www.group-ib.com Open in urlscan Pro
3.72.181.255  Public Scan

14 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

1. https://www.group-ib.com/media-center/press-releases/phishing-kits-2022/ Page URL
2. https://www.group-ib.com/media-center/press-releases/phishing-kits-2022/ Page URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 79

• https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=4496601&time=1697653596972&url=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fphishing-kits-2022%2F&tm=gtmv2 HTTP 302
• https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=4496601&time=1697653596972&url=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fphishing-kits-2022%2F&tm=gtmv2&cookiesTest=true HTTP 302
• https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D4496601%26time%3D1697653596972%26url%3Dhttps%253A%252F%252Fwww.group-ib.com%252Fmedia-center%252Fpress-releases%252Fphishing-kits-2022%252F%26tm%3Dgtmv2%26cookiesTest%3Dtrue%26liSync%3Dtrue HTTP 302
• https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=4496601&time=1697653596972&url=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fphishing-kits-2022%2F&tm=gtmv2&cookiesTest=true&liSync=true HTTP 302
• https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=4496601&time=1697653596972&url=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fphishing-kits-2022%2F&tm=gtmv2&cookiesTest=true&liSync=true&e_ipv6=AQK9vF-5ms79UgAAAYtECiX2JYypOzjF_rZvnfe-iuyEV_LsfWMH1DU4uLgkYRVwaXVkvAc8Yp4lMOVjDAXOucIJlw8BzA

Request Chain 81

• https://mc.yandex.com/sync_cookie_image_check HTTP 302
• https://mc.yandex.ru/sync_cookie_image_start?redirect_domain=mc.yandex.com&token=10160.9iB7bYCqB0fn9LlC2wAYx5Jf4bCRgiBFKQoiFpknhTH0iUHslzT8Uc1m8lycrK4I.CbJs9Rrem3UGuiCsgSv5UcszZhw%2C HTTP 302
• https://mc.yandex.com/sync_cookie_image_decide?token=10160.X9eY6J2t3DUHfO_vZu4LsGGDsmyr3XeT7bYGFclqh9EPlNiSqmRZorr3RZC2dZ9SxEh6PFrn4j8ZbdOH5_nJaGGK_oN7stq-gnIIo84I7Fed4-cA4EdI6q6LvXgHNUf4TMuibPhvQNaIgt83lWoAC8yRB17sE_ygIfVDe3HJt2E3Q5QpUIyydVjVlTRhpX1-D_pHVb2l6STV_BSUQAz1Su6ITt7gM0FnIhSnnpW4r2g%2C.UVt4y_n3I4R8JccMDK1Kn0Up45M%2C

Request Chain 106

• https://mc.yandex.com/watch/26812653?wmode=7&page-url=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fphishing-kits-2022%2F&charset=utf-8&site-info=%7B%22shareVersion%22%3A2%2C%22strategy%22%3A%22d%2Fn%2Fq%2Fr%2Fs%2Ft%22%7D&uah=chm%0A%3F0&browser-info=pv%3A1%3Avf%3A3qm6qq812ez2u52y4wzrnbv%3Afp%3A471%3Afu%3A1%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A1135%3Acn%3A1%3Adp%3A0%3Als%3A356605506717%3Ahid%3A179107037%3Az%3A120%3Ai%3A20231018202637%3Aet%3A1697653597%3Ac%3A1%3Arn%3A860900965%3Arqn%3A1%3Au%3A1697653597310309535%3Aw%3A1600x1200%3As%3A1600x1200x24%3Ask%3A1%3Awv%3A2%3Ads%3A0%2C0%2C21%2C8%2C0%2C0%2C%2C535%2C33%2C%2C%2C%2C626%3Aco%3A0%3Acpf%3A1%3Ans%3A1697653595890%3Aadb%3A2%3Arqnl%3A1%3Ast%3A1697653597%3At%3AGroup-IB%3A%20the%20use%20of%20phishing%20kits%20surges%20by%2025%25%20in%202022%20as%20they%20become%20more%20evasive%20and%20advanced%20%7C%20Group-IB&t=gdpr(14)clc(0-0-0)rqnt(1)aw(1)ti(2) HTTP 302
• https://mc.yandex.com/watch/26812653/1?wmode=7&page-url=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fphishing-kits-2022%2F&charset=utf-8&site-info=%7B%22shareVersion%22%3A2%2C%22strategy%22%3A%22d%2Fn%2Fq%2Fr%2Fs%2Ft%22%7D&uah=chm%0A%3F0&browser-info=pv%3A1%3Avf%3A3qm6qq812ez2u52y4wzrnbv%3Afp%3A471%3Afu%3A1%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A1135%3Acn%3A1%3Adp%3A0%3Als%3A356605506717%3Ahid%3A179107037%3Az%3A120%3Ai%3A20231018202637%3Aet%3A1697653597%3Ac%3A1%3Arn%3A860900965%3Arqn%3A1%3Au%3A1697653597310309535%3Aw%3A1600x1200%3As%3A1600x1200x24%3Ask%3A1%3Awv%3A2%3Ads%3A0%2C0%2C21%2C8%2C0%2C0%2C%2C535%2C33%2C%2C%2C%2C626%3Aco%3A0%3Acpf%3A1%3Ans%3A1697653595890%3Aadb%3A2%3Arqnl%3A1%3Ast%3A1697653597%3At%3AGroup-IB%3A%20the%20use%20of%20phishing%20kits%20surges%20by%2025%25%20in%202022%20as%20they%20become%20more%20evasive%20and%20advanced%20%7C%20Group-IB&t=gdpr%2814%29clc%280-0-0%29rqnt%281%29aw%281%29ti%282%29

120 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
8 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	403	/ Show response www.group-ib.com/media-center/press-releases/phishing-kits-2022/	7 KB 7 KB	57ms 6ms	Document text/html	3.72.181.255 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://www.group-ib.com/media-center/press-releases/phishing-kits-2022/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 3.72.181.255 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-3-72-181-255.eu-central-1.compute.amazonaws.com Software / Resource Hash 1f8292749f9543412c821cd595ce8e84b5cec9f46d1e2c18c57ff8b8ec44025a Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers cache-control no-cache, no-store, must-revalidate content-type text/html date Wed, 18 Oct 2023 18:26:34 GMT
GET H/1.1	200 OK	bt-autoinject.js Show response fhp-de-js.group-ib.com/d/	342 KB 134 KB	49ms 20ms	Script text/javascript	188.40.44.175 HETZNER-AS
General Check archive.org Show headers Download Go to Full URL https://fhp-de-js.group-ib.com/d/bt-autoinject.js Requested by Host: www.group-ib.com URL: https://www.group-ib.com/media-center/press-releases/phishing-kits-2022/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 188.40.44.175 , Germany, ASN24940 (HETZNER-AS, DE), Reverse DNS static.175.44.40.188.clients.your-server.de Software nginx / Resource Hash ba94685a300cba555ba04b2e16a9c28c59e08a54c6c3822048b92fda87d75fde Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers Date Wed, 18 Oct 2023 18:26:34 GMT Content-Encoding gzip Server nginx Transfer-Encoding chunked Vary Accept-Encoding Content-Type text/javascript; charset=UTF-8 Access-Control-Allow-Methods GET, POST, OPTIONS x-envoy-upstream-service-time 0 Access-Control-Allow-Credentials true Connection keep-alive Access-Control-Allow-Headers Accept,DNT,Keep-Alive,User-Agent,If-Modified-Since,Cache-Control,Content-Type,Origin,ETag,If-None-Match,X-Cfids,Authorization
GET DATA	200 OK	truncated /	484 B 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash ff789011bc632ff54482cf7e8ad1dac4351aa1b841fee8b72dd8d2aff241134f Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	4 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 0b11a8997d87fb68dff747ab7af0dac5bb13c889c69117f6893bcc90406358b5 Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers Content-Type image/png
GET H2	200	idgib-w-61354c22-16cc-40a8-a871-6901f1a76e24 Show response www.group-ib.com/api/fl/	205 B 660 B	15ms 15ms	XHR application/json	3.72.181.255 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://www.group-ib.com/api/fl/idgib-w-61354c22-16cc-40a8-a871-6901f1a76e24 Requested by Host: fhp-de-js.group-ib.com URL: https://fhp-de-js.group-ib.com/d/bt-autoinject.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 3.72.181.255 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-3-72-181-255.eu-central-1.compute.amazonaws.com Software nginx / Resource Hash fea3288ced35dc509db2ac353fc2146bf0ef16ed1e60059962f6ed1208c8c868 Request headers Referer https://www.group-ib.com/media-center/press-releases/phishing-kits-2022/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 x-cfids - Response headers date Wed, 18 Oct 2023 18:26:34 GMT content-encoding gzip server nginx etag W/"9i0WP4JS3mz3vjIqgnzJ51Fg5mzK4MZp2wJYfJHBoLxSrK/t+r7ELblxUl9tYbroo9h4353N6s4BgcmRhXVQFQ0h9AVdRcH/Dq0Ze6rp+tPkH6zFxnh5xJQW9w3IGf/s4by3THUEFg4WmZFbjINVH9T8" vary Accept-Encoding content-type application/json; charset=utf-8 cache-control no-cache x-envoy-upstream-service-time 1
POST H2	200	fl www.group-ib.com/api/	665 B 982 B	24ms 23ms	XHR application/json	3.72.181.255 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://www.group-ib.com/api/fl?u=078c8cd0-6dd4-11ee-991f-4be53f4f36ab&cfidsgib-w-61354c22-16cc-40a8-a871-6901f1a76e24=9i0WP4JS3mz3vjIqgnzJ51Fg5mzK4MZp2wJYfJHBoLxSrK%2Ft%2Br7ELblxUl9tYbroo9h4353N6s4BgcmRhXVQFQ0h9AVdRcH%2FDq0Ze6rp%2BtPkH6zFxnh5xJQW9w3IGf%2Fs4by3THUEFg4WmZFbjINVH9T8 Requested by Host: fhp-de-js.group-ib.com URL: https://fhp-de-js.group-ib.com/d/bt-autoinject.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 3.72.181.255 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-3-72-181-255.eu-central-1.compute.amazonaws.com Software nginx / Resource Hash Request headers Referer https://www.group-ib.com/media-center/press-releases/phishing-kits-2022/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Content-Type text/plain;charset=UTF-8 Response headers date Wed, 18 Oct 2023 18:26:35 GMT content-encoding gzip server nginx vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS content-type application/json; charset=utf-8 access-control-allow-origin https://www.group-ib.com cache-control no-store access-control-allow-credentials true x-envoy-upstream-service-time 2 access-control-allow-headers Accept,DNT,Keep-Alive,User-Agent,If-Modified-Since,Cache-Control,Content-Type,Origin,ETag,If-None-Match,X-Cfids,Authorization
GET H2	200	Primary Request / Show response www.group-ib.com/media-center/press-releases/phishing-kits-2022/	74 KB 16 KB	21ms 21ms	Document text/html	3.72.181.255 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://www.group-ib.com/media-center/press-releases/phishing-kits-2022/ Requested by Host: www.group-ib.com URL: https://www.group-ib.com/media-center/press-releases/phishing-kits-2022/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 3.72.181.255 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-3-72-181-255.eu-central-1.compute.amazonaws.com Software nginx / Resource Hash eb3fc52937043477724e6272fd3737669b64e25044f08b3fc27785da32424514 Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers Referer https://www.group-ib.com/media-center/press-releases/phishing-kits-2022/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers accept-ranges bytes access-control-allow-origin https://www.group-ib.com cache-control private, max-age=3600 content-encoding gzip content-length 15925 content-security-policy frame-ancestors 'self'; content-type text/html; charset=UTF-8 date Wed, 18 Oct 2023 18:26:35 GMT etag "3da0-607fddcdde7e7" last-modified Wed, 18 Oct 2023 13:46:13 GMT permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() referrer-policy strict-origin-when-cross-origin server nginx strict-transport-security max-age=31536000; includeSubDomains vary X-Forwarded-Proto,Accept-Encoding,Cookie x-content-type-options nosniff x-frame-options sameorigin x-xss-protection 1; mode=block
POST H2	200	fl www.group-ib.com/api/	665 B 691 B	15ms 14ms	Ping application/json	3.72.181.255 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://www.group-ib.com/api/fl?u=078c8cd0-6dd4-11ee-991f-4be53f4f36ab&cfidsgib-w-61354c22-16cc-40a8-a871-6901f1a76e24=dZheMdjm6n5fgo%2FHcrCWiGxTWlffj%2BOwizvlB9KsfWaj1VDEy8Ws6rOw4MY3kfnverokvFbuOl8W3b%2F42n0bsGgvDQlSwEJrOZjwZMFYGuPPO1lz4nHW7XlrAq9wEhD4JFuXaCNcsT25yZYMayfDOE%2FDrSD%2Foj0mQsex Requested by Host: fhp-de-js.group-ib.com URL: https://fhp-de-js.group-ib.com/d/bt-autoinject.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 3.72.181.255 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-3-72-181-255.eu-central-1.compute.amazonaws.com Software nginx / Resource Hash Request headers Referer https://www.group-ib.com/media-center/press-releases/phishing-kits-2022/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Content-Type text/plain;charset=UTF-8 Response headers date Wed, 18 Oct 2023 18:26:35 GMT content-encoding gzip server nginx vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS content-type application/json; charset=utf-8 access-control-allow-origin https://www.group-ib.com cache-control no-store access-control-allow-credentials true x-envoy-upstream-service-time 1 access-control-allow-headers Accept,DNT,Keep-Alive,User-Agent,If-Modified-Since,Cache-Control,Content-Type,Origin,ETag,If-None-Match,X-Cfids,Authorization
GET H/1.1	200 OK	bt-autoinject.js Show response fhp-de-js.group-ib.com/d/	342 KB 134 KB	25ms 25ms	Script text/javascript	188.40.44.175 HETZNER-AS
General Check archive.org Show headers Download Go to Full URL https://fhp-de-js.group-ib.com/d/bt-autoinject.js Requested by Host: www.group-ib.com URL: https://www.group-ib.com/media-center/press-releases/phishing-kits-2022/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 188.40.44.175 , Germany, ASN24940 (HETZNER-AS, DE), Reverse DNS static.175.44.40.188.clients.your-server.de Software nginx / Resource Hash ba94685a300cba555ba04b2e16a9c28c59e08a54c6c3822048b92fda87d75fde Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers Date Wed, 18 Oct 2023 18:26:35 GMT Content-Encoding gzip Server nginx Transfer-Encoding chunked Vary Accept-Encoding Content-Type text/javascript; charset=UTF-8 Access-Control-Allow-Methods GET, POST, OPTIONS x-envoy-upstream-service-time 0 Access-Control-Allow-Credentials true Connection keep-alive Access-Control-Allow-Headers Accept,DNT,Keep-Alive,User-Agent,If-Modified-Since,Cache-Control,Content-Type,Origin,ETag,If-None-Match,X-Cfids,Authorization
GET H2	200	lazyload.min.js Show response www.group-ib.com/wp-content/plugins/w3-total-cache/pub/js/	6 KB 2 KB	17ms 16ms	Script application/x-javascript	3.72.181.255 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://www.group-ib.com/wp-content/plugins/w3-total-cache/pub/js/lazyload.min.js Requested by Host: www.group-ib.com URL: https://www.group-ib.com/media-center/press-releases/phishing-kits-2022/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 3.72.181.255 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-3-72-181-255.eu-central-1.compute.amazonaws.com Software nginx / Resource Hash 1a54a1907a6443e3c81608130bfed4546eb0ce5d0c8897e1d7a3b43d89ecc367 Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/media-center/press-releases/phishing-kits-2022/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; content-encoding gzip x-content-type-options nosniff date Wed, 18 Oct 2023 18:26:35 GMT strict-transport-security max-age=31536000; includeSubDomains content-length 2356 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Tue, 17 Oct 2023 14:39:45 GMT server nginx etag "1883-607ea7e6d372f-gzip" vary X-Forwarded-Proto,Accept-Encoding x-frame-options sameorigin content-type application/x-javascript access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes expires Wed, 18 Oct 2023 18:56:35 GMT
GET H2	200	swiper-bundle.min.js Show response website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/js/	140 KB 39 KB	66ms 29ms	Script application/x-javascript	2600:9000:238d:4a00:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/js/swiper-bundle.min.js Requested by Host: www.group-ib.com URL: https://www.group-ib.com/media-center/press-releases/phishing-kits-2022/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:238d:4a00:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash b624e1e378abe009ef0de69a698b0a3e734af47efcdbd6816d5fcb8fc64c8bfe Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; content-encoding gzip x-content-type-options nosniff strict-transport-security max-age=31536000; includeSubDomains via 1.1 74511018c757716e70d811d8214e45e0.cloudfront.net (CloudFront) date Wed, 18 Oct 2023 18:26:35 GMT x-amz-cf-pop AMS1-P1 x-cache Hit from cloudfront content-length 39504 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Mon, 05 Sep 2022 07:41:14 GMT server nginx etag "22ede-5e7e9344df9f2-gzip" x-frame-options sameorigin vary Accept-Encoding content-type application/x-javascript access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id bz0MpPeUwlV494alKSrj3URIvB3E2N04Uuv0-7OdUBA6WZIK9J-oKQ== expires Wed, 18 Oct 2023 18:56:35 GMT
GET H2	200	classic-themes.min.css website.cdn.group-ib.com/wp-includes/css/	217 B 1004 B	65ms 29ms	Stylesheet text/css	2600:9000:238d:4a00:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://website.cdn.group-ib.com/wp-includes/css/classic-themes.min.css Requested by Host: www.group-ib.com URL: https://www.group-ib.com/media-center/press-releases/phishing-kits-2022/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:238d:4a00:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash 5a5f39391fbf5b06db84b8f9716d53de575ee97a627d2c5f12f79a991a671eb5 Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; content-encoding gzip x-content-type-options nosniff strict-transport-security max-age=31536000; includeSubDomains via 1.1 74511018c757716e70d811d8214e45e0.cloudfront.net (CloudFront) date Wed, 18 Oct 2023 18:26:35 GMT x-amz-cf-pop AMS1-P1 x-cache Hit from cloudfront content-length 189 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Fri, 11 Nov 2022 11:58:50 GMT server nginx etag "d9-5ed309cf15c82-gzip" x-frame-options sameorigin vary Accept-Encoding content-type text/css access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id uf0uHZBVte5oQ-a3yMl3mDgv4CZnJUiPY7QxNlLyE8IcYlWtvR_cCw== expires Wed, 18 Oct 2023 18:56:35 GMT
GET H2	200	dashicons.min.css website.cdn.group-ib.com/wp-includes/css/	58 KB 36 KB	64ms 27ms	Stylesheet text/css	2600:9000:238d:4a00:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://website.cdn.group-ib.com/wp-includes/css/dashicons.min.css Requested by Host: www.group-ib.com URL: https://www.group-ib.com/media-center/press-releases/phishing-kits-2022/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:238d:4a00:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash c21e5a2b32c47bc5f9d9efc97bc0e29fd081946d1d3ebffc5621cfafb1d3960e Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; content-encoding gzip x-content-type-options nosniff strict-transport-security max-age=31536000; includeSubDomains via 1.1 74511018c757716e70d811d8214e45e0.cloudfront.net (CloudFront) date Wed, 18 Oct 2023 18:26:35 GMT x-amz-cf-pop AMS1-P1 x-cache Hit from cloudfront content-length 35730 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Fri, 10 Jun 2022 07:03:36 GMT server nginx etag "e688-5e112897ec200-gzip" x-frame-options sameorigin vary Accept-Encoding content-type text/css access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id 24SHN0iRr-BUHfAMq4nA7W8wQm7tnmShoZQ_A8iyTb-Zm2XisSv_bQ== expires Wed, 18 Oct 2023 18:56:35 GMT
GET H2	200	frontend.min.css www.group-ib.com/wp-content/plugins/post-views-counter/css/	215 B 251 B	17ms 16ms	Stylesheet text/css	3.72.181.255 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://www.group-ib.com/wp-content/plugins/post-views-counter/css/frontend.min.css Requested by Host: www.group-ib.com URL: https://www.group-ib.com/media-center/press-releases/phishing-kits-2022/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 3.72.181.255 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-3-72-181-255.eu-central-1.compute.amazonaws.com Software nginx / Resource Hash ed70c2cf61d0f24d03299ffc5896c7abd86bb858501987dc10e3afec086c01df Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/media-center/press-releases/phishing-kits-2022/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; content-encoding gzip x-content-type-options nosniff date Wed, 18 Oct 2023 18:26:35 GMT strict-transport-security max-age=31536000; includeSubDomains content-length 160 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Wed, 26 Apr 2023 07:26:40 GMT server nginx etag "d7-5fa38293ec798-gzip" vary X-Forwarded-Proto,Accept-Encoding x-frame-options sameorigin content-type text/css access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes expires Wed, 18 Oct 2023 18:56:35 GMT
GET H2	200	jquery.min.js Show response website.cdn.group-ib.com/wp-includes/js/jquery/	88 KB 31 KB	66ms 30ms	Script application/x-javascript	2600:9000:238d:4a00:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://website.cdn.group-ib.com/wp-includes/js/jquery/jquery.min.js Requested by Host: www.group-ib.com URL: https://www.group-ib.com/media-center/press-releases/phishing-kits-2022/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:238d:4a00:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash cc7403bab52ed166e24ea9324241045af370be482f5b594468f4a6ac6e7e7981 Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; content-encoding gzip x-content-type-options nosniff strict-transport-security max-age=31536000; includeSubDomains via 1.1 74511018c757716e70d811d8214e45e0.cloudfront.net (CloudFront) date Wed, 18 Oct 2023 18:26:35 GMT x-amz-cf-pop AMS1-P1 x-cache Hit from cloudfront content-length 30995 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Fri, 11 Nov 2022 11:58:50 GMT server nginx etag "15e54-5ed309cf21802-gzip" x-frame-options sameorigin vary Accept-Encoding content-type application/x-javascript access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id xljfP-iSq7Thi3d3FG82n8heSZPFJF4xZP918tHmfa9KH4ml0fLtmg== expires Wed, 18 Oct 2023 18:56:35 GMT
GET H2	200	single-press-release.css website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/	227 KB 34 KB	64ms 28ms	Stylesheet text/css	2600:9000:238d:4a00:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-press-release.css Requested by Host: www.group-ib.com URL: https://www.group-ib.com/media-center/press-releases/phishing-kits-2022/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:238d:4a00:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash 9ea99438227af036f87175bd97770d185538ffd7bf7e3c9a786bd735b68d8f66 Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; content-encoding gzip x-content-type-options nosniff strict-transport-security max-age=31536000; includeSubDomains via 1.1 74511018c757716e70d811d8214e45e0.cloudfront.net (CloudFront) date Wed, 18 Oct 2023 18:26:35 GMT x-amz-cf-pop AMS1-P1 x-cache Hit from cloudfront content-length 33723 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Wed, 18 Oct 2023 18:25:51 GMT server nginx etag "38aba-60801c4e14402-gzip" x-frame-options sameorigin vary Accept-Encoding content-type text/css access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id 69thh1Bk6Yne1xI3ZENpY5KHCEjWZqCudg0KSdAq8wSeoecH5tRYcw== expires Wed, 18 Oct 2023 18:56:35 GMT
GET H2	200	v2.js Show response js-eu1.hsforms.net/forms/	563 KB 179 KB	56ms 20ms	Script application/javascript	172.65.255.172 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://js-eu1.hsforms.net/forms/v2.js Requested by Host: www.group-ib.com URL: https://www.group-ib.com/media-center/press-releases/phishing-kits-2022/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.65.255.172 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 279817a125934c4629aa278564e64fca0dcb0fdc45f38739e38c9cab297d2a92 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers content-encoding br age 321 x-evy-trace-route-service-name envoyset-translator x-amz-server-side-encryption AES256 content-security-policy-report-only frame-ancestors 'self'; report-uri https://send.hsbrowserreports.com/csp/report?resource=forms-embed/static-1.3938/bundles/project-v2.js&cfRay=8182ccc6c4db9b25-FRA x-amz-replication-status COMPLETED x-evy-trace-listener listener_https etag W/"df4d197f9648d27915af7ec01a018b73" vary Accept-Encoding content-type application/javascript; charset=utf-8 access-control-allow-origin * x-evy-trace-virtual-host all cache-control s-maxage=600, max-age=300 x-hs-target-asset forms-embed/static-1.3938/bundles/project-v2.js date Wed, 18 Oct 2023 18:26:35 GMT x-amz-version-id pLPYW3H2ND7V2jGLhGJ4mCejj6Xammwx via 1.1 3aad72975c9da06e6d0903ad874f0b54.cloudfront.net (CloudFront) x-content-type-options nosniff cf-cache-status HIT nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} strict-transport-security max-age=31536000; includeSubDomains; preload x-amz-cf-pop FRA56-P2 x-hubspot-correlation-id 8a42abee-ec35-43f8-9b7b-6f538e4ac0d0 x-cache Hit from cloudfront cache-tag staticjsapp-forms-embed-v2-web-prod,staticjsapp-prod x-envoy-upstream-service-time 0 alt-svc h3=":443"; ma=86400 x-evy-trace-route-configuration listener_https/all x-request-id 8a42abee-ec35-43f8-9b7b-6f538e4ac0d0 last-modified Thu, 12 Oct 2023 03:05:49 UTC server cloudflare report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=8tFLRNmiygCmGu9p5ROkd02WqhMNtBMZPU5OqseyOUh8mtKAbThZKSn9Axcaa7NshD8Aok1nrlS2HqU63Bfr1BA76AWFhx0P9MYko0LRTn2AzqkP0zTQn%2FC7Ufkyd5s3lLQ5BA%3D%3D"}],"group":"cf-nel","max_age":604800} x-hs-cache-status HIT x-evy-trace-served-by-pod fra04/app-td/envoy-proxy-797758f45b-49p9l cf-ray 8182d49ecf8b5c38-FRA x-amz-cf-id LlsKj5dP-MkkPppvAGDgxdKZqzwdf22ZYyY8doPSCKhnhgjkBP8w7g==
GET H2	200	jquery-ui.js Show response website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/libs/jquery-ui/	517 KB 125 KB	16ms 15ms	Script application/x-javascript	2600:9000:238d:4a00:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/libs/jquery-ui/jquery-ui.js Requested by Host: www.group-ib.com URL: https://www.group-ib.com/media-center/press-releases/phishing-kits-2022/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:238d:4a00:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash e97315234cc1f1c4737d98ea29c0f4d4f06c032dc5943012ae50bc4b10a92276 Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; content-encoding gzip x-content-type-options nosniff strict-transport-security max-age=31536000; includeSubDomains via 1.1 74511018c757716e70d811d8214e45e0.cloudfront.net (CloudFront) date Wed, 18 Oct 2023 18:26:36 GMT x-amz-cf-pop AMS1-P1 x-cache Hit from cloudfront x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Mon, 05 Sep 2022 07:24:28 GMT server nginx etag "812a6-5e7e8f85cb376-gzip" x-frame-options sameorigin vary Accept-Encoding content-type application/x-javascript access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id KhfHI4PwHBiVMgh_E858EqvJY6unCmV-eSVzlGatSCVcCuF0qrFQ8A== expires Wed, 18 Oct 2023 18:56:36 GMT
GET H2	200	fancybox.umd.js Show response website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/libs/fancybox/	103 KB 30 KB	65ms 30ms	Script application/x-javascript	2600:9000:238d:4a00:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/libs/fancybox/fancybox.umd.js Requested by Host: www.group-ib.com URL: https://www.group-ib.com/media-center/press-releases/phishing-kits-2022/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:238d:4a00:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash 942e02acf640c0308f65e057a8afaed63dfaf995034cda9cfc75532a1009ec72 Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; content-encoding gzip x-content-type-options nosniff strict-transport-security max-age=31536000; includeSubDomains via 1.1 74511018c757716e70d811d8214e45e0.cloudfront.net (CloudFront) date Wed, 18 Oct 2023 18:26:35 GMT x-amz-cf-pop AMS1-P1 x-cache Hit from cloudfront content-length 29634 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Mon, 05 Sep 2022 07:24:28 GMT server nginx etag "19ca6-5e7e8f85cb376-gzip" x-frame-options sameorigin vary Accept-Encoding content-type application/x-javascript access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id q_yCRK3HlDoOCGLP9T0caI2DyiRhkeQo30p0sm-A58Z6aw2S3vTvpQ== expires Wed, 18 Oct 2023 18:56:35 GMT
GET H2	200	main.js Show response website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/js/	212 KB 45 KB	25ms 25ms	Script application/x-javascript	2600:9000:238d:4a00:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/js/main.js Requested by Host: www.group-ib.com URL: https://www.group-ib.com/media-center/press-releases/phishing-kits-2022/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:238d:4a00:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software cloudflare / Resource Hash 620418e15bd4302ca68fe0c806a6a6e74a11a7cbc56004a3e052529b73092e9b Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; strict-transport-security max-age=31536000; includeSubDomains x-content-type-options nosniff cf-cache-status BYPASS nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} date Wed, 18 Oct 2023 18:26:36 GMT content-encoding br x-amz-cf-pop AMS1-P1 via 1.1 74511018c757716e70d811d8214e45e0.cloudfront.net (CloudFront) x-cache Hit from cloudfront x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Fri, 06 Oct 2023 11:14:14 GMT server cloudflare etag W/"34e47-6070a5733757d-gzip" x-frame-options sameorigin report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=BXbh4Wgj3BHyncFoFR0LAb9%2FR6K%2FsCGYJrMd6LfO7fu262iY%2BAgUspwl0N9FjseSiCKKvOUi1sDjspXuwmMo5D5GYw8kwoIpMteWLWiPSwGwus%2B5QRc5xOu7l7%2F5Vg2twHk%3D"}],"group":"cf-nel","max_age":604800} content-type application/x-javascript access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() vary Accept-Encoding cf-ray 817e64155a5b9bc2-FRA x-amz-cf-id DCRBCPeh8r8Fbu7tqFKOkY-lk42PEoCRifxnlJ8Cke7j3w2OME0qfA== expires Wed, 18 Oct 2023 18:56:36 GMT
GET H2	200	25755956.js Show response js-eu1.hs-scripts.com/	2 KB 1 KB	56ms 22ms	Script application/javascript	172.65.208.22 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://js-eu1.hs-scripts.com/25755956.js Requested by Host: www.group-ib.com URL: https://www.group-ib.com/media-center/press-releases/phishing-kits-2022/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.65.208.22 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash f8689f8ca34493dc577ea3d13b20e228745657870655d670486e194d6519667d Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers date Wed, 18 Oct 2023 18:26:36 GMT content-encoding br x-content-type-options nosniff cf-cache-status HIT x-hubspot-correlation-id bbc3f964-54c7-422c-97a9-ae089c85f96e x-evy-trace-route-service-name envoyset-translator cf-polished origSize=2524 age 9 x-envoy-upstream-service-time 4 x-evy-trace-route-configuration listener_https/all x-evy-trace-listener listener_https x-request-id bbc3f964-54c7-422c-97a9-ae089c85f96e cf-bgj minify last-modified Wed, 18 Oct 2023 18:26:27 GMT server cloudflare x-trace 2B477A5554AD2C518B514E60817CD031BC95E42421000000000000000000 access-control-max-age 3600 vary origin, Accept-Encoding content-type application/javascript;charset=utf-8 access-control-allow-origin https://www.group-ib.com x-evy-trace-served-by-pod fra04/hubapi-td/envoy-proxy-86f46d6c7b-sl5tw cache-control public, max-age=30 access-control-allow-credentials true x-evy-trace-virtual-host all cf-ray 8182d4a09eb437ec-FRA
GET DATA	200 OK	truncated /	488 B 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash f7fb1fc0ac78212c25ae41c535617d5cd66edd2230166376ca93fc945861f937 Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	4 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 1ba6e187ad23ae1f93ec3adebe14738a85dfad080dd988d4c3bfbe27bdefc73c Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers Content-Type image/png
GET H2	200	idgib-w-61354c22-16cc-40a8-a871-6901f1a76e24 Show response www.group-ib.com/api/fl/	217 B 634 B	35ms 34ms	XHR application/json	3.72.181.255 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://www.group-ib.com/api/fl/idgib-w-61354c22-16cc-40a8-a871-6901f1a76e24 Requested by Host: fhp-de-js.group-ib.com URL: https://fhp-de-js.group-ib.com/d/bt-autoinject.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 3.72.181.255 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-3-72-181-255.eu-central-1.compute.amazonaws.com Software nginx / Resource Hash 24b2b3dad35ab100c4747f92dcdc73eeca9599e749fdd3e44030700bef68fb62 Request headers X-GIB-GSSCgib-w-61354c22-16cc-40a8-a871-6901f1a76e24 VRDho37y8agNb3YncrEoKXnBDAzgql8gMV9PqYK3PnbB5wJwAjkYw5E75XEt9EdRlRejyF4n2Rw86T6cE2jKvC+EGes4PTTFNEe2YBLcc5DnYeS2ZoAJhnIr2jtS0kNLBMVMdszax7v3/y/qGraX6yVWx9V5oD2DIxyRRtBouGE6D47c52yfZxfWDRFE24rIaucv1SzSmJY0Et7fm9HdHWr8Ufdoc9w+kErYebGx+ajIl6Wprc8am2vcqsa6Dg== Referer https://www.group-ib.com/media-center/press-releases/phishing-kits-2022/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 X-GIB-FGSSCgib-w-61354c22-16cc-40a8-a871-6901f1a76e24 ixSSdf818d209b042e90112d34368a3181709e6f x-cfids dZheMdjm6n5fgo/HcrCWiGxTWlffj+OwizvlB9KsfWaj1VDEy8Ws6rOw4MY3kfnverokvFbuOl8W3b/42n0bsGgvDQlSwEJrOZjwZMFYGuPPO1lz4nHW7XlrAq9wEhD4JFuXaCNcsT25yZYMayfDOE/DrSD/oj0mQsex Response headers date Wed, 18 Oct 2023 18:26:36 GMT content-encoding gzip server nginx etag W/"ZmCjuxoXtGmduvQYW9cj4nsvQi1rqmNYfYa8VGZDobYemwGDw6VG6N0vST41XufX2EwHqB9TevmQ/kXtR3mNvepmsSwy4dbSIRt+2AmF4unjza4OTJtlLv92SfU/8kkVi1EQmcjAYXoONV5TditCfgsQJMTboO8zP0Z4" vary Accept-Encoding content-type application/json; charset=utf-8 cache-control no-cache x-envoy-upstream-service-time 1
GET H2	200	G-font-Medium.otf website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/fonts/G-font/	60 KB 35 KB	79ms 49ms	Font application/x-font-otf	2600:9000:238d:4a00:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/fonts/G-font/G-font-Medium.otf Requested by Host: website.cdn.group-ib.com URL: https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-press-release.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:238d:4a00:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash 1efe16c9efbadde5e242d88a315eca3906a55669fcd4882a904fbc723306a4e4 Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers Referer https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-press-release.css Origin https://www.group-ib.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; content-encoding gzip x-content-type-options nosniff strict-transport-security max-age=31536000; includeSubDomains via 1.1 cf45fdeb5348a5648604f5f9e4f2b8a8.cloudfront.net (CloudFront) date Wed, 18 Oct 2023 18:26:36 GMT x-amz-cf-pop AMS1-P1 x-cache RefreshHit from cloudfront content-length 35382 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Tue, 28 Jun 2022 07:55:26 GMT server nginx etag "eed4-5e27d5c025780-gzip" x-frame-options sameorigin vary Accept-Encoding content-type application/x-font-otf access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id fpFC0SBY6q6Orng9W1GbeFkluC6x3_ps6kx-Y1dDpA5DReDjQx3Kww== expires Wed, 18 Oct 2023 18:56:36 GMT
GET H2	200	G-font-Regular.otf website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/fonts/G-font/	47 KB 31 KB	67ms 38ms	Font application/x-font-otf	2600:9000:238d:4a00:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/fonts/G-font/G-font-Regular.otf Requested by Host: website.cdn.group-ib.com URL: https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-press-release.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:238d:4a00:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash 6cee0fb06339ba13e1f15d044e0e4904bbeeb7fbe4351e3f102b6d80b2465061 Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers Referer https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-press-release.css Origin https://www.group-ib.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; content-encoding gzip x-content-type-options nosniff strict-transport-security max-age=31536000; includeSubDomains via 1.1 cf45fdeb5348a5648604f5f9e4f2b8a8.cloudfront.net (CloudFront) date Wed, 18 Oct 2023 18:26:36 GMT x-amz-cf-pop AMS1-P1 x-cache RefreshHit from cloudfront content-length 30798 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Tue, 28 Jun 2022 07:55:26 GMT server nginx etag "bbf8-5e27d5c025780-gzip" x-frame-options sameorigin vary Accept-Encoding content-type application/x-font-otf access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id l_EgG5Jbu8VJ7DLeqTxdBUJlqD2lFikPUhoUf7mHmFgU4u8dfDCRTQ== expires Wed, 18 Oct 2023 18:56:36 GMT
GET H/1.1	200 OK	json Show response forms-eu1.hsforms.com/embed/v3/form/25755956/044e7558-8073-478a-ad3c-5807dd76840f/	9 KB 3 KB	100ms 67ms	XHR application/json	172.65.232.43 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://forms-eu1.hsforms.com/embed/v3/form/25755956/044e7558-8073-478a-ad3c-5807dd76840f/json?hs_static_app=forms-embed&hs_static_app_version=1.3938&X-HubSpot-Static-App-Info=forms-embed-1.3938 Requested by Host: fhp-de-js.group-ib.com URL: https://fhp-de-js.group-ib.com/d/bt-autoinject.js Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 172.65.232.43 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash e297f532756cf9ebae46f7f087914e857671392e3047017c31bbb53c213fe453 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Accept application/json, text/plain, */* Referer https://www.group-ib.com/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers X-Origin-Hublet eu1 Date Wed, 18 Oct 2023 18:26:36 GMT Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff CF-Cache-Status DYNAMIC Content-Encoding br x-evy-trace-route-service-name envoyset-translator X-HubSpot-Correlation-Id 5181cc7a-7aaf-4ea9-a49d-41b06892b935 Transfer-Encoding chunked x-envoy-upstream-service-time 11 Connection keep-alive alt-svc h3=":443"; ma=86400 x-evy-trace-route-configuration listener_https/all x-evy-trace-listener listener_https x-request-id 5181cc7a-7aaf-4ea9-a49d-41b06892b935 Server cloudflare X-Trace 2B7DA79DE831507A17E66746492E75BFCB68FD688F000000000000000000 Vary origin Access-Control-Allow-Methods OPTIONS, GET Content-Type application/json;charset=utf-8 Access-Control-Allow-Origin https://www.group-ib.com x-evy-trace-virtual-host all Access-Control-Expose-Headers X-Origin-Hublet Access-Control-Max-Age 180 Access-Control-Allow-Credentials false Cache-Control max-age=0, no-cache, no-store X-Robots-Tag none Access-Control-Allow-Headers * CF-RAY 8182d4a0d89e1c2e-FRA x-evy-trace-served-by-pod fra04/star-hubspot-td/envoy-proxy-5cdd94655b-9hfk8
GET H2	200	cross.svg website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/main-nav/	342 B 1 KB	41ms 40ms	Image image/svg+xml	2600:9000:238d:4a00:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/main-nav/cross.svg Requested by Host: website.cdn.group-ib.com URL: https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-press-release.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:238d:4a00:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash dfb059f8aa219769088fd6c85d85aae789f1e72bfe3d314748f1f3ccfffffb1c Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-press-release.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; content-encoding gzip x-content-type-options nosniff strict-transport-security max-age=31536000; includeSubDomains via 1.1 74511018c757716e70d811d8214e45e0.cloudfront.net (CloudFront) date Wed, 18 Oct 2023 18:26:36 GMT x-amz-cf-pop AMS1-P1 x-cache RefreshHit from cloudfront content-length 207 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Tue, 28 Jun 2022 07:55:26 GMT server nginx etag "156-5e27d5c025780-gzip" x-frame-options sameorigin vary Accept-Encoding content-type image/svg+xml access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id kvqEa7YbermeE9_gqhb59TH_CDfKB2l12mrcHXSBNlW8TL-ypTy93Q== expires Wed, 18 Oct 2023 18:56:36 GMT
GET H/1.1	200 OK	json Show response forms-eu1.hsforms.com/embed/v3/form/25755956/4dbceae1-75ae-423a-9c12-dee8f1ca3345/	112 KB 30 KB	114ms 94ms	XHR application/json	172.65.232.43 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://forms-eu1.hsforms.com/embed/v3/form/25755956/4dbceae1-75ae-423a-9c12-dee8f1ca3345/json?hs_static_app=forms-embed&hs_static_app_version=1.3938&X-HubSpot-Static-App-Info=forms-embed-1.3938 Requested by Host: fhp-de-js.group-ib.com URL: https://fhp-de-js.group-ib.com/d/bt-autoinject.js Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 172.65.232.43 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 6c15814aed2fe9424768c09fb36971a349509fe7c4369f48787a628e422bd824 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Accept application/json, text/plain, */* Referer https://www.group-ib.com/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers X-Origin-Hublet eu1 Date Wed, 18 Oct 2023 18:26:36 GMT Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff CF-Cache-Status DYNAMIC Content-Encoding br x-evy-trace-route-service-name envoyset-translator X-HubSpot-Correlation-Id 7e32966d-e177-4bd3-812d-f497119baee1 Transfer-Encoding chunked x-envoy-upstream-service-time 24 Connection keep-alive alt-svc h3=":443"; ma=86400 x-evy-trace-route-configuration listener_https/all x-evy-trace-listener listener_https x-request-id 7e32966d-e177-4bd3-812d-f497119baee1 Server cloudflare X-Trace 2B6EBD3C876957DCAD0188EDB8F49BE0F17411D725000000000000000000 Vary origin Access-Control-Allow-Methods OPTIONS, GET Content-Type application/json;charset=utf-8 Access-Control-Allow-Origin https://www.group-ib.com x-evy-trace-virtual-host all Access-Control-Expose-Headers X-Origin-Hublet Access-Control-Max-Age 180 Access-Control-Allow-Credentials false Cache-Control max-age=0, no-cache, no-store X-Robots-Tag none Access-Control-Allow-Headers * CF-RAY 8182d4a0fe389ba6-FRA x-evy-trace-served-by-pod fra04/star-hubspot-td/envoy-proxy-5cdd94655b-pnstb
GET H/1.1	200 OK	json Show response forms-eu1.hsforms.com/embed/v3/form/25755956/5a995f05-701c-48e3-b25a-d1548ba3c0b3/	104 KB 29 KB	79ms 61ms	XHR application/json	172.65.232.43 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://forms-eu1.hsforms.com/embed/v3/form/25755956/5a995f05-701c-48e3-b25a-d1548ba3c0b3/json?hs_static_app=forms-embed&hs_static_app_version=1.3938&X-HubSpot-Static-App-Info=forms-embed-1.3938 Requested by Host: fhp-de-js.group-ib.com URL: https://fhp-de-js.group-ib.com/d/bt-autoinject.js Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 172.65.232.43 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 558e25cba3298c6024909de57357e05622784925dd2932ddb87fc7d2e0aecd41 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Accept application/json, text/plain, */* Referer https://www.group-ib.com/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers X-Origin-Hublet eu1 Date Wed, 18 Oct 2023 18:26:36 GMT Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff CF-Cache-Status DYNAMIC Content-Encoding br x-evy-trace-route-service-name envoyset-translator X-HubSpot-Correlation-Id d5fc9099-5279-4c9a-9182-b1b21e7edbfa Transfer-Encoding chunked x-envoy-upstream-service-time 16 Connection keep-alive alt-svc h3=":443"; ma=86400 x-evy-trace-route-configuration listener_https/all x-evy-trace-listener listener_https x-request-id d5fc9099-5279-4c9a-9182-b1b21e7edbfa Server cloudflare X-Trace 2B46065C3B39EFE9A43385D63A9C27FCD4E9F21785000000000000000000 Vary origin Access-Control-Allow-Methods OPTIONS, GET Content-Type application/json;charset=utf-8 Access-Control-Allow-Origin https://www.group-ib.com x-evy-trace-virtual-host all Access-Control-Expose-Headers X-Origin-Hublet Access-Control-Max-Age 180 Access-Control-Allow-Credentials false Cache-Control max-age=0, no-cache, no-store X-Robots-Tag none Access-Control-Allow-Headers * CF-RAY 8182d4a10b032bc7-FRA x-evy-trace-served-by-pod fra04/star-hubspot-td/envoy-proxy-5cdd94655b-5tsjd
GET DATA	200 OK	truncated /	64 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 01caf20e667c8e300960582162f912d9405e9895c32cff1a9ee95511fd509a2c Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	69 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 8cf03002cc76f44aa90d9925963f6173ac50650b2395bed48247f9ff85bf3107 Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	68 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash f5ff6d9d9a42ed8dc64cf6d1418511eb4b9cb2f0aa76fdc471ecf442e43a037f Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers Content-Type image/svg+xml
GET H2	200	dropdown_before.svg website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/main-nav/	154 B 1 KB	45ms 44ms	Image image/svg+xml	2600:9000:238d:4a00:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/main-nav/dropdown_before.svg Requested by Host: website.cdn.group-ib.com URL: https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-press-release.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:238d:4a00:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software cloudflare / Resource Hash 574ab1a3d7b47add5d43a927f62c87698264f63572acd70b42081dd4a1dc5ced Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-press-release.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers strict-transport-security max-age=31536000; includeSubDomains content-security-policy frame-ancestors 'self'; x-content-type-options nosniff cf-cache-status BYPASS nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} date Wed, 18 Oct 2023 18:26:36 GMT content-encoding br x-amz-cf-pop AMS1-P1 via 1.1 74511018c757716e70d811d8214e45e0.cloudfront.net (CloudFront) x-cache RefreshHit from cloudfront x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Tue, 28 Jun 2022 07:55:26 GMT server cloudflare etag W/"9a-5e27d5c025780-gzip" x-frame-options sameorigin report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=7esrJ2dayLci2vDjReVtd9UC3LBPGsWWxleawzzfNnIyLpec4Pku4PfkS8to07A0Ag8HMd0NHzR%2BtcbKGdP5ZCN341NGcS5inSJtnvZbVR5BSTjtnmb2kF%2FwsUki47A0ENA%3D"}],"group":"cf-nel","max_age":604800} content-type image/svg+xml access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() vary Accept-Encoding cf-ray 8145918baa261d84-FRA x-amz-cf-id EIaA_3b_2NUucxMzkOl6j_o1sG8ICD097p3z3HK6XufWPMzKG3fRGQ== expires Wed, 18 Oct 2023 18:56:36 GMT
GET H2	200	link-arrow.svg website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/	409 B 1 KB	31ms 30ms	Image image/svg+xml	2600:9000:238d:4a00:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/link-arrow.svg Requested by Host: website.cdn.group-ib.com URL: https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-press-release.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:238d:4a00:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash e91c5731358570d3e4cd684118251d243fc799059648b152403dcd775ceba632 Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-press-release.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; content-encoding gzip x-content-type-options nosniff strict-transport-security max-age=31536000; includeSubDomains via 1.1 74511018c757716e70d811d8214e45e0.cloudfront.net (CloudFront) date Wed, 18 Oct 2023 18:26:36 GMT x-amz-cf-pop AMS1-P1 x-cache RefreshHit from cloudfront content-length 267 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Tue, 28 Jun 2022 07:55:26 GMT server nginx etag "199-5e27d5c025780-gzip" x-frame-options sameorigin vary Accept-Encoding content-type image/svg+xml access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id UrHhnSMt3BYiWGUw83T7NM7guK9fn_30D0Fu7jc8sxOOZmECWqPdXQ== expires Wed, 18 Oct 2023 18:56:36 GMT
GET H2	200	G-font-Bold.otf website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/fonts/G-font/	49 KB 32 KB	84ms 84ms	Font application/x-font-otf	2600:9000:238d:4a00:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/fonts/G-font/G-font-Bold.otf Requested by Host: website.cdn.group-ib.com URL: https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-press-release.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:238d:4a00:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash 8d15a221986226efe4f742f390f46f9d5ae8b2008a6edd40e10ff121ef9cca9b Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers Referer https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-press-release.css Origin https://www.group-ib.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; content-encoding gzip x-content-type-options nosniff strict-transport-security max-age=31536000; includeSubDomains via 1.1 cf45fdeb5348a5648604f5f9e4f2b8a8.cloudfront.net (CloudFront) date Wed, 18 Oct 2023 18:26:36 GMT x-amz-cf-pop AMS1-P1 x-cache RefreshHit from cloudfront content-length 31918 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Tue, 28 Jun 2022 07:55:26 GMT server nginx etag "c320-5e27d5c025780-gzip" x-frame-options sameorigin vary Accept-Encoding content-type application/x-font-otf access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id uLnCCjjC3T4p4fgyjrlIlqQkkZ9NwHRqXXlX-80LSdM8OLz0N2ax2Q== expires Wed, 18 Oct 2023 18:56:36 GMT
GET DATA	200 OK	truncated /	69 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 81cc2a3a0c0b6e8335f5f3143390b8b6f036dc573e73d3f4b5742482f0bdca73 Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers Content-Type image/svg+xml
GET H/1.1	200 OK	json Show response forms-eu1.hsforms.com/embed/v3/form/25755956/55a22738-d5a5-43f9-9c1c-fa4c1a6eb349/	8 KB 3 KB	44ms 43ms	XHR application/json	172.65.232.43 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://forms-eu1.hsforms.com/embed/v3/form/25755956/55a22738-d5a5-43f9-9c1c-fa4c1a6eb349/json?hs_static_app=forms-embed&hs_static_app_version=1.3938&X-HubSpot-Static-App-Info=forms-embed-1.3938 Requested by Host: fhp-de-js.group-ib.com URL: https://fhp-de-js.group-ib.com/d/bt-autoinject.js Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 172.65.232.43 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 86352c41e3f72847c3dc0cd499277e38c50fdc60909054b8ff36a5b832b16d65 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Accept application/json, text/plain, */* Referer https://www.group-ib.com/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers X-Origin-Hublet eu1 Date Wed, 18 Oct 2023 18:26:36 GMT Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff CF-Cache-Status DYNAMIC Content-Encoding br x-evy-trace-route-service-name envoyset-translator X-HubSpot-Correlation-Id 7842a6a8-4f7e-4dba-928d-1c43881aa57d Transfer-Encoding chunked x-envoy-upstream-service-time 7 Connection keep-alive alt-svc h3=":443"; ma=86400 x-evy-trace-route-configuration listener_https/all x-evy-trace-listener listener_https x-request-id 7842a6a8-4f7e-4dba-928d-1c43881aa57d Server cloudflare X-Trace 2BDB91C993A83E8718A1DB3EBBA6F82CFDF391B0D1000000000000000000 Vary origin Access-Control-Allow-Methods OPTIONS, GET Content-Type application/json;charset=utf-8 Access-Control-Allow-Origin https://www.group-ib.com x-evy-trace-virtual-host all Access-Control-Expose-Headers X-Origin-Hublet Access-Control-Max-Age 180 Access-Control-Allow-Credentials false Cache-Control max-age=0, no-cache, no-store X-Robots-Tag none Access-Control-Allow-Headers * CF-RAY 8182d4a17b9c2bc7-FRA x-evy-trace-served-by-pod fra04/star-hubspot-td/envoy-proxy-5cdd94655b-hn9qf
GET H2	200	gtm.js Show response www.googletagmanager.com/	287 KB 90 KB	59ms 34ms	Script application/javascript	2a00:1450:4001:831::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtm.js?id=GTM-PW7265 Requested by Host: www.group-ib.com URL: https://www.group-ib.com/media-center/press-releases/phishing-kits-2022/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:831::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash cf96299f469ab2abd282cc2d45eab4d4b5313b307837c8b21509a615545a09c9 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers date Wed, 18 Oct 2023 18:26:36 GMT content-encoding br strict-transport-security max-age=31536000; includeSubDomains cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 91919 x-xss-protection 0 last-modified Wed, 18 Oct 2023 18:00:00 GMT server Google Tag Manager vary Accept-Encoding content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true access-control-allow-headers Cache-Control expires Wed, 18 Oct 2023 18:26:36 GMT
GET H2	200	insight.min.js Show response website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/js/	8 KB 4 KB	47ms 47ms	Script application/x-javascript	2600:9000:238d:4a00:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/js/insight.min.js Requested by Host: www.group-ib.com URL: https://www.group-ib.com/media-center/press-releases/phishing-kits-2022/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:238d:4a00:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software cloudflare / Resource Hash 14f2ec002b176e0dee403cb7dd4ef2274a1353080e1e3e4084678770f4c15b9c Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers strict-transport-security max-age=31536000; includeSubDomains content-security-policy frame-ancestors 'self'; x-content-type-options nosniff cf-cache-status BYPASS nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} date Wed, 18 Oct 2023 18:26:36 GMT content-encoding br x-amz-cf-pop AMS1-P1 via 1.1 74511018c757716e70d811d8214e45e0.cloudfront.net (CloudFront) x-cache Hit from cloudfront x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Fri, 15 Jul 2022 14:12:57 GMT server cloudflare etag W/"1e5a-5e3d89d6a8c40-gzip" x-frame-options sameorigin report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=3%2F%2BDFDQydgD86CZcerWrIFFiW4Gfx2mB%2FWvDbWObssNeQ%2BEL7I3y61%2BAi0k4R%2BpHlhpasZAWQ3T62uzn2Ov1Xz%2BICGlBtIQo8zVA7jf5y34%2F2YIsW6VnSv6GSd1B4l6ieN4%3D"}],"group":"cf-nel","max_age":604800} content-type application/x-javascript access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() vary Accept-Encoding cf-ray 8145911299ee921a-FRA x-amz-cf-id 9HykgQX5dTXsVaC0jNczin-OrwS_akoetqwPTVFmKwDx9mFhBNIBIg== expires Wed, 18 Oct 2023 18:56:36 GMT
GET H2	200	collectedforms.js Show response js-eu1.hscollectedforms.net/	69 KB 25 KB	41ms 22ms	Script application/javascript	172.65.192.122 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://js-eu1.hscollectedforms.net/collectedforms.js Requested by Host: js-eu1.hs-scripts.com URL: https://js-eu1.hs-scripts.com/25755956.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.65.192.122 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash d1b5aca028dd8447199f3c06601e38f5b8aba3b29be5ccd2de504a561fed2558 Security Headers Name Value X-Content-Type-Options nosniff Request headers Referer https://www.group-ib.com/ Origin https://www.group-ib.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers content-encoding br age 362 x-evy-trace-route-service-name envoyset-translator x-amz-server-side-encryption AES256 content-security-policy-report-only frame-ancestors 'self'; report-uri https://send.hsbrowserreports.com/csp/report?resource=collected-forms-embed-js/static-1.425/bundles/project.js&cfRay=8182cbce5b699028-FRA x-amz-replication-status COMPLETED x-evy-trace-listener listener_https etag W/"526bb173ed1384afadfc2b0eb6b0846e" vary Accept-Encoding,Origin,Access-Control-Request-Headers,Access-Control-Request-Method access-control-allow-methods GET content-type application/javascript; charset=utf-8 access-control-allow-origin * x-evy-trace-virtual-host all cache-control s-maxage=600, max-age=300 x-hs-target-asset collected-forms-embed-js/static-1.425/bundles/project.js date Wed, 18 Oct 2023 18:26:36 GMT x-amz-version-id 99Y.E0UsJAdqqpubte3vKq3r2MOVQh4K via 1.1 4a502b22092e94faddf9a5b056e273ae.cloudfront.net (CloudFront) x-content-type-options nosniff cf-cache-status HIT x-amz-cf-pop FRA56-P2 x-hubspot-correlation-id 14cdaf11-60ce-4d1d-9020-3f7e8cfa6390 x-cache Hit from cloudfront cache-tag staticjsapp-collected-forms-embed-js-web-prod,staticjsapp-prod x-envoy-upstream-service-time 2 x-evy-trace-route-configuration listener_https/all x-request-id 14cdaf11-60ce-4d1d-9020-3f7e8cfa6390 last-modified Fri, 22 Sep 2023 08:42:59 UTC server cloudflare access-control-max-age 3000 x-hs-cache-status HIT x-evy-trace-served-by-pod fra04/app-td/envoy-proxy-797758f45b-49p9l cf-ray 8182d4a1cf991e14-FRA x-amz-cf-id 7_eFs_FfUe5nCIGByXNGW4nDkp4lSQDywccrvkF1KPIUAHrw-bpLEg==
GET H2	200	banner.js Show response js-eu1.hs-banner.com/v2/25755956/	66 KB 20 KB	59ms 22ms	Script text/javascript	172.65.202.201 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://js-eu1.hs-banner.com/v2/25755956/banner.js Requested by Host: js-eu1.hs-scripts.com URL: https://js-eu1.hs-scripts.com/25755956.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.65.202.201 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash c84eae5b234d8595c0318241296fe36e8a29f6f9077176a2b3f1c553b7ef823b Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers date Wed, 18 Oct 2023 18:26:36 GMT x-amz-version-id k.vw21NpSh7kRqhHX0xaReU0fWn_9Gg5 content-encoding br cf-cache-status HIT x-amz-request-id 5DTD75KSFV2P6VRN x-evy-trace-route-service-name envoyset-translator x-amz-server-side-encryption AES256 x-hubspot-correlation-id 882c981a-ec5f-4c94-a55a-f21ce92cc58e age 9 x-envoy-upstream-service-time 19 x-amz-id-2 vFP0XGjRIgFrTONIdj9WVwNVhsnkTWnl9u/XpgBkjWI1qDT4sLgqBxmKsoLtoo6r5vMEdSS9hK8= x-evy-trace-listener listener_https x-request-id 882c981a-ec5f-4c94-a55a-f21ce92cc58e x-evy-trace-route-configuration listener_https/all last-modified Wed, 18 Oct 2023 17:20:52 GMT server cloudflare etag W/"0fe58bfdba164c72145bf56fb55fa2bb" access-control-max-age 604800 access-control-allow-methods GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD content-type text/javascript; charset=UTF-8 access-control-allow-origin https://www.group-ib.com x-evy-trace-virtual-host all access-control-expose-headers x-last-modified-timestamp, X-HubSpot-NotFound, X-HS-User-Request, Link, Server-Timing cache-control max-age=300,public access-control-allow-credentials true x-evy-trace-served-by-pod fra04/analytics-js-proxy-td/envoy-proxy-6bfd96c9d5-v5rkj vary origin, Accept-Encoding timing-allow-origin * access-control-allow-headers Origin, X-Requested-With, Content-Type, Accept, Accept-Charset, Accept-Encoding, X-Override-Internal-Permissions, X-Properties-Source, X-Properties-SourceId, X-Properties-Flag, X-Hubspot-User-Id, X-Hubspot-Trace, X-Hubspot-Callee, X-Hubspot-Offset, X-Hubspot-No-Trace, X-HubSpot-Static-App-Info, X-HubSpot-Messages-Uri, X-HubSpot-Request-Source, X-HubSpot-Request-Reason, Subscription-Billing-Auth-Token, X-App-CSRF, X-Tools-CSRF, Online-Payment-Signing-UUID, X-Source, X-SourceId, X-Origin-UserId, X-Biden-Request-Source, X-HubSpot-CSRF-hubspotapi, X-Force-Cookie-Refresh, X-Force-Cookie-Refresh-No-Cache, X-HS-User-Request, X-Application-Id, X-HS-Referer, X-HubSpot-Correlation-Id cf-ray 8182d4a1dfae4d91-FRA expires Wed, 18 Oct 2023 18:31:27 GMT
GET H2	200	web-interactives-embed.js Show response js-eu1.hubspot.com/	75 KB 23 KB	295ms 275ms	Script application/javascript	172.65.236.181 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://js-eu1.hubspot.com/web-interactives-embed.js Requested by Host: js-eu1.hs-scripts.com URL: https://js-eu1.hs-scripts.com/25755956.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.65.236.181 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash acabd35f2b1e9987602b0dd006d22beaaf59d64d55aa0b1182953f605b4aedca Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer https://www.group-ib.com/ Origin https://www.group-ib.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers content-encoding br x-evy-trace-route-service-name envoyset-translator x-amz-server-side-encryption AES256 content-security-policy-report-only frame-ancestors 'self'; report-uri https://send.hsbrowserreports.com/csp/report?resource=web-interactives-embed/static-2.603/bundles/project.js&cfRay=8182d4a1c871902a-FRA x-amz-replication-status COMPLETED x-evy-trace-listener listener_https etag W/"05df44f442894aeff6db4cae78774575" vary Accept-Encoding,Origin,Access-Control-Request-Headers,Access-Control-Request-Method access-control-allow-methods GET content-type application/javascript; charset=utf-8 access-control-allow-origin * x-evy-trace-virtual-host all cache-control max-age=600 x-hs-target-asset web-interactives-embed/static-2.603/bundles/project.js date Wed, 18 Oct 2023 18:26:36 GMT x-amz-version-id CUHT59SEc6aYYLtp23JCKXXA_T1K86mL via 1.1 e9101023ffbe04130b9d4cac0cf9eebc.cloudfront.net (CloudFront) x-content-type-options nosniff cf-cache-status EXPIRED nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} strict-transport-security max-age=31536000; includeSubDomains; preload x-amz-cf-pop FRA56-P2 x-hubspot-correlation-id 1e92219f-1a5f-41be-a20c-c46451372d43 x-cache RefreshHit from cloudfront cache-tag staticjsapp-web-interactives-embed-web-prod,staticjsapp-prod x-envoy-upstream-service-time 245 x-evy-trace-route-configuration listener_https/all x-request-id 1e92219f-1a5f-41be-a20c-c46451372d43 last-modified Thu, 12 Oct 2023 02:04:49 UTC server cloudflare access-control-max-age 3000 report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=EqPNdSxsypfaRY%2FDrWKr6suiseBooYTdWeVhLoimiod42VJ7VC14ZbtzEPvCsRY0J%2Fg6dLV27ymz61CQSHp8NgH9bHGXQnqB69H3i%2FplwYLWFZ3DkaiiIWPEePU9bso3InmFuw%3D%3D"}],"group":"cf-nel","max_age":604800} x-hs-cache-status MISS x-evy-trace-served-by-pod fra04/app-td/envoy-proxy-797758f45b-8q8m9 cf-ray 8182d4a1c871902a-FRA x-amz-cf-id vSF9-ApmGzU1lak5zip5OSWhEehdGB_hGay1t7x6f76D3liFeBVZfA==
GET H2	200	fb.js Show response js-eu1.hsadspixel.net/	6 KB 4 KB	60ms 24ms	Script application/javascript	172.65.219.229 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://js-eu1.hsadspixel.net/fb.js Requested by Host: js-eu1.hs-scripts.com URL: https://js-eu1.hs-scripts.com/25755956.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.65.219.229 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 413237d22e25097e3cee2595c2cedccc0d680158bd638a421aecaa1a7237321f Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers date Wed, 18 Oct 2023 18:26:36 GMT x-amz-version-id 6Rl00Bao8JSR9sjVJgKGfhCjk_eTdRhI via 1.1 4d0ae7ca3bb5e2d6eaa1450e1906adb4.cloudfront.net (CloudFront) x-content-type-options nosniff cf-cache-status HIT x-amz-cf-pop FRA56-P2 age 10 x-amz-server-side-encryption AES256 x-evy-trace-route-service-name envoyset-translator content-security-policy-report-only frame-ancestors 'self'; report-uri https://send.hsbrowserreports.com/csp/report?resource=adsscriptloaderstatic/static-1.490/bundles/pixels-release.js&cfRay=8182d4631ad54da6-FRA x-cache Hit from cloudfront x-hubspot-correlation-id e07d3d0b-01f5-419e-971a-9e7c2964c881 cache-tag staticjsapp-AdsScriptLoaderCloudflare-web-prod,staticjsapp-prod content-encoding br x-envoy-upstream-service-time 1 x-amz-replication-status COMPLETED x-evy-trace-route-configuration listener_https/all x-evy-trace-listener listener_https x-request-id e07d3d0b-01f5-419e-971a-9e7c2964c881 last-modified Mon, 16 Oct 2023 16:51:04 UTC server cloudflare etag W/"7e8c6b3c97842ae7b4b13d1465637fd9" vary Accept-Encoding content-type application/javascript; charset=utf-8 x-hs-cache-status HIT x-evy-trace-virtual-host all cache-control max-age=600 x-evy-trace-served-by-pod fra04/app-td/envoy-proxy-797758f45b-8q8m9 cf-ray 8182d4a1e8825d91-FRA x-amz-cf-id oSN6bdM2WUllxQjwnqz8T8iWumbZYyRAg46nNxqPrIAmpITNNGfcsg== x-hs-target-asset adsscriptloaderstatic/static-1.490/bundles/pixels-release.js
GET H2	200	25755956.js Show response js-eu1.hs-analytics.net/analytics/1697653500000/	66 KB 21 KB	55ms 22ms	Script text/javascript	172.65.238.60 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://js-eu1.hs-analytics.net/analytics/1697653500000/25755956.js Requested by Host: js-eu1.hs-scripts.com URL: https://js-eu1.hs-scripts.com/25755956.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.65.238.60 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 92361eb5c51c83c5575a6704ee3734c26cd7713fb564e503d3a7800a0e284638 Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers date Wed, 18 Oct 2023 18:26:36 GMT content-encoding br cf-cache-status HIT x-amz-request-id 9R6BE1VZG6EF2G6H x-evy-trace-route-service-name envoyset-translator x-amz-server-side-encryption AES256 x-hubspot-correlation-id 39b2a910-acec-46c2-bacc-86f806838e94 age 20 x-envoy-upstream-service-time 22 x-amz-id-2 GBrw9rcQy9UGyHmThOWoO8GxFlUdMBaWMS8l3j1uG7Ya1KYw5umP+m3frXzll8/jS3tjaIdcpVY= x-evy-trace-listener listener_https x-request-id 39b2a910-acec-46c2-bacc-86f806838e94 x-evy-trace-route-configuration listener_https/all last-modified Thu, 12 Oct 2023 15:15:37 GMT server cloudflare etag W/"181d06e20d9f2d1a1320c23d29224409" vary origin, Accept-Encoding content-type text/javascript x-evy-trace-virtual-host all x-evy-trace-served-by-pod fra04/analytics-js-proxy-td/envoy-proxy-6bfd96c9d5-gdvn9 cache-control max-age=300,public access-control-allow-credentials false cf-ray 8182d4a1dd136931-FRA expires Wed, 18 Oct 2023 18:31:16 GMT
GET H/1.1	200 OK	json Show response forms-eu1.hsforms.com/embed/v3/form/25755956/eb903dab-0ef3-43b5-bdeb-71372e6ad0f0/	7 KB 3 KB	48ms 48ms	XHR application/json	172.65.232.43 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://forms-eu1.hsforms.com/embed/v3/form/25755956/eb903dab-0ef3-43b5-bdeb-71372e6ad0f0/json?hs_static_app=forms-embed&hs_static_app_version=1.3938&X-HubSpot-Static-App-Info=forms-embed-1.3938 Requested by Host: fhp-de-js.group-ib.com URL: https://fhp-de-js.group-ib.com/d/bt-autoinject.js Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 172.65.232.43 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 2badaa289a28b96a87de74cda1e642d9c89d99b26e211647bb5d78a44c74e883 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Accept application/json, text/plain, */* Referer https://www.group-ib.com/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers X-Origin-Hublet eu1 Date Wed, 18 Oct 2023 18:26:36 GMT Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff CF-Cache-Status DYNAMIC Content-Encoding br x-evy-trace-route-service-name envoyset-translator X-HubSpot-Correlation-Id c7138938-00e1-4473-9ce7-b4671c8019e5 Transfer-Encoding chunked x-envoy-upstream-service-time 7 Connection keep-alive alt-svc h3=":443"; ma=86400 x-evy-trace-route-configuration listener_https/all x-evy-trace-listener listener_https x-request-id c7138938-00e1-4473-9ce7-b4671c8019e5 Server cloudflare X-Trace 2BD3B7000AB92DB0376587F2AE29F225663CD7F3CA000000000000000000 Vary origin Access-Control-Allow-Methods OPTIONS, GET Content-Type application/json;charset=utf-8 Access-Control-Allow-Origin https://www.group-ib.com x-evy-trace-virtual-host all Access-Control-Expose-Headers X-Origin-Hublet Access-Control-Max-Age 180 Access-Control-Allow-Credentials false Cache-Control max-age=0, no-cache, no-store X-Robots-Tag none Access-Control-Allow-Headers * CF-RAY 8182d4a1bbf22bc7-FRA x-evy-trace-served-by-pod fra04/star-hubspot-td/envoy-proxy-5cdd94655b-9hfk8
GET H2	200	tag.js Show response mc.yandex.ru/metrika/	202 KB 70 KB	244ms 116ms	Script application/javascript	2a02:6b8::1:119 GLOBAL_DC
General Check archive.org Show headers Download Go to Full URL https://mc.yandex.ru/metrika/tag.js Requested by Host: website.cdn.group-ib.com URL: https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/js/main.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:6b8::1:119 Ulyanovsk, Russian Federation, ASN208722 (GLOBAL_DC, FI), Reverse DNS Software / Resource Hash e9597987b6f5f6a1e2c0a9bb76f9728ad3bda5548c3b1341dac1e7708c18ee7e Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers date Wed, 18 Oct 2023 18:26:36 GMT content-encoding br strict-transport-security max-age=31536000 last-modified Tue, 17 Oct 2023 09:59:45 GMT accept-ch Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA etag "652e5b11-11470" content-type application/javascript access-control-allow-origin * cache-control max-age=3600 timing-allow-origin * content-length 70768 expires Wed, 18 Oct 2023 19:26:36 GMT
GET H/1.1	200 OK	counters.gif forms.hsforms.com/embed/v3/	35 B 1016 B	156ms 136ms	Image image/gif	2606:4700::6811:cff9 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://forms.hsforms.com/embed/v3/counters.gif?key=forms-embed-v2-DEFINITION_SUCCESS&count=1 Requested by Host: www.group-ib.com URL: https://www.group-ib.com/media-center/press-releases/phishing-kits-2022/ Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6811:cff9 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers Date Wed, 18 Oct 2023 18:26:36 GMT Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff CF-Cache-Status DYNAMIC x-evy-trace-route-service-name envoyset-translator X-HubSpot-Correlation-Id 6e6851a1-d903-4e9e-a5ee-b5ebe13de393 x-envoy-upstream-service-time 11 Connection keep-alive alt-svc h3=":443"; ma=86400 Content-Length 35 x-evy-trace-route-configuration listener_https/all x-evy-trace-listener listener_https x-request-id 6e6851a1-d903-4e9e-a5ee-b5ebe13de393 Server cloudflare X-Trace 2BA317CFC17103FD75014E4CD36EA54D84B455E603000000000000000000 Vary origin Content-Type image/gif x-evy-trace-virtual-host all x-evy-trace-served-by-pod iad02/star-hubspot-td/envoy-proxy-79986f96f-97dlb Access-Control-Expose-Headers X-Origin-Hublet Cache-Control max-age=0, no-cache, no-store Access-Control-Allow-Credentials false X-Robots-Tag none CF-RAY 8182d4a27b852bf2-FRA
GET H2	200	telegram-64.svg website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/socials/	1 KB 2 KB	26ms 23ms	Image image/svg+xml	2600:9000:238d:4a00:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/socials/telegram-64.svg Requested by Host: website.cdn.group-ib.com URL: https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-press-release.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:238d:4a00:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash cdc4d10b6b74ad79b55333b9882e854f054ee8b9953c6203dc46c68dc74eb0fb Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-press-release.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; content-encoding gzip x-content-type-options nosniff strict-transport-security max-age=31536000; includeSubDomains via 1.1 74511018c757716e70d811d8214e45e0.cloudfront.net (CloudFront) date Wed, 18 Oct 2023 18:26:36 GMT x-amz-cf-pop AMS1-P1 x-cache Hit from cloudfront content-length 787 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Tue, 29 Nov 2022 07:39:21 GMT server nginx etag "5fc-5ee9716179e8a-gzip" x-frame-options sameorigin vary Accept-Encoding content-type image/svg+xml access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id En1RW99jD_O5PtePdcS7Wj7ZNq1wAJziZD9B24NuZLIIKAQtUp6rSw== expires Wed, 18 Oct 2023 18:56:36 GMT
GET H2	200	telegram-blue.svg website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/socials/	1 KB 2 KB	27ms 24ms	Image image/svg+xml	2600:9000:238d:4a00:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/socials/telegram-blue.svg Requested by Host: website.cdn.group-ib.com URL: https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-press-release.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:238d:4a00:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash f134669d195076302131981e5fbcff6cf42dc48f5642c1a8e392862f7b4ca412 Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-press-release.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; content-encoding gzip x-content-type-options nosniff strict-transport-security max-age=31536000; includeSubDomains via 1.1 74511018c757716e70d811d8214e45e0.cloudfront.net (CloudFront) date Wed, 18 Oct 2023 18:26:36 GMT x-amz-cf-pop AMS1-P1 x-cache Hit from cloudfront content-length 792 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Tue, 29 Nov 2022 07:39:21 GMT server nginx etag W/"5fb-5ee9716179e8a-gzip" x-frame-options sameorigin vary Accept-Encoding content-type image/svg+xml access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id 6H4OLyxM-XuIWJ5GO-HlvWfaM4eDk9PZhq24xPQE3cCPXEanCZj2tw== expires Wed, 18 Oct 2023 18:56:36 GMT
GET H2	200	twitter-64.svg website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/socials/	1 KB 2 KB	38ms 36ms	Image image/svg+xml	2600:9000:238d:4a00:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/socials/twitter-64.svg Requested by Host: website.cdn.group-ib.com URL: https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-press-release.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:238d:4a00:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software cloudflare / Resource Hash ae9dad69229703dfa3b6d226c4c7d692e2f2809bf2475f22612824c2f7602efc Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-press-release.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers strict-transport-security max-age=31536000; includeSubDomains content-security-policy frame-ancestors 'self'; x-content-type-options nosniff cf-cache-status BYPASS nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} date Wed, 18 Oct 2023 18:26:36 GMT content-encoding br x-amz-cf-pop AMS1-P1 via 1.1 74511018c757716e70d811d8214e45e0.cloudfront.net (CloudFront) x-cache Hit from cloudfront x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Tue, 29 Nov 2022 07:39:21 GMT server cloudflare etag W/"426-5ee9716179e8a-gzip" x-frame-options sameorigin report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=3h%2Fu7ZtUr3fbbcl8qzrDo8EbSYnXoIimzBu%2BKCLI0kxR8OfIVMrn9COSFbmzH8gAZFeUPIVFKWM2L7NEiyZc09%2F2ZC7aQqJ4LHHngzMRxGfFUtGU3WZa2FTmr92fP59b1Us%3D"}],"group":"cf-nel","max_age":604800} content-type image/svg+xml access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() vary Accept-Encoding cf-ray 814489b50e613804-FRA x-amz-cf-id dQL8upYtYR1UvXsycM__DAM_Cl6sQz_u6-jKX9bOlCglDvq7cxZYMA== expires Wed, 18 Oct 2023 18:56:36 GMT
GET H2	200	twitter-blue.svg website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/socials/	1 KB 1 KB	34ms 33ms	Image image/svg+xml	2600:9000:238d:4a00:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/socials/twitter-blue.svg Requested by Host: website.cdn.group-ib.com URL: https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-press-release.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:238d:4a00:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash 811a0ac7da35a5fd342022f6587eec2f5ad3aa69dfdb05a7cea5224030617507 Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-press-release.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; content-encoding gzip x-content-type-options nosniff strict-transport-security max-age=31536000; includeSubDomains via 1.1 74511018c757716e70d811d8214e45e0.cloudfront.net (CloudFront) date Wed, 18 Oct 2023 18:26:36 GMT x-amz-cf-pop AMS1-P1 x-cache Hit from cloudfront content-length 556 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Tue, 29 Nov 2022 07:39:21 GMT server nginx etag W/"426-5ee9716179e8a-gzip" x-frame-options sameorigin vary Accept-Encoding content-type image/svg+xml access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id y5aM3e6UtEAcckLm-K5D7-pfqsdwtgQBLhiFbQnHIn2u4pEHvKpFJA== expires Wed, 18 Oct 2023 18:56:36 GMT
GET H2	200	linkedin-64.svg website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/socials/	919 B 2 KB	41ms 39ms	Image image/svg+xml	2600:9000:238d:4a00:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/socials/linkedin-64.svg Requested by Host: website.cdn.group-ib.com URL: https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-press-release.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:238d:4a00:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software cloudflare / Resource Hash f4991587d5312981e74087707ed399bd3820d83f773e7773c013ce00d6835f28 Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-press-release.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers strict-transport-security max-age=31536000; includeSubDomains content-security-policy frame-ancestors 'self'; x-content-type-options nosniff cf-cache-status BYPASS nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} date Wed, 18 Oct 2023 18:26:36 GMT content-encoding br x-amz-cf-pop AMS1-P1 via 1.1 74511018c757716e70d811d8214e45e0.cloudfront.net (CloudFront) x-cache Hit from cloudfront x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Tue, 29 Nov 2022 07:39:21 GMT server cloudflare etag W/"397-5ee9716179e8a-gzip" x-frame-options sameorigin report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=GK5ibWO%2BC1oavPJyfeDWTV06OqLuSEUh%2BBomal6ENGVGUTgY7WPEyVcEqAvw0IEP73ZLbuPeg2aj8RR6ol6dhRJ0GQrv1t1vWHn15jl7455BkGE8%2BNYB3JlbAO73xl1wZ00%3D"}],"group":"cf-nel","max_age":604800} content-type image/svg+xml access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() vary Accept-Encoding cf-ray 814489b50fc337ef-FRA x-amz-cf-id pfyn4X1APrMi9kJDQjIVfFObeRhmhAUnZcHs4rlW9q8zoqxX9L_IRA== expires Wed, 18 Oct 2023 18:56:36 GMT
GET H2	200	linkedin-blue.svg website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/socials/	919 B 1 KB	42ms 41ms	Image image/svg+xml	2600:9000:238d:4a00:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/socials/linkedin-blue.svg Requested by Host: website.cdn.group-ib.com URL: https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-press-release.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:238d:4a00:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash dbc32b11b85805050a7fbd85361a52e9c84a34cff6fa03d7d764b190c75fefe3 Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-press-release.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; content-encoding gzip x-content-type-options nosniff strict-transport-security max-age=31536000; includeSubDomains via 1.1 74511018c757716e70d811d8214e45e0.cloudfront.net (CloudFront) date Wed, 18 Oct 2023 18:26:36 GMT x-amz-cf-pop AMS1-P1 x-cache Hit from cloudfront content-length 470 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Tue, 29 Nov 2022 07:39:21 GMT server nginx etag W/"397-5ee9716179e8a-gzip" x-frame-options sameorigin vary Accept-Encoding content-type image/svg+xml access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id smeikLD3KoQsaqM2eEIhsPLGHtViZPEpvT0lsNiT5ChoqyTraJ_Frw== expires Wed, 18 Oct 2023 18:56:36 GMT
GET H2	200	whatsapp-64.svg website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/socials/	2 KB 2 KB	46ms 45ms	Image image/svg+xml	2600:9000:238d:4a00:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/socials/whatsapp-64.svg Requested by Host: website.cdn.group-ib.com URL: https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-press-release.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:238d:4a00:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash 45d44c2f23a04d49dbbb3f216ba72782ad80278cf7c4c330b1f03b8263c544ee Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-press-release.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; content-encoding gzip x-content-type-options nosniff strict-transport-security max-age=31536000; includeSubDomains via 1.1 74511018c757716e70d811d8214e45e0.cloudfront.net (CloudFront) date Wed, 18 Oct 2023 18:26:36 GMT x-amz-cf-pop AMS1-P1 x-cache Hit from cloudfront content-length 1046 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Tue, 29 Nov 2022 07:39:21 GMT server nginx etag W/"7e8-5ee9716179e8a-gzip" x-frame-options sameorigin vary Accept-Encoding content-type image/svg+xml access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id 4Z2D85lQk9LPjgmJeviJRFNaSLkZCXWbeKfpDGV5vo-smzDpS243yw== expires Wed, 18 Oct 2023 18:56:36 GMT
GET H2	200	whatsapp-blue.svg website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/socials/	2 KB 2 KB	45ms 43ms	Image image/svg+xml	2600:9000:238d:4a00:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/socials/whatsapp-blue.svg Requested by Host: website.cdn.group-ib.com URL: https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-press-release.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:238d:4a00:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash d3689b014c0ffdfe6c70af7141a0d708166ba120d136838de16b50a7394947a9 Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-press-release.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; content-encoding gzip x-content-type-options nosniff strict-transport-security max-age=31536000; includeSubDomains via 1.1 74511018c757716e70d811d8214e45e0.cloudfront.net (CloudFront) date Wed, 18 Oct 2023 18:26:36 GMT x-amz-cf-pop AMS1-P1 x-cache Hit from cloudfront content-length 1047 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Tue, 29 Nov 2022 07:39:21 GMT server nginx etag W/"7e7-5ee9716179e8a-gzip" x-frame-options sameorigin vary Accept-Encoding content-type image/svg+xml access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id ah5RqCfW6gdOwE6fPsovCbwgA6eD9lfOS764CKjNuwwdz_ith460UA== expires Wed, 18 Oct 2023 18:56:36 GMT
GET H2	200	main-logo.svg www.group-ib.com/wp-content/themes/gib-theme/assets/images/	3 KB 2 KB	22ms 16ms	Image image/svg+xml	3.72.181.255 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://www.group-ib.com/wp-content/themes/gib-theme/assets/images/main-logo.svg Requested by Host: www.group-ib.com URL: https://www.group-ib.com/media-center/press-releases/phishing-kits-2022/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 3.72.181.255 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-3-72-181-255.eu-central-1.compute.amazonaws.com Software nginx / Resource Hash 589c9a6a159cf2ecc8555bc4457827f21002eaec9a24e3bc54401ed0b4d30ac8 Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/media-center/press-releases/phishing-kits-2022/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; content-encoding gzip x-content-type-options nosniff date Wed, 18 Oct 2023 18:26:36 GMT strict-transport-security max-age=31536000; includeSubDomains content-length 1527 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Mon, 30 Jan 2023 11:16:06 GMT server nginx etag "d82-5f379576be685-gzip" vary Accept-Encoding x-frame-options sameorigin content-type image/svg+xml access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes expires Wed, 18 Oct 2023 18:56:36 GMT
GET H2	200	ti.png website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/main-nav/	6 KB 7 KB	25ms 20ms	Image image/png	2600:9000:238d:4a00:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/main-nav/ti.png Requested by Host: www.group-ib.com URL: https://www.group-ib.com/media-center/press-releases/phishing-kits-2022/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:238d:4a00:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash f0e3a799744c0c67782742af2c13b85f769b58abd04800a04853d26f60cf7314 Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; strict-transport-security max-age=31536000; includeSubDomains x-content-type-options nosniff date Wed, 18 Oct 2023 18:26:36 GMT via 1.1 74511018c757716e70d811d8214e45e0.cloudfront.net (CloudFront) x-amz-cf-pop AMS1-P1 x-cache Hit from cloudfront content-length 5919 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Tue, 28 Jun 2022 07:55:26 GMT server nginx etag "171f-5e27d5c025780" x-frame-options sameorigin vary Accept-Encoding content-type image/png access-control-allow-origin https://www.group-ib.com cache-control no-cache, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id nhHNx3zjFpqr8DwU9_QRnh8d6v0FXiHQ4eQlrCWLnzWpVNTCRCzCaA== expires Wed, 18 Oct 2023 18:26:35 GMT
GET H2	200	asm.png website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/main-nav/	6 KB 7 KB	26ms 21ms	Image image/png	2600:9000:238d:4a00:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/main-nav/asm.png Requested by Host: www.group-ib.com URL: https://www.group-ib.com/media-center/press-releases/phishing-kits-2022/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:238d:4a00:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash 997d49d316b533985208f14602a1ff15a76bf6a567afbb6b6980629ca8d78bab Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; strict-transport-security max-age=31536000; includeSubDomains x-content-type-options nosniff date Wed, 18 Oct 2023 18:26:36 GMT via 1.1 74511018c757716e70d811d8214e45e0.cloudfront.net (CloudFront) x-amz-cf-pop AMS1-P1 x-cache Hit from cloudfront content-length 5941 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Tue, 28 Jun 2022 07:55:26 GMT server nginx etag "1735-5e27d5c025780" x-frame-options sameorigin vary Accept-Encoding content-type image/png access-control-allow-origin https://www.group-ib.com cache-control no-cache, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id WJXwu5I8KOSLepSUTGU21ZbyLtTdrZtncHQW4aRjAm12WZDLRc14HA== expires Wed, 18 Oct 2023 18:26:35 GMT
GET H2	200	fp.png website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/main-nav/	8 KB 8 KB	26ms 21ms	Image image/png	2600:9000:238d:4a00:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/main-nav/fp.png Requested by Host: www.group-ib.com URL: https://www.group-ib.com/media-center/press-releases/phishing-kits-2022/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:238d:4a00:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash 15534f98c260c3c3caaedf53335d912010b2de1731477a9fd4dbea89fb4995d9 Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; strict-transport-security max-age=31536000; includeSubDomains x-content-type-options nosniff date Wed, 18 Oct 2023 18:26:36 GMT via 1.1 74511018c757716e70d811d8214e45e0.cloudfront.net (CloudFront) x-amz-cf-pop AMS1-P1 x-cache Hit from cloudfront content-length 7844 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Tue, 28 Jun 2022 07:55:26 GMT server nginx etag "1ea4-5e27d5c025780" x-frame-options sameorigin vary Accept-Encoding content-type image/png access-control-allow-origin https://www.group-ib.com cache-control no-cache, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id 9z0RlJpabPXLXTaSgx3OkC1MMVv_ZvTOAz_Dd594PRhrVjz33qKnfQ== expires Wed, 18 Oct 2023 18:26:35 GMT
GET H2	200	drp.png website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/main-nav/	5 KB 6 KB	28ms 23ms	Image image/png	2600:9000:238d:4a00:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/main-nav/drp.png Requested by Host: www.group-ib.com URL: https://www.group-ib.com/media-center/press-releases/phishing-kits-2022/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:238d:4a00:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software cloudflare / Resource Hash a300a894e169169882504968fae71958a87e0a4322e2aee1b6b0bbd63fd9621f Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers strict-transport-security max-age=31536000; includeSubDomains content-security-policy frame-ancestors 'self'; x-content-type-options nosniff cf-cache-status BYPASS nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} date Wed, 18 Oct 2023 18:26:36 GMT via 1.1 74511018c757716e70d811d8214e45e0.cloudfront.net (CloudFront) x-amz-cf-pop AMS1-P1 x-cache Hit from cloudfront content-length 5398 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Tue, 28 Jun 2022 07:55:26 GMT server cloudflare etag "1516-5e27d5c025780" x-frame-options sameorigin report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=QsUJdnIkDxAOWGpHksoXVH71v7T6HHIQUTnn6kXnY2r%2F2lheyBA5hgvu0rvlGk36y5C3tHzKZZ%2BjSt2OiL1llrNHOqY5gfzllbLpsOBm7%2BUsgEY0Cg%2FUqUK5H4a5kCDtuH4%3D"}],"group":"cf-nel","max_age":604800} content-type image/png access-control-allow-origin https://www.group-ib.com cache-control no-cache, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() vary Accept-Encoding accept-ranges bytes cf-ray 8144bbcdbaa0693d-FRA x-amz-cf-id 9jySfQVxbTqDptaXn_lepdihYn6H6QLlfVdNbCPFvMtdBvveUUE9cg== expires Wed, 18 Oct 2023 18:26:35 GMT
GET H2	200	mxdr.png website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/main-nav/	6 KB 7 KB	76ms 72ms	Image image/png	2600:9000:238d:4a00:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/main-nav/mxdr.png Requested by Host: www.group-ib.com URL: https://www.group-ib.com/media-center/press-releases/phishing-kits-2022/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:238d:4a00:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash 2be8ce2b065360537771ed230d5d72cbd84758ec127ffa035e6d260ed14af5b0 Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; strict-transport-security max-age=31536000; includeSubDomains x-content-type-options nosniff date Wed, 18 Oct 2023 18:26:36 GMT via 1.1 74511018c757716e70d811d8214e45e0.cloudfront.net (CloudFront) x-amz-cf-pop AMS1-P1 x-cache Hit from cloudfront content-length 6506 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Tue, 28 Jun 2022 07:55:26 GMT server nginx etag "196a-5e27d5c025780" x-frame-options sameorigin vary Accept-Encoding content-type image/png access-control-allow-origin https://www.group-ib.com cache-control no-cache, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id ghoisz01OlGKpg6RmnYw4SX8RqOqyokAj6RE5SpPt9h8l6oNREkqLg== expires Wed, 18 Oct 2023 18:26:35 GMT
GET H2	200	bep.png website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/main-nav/	6 KB 7 KB	31ms 28ms	Image image/png	2600:9000:238d:4a00:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/main-nav/bep.png Requested by Host: www.group-ib.com URL: https://www.group-ib.com/media-center/press-releases/phishing-kits-2022/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:238d:4a00:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash 7574ba97d4ee7e81bd60873a52a31ff13359f246d0ac492ef2dabf96233a99e6 Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; strict-transport-security max-age=31536000; includeSubDomains x-content-type-options nosniff date Wed, 18 Oct 2023 18:26:36 GMT via 1.1 74511018c757716e70d811d8214e45e0.cloudfront.net (CloudFront) x-amz-cf-pop AMS1-P1 x-cache Hit from cloudfront content-length 6362 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Tue, 28 Jun 2022 07:55:26 GMT server nginx etag "18da-5e27d5c025780" x-frame-options sameorigin vary Accept-Encoding content-type image/png access-control-allow-origin https://www.group-ib.com cache-control no-cache, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id 4vC2jDIKquddrR3aPPIrp-aySrx8ggBYLKxOPjFW6XwZOC-g-gq8Rw== expires Wed, 18 Oct 2023 18:26:35 GMT
GET H2	200	blog1-9-min.png website.cdn.group-ib.com/wp-content/uploads/	716 KB 717 KB	49ms 46ms	Image image/png	2600:9000:238d:4a00:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://website.cdn.group-ib.com/wp-content/uploads/blog1-9-min.png Requested by Host: www.group-ib.com URL: https://www.group-ib.com/media-center/press-releases/phishing-kits-2022/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:238d:4a00:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash acfe9b50dd8005d4a757810c1c48ea6a41b7ac8f4a9d74400d3aa22e0593ee9c Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; strict-transport-security max-age=31536000; includeSubDomains x-content-type-options nosniff date Wed, 18 Oct 2023 18:26:36 GMT via 1.1 74511018c757716e70d811d8214e45e0.cloudfront.net (CloudFront) x-amz-cf-pop AMS1-P1 x-cache RefreshHit from cloudfront content-length 732950 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Wed, 24 May 2023 11:34:06 GMT server nginx etag "b2f16-5fc6ee1b3d501" x-frame-options sameorigin vary Accept-Encoding content-type image/png access-control-allow-origin https://www.group-ib.com cache-control no-cache, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id IySBwevNg67vVhVDCTl15eLOPtRt_5BMkm5KfOyWRPFUB-fcQw0gjg== expires Wed, 18 Oct 2023 18:26:35 GMT
GET H2	200	evolution-of-phishing-kits-in-2022_group-ib-min.png website.cdn.group-ib.com/wp-content/uploads/	240 KB 241 KB	37ms 34ms	Image image/png	2600:9000:238d:4a00:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://website.cdn.group-ib.com/wp-content/uploads/evolution-of-phishing-kits-in-2022_group-ib-min.png Requested by Host: www.group-ib.com URL: https://www.group-ib.com/media-center/press-releases/phishing-kits-2022/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:238d:4a00:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash 06e8729365301cd2abb3b9b7cdb2316965b5ee42a0558b1e127ccacd08e83ac0 Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; strict-transport-security max-age=31536000; includeSubDomains x-content-type-options nosniff date Wed, 18 Oct 2023 18:26:36 GMT via 1.1 74511018c757716e70d811d8214e45e0.cloudfront.net (CloudFront) x-amz-cf-pop AMS1-P1 x-cache RefreshHit from cloudfront content-length 245447 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Wed, 24 May 2023 11:34:13 GMT server nginx etag "3bec7-5fc6ee2186b84" x-frame-options sameorigin vary Accept-Encoding content-type image/png access-control-allow-origin https://www.group-ib.com cache-control no-cache, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id KvrW1pIoMHm2nS85KwGnBcOcNkVwAaUq1X-eg-iVN1KI4AaQVtKlQA== expires Wed, 18 Oct 2023 18:26:35 GMT
GET H/1.1	200 OK	counters.gif forms-eu1.hsforms.com/embed/v3/	35 B 1016 B	47ms 28ms	Image image/gif	172.65.232.43 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://forms-eu1.hsforms.com/embed/v3/counters.gif?key=forms-embed-v2-RENDER_SUCCESS&count=1 Requested by Host: www.group-ib.com URL: https://www.group-ib.com/media-center/press-releases/phishing-kits-2022/ Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 172.65.232.43 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers Date Wed, 18 Oct 2023 18:26:36 GMT Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff CF-Cache-Status DYNAMIC x-evy-trace-route-service-name envoyset-translator X-HubSpot-Correlation-Id 758c7f6b-ff37-4c45-80bf-340da9e96671 x-envoy-upstream-service-time 2 Connection keep-alive alt-svc h3=":443"; ma=86400 Content-Length 35 x-evy-trace-route-configuration listener_https/all x-evy-trace-listener listener_https x-request-id 758c7f6b-ff37-4c45-80bf-340da9e96671 Server cloudflare X-Trace 2B69B976B035AD33B5AAEDFD8A0BBC2897AAEA9A92000000000000000000 Vary origin Content-Type image/gif x-evy-trace-virtual-host all x-evy-trace-served-by-pod fra04/star-hubspot-td/envoy-proxy-5cdd94655b-5tsjd Access-Control-Expose-Headers X-Origin-Hublet Cache-Control max-age=0, no-cache, no-store Access-Control-Allow-Credentials false X-Robots-Tag none CF-RAY 8182d4a43a1e365c-FRA
GET H2	200	collect px.ads.linkedin.com/	0 532 B	172ms 151ms	Image application/javascript	2620:1ec:21::14 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Show image Full URL https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=&time=1697653596841&url=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fphishing-kits-2022%2F Requested by Host: www.group-ib.com URL: https://www.group-ib.com/media-center/press-releases/phishing-kits-2022/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2620:1ec:21::14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers date Wed, 18 Oct 2023 18:26:36 GMT x-li-pop afd-prod-ltx1-x x-msedge-ref Ref A: 51BC0F9581074019B3D3E1CDA5FF5C09 Ref B: FRAEDGE1217 Ref C: 2023-10-18T18:26:36Z linkedin-action 1 x-cache CONFIG_NOCACHE content-type application/javascript x-li-fabric prod-ltx1 x-li-proto http/2 content-length 0 x-li-uuid AAYIAceYyPNy4wLvThU1sg==
GET H2	200	json Show response api-eu1.hubapi.com/hs-script-loader-public/v1/config/pixels-and-events/	250 B 1 KB	54ms 30ms	XHR application/json	2a06:98c1:3200::90:3 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://api-eu1.hubapi.com/hs-script-loader-public/v1/config/pixels-and-events/json?portalId=25755956 Requested by Host: fhp-de-js.group-ib.com URL: https://fhp-de-js.group-ib.com/d/bt-autoinject.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a06:98c1:3200::90:3 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 1aa462865a143f6b053d5d1594aea3e38d36ebad2a23a7fcfdd84ba7a7a1fddb Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers date Wed, 18 Oct 2023 18:26:36 GMT strict-transport-security max-age=31536000; includeSubDomains; preload x-content-type-options nosniff cf-cache-status DYNAMIC nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} x-evy-trace-route-service-name envoyset-translator x-hubspot-correlation-id 3f14ce52-6ffe-4874-b337-e4749c039a47 content-encoding br x-envoy-upstream-service-time 3 x-evy-trace-route-configuration listener_https/all x-evy-trace-listener listener_https x-request-id 3f14ce52-6ffe-4874-b337-e4749c039a47 server cloudflare x-trace 2BBE3158098275C7C63B0CA5E6A7239AF23050B1BC000000000000000000 vary origin access-control-allow-methods GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD content-type application/json;charset=utf-8 access-control-allow-origin https://www.group-ib.com x-evy-trace-virtual-host all access-control-max-age 180 access-control-allow-credentials false x-evy-trace-served-by-pod fra04/hubapi-td/envoy-proxy-86f46d6c7b-xgfs4 report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=BObV6%2B4%2B66JZ2JymeYHjd7mfa3iHTP%2BllgD4KMMBNWgTd02rMSRiIYl6Ec6Dl%2FtjfDOaAjifU8os5bJrkZINSOav99h%2BIkAZSEEANfS4ddtTz0DDH5iAvSFc6Y8uJG9QzZouPhReI%2BfeeCD3BZ9fqg%3D%3D"}],"group":"cf-nel","max_age":604800} cf-ray 8182d4a4bfd22c3d-FRA access-control-allow-headers *
GET H/1.1	200 OK	counters.gif forms-eu1.hsforms.com/embed/v3/	35 B 1016 B	31ms 31ms	Image image/gif	172.65.232.43 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://forms-eu1.hsforms.com/embed/v3/counters.gif?key=forms-embed-v2-RENDER_SUCCESS&count=1 Requested by Host: js-eu1.hsforms.net URL: https://js-eu1.hsforms.net/forms/v2.js Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 172.65.232.43 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers Date Wed, 18 Oct 2023 18:26:36 GMT Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff CF-Cache-Status DYNAMIC x-evy-trace-route-service-name envoyset-translator X-HubSpot-Correlation-Id 4d786d35-bf7a-40c5-8bc3-de0d00bcae24 x-envoy-upstream-service-time 1 Connection keep-alive alt-svc h3=":443"; ma=86400 Content-Length 35 x-evy-trace-route-configuration listener_https/all x-evy-trace-listener listener_https x-request-id 4d786d35-bf7a-40c5-8bc3-de0d00bcae24 Server cloudflare X-Trace 2BAB7D363E02B8C819F2B5B840941C8020FAB0DEEC000000000000000000 Vary origin Content-Type image/gif x-evy-trace-virtual-host all x-evy-trace-served-by-pod fra04/star-hubspot-td/envoy-proxy-5cdd94655b-9hfk8 Access-Control-Expose-Headers X-Origin-Hublet Cache-Control max-age=0, no-cache, no-store Access-Control-Allow-Credentials false X-Robots-Tag none CF-RAY 8182d4a4aabc365c-FRA
GET H2	200	json Show response forms-eu1.hscollectedforms.net/collected-forms/v1/config/	116 B 410 B	33ms 31ms	XHR application/json	172.65.192.122 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://forms-eu1.hscollectedforms.net/collected-forms/v1/config/json?portalId=25755956&utk= Requested by Host: fhp-de-js.group-ib.com URL: https://fhp-de-js.group-ib.com/d/bt-autoinject.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.65.192.122 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 43f22362329b9705cf8629061fb5b1d1a38f1cc2bc9fd46728f73e5cd9eb77cf Security Headers Name Value X-Content-Type-Options nosniff Request headers Accept application/json, text/plain, */* Referer https://www.group-ib.com/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers date Wed, 18 Oct 2023 18:26:36 GMT content-encoding br x-content-type-options nosniff cf-cache-status DYNAMIC x-evy-trace-route-service-name envoyset-translator x-hubspot-correlation-id a530ac66-7cbc-4eea-a451-2922d4d26c39 x-envoy-upstream-service-time 5 x-evy-trace-route-configuration listener_https/all x-evy-trace-listener listener_https x-request-id a530ac66-7cbc-4eea-a451-2922d4d26c39 server cloudflare vary Accept-Encoding access-control-allow-methods GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD content-type application/json;charset=utf-8 access-control-allow-origin https://www.group-ib.com x-evy-trace-virtual-host all cache-control max-age=0 x-evy-trace-served-by-pod fra04/app-td/envoy-proxy-797758f45b-8q8m9 access-control-max-age 180 x-robots-tag none access-control-allow-headers * cf-ray 8182d4a4eca91e14-FRA
GET H2	200	6si.min.js Show response j.6sc.co/	60 KB 16 KB	47ms 5ms	Script application/javascript	2.16.241.88 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://j.6sc.co/6si.min.js Requested by Host: www.group-ib.com URL: https://www.group-ib.com/media-center/press-releases/phishing-kits-2022/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2.16.241.88 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS a2-16-241-88.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash e8a99c16a581c4e69330699d00aa4a7763158ed99194087bceebd232d53eb42f Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers pragma no-cache date Wed, 18 Oct 2023 18:26:37 GMT content-encoding gzip x-content-type-options nosniff last-modified Tue, 17 Oct 2023 19:14:48 GMT server nginx/1.14.0 (Ubuntu) etag "652edd28-f1f8" vary Accept-Encoding content-type application/javascript cache-control private, no-cache, proxy-revalidate accept-ranges bytes content-length 16484 expires Wed, 18 Oct 2023 18:26:37 GMT
GET H2	200	/ Show response googleads.g.doubleclick.net/pagead/viewthroughconversion/10897073384/	3 KB 2 KB	144ms 108ms	Script text/javascript	2a00:1450:4001:810::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://googleads.g.doubleclick.net/pagead/viewthroughconversion/10897073384/?random=1697653596964&cv=11&fst=1697653596964&bg=ffffff&guid=ON&async=1&gtm=45He3ag0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fphishing-kits-2022%2F&ref=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fphishing-kits-2022%2F&hn=www.googleadservices.com&frm=0&tiba=Group-IB%3A%20the%20use%20of%20phishing%20kits%20surges%20by%2025%25%20in%202022%20as%20they%20become%20more%20evasive%20and%20advanced%20%7C%20Group-IB&auid=1614929152.1697653597&uamb=0&uaw=0&rfmt=3&fmt=4 Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-PW7265 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash 4f3a915090d6de6d2bfb942d0bb84499c671370959c401ead600cacc22a61272 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers pragma no-cache date Wed, 18 Oct 2023 18:26:37 GMT content-encoding br x-content-type-options nosniff server cafe content-type text/javascript; charset=UTF-8 p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" cache-control no-cache, must-revalidate cross-origin-resource-policy cross-origin content-disposition attachment; filename="f.txt" timing-allow-origin * alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 1408 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	pixel.js Show response www.redditstatic.com/ads/	23 KB 8 KB	38ms 7ms	Script application/javascript	2a04:4e42:200::396 FASTLY
General Check archive.org Show headers Download Go to Full URL https://www.redditstatic.com/ads/pixel.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-PW7265 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:200::396 , United States, ASN54113 (FASTLY, US), Reverse DNS Software snooserv / Resource Hash e803e774c7b59fe74f71ed93acaa875cf9a99947ff8ed7615cd0c93c1667250f Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers date Wed, 18 Oct 2023 18:26:37 GMT content-encoding gzip via 1.1 varnish, 1.1 varnish last-modified Thu, 15 Jun 2023 20:49:59 GMT server snooserv nel {"report_to": "w3-reporting-nel", "max_age": 14400, "include_subdomains": false, "success_fraction": 0.02, "failure_fraction": 0.02} etag "4a205643a240cb95fa82289d62b5af7e" x-amz-server-side-encryption AES256 vary Accept-Encoding,Origin report-to {"group": "w3-reporting-nel", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-nel.reddit.com/reports" }]}, {"group": "w3-reporting", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting.reddit.com/reports" }]}, {"group": "w3-reporting-csp", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-csp.reddit.com/reports" }]} content-type application/javascript cache-control public, max-age=60 accept-ranges bytes content-length 7409
GET H2	200	NeverBounce.js Show response cdn.neverbounce.com/widget/dist/	96 KB 29 KB	74ms 15ms	Script application/javascript	18.239.18.83 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://cdn.neverbounce.com/widget/dist/NeverBounce.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-PW7265 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.239.18.83 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-18-239-18-83.ams58.r.cloudfront.net Software AmazonS3 / Resource Hash c99d11cb4960d6e1918ed55d5bcbb316d38b51098e2efc1201904d7274d3273e Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers date Wed, 18 Oct 2023 03:31:41 GMT content-encoding gzip via 1.1 c26e94322027d14813c3c25e1b340274.cloudfront.net (CloudFront) last-modified Mon, 02 Mar 2020 18:37:33 GMT server AmazonS3 x-amz-cf-pop AMS58-P6 age 53703 etag W/"c1e06621030dfcba15b88abbcaa546eb" vary Accept-Encoding x-cache Hit from cloudfront content-type application/javascript x-amz-cf-id pJPcW_Ju8cJaMDiMWt0I_our2OyOEk8i2_Xh2K3bBqkzQrH97by0qw==
GET H2	200	63e267f61a03d71ea3df5fe7 Show response ws.zoominfo.com/pixel/	3 KB 2 KB	287ms 258ms	Script text/javascript	2606:4700::6810:880f CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://ws.zoominfo.com/pixel/63e267f61a03d71ea3df5fe7 Requested by Host: www.group-ib.com URL: https://www.group-ib.com/media-center/press-releases/phishing-kits-2022/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6810:880f , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Express Resource Hash 8348281affaf8e511cb8243be3db018290f896890baa11395f368a0ab12232b3 Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/media-center/press-releases/phishing-kits-2022/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers date Wed, 18 Oct 2023 18:26:37 GMT content-encoding gzip x-content-type-options nosniff cf-cache-status DYNAMIC via 1.1 google server cloudflare x-powered-by Express vary Accept-Encoding content-type text/javascript access-control-allow-origin * access-control-allow-credentials true cf-ray 8182d4a5583b2c49-FRA access-control-allow-headers Content-Type,cf-ipcountry,service-version,x-appengine-user-ip,x-forwarded-for, x-ws-collect-type,requestFromZITag,unifiedScriptVerified,_zitok,_vtok alt-svc h3=":443"; ma=86400
GET H2	200	fbevents.js Show response connect.facebook.net/en_US/	198 KB 53 KB	36ms 8ms	Script application/x-javascript	2a03:2880:f084:105:face:b00c:0:3 FACEBOOK
General Check archive.org Show headers Download Go to Full URL https://connect.facebook.net/en_US/fbevents.js Requested by Host: www.group-ib.com URL: https://www.group-ib.com/media-center/press-releases/phishing-kits-2022/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a03:2880:f084:105:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US), Reverse DNS Software / Resource Hash 564a53ce84ae022b30816d44aa48589ebfe170c226b098d0245c47fe13341c67 Security Headers Name Value Content-Security-Policy default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script'; Strict-Transport-Security max-age=31536000; preload; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers content-security-policy default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script'; content-encoding gzip x-content-type-options nosniff strict-transport-security max-age=31536000; preload; includeSubDomains date Wed, 18 Oct 2023 18:26:37 GMT document-policy force-load-at-top cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400 content-length 53498 x-xss-protection 0 pragma public x-fb-debug VJjYrNYDfyeNeuK6SKpOdz5rjd+2Y9hgmrQJdDiEb+Ylb67EqpQCuw+Vxw9APtHFPahEUD2ID39oSMwc/+nT8Q== cross-origin-opener-policy same-origin-allow-popups vary Accept-Encoding x-frame-options DENY content-type application/x-javascript; charset=utf-8 cache-control public, max-age=1200 permissions-policy accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(), gyroscope=(), hid=(), idle-detection=(), magnetometer=(), microphone=(), midi=(), payment=(), screen-wake-lock=(), serial=(), usb=() timing-allow-origin * expires Sat, 01 Jan 2000 00:00:00 GMT
GET H2	200	1010045.js Show response tracking.g2crowd.com/attribution_tracking/conversions/	958 B 2 KB	148ms 120ms	Script text/javascript	2606:4700:4400::6812:2b1f CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://tracking.g2crowd.com/attribution_tracking/conversions/1010045.js?p=https://www.group-ib.com/media-center/press-releases/phishing-kits-2022/&e= Requested by Host: www.group-ib.com URL: https://www.group-ib.com/media-center/press-releases/phishing-kits-2022/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:4400::6812:2b1f , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash d4c9ffda6ca556f36f402f6d1131a4f3f567505320a9f60151023d4a8bbdb458 Security Headers Name Value Content-Security-Policy default-src 'self' *.g2crowd.com *.g2.com; connect-src 'self' *.g2crowd.com *.g2.com; font-src 'self' *.g2crowd.com *.g2.com; form-action 'self' *.g2crowd.com *.g2.com; frame-src 'self' *.g2crowd.com *.g2.com; img-src 'self' *.g2crowd.com *.g2.com; manifest-src 'self' *.g2crowd.com *.g2.com; media-src 'self' *.g2crowd.com *.g2.com; object-src 'self' *.g2crowd.com *.g2.com; script-src 'self' *.g2crowd.com *.g2.com; style-src 'self' *.g2crowd.com *.g2.com; worker-src 'self' *.g2crowd.com *.g2.com Strict-Transport-Security max-age=604800 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers date Wed, 18 Oct 2023 18:26:37 GMT strict-transport-security max-age=604800 x-content-type-options nosniff cf-cache-status DYNAMIC content-encoding br x-permitted-cross-domain-policies none content-security-policy default-src 'self' *.g2crowd.com *.g2.com; connect-src 'self' *.g2crowd.com *.g2.com; font-src 'self' *.g2crowd.com *.g2.com; form-action 'self' *.g2crowd.com *.g2.com; frame-src 'self' *.g2crowd.com *.g2.com; img-src 'self' *.g2crowd.com *.g2.com; manifest-src 'self' *.g2crowd.com *.g2.com; media-src 'self' *.g2crowd.com *.g2.com; object-src 'self' *.g2crowd.com *.g2.com; script-src 'self' *.g2crowd.com *.g2.com; style-src 'self' *.g2crowd.com *.g2.com; worker-src 'self' *.g2crowd.com *.g2.com x-xss-protection 1; mode=block x-request-id a0b6b2eb-81e6-4ed9-bbe5-0a3cb1eeb9ab x-runtime 0.004485 referrer-policy strict-origin-when-cross-origin server cloudflare etag W/"d4c9ffda6ca556f36f402f6d1131a4f3" x-download-options noopen x-frame-options SAMEORIGIN vary Origin content-type text/javascript; charset=utf-8 cache-control max-age=600, public cf-ray 8182d4a54de39072-FRA
GET H2	200	1010056.js Show response tracking.g2crowd.com/attribution_tracking/conversions/	958 B 923 B	151ms 123ms	Script text/javascript	2606:4700:4400::6812:2b1f CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://tracking.g2crowd.com/attribution_tracking/conversions/1010056.js?p=https://www.group-ib.com/media-center/press-releases/phishing-kits-2022/&e= Requested by Host: www.group-ib.com URL: https://www.group-ib.com/media-center/press-releases/phishing-kits-2022/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:4400::6812:2b1f , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 085d5ab7549bcb7c4e86df292e05e2e579ec6ce11e052357110484554cdb12c1 Security Headers Name Value Content-Security-Policy default-src 'self' *.g2crowd.com *.g2.com; connect-src 'self' *.g2crowd.com *.g2.com; font-src 'self' *.g2crowd.com *.g2.com; form-action 'self' *.g2crowd.com *.g2.com; frame-src 'self' *.g2crowd.com *.g2.com; img-src 'self' *.g2crowd.com *.g2.com; manifest-src 'self' *.g2crowd.com *.g2.com; media-src 'self' *.g2crowd.com *.g2.com; object-src 'self' *.g2crowd.com *.g2.com; script-src 'self' *.g2crowd.com *.g2.com; style-src 'self' *.g2crowd.com *.g2.com; worker-src 'self' *.g2crowd.com *.g2.com Strict-Transport-Security max-age=604800 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers date Wed, 18 Oct 2023 18:26:37 GMT strict-transport-security max-age=604800 x-content-type-options nosniff cf-cache-status DYNAMIC content-encoding br x-permitted-cross-domain-policies none content-security-policy default-src 'self' *.g2crowd.com *.g2.com; connect-src 'self' *.g2crowd.com *.g2.com; font-src 'self' *.g2crowd.com *.g2.com; form-action 'self' *.g2crowd.com *.g2.com; frame-src 'self' *.g2crowd.com *.g2.com; img-src 'self' *.g2crowd.com *.g2.com; manifest-src 'self' *.g2crowd.com *.g2.com; media-src 'self' *.g2crowd.com *.g2.com; object-src 'self' *.g2crowd.com *.g2.com; script-src 'self' *.g2crowd.com *.g2.com; style-src 'self' *.g2crowd.com *.g2.com; worker-src 'self' *.g2crowd.com *.g2.com x-xss-protection 1; mode=block x-request-id e63e2c6f-81c9-406a-90a1-a4cfd0059aef x-runtime 0.004480 referrer-policy strict-origin-when-cross-origin server cloudflare etag W/"085d5ab7549bcb7c4e86df292e05e2e5" x-download-options noopen x-frame-options SAMEORIGIN vary Origin content-type text/javascript; charset=utf-8 cache-control max-age=600, public cf-ray 8182d4a54de49072-FRA
GET H2	200	1010057.js Show response tracking.g2crowd.com/attribution_tracking/conversions/	958 B 913 B	149ms 122ms	Script text/javascript	2606:4700:4400::6812:2b1f CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://tracking.g2crowd.com/attribution_tracking/conversions/1010057.js?p=https://www.group-ib.com/media-center/press-releases/phishing-kits-2022/&e= Requested by Host: www.group-ib.com URL: https://www.group-ib.com/media-center/press-releases/phishing-kits-2022/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:4400::6812:2b1f , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 1d26a8b07287923bfa829132476a39ef18a3d54142a095bead617044f2255eab Security Headers Name Value Content-Security-Policy default-src 'self' *.g2crowd.com *.g2.com; connect-src 'self' *.g2crowd.com *.g2.com; font-src 'self' *.g2crowd.com *.g2.com; form-action 'self' *.g2crowd.com *.g2.com; frame-src 'self' *.g2crowd.com *.g2.com; img-src 'self' *.g2crowd.com *.g2.com; manifest-src 'self' *.g2crowd.com *.g2.com; media-src 'self' *.g2crowd.com *.g2.com; object-src 'self' *.g2crowd.com *.g2.com; script-src 'self' *.g2crowd.com *.g2.com; style-src 'self' *.g2crowd.com *.g2.com; worker-src 'self' *.g2crowd.com *.g2.com Strict-Transport-Security max-age=604800 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers date Wed, 18 Oct 2023 18:26:37 GMT strict-transport-security max-age=604800 x-content-type-options nosniff cf-cache-status DYNAMIC content-encoding br x-permitted-cross-domain-policies none content-security-policy default-src 'self' *.g2crowd.com *.g2.com; connect-src 'self' *.g2crowd.com *.g2.com; font-src 'self' *.g2crowd.com *.g2.com; form-action 'self' *.g2crowd.com *.g2.com; frame-src 'self' *.g2crowd.com *.g2.com; img-src 'self' *.g2crowd.com *.g2.com; manifest-src 'self' *.g2crowd.com *.g2.com; media-src 'self' *.g2crowd.com *.g2.com; object-src 'self' *.g2crowd.com *.g2.com; script-src 'self' *.g2crowd.com *.g2.com; style-src 'self' *.g2crowd.com *.g2.com; worker-src 'self' *.g2crowd.com *.g2.com x-xss-protection 1; mode=block x-request-id 528d8ee2-7f8b-4b2c-8bc8-fd3eb2cc3c40 x-runtime 0.004928 referrer-policy strict-origin-when-cross-origin server cloudflare etag W/"1d26a8b07287923bfa829132476a39ef" x-download-options noopen x-frame-options SAMEORIGIN vary Origin content-type text/javascript; charset=utf-8 cache-control max-age=600, public cf-ray 8182d4a54de59072-FRA
GET H2	200	js Show response www.googletagmanager.com/gtag/	287 KB 93 KB	29ms 27ms	Script application/javascript	2a00:1450:4001:831::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtag/js?id=G-QMES53K3Y2&l=dataLayer&cx=c Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-PW7265 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:831::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash 516e69267fd937a1a9b86229c2d7fd4ff0640cfc0a8c0221ef308ca8d9f1a51b Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers date Wed, 18 Oct 2023 18:26:37 GMT content-encoding br strict-transport-security max-age=31536000; includeSubDomains server Google Tag Manager vary Accept-Encoding content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true cross-origin-resource-policy cross-origin access-control-allow-headers Cache-Control content-length 95275 x-xss-protection 0 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 expires Wed, 18 Oct 2023 18:26:37 GMT
GET H2	200	collect px4.ads.linkedin.com/ Redirect Chain https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=4496601&time=1697653596972&url=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fphishing-kits-2022%2F&tm=gtmv2 https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=4496601&time=1697653596972&url=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fphishing-kits-2022%2F&tm=gtmv2&cookiesTest=true https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D4496601%26time%3D1697653596972%26url%3Dhttps%253A%252F%252Fwww.group-ib.com%252Fm... https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=4496601&time=1697653596972&url=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fphishing-kits-2022%2F&tm=gtmv2&cookiesTest=true&li... https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=4496601&time=1697653596972&url=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fphishing-kits-2022%2F&tm=gtmv2&cookiesTest=true&l...	0 480 B	198ms 180ms	Image application/javascript	13.107.42.14 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Show image Full URL https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=4496601&time=1697653596972&url=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fphishing-kits-2022%2F&tm=gtmv2&cookiesTest=true&liSync=true&e_ipv6=AQK9vF-5ms79UgAAAYtECiX2JYypOzjF_rZvnfe-iuyEV_LsfWMH1DU4uLgkYRVwaXVkvAc8Yp4lMOVjDAXOucIJlw8BzA Requested by Host: www.group-ib.com URL: https://www.group-ib.com/media-center/press-releases/phishing-kits-2022/ Protocol H2 Server 13.107.42.14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers date Wed, 18 Oct 2023 18:26:37 GMT nel {"report_to":"network-errors","max_age":1296000,"success_fraction":0.00066,"failure_fraction":1,"include_subdomains":true} x-li-pop afd-prod-lor1-x x-msedge-ref Ref A: 4ED5060517FD43A8BF6C50F0AAA4745F Ref B: FRAEDGE1321 Ref C: 2023-10-18T18:26:37Z linkedin-action 1 report-to {"group":"network-errors","max_age":2592000,"endpoints":[{"url":"https://www.linkedin.com/li/rep"}],"include_subdomains":true} content-type application/javascript x-li-fabric prod-lor1 x-cache CONFIG_NOCACHE x-li-proto http/2 content-length 0 x-li-uuid AAYIAcenOoodgBPLVu4lzQ== Redirect headers date Wed, 18 Oct 2023 18:26:37 GMT nel {"report_to":"network-errors","max_age":1296000,"success_fraction":0.00066,"failure_fraction":1,"include_subdomains":true} x-li-pop afd-prod-lor1-x x-msedge-ref Ref A: 7D474B7FFDD648DDAE73F9941C3CD506 Ref B: FRAEDGE1217 Ref C: 2023-10-18T18:26:37Z linkedin-action 1 report-to {"group":"network-errors","max_age":2592000,"endpoints":[{"url":"https://www.linkedin.com/li/rep"}],"include_subdomains":true} x-li-fabric prod-lor1 location https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=4496601&time=1697653596972&url=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fphishing-kits-2022%2F&tm=gtmv2&cookiesTest=true&liSync=true&e_ipv6=AQK9vF-5ms79UgAAAYtECiX2JYypOzjF_rZvnfe-iuyEV_LsfWMH1DU4uLgkYRVwaXVkvAc8Yp4lMOVjDAXOucIJlw8BzA x-cache CONFIG_NOCACHE x-li-proto http/2 content-length 0 x-li-uuid AAYIAcekM2Jnrec5SwPf4A==
GET H2	200	combinedConfigs Show response cta-eu1.hubspot.com/web-interactives/public/v1/embed/	207 B 1 KB	90ms 40ms	Fetch application/json	172.65.198.159 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cta-eu1.hubspot.com/web-interactives/public/v1/embed/combinedConfigs?portalId=25755956&currentUrl=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fphishing-kits-2022%2F&referrer=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fphishing-kits-2022%2F Requested by Host: fhp-de-js.group-ib.com URL: https://fhp-de-js.group-ib.com/d/bt-autoinject.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.65.198.159 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 4e1f5dae1f231a3e6c42993418f2c2b7670e62db5b3ffee9afe0afa6657504f5 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers date Wed, 18 Oct 2023 18:26:37 GMT strict-transport-security max-age=31536000; includeSubDomains; preload x-content-type-options nosniff cf-cache-status DYNAMIC nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} x-evy-trace-route-service-name envoyset-translator x-hubspot-correlation-id 4ba540de-2cb1-4d2a-b7fa-6fd9c604c1a6 content-encoding br x-envoy-upstream-service-time 10 x-evy-trace-route-configuration listener_https/all x-evy-trace-listener listener_https x-request-id 4ba540de-2cb1-4d2a-b7fa-6fd9c604c1a6 server cloudflare vary origin access-control-allow-methods OPTIONS, GET content-type application/json;charset=utf-8 access-control-allow-origin https://www.group-ib.com x-evy-trace-virtual-host all access-control-max-age 180 access-control-allow-credentials true cache-control max-age=0, no-cache, no-store report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=mJptUnq32ZbGInWtxeonDAXfkTzYnhE3YX82dXD169pZVLS4meEwhvnfwoESKdSqXKyJtjKlS11haN2Oy9mGBG3to0%2BhQKzayDaoiqROdDPpnHpZeanMFRFBwAhAOdNxx8ZaaSs%3D"}],"group":"cf-nel","max_age":604800} x-robots-tag noindex, follow access-control-allow-headers Accept, Accept-Charset, Accept-Encoding, Accept-Language, Content-Type, Host, Origin, Referer, User-Agent cf-ray 8182d4a59c901d84-FRA x-evy-trace-served-by-pod fra04/star-hubspot-td/envoy-proxy-5cdd94655b-pnstb
GET H2	200	sync_cookie_image_decide mc.yandex.com/ Redirect Chain https://mc.yandex.com/sync_cookie_image_check https://mc.yandex.ru/sync_cookie_image_start?redirect_domain=mc.yandex.com&token=10160.9iB7bYCqB0fn9LlC2wAYx5Jf4bCRgiBFKQoiFpknhTH0iUHslzT8Uc1m8lycrK4I.CbJs9Rrem3UGuiCsgSv5UcszZhw%2C https://mc.yandex.com/sync_cookie_image_decide?token=10160.X9eY6J2t3DUHfO_vZu4LsGGDsmyr3XeT7bYGFclqh9EPlNiSqmRZorr3RZC2dZ9SxEh6PFrn4j8ZbdOH5_nJaGGK_oN7stq-gnIIo84I7Fed4-cA4EdI6q6LvXgHNUf4TMuibPhvQN...	43 B 673 B	61ms 60ms	Image image/gif	2a02:6b8::1:119 GLOBAL_DC
General Check archive.org Show headers Download Go to Show image Full URL https://mc.yandex.com/sync_cookie_image_decide?token=10160.X9eY6J2t3DUHfO_vZu4LsGGDsmyr3XeT7bYGFclqh9EPlNiSqmRZorr3RZC2dZ9SxEh6PFrn4j8ZbdOH5_nJaGGK_oN7stq-gnIIo84I7Fed4-cA4EdI6q6LvXgHNUf4TMuibPhvQNaIgt83lWoAC8yRB17sE_ygIfVDe3HJt2E3Q5QpUIyydVjVlTRhpX1-D_pHVb2l6STV_BSUQAz1Su6ITt7gM0FnIhSnnpW4r2g%2C.UVt4y_n3I4R8JccMDK1Kn0Up45M%2C Requested by Host: www.group-ib.com URL: https://www.group-ib.com/media-center/press-releases/phishing-kits-2022/ Protocol H2 Server 2a02:6b8::1:119 Ulyanovsk, Russian Federation, ASN208722 (GLOBAL_DC, FI), Reverse DNS Software / Resource Hash 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87 Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers date Wed, 18 Oct 2023 18:26:37 GMT strict-transport-security max-age=31536000 content-length 43 x-xss-protection 1; mode=block content-type image/gif Redirect headers location https://mc.yandex.com/sync_cookie_image_decide?token=10160.X9eY6J2t3DUHfO_vZu4LsGGDsmyr3XeT7bYGFclqh9EPlNiSqmRZorr3RZC2dZ9SxEh6PFrn4j8ZbdOH5_nJaGGK_oN7stq-gnIIo84I7Fed4-cA4EdI6q6LvXgHNUf4TMuibPhvQNaIgt83lWoAC8yRB17sE_ygIfVDe3HJt2E3Q5QpUIyydVjVlTRhpX1-D_pHVb2l6STV_BSUQAz1Su6ITt7gM0FnIhSnnpW4r2g%2C.UVt4y_n3I4R8JccMDK1Kn0Up45M%2C date Wed, 18 Oct 2023 18:26:37 GMT strict-transport-security max-age=31536000 x-xss-protection 1; mode=block
GET H3	200	js Show response www.googletagmanager.com/gtag/	226 KB 78 KB	39ms 36ms	Script application/javascript	2a00:1450:4001:831::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtag/js?id=AW-10882981508 Requested by Host: js-eu1.hsadspixel.net URL: https://js-eu1.hsadspixel.net/fb.js Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:831::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash 52e284e3afaec4160789862f1a87222d0639f8ab64def6cfb996e302c421a405 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers date Wed, 18 Oct 2023 18:26:37 GMT content-encoding br strict-transport-security max-age=31536000; includeSubDomains cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 80139 x-xss-protection 0 last-modified Wed, 18 Oct 2023 18:00:00 GMT server Google Tag Manager vary Accept-Encoding content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true access-control-allow-headers Cache-Control expires Wed, 18 Oct 2023 18:26:37 GMT
GET H3	200	js Show response www.googletagmanager.com/gtag/	226 KB 78 KB	38ms 36ms	Script application/javascript	2a00:1450:4001:831::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtag/js?id=AW-10882981508&l=dataLayer&cx=c Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-PW7265 Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:831::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash 52f643debdfcd7d10ad6f0ceb72929bbfcc4e67692000fb988a7d005c5f09f67 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers date Wed, 18 Oct 2023 18:26:37 GMT content-encoding br strict-transport-security max-age=31536000; includeSubDomains cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 80187 x-xss-protection 0 last-modified Wed, 18 Oct 2023 18:00:00 GMT server Google Tag Manager vary Accept-Encoding content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true access-control-allow-headers Cache-Control expires Wed, 18 Oct 2023 18:26:37 GMT
GET H2	200	advert.gif mc.yandex.com/metrika/	43 B 498 B	60ms 60ms	Image image/gif	2a02:6b8::1:119 GLOBAL_DC
General Check archive.org Show headers Download Go to Show image Full URL https://mc.yandex.com/metrika/advert.gif Requested by Host: www.group-ib.com URL: https://www.group-ib.com/media-center/press-releases/phishing-kits-2022/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:6b8::1:119 Ulyanovsk, Russian Federation, ASN208722 (GLOBAL_DC, FI), Reverse DNS Software / Resource Hash 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers date Wed, 18 Oct 2023 18:26:37 GMT strict-transport-security max-age=31536000 last-modified Tue, 17 Oct 2023 09:59:45 GMT accept-ch Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA etag "652e5b11-2b" content-type image/gif access-control-allow-origin * cache-control max-age=3600 accept-ranges bytes timing-allow-origin * content-length 43 expires Wed, 18 Oct 2023 19:26:37 GMT
GET H/1.1	200 OK	counters.gif forms-eu1.hsforms.com/embed/v3/	35 B 1016 B	329ms 28ms	Image image/gif	172.65.232.43 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://forms-eu1.hsforms.com/embed/v3/counters.gif?key=collected-forms-embed-js-form-bind&count=5 Requested by Host: www.group-ib.com URL: https://www.group-ib.com/media-center/press-releases/phishing-kits-2022/ Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 172.65.232.43 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers Date Wed, 18 Oct 2023 18:26:37 GMT Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff CF-Cache-Status DYNAMIC x-evy-trace-route-service-name envoyset-translator X-HubSpot-Correlation-Id bd3d046c-24ca-4053-9976-d918d56f89dd x-envoy-upstream-service-time 3 Connection keep-alive alt-svc h3=":443"; ma=86400 Content-Length 35 x-evy-trace-route-configuration listener_https/all x-evy-trace-listener listener_https x-request-id bd3d046c-24ca-4053-9976-d918d56f89dd Server cloudflare X-Trace 2B7884345EA565C9802051194A67A87F3CC2A83714000000000000000000 Vary origin Content-Type image/gif x-evy-trace-virtual-host all x-evy-trace-served-by-pod fra04/star-hubspot-td/envoy-proxy-5cdd94655b-hn9qf Access-Control-Expose-Headers X-Origin-Hublet Cache-Control max-age=0, no-cache, no-store Access-Control-Allow-Credentials false X-Robots-Tag none CF-RAY 8182d4a7bfcf365c-FRA
GET H2	200	/ Show response c.6sc.co/	7 B 194 B	10ms 9ms	XHR text/html	2.16.241.88 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://c.6sc.co/ Requested by Host: fhp-de-js.group-ib.com URL: https://fhp-de-js.group-ib.com/d/bt-autoinject.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2.16.241.88 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS a2-16-241-88.deploy.static.akamaitechnologies.com Software / Resource Hash fe04a9dc88d3f3be8d4f6bc63a9a80f45a4c6d8460e7551dab849457c091920a Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers date Wed, 18 Oct 2023 18:26:37 GMT access-control-max-age 86400 access-control-allow-methods GET,POST content-type text/html access-control-allow-origin https://www.group-ib.com access-control-allow-credentials true access-control-allow-headers * content-length 7
GET H2	200	/ Show response ipv6.6sc.co/	36 B 337 B	79ms 18ms	XHR text/html	2a02:26f0:2c::216:f230 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://ipv6.6sc.co/ Requested by Host: fhp-de-js.group-ib.com URL: https://fhp-de-js.group-ib.com/d/bt-autoinject.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:2c::216:f230 Düsseldorf, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software / Resource Hash 8f9a92c68eabbddc30f407bca636e07ce6cf5d6e4f56c9ed48a2134c58f31e25 Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers pragma no-cache date Wed, 18 Oct 2023 18:26:37 GMT vary Origin content-type text/html access-control-allow-origin https://www.group-ib.com cache-control max-age=0, no-cache, no-store 6si-ipv6 2001:ac8:20:3a00:1012:9e16:3e4f:e5b4 server-timing cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="1697653597162_35058220_57829269_26_1106_15_34_219";dur=1 content-length 36 expires Wed, 18 Oct 2023 18:26:37 GMT
GET H2	200	img.gif b.6sc.co/v1/beacon/	43 B 484 B	198ms 193ms	Image image/gif	2.16.241.88 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=e84d9c08a990af8592952e7ac9a983ad&svisitor=null&visitor=67be12de-54a8-4ad0-809d-77c907844f68&session=9d8ad07a-f435-4085-8b39-02d421861311&event=a_pageload&q=%7B%22pageLoadTime%22%3A%22Wed%2C%2018%20Oct%202023%2018%3A26%3A37%20GMT%22%7D&isIframe=false&m=%7B%22description%22%3A%22Group-IB%2C%20a%20global%20cybersecurity%20leader%20headquartered%20in%20Singapore%2C%20has%20recorded%20a%2025%25%20increase%20in%20the%20use%20of%20phishing%20kits%20in%202022.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Group-IB%3A%20the%20use%20of%20phishing%20kits%20surges%20by%2025%25%20in%202022%20as%20they%20become%20more%20evasive%20and%20advanced%20%7C%20Group-IB%22%7D&cb=&r=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fphishing-kits-2022%2F&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fphishing-kits-2022%2F&pageViewId=d753acb7-b710-4427-87da-572baad0f219&v=1.1.7 Requested by Host: www.group-ib.com URL: https://www.group-ib.com/media-center/press-releases/phishing-kits-2022/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2.16.241.88 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS a2-16-241-88.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers date Wed, 18 Oct 2023 18:26:37 GMT x-content-type-options nosniff content-length 43 pragma no-cache last-modified Sat, 18 Feb 2023 00:49:36 GMT server nginx/1.14.0 (Ubuntu) etag "63f020a0-2b" access-control-max-age 86400 access-control-allow-methods GET,POST content-type image/gif access-control-allow-origin cache-control private, no-cache, no-cache=Set-Cookie, proxy-revalidate access-control-allow-credentials true accept-ranges bytes access-control-allow-headers * expires Wed, 19 Apr 2000 11:43:00 GMT
GET H2	200	img.gif b.6sc.co/v1/beacon/	43 B 484 B	205ms 201ms	Image image/gif	2.16.241.88 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=e84d9c08a990af8592952e7ac9a983ad&svisitor=null&visitor=67be12de-54a8-4ad0-809d-77c907844f68&session=9d8ad07a-f435-4085-8b39-02d421861311&event=ni%3AasyncSettingsAudit&q=%7B%22settings%22%3A%22%5B%7B%5C%22name%5C%22%3A%5C%22enableEventTracking%5C%22%2C%5C%22value%5C%22%3A%5C%22true%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Wed%2C%2018%20Oct%202023%2018%3A26%3A37%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setToken%5C%22%2C%5C%22value%5C%22%3A%5C%22e84d9c08a990af8592952e7ac9a983ad%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Wed%2C%2018%20Oct%202023%2018%3A26%3A37%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setEndpoint%5C%22%2C%5C%22value%5C%22%3A%5C%22b.6sc.co%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Wed%2C%2018%20Oct%202023%2018%3A26%3A37%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%5D%22%7D&isIframe=false&m=%7B%22description%22%3A%22Group-IB%2C%20a%20global%20cybersecurity%20leader%20headquartered%20in%20Singapore%2C%20has%20recorded%20a%2025%25%20increase%20in%20the%20use%20of%20phishing%20kits%20in%202022.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Group-IB%3A%20the%20use%20of%20phishing%20kits%20surges%20by%2025%25%20in%202022%20as%20they%20become%20more%20evasive%20and%20advanced%20%7C%20Group-IB%22%7D&cb=&r=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fphishing-kits-2022%2F&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fphishing-kits-2022%2F&pageViewId=d753acb7-b710-4427-87da-572baad0f219&v=1.1.7 Requested by Host: www.group-ib.com URL: https://www.group-ib.com/media-center/press-releases/phishing-kits-2022/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2.16.241.88 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS a2-16-241-88.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers date Wed, 18 Oct 2023 18:26:37 GMT x-content-type-options nosniff content-length 43 pragma no-cache last-modified Tue, 05 Oct 2021 22:17:52 GMT server nginx/1.14.0 (Ubuntu) etag "615ccf10-2b" access-control-max-age 86400 access-control-allow-methods GET,POST content-type image/gif access-control-allow-origin cache-control private, no-cache, no-cache=Set-Cookie, proxy-revalidate access-control-allow-credentials true accept-ranges bytes access-control-allow-headers * expires Wed, 19 Apr 2000 11:43:00 GMT
GET H2	200	rp.gif alb.reddit.com/	42 B 637 B	53ms 7ms	Image image/gif	151.101.65.140 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://alb.reddit.com/rp.gif?ts=1697653597137&id=a2_du2owjr6f67j&event=PageVisit&m.itemCount=undefined&m.value=&m.valueDecimal=undefined&m.currency=undefined&m.transactionId=&m.customEventName=&m.products=&m.conversionId=&uuid=ab04a699-88aa-42c0-89ac-ebdc47e42ca2&aaid=&em=&external_id=&idfa=&integration=gtm&opt_out=0&sh=1600&sw=1200&v=rdt_f5bd31b2 Requested by Host: www.group-ib.com URL: https://www.group-ib.com/media-center/press-releases/phishing-kits-2022/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 151.101.65.140 , United States, ASN54113 (FASTLY, US), Reverse DNS Software Varnish / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers date Wed, 18 Oct 2023 18:26:37 GMT via 1.1 varnish nel {"report_to": "w3-reporting-nel", "max_age": 14400, "include_subdomains": false, "success_fraction": 0.3, "failure_fraction": 0.3} server Varnish report-to {"group": "w3-reporting-nel", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-nel.reddit.com/reports" }]}, {"group": "w3-reporting", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting.reddit.com/reports" }]}, {"group": "w3-reporting-csp", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-csp.reddit.com/reports" }]} content-type image/gif cross-origin-resource-policy cross-origin accept-ranges bytes content-length 42 retry-after 0
GET H2	200	649324202964935 Show response connect.facebook.net/signals/config/	141 KB 37 KB	8ms 7ms	Script application/x-javascript	2a03:2880:f084:105:face:b00c:0:3 FACEBOOK
General Check archive.org Show headers Download Go to Full URL https://connect.facebook.net/signals/config/649324202964935?v=2.9.134&r=stable&domain=www.group-ib.com Requested by Host: connect.facebook.net URL: https://connect.facebook.net/en_US/fbevents.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a03:2880:f084:105:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US), Reverse DNS Software / Resource Hash 159950096492a963e1d167bf53b49aaa3d33db34d629c51d34dd233d01ea1ae5 Security Headers Name Value Content-Security-Policy default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script'; Strict-Transport-Security max-age=31536000; preload; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers content-security-policy default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script'; content-encoding gzip x-content-type-options nosniff strict-transport-security max-age=31536000; preload; includeSubDomains date Wed, 18 Oct 2023 18:26:37 GMT document-policy force-load-at-top cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400 content-length 37040 x-xss-protection 0 pragma public x-fb-debug 0mlz1detEWyi28z3/51w3E+BjHJrX+5MqAPL+sUXFTnJwfDlHrfXuDcaWqYG+rDPpNrhh+LGJlm1K5Q67l2byg== cross-origin-opener-policy same-origin-allow-popups vary Accept-Encoding x-frame-options DENY content-type application/x-javascript; charset=utf-8 origin-agent-cluster ?0 cache-control public, max-age=1200 permissions-policy accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(), gyroscope=(), hid=(), idle-detection=(), magnetometer=(), microphone=(), midi=(), payment=(), screen-wake-lock=(), serial=(), usb=() timing-allow-origin * expires Sat, 01 Jan 2000 00:00:00 GMT
POST H2	204	collect region1.analytics.google.com/g/	0 246 B	39ms 16ms	Ping text/plain	2001:4860:4802:32::36 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://region1.analytics.google.com/g/collect?v=2&tid=G-QMES53K3Y2&gtm=45je3ag0&_p=1558960621&_gaz=1&cid=40281499.1697653597&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_s=1&dl=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fphishing-kits-2022%2F&sid=1697653597&sct=1&seg=0&dr=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fphishing-kits-2022%2F&dt=Group-IB%3A%20the%20use%20of%20phishing%20kits%20surges%20by%2025%25%20in%202022%20as%20they%20become%20more%20evasive%20and%20advanced%20%7C%20Group-IB&en=page_view&_fv=1&_nsi=1&_ss=1 Requested by Host: fhp-de-js.group-ib.com URL: https://fhp-de-js.group-ib.com/d/bt-autoinject.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2001:4860:4802:32::36 , United States, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers pragma no-cache date Wed, 18 Oct 2023 18:26:37 GMT server Golfe2 content-type text/plain access-control-allow-origin https://www.group-ib.com cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 0 expires Fri, 01 Jan 1990 00:00:00 GMT
POST H2	204	collect stats.g.doubleclick.net/g/	0 246 B	61ms 20ms	Ping text/plain	2a00:1450:400c:c06::9d GOOGLE
General Check archive.org Show headers Download Go to Full URL https://stats.g.doubleclick.net/g/collect?v=2&tid=G-QMES53K3Y2&cid=40281499.1697653597&gtm=45je3ag0&aip=1 Requested by Host: fhp-de-js.group-ib.com URL: https://fhp-de-js.group-ib.com/d/bt-autoinject.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:400c:c06::9d Brussels, Belgium, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers pragma no-cache date Wed, 18 Oct 2023 18:26:37 GMT server Golfe2 content-type text/plain access-control-allow-origin https://www.group-ib.com cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	ga-audiences www.google.de/ads/	42 B 408 B	74ms 45ms	Image image/gif	2a00:1450:4001:831::2003 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.de/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&tid=G-QMES53K3Y2&cid=40281499.1697653597&gtm=45je3ag0&aip=1&z=1884354397 Requested by Host: www.group-ib.com URL: https://www.group-ib.com/media-center/press-releases/phishing-kits-2022/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:831::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers pragma no-cache date Wed, 18 Oct 2023 18:26:37 GMT x-content-type-options nosniff server cafe content-type image/gif p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin timing-allow-origin * alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H/1.1	200 OK	counters.gif perf-eu1.hsforms.com/embed/v3/	35 B 1 KB	76ms 41ms	Image image/gif	172.65.232.43 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://perf-eu1.hsforms.com/embed/v3/counters.gif?key=config-loaded-success&value=1 Requested by Host: www.group-ib.com URL: https://www.group-ib.com/media-center/press-releases/phishing-kits-2022/ Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 172.65.232.43 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers Date Wed, 18 Oct 2023 18:26:37 GMT Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff CF-Cache-Status MISS x-evy-trace-route-service-name envoyset-translator X-HubSpot-Correlation-Id 03f9b327-5c9d-4ec3-b10f-593c96abe45b x-envoy-upstream-service-time 1 Connection keep-alive alt-svc h3=":443"; ma=86400 Content-Length 35 x-evy-trace-route-configuration listener_https/all x-evy-trace-listener listener_https x-request-id 03f9b327-5c9d-4ec3-b10f-593c96abe45b Last-Modified Wed, 18 Oct 2023 18:26:37 GMT Server cloudflare X-Trace 2B1F861679D733EB9353CE2BD74C9B7AA3D2966802000000000000000000 Vary origin, Accept-Encoding Content-Type image/gif x-evy-trace-virtual-host all x-evy-trace-served-by-pod fra04/star-hubspot-td/envoy-proxy-5cdd94655b-5tsjd Access-Control-Expose-Headers X-Origin-Hublet Cache-Control max-age=0, no-cache, no-store Access-Control-Allow-Credentials false Accept-Ranges bytes X-Robots-Tag none CF-RAY 8182d4a6fc794d25-FRA
GET H2	200	notify Show response api.neverbounce.com/v4/poe/	62 B 281 B	379ms 183ms	Script application/javascript	35.168.79.248 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://api.neverbounce.com/v4/poe/notify?key=public_feedec8c69cd171b06421bb96273f04d&event=form.load&callback=__neverbounce_10924 Requested by Host: cdn.neverbounce.com URL: https://cdn.neverbounce.com/widget/dist/NeverBounce.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 35.168.79.248 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-35-168-79-248.compute-1.amazonaws.com Software nginx / Resource Hash c255b1994c07be3a708b9d771b14c055357b34fb6af1ac40798fbd0dc4c2c774 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers date Wed, 18 Oct 2023 18:26:37 GMT content-encoding gzip strict-transport-security max-age=31536000; includeSubDomains server nginx vary Accept-Encoding content-type application/javascript cache-control no-cache, private x-ua-compatible IE=Edge
GET H2	200	notify Show response api.neverbounce.com/v4/poe/	63 B 282 B	311ms 117ms	Script application/javascript	35.168.79.248 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://api.neverbounce.com/v4/poe/notify?key=public_feedec8c69cd171b06421bb96273f04d&event=form.load&callback=__neverbounce_630035 Requested by Host: cdn.neverbounce.com URL: https://cdn.neverbounce.com/widget/dist/NeverBounce.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 35.168.79.248 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-35-168-79-248.compute-1.amazonaws.com Software nginx / Resource Hash 2f162737120b100c0e01ec3af39a6e696febc219d264bd7a1d17520a93a3c1f6 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers date Wed, 18 Oct 2023 18:26:37 GMT content-encoding gzip strict-transport-security max-age=31536000; includeSubDomains server nginx vary Accept-Encoding content-type application/javascript cache-control no-cache, private x-ua-compatible IE=Edge
GET H2	200	notify Show response api.neverbounce.com/v4/poe/	62 B 282 B	297ms 104ms	Script application/javascript	35.168.79.248 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://api.neverbounce.com/v4/poe/notify?key=public_feedec8c69cd171b06421bb96273f04d&event=form.load&callback=__neverbounce_134442 Requested by Host: cdn.neverbounce.com URL: https://cdn.neverbounce.com/widget/dist/NeverBounce.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 35.168.79.248 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-35-168-79-248.compute-1.amazonaws.com Software nginx / Resource Hash b8a27e91ea2dd410791f71cb6c68b8cd8ae72282436690b0c5abc098efe53ee0 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers date Wed, 18 Oct 2023 18:26:37 GMT content-encoding gzip strict-transport-security max-age=31536000; includeSubDomains server nginx vary Accept-Encoding content-type application/javascript cache-control no-cache, private x-ua-compatible IE=Edge
GET H2	200	notify Show response api.neverbounce.com/v4/poe/	63 B 282 B	297ms 105ms	Script application/javascript	35.168.79.248 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://api.neverbounce.com/v4/poe/notify?key=public_feedec8c69cd171b06421bb96273f04d&event=form.load&callback=__neverbounce_124770 Requested by Host: cdn.neverbounce.com URL: https://cdn.neverbounce.com/widget/dist/NeverBounce.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 35.168.79.248 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-35-168-79-248.compute-1.amazonaws.com Software nginx / Resource Hash 8b82b9009568e87fb2c8cdc6d6703cb9c364bf218469c08a7507ca0868af2f7a Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers date Wed, 18 Oct 2023 18:26:37 GMT content-encoding gzip strict-transport-security max-age=31536000; includeSubDomains server nginx vary Accept-Encoding content-type application/javascript cache-control no-cache, private x-ua-compatible IE=Edge
GET H2	200	notify Show response api.neverbounce.com/v4/poe/	63 B 282 B	307ms 116ms	Script application/javascript	35.168.79.248 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://api.neverbounce.com/v4/poe/notify?key=public_feedec8c69cd171b06421bb96273f04d&event=form.load&callback=__neverbounce_425858 Requested by Host: cdn.neverbounce.com URL: https://cdn.neverbounce.com/widget/dist/NeverBounce.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 35.168.79.248 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-35-168-79-248.compute-1.amazonaws.com Software nginx / Resource Hash 1803ec5ff4903f01b8b1a2d18c52b23c302ad476af2c8474bf95a9e8772e4bee Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers date Wed, 18 Oct 2023 18:26:37 GMT content-encoding gzip strict-transport-security max-age=31536000; includeSubDomains server nginx vary Accept-Encoding content-type application/javascript cache-control no-cache, private x-ua-compatible IE=Edge
POST H2	200	fl Show response www.group-ib.com/api/	665 B 1 KB	28ms 28ms	XHR application/json	3.72.181.255 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://www.group-ib.com/api/fl?u=078c8cd0-6dd4-11ee-991f-4be53f4f36ab&cfidsgib-w-61354c22-16cc-40a8-a871-6901f1a76e24=ZmCjuxoXtGmduvQYW9cj4nsvQi1rqmNYfYa8VGZDobYemwGDw6VG6N0vST41XufX2EwHqB9TevmQ%2FkXtR3mNvepmsSwy4dbSIRt%2B2AmF4unjza4OTJtlLv92SfU%2F8kkVi1EQmcjAYXoONV5TditCfgsQJMTboO8zP0Z4 Requested by Host: fhp-de-js.group-ib.com URL: https://fhp-de-js.group-ib.com/d/bt-autoinject.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 3.72.181.255 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-3-72-181-255.eu-central-1.compute.amazonaws.com Software nginx / Resource Hash b3625b39a0669aed6ad1ddaee5d18d3c89875c59a4e5e7e20e37521bb8635011 Request headers X-GIB-GSSCgib-w-61354c22-16cc-40a8-a871-6901f1a76e24 VRDho37y8agNb3YncrEoKXnBDAzgql8gMV9PqYK3PnbB5wJwAjkYw5E75XEt9EdRlRejyF4n2Rw86T6cE2jKvC+EGes4PTTFNEe2YBLcc5DnYeS2ZoAJhnIr2jtS0kNLBMVMdszax7v3/y/qGraX6yVWx9V5oD2DIxyRRtBouGE6D47c52yfZxfWDRFE24rIaucv1SzSmJY0Et7fm9HdHWr8Ufdoc9w+kErYebGx+ajIl6Wprc8am2vcqsa6Dg== Referer https://www.group-ib.com/media-center/press-releases/phishing-kits-2022/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 X-GIB-FGSSCgib-w-61354c22-16cc-40a8-a871-6901f1a76e24 tdzC7663a25947930455d87626f4b4bc59b3fd56 Content-Type text/plain;charset=UTF-8 Response headers date Wed, 18 Oct 2023 18:26:37 GMT content-encoding gzip server nginx vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS content-type application/json; charset=utf-8 access-control-allow-origin https://www.group-ib.com cache-control no-store access-control-allow-credentials true x-envoy-upstream-service-time 2 access-control-allow-headers Accept,DNT,Keep-Alive,User-Agent,If-Modified-Since,Cache-Control,Content-Type,Origin,ETag,If-None-Match,X-Cfids,Authorization
GET H2	200	/ www.google.com/pagead/1p-user-list/10897073384/	42 B 455 B	46ms 21ms	Image image/gif	2a00:1450:4001:82a::2004 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.com/pagead/1p-user-list/10897073384/?random=1697653596964&cv=11&fst=1697652000000&bg=ffffff&guid=ON&async=1&gtm=45He3ag0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fphishing-kits-2022%2F&ref=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fphishing-kits-2022%2F&frm=0&tiba=Group-IB%3A%20the%20use%20of%20phishing%20kits%20surges%20by%2025%25%20in%202022%20as%20they%20become%20more%20evasive%20and%20advanced%20%7C%20Group-IB&fmt=3&is_vtc=1&random=3579124107&rmt_tld=0&ipr=y Requested by Host: www.group-ib.com URL: https://www.group-ib.com/media-center/press-releases/phishing-kits-2022/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:82a::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value Content-Security-Policy script-src 'none'; object-src 'none' X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers pragma no-cache date Wed, 18 Oct 2023 18:26:37 GMT content-security-policy script-src 'none'; object-src 'none' x-content-type-options nosniff server cafe content-type image/gif p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin timing-allow-origin * alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	/ www.google.de/pagead/1p-user-list/10897073384/	42 B 154 B	21ms 20ms	Image image/gif	2a00:1450:4001:831::2003 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.de/pagead/1p-user-list/10897073384/?random=1697653596964&cv=11&fst=1697652000000&bg=ffffff&guid=ON&async=1&gtm=45He3ag0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fphishing-kits-2022%2F&ref=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fphishing-kits-2022%2F&frm=0&tiba=Group-IB%3A%20the%20use%20of%20phishing%20kits%20surges%20by%2025%25%20in%202022%20as%20they%20become%20more%20evasive%20and%20advanced%20%7C%20Group-IB&fmt=3&is_vtc=1&random=3579124107&rmt_tld=1&ipr=y Requested by Host: www.group-ib.com URL: https://www.group-ib.com/media-center/press-releases/phishing-kits-2022/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:831::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value Content-Security-Policy script-src 'none'; object-src 'none' X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers pragma no-cache date Wed, 18 Oct 2023 18:26:37 GMT content-security-policy script-src 'none'; object-src 'none' x-content-type-options nosniff server cafe content-type image/gif p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin timing-allow-origin * alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	/ Show response googleads.g.doubleclick.net/pagead/viewthroughconversion/10882981508/	3 KB 2 KB	26ms 26ms	Script text/javascript	2a00:1450:4001:810::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://googleads.g.doubleclick.net/pagead/viewthroughconversion/10882981508/?random=1697653597371&cv=11&fst=1697653597371&bg=ffffff&guid=ON&async=1&gtm=45be3ag0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fphishing-kits-2022%2F&ref=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fphishing-kits-2022%2F&hn=www.googleadservices.com&frm=0&tiba=Group-IB%3A%20the%20use%20of%20phishing%20kits%20surges%20by%2025%25%20in%202022%20as%20they%20become%20more%20evasive%20and%20advanced%20%7C%20Group-IB&did=dZTQ1Zm&gdid=dZTQ1Zm&auid=1614929152.1697653597&uamb=0&uaw=0&data=event%3Dgtag.config&rfmt=3&fmt=4 Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtag/js?id=AW-10882981508 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash 6c54e56e25be8b61100ea1ab2a4bf5eb2c489b53892e583bf70d161eddaf9a7d Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers pragma no-cache date Wed, 18 Oct 2023 18:26:37 GMT content-encoding br x-content-type-options nosniff server cafe content-type text/javascript; charset=UTF-8 p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" cache-control no-cache, must-revalidate cross-origin-resource-policy cross-origin content-disposition attachment; filename="f.txt" timing-allow-origin * alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 1422 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	img.gif b.6sc.co/v1/beacon/	43 B 485 B	205ms 205ms	Image image/gif	2.16.241.88 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=e84d9c08a990af8592952e7ac9a983ad&svisitor=null&visitor=67be12de-54a8-4ad0-809d-77c907844f68&session=9d8ad07a-f435-4085-8b39-02d421861311&event=ipv6&q=%7B%22address%22%3A%222001%3Aac8%3A20%3A3a00%3A1012%3A9e16%3A3e4f%3Ae5b4%22%7D&isIframe=false&m=%7B%22description%22%3A%22Group-IB%2C%20a%20global%20cybersecurity%20leader%20headquartered%20in%20Singapore%2C%20has%20recorded%20a%2025%25%20increase%20in%20the%20use%20of%20phishing%20kits%20in%202022.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Group-IB%3A%20the%20use%20of%20phishing%20kits%20surges%20by%2025%25%20in%202022%20as%20they%20become%20more%20evasive%20and%20advanced%20%7C%20Group-IB%22%7D&cb=&r=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fphishing-kits-2022%2F&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fphishing-kits-2022%2F&pageViewId=d753acb7-b710-4427-87da-572baad0f219&v=1.1.7 Requested by Host: www.group-ib.com URL: https://www.group-ib.com/media-center/press-releases/phishing-kits-2022/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2.16.241.88 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS a2-16-241-88.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers date Wed, 18 Oct 2023 18:26:37 GMT x-content-type-options nosniff content-length 43 pragma no-cache last-modified Sat, 18 Feb 2023 02:04:22 GMT server nginx/1.14.0 (Ubuntu) etag "63f03226-2b" access-control-max-age 86400 access-control-allow-methods GET,POST content-type image/gif access-control-allow-origin cache-control private, no-cache, no-cache=Set-Cookie, proxy-revalidate access-control-allow-credentials true accept-ranges bytes access-control-allow-headers * expires Wed, 19 Apr 2000 11:43:00 GMT
GET H2	200	1 Show response mc.yandex.com/watch/26812653/ Redirect Chain https://mc.yandex.com/watch/26812653?wmode=7&page-url=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fphishing-kits-2022%2F&charset=utf-8&site-info=%7B%22shareVersion%22%3A2%2C%22s... https://mc.yandex.com/watch/26812653/1?wmode=7&page-url=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fphishing-kits-2022%2F&charset=utf-8&site-info=%7B%22shareVersion%22%3A2%2C%2...	427 B 546 B	61ms 60ms	XHR application/json	2a02:6b8::1:119 GLOBAL_DC
General Check archive.org Show headers Download Go to Full URL https://mc.yandex.com/watch/26812653/1?wmode=7&page-url=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fphishing-kits-2022%2F&charset=utf-8&site-info=%7B%22shareVersion%22%3A2%2C%22strategy%22%3A%22d%2Fn%2Fq%2Fr%2Fs%2Ft%22%7D&uah=chm%0A%3F0&browser-info=pv%3A1%3Avf%3A3qm6qq812ez2u52y4wzrnbv%3Afp%3A471%3Afu%3A1%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A1135%3Acn%3A1%3Adp%3A0%3Als%3A356605506717%3Ahid%3A179107037%3Az%3A120%3Ai%3A20231018202637%3Aet%3A1697653597%3Ac%3A1%3Arn%3A860900965%3Arqn%3A1%3Au%3A1697653597310309535%3Aw%3A1600x1200%3As%3A1600x1200x24%3Ask%3A1%3Awv%3A2%3Ads%3A0%2C0%2C21%2C8%2C0%2C0%2C%2C535%2C33%2C%2C%2C%2C626%3Aco%3A0%3Acpf%3A1%3Ans%3A1697653595890%3Aadb%3A2%3Arqnl%3A1%3Ast%3A1697653597%3At%3AGroup-IB%3A%20the%20use%20of%20phishing%20kits%20surges%20by%2025%25%20in%202022%20as%20they%20become%20more%20evasive%20and%20advanced%20%7C%20Group-IB&t=gdpr%2814%29clc%280-0-0%29rqnt%281%29aw%281%29ti%282%29 Requested by Host: www.group-ib.com URL: https://www.group-ib.com/media-center/press-releases/phishing-kits-2022/ Protocol H2 Server 2a02:6b8::1:119 Ulyanovsk, Russian Federation, ASN208722 (GLOBAL_DC, FI), Reverse DNS Software / Resource Hash b63d5c2208891baea6ebb2d3b738a2ece59d7f6f0afcd0dba5bc22458fae2e6d Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers pragma no-cache date Wed, 18 Oct 2023 18:26:37 GMT strict-transport-security max-age=31536000 x-content-type-options nosniff last-modified Wed, 18-Oct-2023 18:26:37 GMT accept-ch Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA content-type application/json; charset=utf-8 access-control-allow-origin https://www.group-ib.com cache-control private, no-cache, no-store, must-revalidate, max-age=0 access-control-allow-credentials true content-length 427 x-xss-protection 1; mode=block expires Wed, 18-Oct-2023 18:26:37 GMT Redirect headers pragma no-cache date Wed, 18 Oct 2023 18:26:37 GMT strict-transport-security max-age=31536000 last-modified Wed, 18-Oct-2023 18:26:37 GMT accept-ch Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA location /watch/26812653/1?wmode=7&page-url=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fphishing-kits-2022%2F&charset=utf-8&site-info=%7B%22shareVersion%22%3A2%2C%22strategy%22%3A%22d%2Fn%2Fq%2Fr%2Fs%2Ft%22%7D&uah=chm%0A%3F0&browser-info=pv%3A1%3Avf%3A3qm6qq812ez2u52y4wzrnbv%3Afp%3A471%3Afu%3A1%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A1135%3Acn%3A1%3Adp%3A0%3Als%3A356605506717%3Ahid%3A179107037%3Az%3A120%3Ai%3A20231018202637%3Aet%3A1697653597%3Ac%3A1%3Arn%3A860900965%3Arqn%3A1%3Au%3A1697653597310309535%3Aw%3A1600x1200%3As%3A1600x1200x24%3Ask%3A1%3Awv%3A2%3Ads%3A0%2C0%2C21%2C8%2C0%2C0%2C%2C535%2C33%2C%2C%2C%2C626%3Aco%3A0%3Acpf%3A1%3Ans%3A1697653595890%3Aadb%3A2%3Arqnl%3A1%3Ast%3A1697653597%3At%3AGroup-IB%3A%20the%20use%20of%20phishing%20kits%20surges%20by%2025%25%20in%202022%20as%20they%20become%20more%20evasive%20and%20advanced%20%7C%20Group-IB&t=gdpr%2814%29clc%280-0-0%29rqnt%281%29aw%281%29ti%282%29 access-control-allow-origin https://www.group-ib.com cache-control private, no-cache, no-store, must-revalidate, max-age=0 access-control-allow-credentials true x-xss-protection 1; mode=block expires Wed, 18-Oct-2023 18:26:37 GMT
GET H2	200	/ www.facebook.com/tr/	0 185 B	22ms 7ms	Image text/plain	2a03:2880:f176:181:face:b00c:0:25de FACEBOOK
General Check archive.org Show headers Download Go to Show image Full URL https://www.facebook.com/tr/?id=649324202964935&ev=PageView&dl=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fphishing-kits-2022%2F&rl=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fphishing-kits-2022%2F&if=false&ts=1697653597436&sw=1600&sh=1200&v=2.9.134&r=stable&ec=0&o=30&fbp=fb.1.1697653597430.872886294&cs_est=true&it=1697653597156&coo=false&rqm=GET Requested by Host: www.group-ib.com URL: https://www.group-ib.com/media-center/press-releases/phishing-kits-2022/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a03:2880:f176:181:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US), Reverse DNS Software proxygen-bolt / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers strict-transport-security max-age=31536000; includeSubDomains date Wed, 18 Oct 2023 18:26:37 GMT server proxygen-bolt content-type text/plain access-control-allow-origin access-control-allow-credentials true cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400 content-length 0
GET H2	200	/ www.google.com/pagead/1p-user-list/10882981508/	42 B 108 B	23ms 22ms	Image image/gif	2a00:1450:4001:82a::2004 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.com/pagead/1p-user-list/10882981508/?random=1697653597371&cv=11&fst=1697652000000&bg=ffffff&guid=ON&async=1&gtm=45be3ag0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fphishing-kits-2022%2F&ref=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fphishing-kits-2022%2F&frm=0&tiba=Group-IB%3A%20the%20use%20of%20phishing%20kits%20surges%20by%2025%25%20in%202022%20as%20they%20become%20more%20evasive%20and%20advanced%20%7C%20Group-IB&data=event%3Dgtag.config&fmt=3&is_vtc=1&random=414556540&rmt_tld=0&ipr=y Requested by Host: www.group-ib.com URL: https://www.group-ib.com/media-center/press-releases/phishing-kits-2022/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:82a::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value Content-Security-Policy script-src 'none'; object-src 'none' X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers pragma no-cache date Wed, 18 Oct 2023 18:26:37 GMT content-security-policy script-src 'none'; object-src 'none' x-content-type-options nosniff server cafe content-type image/gif p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin timing-allow-origin * alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H3	200	/ www.google.de/pagead/1p-user-list/10882981508/	42 B 64 B	21ms 21ms	Image image/gif	2a00:1450:4001:831::2003 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.de/pagead/1p-user-list/10882981508/?random=1697653597371&cv=11&fst=1697652000000&bg=ffffff&guid=ON&async=1&gtm=45be3ag0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fphishing-kits-2022%2F&ref=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fphishing-kits-2022%2F&frm=0&tiba=Group-IB%3A%20the%20use%20of%20phishing%20kits%20surges%20by%2025%25%20in%202022%20as%20they%20become%20more%20evasive%20and%20advanced%20%7C%20Group-IB&data=event%3Dgtag.config&fmt=3&is_vtc=1&random=414556540&rmt_tld=1&ipr=y Requested by Host: www.group-ib.com URL: https://www.group-ib.com/media-center/press-releases/phishing-kits-2022/ Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:831::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value Content-Security-Policy script-src 'none'; object-src 'none' X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers pragma no-cache date Wed, 18 Oct 2023 18:26:37 GMT content-security-policy script-src 'none'; object-src 'none' x-content-type-options nosniff server cafe content-type image/gif p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin timing-allow-origin * alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
POST H2	200	1 Show response mc.yandex.com/watch/26812653/	43 B 86 B	59ms 59ms	XHR image/gif	2a02:6b8::1:119 GLOBAL_DC
General Check archive.org Show headers Download Go to Full URL https://mc.yandex.com/watch/26812653/1?page-url=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fphishing-kits-2022%2F&charset=utf-8&hittoken=1697653597_9e878d13ca10d86d8a5f51460fb51ca407b2a992071f9dbf7babebcbebf3285c&browser-info=pa%3A1%3Aar%3A1%3Avf%3A3qm6qq812ez2u52y4wzrnbv%3Afu%3A1%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A1135%3Acn%3A1%3Adp%3A1%3Als%3A356605506717%3Ahid%3A179107037%3Az%3A120%3Ai%3A20231018202637%3Aet%3A1697653598%3Ac%3A1%3Arn%3A937048284%3Arqn%3A2%3Au%3A1697653597310309535%3Aw%3A1600x1200%3As%3A1600x1200x24%3Ask%3A1%3Awv%3A2%3Aco%3A0%3Acpf%3A1%3Ans%3A1697653595890%3Aadb%3A2%3Arqnl%3A1%3Ast%3A1697653598&t=gdpr(14)mc(p-1)clc(0-0-0)rqnt(2)lt(36700)aw(1)ti(2) Requested by Host: fhp-de-js.group-ib.com URL: https://fhp-de-js.group-ib.com/d/bt-autoinject.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:6b8::1:119 Ulyanovsk, Russian Federation, ASN208722 (GLOBAL_DC, FI), Reverse DNS Software / Resource Hash 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87 Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Xss-Protection 1; mode=block Request headers Referer https://www.group-ib.com/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Content-Type application/x-www-form-urlencoded Response headers pragma no-cache date Wed, 18 Oct 2023 18:26:37 GMT strict-transport-security max-age=31536000 last-modified Wed, 18-Oct-2023 18:26:37 GMT accept-ch Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA content-type image/gif access-control-allow-origin https://www.group-ib.com cache-control private, no-cache, no-store, must-revalidate, max-age=0 access-control-allow-credentials true content-length 43 x-xss-protection 1; mode=block expires Wed, 18-Oct-2023 18:26:37 GMT
GET H3	200	709834390277869 Show response connect.facebook.net/signals/config/	138 KB 36 KB	8ms 8ms	Script application/x-javascript	2a03:2880:f084:105:face:b00c:0:3 FACEBOOK
General Check archive.org Show headers Download Go to Full URL https://connect.facebook.net/signals/config/709834390277869?v=2.9.134&r=stable&domain=www.group-ib.com Requested by Host: connect.facebook.net URL: https://connect.facebook.net/en_US/fbevents.js Protocol H3 Security QUIC, , AES_128_GCM Server 2a03:2880:f084:105:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US), Reverse DNS Software / Resource Hash 76631339cbb636125ff94e2d21652dbf0f83343cb2afa962f14840f80525de9a Security Headers Name Value Content-Security-Policy default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script'; Strict-Transport-Security max-age=31536000; preload; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers content-security-policy default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script'; content-encoding gzip x-content-type-options nosniff strict-transport-security max-age=31536000; preload; includeSubDomains date Wed, 18 Oct 2023 18:26:37 GMT document-policy force-load-at-top cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400 content-length 36538 x-xss-protection 0 pragma public x-fb-debug WkTZ4v5X/uY4lRZjNumLVPcCgPHXflLGRXQStuU6/TWsaPe2iKyAnonNXOWcJWhlb9azXAio4+pqv6BuDWGxSw== cross-origin-opener-policy same-origin-allow-popups vary Accept-Encoding x-frame-options DENY content-type application/x-javascript; charset=utf-8 origin-agent-cluster ?0 cache-control public, max-age=1200 permissions-policy accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(), gyroscope=(), hid=(), idle-detection=(), magnetometer=(), microphone=(), midi=(), payment=(), screen-wake-lock=(), serial=(), usb=() timing-allow-origin * priority u=3,i expires Sat, 01 Jan 2000 00:00:00 GMT
GET H2	200	__ptq.gif track-eu1.hubspot.com/	45 B 1 KB	72ms 44ms	Image image/gif	172.65.240.166 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://track-eu1.hubspot.com/__ptq.gif?k=1&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=en-us&bfp=3857904254&v=1.1&a=25755956&rcu=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fphishing-kits-2022%2F&r=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fphishing-kits-2022%2F&pu=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fphishing-kits-2022%2F&t=Group-IB%3A+the+use+of+phishing+kits+surges+by+25%25+in+2022+as+they+become+more+evasive+and+advanced+%7C+Group-IB&cts=1697653597983&vi=df256f1b2d3ade683c7f31aa796954df&nc=true&u=84897990.df256f1b2d3ade683c7f31aa796954df.1697653597978.1697653597978.1697653597978.1&b=84897990.1.1697653597979&cc=15 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.65.240.166 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers date Wed, 18 Oct 2023 18:26:38 GMT strict-transport-security max-age=31536000; includeSubDomains; preload x-content-type-options nosniff cf-cache-status MISS nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} x-evy-trace-route-service-name envoyset-translator x-hubspot-correlation-id ea53a87c-d70a-4384-bd62-e633931457f7 p3p CP="NOI CUR ADM OUR NOR STA NID" x-envoy-upstream-service-time 2 content-length 45 x-evy-trace-route-configuration listener_https/all x-evy-trace-listener listener_https x-request-id ea53a87c-d70a-4384-bd62-e633931457f7 last-modified Wed, 18 Oct 2023 18:26:38 GMT server cloudflare vary origin, Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=mIfLbhZE7MoONjD%2BGJxhqlRX1D2g%2FFDi0QppvqUWg9Pk7AoYfxzBmeBtJFqiZYj%2BiGPidzgOatqqTJvlXw%2FKbANHoSxWt9L9U%2BqSBqjtLpZ25Om3HUHxSxGuiKGMRpa0HWlMUTfVgQ%3D%3D"}],"group":"cf-nel","max_age":604800} content-type image/gif x-evy-trace-served-by-pod fra04/analytics-tracking-td/envoy-proxy-74554d9fd-9spmc x-evy-trace-virtual-host all cache-control no-cache, no-store, no-transform access-control-allow-credentials false accept-ranges bytes cf-ray 8182d4abbff32c6f-FRA x-robots-tag none
GET H2	200	__ptq.gif track-eu1.hubspot.com/	45 B 639 B	43ms 40ms	Image image/gif	172.65.240.166 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://track-eu1.hubspot.com/__ptq.gif?k=15&fi=044e7558-8073-478a-ad3c-5807dd76840f&fci=888758e3-f5eb-4eae-8986-20cf3965f8e6&ft=0&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=en-us&bfp=3857904254&v=1.1&a=25755956&rcu=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fphishing-kits-2022%2F&r=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fphishing-kits-2022%2F&pu=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fphishing-kits-2022%2F&t=Group-IB%3A+the+use+of+phishing+kits+surges+by+25%25+in+2022+as+they+become+more+evasive+and+advanced+%7C+Group-IB&cts=1697653597986&vi=df256f1b2d3ade683c7f31aa796954df&nc=true&u=84897990.df256f1b2d3ade683c7f31aa796954df.1697653597978.1697653597978.1697653597978.1&b=84897990.1.1697653597979&cc=15 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.65.240.166 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers date Wed, 18 Oct 2023 18:26:38 GMT strict-transport-security max-age=31536000; includeSubDomains; preload x-content-type-options nosniff cf-cache-status MISS nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} x-evy-trace-route-service-name envoyset-translator x-hubspot-correlation-id ee3557c4-0145-4399-90f7-7a57d0a4cf61 p3p CP="NOI CUR ADM OUR NOR STA NID" x-envoy-upstream-service-time 4 content-length 45 x-evy-trace-route-configuration listener_https/all x-evy-trace-listener listener_https x-request-id ee3557c4-0145-4399-90f7-7a57d0a4cf61 last-modified Wed, 18 Oct 2023 18:26:38 GMT server cloudflare vary origin, Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=tSwYICbgi64QqwOTaWjH6r9BGMR3VMK7q34oNyPFaSEJZ%2B4ew2%2FgVruPtSE3i9NcBl4wSixH9%2Fw15e%2By2CJQQ%2BUZUctX%2FVokEDJnvPO6ln%2Fi2zF9vhdvqro52g1AUPQtH65rimdChw%3D%3D"}],"group":"cf-nel","max_age":604800} content-type image/gif x-evy-trace-served-by-pod fra04/analytics-tracking-td/envoy-proxy-74554d9fd-nh8kq x-evy-trace-virtual-host all cache-control no-cache, no-store, no-transform access-control-allow-credentials false accept-ranges bytes cf-ray 8182d4abc8142c6f-FRA x-robots-tag none
GET H2	200	__ptq.gif track-eu1.hubspot.com/	45 B 644 B	54ms 50ms	Image image/gif	172.65.240.166 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://track-eu1.hubspot.com/__ptq.gif?k=15&fi=5a995f05-701c-48e3-b25a-d1548ba3c0b3&fci=e5fa5a70-4282-4c1f-bb37-a9ad3274209e&ft=0&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=en-us&bfp=3857904254&v=1.1&a=25755956&rcu=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fphishing-kits-2022%2F&r=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fphishing-kits-2022%2F&pu=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fphishing-kits-2022%2F&t=Group-IB%3A+the+use+of+phishing+kits+surges+by+25%25+in+2022+as+they+become+more+evasive+and+advanced+%7C+Group-IB&cts=1697653597988&vi=df256f1b2d3ade683c7f31aa796954df&nc=true&u=84897990.df256f1b2d3ade683c7f31aa796954df.1697653597978.1697653597978.1697653597978.1&b=84897990.1.1697653597979&cc=15 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.65.240.166 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers date Wed, 18 Oct 2023 18:26:38 GMT strict-transport-security max-age=31536000; includeSubDomains; preload x-content-type-options nosniff cf-cache-status MISS nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} x-evy-trace-route-service-name envoyset-translator x-hubspot-correlation-id 31983aae-315e-42ae-b283-8a5209cb3deb p3p CP="NOI CUR ADM OUR NOR STA NID" x-envoy-upstream-service-time 6 content-length 45 x-evy-trace-route-configuration listener_https/all x-evy-trace-listener listener_https x-request-id 31983aae-315e-42ae-b283-8a5209cb3deb last-modified Wed, 18 Oct 2023 18:26:38 GMT server cloudflare vary origin, Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=o7Do%2FQtG2AF%2Bub%2BFERDXNypE6rOZN7M2apAo4w5un0ef%2BmzbPOCwISitgHKYcOy6CLdiOqd3LFuKnvYV9cw8CCCuyvrjxTp3jNEXRmV2O7h0Pd%2FVQdEA%2F%2B1U5ypJHltb%2Bg4lDaAWzQ%3D%3D"}],"group":"cf-nel","max_age":604800} content-type image/gif x-evy-trace-served-by-pod fra04/analytics-tracking-td/envoy-proxy-74554d9fd-lr4nj x-evy-trace-virtual-host all cache-control no-cache, no-store, no-transform access-control-allow-credentials false accept-ranges bytes cf-ray 8182d4abc8182c6f-FRA x-robots-tag none
GET H2	200	__ptq.gif track-eu1.hubspot.com/	45 B 636 B	51ms 48ms	Image image/gif	172.65.240.166 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://track-eu1.hubspot.com/__ptq.gif?k=15&fi=4dbceae1-75ae-423a-9c12-dee8f1ca3345&fci=9c167083-3c55-4caa-929a-fe79e1895def&ft=0&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=en-us&bfp=3857904254&v=1.1&a=25755956&rcu=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fphishing-kits-2022%2F&r=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fphishing-kits-2022%2F&pu=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fphishing-kits-2022%2F&t=Group-IB%3A+the+use+of+phishing+kits+surges+by+25%25+in+2022+as+they+become+more+evasive+and+advanced+%7C+Group-IB&cts=1697653597990&vi=df256f1b2d3ade683c7f31aa796954df&nc=true&u=84897990.df256f1b2d3ade683c7f31aa796954df.1697653597978.1697653597978.1697653597978.1&b=84897990.1.1697653597979&cc=15 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.65.240.166 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers date Wed, 18 Oct 2023 18:26:38 GMT strict-transport-security max-age=31536000; includeSubDomains; preload x-content-type-options nosniff cf-cache-status MISS nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} x-evy-trace-route-service-name envoyset-translator x-hubspot-correlation-id 61e78efb-640e-470f-a050-76f6b2ca2b20 p3p CP="NOI CUR ADM OUR NOR STA NID" x-envoy-upstream-service-time 2 content-length 45 x-evy-trace-route-configuration listener_https/all x-evy-trace-listener listener_https x-request-id 61e78efb-640e-470f-a050-76f6b2ca2b20 last-modified Wed, 18 Oct 2023 18:26:38 GMT server cloudflare vary origin, Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=nyswkihMBRgZvj2ghGzykBLMc2nFhH43TFDKftPVRJxTA7VY5a%2Bix96zxMTcOt%2Fnk9dgH8wMp%2F1n0yz8TEcml8LNH5VqLyqoC%2F3hzEeN8%2BbSEzGGeIEuF2Rnh6VO1gdlNHpgK6Bt4A%3D%3D"}],"group":"cf-nel","max_age":604800} content-type image/gif x-evy-trace-served-by-pod fra04/analytics-tracking-td/envoy-proxy-74554d9fd-7pz7j x-evy-trace-virtual-host all cache-control no-cache, no-store, no-transform access-control-allow-credentials false accept-ranges bytes cf-ray 8182d4abc8192c6f-FRA x-robots-tag none
GET H2	200	__ptq.gif track-eu1.hubspot.com/	45 B 1 KB	48ms 45ms	Image image/gif	172.65.240.166 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://track-eu1.hubspot.com/__ptq.gif?k=15&fi=55a22738-d5a5-43f9-9c1c-fa4c1a6eb349&fci=b057b4ce-9498-467d-830f-9faacf125664&ft=0&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=en-us&bfp=3857904254&v=1.1&a=25755956&rcu=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fphishing-kits-2022%2F&r=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fphishing-kits-2022%2F&pu=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fphishing-kits-2022%2F&t=Group-IB%3A+the+use+of+phishing+kits+surges+by+25%25+in+2022+as+they+become+more+evasive+and+advanced+%7C+Group-IB&cts=1697653597991&vi=df256f1b2d3ade683c7f31aa796954df&nc=true&u=84897990.df256f1b2d3ade683c7f31aa796954df.1697653597978.1697653597978.1697653597978.1&b=84897990.1.1697653597979&cc=15 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.65.240.166 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers date Wed, 18 Oct 2023 18:26:38 GMT strict-transport-security max-age=31536000; includeSubDomains; preload x-content-type-options nosniff cf-cache-status MISS nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} x-evy-trace-route-service-name envoyset-translator x-hubspot-correlation-id 5fa463a7-ce21-4432-bf2f-a5fda27477e1 p3p CP="NOI CUR ADM OUR NOR STA NID" x-envoy-upstream-service-time 4 content-length 45 x-evy-trace-route-configuration listener_https/all x-evy-trace-listener listener_https x-request-id 5fa463a7-ce21-4432-bf2f-a5fda27477e1 last-modified Wed, 18 Oct 2023 18:26:38 GMT server cloudflare vary origin, Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=cXRI%2FDM1JDf9Go60zzCSTg0oQdBx8NA1W%2FaozxT4ysSlcw9Lzbu66MtvX%2FC4MgYcDaoz0azfjYdbtToZM5ZX1UjHhRORpheI6M%2BArMF9zgzRfHJCcxBAMEdtyiU%2FxaaE3QYhL0gdog%3D%3D"}],"group":"cf-nel","max_age":604800} content-type image/gif x-evy-trace-served-by-pod fra04/analytics-tracking-td/envoy-proxy-74554d9fd-wfdxk x-evy-trace-virtual-host all cache-control no-cache, no-store, no-transform access-control-allow-credentials false accept-ranges bytes cf-ray 8182d4abc81a2c6f-FRA x-robots-tag none
GET H2	200	__ptq.gif track-eu1.hubspot.com/	45 B 626 B	43ms 40ms	Image image/gif	172.65.240.166 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://track-eu1.hubspot.com/__ptq.gif?k=15&fi=eb903dab-0ef3-43b5-bdeb-71372e6ad0f0&fci=29fa66d0-746d-4e69-87d9-da90dcdc61b9&ft=0&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=en-us&bfp=3857904254&v=1.1&a=25755956&rcu=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fphishing-kits-2022%2F&r=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fphishing-kits-2022%2F&pu=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fphishing-kits-2022%2F&t=Group-IB%3A+the+use+of+phishing+kits+surges+by+25%25+in+2022+as+they+become+more+evasive+and+advanced+%7C+Group-IB&cts=1697653597998&vi=df256f1b2d3ade683c7f31aa796954df&nc=true&u=84897990.df256f1b2d3ade683c7f31aa796954df.1697653597978.1697653597978.1697653597978.1&b=84897990.1.1697653597979&cc=15 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.65.240.166 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers date Wed, 18 Oct 2023 18:26:38 GMT strict-transport-security max-age=31536000; includeSubDomains; preload x-content-type-options nosniff cf-cache-status MISS nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} x-evy-trace-route-service-name envoyset-translator x-hubspot-correlation-id 07f93884-7cea-47e8-ba57-821a1df725bc p3p CP="NOI CUR ADM OUR NOR STA NID" x-envoy-upstream-service-time 2 content-length 45 x-evy-trace-route-configuration listener_https/all x-evy-trace-listener listener_https x-request-id 07f93884-7cea-47e8-ba57-821a1df725bc last-modified Wed, 18 Oct 2023 18:26:38 GMT server cloudflare vary origin, Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=feq5cM1G5Yh6aRGBFZ1sk1HJhvOoS8kwz3Z0tCy3ywzsQ4onMuxZE8sketD0tGenCPL6LJv3VEnAJnNkOsB2P7vqWgOX2Ge8%2Bw9dAxQNt3sWorrS6kmgDNo34JeRrWSbus1XVrZh4w%3D%3D"}],"group":"cf-nel","max_age":604800} content-type image/gif x-evy-trace-served-by-pod fra04/analytics-tracking-td/envoy-proxy-74554d9fd-lr4nj x-evy-trace-virtual-host all cache-control no-cache, no-store, no-transform access-control-allow-credentials false accept-ranges bytes cf-ray 8182d4abc81b2c6f-FRA x-robots-tag none
GET H2	200	__ptq.gif track-eu1.hubspot.com/	45 B 653 B	49ms 46ms	Image image/gif	172.65.240.166 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://track-eu1.hubspot.com/__ptq.gif?k=17&fi=4dbceae1-75ae-423a-9c12-dee8f1ca3345&fci=9c167083-3c55-4caa-929a-fe79e1895def&ft=0&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=en-us&bfp=3857904254&v=1.1&a=25755956&rcu=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fphishing-kits-2022%2F&r=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fphishing-kits-2022%2F&pu=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fphishing-kits-2022%2F&t=Group-IB%3A+the+use+of+phishing+kits+surges+by+25%25+in+2022+as+they+become+more+evasive+and+advanced+%7C+Group-IB&cts=1697653597999&vi=df256f1b2d3ade683c7f31aa796954df&nc=true&u=84897990.df256f1b2d3ade683c7f31aa796954df.1697653597978.1697653597978.1697653597978.1&b=84897990.1.1697653597979&cc=15 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.65.240.166 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers date Wed, 18 Oct 2023 18:26:38 GMT strict-transport-security max-age=31536000; includeSubDomains; preload x-content-type-options nosniff cf-cache-status MISS nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} x-evy-trace-route-service-name envoyset-translator x-hubspot-correlation-id 60286184-2f31-4fb4-b011-5167658d0880 p3p CP="NOI CUR ADM OUR NOR STA NID" x-envoy-upstream-service-time 4 content-length 45 x-evy-trace-route-configuration listener_https/all x-evy-trace-listener listener_https x-request-id 60286184-2f31-4fb4-b011-5167658d0880 last-modified Wed, 18 Oct 2023 18:26:38 GMT server cloudflare vary origin, Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=JsaeSiVLb7nxxYf0Q1W%2BF0M10iP1kFoUF0HSrCD3R%2FVdgyD7SE2KVmheqtbp13etw%2BVzesP3mUmfUhVVzNV4e6NKYrswhPDyv0ViclYvKAf22HC6lSczm80hN4PcYPR88Uk8vb1%2BSQ%3D%3D"}],"group":"cf-nel","max_age":604800} content-type image/gif x-evy-trace-served-by-pod fra04/analytics-tracking-td/envoy-proxy-74554d9fd-5jnpb x-evy-trace-virtual-host all cache-control no-cache, no-store, no-transform access-control-allow-credentials false accept-ranges bytes cf-ray 8182d4abc81d2c6f-FRA x-robots-tag none
GET H2	200	__ptq.gif track-eu1.hubspot.com/	45 B 1 KB	51ms 49ms	Image image/gif	172.65.240.166 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://track-eu1.hubspot.com/__ptq.gif?k=17&fi=5a995f05-701c-48e3-b25a-d1548ba3c0b3&fci=e5fa5a70-4282-4c1f-bb37-a9ad3274209e&ft=0&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=en-us&bfp=3857904254&v=1.1&a=25755956&rcu=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fphishing-kits-2022%2F&r=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fphishing-kits-2022%2F&pu=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fphishing-kits-2022%2F&t=Group-IB%3A+the+use+of+phishing+kits+surges+by+25%25+in+2022+as+they+become+more+evasive+and+advanced+%7C+Group-IB&cts=1697653598000&vi=df256f1b2d3ade683c7f31aa796954df&nc=true&u=84897990.df256f1b2d3ade683c7f31aa796954df.1697653597978.1697653597978.1697653597978.1&b=84897990.1.1697653597979&cc=15 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.65.240.166 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers date Wed, 18 Oct 2023 18:26:38 GMT strict-transport-security max-age=31536000; includeSubDomains; preload x-content-type-options nosniff cf-cache-status MISS nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} x-evy-trace-route-service-name envoyset-translator x-hubspot-correlation-id 5881405d-57ed-4bbd-8223-f973117b5850 p3p CP="NOI CUR ADM OUR NOR STA NID" x-envoy-upstream-service-time 4 content-length 45 x-evy-trace-route-configuration listener_https/all x-evy-trace-listener listener_https x-request-id 5881405d-57ed-4bbd-8223-f973117b5850 last-modified Wed, 18 Oct 2023 18:26:38 GMT server cloudflare vary origin, Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=i4lPn8b25XK%2F0WSPUZYbIFyVPH3hG%2BRowCoCZHCH3TukKb83bLyoeIiHEOCJIwJErJZoyl1vRr7p0%2BjHnD1tCXkchqitQGFpGI%2B43JU%2FjgdE2lXnmIatTyutbB5yY142Fo%2B7xlEwew%3D%3D"}],"group":"cf-nel","max_age":604800} content-type image/gif x-evy-trace-served-by-pod fra04/analytics-tracking-td/envoy-proxy-74554d9fd-xz7cd x-evy-trace-virtual-host all cache-control no-cache, no-store, no-transform access-control-allow-credentials false accept-ranges bytes cf-ray 8182d4abc81e2c6f-FRA x-robots-tag none
GET H2	200	__ptq.gif track-eu1.hubspot.com/	45 B 633 B	72ms 70ms	Image image/gif	172.65.240.166 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://track-eu1.hubspot.com/__ptq.gif?k=17&fi=044e7558-8073-478a-ad3c-5807dd76840f&fci=888758e3-f5eb-4eae-8986-20cf3965f8e6&ft=0&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=en-us&bfp=3857904254&v=1.1&a=25755956&rcu=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fphishing-kits-2022%2F&r=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fphishing-kits-2022%2F&pu=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fphishing-kits-2022%2F&t=Group-IB%3A+the+use+of+phishing+kits+surges+by+25%25+in+2022+as+they+become+more+evasive+and+advanced+%7C+Group-IB&cts=1697653598001&vi=df256f1b2d3ade683c7f31aa796954df&nc=true&u=84897990.df256f1b2d3ade683c7f31aa796954df.1697653597978.1697653597978.1697653597978.1&b=84897990.1.1697653597979&cc=15 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.65.240.166 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers date Wed, 18 Oct 2023 18:26:38 GMT strict-transport-security max-age=31536000; includeSubDomains; preload x-content-type-options nosniff cf-cache-status MISS nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} x-evy-trace-route-service-name envoyset-translator x-hubspot-correlation-id e673e541-63c1-4775-92e4-1d1ed0df37eb p3p CP="NOI CUR ADM OUR NOR STA NID" x-envoy-upstream-service-time 2 content-length 45 x-evy-trace-route-configuration listener_https/all x-evy-trace-listener listener_https x-request-id e673e541-63c1-4775-92e4-1d1ed0df37eb last-modified Wed, 18 Oct 2023 18:26:38 GMT server cloudflare vary origin, Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ZgRw3gU8X%2FHsMy93hCmGYITmH2YTbZ25Ou00w93f%2FkZyVaHoLTDCpTmv3jzaS239XjySyItf%2BFlfzsNUUpAMLLQaXEL4gbRaJqvfTyq1SWGOPe9PHynCl3ZKrMZq3x1vV6QoWLHzsg%3D%3D"}],"group":"cf-nel","max_age":604800} content-type image/gif x-evy-trace-served-by-pod fra04/analytics-tracking-td/envoy-proxy-74554d9fd-gjpms x-evy-trace-virtual-host all cache-control no-cache, no-store, no-transform access-control-allow-credentials false accept-ranges bytes cf-ray 8182d4abc8212c6f-FRA x-robots-tag none
GET H2	200	facebook-64.svg website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/socials/	627 B 1 KB	39ms 38ms	Image image/svg+xml	2600:9000:238d:4a00:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/socials/facebook-64.svg Requested by Host: website.cdn.group-ib.com URL: https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-press-release.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:238d:4a00:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash f006e8bbfa4f0537780571436b5bed50ff10ff28759924c53b67732ec5af28ba Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-press-release.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; content-encoding gzip x-content-type-options nosniff strict-transport-security max-age=31536000; includeSubDomains via 1.1 74511018c757716e70d811d8214e45e0.cloudfront.net (CloudFront) date Wed, 18 Oct 2023 18:26:38 GMT x-amz-cf-pop AMS1-P1 x-cache RefreshHit from cloudfront content-length 376 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Tue, 29 Nov 2022 07:39:21 GMT server nginx etag "273-5ee9716178eea-gzip" x-frame-options sameorigin vary Accept-Encoding content-type image/svg+xml access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id hNvuHr3fFJpvIXKDkLYhg43RlqXp4pXoBQVWEyCF00nzViojUH8Q6w== expires Wed, 18 Oct 2023 18:56:38 GMT
GET H2	200	facebook-blue.svg website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/socials/	627 B 1 KB	33ms 31ms	Image image/svg+xml	2600:9000:238d:4a00:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/socials/facebook-blue.svg Requested by Host: website.cdn.group-ib.com URL: https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-press-release.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:238d:4a00:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software cloudflare / Resource Hash 746b0aea019090232091568f0790cf4d479b06a4e1fd9987069881ad5d1590ca Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-press-release.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers strict-transport-security max-age=31536000; includeSubDomains content-security-policy frame-ancestors 'self'; x-content-type-options nosniff cf-cache-status BYPASS nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} date Wed, 18 Oct 2023 18:26:38 GMT content-encoding br x-amz-cf-pop AMS1-P1 via 1.1 74511018c757716e70d811d8214e45e0.cloudfront.net (CloudFront) x-cache RefreshHit from cloudfront x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Tue, 29 Nov 2022 07:39:21 GMT server cloudflare etag W/"273-5ee9716178eea-gzip" x-frame-options sameorigin report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=v3r%2BJyq3HjsfZE6ezLJG%2BUs%2FPfczHJZqecmX16w9l%2BmJTrl2gnYJ7dtZpyKi9U9l8P1M6cRav4irA%2BxZU8U7Jd52Yp4GNU3xMdagzpSDvNRL4TvfEEg40R5ejDjdJA4AM%2Fk%3D"}],"group":"cf-nel","max_age":604800} content-type image/svg+xml access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() vary Accept-Encoding cf-ray 8144d1a23cfe9238-FRA x-amz-cf-id 8EzkTeMb2EFD3Nye4dT_tCfHiWHbeShYwTl27jsXA2Q2VPJJetxZRw== expires Wed, 18 Oct 2023 18:56:38 GMT
GET H2	200	/ www.facebook.com/tr/	0 54 B	8ms 7ms	Image text/plain	2a03:2880:f176:181:face:b00c:0:25de FACEBOOK
General Check archive.org Show headers Download Go to Show image Full URL https://www.facebook.com/tr/?id=709834390277869&ev=PageView&dl=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fphishing-kits-2022%2F&rl=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fphishing-kits-2022%2F&if=false&ts=1697653598056&sw=1600&sh=1200&ud[external_id]=df256f1b2d3ade683c7f31aa796954df&v=2.9.134&r=stable&ec=0&o=30&fbp=fb.1.1697653597430.872886294&cs_est=true&it=1697653597156&coo=false&rqm=GET Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a03:2880:f176:181:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US), Reverse DNS Software proxygen-bolt / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers strict-transport-security max-age=31536000; includeSubDomains date Wed, 18 Oct 2023 18:26:38 GMT server proxygen-bolt content-type text/plain access-control-allow-origin access-control-allow-credentials true cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400 content-length 0
GET H2	200	img.gif b.6sc.co/v1/beacon/	43 B 484 B	193ms 193ms	Image image/gif	2.16.241.88 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=e84d9c08a990af8592952e7ac9a983ad&svisitor=null&visitor=67be12de-54a8-4ad0-809d-77c907844f68&session=9d8ad07a-f435-4085-8b39-02d421861311&event=active_time_track&q=%7B%22currentTime%22%3A%22Wed%2C%2018%20Oct%202023%2018%3A26%3A38%20GMT%22%2C%22lastTrackTime%22%3A%22Wed%2C%2018%20Oct%202023%2018%3A26%3A37%20GMT%22%2C%22timeSpent%22%3A%221014%22%2C%22totalTimeSpent%22%3A%221014%22%7D&isIframe=false&m=%7B%22description%22%3A%22Group-IB%2C%20a%20global%20cybersecurity%20leader%20headquartered%20in%20Singapore%2C%20has%20recorded%20a%2025%25%20increase%20in%20the%20use%20of%20phishing%20kits%20in%202022.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Group-IB%3A%20the%20use%20of%20phishing%20kits%20surges%20by%2025%25%20in%202022%20as%20they%20become%20more%20evasive%20and%20advanced%20%7C%20Group-IB%22%7D&cb=&r=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fphishing-kits-2022%2F&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fphishing-kits-2022%2F&pageViewId=d753acb7-b710-4427-87da-572baad0f219&v=1.1.7 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2.16.241.88 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS a2-16-241-88.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers date Wed, 18 Oct 2023 18:26:38 GMT x-content-type-options nosniff content-length 43 pragma no-cache last-modified Fri, 21 Feb 2020 18:57:20 GMT server nginx/1.14.0 (Ubuntu) etag "5e502810-2b" access-control-max-age 86400 access-control-allow-methods GET,POST content-type image/gif access-control-allow-origin cache-control private, no-cache, no-cache=Set-Cookie, proxy-revalidate access-control-allow-credentials true accept-ranges bytes access-control-allow-headers * expires Wed, 19 Apr 2000 11:43:00 GMT
POST H2	200	fl Show response www.group-ib.com/api/	665 B 777 B	17ms 16ms	XHR application/json	3.72.181.255 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://www.group-ib.com/api/fl?u=078c8cd0-6dd4-11ee-991f-4be53f4f36ab&cfidsgib-w-61354c22-16cc-40a8-a871-6901f1a76e24=qMIV1m2wQiAKzK6CH8fhK6uTQ68p3%2BcyOcKxyU7NtH%2BuqJjvqWeLvqcol7eQEhzTSC2nmpgVAQsJpt9yLm4INM2M8RK7qOdiEUI8zzHKMbW5W%2BsxvfVPugNYi8ZduqYw%2BUTx5w%2BQbuz%2B36llXJ5t6Z9E8JHMwEzXsUba Requested by Host: fhp-de-js.group-ib.com URL: https://fhp-de-js.group-ib.com/d/bt-autoinject.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 3.72.181.255 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-3-72-181-255.eu-central-1.compute.amazonaws.com Software nginx / Resource Hash 026f94376934643d2742fc31acdf6501937fec280b0c899421aacbe4578dab12 Request headers X-GIB-GSSCgib-w-61354c22-16cc-40a8-a871-6901f1a76e24 Xc77kZUXZXNwoRw6L1DSHoDzl61jpTSpqpAM8kqbI6H/K7TdV4DthJ+7xSXPgZvI1JAucqoW3MxbbiSEr3lRk97EgpOWThyUY5+rjlXPStVrf5Ea8n8Vq7J+v18qYTa/9W9VX4hJwKKvYGF5yHED5UrGRr25ShcfqyaINZgzJwt5clwowPtAsLY4PhN796t7OBonVKvkXgjUyjyXrt85b+SXnkrYGpqlaCQe/biP8hKD1gJ7UOp5MySb+LFXnQ== Referer https://www.group-ib.com/media-center/press-releases/phishing-kits-2022/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 X-GIB-FGSSCgib-w-61354c22-16cc-40a8-a871-6901f1a76e24 WuLGd3c4bc17ed837f9cb1b7caa5647ee8f899d9 Content-Type text/plain;charset=UTF-8 Response headers date Wed, 18 Oct 2023 18:26:38 GMT content-encoding gzip server nginx vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS content-type application/json; charset=utf-8 access-control-allow-origin https://www.group-ib.com cache-control no-store access-control-allow-credentials true x-envoy-upstream-service-time 2 access-control-allow-headers Accept,DNT,Keep-Alive,User-Agent,If-Modified-Since,Cache-Control,Content-Type,Origin,ETag,If-None-Match,X-Cfids,Authorization
GET		img.gif b.6sc.co/v1/beacon/	0 0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain

b.6sc.co

URL

https://b.6sc.co/v1/beacon/img.gif?token=e84d9c08a990af8592952e7ac9a983ad&svisitor=null&visitor=67be12de-54a8-4ad0-809d-77c907844f68&session=9d8ad07a-f435-4085-8b39-02d421861311&event=active_time_track&q=%7B%22currentTime%22%3A%22Wed%2C%2018%20Oct%202023%2018%3A26%3A39%20GMT%22%2C%22lastTrackTime%22%3A%22Wed%2C%2018%20Oct%202023%2018%3A26%3A38%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%222015%22%7D&isIframe=false&m=%7B%22description%22%3A%22Group-IB%2C%20a%20global%20cybersecurity%20leader%20headquartered%20in%20Singapore%2C%20has%20recorded%20a%2025%25%20increase%20in%20the%20use%20of%20phishing%20kits%20in%202022.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Group-IB%3A%20the%20use%20of%20phishing%20kits%20surges%20by%2025%25%20in%202022%20as%20they%20become%20more%20evasive%20and%20advanced%20%7C%20Group-IB%22%7D&cb=&r=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fphishing-kits-2022%2F&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fphishing-kits-2022%2F&pageViewId=d753acb7-b710-4427-87da-572baad0f219&v=1.1.7