application/javascript	52.0.6.237 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://api.neverbounce.com/v4/poe/notify?key=public_feedec8c69cd171b06421bb96273f04d&event=form.load&callback=__neverbounce_646795 Requested by Host: cdn.neverbounce.com URL: https://cdn.neverbounce.com/widget/dist/NeverBounce.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.0.6.237 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-52-0-6-237.compute-1.amazonaws.com Software nginx / Resource Hash e700dbd1e763af0d68c0c1c14fd2028a085ee2986a25badbf604120b98576f5e Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36 Response headers date Thu, 25 May 2023 10:41:58 GMT content-encoding gzip strict-transport-security max-age=31536000; includeSubDomains server nginx vary Accept-Encoding content-type application/javascript cache-control no-cache, private x-ua-compatible IE=Edge
GET H2	200	notify Show response api.neverbounce.com/v4/poe/	63 B 282 B	386ms 131ms	Script application/javascript	52.0.6.237 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://api.neverbounce.com/v4/poe/notify?key=public_feedec8c69cd171b06421bb96273f04d&event=form.load&callback=__neverbounce_317326 Requested by Host: cdn.neverbounce.com URL: https://cdn.neverbounce.com/widget/dist/NeverBounce.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.0.6.237 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-52-0-6-237.compute-1.amazonaws.com Software nginx / Resource Hash e84b62e02984217cdd23ef0954edcf61be38071b272576a43527b68268181c39 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36 Response headers date Thu, 25 May 2023 10:41:58 GMT content-encoding gzip strict-transport-security max-age=31536000; includeSubDomains server nginx vary Accept-Encoding content-type application/javascript cache-control no-cache, private x-ua-compatible IE=Edge
GET H3	200	js Show response www.googletagmanager.com/gtag/	208 KB 73 KB	43ms 43ms	Script application/javascript	2a00:1450:4001:82f::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtag/js?id=AW-10882981508 Requested by Host: js-eu1.hsadspixel.net URL: https://js-eu1.hsadspixel.net/fb.js Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:82f::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash 4bbe63849e0e8a010e3e17f5697bbb52d68755d4b62b458663e21a6919f1a870 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36 Response headers date Thu, 25 May 2023 10:41:58 GMT content-encoding br strict-transport-security max-age=31536000; includeSubDomains cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 74633 x-xss-protection 0 last-modified Thu, 25 May 2023 09:00:00 GMT server Google Tag Manager vary Accept-Encoding content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true access-control-allow-headers Cache-Control expires Thu, 25 May 2023 10:41:58 GMT
GET H3	200	js Show response www.googletagmanager.com/gtag/	208 KB 73 KB	37ms 37ms	Script application/javascript	2a00:1450:4001:82f::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtag/js?id=AW-10882981508&l=dataLayer&cx=c Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtag/js?id=UA-25492706-2 Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:82f::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash 430450d5e57d6053f117c073650cd7481e1be55f75194791aa6e6d334ac5537f Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36 Response headers date Thu, 25 May 2023 10:41:58 GMT content-encoding br strict-transport-security max-age=31536000; includeSubDomains cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 74660 x-xss-protection 0 last-modified Thu, 25 May 2023 09:00:00 GMT server Google Tag Manager vary Accept-Encoding content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true access-control-allow-headers Cache-Control expires Thu, 25 May 2023 10:41:58 GMT
GET H2	200	sync_cookie_image_decide mc.yandex.com/ Redirect Chain https://mc.yandex.com/sync_cookie_image_check https://mc.yandex.ru/sync_cookie_image_start?redirect_domain=mc.yandex.com&token=10014.inN2DBfdWeehpwJE74w-ZVReqbiA9egIzBzmWiFhUP1u1FziI0zvteBCGvgx3-TQ.1jw36qzXssbcAinIe5ZEDdwLW9I%2C https://mc.yandex.com/sync_cookie_image_decide?token=10014.23_0YRMQBRARh9lCXFxxdaSmU58tKttTos1QIDfOWBOT0fM4wL-_H240AJsFf798dTbC8JuySBT-KEgIzBgO_5k_KavG4sczVdM9Ajj49ok%2C.fo-m3nYkEddwgfvcwGmFyNKd0Ko%2C	43 B 67 B	73ms 72ms	Image image/gif	2a02:6b8::1:119 GLOBAL_DC
General Check archive.org Show headers Download Go to Show image Full URL https://mc.yandex.com/sync_cookie_image_decide?token=10014.23_0YRMQBRARh9lCXFxxdaSmU58tKttTos1QIDfOWBOT0fM4wL-_H240AJsFf798dTbC8JuySBT-KEgIzBgO_5k_KavG4sczVdM9Ajj49ok%2C.fo-m3nYkEddwgfvcwGmFyNKd0Ko%2C Requested by Host: www.group-ib.com URL: https://www.group-ib.com/media-center/press-releases/phishing-kits-2022/ Protocol H2 Server 2a02:6b8::1:119 Moscow, Russian Federation, ASN208722 (GLOBAL_DC, FI), Reverse DNS Software / Resource Hash 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87 Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36 Response headers date Thu, 25 May 2023 10:41:58 GMT strict-transport-security max-age=31536000 content-length 43 x-xss-protection 1; mode=block content-type image/gif Redirect headers location https://mc.yandex.com/sync_cookie_image_decide?token=10014.23_0YRMQBRARh9lCXFxxdaSmU58tKttTos1QIDfOWBOT0fM4wL-_H240AJsFf798dTbC8JuySBT-KEgIzBgO_5k_KavG4sczVdM9Ajj49ok%2C.fo-m3nYkEddwgfvcwGmFyNKd0Ko%2C date Thu, 25 May 2023 10:41:58 GMT strict-transport-security max-age=31536000 x-xss-protection 1; mode=block
GET H2	200	/ www.facebook.com/tr/	0 31 B	20ms 19ms	Image text/plain	2a03:2880:f176:181:face:b00c:0:25de FACEBOOK
General Check archive.org Show headers Download Go to Show image Full URL https://www.facebook.com/tr/?id=649324202964935&ev=PageView&dl=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fphishing-kits-2022%2F&rl=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fphishing-kits-2022%2F&if=false&ts=1685011318372&sw=1600&sh=1200&v=2.9.104&r=stable&ec=0&o=30&fbp=fb.1.1685011318370.1049122830&cs_est=true&it=1685011318217&coo=false&rqm=GET Requested by Host: www.group-ib.com URL: https://www.group-ib.com/media-center/press-releases/phishing-kits-2022/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a03:2880:f176:181:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US), Reverse DNS Software proxygen-bolt / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36 Response headers strict-transport-security max-age=31536000; includeSubDomains date Thu, 25 May 2023 10:41:58 GMT server proxygen-bolt content-type text/plain access-control-allow-origin access-control-allow-credentials true cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400 content-length 0
GET H2	200	advert.gif mc.yandex.com/metrika/	43 B 113 B	131ms 130ms	Image image/gif	2a02:6b8::1:119 GLOBAL_DC
General Check archive.org Show headers Download Go to Show image Full URL https://mc.yandex.com/metrika/advert.gif Requested by Host: www.group-ib.com URL: https://www.group-ib.com/media-center/press-releases/phishing-kits-2022/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:6b8::1:119 Moscow, Russian Federation, ASN208722 (GLOBAL_DC, FI), Reverse DNS Software / Resource Hash 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36 Response headers date Thu, 25 May 2023 10:41:58 GMT strict-transport-security max-age=31536000 last-modified Wed, 24 May 2023 11:18:57 GMT accept-ch Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA etag "646dc871-2b" content-type image/gif access-control-allow-origin * cache-control max-age=3600 accept-ranges bytes content-length 43 expires Thu, 25 May 2023 11:41:58 GMT
GET H2	200	/ Show response googleads.g.doubleclick.net/pagead/viewthroughconversion/10882981508/	3 KB 2 KB	144ms 68ms	Script text/javascript	2a00:1450:4001:82a::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://googleads.g.doubleclick.net/pagead/viewthroughconversion/10882981508/?random=1685011318424&cv=11&fst=1685011318424&bg=ffffff&guid=ON&async=1&gtm=45be35m0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fphishing-kits-2022%2F&ref=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fphishing-kits-2022%2F&hn=www.googleadservices.com&frm=0&tiba=Group-IB%3A%20the%20use%20of%20phishing%20kits%20surges%20by%2025%25%20in%202022%20as%20they%20become%20more%20evasive%20and%20advanced%20%7C%20Group-IB&did=dZTQ1Zm&gdid=dZTQ1Zm&auid=485171967.1685011318&uamb=0&uaw=0&data=event%3Dgtag.config&rfmt=3&fmt=4 Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtag/js?id=AW-10882981508&l=dataLayer&cx=c Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash f8727afcd22e2c3f97901c45811229426c233f1d518d7e15951677066333b0c3 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36 Response headers pragma no-cache date Thu, 25 May 2023 10:41:58 GMT content-encoding br x-content-type-options nosniff server cafe content-type text/javascript; charset=UTF-8 p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" cache-control no-cache, must-revalidate cross-origin-resource-policy cross-origin content-disposition attachment; filename="f.txt" timing-allow-origin * alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 1425 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	img.gif b.6sc.co/v1/beacon/	43 B 494 B	280ms 280ms	Image image/gif	23.36.162.208 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=e84d9c08a990af8592952e7ac9a983ad&svisitor=null&visitor=cca16b57-1443-4a84-8e1e-66453d08ca12&session=722419ce-987e-4bf7-82c2-ab7ab7717c0b&event=ipv6&q=%7B%22address%22%3A%222001%3A1b60%3A2%3A240%3A3247%3A%3A11%22%7D&isIframe=false&m=%7B%22description%22%3A%22Group-IB%2C%20a%20global%20cybersecurity%20leader%20headquartered%20in%20Singapore%2C%20has%20recorded%20a%2025%25%20increase%20in%20the%20use%20of%20phishing%20kits%20in%202022.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Group-IB%3A%20the%20use%20of%20phishing%20kits%20surges%20by%2025%25%20in%202022%20as%20they%20become%20more%20evasive%20and%20advanced%20%7C%20Group-IB%22%7D&cb=&r=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fphishing-kits-2022%2F&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fphishing-kits-2022%2F&pageViewId=c1e9d031-19df-43ba-8519-cf95dd163b74 Requested by Host: www.group-ib.com URL: https://www.group-ib.com/media-center/press-releases/phishing-kits-2022/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 23.36.162.208 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS a23-36-162-208.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36 Response headers date Thu, 25 May 2023 10:41:58 GMT x-content-type-options nosniff content-length 43 pragma no-cache last-modified Sat, 18 Feb 2023 01:45:17 GMT server nginx/1.14.0 (Ubuntu) etag "63f02dad-2b" access-control-max-age 86400 access-control-allow-methods GET,POST content-type image/gif access-control-allow-origin cache-control private, no-cache, no-cache=Set-Cookie, proxy-revalidate access-control-allow-credentials true accept-ranges bytes access-control-allow-headers * expires Wed, 19 Apr 2000 11:43:00 GMT
GET H2	200	/ www.google.com/pagead/1p-user-list/10882981508/	42 B 154 B	33ms 33ms	Image image/gif	2a00:1450:4001:831::2004 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.com/pagead/1p-user-list/10882981508/?random=1685011318424&cv=11&fst=1685008800000&bg=ffffff&guid=ON&async=1&gtm=45be35m0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fphishing-kits-2022%2F&ref=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fphishing-kits-2022%2F&frm=0&tiba=Group-IB%3A%20the%20use%20of%20phishing%20kits%20surges%20by%2025%25%20in%202022%20as%20they%20become%20more%20evasive%20and%20advanced%20%7C%20Group-IB&data=event%3Dgtag.config&fmt=3&is_vtc=1&random=2325888123&rmt_tld=0&ipr=y Requested by Host: www.group-ib.com URL: https://www.group-ib.com/media-center/press-releases/phishing-kits-2022/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:831::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value Content-Security-Policy script-src 'none'; object-src 'none' X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36 Response headers pragma no-cache date Thu, 25 May 2023 10:41:58 GMT content-security-policy script-src 'none'; object-src 'none' x-content-type-options nosniff server cafe content-type image/gif p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin timing-allow-origin * alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	/ www.google.de/pagead/1p-user-list/10882981508/	42 B 154 B	34ms 34ms	Image image/gif	2a00:1450:4001:82f::2003 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.de/pagead/1p-user-list/10882981508/?random=1685011318424&cv=11&fst=1685008800000&bg=ffffff&guid=ON&async=1&gtm=45be35m0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fphishing-kits-2022%2F&ref=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fphishing-kits-2022%2F&frm=0&tiba=Group-IB%3A%20the%20use%20of%20phishing%20kits%20surges%20by%2025%25%20in%202022%20as%20they%20become%20more%20evasive%20and%20advanced%20%7C%20Group-IB&data=event%3Dgtag.config&fmt=3&is_vtc=1&random=2325888123&rmt_tld=1&ipr=y Requested by Host: www.group-ib.com URL: https://www.group-ib.com/media-center/press-releases/phishing-kits-2022/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:82f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value Content-Security-Policy script-src 'none'; object-src 'none' X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36 Response headers pragma no-cache date Thu, 25 May 2023 10:41:58 GMT content-security-policy script-src 'none'; object-src 'none' x-content-type-options nosniff server cafe content-type image/gif p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin timing-allow-origin * alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
POST H2	200	fl Show response www.group-ib.com/api/	665 B 826 B	60ms 60ms	XHR application/json	3.72.181.255 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://www.group-ib.com/api/fl?u=2dc77450-fa2a-11ed-b340-a8bb7d12174f&cfidsgib-w-61354c22-16cc-40a8-a871-6901f1a76e24=Ojqyn7c%2B3nazbdsgU10NXxTXZHne9pVMg%2FPTaraiqhEbDodQY36fk6UdR5px07WBVapv5s7Q%2Fe2PcyhAWUgiW9gGPhBvbJB5FcTHdGoHhRZwMuXEx5I8iDSQOJFr6iwCI3IOhibqHN3yy4FwN5rekoTevu0N8l%2FkwBmV Requested by Host: fhp-aws-antibot-back.group-ib.com URL: https://fhp-aws-antibot-back.group-ib.com/d/bt-autoinject.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 3.72.181.255 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-3-72-181-255.eu-central-1.compute.amazonaws.com Software istio-envoy / Resource Hash 2917772935863d0177c3bf40454c1b5fc5391931b664e71626d0f413c57575fd Request headers X-GIB-GSSCgib-w-61354c22-16cc-40a8-a871-6901f1a76e24 y3bOKskqj/qw+IYS9pgl44hDV0LXN9biwuQIgBvzQGOGDyg7ZAqpShQmHrbS7fMZIWJbeaE5ie074U4C+c0RVY7ZEheDaPWVHZttgx+sZxoJfpFz/DfBvrs1F85d56jaO8UzGMCWTYxFul5rYlIWvKIK2JmmUvz/C3SIpzFDwNbEHGY/s4QzU1E4PnB9bEAy/BWwhP1mFVANribOKRz8KJQUi6JMhn4oIeuWBSWY55hkFJ+5EXxpLRZ91STl+Q== Referer https://www.group-ib.com/media-center/press-releases/phishing-kits-2022/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36 X-GIB-FGSSCgib-w-61354c22-16cc-40a8-a871-6901f1a76e24 FRr7783099f7c0ffe117c9d7cb72edc0a052a9a3 Content-Type text/plain;charset=UTF-8 Response headers date Thu, 25 May 2023 10:41:58 GMT content-encoding gzip server istio-envoy vary Accept-Encoding content-type application/json; charset=utf-8 access-control-allow-origin https://www.group-ib.com cache-control no-store access-control-allow-credentials true x-envoy-upstream-service-time 2
GET H2	200	counters.gif forms-eu1.hsforms.com/embed/v3/	35 B 246 B	38ms 38ms	Image image/gif	172.65.232.43 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://forms-eu1.hsforms.com/embed/v3/counters.gif?key=collected-forms-embed-js-form-bind&count=1 Requested by Host: www.group-ib.com URL: https://www.group-ib.com/media-center/press-releases/phishing-kits-2022/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.65.232.43 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36 Response headers date Thu, 25 May 2023 10:41:58 GMT strict-transport-security max-age=31536000; includeSubDomains; preload cf-cache-status DYNAMIC x-hubspot-correlation-id 410b6167-55d6-4f50-a7a2-cfc677801a9b x-evy-trace-route-service-name envoyset-translator x-envoy-upstream-service-time 1 alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 content-length 35 x-evy-trace-route-configuration listener_https/all x-evy-trace-listener listener_https x-request-id c5a58b61-c7aa-495b-b570-9ee7479edf7c server cloudflare x-trace 2B08C9AF4C420A8972435CFF8783955C51B83B322E000000000000000000 vary origin content-type image/gif x-evy-trace-virtual-host all x-evy-trace-served-by-pod fra04/star-hubspot-td/envoy-proxy-79bb87d888-p4pw9 access-control-expose-headers X-Origin-Hublet cache-control max-age=0, no-cache, no-store access-control-allow-credentials false x-robots-tag none cf-ray 7ccd2b470ee32c65-FRA
POST H3	200	/ Show response www.facebook.com/tr/ Frame BBC3	0 18 B	21ms 20ms	Document text/plain	2a03:2880:f176:181:face:b00c:0:25de FACEBOOK
General Check archive.org Show headers Download Go to Full URL https://www.facebook.com/tr/ Requested by Host: www.group-ib.com URL: https://www.group-ib.com/media-center/press-releases/phishing-kits-2022/ Protocol H3 Security QUIC, , AES_128_GCM Server 2a03:2880:f176:181:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US), Reverse DNS Software proxygen-bolt / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Content-Type application/x-www-form-urlencoded Origin https://www.group-ib.com Referer https://www.group-ib.com/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers access-control-allow-credentials true access-control-allow-origin https://www.group-ib.com alt-svc h3=":443"; ma=86400 content-length 0 content-type text/plain cross-origin-resource-policy cross-origin date Thu, 25 May 2023 10:41:58 GMT priority u=0,i server proxygen-bolt strict-transport-security max-age=31536000; includeSubDomains
GET H2	200	1 Show response mc.yandex.com/watch/26812653/ Redirect Chain https://mc.yandex.com/watch/26812653?wmode=7&page-url=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fphishing-kits-2022%2F&charset=utf-8&site-info=%7B%22shareVersion%22%3A2%2C%22s... https://mc.yandex.com/watch/26812653/1?wmode=7&page-url=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fphishing-kits-2022%2F&charset=utf-8&site-info=%7B%22shareVersion%22%3A2%2C%2...	435 B 769 B	74ms 73ms	XHR application/json	2a02:6b8::1:119 GLOBAL_DC
General Check archive.org Show headers Download Go to Full URL https://mc.yandex.com/watch/26812653/1?wmode=7&page-url=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fphishing-kits-2022%2F&charset=utf-8&site-info=%7B%22shareVersion%22%3A2%2C%22strategy%22%3A%22d%2Fn%2Fq%2Fr%2Fs%2Ft%22%7D&uah=chm%0A%3F0&browser-info=pv%3A1%3Avf%3A1xbwdxt5f7y09z8vpduka1r%3Afp%3A451%3Afu%3A1%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A1043%3Acn%3A1%3Adp%3A0%3Als%3A153567322540%3Ahid%3A538565779%3Az%3A0%3Ai%3A20230525104158%3Aet%3A1685011318%3Ac%3A1%3Arn%3A17465501%3Arqn%3A1%3Au%3A1685011318734949506%3Aw%3A1600x1200%3As%3A1600x1200x24%3Ask%3A1%3Awv%3A2%3Ads%3A0%2C0%2C35%2C18%2C0%2C0%2C%2C392%2C1%2C%2C%2C%2C586%3Aco%3A0%3Acpf%3A1%3Ans%3A1685011317372%3Aadb%3A2%3Arqnl%3A1%3Ast%3A1685011319%3At%3AGroup-IB%3A%20the%20use%20of%20phishing%20kits%20surges%20by%2025%25%20in%202022%20as%20they%20become%20more%20evasive%20and%20advanced%20%7C%20Group-IB&t=gdpr%2814%29clc%280-0-0%29rqnt%281%29aw%281%29ti%282%29 Requested by Host: www.group-ib.com URL: https://www.group-ib.com/media-center/press-releases/phishing-kits-2022/ Protocol H2 Server 2a02:6b8::1:119 Moscow, Russian Federation, ASN208722 (GLOBAL_DC, FI), Reverse DNS Software / Resource Hash 186551db63b8c5a30f59115161e1228596323ff85af8f1e2ce5c0b9ca647bd8b Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36 Response headers pragma no-cache date Thu, 25 May 2023 10:41:59 GMT strict-transport-security max-age=31536000 x-content-type-options nosniff last-modified Thu, 25-May-2023 10:41:59 GMT accept-ch Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA content-type application/json; charset=utf-8 access-control-allow-origin https://www.group-ib.com cache-control private, no-cache, no-store, must-revalidate, max-age=0 access-control-allow-credentials true content-length 435 x-xss-protection 1; mode=block expires Thu, 25-May-2023 10:41:59 GMT Redirect headers pragma no-cache date Thu, 25 May 2023 10:41:59 GMT strict-transport-security max-age=31536000 last-modified Thu, 25-May-2023 10:41:59 GMT accept-ch Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA location /watch/26812653/1?wmode=7&page-url=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fphishing-kits-2022%2F&charset=utf-8&site-info=%7B%22shareVersion%22%3A2%2C%22strategy%22%3A%22d%2Fn%2Fq%2Fr%2Fs%2Ft%22%7D&uah=chm%0A%3F0&browser-info=pv%3A1%3Avf%3A1xbwdxt5f7y09z8vpduka1r%3Afp%3A451%3Afu%3A1%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A1043%3Acn%3A1%3Adp%3A0%3Als%3A153567322540%3Ahid%3A538565779%3Az%3A0%3Ai%3A20230525104158%3Aet%3A1685011318%3Ac%3A1%3Arn%3A17465501%3Arqn%3A1%3Au%3A1685011318734949506%3Aw%3A1600x1200%3As%3A1600x1200x24%3Ask%3A1%3Awv%3A2%3Ads%3A0%2C0%2C35%2C18%2C0%2C0%2C%2C392%2C1%2C%2C%2C%2C586%3Aco%3A0%3Acpf%3A1%3Ans%3A1685011317372%3Aadb%3A2%3Arqnl%3A1%3Ast%3A1685011319%3At%3AGroup-IB%3A%20the%20use%20of%20phishing%20kits%20surges%20by%2025%25%20in%202022%20as%20they%20become%20more%20evasive%20and%20advanced%20%7C%20Group-IB&t=gdpr%2814%29clc%280-0-0%29rqnt%281%29aw%281%29ti%282%29 access-control-allow-origin https://www.group-ib.com cache-control private, no-cache, no-store, must-revalidate, max-age=0 access-control-allow-credentials true x-xss-protection 1; mode=block expires Thu, 25-May-2023 10:41:59 GMT
GET H2	200	sync_cookie_image_decide_secondary mc.yandex.com/ Redirect Chain https://mc.yandex.com/sync_cookie_image_check_secondary https://mc.yandex.ru/sync_cookie_image_start_secondary?redirect_domain=mc.yandex.com&token=10014.nepNHzb_wUOdLFU0lgDst-W63_zaNllexfAw7CfylFhq5BfenzJAHeltHcJlN1Ii.BlXOi-KxiLEnBuJoE0RbLsgWVDY%2C https://mc.yandex.com/sync_cookie_image_decide_secondary?token=10014.Rbqp68vlKAGM5NiX8VMf3UdVUYPNRNadnjs43Z20_IVcqCB2KrM33ubt6cDT9UyHFyefC0fnIotiSaJ3PVSQQ-QQJ973piFTTr-fUBSGZ5w%2C.U9cepjrb_9vBjgfox...	43 B 79 B	70ms 70ms	Image image/gif	2a02:6b8::1:119 GLOBAL_DC
General Check archive.org Show headers Download Go to Show image Full URL https://mc.yandex.com/sync_cookie_image_decide_secondary?token=10014.Rbqp68vlKAGM5NiX8VMf3UdVUYPNRNadnjs43Z20_IVcqCB2KrM33ubt6cDT9UyHFyefC0fnIotiSaJ3PVSQQ-QQJ973piFTTr-fUBSGZ5w%2C.U9cepjrb_9vBjgfoxTQQOLs6oKU%2C Requested by Host: www.group-ib.com URL: https://www.group-ib.com/media-center/press-releases/phishing-kits-2022/ Protocol H2 Server 2a02:6b8::1:119 Moscow, Russian Federation, ASN208722 (GLOBAL_DC, FI), Reverse DNS Software / Resource Hash 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87 Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36 Response headers date Thu, 25 May 2023 10:41:59 GMT strict-transport-security max-age=31536000 content-length 43 x-xss-protection 1; mode=block content-type image/gif Redirect headers location https://mc.yandex.com/sync_cookie_image_decide_secondary?token=10014.Rbqp68vlKAGM5NiX8VMf3UdVUYPNRNadnjs43Z20_IVcqCB2KrM33ubt6cDT9UyHFyefC0fnIotiSaJ3PVSQQ-QQJ973piFTTr-fUBSGZ5w%2C.U9cepjrb_9vBjgfoxTQQOLs6oKU%2C date Thu, 25 May 2023 10:41:59 GMT strict-transport-security max-age=31536000 x-xss-protection 1; mode=block
GET H2	200	img.gif b.6sc.co/v1/beacon/	43 B 493 B	217ms 216ms	Image image/gif	23.36.162.208 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=e84d9c08a990af8592952e7ac9a983ad&svisitor=null&visitor=cca16b57-1443-4a84-8e1e-66453d08ca12&session=722419ce-987e-4bf7-82c2-ab7ab7717c0b&event=active_time_track&q=%7B%22currentTime%22%3A%22Thu%2C%2025%20May%202023%2010%3A41%3A59%20GMT%22%2C%22lastTrackTime%22%3A%22Thu%2C%2025%20May%202023%2010%3A41%3A58%20GMT%22%2C%22timeSpent%22%3A%221003%22%2C%22totalTimeSpent%22%3A%221003%22%7D&isIframe=false&m=%7B%22description%22%3A%22Group-IB%2C%20a%20global%20cybersecurity%20leader%20headquartered%20in%20Singapore%2C%20has%20recorded%20a%2025%25%20increase%20in%20the%20use%20of%20phishing%20kits%20in%202022.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Group-IB%3A%20the%20use%20of%20phishing%20kits%20surges%20by%2025%25%20in%202022%20as%20they%20become%20more%20evasive%20and%20advanced%20%7C%20Group-IB%22%7D&cb=&r=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fphishing-kits-2022%2F&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fphishing-kits-2022%2F&pageViewId=c1e9d031-19df-43ba-8519-cf95dd163b74 Requested by Host: www.group-ib.com URL: https://www.group-ib.com/media-center/press-releases/phishing-kits-2022/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 23.36.162.208 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS a23-36-162-208.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36 Response headers date Thu, 25 May 2023 10:41:59 GMT x-content-type-options nosniff content-length 43 pragma no-cache last-modified Sat, 18 Feb 2023 00:49:36 GMT server nginx/1.14.0 (Ubuntu) etag "63f020a0-2b" access-control-max-age 86400 access-control-allow-methods GET,POST content-type image/gif access-control-allow-origin cache-control private, no-cache, no-cache=Set-Cookie, proxy-revalidate access-control-allow-credentials true accept-ranges bytes access-control-allow-headers * expires Wed, 19 Apr 2000 11:43:00 GMT
POST H2	200	1 Show response mc.yandex.com/watch/26812653/	43 B 74 B	79ms 78ms	XHR image/gif	2a02:6b8::1:119 GLOBAL_DC
General Check archive.org Show headers Download Go to Full URL https://mc.yandex.com/watch/26812653/1?page-url=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fphishing-kits-2022%2F&charset=utf-8&hittoken=1685011319_7b8e18a4128b015fc0e4033dbeadc27f25eb37556657a16166a22d04923194de&browser-info=pa%3A1%3Aar%3A1%3Avf%3A1xbwdxt5f7y09z8vpduka1r%3Afu%3A1%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A1043%3Acn%3A1%3Adp%3A1%3Als%3A153567322540%3Ahid%3A538565779%3Az%3A0%3Ai%3A20230525104159%3Aet%3A1685011319%3Ac%3A1%3Arn%3A847849036%3Arqn%3A2%3Au%3A1685011318734949506%3Aw%3A1600x1200%3As%3A1600x1200x24%3Ask%3A1%3Awv%3A2%3Aco%3A0%3Acpf%3A1%3Ans%3A1685011317372%3Aadb%3A2%3Ast%3A1685011319&t=gdpr(14)mc(p-1)clc(0-0-0)rqnt(2)lt(12900)aw(1)ti(2) Requested by Host: fhp-aws-antibot-back.group-ib.com URL: https://fhp-aws-antibot-back.group-ib.com/d/bt-autoinject.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:6b8::1:119 Moscow, Russian Federation, ASN208722 (GLOBAL_DC, FI), Reverse DNS Software / Resource Hash 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87 Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Xss-Protection 1; mode=block Request headers Referer https://www.group-ib.com/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36 Content-Type application/x-www-form-urlencoded Response headers pragma no-cache date Thu, 25 May 2023 10:41:59 GMT strict-transport-security max-age=31536000 last-modified Thu, 25-May-2023 10:41:59 GMT accept-ch Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA content-type image/gif access-control-allow-origin https://www.group-ib.com cache-control private, no-cache, no-store, must-revalidate, max-age=0 access-control-allow-credentials true content-length 43 x-xss-protection 1; mode=block expires Thu, 25-May-2023 10:41:59 GMT
GET H3	200	709834390277869 Show response connect.facebook.net/signals/config/	300 KB 86 KB	64ms 64ms	Script application/x-javascript	2a03:2880:f084:d:face:b00c:0:3 FACEBOOK
General Check archive.org Show headers Download Go to Full URL https://connect.facebook.net/signals/config/709834390277869?v=2.9.104&r=stable Requested by Host: connect.facebook.net URL: https://connect.facebook.net/en_US/fbevents.js Protocol H3 Security QUIC, , AES_128_GCM Server 2a03:2880:f084:d:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US), Reverse DNS Software / Resource Hash 1196f279a6c7440fd6e93fe91c0756ddadf1b5766e02a292da96404e2e6c3ff9 Security Headers Name Value Content-Security-Policy default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0; Strict-Transport-Security max-age=31536000; preload; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36 Response headers content-security-policy default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0; content-encoding gzip x-content-type-options nosniff strict-transport-security max-age=31536000; preload; includeSubDomains date Thu, 25 May 2023 10:41:59 GMT document-policy force-load-at-top cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400 x-fb-rlafr 0 x-xss-protection 0 pragma public x-fb-debug YACylGNCm7RuVyR0vFQs5AERslBgww0Xbv5L5wG9wexiSXAOzma61ZlpRLNOUIjGzjk0QARWlt9wUxnbt8KPvA== cross-origin-embedder-policy-report-only require-corp;report-to="coep_report" cross-origin-opener-policy same-origin-allow-popups vary Accept-Encoding report-to {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/?minimize=0"}],"group":"coep_report"} content-type application/x-javascript; charset=utf-8 x-frame-options DENY origin-agent-cluster ?0 cache-control public, max-age=1200 permissions-policy accelerometer=(), ambient-light-sensor=(), bluetooth=(), gyroscope=(), hid=(), idle-detection=(), magnetometer=(), midi=(), screen-wake-lock=(), serial=(), usb=() priority u=3,i expires Sat, 01 Jan 2000 00:00:00 GMT
GET H2	200	__ptq.gif track-eu1.hubspot.com/	45 B 636 B	130ms 56ms	Image image/gif	172.65.240.166 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://track-eu1.hubspot.com/__ptq.gif?k=1&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=en-us&bfp=1944070336&v=1.1&a=25755956&rcu=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fphishing-kits-2022%2F&r=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fphishing-kits-2022%2F&pu=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fphishing-kits-2022%2F&t=Group-IB%3A+the+use+of+phishing+kits+surges+by+25%25+in+2022+as+they+become+more+evasive+and+advanced+%7C+Group-IB&cts=1685011319529&vi=7d7d51d7f1e0869895abf7ca604278ea&nc=true&u=84897990.7d7d51d7f1e0869895abf7ca604278ea.1685011319525.1685011319525.1685011319525.1&b=84897990.1.1685011319526&cc=15 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.65.240.166 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36 Response headers date Thu, 25 May 2023 10:41:59 GMT strict-transport-security max-age=31536000; includeSubDomains; preload cf-cache-status MISS nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} x-evy-trace-route-service-name envoyset-translator x-hubspot-correlation-id 257156c7-7cae-4dfe-95d3-9a1d4893cdd1 p3p CP="NOI CUR ADM OUR NOR STA NID" x-envoy-upstream-service-time 2 alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 content-length 45 x-evy-trace-route-configuration listener_https/all x-evy-trace-listener listener_https x-request-id e7e75213-69f0-4ea1-a32d-8689f1d51971 last-modified Thu, 25 May 2023 10:41:59 GMT server cloudflare vary origin, Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=x0V7r0eNGN5EZuDF%2BQPSyeZe6zln06Q2etbQQsfbub7zqd92m9%2FnSrpqBX4xip7IcQBUcU%2BA4NDBRHlw%2F54qfKvtXjt2ZkCbjMVxOzhuwpDYTscj26fQdOsNBQd4VVAFtJeYmY6wZg%3D%3D"}],"group":"cf-nel","max_age":604800} content-type image/gif x-evy-trace-served-by-pod fra04/analytics-tracking-td/envoy-proxy-58947f5fdd-csbhx x-evy-trace-virtual-host all cache-control no-cache, no-store, no-transform access-control-allow-credentials false accept-ranges bytes cf-ray 7ccd2b4b9a51913d-FRA x-robots-tag none
GET H2	200	__ptq.gif track-eu1.hubspot.com/	45 B 1 KB	98ms 44ms	Image image/gif	172.65.240.166 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://track-eu1.hubspot.com/__ptq.gif?k=15&fi=55a22738-d5a5-43f9-9c1c-fa4c1a6eb349&fci=73c9a05e-8691-4a93-ad3b-a535a0f6d7d8&ft=0&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=en-us&bfp=1944070336&v=1.1&a=25755956&rcu=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fphishing-kits-2022%2F&r=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fphishing-kits-2022%2F&pu=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fphishing-kits-2022%2F&t=Group-IB%3A+the+use+of+phishing+kits+surges+by+25%25+in+2022+as+they+become+more+evasive+and+advanced+%7C+Group-IB&cts=1685011319531&vi=7d7d51d7f1e0869895abf7ca604278ea&nc=true&u=84897990.7d7d51d7f1e0869895abf7ca604278ea.1685011319525.1685011319525.1685011319525.1&b=84897990.1.1685011319526&cc=15 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.65.240.166 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36 Response headers date Thu, 25 May 2023 10:41:59 GMT strict-transport-security max-age=31536000; includeSubDomains; preload cf-cache-status MISS nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} x-evy-trace-route-service-name envoyset-translator x-hubspot-correlation-id 631e20c0-bbe3-4d69-bd6b-6017f2d85bd0 p3p CP="NOI CUR ADM OUR NOR STA NID" x-envoy-upstream-service-time 2 alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 content-length 45 x-evy-trace-route-configuration listener_https/all x-evy-trace-listener listener_https x-request-id e1182cc9-2993-452c-9292-6b219c781bd2 last-modified Thu, 25 May 2023 10:41:59 GMT server cloudflare vary origin, Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=NSqrAYUwxAMalw0ajF%2Bi6nZejcCEUxoIdsA9vr%2BMY7VhM8aiEXHTc24LjgkKLx271AWM95A3L78OZjfNItxpoeVoqNARFZGANLvdopd9FZDpNsS2zXvGYz7aEUvN%2FDFUOrJuuf76Tw%3D%3D"}],"group":"cf-nel","max_age":604800} content-type image/gif x-evy-trace-served-by-pod fra04/analytics-tracking-td/envoy-proxy-58947f5fdd-mthlf x-evy-trace-virtual-host all cache-control no-cache, no-store, no-transform access-control-allow-credentials false accept-ranges bytes cf-ray 7ccd2b4b9a52913d-FRA x-robots-tag none
GET H2	200	__ptq.gif track-eu1.hubspot.com/	45 B 1 KB	114ms 60ms	Image image/gif	172.65.240.166 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://track-eu1.hubspot.com/__ptq.gif?k=17&fi=55a22738-d5a5-43f9-9c1c-fa4c1a6eb349&fci=73c9a05e-8691-4a93-ad3b-a535a0f6d7d8&ft=0&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=en-us&bfp=1944070336&v=1.1&a=25755956&rcu=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fphishing-kits-2022%2F&r=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fphishing-kits-2022%2F&pu=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fphishing-kits-2022%2F&t=Group-IB%3A+the+use+of+phishing+kits+surges+by+25%25+in+2022+as+they+become+more+evasive+and+advanced+%7C+Group-IB&cts=1685011319532&vi=7d7d51d7f1e0869895abf7ca604278ea&nc=true&u=84897990.7d7d51d7f1e0869895abf7ca604278ea.1685011319525.1685011319525.1685011319525.1&b=84897990.1.1685011319526&cc=15 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.65.240.166 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36 Response headers date Thu, 25 May 2023 10:41:59 GMT strict-transport-security max-age=31536000; includeSubDomains; preload cf-cache-status MISS nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} x-evy-trace-route-service-name envoyset-translator x-hubspot-correlation-id be696637-c563-40f0-9180-cfcc725e281e p3p CP="NOI CUR ADM OUR NOR STA NID" x-envoy-upstream-service-time 3 alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 content-length 45 x-evy-trace-route-configuration listener_https/all x-evy-trace-listener listener_https x-request-id 5d51067a-216e-4ceb-9fd2-9d88e65ebb70 last-modified Thu, 25 May 2023 10:41:59 GMT server cloudflare vary origin, Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=APbcAcjpZOzJUXUBidl%2BkPEmHl0NjWJ5%2FCTAe1QbyAqZk%2Fp8XQ9%2BX5p%2B5VMRVgrscVkTDGOUcrbvM9Rs9pKG2bO6Xejp%2BCkqN9Y9SjjmFcPjZdkfOA%2BoAcss2gK%2F6L8gBjazotJFJQ%3D%3D"}],"group":"cf-nel","max_age":604800} content-type image/gif x-evy-trace-served-by-pod fra04/analytics-tracking-td/envoy-proxy-58947f5fdd-jbb8b x-evy-trace-virtual-host all cache-control no-cache, no-store, no-transform access-control-allow-credentials false accept-ranges bytes cf-ray 7ccd2b4b9a53913d-FRA x-robots-tag none
GET H2	200	__ptq.gif track-eu1.hubspot.com/	45 B 1 KB	108ms 55ms	Image image/gif	172.65.240.166 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://track-eu1.hubspot.com/__ptq.gif?k=15&fi=044e7558-8073-478a-ad3c-5807dd76840f&fci=8c88c1bf-4166-4093-a3ae-901aa82d9fc2&ft=0&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=en-us&bfp=1944070336&v=1.1&a=25755956&rcu=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fphishing-kits-2022%2F&r=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fphishing-kits-2022%2F&pu=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fphishing-kits-2022%2F&t=Group-IB%3A+the+use+of+phishing+kits+surges+by+25%25+in+2022+as+they+become+more+evasive+and+advanced+%7C+Group-IB&cts=1685011319533&vi=7d7d51d7f1e0869895abf7ca604278ea&nc=true&u=84897990.7d7d51d7f1e0869895abf7ca604278ea.1685011319525.1685011319525.1685011319525.1&b=84897990.1.1685011319526&cc=15 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.65.240.166 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36 Response headers date Thu, 25 May 2023 10:41:59 GMT strict-transport-security max-age=31536000; includeSubDomains; preload cf-cache-status MISS nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} x-evy-trace-route-service-name envoyset-translator x-hubspot-correlation-id 0390b8da-26b0-4150-a514-cc63c777747a p3p CP="NOI CUR ADM OUR NOR STA NID" x-envoy-upstream-service-time 1 alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 content-length 45 x-evy-trace-route-configuration listener_https/all x-evy-trace-listener listener_https x-request-id d3a5947e-271b-42cf-91c2-e978a1a01644 last-modified Thu, 25 May 2023 10:41:59 GMT server cloudflare vary origin, Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=KsnottH74aev4I4IoIA3YKQMfRRBHiFwlDQu2iKOjyJrFmG27uCMygfzv2YXXx0ok1A7Q2xgbKSKZzuJZk6aqHU9VM7PVSddWXYXbnP1j1pJQpffy6%2BO%2BWuJ9BTt3Uk0xwtI1%2B8nGw%3D%3D"}],"group":"cf-nel","max_age":604800} content-type image/gif x-evy-trace-served-by-pod fra04/analytics-tracking-td/envoy-proxy-58947f5fdd-l92bf x-evy-trace-virtual-host all cache-control no-cache, no-store, no-transform access-control-allow-credentials false accept-ranges bytes cf-ray 7ccd2b4b9a54913d-FRA x-robots-tag none
GET H2	200	__ptq.gif track-eu1.hubspot.com/	45 B 636 B	103ms 50ms	Image image/gif	172.65.240.166 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://track-eu1.hubspot.com/__ptq.gif?k=17&fi=044e7558-8073-478a-ad3c-5807dd76840f&fci=8c88c1bf-4166-4093-a3ae-901aa82d9fc2&ft=0&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=en-us&bfp=1944070336&v=1.1&a=25755956&rcu=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fphishing-kits-2022%2F&r=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fphishing-kits-2022%2F&pu=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fphishing-kits-2022%2F&t=Group-IB%3A+the+use+of+phishing+kits+surges+by+25%25+in+2022+as+they+become+more+evasive+and+advanced+%7C+Group-IB&cts=1685011319534&vi=7d7d51d7f1e0869895abf7ca604278ea&nc=true&u=84897990.7d7d51d7f1e0869895abf7ca604278ea.1685011319525.1685011319525.1685011319525.1&b=84897990.1.1685011319526&cc=15 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.65.240.166 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36 Response headers date Thu, 25 May 2023 10:41:59 GMT strict-transport-security max-age=31536000; includeSubDomains; preload cf-cache-status MISS nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} x-evy-trace-route-service-name envoyset-translator x-hubspot-correlation-id 49c42138-e25a-4127-84a4-b6dba1c8894b p3p CP="NOI CUR ADM OUR NOR STA NID" x-envoy-upstream-service-time 1 alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 content-length 45 x-evy-trace-route-configuration listener_https/all x-evy-trace-listener listener_https x-request-id 6a66bc9d-2a04-414e-bf58-eb592659d13a last-modified Thu, 25 May 2023 10:41:59 GMT server cloudflare vary origin, Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=n56XjryScIKLs%2FExZL7xZzy32n2OwreWobeTgGOWVMvU67NgbMbrt5HnjKjMZXNUh5ZD%2FR45zoHIdL4iId%2BBxXW0zpmTbPROsX4C2NTxqJAfozFfLTvv4ks0ReoM2hRVnysDxw259g%3D%3D"}],"group":"cf-nel","max_age":604800} content-type image/gif x-evy-trace-served-by-pod fra04/analytics-tracking-td/envoy-proxy-58947f5fdd-t64lq x-evy-trace-virtual-host all cache-control no-cache, no-store, no-transform access-control-allow-credentials false accept-ranges bytes cf-ray 7ccd2b4b9a57913d-FRA x-robots-tag none
GET H2	200	__ptq.gif track-eu1.hubspot.com/	45 B 637 B	98ms 45ms	Image image/gif	172.65.240.166 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://track-eu1.hubspot.com/__ptq.gif?k=15&fi=4dbceae1-75ae-423a-9c12-dee8f1ca3345&fci=91299eb1-240d-47fd-bd9e-f0e1015cceaf&ft=0&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=en-us&bfp=1944070336&v=1.1&a=25755956&rcu=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fphishing-kits-2022%2F&r=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fphishing-kits-2022%2F&pu=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fphishing-kits-2022%2F&t=Group-IB%3A+the+use+of+phishing+kits+surges+by+25%25+in+2022+as+they+become+more+evasive+and+advanced+%7C+Group-IB&cts=1685011319535&vi=7d7d51d7f1e0869895abf7ca604278ea&nc=true&u=84897990.7d7d51d7f1e0869895abf7ca604278ea.1685011319525.1685011319525.1685011319525.1&b=84897990.1.1685011319526&cc=15 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.65.240.166 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36 Response headers date Thu, 25 May 2023 10:41:59 GMT strict-transport-security max-age=31536000; includeSubDomains; preload cf-cache-status MISS nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} x-evy-trace-route-service-name envoyset-translator x-hubspot-correlation-id 49728b44-17eb-497f-9ad0-70f8ae69d1d5 p3p CP="NOI CUR ADM OUR NOR STA NID" x-envoy-upstream-service-time 3 alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 content-length 45 x-evy-trace-route-configuration listener_https/all x-evy-trace-listener listener_https x-request-id 1dc1c455-d76d-457a-b63e-a7d368470551 last-modified Thu, 25 May 2023 10:41:59 GMT server cloudflare vary origin, Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=qX12QvtsYJ05tcigoVjHiA9DssgbiJzJepgRX0FIr%2BHVY8SNAEWwZ9YGJzKaxUeygV%2FTpowiwLSF7%2BI4ddt%2BNK5POvplbIhaOH%2Big11sUMPNIHZ5TCpWZBuIyxLd%2FgUpU0hUoBoOSQ%3D%3D"}],"group":"cf-nel","max_age":604800} content-type image/gif x-evy-trace-served-by-pod fra04/analytics-tracking-td/envoy-proxy-58947f5fdd-x2249 x-evy-trace-virtual-host all cache-control no-cache, no-store, no-transform access-control-allow-credentials false accept-ranges bytes cf-ray 7ccd2b4b9a58913d-FRA x-robots-tag none
GET H2	200	__ptq.gif track-eu1.hubspot.com/	45 B 627 B	49ms 49ms	Image image/gif	172.65.240.166 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://track-eu1.hubspot.com/__ptq.gif?k=17&fi=4dbceae1-75ae-423a-9c12-dee8f1ca3345&fci=91299eb1-240d-47fd-bd9e-f0e1015cceaf&ft=0&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=en-us&bfp=1944070336&v=1.1&a=25755956&rcu=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fphishing-kits-2022%2F&r=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fphishing-kits-2022%2F&pu=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fphishing-kits-2022%2F&t=Group-IB%3A+the+use+of+phishing+kits+surges+by+25%25+in+2022+as+they+become+more+evasive+and+advanced+%7C+Group-IB&cts=1685011319536&vi=7d7d51d7f1e0869895abf7ca604278ea&nc=true&u=84897990.7d7d51d7f1e0869895abf7ca604278ea.1685011319525.1685011319525.1685011319525.1&b=84897990.1.1685011319526&cc=15 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.65.240.166 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36 Response headers date Thu, 25 May 2023 10:41:59 GMT strict-transport-security max-age=31536000; includeSubDomains; preload cf-cache-status MISS nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} x-evy-trace-route-service-name envoyset-translator x-hubspot-correlation-id 93584a00-5b77-4212-a495-29cdcfe8e8c4 p3p CP="NOI CUR ADM OUR NOR STA NID" x-envoy-upstream-service-time 2 alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 content-length 45 x-evy-trace-route-configuration listener_https/all x-evy-trace-listener listener_https x-request-id fa70e3ba-1efd-4485-a3b1-ad0014d5d32a last-modified Thu, 25 May 2023 10:41:59 GMT server cloudflare vary origin, Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=NuWEyetyTfgy5H31EpgAtM%2B58N89k3VYwnLjf3vPXvUDH73vn4qMWv3RiF0I%2Fb6iQsfBjQ3ZmHrwlstuYERTxuiI9xM2IF181xrBTI1voDdMEJt2qXea7xLi0WArZuXI0bjdAcbzYg%3D%3D"}],"group":"cf-nel","max_age":604800} content-type image/gif x-evy-trace-served-by-pod fra04/analytics-tracking-td/envoy-proxy-58947f5fdd-r2f89 x-evy-trace-virtual-host all cache-control no-cache, no-store, no-transform access-control-allow-credentials false accept-ranges bytes cf-ray 7ccd2b4baa6a913d-FRA x-robots-tag none
GET H2	200	facebook-64.svg website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/socials/	627 B 1 KB	51ms 50ms	Image image/svg+xml	2600:9000:225b:1400:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/socials/facebook-64.svg Requested by Host: website.cdn.group-ib.com URL: https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-press-release.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:225b:1400:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash f006e8bbfa4f0537780571436b5bed50ff10ff28759924c53b67732ec5af28ba Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-press-release.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; content-encoding gzip x-content-type-options nosniff date Thu, 25 May 2023 10:41:59 GMT via 1.1 8c1abfbb8460bed752668233d296dba8.cloudfront.net (CloudFront) strict-transport-security max-age=31536000; includeSubDomains x-amz-cf-pop MUC50-P1 x-cache Miss from cloudfront content-length 376 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Tue, 29 Nov 2022 07:39:21 GMT server nginx etag "273-5ee9716178eea-gzip" x-frame-options sameorigin vary Accept-Encoding content-type image/svg+xml access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id CwKzAIuLpcu8crZXLgmvaN3AhguhIFF6qesckte-AUlndrNVgeQ3Lg== expires Thu, 25 May 2023 11:11:59 GMT
GET H2	200	facebook-blue.svg website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/socials/	627 B 1 KB	62ms 61ms	Image image/svg+xml	2600:9000:225b:1400:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/socials/facebook-blue.svg Requested by Host: website.cdn.group-ib.com URL: https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-press-release.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:225b:1400:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash 746b0aea019090232091568f0790cf4d479b06a4e1fd9987069881ad5d1590ca Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-press-release.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; content-encoding gzip x-content-type-options nosniff date Thu, 25 May 2023 10:41:59 GMT via 1.1 8c1abfbb8460bed752668233d296dba8.cloudfront.net (CloudFront) strict-transport-security max-age=31536000; includeSubDomains x-amz-cf-pop MUC50-P1 x-cache Miss from cloudfront content-length 377 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Tue, 29 Nov 2022 07:39:21 GMT server nginx etag "273-5ee9716178eea-gzip" x-frame-options sameorigin vary Accept-Encoding content-type image/svg+xml access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id -HvltMtR599QoikPpLnKjJCpRhkDBx1ojaeMTkNQ7QbM1GR6uon9aA== expires Thu, 25 May 2023 11:11:59 GMT
GET H3	200	/ www.facebook.com/tr/	0 15 B	21ms 20ms	Image text/plain	2a03:2880:f176:181:face:b00c:0:25de FACEBOOK
General Check archive.org Show headers Download Go to Show image Full URL https://www.facebook.com/tr/?id=709834390277869&ev=PageView&dl=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fphishing-kits-2022%2F&rl=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fphishing-kits-2022%2F&if=false&ts=1685011319638&sw=1600&sh=1200&ud[external_id]=7d7d51d7f1e0869895abf7ca604278ea&v=2.9.104&r=stable&ec=0&o=30&fbp=fb.1.1685011318370.1049122830&it=1685011318217&coo=false&rqm=GET Protocol H3 Security QUIC, , AES_128_GCM Server 2a03:2880:f176:181:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US), Reverse DNS Software proxygen-bolt / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36 Response headers strict-transport-security max-age=31536000; includeSubDomains date Thu, 25 May 2023 10:41:59 GMT server proxygen-bolt content-type text/plain access-control-allow-origin access-control-allow-credentials true cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400 content-length 0 priority u=3,i
POST H2	200	fl Show response www.group-ib.com/api/	665 B 838 B	28ms 27ms	XHR application/json	3.72.181.255 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://www.group-ib.com/api/fl?u=2dc77450-fa2a-11ed-b340-a8bb7d12174f&cfidsgib-w-61354c22-16cc-40a8-a871-6901f1a76e24=w%2F1tLcn9KWLjV3scqBNbOJDxC4o4UdLcxvVfWlVgnv1Y%2F4Pyg82hI%2FzlfNAd9nAHGxotCUFW1iTePxDnzqNko5SRbgr3mGVYHX7RD4zamoidgC1Q%2B7hQdCg2vNP8MhGH%2BCcI4G056hQpiNNiB1e5D452jh4m%2F0CJXNVn Requested by Host: fhp-aws-antibot-back.group-ib.com URL: https://fhp-aws-antibot-back.group-ib.com/d/bt-autoinject.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 3.72.181.255 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-3-72-181-255.eu-central-1.compute.amazonaws.com Software istio-envoy / Resource Hash fe275f22dd42655a400dd26cd2b694903b6d317d371c08530275ec33b32752c6 Request headers X-GIB-GSSCgib-w-61354c22-16cc-40a8-a871-6901f1a76e24 NLSPhMAi/IicJaq0eYDNNX2lJNe9RSebrYNA2IjW8X4mumPxWA5UIdZzWxQmnqY9hkIdHH5hBvJXTebhJL6f//rp63lqAr4VuqvVa2sPc3S0+YxB9z1Us5dXRCAigxGIRPK4jF5ZGyahGU8X/f3KIusOJXiuY6/2RoEAGgrIM/DyKsPNAU3xhSO5HyLQQnJaO+WgVK3yd6tDmV5VwUMePqoZrySkNIDFUO+P+RWJ53pgnYukoaKF8y+JOMsGXg== Referer https://www.group-ib.com/media-center/press-releases/phishing-kits-2022/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36 X-GIB-FGSSCgib-w-61354c22-16cc-40a8-a871-6901f1a76e24 SFL1d9eb09da7fdf1076aad4855b5900b607aa20 Content-Type text/plain;charset=UTF-8 Response headers date Thu, 25 May 2023 10:41:59 GMT content-encoding gzip server istio-envoy vary Accept-Encoding content-type application/json; charset=utf-8 access-control-allow-origin https://www.group-ib.com cache-control no-store access-control-allow-credentials true x-envoy-upstream-service-time 3
GET H2	200	counters.gif forms-eu1.hsforms.com/embed/v3/	35 B 226 B	50ms 50ms	Image image/gif	172.65.232.43 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://forms-eu1.hsforms.com/embed/v3/counters.gif?key=collected-forms-embed-js-form-bind&count=1 Requested by Host: js-eu1.hscollectedforms.net URL: https://js-eu1.hscollectedforms.net/collectedforms.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.65.232.43 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36 Response headers date Thu, 25 May 2023 10:42:00 GMT strict-transport-security max-age=31536000; includeSubDomains; preload cf-cache-status DYNAMIC x-hubspot-correlation-id 82611b39-d135-4e1c-9a8f-d1826b88eb01 x-evy-trace-route-service-name envoyset-translator x-envoy-upstream-service-time 2 alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 content-length 35 x-evy-trace-route-configuration listener_https/all x-evy-trace-listener listener_https x-request-id 499922a1-8067-4dd0-a489-03febda33feb server cloudflare x-trace 2B93CB777CE0436B53161BB2B8F37AA9080289812A000000000000000000 vary origin content-type image/gif x-evy-trace-virtual-host all x-evy-trace-served-by-pod fra04/star-hubspot-td/envoy-proxy-79bb87d888-p4pw9 access-control-expose-headers X-Origin-Hublet cache-control max-age=0, no-cache, no-store access-control-allow-credentials false x-robots-tag none cf-ray 7ccd2b4ee84d2c65-FRA
POST H3	200	/ Show response www.facebook.com/tr/ Frame F51B	0 15 B	20ms 20ms	Document text/plain	2a03:2880:f176:181:face:b00c:0:25de FACEBOOK
General Check archive.org Show headers Download Go to Full URL https://www.facebook.com/tr/ Protocol H3 Security QUIC, , AES_128_GCM Server 2a03:2880:f176:181:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US), Reverse DNS Software proxygen-bolt / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Content-Type application/x-www-form-urlencoded Origin https://www.group-ib.com Referer https://www.group-ib.com/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers access-control-allow-credentials true access-control-allow-origin https://www.group-ib.com alt-svc h3=":443"; ma=86400 content-length 0 content-type text/plain cross-origin-resource-policy cross-origin date Thu, 25 May 2023 10:42:00 GMT priority u=0,i server proxygen-bolt strict-transport-security max-age=31536000; includeSubDomains
GET H2	200	img.gif b.6sc.co/v1/beacon/	43 B 494 B	217ms 217ms	Image image/gif	23.36.162.208 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=e84d9c08a990af8592952e7ac9a983ad&svisitor=null&visitor=cca16b57-1443-4a84-8e1e-66453d08ca12&session=722419ce-987e-4bf7-82c2-ab7ab7717c0b&event=active_time_track&q=%7B%22currentTime%22%3A%22Thu%2C%2025%20May%202023%2010%3A42%3A00%20GMT%22%2C%22lastTrackTime%22%3A%22Thu%2C%2025%20May%202023%2010%3A41%3A59%20GMT%22%2C%22timeSpent%22%3A%221006%22%2C%22totalTimeSpent%22%3A%222009%22%7D&isIframe=false&m=%7B%22description%22%3A%22Group-IB%2C%20a%20global%20cybersecurity%20leader%20headquartered%20in%20Singapore%2C%20has%20recorded%20a%2025%25%20increase%20in%20the%20use%20of%20phishing%20kits%20in%202022.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Group-IB%3A%20the%20use%20of%20phishing%20kits%20surges%20by%2025%25%20in%202022%20as%20they%20become%20more%20evasive%20and%20advanced%20%7C%20Group-IB%22%7D&cb=&r=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fphishing-kits-2022%2F&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fphishing-kits-2022%2F&pageViewId=c1e9d031-19df-43ba-8519-cf95dd163b74 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 23.36.162.208 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS a23-36-162-208.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36 Response headers date Thu, 25 May 2023 10:42:00 GMT x-content-type-options nosniff content-length 43 pragma no-cache last-modified Sat, 05 Jun 2021 07:56:05 GMT server nginx/1.14.0 (Ubuntu) etag "60bb2e15-2b" access-control-max-age 86400 access-control-allow-methods GET,POST content-type image/gif access-control-allow-origin cache-control private, no-cache, no-cache=Set-Cookie, proxy-revalidate access-control-allow-credentials true accept-ranges bytes access-control-allow-headers * expires Wed, 19 Apr 2000 11:43:00 GMT