www.deepinstinct.com Open in urlscan Pro
3.70.101.28 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework
Submission: On April 24 via api (April 24th 2024, 10:52:31 am UTC) from IL — Scanned from IL

Summary HTTP 112 Redirects Links 40 Behaviour Indicators

Summary

This website contacted 40 IPs in 4 countries across 33 domains to perform 112 HTTP transactions. The main IP is 3.70.101.28, located in Frankfurt am Main, Germany and belongs to AMAZON-02, US. The main domain is www.deepinstinct.com. The Cisco Umbrella rank of the primary domain is 488596.
TLS certificate: Issued by R3 on April 18th 2024. Valid for: 3 months.

This is the only time www.deepinstinct.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
43	3.70.101.28 3.70.101.28	16509 (AMAZON-02) (AMAZON-02)
1	142.250.186.174 142.250.186.174	15169 (GOOGLE) (GOOGLE)
4	23.200.36.196 23.200.36.196	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
4	151.101.194.137 151.101.194.137	54113 (FASTLY) (FASTLY)
3	172.217.16.200 172.217.16.200	15169 (GOOGLE) (GOOGLE)
1	23.200.36.205 23.200.36.205	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
3	172.217.18.14 172.217.18.14	15169 (GOOGLE) (GOOGLE)
1	18.66.102.53 18.66.102.53	16509 (AMAZON-02) (AMAZON-02)
1	18.245.46.22 18.245.46.22	16509 (AMAZON-02) (AMAZON-02)
1	104.16.141.209 104.16.141.209	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	23.200.38.43 23.200.38.43	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	146.75.120.157 146.75.120.157	54113 (FASTLY) (FASTLY)
3	157.240.253.1 157.240.253.1	32934 (FACEBOOK) (FACEBOOK)
3	204.79.197.237 204.79.197.237	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
4	152.195.15.58 152.195.15.58	15133 (EDGECAST) (EDGECAST)
1	172.64.151.60 172.64.151.60	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	104.18.16.5 104.18.16.5	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	104.18.34.229 104.18.34.229	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	104.17.175.201 104.17.175.201	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	104.18.140.17 104.18.140.17	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	104.17.223.152 104.17.223.152	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	34.111.208.231 34.111.208.231	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1	142.250.185.162 142.250.185.162	15169 (GOOGLE) (GOOGLE)
1	142.250.185.238 142.250.185.238	15169 (GOOGLE) (GOOGLE)
2	74.125.206.154 74.125.206.154	15169 (GOOGLE) (GOOGLE)
3	142.250.186.163 142.250.186.163	15169 (GOOGLE) (GOOGLE)
1	34.96.71.22 34.96.71.22	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1	18.66.102.85 18.66.102.85	16509 (AMAZON-02) (AMAZON-02)
2	13.33.187.19 13.33.187.19	16509 (AMAZON-02) (AMAZON-02)
2	104.244.42.133 104.244.42.133	13414 (TWITTER) (TWITTER)
2	104.244.42.131 104.244.42.131	13414 (TWITTER) (TWITTER)
3	151.101.65.167 151.101.65.167	54113 (FASTLY) (FASTLY)
1	143.204.98.12 143.204.98.12	16509 (AMAZON-02) (AMAZON-02)
2	216.58.206.68 216.58.206.68	15169 (GOOGLE) (GOOGLE)
3 5	13.107.42.14 13.107.42.14	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
2	157.240.253.35 157.240.253.35	32934 (FACEBOOK) (FACEBOOK)
1	169.48.219.66 169.48.219.66	36351 (SOFTLAYER) (SOFTLAYER)
1	35.171.141.234 35.171.141.234	14618 (AMAZON-AES) (AMAZON-AES)
1	104.16.117.116 104.16.117.116	13335 (CLOUDFLAR...) (CLOUDFLARENET)
112	40

43 3.70.101.28 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-3-70-101-28.eu-central-1.compute.amazonaws.com

www.deepinstinct.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.186.174 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s08-in-f14.1e100.net

www.googleoptimize.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 23.200.36.196 (Mexico)

ASN20940 (AKAMAI-ASN1, NL)
PTR: a23-200-36-196.deploy.static.akamaitechnologies.com

use.typekit.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 151.101.194.137 (United States)

ASN54113 (FASTLY, US)

images.contentstack.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 172.217.16.200 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s65-in-f8.1e100.net

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 23.200.36.205 (Mexico)

ASN20940 (AKAMAI-ASN1, NL)
PTR: a23-200-36-205.deploy.static.akamaitechnologies.com

p.typekit.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 172.217.18.14 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s22-in-f14.1e100.net

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.66.102.53 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-66-102-53.fra56.r.cloudfront.net

static.hotjar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.245.46.22 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-245-46-22.fra56.r.cloudfront.net

tag.demandbase.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.16.141.209 (None, )

ASN13335 (CLOUDFLARENET, US)

js.hs-scripts.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 23.200.38.43 (Mexico)

ASN20940 (AKAMAI-ASN1, NL)
PTR: a23-200-38-43.deploy.static.akamaitechnologies.com

snap.licdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 146.75.120.157 (Frankfurt am Main, Germany)

ASN54113 (FASTLY, US)

static.ads-twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 157.240.253.1 (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)
PTR: xx-fbcdn-shv-02-fra5.fbcdn.net

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 204.79.197.237 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

bat.bing.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 152.195.15.58 (United States)

ASN15133 (EDGECAST, US)

cdn.bizible.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
cdn.bizibly.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 172.64.151.60 (San Francisco, United States)

ASN13335 (CLOUDFLARENET, US)

trk.techtarget.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.18.16.5 (None, )

ASN13335 (CLOUDFLARENET, US)

js.qualified.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.18.34.229 (None, )

ASN13335 (CLOUDFLARENET, US)

js.hs-banner.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.17.175.201 (None, )

ASN13335 (CLOUDFLARENET, US)

js.hs-analytics.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.18.140.17 (None, )

ASN13335 (CLOUDFLARENET, US)

js.hsleadflows.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.17.223.152 (None, )

ASN13335 (CLOUDFLARENET, US)

js.hsadspixel.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 34.111.208.231 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 231.208.111.34.bc.googleusercontent.com

ibc-flow.techtarget.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.185.162 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s51-in-f2.1e100.net

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.185.238 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s53-in-f14.1e100.net

analytics.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 74.125.206.154 (United States)

ASN15169 (GOOGLE, US)
PTR: wk-in-f154.1e100.net

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 142.250.186.163 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s08-in-f3.1e100.net

www.google.co.il	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.96.71.22 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 22.71.96.34.bc.googleusercontent.com

s.company-target.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.66.102.85 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-66-102-85.fra56.r.cloudfront.net

api.company-target.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 13.33.187.19 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-33-187-19.fra60.r.cloudfront.net

script.hotjar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 104.244.42.133 (United States)

ASN13414 (TWITTER, US)

t.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 104.244.42.131 (United States)

ASN13414 (TWITTER, US)

analytics.twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 151.101.65.167 (United States)

ASN54113 (FASTLY, US)

s.swiftypecdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 143.204.98.12 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-143-204-98-12.fra50.r.cloudfront.net

tag-logger.demandbase.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 216.58.206.68 (United States)

ASN15169 (GOOGLE, US)
PTR: tzfraa-aa-in-f4.1e100.net

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 13.107.42.14 (United States) 3 redirects

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

px.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
www.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 157.240.253.35 (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)
PTR: edge-star-mini-shv-02-fra5.facebook.com

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 169.48.219.66 (United States)

ASN36351 (SOFTLAYER, US)
PTR: 42.db.30a9.ip4.static.sl-reverse.com

cc.swiftype.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.171.141.234 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-35-171-141-234.compute-1.amazonaws.com

app.qualified.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.16.117.116 (None, )

ASN13335 (CLOUDFLARENET, US)

track.hubspot.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
43	deepinstinct.com www.deepinstinct.com — Cisco Umbrella Rank: 488596	850 KB
5	linkedin.com 3 redirects px.ads.linkedin.com — Cisco Umbrella Rank: 328 www.linkedin.com — Cisco Umbrella Rank: 613	3 KB
5	typekit.net use.typekit.net — Cisco Umbrella Rank: 463 p.typekit.net — Cisco Umbrella Rank: 574	78 KB
4	contentstack.io images.contentstack.io — Cisco Umbrella Rank: 11845	175 KB
3	swiftypecdn.com s.swiftypecdn.com — Cisco Umbrella Rank: 11932	148 KB
3	google.co.il www.google.co.il — Cisco Umbrella Rank: 27443	625 B
3	google.com analytics.google.com — Cisco Umbrella Rank: 145 www.google.com — Cisco Umbrella Rank: 2	384 B
3	doubleclick.net googleads.g.doubleclick.net — Cisco Umbrella Rank: 36 stats.g.doubleclick.net — Cisco Umbrella Rank: 84	2 KB
3	techtarget.com trk.techtarget.com — Cisco Umbrella Rank: 25821 ibc-flow.techtarget.com — Cisco Umbrella Rank: 23185	2 KB
3	bizible.com cdn.bizible.com — Cisco Umbrella Rank: 7702	26 KB
3	bing.com bat.bing.com — Cisco Umbrella Rank: 337	14 KB
3	facebook.net connect.facebook.net — Cisco Umbrella Rank: 180	74 KB
3	hotjar.com static.hotjar.com — Cisco Umbrella Rank: 737 script.hotjar.com — Cisco Umbrella Rank: 933	61 KB
3	google-analytics.com www.google-analytics.com — Cisco Umbrella Rank: 31	21 KB
3	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 39	284 KB
2	facebook.com www.facebook.com — Cisco Umbrella Rank: 97	301 B
2	twitter.com analytics.twitter.com — Cisco Umbrella Rank: 825	609 B
2	t.co t.co — Cisco Umbrella Rank: 678	580 B
2	company-target.com s.company-target.com — Cisco Umbrella Rank: 1314 api.company-target.com — Cisco Umbrella Rank: 4071	1 KB
2	qualified.com js.qualified.com — Cisco Umbrella Rank: 19100 app.qualified.com — Cisco Umbrella Rank: 20027	167 KB
2	demandbase.com tag.demandbase.com — Cisco Umbrella Rank: 4884 tag-logger.demandbase.com — Cisco Umbrella Rank: 4914	22 KB
1	hubspot.com track.hubspot.com — Cisco Umbrella Rank: 2416	1 KB
1	swiftype.com cc.swiftype.com — Cisco Umbrella Rank: 12951	279 B
1	bizibly.com cdn.bizibly.com — Cisco Umbrella Rank: 12616	182 B
1	hsadspixel.net js.hsadspixel.net — Cisco Umbrella Rank: 3146	4 KB
1	hsleadflows.net js.hsleadflows.net — Cisco Umbrella Rank: 5216	88 KB
1	hs-analytics.net js.hs-analytics.net — Cisco Umbrella Rank: 2216	21 KB
1	hs-banner.com js.hs-banner.com — Cisco Umbrella Rank: 2206	17 KB
1	ads-twitter.com static.ads-twitter.com — Cisco Umbrella Rank: 795	15 KB
1	licdn.com snap.licdn.com — Cisco Umbrella Rank: 781	17 KB
1	hs-scripts.com js.hs-scripts.com — Cisco Umbrella Rank: 2505	1 KB
1	googleoptimize.com www.googleoptimize.com — Cisco Umbrella Rank: 2698	62 KB
0	rlcdn.com Failed id.rlcdn.com Failed
112	33

	Domain	Requested by
43	www.deepinstinct.com	www.deepinstinct.com
4	px.ads.linkedin.com	2 redirects www.deepinstinct.com cdn.bizible.com
4	images.contentstack.io	www.deepinstinct.com
4	use.typekit.net	www.deepinstinct.com use.typekit.net
3	s.swiftypecdn.com	www.deepinstinct.com cdn.bizible.com s.swiftypecdn.com
3	www.google.co.il	www.deepinstinct.com
3	cdn.bizible.com	www.googletagmanager.com www.deepinstinct.com cdn.bizible.com
3	bat.bing.com	www.deepinstinct.com bat.bing.com
3	connect.facebook.net	www.deepinstinct.com connect.facebook.net
3	www.google-analytics.com	www.googletagmanager.com www.google-analytics.com www.deepinstinct.com
3	www.googletagmanager.com	www.deepinstinct.com www.googletagmanager.com
2	www.facebook.com	www.deepinstinct.com
2	www.google.com	www.deepinstinct.com
2	analytics.twitter.com	www.deepinstinct.com
2	t.co	www.deepinstinct.com
2	script.hotjar.com	static.hotjar.com script.hotjar.com
2	stats.g.doubleclick.net	www.googletagmanager.com www.google-analytics.com
2	ibc-flow.techtarget.com	trk.techtarget.com
1	track.hubspot.com
1	app.qualified.com	js.qualified.com
1	cc.swiftype.com	www.deepinstinct.com
1	www.linkedin.com	1 redirects
1	cdn.bizibly.com	www.deepinstinct.com
1	tag-logger.demandbase.com	tag.demandbase.com
1	api.company-target.com	tag.demandbase.com
1	s.company-target.com	tag.demandbase.com
1	analytics.google.com	www.googletagmanager.com
1	googleads.g.doubleclick.net	www.googletagmanager.com
1	js.hsadspixel.net	js.hs-scripts.com
1	js.hsleadflows.net	js.hs-scripts.com
1	js.hs-analytics.net	js.hs-scripts.com
1	js.hs-banner.com	js.hs-scripts.com
1	js.qualified.com	www.googletagmanager.com
1	trk.techtarget.com	www.deepinstinct.com
1	static.ads-twitter.com	www.googletagmanager.com
1	snap.licdn.com	www.googletagmanager.com
1	js.hs-scripts.com	www.googletagmanager.com
1	tag.demandbase.com	www.deepinstinct.com
1	static.hotjar.com	www.googletagmanager.com
1	p.typekit.net	use.typekit.net
1	www.googleoptimize.com	www.deepinstinct.com
0	id.rlcdn.com Failed	www.deepinstinct.com
112	42

This site contains links to these domains. Also see Links.

Domain
portal.deepinstinct.com
info.deepinstinct.com
services.google.com
www.gov.il
amitaico.substack.com
www.securityjoes.com
xelemental.medium.com
go.crowdstrike.com
www.microsoft.com
en.wikipedia.org
www.mandiant.com
research.checkpoint.com
blog.talosintelligence.com
www.group-ib.com
symantec-enterprise-blogs.security.com
villains.fandom.com
op-c.net
www.secureworks.com
www.sentinelone.com
www.proofpoint.com
twitter.com
labs.k7computing.com
0day.bio
www.google.com
github.com
www.mafateehgroup.com
docs.tacticalrmm.com
learn.microsoft.com
www.youtube.com
www.linkedin.com
www.facebook.com

Subject Issuer	Validity	Valid
deepinstinct.com R3	`2024-04-18` - `2024-07-17`	3 months	crt.sh
*.google-analytics.com GTS CA 1C3	`2024-03-18` - `2024-06-10`	3 months	crt.sh
use.typekit.net DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2024-02-01` - `2025-03-03`	a year	crt.sh
*.contentstack.io Gandi RSA Domain Validation Secure Server CA 3	`2024-04-10` - `2025-05-04`	a year	crt.sh
*.hotjar.com Amazon ECDSA 256 M03	`2024-02-07` - `2025-03-08`	a year	crt.sh
tag.demandbase.com Go Daddy Secure Certificate Authority - G2	`2023-08-23` - `2024-09-23`	a year	crt.sh
hs-scripts.com E1	`2024-04-01` - `2024-06-30`	3 months	crt.sh
snap.licdn.com DigiCert SHA2 Secure Server CA	`2023-12-13` - `2024-12-12`	a year	crt.sh
ads-twitter.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-07-21` - `2024-07-19`	a year	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2024-02-01` - `2024-05-01`	3 months	crt.sh
www.bing.com Microsoft Azure TLS Issuing CA 05	`2024-04-24` - `2024-06-27`	2 months	crt.sh
io.bizible.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-06-01` - `2024-07-01`	a year	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2023-06-25` - `2024-06-24`	a year	crt.sh
qualified.com E1	`2024-03-11` - `2024-06-09`	3 months	crt.sh
hs-banner.com E1	`2024-04-01` - `2024-06-30`	3 months	crt.sh
hs-analytics.net GTS CA 1P5	`2024-04-13` - `2024-07-12`	3 months	crt.sh
hsleadflows.net E1	`2024-04-05` - `2024-07-04`	3 months	crt.sh
hsadspixel.net E1	`2024-04-16` - `2024-07-15`	3 months	crt.sh
ibc-flow.techtarget.com GTS CA 1D4	`2024-03-10` - `2024-06-08`	3 months	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2024-03-18` - `2024-06-10`	3 months	crt.sh
*.google.com GTS CA 1C3	`2024-03-18` - `2024-06-10`	3 months	crt.sh
*.google.co.il GTS CA 1C3	`2024-03-18` - `2024-06-10`	3 months	crt.sh
*.company-target.com R3	`2024-04-17` - `2024-07-16`	3 months	crt.sh
api.demandbase.com Go Daddy Secure Certificate Authority - G2	`2023-09-27` - `2024-09-26`	a year	crt.sh
t.co DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2024-01-07` - `2025-01-06`	a year	crt.sh
*.twitter.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-10-31` - `2024-10-29`	a year	crt.sh
s.swiftypecdn.com GlobalSign Atlas R3 DV TLS CA 2024 Q1	`2024-04-04` - `2025-05-06`	a year	crt.sh
*.demandbase.com Amazon RSA 2048 M01	`2023-07-11` - `2024-08-08`	a year	crt.sh
www.linkedin.com DigiCert SHA2 Secure Server CA	`2024-01-30` - `2024-07-30`	6 months	crt.sh
*.swiftype.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-06-21` - `2024-07-14`	a year	crt.sh
app.qualified.com R3	`2024-03-21` - `2024-06-19`	3 months	crt.sh
hubspot.com Cloudflare Inc ECC CA-3	`2024-01-06` - `2024-12-31`	a year	crt.sh

This page contains 3 frames:

Primary Page: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework
Frame ID: 68CBE7D9084F9D08BE7126CCF4FCEC7D
Requests: 109 HTTP requests in this frame

Frame: https://s.company-target.com/s/sync?exc=lr
Frame ID: FFE949FD00CCC27C650701A67B3A74EA
Requests: 1 HTTP requests in this frame

Frame: https://app.qualified.com/w/1/DxHYmKWTScn3buDp/messenger?uuid=a5b6fcd1-5260-476a-a20d-8dc134fa29f5
Frame ID: BBEC0C2C25B11A7D595EF83889BA6DD0
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

DarkBeatC2: The Latest MuddyWater Attack Framework

Detected technologies

Facebook (Widgets) Expand

Overall confidence: 100%
Detected patterns

//connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

google-analytics\.com/(?:ga|urchin|analytics)\.js

Google Optimize (A/B Testing) Expand

Overall confidence: 100%
Detected patterns

googleoptimize\.com/optimize\.js

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtm\.js
googletagmanager\.com/gtag/js

Hotjar (Analytics) Expand

Overall confidence: 100%
Detected patterns

//static\.hotjar\.com/

HubSpot Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

js\.hs-analytics\.net/analytics

Linkedin Insight Tag (Analytics) Expand

Overall confidence: 100%
Detected patterns

snap\.licdn\.com/li\.lms-analytics/insight\.min\.js

Typekit (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link [^>]*href="[^"]+use\.typekit\.(?:net|com)

Page Statistics

112
Requests

97 %
HTTPS

0 %
IPv6

33
Domains

42
Subdomains

40
IPs

4
Countries

2155 kB
Transfer

6003 kB
Size

44
Cookies

40 Outgoing links

These are links going to different origins than the main page.

URL: https://portal.deepinstinct.com/
Title: Login

Search URL Search Domain Scan URL

URL: https://info.deepinstinct.com/request-a-demo
Title: Request Demo

Search URL Search Domain Scan URL

URL: https://services.google.com/fh/files/misc/tool-of-first-resort-israel-hamas-war-cyber.pdf
Title: shared

Search URL Search Domain Scan URL

URL: https://www.gov.il/en/departments/about/newabout
Title: INCD

Search URL Search Domain Scan URL

URL: https://www.gov.il/he/departments/publications/reports/alert_1721
Title: shared

Search URL Search Domain Scan URL

URL: https://amitaico.substack.com/p/the-other-pyramids
Title: Pyramid of Pain

Search URL Search Domain Scan URL

URL: https://www.securityjoes.com/post/bibi-linux-a-new-wiper-dropped-by-pro-hamas-hacktivist-group
Title: BiBi wiper

Search URL Search Domain Scan URL

URL: https://xelemental.medium.com/homeland-justice-albania-wiper-3c7e7edd43cc
Title: Homeland Justice

Search URL Search Domain Scan URL

URL: https://go.crowdstrike.com/rs/281-OBQ-266/images/GlobalThreatReport2024.pdf
Title: BanishedKitten

Search URL Search Domain Scan URL

URL: https://www.microsoft.com/en-us/security/blog/2022/09/08/microsoft-investigates-iranian-attacks-against-the-albanian-government/
Title: investigation

Search URL Search Domain Scan URL

URL: https://en.wikipedia.org/wiki/Kill_chain#Cyber
Title: Cyber Kill Chain

Search URL Search Domain Scan URL

URL: https://www.mandiant.com/resources/blog/likely-iranian-threat-actor-conducts-politically-motivated-disruptive-activity-against
Title: investigation

Search URL Search Domain Scan URL

URL: https://research.checkpoint.com/2023/from-albania-to-the-middle-east-the-scarred-manticore-is-listening/
Title: FoxShell

Search URL Search Domain Scan URL

URL: https://blog.talosintelligence.com/introducing-shrouded-snooper/
Title: ShroudedSnooper

Search URL Search Domain Scan URL

URL: https://www.microsoft.com/en-us/security/blog/2023/04/07/mercury-and-dev-1084-destructive-attack-on-hybrid-environment/
Title: DEV-1084

Search URL Search Domain Scan URL

URL: https://www.group-ib.com/blog/muddywater-infrastructure/
Title: SimpleHarm

Search URL Search Domain Scan URL

URL: https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/iran-apt-seedworm-africa-telecoms
Title: 2

Search URL Search Domain Scan URL

URL: https://villains.fandom.com/wiki/Lord_Nemesis
Title: Lord Nemesis

Search URL Search Domain Scan URL

URL: https://op-c.net/blog/lord-nemesis-strikes-supply-chain-attack-on-the-israeli-academic-sector/
Title: report

Search URL Search Domain Scan URL

URL: https://www.microsoft.com/en-us/security/blog/2022/09/07/profiling-dev-0270-phosphorus-ransomware-operations/
Title: According

Search URL Search Domain Scan URL

URL: https://www.secureworks.com/blog/cobalt-mirage-conducts-ransomware-operations-in-us
Title: Cobalt Mirage

Search URL Search Domain Scan URL

URL: https://www.sentinelone.com/labs/log4j2-in-the-wild-iranian-aligned-threat-actor-tunnelvision-actively-exploiting-vmware-horizon/
Title: TunnelVision

Search URL Search Domain Scan URL

URL: https://www.microsoft.com/en-us/security/blog/2024/01/17/new-ttps-observed-in-mint-sandstorm-campaign-targeting-high-profile-individuals-at-universities-and-research-orgs/
Title: Mint Sandstorm

Search URL Search Domain Scan URL

URL: https://www.proofpoint.com/us/blog/threat-insight/security-brief-ta450-uses-embedded-links-pdf-attachments-latest-campaign
Title: recent

Search URL Search Domain Scan URL

URL: https://twitter.com/k3yp0d/status/1770954280049975757
Title: another

Search URL Search Domain Scan URL

URL: https://twitter.com/xDarkBitx/with_replies
Title: made

Search URL Search Domain Scan URL

URL: https://labs.k7computing.com/index.php/muddywater-back-with-darkbit/

Search URL Search Domain Scan URL

URL: https://0day.bio/
Title: 0Day forums

Search URL Search Domain Scan URL

URL: https://www.google.com/search?q=%22stark-industries%22+%22malware%22
Title: known

Search URL Search Domain Scan URL

URL: https://github.com/yogeshojha/rengine
Title: reNgine

Search URL Search Domain Scan URL

URL: https://www.mafateehgroup.com/about/
Title: mafateehgroup.com

Search URL Search Domain Scan URL

URL: https://docs.tacticalrmm.com/
Title: Tactical RMM.

Search URL Search Domain Scan URL

URL: https://twitter.com/1ZRR4H/status/1772107339757232497
Title: reported

Search URL Search Domain Scan URL

URL: https://twitter.com/chux13786509/status/1768642677484949748
Title: observed

Search URL Search Domain Scan URL

URL: https://twitter.com/Intel_Ops_io/status/1772586606639132955
Title: Intel-Ops

Search URL Search Domain Scan URL

URL: https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_script_blocks?view=powershell-7.4
Title: scriptblock

Search URL Search Domain Scan URL

URL: https://www.youtube.com/channel/UCYerfisJf3hc9QOWmic1G9Q

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/company/deep-instinct

Search URL Search Domain Scan URL

URL: https://twitter.com/DeepInstinctSec

Search URL Search Domain Scan URL

URL: https://www.facebook.com/DeepInstinctInc

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 91

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=316505&time=1713955943822&li_adsId=b7706266-a5ee-44c2-a9c8-f8af6d57b689&url=https%3A%2F%2Fwww.deepinstinct.com%2Fblog%2Fdarkbeatc2-the-latest-muddywater-attack-framework HTTP 302
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=316505&time=1713955943822&li_adsId=b7706266-a5ee-44c2-a9c8-f8af6d57b689&url=https%3A%2F%2Fwww.deepinstinct.com%2Fblog%2Fdarkbeatc2-the-latest-muddywater-attack-framework&cookiesTest=true HTTP 302
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D316505%26time%3D1713955943822%26li_adsId%3Db7706266-a5ee-44c2-a9c8-f8af6d57b689%26url%3Dhttps%253A%252F%252Fwww.deepinstinct.com%252Fblog%252Fdarkbeatc2-the-latest-muddywater-attack-framework%26cookiesTest%3Dtrue%26liSync%3Dtrue HTTP 302
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=316505&time=1713955943822&li_adsId=b7706266-a5ee-44c2-a9c8-f8af6d57b689&url=https%3A%2F%2Fwww.deepinstinct.com%2Fblog%2Fdarkbeatc2-the-latest-muddywater-attack-framework&cookiesTest=true&liSync=true

112 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request darkbeatc2-the-latest-muddywater-attack-framework Show response
www.deepinstinct.com/blog/ 170 KB
27 KB 452ms
150ms Document
text/html 3.70.101.28
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.70.101.28 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-70-101-28.eu-central-1.compute.amazonaws.com

Software

Netlify /

Resource Hash

feadef6719ca44406d0eeb1c80724f6212e37d284782ea336576a216ad24b90b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1

Request headers

Accept-Language: he-IL,he;q=0.9;q=0.9
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Win32"

Response headers

age: 15374
cache-control: public,max-age=0,must-revalidate
cache-status: "Netlify Edge"; hit; fwd=stale
content-encoding: br
content-length: 26672
content-type: text/html; charset=utf-8
date: Wed, 24 Apr 2024 10:52:21 GMT
etag: "4ry6s43a3l3pa5-df"
netlify-vary: header=x-nextjs-data,cookie=__prerender_bypass|__next_preview_data
server: Netlify
strict-transport-security: max-age=31536000
surrogate-control: max-age=300, stale-while-revalidate=900, stale-if-error=900
vary: Accept-Encoding
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-nextjs-date: Wed, 24 Apr 2024 06:36:18 GMT
x-nf-request-id: 01HW7VRB183SDB9D5BM5Z3A6E8
x-xss-protection: 1

GET
H2 200 optimize.js Show response
www.googleoptimize.com/ 172 KB
62 KB 394ms
153ms Script
application/javascript 142.250.186.174
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleoptimize.com/optimize.js?id=OPT-P298HTJ

Requested by

Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.174 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s08-in-f14.1e100.net

Software

Google Tag Manager /

Resource Hash

a57d51de6bc8303a6cb9a28f6dd9a90e23b683d4a4a8b6d8857914943665ab89

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.deepinstinct.com/
Accept-Language: he-IL,he;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 24 Apr 2024 10:52:21 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 63308
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Wed, 24 Apr 2024 10:52:21 GMT

GET
H2 200 62c9f84af6283043.css
www.deepinstinct.com/_next/static/css/ 33 KB
7 KB 142ms
142ms Stylesheet
text/css 3.70.101.28
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.deepinstinct.com/_next/static/css/62c9f84af6283043.css

Requested by

Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.70.101.28 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-70-101-28.eu-central-1.compute.amazonaws.com

Software

Netlify /

Resource Hash

8a61ba991bab87bb170f6256868d5f2f3264d28b40b8f8129e02a07a44651469

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework
Accept-Language: he-IL,he;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-nf-request-id: 01HW7VRB9R7ZGDTH0NSKBKPHCF
date: Wed, 24 Apr 2024 10:52:21 GMT
content-encoding: br
strict-transport-security: max-age=31536000
server: Netlify
age: 50024
cache-status: "Netlify Edge"; hit
etag: "12e801962e10f6d1010c18a06f69df7b-ssl-df"
vary: Accept-Encoding
content-type: text/css; charset=UTF-8
cache-control: public,max-age=0,must-revalidate
accept-ranges: bytes
content-length: 7177

GET
H2 200 b3c831d72c60daeb.css
www.deepinstinct.com/_next/static/css/ 15 KB
3 KB 152ms
151ms Stylesheet
text/css 3.70.101.28
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.deepinstinct.com/_next/static/css/b3c831d72c60daeb.css

Requested by

Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.70.101.28 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-70-101-28.eu-central-1.compute.amazonaws.com

Software

Netlify /

Resource Hash

0130b680d34de9079a7677f6954c5fded22ad91a7791e2acd86f3ed53191a1d8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework
Accept-Language: he-IL,he;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-nf-request-id: 01HW7VRB9S3TEKQ32DZWZRRXNG
date: Wed, 24 Apr 2024 10:52:21 GMT
content-encoding: br
strict-transport-security: max-age=31536000
server: Netlify
age: 75180
cache-status: "Netlify Edge"; hit
etag: "b612c4d93b4d750f521d7cf025d5fdd3-ssl-df"
vary: Accept-Encoding
content-type: text/css; charset=UTF-8
cache-control: public,max-age=0,must-revalidate
accept-ranges: bytes
content-length: 3469

GET
H2 200 ddca67f80ea11511.css
www.deepinstinct.com/_next/static/css/ 889 B
981 B 156ms
155ms Stylesheet
text/css 3.70.101.28
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.deepinstinct.com/_next/static/css/ddca67f80ea11511.css

Requested by

Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.70.101.28 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-70-101-28.eu-central-1.compute.amazonaws.com

Software

Netlify /

Resource Hash

4db83b291d4b780a54c7a0e998e64ce8cf5bace8d0612dc0082b0d961f04ce04

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework
Accept-Language: he-IL,he;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-nf-request-id: 01HW7VRB9S16JMKQTHWXSM5418
date: Wed, 24 Apr 2024 10:52:21 GMT
strict-transport-security: max-age=31536000
server: Netlify
age: 34881
cache-status: "Netlify Edge"; hit
etag: "bf94acaf8c7e8837fa3d2ad39b6a0f87-ssl"
content-type: text/css; charset=UTF-8
cache-control: public,max-age=0,must-revalidate
accept-ranges: bytes
content-length: 889

GET
H2 200 5935-76bf011ee3d88f83.js Show response
www.deepinstinct.com/_next/static/chunks/ 30 KB
10 KB 407ms
402ms Script
application/javascript 3.70.101.28
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.deepinstinct.com/_next/static/chunks/5935-76bf011ee3d88f83.js

Requested by

Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.70.101.28 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-70-101-28.eu-central-1.compute.amazonaws.com

Software

Netlify /

Resource Hash

3a9972297dfa97e4f6a11cc17f5767935ffa27d7c6d92123e38fd423bd4afd9e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework
Accept-Language: he-IL,he;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-nf-request-id: 01HW7VRBT4V1ZNPRZ4CRNT2R5W
date: Wed, 24 Apr 2024 10:52:22 GMT
content-encoding: br
strict-transport-security: max-age=31536000
server: Netlify
age: 50023
cache-status: "Netlify Edge"; hit
etag: "711c7a0bda1d2a5419580350a0ac2def-ssl-df"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
cache-control: public,max-age=0,must-revalidate
accept-ranges: bytes
content-length: 10222

GET
H2 200 7029-3230841eb82dea3f.js Show response
www.deepinstinct.com/_next/static/chunks/ 123 KB
37 KB 408ms
403ms Script
application/javascript 3.70.101.28
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.deepinstinct.com/_next/static/chunks/7029-3230841eb82dea3f.js

Requested by

Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.70.101.28 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-70-101-28.eu-central-1.compute.amazonaws.com

Software

Netlify /

Resource Hash

529f9f3aa54fc536d8b9b39f45d3d8bbfbbe067545c2c375ea3fd5f0d446ac14

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework
Accept-Language: he-IL,he;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-nf-request-id: 01HW7VRBT4MQ6M2D24SB3YJ6ZW
date: Wed, 24 Apr 2024 10:52:22 GMT
content-encoding: br
strict-transport-security: max-age=31536000
server: Netlify
age: 50023
cache-status: "Netlify Edge"; hit
etag: "163091f8d515307568ca14bd7c244cee-ssl-df"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
cache-control: public,max-age=0,must-revalidate
accept-ranges: bytes
content-length: 37347

GET
H2 200 6839.c8ee40f8e73e0e22.js Show response
www.deepinstinct.com/_next/static/chunks/ 2 KB
1 KB 336ms
331ms Script
application/javascript 3.70.101.28
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.deepinstinct.com/_next/static/chunks/6839.c8ee40f8e73e0e22.js

Requested by

Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.70.101.28 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-70-101-28.eu-central-1.compute.amazonaws.com

Software

Netlify /

Resource Hash

67a86dcd9de0e056f9b4be883e95c1587463e7b87e5390982c02e1822f9c3356

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework
Accept-Language: he-IL,he;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-nf-request-id: 01HW7VRBT4XVW7EQG3998FKTMX
date: Wed, 24 Apr 2024 10:52:22 GMT
content-encoding: br
strict-transport-security: max-age=31536000
server: Netlify
age: 34881
cache-status: "Netlify Edge"; hit
etag: "42b37c98d571c31326f0ce7f5b379979-ssl-df"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
cache-control: public,max-age=0,must-revalidate
accept-ranges: bytes
content-length: 1059

GET
H2 200 webpack-29002f1662bf7c0b.js Show response
www.deepinstinct.com/_next/static/chunks/ 7 KB
3 KB 336ms
331ms Script
application/javascript 3.70.101.28
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.deepinstinct.com/_next/static/chunks/webpack-29002f1662bf7c0b.js

Requested by

Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.70.101.28 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-70-101-28.eu-central-1.compute.amazonaws.com

Software

Netlify /

Resource Hash

1ed76e4688ef9d3b8245de7492c54d081dbb25796bde18fe026183bc57b13501

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework
Accept-Language: he-IL,he;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-nf-request-id: 01HW7VRBT4VMSF8PBTE1RCN9T2
date: Wed, 24 Apr 2024 10:52:22 GMT
content-encoding: br
strict-transport-security: max-age=31536000
server: Netlify
age: 75746
cache-status: "Netlify Edge"; hit
etag: "08ae6cd137e5a9f44ce8da97bbdf3bdf-ssl-df"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
cache-control: public,max-age=0,must-revalidate
accept-ranges: bytes
content-length: 3423

GET
H2 200 framework-314c182fa7e2bf37.js Show response
www.deepinstinct.com/_next/static/chunks/ 138 KB
43 KB 373ms
368ms Script
application/javascript 3.70.101.28
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.deepinstinct.com/_next/static/chunks/framework-314c182fa7e2bf37.js

Requested by

Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.70.101.28 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-70-101-28.eu-central-1.compute.amazonaws.com

Software

Netlify /

Resource Hash

fff0bdb3f70b85b820a949503a24610fb007cf4582f1e67f4835a14de511d50f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework
Accept-Language: he-IL,he;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-nf-request-id: 01HW7VRBT4BHM6Y6B3K3PGNNQ7
date: Wed, 24 Apr 2024 10:52:22 GMT
content-encoding: br
strict-transport-security: max-age=31536000
server: Netlify
age: 65530
cache-status: "Netlify Edge"; hit
etag: "842190aeeb138e17ecbd4e80395b04db-ssl-df"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
cache-control: public,max-age=0,must-revalidate
accept-ranges: bytes
content-length: 43629

GET
H2 200 main-c5b7e6d77b82bab5.js Show response
www.deepinstinct.com/_next/static/chunks/ 124 KB
35 KB 341ms
336ms Script
application/javascript 3.70.101.28
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.deepinstinct.com/_next/static/chunks/main-c5b7e6d77b82bab5.js

Requested by

Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.70.101.28 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-70-101-28.eu-central-1.compute.amazonaws.com

Software

Netlify /

Resource Hash

c9476026edd0c62a79ca209ab6ccb1b5f2611ef3049b8d771071878003f6871e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework
Accept-Language: he-IL,he;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-nf-request-id: 01HW7VRBT6SNPKDC1BAMJ1NJJC
date: Wed, 24 Apr 2024 10:52:22 GMT
content-encoding: br
strict-transport-security: max-age=31536000
server: Netlify
age: 50023
cache-status: "Netlify Edge"; hit
etag: "f5b74e619e9eb5d06577186ed77b231a-ssl-df"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
cache-control: public,max-age=0,must-revalidate
accept-ranges: bytes
content-length: 35770

GET
H2 200 _app-88813e0d1ae2e973.js Show response
www.deepinstinct.com/_next/static/chunks/pages/ 450 B
536 B 338ms
334ms Script
application/javascript 3.70.101.28
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.deepinstinct.com/_next/static/chunks/pages/_app-88813e0d1ae2e973.js

Requested by

Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.70.101.28 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-70-101-28.eu-central-1.compute.amazonaws.com

Software

Netlify /

Resource Hash

c9a95f9262273cfe4ae43a8a0dbb61ce3d4fbcff4b54d2350258b39cd08b32e0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework
Accept-Language: he-IL,he;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-nf-request-id: 01HW7VRBT6E1J8X2Q07NHBJG1D
date: Wed, 24 Apr 2024 10:52:22 GMT
strict-transport-security: max-age=31536000
server: Netlify
age: 75746
cache-status: "Netlify Edge"; hit
etag: "50537b790c14aad9a5df48742d265dfa-ssl"
content-type: application/javascript; charset=UTF-8
cache-control: public,max-age=0,must-revalidate
accept-ranges: bytes
content-length: 450

GET
H2 200 5675-5d8e1c18eb2a06a1.js Show response
www.deepinstinct.com/_next/static/chunks/ 9 KB
4 KB 413ms
409ms Script
application/javascript 3.70.101.28
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.deepinstinct.com/_next/static/chunks/5675-5d8e1c18eb2a06a1.js

Requested by

Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.70.101.28 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-70-101-28.eu-central-1.compute.amazonaws.com

Software

Netlify /

Resource Hash

d66b13d15c9f6d62412758da1d16472e96466304912f1fe178ef8d5b3b44cda0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework
Accept-Language: he-IL,he;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-nf-request-id: 01HW7VRBVZ6T57FH43GEJT8N1A
date: Wed, 24 Apr 2024 10:52:22 GMT
content-encoding: br
strict-transport-security: max-age=31536000
server: Netlify
age: 75747
cache-status: "Netlify Edge"; hit
etag: "ae4ef7f9e1361f41374b10337ad35c3b-ssl-df"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
cache-control: public,max-age=0,must-revalidate
accept-ranges: bytes
content-length: 3730

GET
H2 200 8882-efb8f68e8ac16c1e.js Show response
www.deepinstinct.com/_next/static/chunks/ 27 KB
10 KB 413ms
409ms Script
application/javascript 3.70.101.28
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.deepinstinct.com/_next/static/chunks/8882-efb8f68e8ac16c1e.js

Requested by

Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.70.101.28 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-70-101-28.eu-central-1.compute.amazonaws.com

Software

Netlify /

Resource Hash

94c1047f45725fdfd62ad286aae8ff577b87af99f3c6ff9e271fca751398cbbc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework
Accept-Language: he-IL,he;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-nf-request-id: 01HW7VRBVZ1M03HE3RZEMAECJ6
date: Wed, 24 Apr 2024 10:52:22 GMT
content-encoding: br
strict-transport-security: max-age=31536000
server: Netlify
age: 50023
cache-status: "Netlify Edge"; hit
etag: "e9c9a5087b21357b065e593c5a56f0d3-ssl-df"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
cache-control: public,max-age=0,must-revalidate
accept-ranges: bytes
content-length: 9912

GET
H2 200 1053-69c3e67c1a3e9c2f.js Show response
www.deepinstinct.com/_next/static/chunks/ 89 KB
31 KB 415ms
411ms Script
application/javascript 3.70.101.28
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.deepinstinct.com/_next/static/chunks/1053-69c3e67c1a3e9c2f.js

Requested by

Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.70.101.28 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-70-101-28.eu-central-1.compute.amazonaws.com

Software

Netlify /

Resource Hash

3c51542bd74124ed2bae5b0d8cb837dc7e567a94acaee00f4c686dfb8d272018

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework
Accept-Language: he-IL,he;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-nf-request-id: 01HW7VRBVZ60FCG6VET2Y900TR
date: Wed, 24 Apr 2024 10:52:22 GMT
content-encoding: br
strict-transport-security: max-age=31536000
server: Netlify
age: 50023
cache-status: "Netlify Edge"; hit
etag: "78b7ac861927eedc433e1fd1aff23deb-ssl-df"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
cache-control: public,max-age=0,must-revalidate
accept-ranges: bytes
content-length: 31147

GET
H2 200 512-de9e9b45ad8341f5.js Show response
www.deepinstinct.com/_next/static/chunks/ 17 KB
6 KB 446ms
442ms Script
application/javascript 3.70.101.28
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.deepinstinct.com/_next/static/chunks/512-de9e9b45ad8341f5.js

Requested by

Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.70.101.28 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-70-101-28.eu-central-1.compute.amazonaws.com

Software

Netlify /

Resource Hash

8d3a1bf6e2df7ec1dc004f9ea76c89627a5a1d3350d2e01f833dd20ffddee5b6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework
Accept-Language: he-IL,he;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-nf-request-id: 01HW7VRBVZG4JAJGAN2BNQSZFN
date: Wed, 24 Apr 2024 10:52:22 GMT
content-encoding: br
strict-transport-security: max-age=31536000
server: Netlify
age: 104964
cache-status: "Netlify Edge"; hit
etag: "f23770c964cb4a5c463e6f0d11791c33-ssl-df"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
cache-control: public,max-age=0,must-revalidate
accept-ranges: bytes
content-length: 5613

GET
H2 200 %5Bpid%5D-7f7601d838d136ca.js Show response
www.deepinstinct.com/_next/static/chunks/pages/blog/ 547 B
639 B 446ms
442ms Script
application/javascript 3.70.101.28
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.deepinstinct.com/_next/static/chunks/pages/blog/%5Bpid%5D-7f7601d838d136ca.js

Requested by

Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.70.101.28 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-70-101-28.eu-central-1.compute.amazonaws.com

Software

Netlify /

Resource Hash

1ea94e6fc8afdc8a96c72f6821974bbfe2126b9a960c469251c88f2d5dd02260

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework
Accept-Language: he-IL,he;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-nf-request-id: 01HW7VRBVZY2G1BHP492CYTRKK
date: Wed, 24 Apr 2024 10:52:22 GMT
strict-transport-security: max-age=31536000
server: Netlify
age: 75180
cache-status: "Netlify Edge"; hit
etag: "f101ba9e2d84013ead218fe806d71a13-ssl"
content-type: application/javascript; charset=UTF-8
cache-control: public,max-age=0,must-revalidate
accept-ranges: bytes
content-length: 547

GET
H2 200 _buildManifest.js Show response
www.deepinstinct.com/_next/static/7-TyYd0Ikn4eVyBeP3eWe/ 8 KB
2 KB 446ms
443ms Script
application/javascript 3.70.101.28
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.deepinstinct.com/_next/static/7-TyYd0Ikn4eVyBeP3eWe/_buildManifest.js

Requested by

Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.70.101.28 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-70-101-28.eu-central-1.compute.amazonaws.com

Software

Netlify /

Resource Hash

3c98404a986fe5182a2b6214d370226eb15a0cb58af0a25c5e9a95239535f5ee

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework
Accept-Language: he-IL,he;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-nf-request-id: 01HW7VRBVZZ31WZX35SMEYEY0F
date: Wed, 24 Apr 2024 10:52:22 GMT
content-encoding: br
strict-transport-security: max-age=31536000
server: Netlify
age: 75746
cache-status: "Netlify Edge"; hit
etag: "8d7e44c890b374fe3291edb4d40e58a2-ssl-df"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
cache-control: public,max-age=0,must-revalidate
accept-ranges: bytes
content-length: 1483

GET
H2 200 _ssgManifest.js Show response
www.deepinstinct.com/_next/static/7-TyYd0Ikn4eVyBeP3eWe/ 455 B
547 B 459ms
456ms Script
application/javascript 3.70.101.28
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.deepinstinct.com/_next/static/7-TyYd0Ikn4eVyBeP3eWe/_ssgManifest.js

Requested by

Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.70.101.28 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-70-101-28.eu-central-1.compute.amazonaws.com

Software

Netlify /

Resource Hash

32cc58a56e1170810316c9cb82dd82a1fb379e2b82139b5ed039063bb40e4724

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework
Accept-Language: he-IL,he;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-nf-request-id: 01HW7VRBVZ34TSB3GMSAV4XFVR
date: Wed, 24 Apr 2024 10:52:22 GMT
strict-transport-security: max-age=31536000
server: Netlify
age: 75746
cache-status: "Netlify Edge"; hit
etag: "c28c1e4abeeaf5ddbabf351bc59836fa-ssl"
content-type: application/javascript; charset=UTF-8
cache-control: public,max-age=0,must-revalidate
accept-ranges: bytes
content-length: 455

GET
H2 200 zka3qml.css
use.typekit.net/ 3 KB
993 B 754ms
248ms Stylesheet
text/css 23.200.36.196
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://use.typekit.net/zka3qml.css

Requested by

Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.200.36.196 , Mexico, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a23-200-36-196.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

9d9e8a96a73580c975860c5b2fa6488d785af4b44e2f0a0a35cbbc891c863746

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains;

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.deepinstinct.com/
Accept-Language: he-IL,he;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

strict-transport-security: max-age=31536000; includeSubDomains;
content-encoding: gzip
date: Wed, 24 Apr 2024 10:52:22 GMT
server: nginx
vary: Accept-Encoding
content-type: text/css;charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=600, stale-while-revalidate=604800
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 770

GET
H2 200 fig01-threat-actors-behind-the-attack.png
images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt79ab55a6f21afecc/660dde571e8523d4db73a039/ 64 KB
64 KB 438ms
182ms Image
image/png 151.101.194.137
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt79ab55a6f21afecc/660dde571e8523d4db73a039/fig01-threat-actors-behind-the-attack.png
Requested by: Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.194.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: contentstack /
Resource Hash: 6a231076c5c83e79bea81510940b1fdd77839f3873526b0d49485be6697d0e8f

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.deepinstinct.com/
Accept-Language: he-IL,he;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 24 Apr 2024 10:52:21 GMT
via: 1.1 varnish, 1.1 varnish
fastly-io-served-by: vpop-haf2300703
age: 1771021
x-cache: HIT, HIT
fastly-io-info: ifsz=65512 idim=959x352 ifmt=png ofsz=65485 odim=959x352 ofmt=png
content-disposition: inline; filename=fig01-threat-actors-behind-the-attack.png
fastly-stats: io=1
content-length: 65485
x-request-id: bdc22ad351705a5892f096edccb75e2d
x-served-by: cache-sjc1000100-SJC, cache-mrs10575-MRS
x-runtime: 70ms
server: contentstack
x-timer: S1713955942.940742,VS0,VE2
x-contentstack-organization: bltdec97706489ab5de
etag: "VEnI2SRgCKF7O3N/g1JMMt8mHvFARxWKJS+kxe7JNsE"
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: content-disposition, content-type, cache-control, status, content-length
cache-control: max-age=31536000
accept-ranges: bytes
x-cache-hits: 179, 1

GET
H2 200 fig02-faketivism.png
images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltbdfb7ae1ffe166ed/660dde571d996f2393153c9e/ 95 KB
96 KB 382ms
126ms Image
image/png 151.101.194.137
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltbdfb7ae1ffe166ed/660dde571d996f2393153c9e/fig02-faketivism.png
Requested by: Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.194.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: contentstack /
Resource Hash: 8e081ea7988f4b0266528e9ec8b76799e66157ff1a989f649710d6c725a7855a

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.deepinstinct.com/
Accept-Language: he-IL,he;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 24 Apr 2024 10:52:21 GMT
via: 1.1 varnish, 1.1 varnish
fastly-io-served-by: vpop-haf2300706
age: 324864
x-cache: HIT, HIT
fastly-io-info: ifsz=97816 idim=886x430 ifmt=png ofsz=97214 odim=886x430 ofmt=png
content-disposition: inline; filename=fig02-faketivism.png
fastly-stats: io=1
content-length: 97214
x-request-id: 2e37da787e3e2a6e8ca7adb73c0b0a2b
x-served-by: cache-sjc10044-SJC, cache-mrs10575-MRS
x-runtime: 111ms
server: contentstack
x-timer: S1713955942.941007,VS0,VE2
x-contentstack-organization: bltdec97706489ab5de
etag: "dOM9Tlik+m9shWIGyZg+b6nO+tORUueAg4gj+nZYapU"
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: content-disposition, content-type, cache-control, status, content-length
cache-control: max-age=31536000
accept-ranges: bytes
x-cache-hits: 13, 1

GET
H2 200 fig03-current-muddywater-campign.png
www.deepinstinct.com/image/bltc0997229863d1710/660dde6bf407dd847e3167b5/ 63 KB
63 KB 161ms
155ms Image
image/png 3.70.101.28
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.deepinstinct.com/image/bltc0997229863d1710/660dde6bf407dd847e3167b5/fig03-current-muddywater-campign.png

Requested by

Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.70.101.28 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-70-101-28.eu-central-1.compute.amazonaws.com

Software

Netlify /

Resource Hash

0f701def79cf3f86b8f75e4f805436a387ff2718851060447561b89a6daae4e6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework
Accept-Language: he-IL,he;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-nf-request-id: 01HW7VRBT4VNVK4PKQR6V6170S
date: Wed, 24 Apr 2024 10:52:22 GMT
strict-transport-security: max-age=31536000
via: 1.1 varnish, 1.1 varnish
x-content-type-options: nosniff
age: 101153
fastly-io-served-by: vpop-haf2300711
x-cache: MISS, HIT
fastly-io-info: ifsz=74622 idim=1086x341 ifmt=png ofsz=64213 odim=1086x341 ofmt=png
content-disposition: inline; filename=fig03-current-muddywater-campign.png
fastly-stats: io=1
content-length: 64213
x-request-id: 8f80c28561388a4a21b0b01320e1ca26
x-served-by: cache-sjc10041-SJC, cache-iad-kiad7000067-IAD
x-runtime: 97ms
netlify-vary: header=x-nextjs-data,cookie=__prerender_bypass|__next_preview_data
server: Netlify
x-timer: S1713854789.446233,VS0,VE1
x-contentstack-organization: bltdec97706489ab5de
cache-status: "Netlify Edge"; hit
etag: "v+vVzFipZI8vegdG4hRmEEU8Un0vcYa4X5FK2gUgmIc"
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: content-disposition, content-type, cache-control, status, content-length
cache-control: max-age=31536000
accept-ranges: bytes
x-cache-hits: 0, 0

GET
H2 200 fig04-uploader-information-at-kinneretacil.jfif
www.deepinstinct.com/image/blt3476f102a9f89a62/660dde57dd5b9e45fca8a154/ 22 KB
22 KB 407ms
401ms Image
image/jpeg 3.70.101.28
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.deepinstinct.com/image/blt3476f102a9f89a62/660dde57dd5b9e45fca8a154/fig04-uploader-information-at-kinneretacil.jfif

Requested by

Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.70.101.28 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-70-101-28.eu-central-1.compute.amazonaws.com

Software

Netlify /

Resource Hash

5af2bd700fd3e70bdb66c457260e13362e077c992b9a8e91ef601515c91bf3fc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework
Accept-Language: he-IL,he;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-nf-request-id: 01HW7VRBT4WP5CR610BGYAKG72
date: Wed, 24 Apr 2024 10:52:22 GMT
strict-transport-security: max-age=31536000
via: 1.1 varnish, 1.1 varnish
x-content-type-options: nosniff
age: 101153
fastly-io-served-by: vpop-haf2300701
x-cache: MISS, HIT
fastly-io-info: ifsz=22606 idim=1429x292 ifmt=jpeg ofsz=22606 odim=1429x292 ofmt=jpeg
content-disposition: inline; filename=fig04-uploader-information-at-kinneretacil.jfif
fastly-stats: io=1
content-length: 22606
fastly-io-warning: Failed to shrink image
x-request-id: ef003cee43b78d5c4189393012af90f7
x-served-by: cache-sjc1000142-SJC, cache-iad-kjyo7100024-IAD
x-runtime: 44ms
netlify-vary: header=x-nextjs-data,cookie=__prerender_bypass|__next_preview_data
server: Netlify
x-timer: S1713854789.416559,VS0,VE1
x-contentstack-organization: bltdec97706489ab5de
cache-status: "Netlify Edge"; hit
etag: "wKbkTH77ViUEbiMLak1GQ7udMH+1721nLL9a+kZWHuE"
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: content-disposition, content-type, cache-control, status, content-length
cache-control: max-age=31536000
accept-ranges: bytes
x-cache-hits: 0, 0

GET
H2 200 fig05-uploader_info-salary.png
www.deepinstinct.com/image/blt5a810cdcb9775a47/660dde57c3bc8b6742dd2d72/ 16 KB
16 KB 148ms
142ms Image
image/png 3.70.101.28
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.deepinstinct.com/image/blt5a810cdcb9775a47/660dde57c3bc8b6742dd2d72/fig05-uploader_info-salary.png

Requested by

Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.70.101.28 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-70-101-28.eu-central-1.compute.amazonaws.com

Software

Netlify /

Resource Hash

fe2d748cbd7dde62aad4dd1fcf6e6a81675c7fec34601791ac4ab1d2ce6317f7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework
Accept-Language: he-IL,he;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-nf-request-id: 01HW7VRBT4GSE9277F9JYGS316
date: Wed, 24 Apr 2024 10:52:22 GMT
strict-transport-security: max-age=31536000
via: 1.1 varnish, 1.1 varnish
x-content-type-options: nosniff
age: 101153
fastly-io-served-by: vpop-haf2300714
x-cache: MISS, HIT
fastly-io-info: ifsz=16145 idim=1115x486 ifmt=png ofsz=16115 odim=1115x486 ofmt=png
content-disposition: inline; filename=fig05-uploader_info-salary.png
fastly-stats: io=1
content-length: 16115
fastly-io-warning: Failed to shrink image
x-request-id: 6fe01d74490c19f267c2ad23d4ef0af1
x-served-by: cache-sjc10042-SJC, cache-iad-kiad7000073-IAD
x-runtime: 60ms
netlify-vary: header=x-nextjs-data,cookie=__prerender_bypass|__next_preview_data
server: Netlify
x-timer: S1713854790.588413,VS0,VE1
x-contentstack-organization: bltdec97706489ab5de
cache-status: "Netlify Edge"; hit
etag: "PMiaPw5iDMnKjyE27Yu4yThV25UYkXcjvoPCbYdHF2w"
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: content-disposition, content-type, cache-control, status, content-length
cache-control: max-age=31536000
accept-ranges: bytes
x-cache-hits: 0, 0

GET
H2 200 fig06-darkbit_muddy.png
images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt8cd3b042edd84394/660dde561e8523371d73a035/ 5 KB
5 KB 130ms
127ms Image
image/png 151.101.194.137
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt8cd3b042edd84394/660dde561e8523371d73a035/fig06-darkbit_muddy.png
Requested by: Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.194.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: contentstack /
Resource Hash: ef6c6142ca7d544ac9af662547dc404225e959789e811607d8acea4f07e0d89d

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.deepinstinct.com/
Accept-Language: he-IL,he;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 24 Apr 2024 10:52:22 GMT
via: 1.1 varnish, 1.1 varnish
fastly-io-served-by: vpop-haf2300708
age: 338081
x-cache: HIT, HIT
fastly-io-info: ifsz=6674 idim=486x114 ifmt=png ofsz=4766 odim=486x114 ofmt=png
content-disposition: inline; filename=fig06-darkbit_muddy.png
fastly-stats: io=1
content-length: 4766
x-request-id: 60e4712a8f8dfe337406f4ea759a3cd4
x-served-by: cache-sjc1000093-SJC, cache-mrs10575-MRS
x-runtime: 58ms
server: contentstack
x-timer: S1713955942.205651,VS0,VE2
x-contentstack-organization: bltdec97706489ab5de
etag: "vmzGr3PB1WNT/Qy+VppMOcSoI5k7kl9iWEFGri9t0g4"
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: content-disposition, content-type, cache-control, status, content-length
cache-control: max-age=31536000
accept-ranges: bytes
x-cache-hits: 25, 1

GET
H2 200 fig07-freeupload.png
images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blteb808cbb731a332a/660dde6b1e85231c2473a041/ 10 KB
10 KB 129ms
126ms Image
image/png 151.101.194.137
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blteb808cbb731a332a/660dde6b1e85231c2473a041/fig07-freeupload.png
Requested by: Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.194.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: contentstack /
Resource Hash: 6006a799a37d5e75090b1631ac710ad8aeac54acf5a48b1beee8c2e52b9c9fd6

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.deepinstinct.com/
Accept-Language: he-IL,he;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 24 Apr 2024 10:52:22 GMT
via: 1.1 varnish, 1.1 varnish
fastly-io-served-by: vpop-haf2300701
age: 1360158
x-cache: HIT, HIT
fastly-io-info: ifsz=10140 idim=1127x56 ifmt=png ofsz=10110 odim=1127x56 ofmt=png
content-disposition: inline; filename=fig07-freeupload.png
fastly-stats: io=1
content-length: 10110
fastly-io-warning: Failed to shrink image
x-request-id: 6da342a52cd0539adef7e49ac7728397
x-served-by: cache-sjc1000121-SJC, cache-mrs10575-MRS
x-runtime: 79ms
server: contentstack
x-timer: S1713955942.205854,VS0,VE1
x-contentstack-organization: bltdec97706489ab5de
etag: "CEzcrV5QqWebRUiDirfFaaWk+AJPzpKZW2GdNo1NG+Q"
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: content-disposition, content-type, cache-control, status, content-length
cache-control: max-age=31536000
accept-ranges: bytes
x-cache-hits: 136, 1

GET
H2 200 fig08-setting_powershell.png
www.deepinstinct.com/image/blt10d68a9cdc3db0f4/660dde6b04d34c5c1dbdb650/ 16 KB
17 KB 459ms
457ms Image
image/png 3.70.101.28
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.deepinstinct.com/image/blt10d68a9cdc3db0f4/660dde6b04d34c5c1dbdb650/fig08-setting_powershell.png

Requested by

Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.70.101.28 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-70-101-28.eu-central-1.compute.amazonaws.com

Software

Netlify /

Resource Hash

c8e3b35aa911b1e6364305e850e35072e75dbceb7fb3ed39b6c9fdf1d216b464

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework
Accept-Language: he-IL,he;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-nf-request-id: 01HW7VRBVZKBV2YX6MXR85FPT3
date: Wed, 24 Apr 2024 10:52:22 GMT
strict-transport-security: max-age=31536000
via: 1.1 varnish, 1.1 varnish
x-content-type-options: nosniff
age: 101153
fastly-io-served-by: vpop-haf2300704
x-cache: MISS, HIT
fastly-io-info: ifsz=31883 idim=975x393 ifmt=png ofsz=16384 odim=975x393 ofmt=png
content-disposition: inline; filename=fig08-setting_powershell.png
fastly-stats: io=1
content-length: 16384
x-request-id: 7d063db2060a9a2771322d5e35cc4f00
x-served-by: cache-sjc1000114-SJC, cache-iad-kjyo7100087-IAD
x-runtime: 68ms
netlify-vary: header=x-nextjs-data,cookie=__prerender_bypass|__next_preview_data
server: Netlify
x-timer: S1713854790.630795,VS0,VE1
x-contentstack-organization: bltdec97706489ab5de
cache-status: "Netlify Edge"; hit
etag: "tMzTzAePC2mduhoWWL08QdmnCEzhK2qRsCO7q0ncweg"
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: content-disposition, content-type, cache-control, status, content-length
cache-control: max-age=31536000
accept-ranges: bytes
x-cache-hits: 0, 0

GET
H2 200 fig09-8946172.png
www.deepinstinct.com/image/blt53a4d37b3f7a9782/660dde6bcac0bc1852c882a3/ 11 KB
12 KB 460ms
458ms Image
image/png 3.70.101.28
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.deepinstinct.com/image/blt53a4d37b3f7a9782/660dde6bcac0bc1852c882a3/fig09-8946172.png

Requested by

Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.70.101.28 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-70-101-28.eu-central-1.compute.amazonaws.com

Software

Netlify /

Resource Hash

6353083e47f984144841ad6f17cb6fd0332a4b629c2089d603f8b2bf04dcf2f8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework
Accept-Language: he-IL,he;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-nf-request-id: 01HW7VRBVZB944874TGN4KEF8B
date: Wed, 24 Apr 2024 10:52:22 GMT
strict-transport-security: max-age=31536000
via: 1.1 varnish, 1.1 varnish
x-content-type-options: nosniff
age: 101153
fastly-io-served-by: vpop-haf2300705
x-cache: MISS, HIT
fastly-io-info: ifsz=19931 idim=997x173 ifmt=png ofsz=11526 odim=997x173 ofmt=png
content-disposition: inline; filename=fig09-8946172.png
fastly-stats: io=1
content-length: 11526
x-request-id: ec9fc83b992e027811e55099b9a0e4ae
x-served-by: cache-sjc1000143-SJC, cache-iad-kjyo7100081-IAD
x-runtime: 56ms
netlify-vary: header=x-nextjs-data,cookie=__prerender_bypass|__next_preview_data
server: Netlify
x-timer: S1713854790.668262,VS0,VE2
x-contentstack-organization: bltdec97706489ab5de
cache-status: "Netlify Edge"; hit
etag: "udEo+45YI5JQNwd9RtBJhX29jtb6aexXu+JLlOswPTs"
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: content-disposition, content-type, cache-control, status, content-length
cache-control: max-age=31536000
accept-ranges: bytes
x-cache-hits: 0, 0

GET
H2 200 fig10-7878123.png
www.deepinstinct.com/image/bltba953ef3b04cf0c5/660dde6ba16454602c462058/ 13 KB
13 KB 460ms
458ms Image
image/png 3.70.101.28
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.deepinstinct.com/image/bltba953ef3b04cf0c5/660dde6ba16454602c462058/fig10-7878123.png

Requested by

Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.70.101.28 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-70-101-28.eu-central-1.compute.amazonaws.com

Software

Netlify /

Resource Hash

7a80c7ae20682012e0a7a06ed486183dc5d7cd45763e09221073675bc067b606

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework
Accept-Language: he-IL,he;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-nf-request-id: 01HW7VRBVZ3YM7CAHYB3GD00G9
date: Wed, 24 Apr 2024 10:52:22 GMT
strict-transport-security: max-age=31536000
via: 1.1 varnish, 1.1 varnish
x-content-type-options: nosniff
age: 101153
fastly-io-served-by: vpop-haf2300709
x-cache: MISS, HIT
fastly-io-info: ifsz=23526 idim=977x364 ifmt=png ofsz=13011 odim=977x364 ofmt=png
content-disposition: inline; filename=fig10-7878123.png
fastly-stats: io=1
content-length: 13011
x-request-id: b98674c462cc83a8c2c22324382fa302
x-served-by: cache-sjc10047-SJC, cache-iad-kiad7000147-IAD
x-runtime: 47ms
netlify-vary: header=x-nextjs-data,cookie=__prerender_bypass|__next_preview_data
server: Netlify
x-timer: S1713854790.665827,VS0,VE1
x-contentstack-organization: bltdec97706489ab5de
cache-status: "Netlify Edge"; hit
etag: "aNLsCZiogfaK+dI13wowFMHlRypXq+Kq01w25juCPkg"
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: content-disposition, content-type, cache-control, status, content-length
cache-control: max-age=31536000
accept-ranges: bytes
x-cache-hits: 0, 0

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 299 KB
102 KB 386ms
145ms Script
application/javascript 172.217.16.200
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-52PC3MW

Requested by

Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.16.200 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s65-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

79ecc15b3d35c6f083de7b0f58ecafecc1511ac0f13d9c11cb0a642b7510cc2a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.deepinstinct.com/
Accept-Language: he-IL,he;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 24 Apr 2024 10:52:22 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 104508
x-xss-protection: 0
last-modified: Wed, 24 Apr 2024 09:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Wed, 24 Apr 2024 10:52:22 GMT

GET
H2 200 p.css
p.typekit.net/ 5 B
172 B 752ms
247ms Stylesheet
text/css 23.200.36.205
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://p.typekit.net/p.css?s=1&k=zka3qml&ht=tk&f=10954.13454.13466.28969&a=83637106&app=typekit&e=css
Requested by: Host: use.typekit.net
URL: https://use.typekit.net/zka3qml.css
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.200.36.205 , Mexico, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a23-200-36-205.deploy.static.akamaitechnologies.com
Software: nginx /
Resource Hash: 1c0ff118a4290c99f39c90abb38703a866e47251b23cca20266c69c812ccafeb

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://use.typekit.net/
Accept-Language: he-IL,he;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 24 Apr 2024 10:52:23 GMT
last-modified: Sun, 22 Oct 2023 12:40:05 GMT
server: nginx
etag: "65351825-5"
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=604800
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
content-length: 5

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 284 KB
97 KB 149ms
148ms Script
application/javascript 172.217.16.200
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-P5MMKMDSNW&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-52PC3MW

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.16.200 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s65-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

28a0012dcd1984d3c08d585dc2a2360b73a0c0c8237bf99a4a1e7ec70a31ebcf

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.deepinstinct.com/
Accept-Language: he-IL,he;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 24 Apr 2024 10:52:22 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 99329
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Wed, 24 Apr 2024 10:52:22 GMT

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 52 KB
21 KB 357ms
116ms Script
text/javascript 172.217.18.14
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-52PC3MW

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.18.14 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s22-in-f14.1e100.net

Software

Golfe2 /

Resource Hash

de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.deepinstinct.com/
Accept-Language: he-IL,he;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
date: Wed, 24 Apr 2024 09:48:08 GMT
last-modified: Tue, 12 Dec 2023 18:09:08 GMT
server: Golfe2
age: 3855
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 20994
expires: Wed, 24 Apr 2024 11:48:08 GMT

GET
H2 200 hotjar-1665869.js Show response
static.hotjar.com/c/ 9 KB
4 KB 414ms
112ms Script
application/javascript 18.66.102.53
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://static.hotjar.com/c/hotjar-1665869.js?sv=7

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-52PC3MW

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.66.102.53 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-66-102-53.fra56.r.cloudfront.net

Software

Resource Hash

f6735d6295b7bd837a2fa51038cbc7a6bb2e2b2b41550a7ea49619487175a48e

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.deepinstinct.com/
Accept-Language: he-IL,he;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

strict-transport-security: max-age=2592000; includeSubDomains
content-encoding: br
x-content-type-options: nosniff
date: Wed, 24 Apr 2024 10:52:06 GMT
via: 1.1 44b457512f742b4e48fc7f0c87d8ed92.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-P2
age: 17
x-cache: Hit from cloudfront
cross-origin-resource-policy: cross-origin
etag: W/533e75318511bcadfbe27699181dc046
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
x-cache-hit: 1
cache-control: max-age=60
x-amz-cf-id: ofUznziYt5yvZ0qzzBY3FZ5r6mVedp9mBFAv2V6DFT3i2vdvbh8DJg==

GET
H2 200 8430ce879b38826d.min.js Show response
tag.demandbase.com/ 77 KB
22 KB 373ms
133ms Script
application/javascript 18.245.46.22
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://tag.demandbase.com/8430ce879b38826d.min.js

Requested by

Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.245.46.22 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-245-46-22.fra56.r.cloudfront.net

Software

AmazonS3 /

Resource Hash

118a0b64762282c340eb77e3234ae6d4e4ec71d140da6afa6139657c4f83bd00

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.deepinstinct.com/
Accept-Language: he-IL,he;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-amz-version-id: 7Ol_pEBx9393nVO_u3vwd1Rs.7TNHyqY
content-encoding: gzip
via: 1.1 1e53d5f889e2ac50f0d7b6cad073c03e.cloudfront.net (CloudFront)
date: Wed, 24 Apr 2024 10:52:06 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
x-amz-cf-pop: FRA56-P9
age: 601
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
last-modified: Tue, 16 Apr 2024 11:34:52 GMT
server: AmazonS3
etag: W/"0beec52509383333869c12b2dc998b2c"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cache-control: public, max-age=3600
permissions-policy: accelerometer=(), camera=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), payment=(), usb=(), interest-cohort=()
x-amz-cf-id: cYDP4t3BblLlSCHudzlXwH-Mylfbgj8KAVPi3ORPeOZ686TgMhleKg==

GET
H2 200 2183098.js Show response
js.hs-scripts.com/ 2 KB
1 KB 198ms
74ms Script
application/javascript 104.16.141.209
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://js.hs-scripts.com/2183098.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-52PC3MW

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.141.209 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

238a5557d281f29a863a1deda2d9c1c426d8ff7b9018c0c44c047f994b52b57a

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.deepinstinct.com/
Accept-Language: he-IL,he;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 24 Apr 2024 10:52:22 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
x-hubspot-correlation-id: 93600b3c-14c8-4708-991c-2f0a5c5bf6b7
x-evy-trace-route-service-name: envoyset-translator
cf-polished: origSize=2012
age: 16
x-envoy-upstream-service-time: 11
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: 93600b3c-14c8-4708-991c-2f0a5c5bf6b7
cf-bgj: minify
last-modified: Wed, 24 Apr 2024 10:46:50 GMT
server: cloudflare
access-control-max-age: 3600
vary: origin, Accept-Encoding
content-type: application/javascript;charset=utf-8
access-control-allow-origin: https://www.deepinstinct.com
x-evy-trace-served-by-pod: iad02/hubapi-td/envoy-proxy-5d47c8d44f-g8cqc
x-evy-trace-virtual-host: all
access-control-allow-credentials: true
cache-control: public, max-age=90
cf-ray: 87958b22e99de3d3-TLV
expires: Wed, 24 Apr 2024 10:53:52 GMT

GET
H2 200 destination Show response
www.googletagmanager.com/gtag/ 243 KB
85 KB 150ms
146ms Script
application/javascript 172.217.16.200
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/destination?id=AW-812608847&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-52PC3MW

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.16.200 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s65-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

96b04582ae3d1f5759bce9653b8e407d2f233745f72e54f9a1c145379b5821a7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.deepinstinct.com/
Accept-Language: he-IL,he;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 24 Apr 2024 10:52:22 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 86513
x-xss-protection: 0
last-modified: Wed, 24 Apr 2024 09:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Wed, 24 Apr 2024 10:52:22 GMT

GET
H2 200 insight.min.js Show response
snap.licdn.com/li.lms-analytics/ 48 KB
17 KB 795ms
281ms Script
application/javascript 23.200.38.43
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://snap.licdn.com/li.lms-analytics/insight.min.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-52PC3MW

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.200.38.43 , Mexico, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a23-200-38-43.deploy.static.akamaitechnologies.com

Software

Resource Hash

6cc4c722a50b4152194b13e7e3c8a1a5a5f23b17988f8fa85404394efc5c0984

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.deepinstinct.com/
Accept-Language: he-IL,he;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 24 Apr 2024 10:52:23 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 09 Apr 2024 07:42:51 GMT
x-cdn: AKAM
x-amz-server-side-encryption: AES256
vary: Accept-Encoding
content-type: application/javascript;charset=utf-8
cache-control: max-age=23657
accept-ranges: bytes
content-length: 17238

GET
H2 200 uwt.js Show response
static.ads-twitter.com/ 56 KB
15 KB 363ms
118ms Script
application/javascript 146.75.120.157
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://static.ads-twitter.com/uwt.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-52PC3MW
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 146.75.120.157 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 4d15ff2317e16ccd8ca1d3248fea7d91130e022369bb032824a84ad9967064df

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.deepinstinct.com/
Accept-Language: he-IL,he;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 24 Apr 2024 10:52:23 GMT
content-encoding: gzip
last-modified: Thu, 04 Apr 2024 00:26:35 GMT
x-amz-server-side-encryption: AES256
etag: "bbbcf811d8437a575d796a4c1e5d4fad+gzip+gzip"
vary: Accept-Encoding,Host
x-cache: HIT, HIT
content-type: application/javascript; charset=utf-8
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
x-tw-cdn: FT
cache-control: no-cache
accept-ranges: bytes
content-length: 15412
x-served-by: cache-iad-kcgs7200164-IAD, cache-fra-etou8220111-FRA

GET
H2 200 fbevents.js Show response
connect.facebook.net/en_US/ 218 KB
59 KB 341ms
109ms Script
application/x-javascript 157.240.253.1
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

157.240.253.1 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

xx-fbcdn-shv-02-fra5.fbcdn.net

Software

Resource Hash

01e9582655224c83e6c075f44b7eecb135e108b6ad2150bf6f78a0a77c4ad5e0

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' data: blob: facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;script-src .fbcdn.net .facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net wss://.fbcdn.net attachment.fbsbx.com blob: 'self';img-src 'self' data: blob: facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.deepinstinct.com/
Accept-Language: he-IL,he;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

content-security-policy: default-src 'self' data: blob: facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';img-src 'self' data: blob: facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script';
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; preload; includeSubDomains
date: Wed, 24 Apr 2024 10:52:23 GMT
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 57850
x-xss-protection: 0
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
x-fb-connection-quality: GOOD; q=0.7, rtt=50, rtx=0, c=12, mss=1380, tbw=2777, tp=-1, tpl=-1, uplat=0, ullat=-1
pragma: public
x-fb-debug: 5YhHs4kr/6SeSQZuMqxvI75QC3by9Q4o9oVGGhEZd6IVWVZ9VYppMHHqHaBopRfWJmBCMeQR4ycpavI+peCDzg==
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
cross-origin-opener-policy: same-origin-allow-popups;report-to="coop_report"
vary: Accept-Encoding
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
content-type: application/x-javascript; charset=utf-8
x-frame-options: DENY
origin-agent-cluster: ?0
cache-control: public, max-age=1200
permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), usb=(), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
timing-allow-origin: *
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 bat.js Show response
bat.bing.com/ 45 KB
13 KB 255ms
128ms Script
application/javascript 204.79.197.237
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://bat.bing.com/bat.js

Requested by

Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

204.79.197.237 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

823804a7807864b44093a3843788f4cd076e89cf4a6fdeb8d153ae5c2c2df721

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.deepinstinct.com/
Accept-Language: he-IL,he;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
date: Wed, 24 Apr 2024 10:52:22 GMT
last-modified: Thu, 29 Feb 2024 19:58:06 GMT
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 31CAAD08A34643B5B72AFD21894E0AD1 Ref B: TLV30EDGE0509 Ref C: 2024-04-24T10:52:22Z
etag: "01b4e9c496bda1:0"
vary: Accept-Encoding
x-cache: CONFIG_NOCACHE
content-type: application/javascript
cache-control: private,max-age=1800
accept-ranges: bytes
content-length: 13261

GET
H2 200 bizible.js Show response
cdn.bizible.com/scripts/ 67 KB
25 KB 455ms
112ms Script
application/x-javascript 152.195.15.58
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.bizible.com/scripts/bizible.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-52PC3MW

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

152.195.15.58 , United States, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECS (frb/67D4) /

Resource Hash

4c903880e86c99ed05c1387b955f7de1f6b97ccdd3ae9db3bf1c82cad6ac8a5a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSub

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.deepinstinct.com/
Accept-Language: he-IL,he;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 24 Apr 2024 10:52:23 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSub
last-modified: Fri, 19 Apr 2024 15:03:17 GMT
server: ECS (frb/67D4)
age: 49019
etag: "c630b1b56a92da1:0"
vary: Accept-Encoding
x-cache: HIT
content-type: application/x-javascript
cache-control: max-age=86400
accept-ranges: bytes
content-length: 25393

GET
H2 200 tracking.js Show response
trk.techtarget.com/ 3 KB
2 KB 209ms
82ms Script
text/javascript 172.64.151.60
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://trk.techtarget.com/tracking.js

Requested by

Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.64.151.60 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0c07b854855b0e2bd7839c3659defa45307e96e281b3c00571d09f213eb6a76e

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains; preload

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.deepinstinct.com/
Accept-Language: he-IL,he;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 24 Apr 2024 10:52:22 GMT
via: 1.1 google
content-encoding: br
cf-cache-status: HIT
cf-bgj: minify
last-modified: Tue, 13 Dec 2022 15:01:39 GMT
strict-transport-security: max-age=0; includeSubDomains; preload
age: 16543
server: cloudflare
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=1200
cf-ray: 87958b2308a6e3d7-TLV
expires: Wed, 24 Apr 2024 11:12:22 GMT

GET
H2 200 qualified.js Show response
js.qualified.com/ 688 KB
167 KB 679ms
556ms Script
text/javascript 104.18.16.5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://js.qualified.com/qualified.js?token=DxHYmKWTScn3buDp

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-52PC3MW

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.16.5 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

be9814e6a9078f839720af16bf4859cc5c386ea740b72439b34b194dbd483cf3

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.deepinstinct.com/
Accept-Language: he-IL,he;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 24 Apr 2024 10:52:23 GMT
content-encoding: gzip
via: 1.1 spaces-router (2a9d893844a5)
strict-transport-security: max-age=63072000; includeSubDomains
cf-cache-status: MISS
x-content-type-options: nosniff
x-permitted-cross-domain-policies: none
x-xss-protection: 1; mode=block
x-request-id: 25049925-8626-db1a-fdb6-655490235d97
pragma: no-cache
x-runtime: 0.021853
referrer-policy: strict-origin-when-cross-origin
server: cloudflare
etag: W/"be9814e6a9078f839720af16bf4859cc"
x-download-options: noopen
vary: Accept,Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: text/javascript; charset=utf-8
cache-control: public, max-age=14400
cf-ray: 87958b2428eee3c7-TLV
expires: Wed, 24 Apr 2024 14:52:23 GMT

GET
H2 200 2183098.js Show response
js.hs-banner.com/ 64 KB
17 KB 194ms
70ms Script
text/javascript 104.18.34.229
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js.hs-banner.com/2183098.js
Requested by: Host: js.hs-scripts.com
URL: https://js.hs-scripts.com/2183098.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.34.229 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c38430e8e8eeedf87f6a7860ee009e354dbd44f3865a62663239922b35590d7f

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.deepinstinct.com/
Accept-Language: he-IL,he;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 24 Apr 2024 10:52:23 GMT
x-amz-version-id: 3t5xtorRfw4OfG5JJC.Kjqhy62bL4qUy
content-encoding: br
cf-cache-status: HIT
x-amz-request-id: YF6E56B8QG8YQM9N
x-evy-trace-route-service-name: envoyset-translator
x-amz-server-side-encryption: AES256
x-hubspot-correlation-id: 8e3b4cd2-8e6f-4d20-ba43-48ea88e88480
age: 16
x-envoy-upstream-service-time: 108
x-amz-id-2: KoEEoGmR/de5pJOsPduO0kgX9YS6p0isaTV75N/KbaAhMSpvcwWBrBxDqE3Azt3lvk8zj2qkkaY=
x-evy-trace-listener: listener_https
x-request-id: 8e3b4cd2-8e6f-4d20-ba43-48ea88e88480
x-evy-trace-route-configuration: listener_https/all
last-modified: Fri, 29 Mar 2024 16:21:55 GMT
server: cloudflare
etag: W/"4554e0b29ba73627bf46cee13e80176e"
access-control-max-age: 604800
access-control-allow-methods: GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: https://www.deepinstinct.com
x-evy-trace-virtual-host: all
access-control-expose-headers: x-last-modified-timestamp, X-HubSpot-NotFound, X-HS-User-Request, Link, Server-Timing
cache-control: max-age=300,public
access-control-allow-credentials: true
x-evy-trace-served-by-pod: iad02/analytics-js-proxy-td/envoy-proxy-6dfb9475dd-88fff
vary: origin, Accept-Encoding
timing-allow-origin: *
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Accept-Charset, Accept-Encoding, X-Override-Internal-Permissions, X-Properties-Source, X-Properties-SourceId, X-Properties-Flag, X-Hubspot-User-Id, X-Hubspot-Trace, X-Hubspot-Callee, X-Hubspot-Offset, X-Hubspot-No-Trace, X-HubSpot-Static-App-Info, X-HubSpot-Messages-Uri, X-HubSpot-Request-Source, X-HubSpot-Request-Reason, Subscription-Billing-Auth-Token, X-App-CSRF, X-Tools-CSRF, Online-Payment-Signing-UUID, X-Source, X-SourceId, X-Origin-UserId, X-Biden-Request-Source, X-HubSpot-CSRF-hubspotapi, X-Force-Cookie-Refresh, X-Force-Cookie-Refresh-No-Cache, X-HS-User-Request, X-Application-Id, X-HS-Referer, X-HubSpot-Correlation-Id
cf-ray: 87958b244bfce3e7-TLV
expires: Wed, 24 Apr 2024 10:57:07 GMT

GET
H2 200 2183098.js Show response
js.hs-analytics.net/analytics/1713955800000/ 67 KB
21 KB 225ms
96ms Script
text/javascript 104.17.175.201
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js.hs-analytics.net/analytics/1713955800000/2183098.js
Requested by: Host: js.hs-scripts.com
URL: https://js.hs-scripts.com/2183098.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.17.175.201 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6371783e47489007d9eeb0119d3ed7c7b540a63f1bb0d1024aca81cf9c5eabfc

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.deepinstinct.com/
Accept-Language: he-IL,he;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 24 Apr 2024 10:52:23 GMT
x-amz-version-id: null
content-encoding: br
cf-cache-status: HIT
x-amz-request-id: YTAYJ87PTZ2TN4YK
x-evy-trace-route-service-name: envoyset-translator
x-amz-server-side-encryption: AES256
x-hubspot-correlation-id: 0b6eb98a-2d8a-4893-afff-b4ae4fe06a76
age: 16
x-envoy-upstream-service-time: 28
x-amz-id-2: XNcj3L+ETXMETmmrXsAbL/HUWMPsHl3cOQGq8IKOkK3ONFOVIQaukjdX5IY9YhzCJTCHhOCdHTU=
x-evy-trace-listener: listener_https
x-request-id: 0b6eb98a-2d8a-4893-afff-b4ae4fe06a76
x-evy-trace-route-configuration: listener_https/all
last-modified: Thu, 18 Apr 2024 19:26:53 GMT
server: cloudflare
etag: W/"a175f3cfa46d4a6f1a9b0c395be6b91c"
vary: origin, Accept-Encoding
content-type: text/javascript
x-evy-trace-virtual-host: all
x-evy-trace-served-by-pod: iad02/analytics-js-proxy-td/envoy-proxy-6685c9958f-jg42k
cache-control: max-age=300,public
access-control-allow-credentials: false
cf-ray: 87958b24bc5fe3d3-TLV
expires: Wed, 24 Apr 2024 10:57:07 GMT

GET
H2 200 leadflows.js Show response
js.hsleadflows.net/ 551 KB
88 KB 221ms
70ms Script
application/javascript 104.18.140.17
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://js.hsleadflows.net/leadflows.js

Requested by

Host: js.hs-scripts.com
URL: https://js.hs-scripts.com/2183098.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.140.17 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

efb5dc6835aeb8a8e1615ca49df1828cfaf708dc73651c5f1c651f2d2ab3907a

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.deepinstinct.com/
Origin: https://www.deepinstinct.com
Accept-Language: he-IL,he;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

content-encoding: br
x-evy-trace-route-service-name: envoyset-translator
age: 24405
x-amz-server-side-encryption: AES256
content-security-policy-report-only: frame-ancestors 'self'; report-uri https://send.hsbrowserreports.com/csp/report?resource=lead-flows-js/static-1.1338/bundle/main/lead-flows-release.js&cfRay=878caa194b7411b8-MRS
x-amz-replication-status: COMPLETED
x-evy-trace-listener: listener_https
etag: W/"d252299cef5b9176cf0435e72e0baeeb"
vary: Accept-Encoding,Origin,Access-Control-Request-Headers,Access-Control-Request-Method
access-control-allow-methods: GET
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
x-evy-trace-virtual-host: all
cache-control: s-maxage=86400, max-age=0
x-hs-target-asset: lead-flows-js/static-1.1338/bundle/main/lead-flows-release.js
date: Wed, 24 Apr 2024 10:52:23 GMT
x-amz-version-id: FzXUOelq5PzvbDhLOc3Au0ThiCBuXHAc
via: 1.1 1f1067e4f193aaabd2c24b99bcdc4e88.cloudfront.net (CloudFront)
x-content-type-options: nosniff
cf-cache-status: HIT
x-amz-cf-pop: IAD12-P3
x-hubspot-correlation-id: d4fdeb6b-6a06-4eeb-8d74-dbbaebcd4a18
x-cache: Hit from cloudfront
cache-tag: staticjsapp-lead-flows-cloudflare-web-prod,staticjsapp-prod
x-envoy-upstream-service-time: 7
x-evy-trace-route-configuration: listener_https/all
x-request-id: d4fdeb6b-6a06-4eeb-8d74-dbbaebcd4a18
last-modified: Wed, 03 Apr 2024 09:27:53 UTC
server: cloudflare
access-control-max-age: 3000
x-hs-cache-status: MISS
x-evy-trace-served-by-pod: iad02/app-td/envoy-proxy-68b7f7fbff-bsp24
cf-ray: 87958b25adbfe3d3-TLV
x-amz-cf-id: cJWabK2Q9VC_jbD52-xEe5jZOtTwZwmktJWIhtezWMYvK3XoobPgsg==

GET
H2 200 fb.js Show response
js.hsadspixel.net/ 6 KB
4 KB 243ms
94ms Script
application/javascript 104.17.223.152
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://js.hsadspixel.net/fb.js

Requested by

Host: js.hs-scripts.com
URL: https://js.hs-scripts.com/2183098.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.17.223.152 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

1c67d8ce90160a6586cfd2c2a936959738f5b1843ebdfbac4325c4d1a9b61224

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.deepinstinct.com/
Accept-Language: he-IL,he;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 24 Apr 2024 10:52:23 GMT
x-amz-version-id: H75lIw.llLd5LbqLQfJpi4qQ6NOhCtlN
via: 1.1 d0d53eedec01ac540f737b5fafb16436.cloudfront.net (CloudFront)
x-content-type-options: nosniff
cf-cache-status: HIT
x-amz-cf-pop: IAD12-P3
age: 532
x-amz-server-side-encryption: AES256
x-evy-trace-route-service-name: envoyset-translator
content-security-policy-report-only: frame-ancestors 'self'; report-uri https://send.hsbrowserreports.com/csp/report?resource=adsscriptloaderstatic/static-1.551/bundles/pixels-release.js&cfRay=879237e84a60e3d7-TLV
x-cache: Hit from cloudfront
x-hubspot-correlation-id: 639ad5b5-c16a-4b09-8b36-fba7fea4157a
cache-tag: staticjsapp-AdsScriptLoaderCloudflare-web-prod,staticjsapp-prod
content-encoding: br
x-envoy-upstream-service-time: 0
x-amz-replication-status: COMPLETED
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: 639ad5b5-c16a-4b09-8b36-fba7fea4157a
last-modified: Fri, 19 Apr 2024 14:01:51 UTC
server: cloudflare
etag: W/"65a4cdf8f8c613ea8f766101eea8e667"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
x-hs-cache-status: HIT
x-evy-trace-virtual-host: all
cache-control: max-age=600
x-evy-trace-served-by-pod: iad02/app-td/envoy-proxy-68b7f7fbff-bsp24
cf-ray: 87958b25abc5e3c7-TLV
x-amz-cf-id: 4FNlnTtxOpbUHAFQY_z12IfTT8NWPbTq83bomM7_rCFWbXfYgI-VGg==
x-hs-target-asset: adsscriptloaderstatic/static-1.551/bundles/pixels-release.js

GET
H2 200 gif.gif Show response
ibc-flow.techtarget.com/a/ 43 B
447 B 238ms
237ms XHR
image/gif 34.111.208.231
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://ibc-flow.techtarget.com/a/gif.gif?actTypeId=31&cid=16780454&r=1713955942936&ref=https%3A%2F%2Fwww.deepinstinct.com%2Fblog%2Fdarkbeatc2-the-latest-muddywater-attack-framework&version=2.4
Requested by: Host: trk.techtarget.com
URL: https://trk.techtarget.com/tracking.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.111.208.231 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 231.208.111.34.bc.googleusercontent.com
Software: nginx/1.20.2 /
Resource Hash: 2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Request headers

ibc_rate_tier: 16780454
sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.deepinstinct.com/
Accept-Language: he-IL,he;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 24 Apr 2024 10:52:23 GMT
via: 1.1 google
x-guploader-uploadid: ABPtcPqizB2Irwx9RBKl3XrUXM-9WssOTVi11En1QiBbrA6a3UBp5B2dSs0TMjLCszm9vW4owfLQzkjTIQ
x-goog-storage-class: STANDARD
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
last-modified: Thu, 08 Dec 2022 21:19:29 GMT
server: nginx/1.20.2
etag: "fc94fb0c3ed8a8f909dbc7630a0987ff"
vary: Origin
x-goog-generation: 1670534369365034
content-type: image/gif
access-control-allow-origin: *
x-goog-hash: crc32c=7uenZA==, md5=/JT7DD7YqPkJ28djCgmH/w==
cache-control: public, max-age=3600
access-control-allow-methods: GET, POST, OPTIONS
x-goog-stored-content-length: 43
accept-ranges: bytes
access-control-allow-headers: ibc_header,ibc_rate_tier,User-Agent,X-Requested-With,Cache-Control,Content-Type,Range
expires: Wed, 24 Apr 2024 11:52:23 GMT

OPTIONS
H2 200 gif.gif
ibc-flow.techtarget.com/a/ Frame 0
0 345ms
206ms Preflight
text/html 34.111.208.231
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://ibc-flow.techtarget.com/a/gif.gif?actTypeId=31&cid=16780454&r=1713955942936&ref=https%3A%2F%2Fwww.deepinstinct.com%2Fblog%2Fdarkbeatc2-the-latest-muddywater-attack-framework&version=2.4
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.111.208.231 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 231.208.111.34.bc.googleusercontent.com
Software: nginx/1.20.2 /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: ibc_rate_tier
Access-Control-Request-Method: GET
Origin: https://www.deepinstinct.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36

Response headers

access-control-allow-headers: ibc_header,ibc_rate_tier,User-Agent,X-Requested-With,Cache-Control,Content-Type,Range
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=0
content-length: 0
content-type: text/html; charset=UTF-8
date: Wed, 24 Apr 2024 10:52:23 GMT
expires: Wed, 24 Apr 2024 10:52:23 GMT
server: nginx/1.20.2
vary: Origin
via: 1.1 google
x-guploader-uploadid: ABPtcPqNpIxR7vGIZUk2-Thx4ZGy18NeqQi9i9n2oRvz7TZbCaZqe6dhiBe9LSwH0hY-FzwqzRgOeoO0WA

GET
H3 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/812608847/ 3 KB
1 KB 442ms
210ms Script
text/javascript 142.250.185.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/812608847/?random=1713955942972&cv=11&fst=1713955942972&bg=ffffff&guid=ON&async=1&gtm=45be44m0v9116635018z878451102za201&gcd=13l3l3l3l1&dma=0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.deepinstinct.com%2Fblog%2Fdarkbeatc2-the-latest-muddywater-attack-framework&hn=www.googleadservices.com&frm=0&tiba=DarkBeatC2%3A%20The%20Latest%20MuddyWater%20Attack%20Framework&npa=0&pscdl=noapi&auid=406974157.1713955943&uaa=x86&uab=64&uafvl=Chromium%3B124.0.6367.60%7CGoogle%2520Chrome%3B124.0.6367.60%7CNot-A.Brand%3B99.0.0.0&uamb=0&uam=&uap=Win32&uapv=10.0.0&uaw=0&fdr=QA&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/destination?id=AW-812608847&l=dataLayer&cx=c

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s51-in-f2.1e100.net

Software

cafe /

Resource Hash

591c61c96042823042978eca080ce9de60db6e3bdf474ab331364d52212212cc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.deepinstinct.com/
Accept-Language: he-IL,he;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Wed, 24 Apr 2024 10:52:23 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1460
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 collect
analytics.google.com/g/ 0
257 B 476ms
137ms Ping
text/plain 142.250.185.238
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://analytics.google.com/g/collect?v=2&tid=G-P5MMKMDSNW&gtm=45je44m0v868549395z878451102za200&_p=1713955942145&_gaz=1&gcd=13l3l3l3l1&npa=0&dma=0&cid=1069735733.1713955943&ul=he-il&sr=1600x1200&uaa=x86&uab=64&uafvl=Chromium%3B124.0.6367.60%7CGoogle%2520Chrome%3B124.0.6367.60%7CNot-A.Brand%3B99.0.0.0&uamb=0&uam=&uap=Win32&uapv=10.0.0&uaw=0&pscdl=noapi&_s=1&sid=1713955943&sct=1&seg=0&dl=https%3A%2F%2Fwww.deepinstinct.com%2Fblog%2Fdarkbeatc2-the-latest-muddywater-attack-framework&dt=DarkBeatC2%3A%20The%20Latest%20MuddyWater%20Attack%20Framework&en=page_view&_fv=1&_nsi=1&_ss=1&tfd=1964
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-P5MMKMDSNW&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 142.250.185.238 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: fra16s53-in-f14.1e100.net
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.deepinstinct.com/
Accept-Language: he-IL,he;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Wed, 24 Apr 2024 10:52:23 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.deepinstinct.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 collect
stats.g.doubleclick.net/g/ 0
56 B 385ms
116ms Ping
text/plain 74.125.206.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://stats.g.doubleclick.net/g/collect?v=2&tid=G-P5MMKMDSNW&cid=1069735733.1713955943&gtm=45je44m0v868549395z878451102za200&aip=1&dma=0&gcd=13l3l3l3l1&npa=0
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-P5MMKMDSNW&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 74.125.206.154 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: wk-in-f154.1e100.net
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.deepinstinct.com/
Accept-Language: he-IL,he;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Wed, 24 Apr 2024 10:52:23 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.deepinstinct.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.co.il/ads/ 42 B
408 B 391ms
145ms Image
image/gif 142.250.186.163
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.co.il/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&tid=G-P5MMKMDSNW&cid=1069735733.1713955943&gtm=45je44m0v868549395z878451102za200&aip=1&dma=0&gcd=13l3l3l3l1&npa=0&z=355386439

Requested by

Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.163 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s08-in-f3.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.deepinstinct.com/
Accept-Language: he-IL,he;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Wed, 24 Apr 2024 10:52:23 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 204 17571311.js Show response
bat.bing.com/p/action/ 0
118 B 131ms
131ms Script
text/plain 204.79.197.237
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://bat.bing.com/p/action/17571311.js

Requested by

Host: bat.bing.com
URL: https://bat.bing.com/bat.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

204.79.197.237 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.deepinstinct.com/
Accept-Language: he-IL,he;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: private,max-age=1800
date: Wed, 24 Apr 2024 10:52:22 GMT
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 757D56CCC69149C492DFA3E885CFBFAD Ref B: TLV30EDGE0509 Ref C: 2024-04-24T10:52:23Z
x-cache: CONFIG_NOCACHE

GET
H2 204 0
bat.bing.com/action/ 0
287 B 153ms
151ms Image
text/plain 204.79.197.237
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://bat.bing.com/action/0?ti=17571311&Ver=2&mid=4c991040-5e16-4f4d-9778-39e69eeed26f&sid=baf9c3c0022811ef9abcd333afd4b7ed&vid=baf9e5b0022811efa99c7116c5e9898a&vids=1&msclkid=N&pi=918639831&lg=he-IL&sw=1600&sh=1200&sc=24&tl=DarkBeatC2%3A%20The%20Latest%20MuddyWater%20Attack%20Framework&p=https%3A%2F%2Fwww.deepinstinct.com%2Fblog%2Fdarkbeatc2-the-latest-muddywater-attack-framework&r=&evt=pageLoad&sv=1&rn=688336

Requested by

Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

204.79.197.237 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.deepinstinct.com/
Accept-Language: he-IL,he;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Wed, 24 Apr 2024 10:52:22 GMT
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 5810558136E34C17883D2EEBBF3083A4 Ref B: TLV30EDGE0509 Ref C: 2024-04-24T10:52:23Z
x-cache: CONFIG_NOCACHE
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 sync
s.company-target.com/s/ Frame FFE9 0
0 387ms
216ms Document
text/html 34.96.71.22
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://s.company-target.com/s/sync?exc=lr
Requested by: Host: tag.demandbase.com
URL: https://tag.demandbase.com/8430ce879b38826d.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.96.71.22 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 22.71.96.34.bc.googleusercontent.com
Software: /
Resource Hash

Request headers

Accept-Language: he-IL,he;q=0.9;q=0.9
Referer: https://www.deepinstinct.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Win32"

Response headers

access-control-allow-methods: GET,OPTIONS
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 634
content-type: text/html; charset=UTF-8
date: Wed, 24 Apr 2024 10:52:23 GMT
via: 1.1 google

GET 464526.gif
id.rlcdn.com/ 0
0

POST
H2 200 collect Show response
www.google-analytics.com/j/ 4 B
212 B 126ms
124ms XHR
text/plain 172.217.18.14
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j101&a=1238991542&t=pageview&_s=1&dl=https%3A%2F%2Fwww.deepinstinct.com%2Fblog%2Fdarkbeatc2-the-latest-muddywater-attack-framework&ul=he-il&de=UTF-8&dt=DarkBeatC2%3A%20The%20Latest%20MuddyWater%20Attack%20Framework&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YCDACEABBAAAACAAI~&jid=710625362&gjid=628120718&cid=1069735733.1713955943&tid=UA-69598329-1&_gid=1241762260.1713955943&_r=1&_slc=1&gtm=45He44m0n8152PC3MWv78451102za200&gcd=13l3l3l3l1&dma=0&z=1633920480

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.18.14 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s22-in-f14.1e100.net

Software

Golfe2 /

Resource Hash

aec60bc104db041b1512185839f18f52986df7e569e5445f740dd60f763fbca8

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
sec-ch-ua-platform: "Win32"
Referer: https://www.deepinstinct.com/
Accept-Language: he-IL,he;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Wed, 24 Apr 2024 10:52:23 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.deepinstinct.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 ip.json Show response
api.company-target.com/api/v2/ 3 KB
1 KB 424ms
182ms XHR
application/json 18.66.102.85
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://api.company-target.com/api/v2/ip.json?referrer=&page=https%3A%2F%2Fwww.deepinstinct.com%2Fblog%2Fdarkbeatc2-the-latest-muddywater-attack-framework&page_title=DarkBeatC2%3A%20The%20Latest%20MuddyWater%20Attack%20Framework
Requested by: Host: tag.demandbase.com
URL: https://tag.demandbase.com/8430ce879b38826d.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.66.102.85 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-66-102-85.fra56.r.cloudfront.net
Software: nginx /
Resource Hash: 12adce1ff8ecf597745ee698257dd38a6af8abab2d89e565b2d40893b646f28e

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
sec-ch-ua-platform: "Win32"
Referer: https://www.deepinstinct.com/
Accept-Language: he-IL,he;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

date: Wed, 24 Apr 2024 10:52:23 GMT
content-encoding: gzip
identification-source: CACHE
via: 1.1 c2e56cd54e2593df95ccca8a6d98c958.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-P2
x-cache: Miss from cloudfront
request-id: 898a3929-46d6-4dac-a387-d2201c979c3f
pragma: no-cache
server: nginx
access-control-max-age: 7200
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/json;charset=utf-8
access-control-allow-origin: https://www.deepinstinct.com
access-control-expose-headers: x-amz-cf-id
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
vary: Accept-Encoding, Origin
api-version: v2
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: 8rS1OAVnRLGkrGnI7a9DerWBOmWQzKWF25E5Jb7XMrpw0stIw8GhUQ==
expires: Tue, 23 Apr 2024 10:52:23 GMT

GET
H2 200 l
use.typekit.net/af/04ec74/00000000000000000001205b/27/ 29 KB
29 KB 762ms
248ms Font
application/font-woff2 23.200.36.196
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://use.typekit.net/af/04ec74/00000000000000000001205b/27/l?primer=7cdcb44be4a7db8877ffa5c0007b8dd865b3bbc383831fe2ea177f62257a9191&fvd=n7&v=3
Requested by: Host: use.typekit.net
URL: https://use.typekit.net/zka3qml.css
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.200.36.196 , Mexico, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a23-200-36-196.deploy.static.akamaitechnologies.com
Software: nginx /
Resource Hash: 8d0056dcc26b8dce6be00539697962adb12475fbf9cbf7fdcbc7c81b2ae7328d

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://use.typekit.net/zka3qml.css
Origin: https://www.deepinstinct.com
Accept-Language: he-IL,he;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 24 Apr 2024 10:52:23 GMT
server: nginx
etag: "1c4557ace28950fbc49487c3a85660222d5fe232"
content-type: application/font-woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 29588

GET
H2 200 l
use.typekit.net/af/1709eb/000000000000000000010b60/27/ 24 KB
24 KB 858ms
346ms Font
application/font-woff2 23.200.36.196
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://use.typekit.net/af/1709eb/000000000000000000010b60/27/l?primer=7cdcb44be4a7db8877ffa5c0007b8dd865b3bbc383831fe2ea177f62257a9191&fvd=n7&v=3
Requested by: Host: use.typekit.net
URL: https://use.typekit.net/zka3qml.css
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.200.36.196 , Mexico, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a23-200-36-196.deploy.static.akamaitechnologies.com
Software: nginx /
Resource Hash: f94786fe65dcbc65b0099b471ae2bb89bbabd7fa7d8573dd3c4e0f5bbe555447

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://use.typekit.net/zka3qml.css
Origin: https://www.deepinstinct.com
Accept-Language: he-IL,he;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 24 Apr 2024 10:52:23 GMT
server: nginx
etag: "9bd0488a91630a3c738a4d950e0b0b7930bcb98f"
content-type: application/font-woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 24740

GET
H2 200 l
use.typekit.net/af/442215/000000000000000000010b5a/27/ 23 KB
23 KB 880ms
368ms Font
application/font-woff2 23.200.36.196
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://use.typekit.net/af/442215/000000000000000000010b5a/27/l?primer=7cdcb44be4a7db8877ffa5c0007b8dd865b3bbc383831fe2ea177f62257a9191&fvd=n4&v=3
Requested by: Host: use.typekit.net
URL: https://use.typekit.net/zka3qml.css
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.200.36.196 , Mexico, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a23-200-36-196.deploy.static.akamaitechnologies.com
Software: nginx /
Resource Hash: 8d5da73586712159bb569fbfbd370f05a258113b2591ba238ef4e7bde1db13b7

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://use.typekit.net/zka3qml.css
Origin: https://www.deepinstinct.com
Accept-Language: he-IL,he;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 24 Apr 2024 10:52:23 GMT
server: nginx
etag: "9523c64514161c03124fab238b18113d17bad9eb"
content-type: application/font-woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 23800

GET
H2 200 image
www.deepinstinct.com/_next/ 286 KB
286 KB 176ms
174ms Image
image/avif 3.70.101.28
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.deepinstinct.com/_next/image?url=https%3A%2F%2Fwww.deepinstinct.com%2Fimage%2Fblt488afd138c53fee8%2F660dc3726c4a396121e472ec%2FDI_Threat_Research_Team_Blog_930x400.png&w=1680&q=100

Requested by

Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.70.101.28 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-70-101-28.eu-central-1.compute.amazonaws.com

Software

Netlify /

Resource Hash

1a1ea29b4da0208aa78b7fa3d2b6f39179a1a5de6dfdbc80c0d4dc7443755807

Security Headers

Name	Value
Content-Security-Policy
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework
Accept-Language: he-IL,he;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-nf-request-id: 01HW7VRCT240VJ44YT7K8ESDYN
content-security-policy
date: Wed, 24 Apr 2024 10:52:23 GMT
x-content-type-options: nosniff
strict-transport-security: max-age=31536000
age: 1282355
cross-origin-resource-policy: cross-origin
content-length: 292898
last-modified: Tue, 09 Apr 2024 14:39:48 GMT
netlify-vary: query=url|crop|fit|fm|h|height|position|q|quality|timestamp|w|width
server: Netlify
cache-status: "Netlify Edge"; fwd=miss
vary: Accept
content-type: image/avif
access-control-allow-origin: *
cache-control: max-age=31536000
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 image
www.deepinstinct.com/_next/ 5 KB
5 KB 171ms
171ms Image
image/avif 3.70.101.28
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.deepinstinct.com/_next/image?url=https%3A%2F%2Fimages.contentstack.io%2Fv3%2Fassets%2Fblt1ec077b6b53d6b3e%2Fblt14ca71678553d70e%2F6305444727ca1b5cd53ebd62%2Fkenin-simon.png&w=64&q=75

Requested by

Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.70.101.28 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-70-101-28.eu-central-1.compute.amazonaws.com

Software

Netlify /

Resource Hash

4d69811fcdf2dcc9ff875a6dd0309585ecdf1e55f46345aa9d507f816c4bdb96

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework
Accept-Language: he-IL,he;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-nf-request-id: 01HW7VRCT3QM373R76F9C1B83M
content-security-policy: script-src 'none'
date: Wed, 24 Apr 2024 10:52:23 GMT
x-content-type-options: nosniff
strict-transport-security: max-age=31536000
age: 1282998
cross-origin-resource-policy: cross-origin
content-length: 4851
last-modified: Tue, 09 Apr 2024 14:29:06 GMT
netlify-vary: query=url|crop|fit|fm|h|height|position|q|quality|timestamp|w|width
server: Netlify
cache-status: "Netlify Edge"; hit
vary: Accept
content-type: image/avif
access-control-allow-origin: *
cache-control: public,max-age=31536000
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 image
www.deepinstinct.com/_next/ 5 KB
5 KB 170ms
170ms Image
image/avif 3.70.101.28
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.deepinstinct.com/_next/image?url=https%3A%2F%2Fimages.contentstack.io%2Fv3%2Fassets%2Fblt1ec077b6b53d6b3e%2Fbltfdfca743f7ac9662%2F630e2d5d8bdc107d4a01ba3f%2F800x800-blue-monogram.png&w=64&q=75

Requested by

Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.70.101.28 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-70-101-28.eu-central-1.compute.amazonaws.com

Software

Netlify /

Resource Hash

4d3e2dd099535045aef08a0eae076c90e23f526c7d683704293a9ef005ebcd6a

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework
Accept-Language: he-IL,he;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-nf-request-id: 01HW7VRCT3A1FJZ2F48Y0C81B1
content-security-policy: script-src 'none'
date: Wed, 24 Apr 2024 10:52:23 GMT
x-content-type-options: nosniff
strict-transport-security: max-age=31536000
age: 1282997
cross-origin-resource-policy: cross-origin
content-length: 5220
last-modified: Tue, 09 Apr 2024 14:29:06 GMT
netlify-vary: query=url|crop|fit|fm|h|height|position|q|quality|timestamp|w|width
server: Netlify
cache-status: "Netlify Edge"; hit
vary: Accept
content-type: image/avif
access-control-allow-origin: *
cache-control: public,max-age=31536000
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 modules.588629dd3c10b20ab52d.js Show response
script.hotjar.com/ 220 KB
55 KB 535ms
188ms Script
application/javascript 13.33.187.19
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://script.hotjar.com/modules.588629dd3c10b20ab52d.js

Requested by

Host: static.hotjar.com
URL: https://static.hotjar.com/c/hotjar-1665869.js?sv=7

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.33.187.19 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-33-187-19.fra60.r.cloudfront.net

Software

Resource Hash

16cabc9d4b8ae81eed9193ec25b6d463e68290e5433069885156f7c1dc81e975

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.deepinstinct.com/
Accept-Language: he-IL,he;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 23 Apr 2024 14:47:06 GMT
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=2592000; includeSubDomains
via: 1.1 6641a812839e5267ee0880e96b41efc4.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P9
age: 72317
x-cache: Hit from cloudfront
cross-origin-resource-policy: cross-origin
content-length: 55620
last-modified: Tue, 23 Apr 2024 14:46:56 GMT
etag: "654dca21564b72e6f97d130ff7086658"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
accept-ranges: bytes
x-robots-tag: none
x-amz-cf-id: 0HvkAqW9hO8X5A1e3hZ0ocZnd70u-AJ4GP2yfT428n0RBSGbZmaXlQ==

GET
H2 200 adsct
t.co/i/ 43 B
204 B 635ms
312ms Image
image/gif 104.244.42.133
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://t.co/i/adsct?bci=3&eci=2&event_id=5485bf97-f525-45b4-8a0d-bf9a3e33e139&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=4a058533-e6bb-4420-b58a-c5f001351a26&tw_document_href=https%3A%2F%2Fwww.deepinstinct.com%2Fblog%2Fdarkbeatc2-the-latest-muddywater-attack-framework&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=o61n5&type=javascript&version=2.3.30

Requested by

Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.244.42.133 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.deepinstinct.com/
Accept-Language: he-IL,he;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-response-time: 186
date: Wed, 24 Apr 2024 10:52:23 GMT
strict-transport-security: max-age=0
server: tsa_o
content-type: image/gif;charset=utf-8
x-transaction-id: 316795b91dc538fc
cache-control: no-cache, no-store, max-age=0
perf: 7402827104
x-connection-hash: 17bf016a6509b42ebf9a8ee2b1c82043c9eb3de9e05c0af519d90afc4d15845f
content-length: 43

GET
H2 200 adsct
analytics.twitter.com/i/ 43 B
216 B 574ms
305ms Image
image/gif 104.244.42.131
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://analytics.twitter.com/i/adsct?bci=3&eci=2&event_id=5485bf97-f525-45b4-8a0d-bf9a3e33e139&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=4a058533-e6bb-4420-b58a-c5f001351a26&tw_document_href=https%3A%2F%2Fwww.deepinstinct.com%2Fblog%2Fdarkbeatc2-the-latest-muddywater-attack-framework&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=o61n5&type=javascript&version=2.3.30

Requested by

Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.244.42.131 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.deepinstinct.com/
Accept-Language: he-IL,he;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-response-time: 183
date: Wed, 24 Apr 2024 10:52:23 GMT
strict-transport-security: max-age=631138519
server: tsa_o
content-type: image/gif;charset=utf-8
x-transaction-id: 0e09539b277bb177
cache-control: no-cache, no-store, max-age=0
perf: 7402827104
x-connection-hash: f3d9ce1242837319446d67dc4bee2d75fe37e3fe245f01821122100e7c858d75
content-length: 43

GET
H2 200 adsct
t.co/i/ 43 B
376 B 372ms
232ms Image
image/gif 104.244.42.133
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://t.co/i/adsct?bci=3&eci=2&event_id=31848f28-11f4-4cd0-9530-9e459cce5869&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=4a058533-e6bb-4420-b58a-c5f001351a26&tw_document_href=https%3A%2F%2Fwww.deepinstinct.com%2Fblog%2Fdarkbeatc2-the-latest-muddywater-attack-framework&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=nzc8r&type=javascript&version=2.3.30

Requested by

Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.244.42.133 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.deepinstinct.com/
Accept-Language: he-IL,he;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-response-time: 103
date: Wed, 24 Apr 2024 10:52:23 GMT
strict-transport-security: max-age=0
server: tsa_o
content-type: image/gif;charset=utf-8
x-transaction-id: 4ceb9bf1a519e36e
cache-control: no-cache, no-store, max-age=0
perf: 7402827104
x-connection-hash: 17bf016a6509b42ebf9a8ee2b1c82043c9eb3de9e05c0af519d90afc4d15845f
content-length: 43

GET
H2 200 adsct
analytics.twitter.com/i/ 43 B
393 B 296ms
229ms Image
image/gif 104.244.42.131
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://analytics.twitter.com/i/adsct?bci=3&eci=2&event_id=31848f28-11f4-4cd0-9530-9e459cce5869&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=4a058533-e6bb-4420-b58a-c5f001351a26&tw_document_href=https%3A%2F%2Fwww.deepinstinct.com%2Fblog%2Fdarkbeatc2-the-latest-muddywater-attack-framework&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=nzc8r&type=javascript&version=2.3.30

Requested by

Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.244.42.131 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.deepinstinct.com/
Accept-Language: he-IL,he;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-response-time: 108
date: Wed, 24 Apr 2024 10:52:23 GMT
strict-transport-security: max-age=631138519
server: tsa_o
content-type: image/gif;charset=utf-8
x-transaction-id: 482f814900133b42
cache-control: no-cache, no-store, max-age=0
perf: 7402827104
x-connection-hash: f3d9ce1242837319446d67dc4bee2d75fe37e3fe245f01821122100e7c858d75
content-length: 43

GET
H2 200 5518.abf70040ebe14552.js Show response
www.deepinstinct.com/_next/static/chunks/ 17 KB
7 KB 382ms
372ms Script
application/javascript 3.70.101.28
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.deepinstinct.com/_next/static/chunks/5518.abf70040ebe14552.js

Requested by

Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/_next/static/chunks/webpack-29002f1662bf7c0b.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.70.101.28 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-70-101-28.eu-central-1.compute.amazonaws.com

Software

Netlify /

Resource Hash

3ad3f48e0876d9c90167457933958b33140d66ebb2c6b42107ade20b39fe2cdd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework
Accept-Language: he-IL,he;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-nf-request-id: 01HW7VRCX4XPTJ7H8G104ZG0A4
date: Wed, 24 Apr 2024 10:52:23 GMT
content-encoding: br
strict-transport-security: max-age=31536000
server: Netlify
age: 50024
cache-status: "Netlify Edge"; hit
etag: "a1bb3610d16d40d3994a04e335eb2f7b-ssl-df"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
cache-control: public,max-age=0,must-revalidate
accept-ranges: bytes
content-length: 7408

GET
H2 200 4c213f3cb0a0d816.css
www.deepinstinct.com/_next/static/css/ 1 KB
423 B 381ms
371ms Stylesheet
text/css 3.70.101.28
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.deepinstinct.com/_next/static/css/4c213f3cb0a0d816.css

Requested by

Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/_next/static/chunks/webpack-29002f1662bf7c0b.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.70.101.28 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-70-101-28.eu-central-1.compute.amazonaws.com

Software

Netlify /

Resource Hash

4fcc2873d9a9e427999107a83f322c299063db3dd645262a3330e4ed336208fc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework
Accept-Language: he-IL,he;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-nf-request-id: 01HW7VRCX4ZMG6RF8TFHB5E8T6
date: Wed, 24 Apr 2024 10:52:23 GMT
content-encoding: br
strict-transport-security: max-age=31536000
server: Netlify
age: 75746
cache-status: "Netlify Edge"; hit
etag: "6eccd5b5ee90f21ffe9daf5e31693980-ssl-df"
vary: Accept-Encoding
content-type: text/css; charset=UTF-8
cache-control: public,max-age=0,must-revalidate
accept-ranges: bytes
content-length: 309

GET
H2 200 1114.36c11ded4c40c351.js Show response
www.deepinstinct.com/_next/static/chunks/ 5 KB
2 KB 325ms
316ms Script
application/javascript 3.70.101.28
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.deepinstinct.com/_next/static/chunks/1114.36c11ded4c40c351.js

Requested by

Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/_next/static/chunks/webpack-29002f1662bf7c0b.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.70.101.28 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-70-101-28.eu-central-1.compute.amazonaws.com

Software

Netlify /

Resource Hash

140e801db59d24b4f0ba9e63042b32863068c1369989eb1e632e481f6fcf09f1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework
Accept-Language: he-IL,he;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-nf-request-id: 01HW7VRCX58J2FE1Y5E73PTMB8
date: Wed, 24 Apr 2024 10:52:23 GMT
content-encoding: br
strict-transport-security: max-age=31536000
server: Netlify
age: 75745
cache-status: "Netlify Edge"; hit
etag: "be2cb73604d20aae800d9673a2b8cb00-ssl-df"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
cache-control: public,max-age=0,must-revalidate
accept-ranges: bytes
content-length: 1666

GET
H2 200 7743.1cc5d0e5cea43aba.js Show response
www.deepinstinct.com/_next/static/chunks/ 2 KB
1 KB 381ms
373ms Script
application/javascript 3.70.101.28
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.deepinstinct.com/_next/static/chunks/7743.1cc5d0e5cea43aba.js

Requested by

Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/_next/static/chunks/webpack-29002f1662bf7c0b.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.70.101.28 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-70-101-28.eu-central-1.compute.amazonaws.com

Software

Netlify /

Resource Hash

e550590605f348a6163e6f1d157578a98364ee307dd221516f9f2401363e0c20

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework
Accept-Language: he-IL,he;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-nf-request-id: 01HW7VRCX5H2EV6YARHJSMWPR2
date: Wed, 24 Apr 2024 10:52:23 GMT
content-encoding: br
strict-transport-security: max-age=31536000
server: Netlify
age: 75745
cache-status: "Netlify Edge"; hit
etag: "b01362f8cfc3944820c788efd91353e8-ssl-df"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
cache-control: public,max-age=0,must-revalidate
accept-ranges: bytes
content-length: 1124

GET
H2 200 st.js Show response
s.swiftypecdn.com/install/v2/ 416 KB
110 KB 425ms
139ms Script
text/javascript 151.101.65.167
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://s.swiftypecdn.com/install/v2/st.js
Requested by: Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.65.167 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 2d7c7930eb39d59cd8c2dc00652977da3ed72347e7cd465f7b540e10e2121c22

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.deepinstinct.com/
Accept-Language: he-IL,he;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-served-by: cache-mrs10564-MRS
date: Wed, 24 Apr 2024 10:52:23 GMT
content-encoding: gzip
via: 1.1 varnish
age: 24
x-timer: S1713955944.913095,VS0,VE2
etag: "644bc37e-1b6c6"
vary: Accept-Encoding
x-cache: HIT
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=300, public, max-age=300, public
accept-ranges: bytes
content-length: 112326
x-cache-hits: 1

POST
H2 200 collect Show response
stats.g.doubleclick.net/j/ 7 B
355 B 350ms
114ms XHR
text/plain 74.125.206.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j101&tid=UA-69598329-1&cid=1069735733.1713955943&jid=710625362&gjid=628120718&_gid=1241762260.1713955943&_u=YCDACEAABAAAACAAI~&z=322476088

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.125.206.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

wk-in-f154.1e100.net

Software

Golfe2 /

Resource Hash

fda80d24f1bfe5a68b5f719a1febecfe747c79720e3a26b4b78b6a42b67b37b7

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
sec-ch-ua-platform: "Win32"
Referer: https://www.deepinstinct.com/
Accept-Language: he-IL,he;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
date: Wed, 24 Apr 2024 10:52:23 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.deepinstinct.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 7
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 bg9s Show response
tag-logger.demandbase.com/ 0
419 B 452ms
215ms XHR
text/html 143.204.98.12
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tag-logger.demandbase.com/bg9s?x-amz-cf-id=8rS1OAVnRLGkrGnI7a9DerWBOmWQzKWF25E5Jb7XMrpw0stIw8GhUQ==&api-version=v2
Requested by: Host: tag.demandbase.com
URL: https://tag.demandbase.com/8430ce879b38826d.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.98.12 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-98-12.fra50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.deepinstinct.com/
Accept-Language: he-IL,he;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-amz-version-id: 8SdDCdpJvGjkSiMFPv08XcVSgwOMVVmH
date: Wed, 24 Apr 2024 02:19:46 GMT
via: 1.1 32c8da10203574baccb74b8f771a7ffa.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA50-C1
age: 49435
x-amz-server-side-encryption: AES256
x-cache: Error from cloudfront
content-length: 0
last-modified: Tue, 07 Mar 2023 20:47:02 GMT
server: AmazonS3
etag: "d41d8cd98f00b204e9800998ecf8427e"
vary: Accept-Encoding
content-type: text/html
access-control-allow-origin: *
accept-ranges: bytes
x-amz-cf-id: aUF0uf0GkA2JnSVECLO70zvAmuGXv6mQ79mBb-JiENfSolInRDpdVA==

GET
H3 200 collect
www.google-analytics.com/ 35 B
55 B 120ms
119ms Image
image/gif 172.217.18.14
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j101&a=1238991542&t=event&ni=1&_s=2&dl=https%3A%2F%2Fwww.deepinstinct.com%2Fblog%2Fdarkbeatc2-the-latest-muddywater-attack-framework&ul=he-il&de=UTF-8&dt=DarkBeatC2%3A%20The%20Latest%20MuddyWater%20Attack%20Framework&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=Demandbase&ea=API%20Resolution&el=IP%20API&_u=aDDACEABBAAAACAAI~&jid=&gjid=&cid=1069735733.1713955943&tid=UA-69598329-1&_gid=1241762260.1713955943&gtm=45He44m0n8152PC3MWv78451102za200&gcd=13l3l3l3l1&dma=0&cd1=Fewbytes&cd2=Business%20Services&cd3=Management%20Consulting&cd4=SMB&cd5=3&cd6=Tel%20Aviv&cd7=IL&cd8=(Non-Company%20Visitor)&cd9=(Non-Company%20Visitor)&cd10=fewbytes.com&cd13=(Non-Company%20Visitor)&z=1134033915

Requested by

Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.18.14 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s22-in-f14.1e100.net

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.deepinstinct.com/
Accept-Language: he-IL,he;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Wed, 24 Apr 2024 09:24:40 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 5263
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H2 200 468591697375107 Show response
connect.facebook.net/signals/config/ 56 KB
12 KB 115ms
114ms Script
application/x-javascript 157.240.253.1
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/468591697375107?v=2.9.154&r=stable&domain=www.deepinstinct.com&hme=c3a545c63044e8e9102d4f32d84a1137594d024f28e801d670bc76dc5c075575&ex_m=67%2C112%2C99%2C103%2C58%2C3%2C93%2C66%2C15%2C91%2C84%2C49%2C51%2C158%2C161%2C172%2C168%2C169%2C171%2C28%2C94%2C50%2C73%2C170%2C153%2C156%2C165%2C166%2C173%2C121%2C14%2C48%2C178%2C177%2C123%2C17%2C33%2C38%2C1%2C41%2C62%2C63%2C64%2C68%2C88%2C16%2C13%2C90%2C87%2C86%2C100%2C102%2C37%2C101%2C29%2C25%2C154%2C157%2C130%2C27%2C10%2C11%2C12%2C5%2C6%2C24%2C21%2C22%2C54%2C59%2C61%2C71%2C95%2C26%2C72%2C8%2C7%2C76%2C46%2C20%2C97%2C96%2C9%2C19%2C18%2C81%2C53%2C79%2C32%2C70%2C0%2C89%2C31%2C78%2C83%2C45%2C44%2C82%2C36%2C4%2C85%2C77%2C42%2C39%2C34%2C80%2C2%2C35%2C60%2C40%2C98%2C43%2C75%2C65%2C104%2C57%2C56%2C30%2C92%2C55%2C52%2C47%2C74%2C69%2C23%2C105

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

157.240.253.1 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

xx-fbcdn-shv-02-fra5.fbcdn.net

Software

Resource Hash

5612daca21fe73f106c77cab5b0cdf820c777af49b1b0230d98e905c3df63e24

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' data: blob: ;script-src .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://.google-analytics.com .google.com;style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com: wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: .cdninstagram.com 'self' https://.google-analytics.com;img-src 'self' data: blob: * https://*.google-analytics.com;block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.deepinstinct.com/
Accept-Language: he-IL,he;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

content-security-policy: default-src 'self' data: blob: *;script-src *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://*.google-analytics.com *.google.com;style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' https://*.google-analytics.com;img-src 'self' data: blob: * https://*.google-analytics.com;block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; preload; includeSubDomains
date: Wed, 24 Apr 2024 10:52:23 GMT
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 11754
x-xss-protection: 0
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
x-fb-connection-quality: GOOD; q=0.7, rtt=50, rtx=0, c=61, mss=1380, tbw=63220, tp=-1, tpl=-1, uplat=1, ullat=-1
pragma: public
x-fb-debug: gCRTnCIGriMQsFzAt5KzpytvnLVuF+SNnXiqUzowrpAiAqIW6KOLNqZxUjyWzp7fQSE/E1uu4dwIMDoF7qyKnA==
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
cross-origin-opener-policy: same-origin-allow-popups;report-to="coop_report"
vary: Accept-Encoding
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
content-type: application/x-javascript; charset=utf-8
x-frame-options: DENY
origin-agent-cluster: ?0
cache-control: public, max-age=1200
permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), usb=(), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
timing-allow-origin: *
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
BLOB 200
OK b2460082-3e0f-4367-94a0-2c0343f5f2cc
https://www.deepinstinct.com/ 43 B
0 Image
image/gif

General

Check archive.org

Show headers Download Go to Show image

Full URL: blob:https://www.deepinstinct.com/b2460082-3e0f-4367-94a0-2c0343f5f2cc
Requested by: Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Request headers

Accept-Language: he-IL,he;q=0.9;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36

Response headers

Content-Length: 43
Content-Type: image/gif

GET
H2 200 prevention-for-storage.json Show response
www.deepinstinct.com/_next/data/7-TyYd0Ikn4eVyBeP3eWe/en/ 22 KB
7 KB 152ms
152ms Fetch
application/json 3.70.101.28
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.deepinstinct.com/_next/data/7-TyYd0Ikn4eVyBeP3eWe/en/prevention-for-storage.json?pid=prevention-for-storage

Requested by

Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/_next/static/chunks/main-c5b7e6d77b82bab5.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.70.101.28 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-70-101-28.eu-central-1.compute.amazonaws.com

Software

Netlify /

Resource Hash

3575cd73d754b670b319a5502e248f3cdee7920b2af18e206d42a6efc54d49df

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
purpose: prefetch
x-nextjs-data: 1
Accept-Language: he-IL,he;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Referer: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework
sec-ch-ua-platform: "Win32"

Response headers

x-nf-request-id: 01HW7VRDBWQX12V8PPVT4RRK97
date: Wed, 24 Apr 2024 10:52:23 GMT
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000
x-nextjs-date: Wed, 24 Apr 2024 10:03:34 GMT
age: 3003
x-nextjs-matched-path: /en/[pid]
content-length: 6401
netlify-vary: header=x-nextjs-data,cookie=__prerender_bypass|__next_preview_data
server: Netlify
cache-status: "Netlify Edge"; hit; fwd=stale
etag: "70xc33uog9hny-df"
vary: Accept-Encoding
content-type: application/json
cache-control: public,max-age=0,must-revalidate

GET
H2 200 %5Bpid%5D-ed9134132e10b8ba.js
www.deepinstinct.com/_next/static/chunks/pages/ 0
1 KB 153ms
152ms Other
application/javascript 3.70.101.28
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.deepinstinct.com/_next/static/chunks/pages/%5Bpid%5D-ed9134132e10b8ba.js

Requested by

Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/_next/static/chunks/main-c5b7e6d77b82bab5.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.70.101.28 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-70-101-28.eu-central-1.compute.amazonaws.com

Software

Netlify /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework
Accept-Language: he-IL,he;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-nf-request-id: 01HW7VRDBY3TB0DG3VYBPYKPPH
date: Wed, 24 Apr 2024 10:52:23 GMT
content-encoding: br
strict-transport-security: max-age=31536000
server: Netlify
age: 75747
cache-status: "Netlify Edge"; hit
etag: "15d332bb735e0dafb8bc25db3451253c-ssl-df"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
cache-control: public,max-age=0,must-revalidate
accept-ranges: bytes
content-length: 1256

GET
H2 200 blog.json Show response
www.deepinstinct.com/_next/data/7-TyYd0Ikn4eVyBeP3eWe/en/ 111 KB
30 KB 165ms
162ms Fetch
application/json 3.70.101.28
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.deepinstinct.com/_next/data/7-TyYd0Ikn4eVyBeP3eWe/en/blog.json?pid=blog

Requested by

Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/_next/static/chunks/main-c5b7e6d77b82bab5.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.70.101.28 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-70-101-28.eu-central-1.compute.amazonaws.com

Software

Netlify /

Resource Hash

8b0ad567f607c61d4574b49cf17871843915be8c7e2a9621d05c8f55ff8739c5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
purpose: prefetch
x-nextjs-data: 1
Accept-Language: he-IL,he;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Referer: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework
sec-ch-ua-platform: "Win32"

Response headers

x-nf-request-id: 01HW7VRDBYQS7JVKRE7FSBB5CE
date: Wed, 24 Apr 2024 10:52:23 GMT
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000
x-nextjs-date: Wed, 24 Apr 2024 01:11:02 GMT
age: 34911
x-nextjs-matched-path: /en/[pid]
content-length: 30184
netlify-vary: header=x-nextjs-data|Accept-Encoding,cookie=__prerender_bypass|__next_preview_data
server: Netlify
cache-status: "Netlify Edge"; hit; fwd=stale
etag: "aphoups31t2fcw-df"
vary: Accept-Encoding
content-type: application/json
cache-control: public,max-age=0,must-revalidate

GET
H2 200 1.json Show response
www.deepinstinct.com/_next/data/7-TyYd0Ikn4eVyBeP3eWe/en/author/simon-kenin/page/ 252 KB
62 KB 439ms
437ms Fetch
application/json 3.70.101.28
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.deepinstinct.com/_next/data/7-TyYd0Ikn4eVyBeP3eWe/en/author/simon-kenin/page/1.json

Requested by

Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/_next/static/chunks/main-c5b7e6d77b82bab5.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.70.101.28 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-70-101-28.eu-central-1.compute.amazonaws.com

Software

Netlify /

Resource Hash

f3e4e112b2d5e33eab4dc97800b6ea00858a4fedaf26f0fe21d5748863df3991

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
purpose: prefetch
x-nextjs-data: 1
Accept-Language: he-IL,he;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Referer: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework
sec-ch-ua-platform: "Win32"

Response headers

x-nf-request-id: 01HW7VRDBYP1TWK3RZGRRTE90W
date: Wed, 24 Apr 2024 10:52:24 GMT
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000
netlify-vary: header=x-nextjs-data|Accept-Encoding,cookie=__prerender_bypass|__next_preview_data
server: Netlify
age: 1004
cache-status: "Next.js"; hit; fwd=stale, "Netlify Edge"; fwd=miss
etag: "lfd5y5u6h55hv0-df"
vary: Accept-Encoding
content-type: application/json
x-nextjs-date: Wed, 24 Apr 2024 10:52:24 GMT
cache-control: no-cache
x-nextjs-matched-path: /en/author/[uid]/page/[pid]

GET
H2 200 %5Bpid%5D-dae3acf70331eea3.js
www.deepinstinct.com/_next/static/chunks/pages/author/%5Buid%5D/page/ 0
4 KB 152ms
151ms Other
application/javascript 3.70.101.28
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.deepinstinct.com/_next/static/chunks/pages/author/%5Buid%5D/page/%5Bpid%5D-dae3acf70331eea3.js

Requested by

Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/_next/static/chunks/main-c5b7e6d77b82bab5.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.70.101.28 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-70-101-28.eu-central-1.compute.amazonaws.com

Software

Netlify /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework
Accept-Language: he-IL,he;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-nf-request-id: 01HW7VRDBZG9WR2G9EDSY4K2G4
date: Wed, 24 Apr 2024 10:52:23 GMT
content-encoding: br
strict-transport-security: max-age=31536000
server: Netlify
age: 75157
cache-status: "Netlify Edge"; hit
etag: "cd19cee397474a5badc0b081afba1bd1-ssl-df"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
cache-control: public,max-age=0,must-revalidate
accept-ranges: bytes
content-length: 3808

GET
H2 200 1.json Show response
www.deepinstinct.com/_next/data/7-TyYd0Ikn4eVyBeP3eWe/en/author/deep-instinct-research/page/ 251 KB
61 KB 574ms
572ms Fetch
application/json 3.70.101.28
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.deepinstinct.com/_next/data/7-TyYd0Ikn4eVyBeP3eWe/en/author/deep-instinct-research/page/1.json

Requested by

Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/_next/static/chunks/main-c5b7e6d77b82bab5.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.70.101.28 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-70-101-28.eu-central-1.compute.amazonaws.com

Software

Netlify /

Resource Hash

c1bf2f1787d4c57156e2faff7d7259eccbafd4ea70e2cfdb065448e9e9a866fc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
purpose: prefetch
x-nextjs-data: 1
Accept-Language: he-IL,he;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Referer: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework
sec-ch-ua-platform: "Win32"

Response headers

x-nf-request-id: 01HW7VRDBYAFATTGQ0TADHV0XH
date: Wed, 24 Apr 2024 10:52:24 GMT
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000
netlify-vary: header=x-nextjs-data|Accept-Encoding,cookie=__prerender_bypass|__next_preview_data
server: Netlify
age: 939
cache-status: "Next.js"; hit; fwd=stale, "Netlify Edge"; fwd=miss
etag: "u0xpnp7rl5hhp-df"
vary: Accept-Encoding
content-type: application/json
x-nextjs-date: Wed, 24 Apr 2024 10:52:24 GMT
cache-control: no-cache
x-nextjs-matched-path: /en/author/[uid]/page/[pid]

GET
H2 200 ipv
cdn.bizible.com/ 43 B
305 B 140ms
115ms Image
image/gif 152.195.15.58
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cdn.bizible.com/ipv?_biz_r=&_biz_h=-1906410348&_biz_u=99dd9720e8c14da0b7788d3057981c47&_biz_l=https%3A%2F%2Fwww.deepinstinct.com%2Fblog%2Fdarkbeatc2-the-latest-muddywater-attack-framework&_biz_t=1713955943761&_biz_i=DarkBeatC2%3A%20The%20Latest%20MuddyWater%20Attack%20Framework&_biz_n=0&rnd=75655&cdn_o=a&_biz_z=1713955943770

Requested by

Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

152.195.15.58 , United States, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECS (frb/67BA) /

Resource Hash

afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSub

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.deepinstinct.com/
Accept-Language: he-IL,he;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Wed, 24 Apr 2024 10:52:23 GMT
strict-transport-security: max-age=31536000; includeSub
last-modified: Fri, 19 Apr 2024 21:15:25 GMT
server: ECS (frb/67BA)
age: 394618
x-cache: HIT
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
content-type: image/gif
cache-control: no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: -1

GET
H2 200 u
cdn.bizibly.com/ 43 B
182 B 145ms
114ms Image
image/gif 152.195.15.58
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cdn.bizibly.com/u?_biz_u=99dd9720e8c14da0b7788d3057981c47&_biz_l=https%3A%2F%2Fwww.deepinstinct.com%2Fblog%2Fdarkbeatc2-the-latest-muddywater-attack-framework&_biz_t=1713955943798&_biz_i=DarkBeatC2%3A%20The%20Latest%20MuddyWater%20Attack%20Framework&rnd=206349&cdn_o=a&_biz_z=1713955943798

Requested by

Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

152.195.15.58 , United States, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECS (frb/6752) /

Resource Hash

afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSub

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.deepinstinct.com/
Accept-Language: he-IL,he;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Wed, 24 Apr 2024 10:52:23 GMT
strict-transport-security: max-age=31536000; includeSub
last-modified: Fri, 19 Apr 2024 21:15:25 GMT
server: ECS (frb/6752)
age: 394618
x-cache: HIT
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
content-type: image/gif
cache-control: no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: -1

GET
H3 200 /
www.google.com/pagead/1p-user-list/812608847/ 42 B
64 B 613ms
165ms Image
image/gif 216.58.206.68
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/812608847/?random=1713955942972&cv=11&fst=1713952800000&bg=ffffff&guid=ON&async=1&gtm=45be44m0v9116635018z878451102za201&gcd=13l3l3l3l1&dma=0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.deepinstinct.com%2Fblog%2Fdarkbeatc2-the-latest-muddywater-attack-framework&hn=www.googleadservices.com&frm=0&tiba=DarkBeatC2%3A%20The%20Latest%20MuddyWater%20Attack%20Framework&npa=0&pscdl=noapi&auid=406974157.1713955943&uaa=x86&uab=64&uafvl=Chromium%3B124.0.6367.60%7CGoogle%2520Chrome%3B124.0.6367.60%7CNot-A.Brand%3B99.0.0.0&uamb=0&uam=&uap=Win32&uapv=10.0.0&uaw=0&fdr=QA&rfmt=3&fmt=3&is_vtc=1&cid=CAQSGwB7FLtqCM_k8Q36JgoWo450xRNlhOw_wHp0MA&random=2103131122&rmt_tld=0&ipr=y

Requested by

Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.206.68 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

tzfraa-aa-in-f4.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.deepinstinct.com/
Accept-Language: he-IL,he;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Wed, 24 Apr 2024 10:52:24 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.co.il/pagead/1p-user-list/812608847/ 42 B
154 B 140ms
120ms Image
image/gif 142.250.186.163
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.co.il/pagead/1p-user-list/812608847/?random=1713955942972&cv=11&fst=1713952800000&bg=ffffff&guid=ON&async=1&gtm=45be44m0v9116635018z878451102za201&gcd=13l3l3l3l1&dma=0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.deepinstinct.com%2Fblog%2Fdarkbeatc2-the-latest-muddywater-attack-framework&hn=www.googleadservices.com&frm=0&tiba=DarkBeatC2%3A%20The%20Latest%20MuddyWater%20Attack%20Framework&npa=0&pscdl=noapi&auid=406974157.1713955943&uaa=x86&uab=64&uafvl=Chromium%3B124.0.6367.60%7CGoogle%2520Chrome%3B124.0.6367.60%7CNot-A.Brand%3B99.0.0.0&uamb=0&uam=&uap=Win32&uapv=10.0.0&uaw=0&fdr=QA&rfmt=3&fmt=3&is_vtc=1&cid=CAQSGwB7FLtqCM_k8Q36JgoWo450xRNlhOw_wHp0MA&random=2103131122&rmt_tld=1&ipr=y

Requested by

Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.163 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s08-in-f3.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.deepinstinct.com/
Accept-Language: he-IL,he;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Wed, 24 Apr 2024 10:52:23 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

collect
px.ads.linkedin.com/
Redirect Chain

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=316505&time=1713955943822&li_adsId=b7706266-a5ee-44c2-a9c8-f8af6d57b689&url=https%3A%2F%2Fwww.deepinstinct.com%2Fblog%2Fdarkbeatc2-the-latest-mudd...
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=316505&time=1713955943822&li_adsId=b7706266-a5ee-44c2-a9c8-f8af6d57b689&url=https%3A%2F%2Fwww.deepinstinct.com%2Fblog%2Fdarkbeatc2-the-latest-mudd...
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D316505%26time%3D1713955943822%26li_adsId%3Db7706266-a5ee-44c2-a9c8-f8af6d57b689%2...
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=316505&time=1713955943822&li_adsId=b7706266-a5ee-44c2-a9c8-f8af6d57b689&url=https%3A%2F%2Fwww.deepinstinct.com%2Fblog%2Fdarkbeatc2-the-latest-mudd...

0
384 B

280ms
279ms

Image
application/javascript

13.107.42.14
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=316505&time=1713955943822&li_adsId=b7706266-a5ee-44c2-a9c8-f8af6d57b689&url=https%3A%2F%2Fwww.deepinstinct.com%2Fblog%2Fdarkbeatc2-the-latest-muddywater-attack-framework&cookiesTest=true&liSync=true
Requested by: Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework
Protocol: H2
Server: 13.107.42.14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: he-IL,he;q=0.9;q=0.9
Referer: https://www.deepinstinct.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36

Response headers

date: Wed, 24 Apr 2024 10:52:24 GMT
x-li-pop: afd-prod-lor1-x
x-msedge-ref: Ref A: 3038B381A6EC4044AC533C71D2B82736 Ref B: TLV30EDGE0307 Ref C: 2024-04-24T10:52:25Z
linkedin-action: 1
x-cache: CONFIG_NOCACHE
content-type: application/javascript
x-li-fabric: prod-lor1
x-li-proto: http/2
content-length: 0
x-li-uuid: AAYW1XdGeS7Kzhbnu+hq/Q==

Redirect headers

strict-transport-security: max-age=31536000
content-security-policy: frame-ancestors 'self'
x-content-type-options: nosniff
date: Wed, 24 Apr 2024 10:52:24 GMT
linkedin-action: 1
x-cache: CONFIG_NOCACHE
content-length: 0
x-li-uuid: AAYW1Xc/ydnUiDlyVOg48g==
pragma: no-cache
x-li-pop: afd-prod-lor1-x
x-msedge-ref: Ref A: 9DE83DB2F16645F38DE43EFE3CF7B99B Ref B: TLV30EDGE0307 Ref C: 2024-04-24T10:52:24Z
x-frame-options: sameorigin
x-li-fabric: prod-lor1
location: https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=316505&time=1713955943822&li_adsId=b7706266-a5ee-44c2-a9c8-f8af6d57b689&url=https%3A%2F%2Fwww.deepinstinct.com%2Fblog%2Fdarkbeatc2-the-latest-muddywater-attack-framework&cookiesTest=true&liSync=true
cache-control: no-cache, no-store
x-li-proto: http/2
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H3 200 ga-audiences
www.google.com/ads/ 42 B
63 B 152ms
152ms Image
image/gif 216.58.206.68
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j101&tid=UA-69598329-1&cid=1069735733.1713955943&jid=710625362&_u=YCDACEAABAAAACAAI~&z=1066706195

Requested by

Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.206.68 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

tzfraa-aa-in-f4.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.deepinstinct.com/
Accept-Language: he-IL,he;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Wed, 24 Apr 2024 10:52:24 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ga-audiences
www.google.co.il/ads/ 42 B
63 B 137ms
137ms Image
image/gif 142.250.186.163
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.co.il/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j101&tid=UA-69598329-1&cid=1069735733.1713955943&jid=710625362&_u=YCDACEAABAAAACAAI~&z=1066706195

Requested by

Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.163 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s08-in-f3.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.deepinstinct.com/
Accept-Language: he-IL,he;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Wed, 24 Apr 2024 10:52:24 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 partners.json Show response
www.deepinstinct.com/_next/data/7-TyYd0Ikn4eVyBeP3eWe/en/ 26 KB
7 KB 357ms
356ms Fetch
application/json 3.70.101.28
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.deepinstinct.com/_next/data/7-TyYd0Ikn4eVyBeP3eWe/en/partners.json?pid=partners

Requested by

Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/_next/static/chunks/main-c5b7e6d77b82bab5.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.70.101.28 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-70-101-28.eu-central-1.compute.amazonaws.com

Software

Netlify /

Resource Hash

dd2c60ce2a0e8c99bffd15d5941f53f0b508eaeb2c66b0181d563ed23240ff15

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
purpose: prefetch
x-nextjs-data: 1
Accept-Language: he-IL,he;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Referer: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework
sec-ch-ua-platform: "Win32"

Response headers

x-nf-request-id: 01HW7VRE39BQZKSQ1BFABC80BX
date: Wed, 24 Apr 2024 10:52:24 GMT
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000
x-nextjs-date: Wed, 24 Apr 2024 10:52:24 GMT
age: 778
x-nextjs-matched-path: /en/[pid]
content-length: 6662
netlify-vary: header=x-nextjs-data,cookie=__prerender_bypass|__next_preview_data
server: Netlify
cache-status: "Next.js"; hit; fwd=stale, "Netlify Edge"; fwd=stale
etag: "iu627gl25hkq0-df"
vary: Accept-Encoding
content-type: application/json
cache-control: public,max-age=0,must-revalidate

GET
H2 200 xdc.js Show response
cdn.bizible.com/ 111 B
345 B 224ms
224ms Script
text/javascript 152.195.15.58
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.bizible.com/xdc.js?_biz_u=99dd9720e8c14da0b7788d3057981c47&_biz_h=-1906410348&cdn_o=a&jsVer=4.24.04.18

Requested by

Host: cdn.bizible.com
URL: https://cdn.bizible.com/scripts/bizible.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

152.195.15.58 , United States, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECS (frb/6711) /

Resource Hash

aadc9e1a13a480ebf46e128f841559fa28e2d73cc47a2cf75f3ec5e63a0250d6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSub

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.deepinstinct.com/
Accept-Language: he-IL,he;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 24 Apr 2024 10:52:24 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSub
server: ECS (frb/6711)
etag: 8EEEF163
vary: Accept-Encoding
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
content-type: text/javascript; charset=utf-8
cache-control: private, must-revalidate, max-age=21600
content-length: 215

GET
H3 200 332937911623471 Show response
connect.facebook.net/signals/config/ 20 KB
3 KB 112ms
111ms Script
application/x-javascript 157.240.253.1
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/332937911623471?v=2.9.154&r=stable&domain=www.deepinstinct.com&hme=c3a545c63044e8e9102d4f32d84a1137594d024f28e801d670bc76dc5c075575&ex_m=67%2C112%2C99%2C103%2C58%2C3%2C93%2C66%2C15%2C91%2C84%2C49%2C51%2C158%2C161%2C172%2C168%2C169%2C171%2C28%2C94%2C50%2C73%2C170%2C153%2C156%2C165%2C166%2C173%2C121%2C14%2C48%2C178%2C177%2C123%2C17%2C33%2C38%2C1%2C41%2C62%2C63%2C64%2C68%2C88%2C16%2C13%2C90%2C87%2C86%2C100%2C102%2C37%2C101%2C29%2C25%2C154%2C157%2C130%2C27%2C10%2C11%2C12%2C5%2C6%2C24%2C21%2C22%2C54%2C59%2C61%2C71%2C95%2C26%2C72%2C8%2C7%2C76%2C46%2C20%2C97%2C96%2C9%2C19%2C18%2C81%2C53%2C79%2C32%2C70%2C0%2C89%2C31%2C78%2C83%2C45%2C44%2C82%2C36%2C4%2C85%2C77%2C42%2C39%2C34%2C80%2C2%2C35%2C60%2C40%2C98%2C43%2C75%2C65%2C104%2C57%2C56%2C30%2C92%2C55%2C52%2C47%2C74%2C69%2C23%2C105%2C184%2C183%2C185%2C190%2C191%2C192%2C188%2C180%2C122%2C150%2C179%2C181%2C113%2C144%2C135%2C139%2C119%2C174%2C216%2C106%2C217%2C152%2C110%2C133%2C126%2C114

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

QUIC, , AES_128_GCM

Server

157.240.253.1 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

xx-fbcdn-shv-02-fra5.fbcdn.net

Software

Resource Hash

b247376c3e2732c8d76dd1d9db2151db9261ad2f27b068835af63c14c17401e1

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' data: blob: ;script-src .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://.google-analytics.com .google.com;style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com: wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: .cdninstagram.com 'self' https://.google-analytics.com;img-src 'self' data: blob: * https://*.google-analytics.com;block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.deepinstinct.com/
Accept-Language: he-IL,he;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

content-security-policy: default-src 'self' data: blob: *;script-src *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://*.google-analytics.com *.google.com;style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' https://*.google-analytics.com;img-src 'self' data: blob: * https://*.google-analytics.com;block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; preload; includeSubDomains
date: Wed, 24 Apr 2024 10:52:24 GMT
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 2726
x-xss-protection: 0
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
x-fb-connection-quality: GOOD; q=0.7, rtt=115, rtx=0, c=38, mss=1232, tbw=4323, tp=9, tpl=0, uplat=1, ullat=-1
pragma: public
x-fb-debug: nLB0RH91xF7iJlYDh9Awow5/IH773dvBqJkph9Fj7h15fRXl9MwyCOGKgxKboTwR3xoqwzqUHeqZCJC7MN7hEw==
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
cross-origin-opener-policy: same-origin-allow-popups;report-to="coop_report"
vary: Accept-Encoding
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
content-type: application/x-javascript; charset=utf-8
x-frame-options: DENY
origin-agent-cluster: ?0
cache-control: public, max-age=1200
permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), usb=(), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
timing-allow-origin: *
priority: u=3,i
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 browser-perf.8417c6bba72228fa2e29.js Show response
script.hotjar.com/ 5 KB
2 KB 112ms
112ms Script
application/javascript 13.33.187.19
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://script.hotjar.com/browser-perf.8417c6bba72228fa2e29.js

Requested by

Host: script.hotjar.com
URL: https://script.hotjar.com/modules.588629dd3c10b20ab52d.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.33.187.19 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-33-187-19.fra60.r.cloudfront.net

Software

Resource Hash

70712c8650feecc46403b5801b9d5b72d5b2d6ba1d1cf0317e105603982321bf

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.deepinstinct.com/
Accept-Language: he-IL,he;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 24 Jan 2024 14:32:07 GMT
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=2592000; includeSubDomains
via: 1.1 6641a812839e5267ee0880e96b41efc4.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P9
age: 7849217
x-cache: Hit from cloudfront
cross-origin-resource-policy: cross-origin
content-length: 1782
last-modified: Wed, 24 Jan 2024 14:31:37 GMT
etag: "b83b61bc5871e9a23a0434e2c539f4f3"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
accept-ranges: bytes
x-robots-tag: none
x-amz-cf-id: Wm5boBVw5g7FubIrixUIkwX1usbF79gtLQOITSCW3sD8iOJx3DBy4Q==

GET
H2 200 NW3rMrxBqJx71BachJFa.json Show response
s.swiftypecdn.com/install/v2/config/ 19 KB
5 KB 427ms
145ms XHR
application/json 151.101.65.167
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://s.swiftypecdn.com/install/v2/config/NW3rMrxBqJx71BachJFa.json

Requested by

Host: cdn.bizible.com
URL: https://cdn.bizible.com/scripts/bizible.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.65.167 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

9a496e8b9da307a0d817e4104c0418c6ff0c8841c6bbb8e426a424d304ac3296

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Accept: */*
Referer: https://www.deepinstinct.com/
Accept-Language: he-IL,he;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 24 Apr 2024 10:52:25 GMT
content-encoding: gzip
x-content-type-options: nosniff
via: 1.1 varnish
x-permitted-cross-domain-policies: none
age: 16
x-cache: HIT
content-length: 4251
x-xss-protection: 1; mode=block
x-request-id: 0c823faea92e60538d31406df18e3bff
x-served-by: cache-mrs10556-MRS
referrer-policy: strict-origin-when-cross-origin
last-modified: Tue, 16 May 2023 16:51:29 GMT
x-timer: S1713955945.128756,VS0,VE1
etag: W/"0b4dc992c692095d33a1f63f87bd38a6"
x-download-options: noopen
x-frame-options: SAMEORIGIN
access-control-max-age: 7200
access-control-allow-methods: GET, POST
content-type: application/json; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers
cache-control: max-age=300, public
access-control-allow-credentials: true
vary: Accept-Encoding, Origin
accept-ranges: bytes
x-cache-hits: 1

GET
H2 200 /
www.facebook.com/tr/ 0
269 B 334ms
112ms Image
text/plain 157.240.253.35
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=468591697375107&ev=PageView&dl=https%3A%2F%2Fwww.deepinstinct.com%2Fblog%2Fdarkbeatc2-the-latest-muddywater-attack-framework&rl=&if=false&ts=1713955945093&sw=1600&sh=1200&v=2.9.154&r=stable&ec=0&o=4126&fbp=fb.1.1713955945092.1414532358&ler=empty&cdl=API_unavailable&it=1713955943673&coo=false&rqm=GET

Requested by

Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

157.240.253.35 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

edge-star-mini-shv-02-fra5.facebook.com

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.deepinstinct.com/
Accept-Language: he-IL,he;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-fb-connection-quality: GOOD; q=0.7, rtt=51, rtx=0, c=10, mss=1380, tbw=2804, tp=-1, tpl=-1, uplat=1, ullat=0
strict-transport-security: max-age=31536000; includeSubDomains
date: Wed, 24 Apr 2024 10:52:25 GMT
server: proxygen-bolt
content-type: text/plain
access-control-allow-origin
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 0

GET
H2 200 /
www.facebook.com/tr/ 0
32 B 333ms
112ms Image
text/plain 157.240.253.35
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=332937911623471&ev=PageView&dl=https%3A%2F%2Fwww.deepinstinct.com%2Fblog%2Fdarkbeatc2-the-latest-muddywater-attack-framework&rl=&if=false&ts=1713955945095&sw=1600&sh=1200&v=2.9.154&r=stable&ec=0&o=4126&fbp=fb.1.1713955945092.1414532358&ler=empty&cdl=API_unavailable&it=1713955943673&coo=false&rqm=GET

Requested by

Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

157.240.253.35 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

edge-star-mini-shv-02-fra5.facebook.com

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.deepinstinct.com/
Accept-Language: he-IL,he;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-fb-connection-quality: GOOD; q=0.7, rtt=51, rtx=0, c=10, mss=1380, tbw=2804, tp=-1, tpl=-1, uplat=1, ullat=0
strict-transport-security: max-age=31536000; includeSubDomains
date: Wed, 24 Apr 2024 10:52:25 GMT
server: proxygen-bolt
content-type: text/plain
access-control-allow-origin
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 0

GET
H2 200 %5Bpid%5D-ed9134132e10b8ba.js Show response
www.deepinstinct.com/_next/static/chunks/pages/ 5 KB
0 1ms
1ms Script
application/javascript 3.70.101.28
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://www.deepinstinct.com/_next/static/chunks/pages/%5Bpid%5D-ed9134132e10b8ba.js
Requested by: Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/_next/static/chunks/main-c5b7e6d77b82bab5.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.70.101.28 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-70-101-28.eu-central-1.compute.amazonaws.com
Software: Netlify /
Resource Hash: 488b5f9d2946120012efd50d989959509b06c83f9b720d0bb58edafadc71bfac

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework
Accept-Language: he-IL,he;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-nf-request-id: 01HW7VRDBY3TB0DG3VYBPYKPPH
date: Wed, 24 Apr 2024 10:52:23 GMT
content-encoding: br
server: Netlify
age: 75747
cache-status: "Netlify Edge"; hit
etag: "15d332bb735e0dafb8bc25db3451253c-ssl-df"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
cache-control: public,max-age=0,must-revalidate
accept-ranges: bytes
content-length: 1256

GET
H2 200 7e11275f8e6fc085.css Show response
www.deepinstinct.com/_next/static/css/ 14 KB
3 KB 164ms
159ms Fetch
text/css 3.70.101.28
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.deepinstinct.com/_next/static/css/7e11275f8e6fc085.css

Requested by

Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/_next/static/chunks/main-c5b7e6d77b82bab5.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.70.101.28 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-70-101-28.eu-central-1.compute.amazonaws.com

Software

Netlify /

Resource Hash

50b4811918e32d93ed527f463f88ac9d4dafd29d14b5f17ee69f623bf3aba360

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework
Accept-Language: he-IL,he;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-nf-request-id: 01HW7VREPEFJ9T4HGAK11JFM93
date: Wed, 24 Apr 2024 10:52:25 GMT
content-encoding: br
strict-transport-security: max-age=31536000
server: Netlify
age: 75751
cache-status: "Netlify Edge"; hit
etag: "a08d329af0ca27ab60ede65e07cd2abf-ssl-df"
vary: Accept-Encoding
content-type: text/css; charset=UTF-8
cache-control: public,max-age=0,must-revalidate
accept-ranges: bytes
content-length: 3169

GET
H2 200 %5Bpid%5D-dae3acf70331eea3.js Show response
www.deepinstinct.com/_next/static/chunks/pages/author/%5Buid%5D/page/ 10 KB
0 2ms
1ms Script
application/javascript 3.70.101.28
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://www.deepinstinct.com/_next/static/chunks/pages/author/%5Buid%5D/page/%5Bpid%5D-dae3acf70331eea3.js
Requested by: Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/_next/static/chunks/main-c5b7e6d77b82bab5.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.70.101.28 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-70-101-28.eu-central-1.compute.amazonaws.com
Software: Netlify /
Resource Hash: ec123bd26b1064cd72ca8c52f9c5576d95587da65aa9e2efdbc2fcccf892a8f4

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework
Accept-Language: he-IL,he;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-nf-request-id: 01HW7VRDBZG9WR2G9EDSY4K2G4
date: Wed, 24 Apr 2024 10:52:23 GMT
content-encoding: br
server: Netlify
age: 75157
cache-status: "Netlify Edge"; hit
etag: "cd19cee397474a5badc0b081afba1bd1-ssl-df"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
cache-control: public,max-age=0,must-revalidate
accept-ranges: bytes
content-length: 3808

GET
H2 200 b5a64cbe6880b7dc.css Show response
www.deepinstinct.com/_next/static/css/ 16 KB
4 KB 164ms
160ms Fetch
text/css 3.70.101.28
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.deepinstinct.com/_next/static/css/b5a64cbe6880b7dc.css

Requested by

Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/_next/static/chunks/main-c5b7e6d77b82bab5.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.70.101.28 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-70-101-28.eu-central-1.compute.amazonaws.com

Software

Netlify /

Resource Hash

09e468b6ae3eaabab8e4f41329c722ee5ff819b477146ea02d27a7b1b49d5050

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework
Accept-Language: he-IL,he;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-nf-request-id: 01HW7VREPFC2S7QYFZ3FFSGWY2
date: Wed, 24 Apr 2024 10:52:25 GMT
content-encoding: br
strict-transport-security: max-age=31536000
server: Netlify
age: 75159
cache-status: "Netlify Edge"; hit
etag: "a85bff580d8ffd9cf629505d2f37a034-ssl-df"
vary: Accept-Encoding
content-type: text/css; charset=UTF-8
cache-control: public,max-age=0,must-revalidate
accept-ranges: bytes
content-length: 3635

GET
H2 200 new_embed-2552d8d62d9c60f59b3b11a5d083d1ebd090c72de809fc7c76fb339825302241.css
s.swiftypecdn.com/assets/ 89 KB
33 KB 136ms
136ms Stylesheet
text/css 151.101.65.167
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://s.swiftypecdn.com/assets/new_embed-2552d8d62d9c60f59b3b11a5d083d1ebd090c72de809fc7c76fb339825302241.css
Requested by: Host: s.swiftypecdn.com
URL: https://s.swiftypecdn.com/install/v2/st.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.65.167 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 2552d8d62d9c60f59b3b11a5d083d1ebd090c72de809fc7c76fb339825302241

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.deepinstinct.com/
Accept-Language: he-IL,he;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-cache-hits: 169
date: Wed, 24 Apr 2024 10:52:25 GMT
content-encoding: gzip
via: 1.1 varnish
age: 41096
x-cache: HIT
content-length: 33983
x-served-by: cache-mrs10564-MRS
x-timer: S1713955945.278059,VS0,VE0
etag: "62b9d075-84bf"
vary: Accept-Encoding
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=31536000, public
accept-ranges: bytes
expires: Wed, 23 Apr 2025 23:27:28 GMT

POST
H2 204 / Show response
px.ads.linkedin.com/wa/ 0
199 B 302ms
302ms XHR
text/plain 13.107.42.14
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://px.ads.linkedin.com/wa/
Requested by: Host: cdn.bizible.com
URL: https://cdn.bizible.com/scripts/bizible.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 13.107.42.14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Accept-Language: he-IL,he;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Accept: *
Referer: https://www.deepinstinct.com/
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 24 Apr 2024 10:52:25 GMT
x-li-pop: afd-prod-lor1-x
x-msedge-ref: Ref A: 88042AFFE0B24A25AE0364A1784A6927 Ref B: TLV30EDGE0307 Ref C: 2024-04-24T10:52:25Z
linkedin-action: 1
vary: Origin
x-cache: CONFIG_NOCACHE
x-li-fabric: prod-lor1
access-control-allow-origin: https://www.deepinstinct.com
x-li-proto: http/2
access-control-allow-credentials: true
x-li-uuid: AAYW1XdKx3vLcbKbC/yTKg==

GET
H/1.1 200
OK cc.js
cc.swiftype.com/ 43 B
279 B 921ms
227ms Image
image/gif 169.48.219.66
SOFTLAYER

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cc.swiftype.com/cc.js?engine_key=zPgdszsQivuSeQwTEHrm&url=https%3A%2F%2Fwww.deepinstinct.com%2Fblog%2Fdarkbeatc2-the-latest-muddywater-attack-framework
Requested by: Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 169.48.219.66 , United States, ASN36351 (SOFTLAYER, US),
Reverse DNS: 42.db.30a9.ip4.static.sl-reverse.com
Software: /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.deepinstinct.com/
Accept-Language: he-IL,he;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Content-Type: image/gif
Date: Wed, 24 Apr 2024 10:52:26 GMT
Cache-Control: no-cache
Last-Modified: Mon, 28 Sep 1970 06:00:00 GMT
Connection: keep-alive
Content-Length: 43
Expires: Wed, 24 Apr 2024 10:52:25 GMT

GET
H/1.1 200
OK messenger
app.qualified.com/w/1/DxHYmKWTScn3buDp/ Frame BBEC 0
0 745ms
261ms Document
text/html 35.171.141.234
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://app.qualified.com/w/1/DxHYmKWTScn3buDp/messenger?uuid=a5b6fcd1-5260-476a-a20d-8dc134fa29f5

Requested by

Host: js.qualified.com
URL: https://js.qualified.com/qualified.js?token=DxHYmKWTScn3buDp

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

35.171.141.234 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-35-171-141-234.compute-1.amazonaws.com

Software

Resource Hash

Security Headers

Name	Value
Content-Security-Policy
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: he-IL,he;q=0.9;q=0.9
Referer: https://www.deepinstinct.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Win32"

Response headers

Cache-Control: max-age=0, private, must-revalidate
Content-Encoding: gzip
Content-Length: 1642
Content-Security-Policy
Content-Type: text/html; charset=utf-8
Date: Wed, 24 Apr 2024 10:52:26 GMT
Etag: W/"a6fabb27c70e149c8124f732926bbdaf"
Link: <https://assets.qualified.com/packs/css/vendors~widget/sandboxed/messenger-94e6eccc.chunk.css>; rel=preload; as=style; nopush,<https://assets.qualified.com/packs/css/widget/sandboxed/messenger-ea37ea0f.chunk.css>; rel=preload; as=style; nopush
Referrer-Policy: strict-origin-when-cross-origin
Strict-Transport-Security: max-age=63072000; includeSubDomains
Vary: Accept-Encoding
Via: 1.1 spaces-router (2a9d893844a5)
X-Content-Type-Options: nosniff
X-Download-Options: noopen
X-Permitted-Cross-Domain-Policies: none
X-Request-Id: bd39418e-d735-5159-9ed3-db81982689f6
X-Runtime: 0.021710
X-Xss-Protection: 1; mode=block

GET
H2 200 __ptq.gif
track.hubspot.com/ 45 B
1 KB 390ms
256ms Image
image/gif 104.16.117.116
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://track.hubspot.com/__ptq.gif?k=1&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=he-il&bfp=801040782&v=1.1&a=2183098&rcu=https%3A%2F%2Fwww.deepinstinct.com%2Fblog%2Fdarkbeatc2-the-latest-muddywater-attack-framework&pu=https%3A%2F%2Fwww.deepinstinct.com%2Fblog%2Fdarkbeatc2-the-latest-muddywater-attack-framework&t=DarkBeatC2%3A+The+Latest+MuddyWater+Attack+Framework&cts=1713955947462&vi=2015b89f7b3ce22295bfc0163da98b7e&nc=true&u=160033954.2015b89f7b3ce22295bfc0163da98b7e.1713955947457.1713955947457.1713955947457.1&b=160033954.1.1713955947458&pt=0&cc=15

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.117.116 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.deepinstinct.com/
Accept-Language: he-IL,he;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 24 Apr 2024 10:52:27 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-evy-trace-route-service-name: envoyset-translator
x-hubspot-correlation-id: b5251f75-8b64-4dea-a149-53db05f6c2bb
p3p: CP="NOI CUR ADM OUR NOR STA NID"
x-envoy-upstream-service-time: 9
content-length: 45
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: b5251f75-8b64-4dea-a149-53db05f6c2bb
server: cloudflare
vary: origin, Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ZacBF8LQ6gNjPtNc7dpun30rt4otvjWR2T4SWN5oJxNGoKNL6FAJIGsRVOz4L9QIrxRUrgQDePgj1y%2BZrz4i1LkcfoVAbOVq%2FK1wMdlZD%2FPK7Yqaopz%2Bh6iMx%2FVDF9g5%2FE9N"}],"group":"cf-nel","max_age":604800}
content-type: image/gif
x-evy-trace-served-by-pod: iad02/analytics-tracking-td/envoy-proxy-76d96f8b5d-rk2jf
x-evy-trace-virtual-host: all
cache-control: no-cache, no-store, no-transform
access-control-allow-credentials: false
cf-ray: 87958b40ad5ae3cb-TLV
x-robots-tag: none

GET
H2 200 favicon-32x32.png
www.deepinstinct.com/favicon/ 1 KB
1 KB 157ms
157ms Other
image/png 3.70.101.28
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.deepinstinct.com/favicon/favicon-32x32.png

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.70.101.28 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-70-101-28.eu-central-1.compute.amazonaws.com

Software

Netlify /

Resource Hash

5be8aaeb682186c135e30933672211af0127c48e96ac3cb3e2b4a9379e8b861b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework
Accept-Language: he-IL,he;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-nf-request-id: 01HW7VRH0AT9TVX5DBKS3KZTCH
date: Wed, 24 Apr 2024 10:52:27 GMT
strict-transport-security: max-age=31536000
server: Netlify
age: 75184
cache-status: "Netlify Edge"; hit
etag: "6c3361589f0d0f46f3458658f29255f6-ssl"
content-type: image/png
cache-control: public,max-age=0,must-revalidate
accept-ranges: bytes
content-length: 1056

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: id.rlcdn.com
URL: https://id.rlcdn.com/464526.gif

Verdicts & Comments Add Verdict or Comment

103 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

44 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.deepinstinct.com/	1970-01-20 22:15:31	Name: _gcl_au Value: 1.1.406974157.1713955943
.techtarget.com/	1970-01-20 20:05:57	Name: __cf_bm Value: XjSB4zNYOuvEo2Xr4gpvJ6RMWuaqBDiQzCaz9E65qZQ-1713955942-1.0.1.1-20nJqLSGF4_TvuLkx7pXANk9wjknhjlahET8gi7c6ZKm4z7_ShM3OD1JPr7tAPAXuX9hgvk3E9FPMQouM_3EKw
.deepinstinct.com/	1970-01-21 05:41:55	Name: _ga_P5MMKMDSNW Value: GS1.1.1713955943.1.0.1713955943.60.0.0
.deepinstinct.com/	1970-01-20 20:07:22	Name: _uetsid Value: baf9c3c0022811ef9abcd333afd4b7ed
.deepinstinct.com/	1970-01-21 05:27:31	Name: _uetvid Value: baf9e5b0022811efa99c7116c5e9898a
.deepinstinct.com/	1970-01-21 05:41:55	Name: _ga Value: GA1.2.1069735733.1713955943
.deepinstinct.com/	1970-01-20 20:07:22	Name: _gid Value: GA1.2.1241762260.1713955943
.deepinstinct.com/	1970-01-20 20:05:56	Name: _gat_UA-69598329-1 Value: 1
.bing.com/	1970-01-21 05:27:31	Name: MUID Value: 06E4EDE4BCEE62301AF9F98FBD93631E
.company-target.com/	1970-01-21 05:41:55	Name: tuuid Value: 49594a8c-3a2b-458d-90f3-795c642e41a6
.company-target.com/	1970-01-21 05:41:55	Name: tuuid_lu Value: 1713955943\|ix:0\|mctv:0\|rp:0
.doubleclick.net/	1970-01-20 20:05:56	Name: test_cookie Value: CheckForPermission
.deepinstinct.com/	1970-01-21 04:51:31	Name: _biz_uid Value: 99dd9720e8c14da0b7788d3057981c47
.deepinstinct.com/	1970-01-21 04:51:31	Name: _biz_nA Value: 1
.t.co/	1970-01-21 05:41:55	Name: muc_ads Value: 65d4831e-d70a-4ba0-87c8-20c05013813d
.bizible.com/	1970-01-21 04:51:31	Name: _BUID Value: 99dd9720e8c14da0b7788d3057981c47
.bizibly.com/	1970-01-21 04:51:31	Name: _BUID Value: 4b40566d3568b78d2b08cb391f03c7fc
.twitter.com/	1970-01-21 05:41:55	Name: personalization_id Value: "v1_WjzJjuV0awHhPP7K58qkUQ=="
.casalemedia.com/	1970-01-21 04:51:31	Name: CMID Value: ZijkZ4sFVUwAAAMxAUnRwQAA
.casalemedia.com/	1970-01-20 22:15:31	Name: CMPS Value: 4756
.casalemedia.com/	1970-01-20 22:15:31	Name: CMPRO Value: 4756
.rubiconproject.com/	1970-01-21 04:51:31	Name: khaos Value: LVDP46DS-G-FHFS
.rubiconproject.com/	1970-01-21 04:51:31	Name: audit Value: 1\|e/Isbl/RrpCzvHvxIsjNOBJcYzEvaDAWjPl8ZfL/muOUHKCefwHvs1zs4v6vkiLpKFNxW9ZtmR9w0S94mtzOHwmugVMwSc1V0miLXFpk/3VFnfy197n4wh6KI3AW2TEomNAhOOWRf6Fd7y0hif7XrWDOSzpLcSR00r1UU9Ix4w1JSUn9Ni8QcA==
.rubiconproject.com/	1970-01-20 22:15:31	Name: receive-cookie-deprecation Value: 1
.linkedin.com/	1970-01-20 22:15:31	Name: li_sugr Value: 3691d4b1-ec6d-4245-aedc-d010f236254c
.linkedin.com/	1970-01-21 04:51:31	Name: bcookie Value: "v=2&22357f43-0be0-4033-80fd-20fb9ac685bc"
.linkedin.com/	1970-01-20 20:07:22	Name: lidc Value: "b=OGST05:s=O:r=O:a=O:p=O:g=3037:u=1:x=1:i=1713955944:t=1714042344:v=2:sig=AQHOA6By3JCiLOB2Zsw6luku6TWDNBgb"
.tremorhub.com/	1970-01-21 04:51:52	Name: tvid Value: 9b79fa22b7644e718b2d2f8ab87600e2
.tremorhub.com/	1970-01-21 05:41:55	Name: tv_UIDM Value: 49594a8c-3a2b-458d-90f3-795c642e41a6
.deepinstinct.com/	1970-01-21 04:51:31	Name: _biz_pendingA Value: %5B%5D
.linkedin.com/	1970-01-20 20:49:07	Name: UserMatchHistory Value: AQLJeldgaGkWUAAAAY8PvDf_lvoYmv4qPXvUooWg09VO72OwQB9FHbwH3_KN5Jl1rgZqFlU9Dk1s2w
.linkedin.com/	1970-01-20 20:49:07	Name: AnalyticsSyncHistory Value: AQJAofv3tBeFLQAAAY8PvDf_GTCkElIz4bsi1j6ByLdd8RfMn3xl52najr3pAshMqO7rg5SctYzufG0qmAHIpA
.deepinstinct.com/	1970-01-21 05:41:55	Name: __q_state_DxHYmKWTScn3buDp Value: eyJ1dWlkIjoiYTViNmZjZDEtNTI2MC00NzZhLWEyMGQtOGRjMTM0ZmEyOWY1IiwiY29va2llRG9tYWluIjoiZGVlcGluc3RpbmN0LmNvbSJ9
.deepinstinct.com/	1970-01-21 04:51:31	Name: _hjSessionUser_1665869 Value: eyJpZCI6IjQ2MjE5NjFjLWE5MmUtNTI5Yi04NTJkLTI1NzMzMTczZGMwYiIsImNyZWF0ZWQiOjE3MTM5NTU5NDQ3NDIsImV4aXN0aW5nIjpmYWxzZX0=
.deepinstinct.com/	1970-01-20 20:05:57	Name: _hjSession_1665869 Value: eyJpZCI6ImZiOTllOTJiLWQwMjMtNGE2Zi1iNGY0LWRkM2NhNmNmNmY3NCIsImMiOjE3MTM5NTU5NDQ3NDQsInMiOjAsInIiOjAsInNiIjowLCJzciI6MCwic2UiOjAsImZzIjoxLCJzcCI6MH0=
.www.linkedin.com/	1970-01-21 04:51:31	Name: bscookie Value: "v=1&20240424105224f6d102f4-aad7-4aba-8637-2a8728e0eeabAQHg8ZLsDvr4A-0Vk_EZabU7bPifcR_v"
.deepinstinct.com/	1970-01-21 04:51:31	Name: _biz_flagsA Value: %7B%22Version%22%3A1%2C%22ViewThrough%22%3A%221%22%2C%22XDomain%22%3A%221%22%7D
.deepinstinct.com/	1970-01-20 22:15:31	Name: _fbp Value: fb.1.1713955945092.1414532358
.deepinstinct.com/	1970-01-21 00:25:07	Name: __hstc Value: 160033954.2015b89f7b3ce22295bfc0163da98b7e.1713955947457.1713955947457.1713955947457.1
.deepinstinct.com/	1970-01-21 00:25:07	Name: hubspotutk Value: 2015b89f7b3ce22295bfc0163da98b7e
.deepinstinct.com/	1969-12-31 23:59:59	Name: __hssrc Value: 1
.deepinstinct.com/	1970-01-20 20:05:57	Name: __hssc Value: 160033954.1.1713955947458
.hubspot.com/	1970-01-20 20:05:57	Name: __cf_bm Value: vPHvoOX.UHUTYsl9yY3Ji6FytbUkbUFF.LK8vVnQcgU-1713955947-1.0.1.1-g0OiLsAWP4.9zKie6UGrprdZZst9CqgEbJNCMzDupsGOp3D5aLjpsQjO4r9zuRdvjR517H.cKQWk0xSHM0DcVw
.hubspot.com/	1969-12-31 23:59:59	Name: _cfuvid Value: hsfjDlG8uTiS1ecuawLQyXx85DvmExjCfvoy9StLxhI-1713955947827-0.0.1.1-604800000

57 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
other	warning	URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://connect.facebook.net/signals/config/468591697375107?v=2.9.154&r=stable&domain=www.deepinstinct.com&hme=c3a545c63044e8e9102d4f32d84a1137594d024f28e801d670bc76dc5c075575&ex_m=67%2C112%2C99%2C103%2C58%2C3%2C93%2C66%2C15%2C91%2C84%2C49%2C51%2C158%2C161%2C172%2C168%2C169%2C171%2C28%2C94%2C50%2C73%2C170%2C153%2C156%2C165%2C166%2C173%2C121%2C14%2C48%2C178%2C177%2C123%2C17%2C33%2C38%2C1%2C41%2C62%2C63%2C64%2C68%2C88%2C16%2C13%2C90%2C87%2C86%2C100%2C102%2C37%2C101%2C29%2C25%2C154%2C157%2C130%2C27%2C10%2C11%2C12%2C5%2C6%2C24%2C21%2C22%2C54%2C59%2C61%2C71%2C95%2C26%2C72%2C8%2C7%2C76%2C46%2C20%2C97%2C96%2C9%2C19%2C18%2C81%2C53%2C79%2C32%2C70%2C0%2C89%2C31%2C78%2C83%2C45%2C44%2C82%2C36%2C4%2C85%2C77%2C42%2C39%2C34%2C80%2C2%2C35%2C60%2C40%2C98%2C43%2C75%2C65%2C104%2C57%2C56%2C30%2C92%2C55%2C52%2C47%2C74%2C69%2C23%2C105(Line 97) Message: Unrecognized feature: 'attribution-reporting'.
other	warning	URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework Message: Third-party cookie will be blocked. Learn more in the Issues tab.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

analytics.google.com
analytics.twitter.com
api.company-target.com
app.qualified.com
bat.bing.com
cc.swiftype.com
cdn.bizible.com
cdn.bizibly.com
connect.facebook.net
googleads.g.doubleclick.net
ibc-flow.techtarget.com
id.rlcdn.com
images.contentstack.io
js.hs-analytics.net
js.hs-banner.com
js.hs-scripts.com
js.hsadspixel.net
js.hsleadflows.net
js.qualified.com
p.typekit.net
px.ads.linkedin.com
s.company-target.com
s.swiftypecdn.com
script.hotjar.com
snap.licdn.com
static.ads-twitter.com
static.hotjar.com
stats.g.doubleclick.net
t.co
tag-logger.demandbase.com
tag.demandbase.com
track.hubspot.com
trk.techtarget.com
use.typekit.net
www.deepinstinct.com
www.facebook.com
www.google-analytics.com
www.google.co.il
www.google.com
www.googleoptimize.com
www.googletagmanager.com
www.linkedin.com
id.rlcdn.com
104.16.117.116
104.16.141.209
104.17.175.201
104.17.223.152
104.18.140.17
104.18.16.5
104.18.34.229
104.244.42.131
104.244.42.133
13.107.42.14
13.33.187.19
142.250.185.162
142.250.185.238
142.250.186.163
142.250.186.174
143.204.98.12
146.75.120.157
151.101.194.137
151.101.65.167
152.195.15.58
157.240.253.1
157.240.253.35
169.48.219.66
172.217.16.200
172.217.18.14
172.64.151.60
18.245.46.22
18.66.102.53
18.66.102.85
204.79.197.237
216.58.206.68
23.200.36.196
23.200.36.205
23.200.38.43
3.70.101.28
34.111.208.231
34.96.71.22
35.171.141.234
74.125.206.154
0130b680d34de9079a7677f6954c5fded22ad91a7791e2acd86f3ed53191a1d8
01e9582655224c83e6c075f44b7eecb135e108b6ad2150bf6f78a0a77c4ad5e0
09e468b6ae3eaabab8e4f41329c722ee5ff819b477146ea02d27a7b1b49d5050
0c07b854855b0e2bd7839c3659defa45307e96e281b3c00571d09f213eb6a76e
0f701def79cf3f86b8f75e4f805436a387ff2718851060447561b89a6daae4e6
118a0b64762282c340eb77e3234ae6d4e4ec71d140da6afa6139657c4f83bd00
12adce1ff8ecf597745ee698257dd38a6af8abab2d89e565b2d40893b646f28e
140e801db59d24b4f0ba9e63042b32863068c1369989eb1e632e481f6fcf09f1
16cabc9d4b8ae81eed9193ec25b6d463e68290e5433069885156f7c1dc81e975
1a1ea29b4da0208aa78b7fa3d2b6f39179a1a5de6dfdbc80c0d4dc7443755807
1c0ff118a4290c99f39c90abb38703a866e47251b23cca20266c69c812ccafeb
1c67d8ce90160a6586cfd2c2a936959738f5b1843ebdfbac4325c4d1a9b61224
1ea94e6fc8afdc8a96c72f6821974bbfe2126b9a960c469251c88f2d5dd02260
1ed76e4688ef9d3b8245de7492c54d081dbb25796bde18fe026183bc57b13501
238a5557d281f29a863a1deda2d9c1c426d8ff7b9018c0c44c047f994b52b57a
2552d8d62d9c60f59b3b11a5d083d1ebd090c72de809fc7c76fb339825302241
28a0012dcd1984d3c08d585dc2a2360b73a0c0c8237bf99a4a1e7ec70a31ebcf
2d7c7930eb39d59cd8c2dc00652977da3ed72347e7cd465f7b540e10e2121c22
2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363
32cc58a56e1170810316c9cb82dd82a1fb379e2b82139b5ed039063bb40e4724
3575cd73d754b670b319a5502e248f3cdee7920b2af18e206d42a6efc54d49df
3a9972297dfa97e4f6a11cc17f5767935ffa27d7c6d92123e38fd423bd4afd9e
3ad3f48e0876d9c90167457933958b33140d66ebb2c6b42107ade20b39fe2cdd
3c51542bd74124ed2bae5b0d8cb837dc7e567a94acaee00f4c686dfb8d272018
3c98404a986fe5182a2b6214d370226eb15a0cb58af0a25c5e9a95239535f5ee
488b5f9d2946120012efd50d989959509b06c83f9b720d0bb58edafadc71bfac
4c903880e86c99ed05c1387b955f7de1f6b97ccdd3ae9db3bf1c82cad6ac8a5a
4d15ff2317e16ccd8ca1d3248fea7d91130e022369bb032824a84ad9967064df
4d3e2dd099535045aef08a0eae076c90e23f526c7d683704293a9ef005ebcd6a
4d69811fcdf2dcc9ff875a6dd0309585ecdf1e55f46345aa9d507f816c4bdb96
4db83b291d4b780a54c7a0e998e64ce8cf5bace8d0612dc0082b0d961f04ce04
4fcc2873d9a9e427999107a83f322c299063db3dd645262a3330e4ed336208fc
50b4811918e32d93ed527f463f88ac9d4dafd29d14b5f17ee69f623bf3aba360
529f9f3aa54fc536d8b9b39f45d3d8bbfbbe067545c2c375ea3fd5f0d446ac14
5612daca21fe73f106c77cab5b0cdf820c777af49b1b0230d98e905c3df63e24
591c61c96042823042978eca080ce9de60db6e3bdf474ab331364d52212212cc
5af2bd700fd3e70bdb66c457260e13362e077c992b9a8e91ef601515c91bf3fc
5be8aaeb682186c135e30933672211af0127c48e96ac3cb3e2b4a9379e8b861b
6006a799a37d5e75090b1631ac710ad8aeac54acf5a48b1beee8c2e52b9c9fd6
6353083e47f984144841ad6f17cb6fd0332a4b629c2089d603f8b2bf04dcf2f8
6371783e47489007d9eeb0119d3ed7c7b540a63f1bb0d1024aca81cf9c5eabfc
67a86dcd9de0e056f9b4be883e95c1587463e7b87e5390982c02e1822f9c3356
6a231076c5c83e79bea81510940b1fdd77839f3873526b0d49485be6697d0e8f
6cc4c722a50b4152194b13e7e3c8a1a5a5f23b17988f8fa85404394efc5c0984
70712c8650feecc46403b5801b9d5b72d5b2d6ba1d1cf0317e105603982321bf
79ecc15b3d35c6f083de7b0f58ecafecc1511ac0f13d9c11cb0a642b7510cc2a
7a80c7ae20682012e0a7a06ed486183dc5d7cd45763e09221073675bc067b606
823804a7807864b44093a3843788f4cd076e89cf4a6fdeb8d153ae5c2c2df721
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
8a61ba991bab87bb170f6256868d5f2f3264d28b40b8f8129e02a07a44651469
8b0ad567f607c61d4574b49cf17871843915be8c7e2a9621d05c8f55ff8739c5
8d0056dcc26b8dce6be00539697962adb12475fbf9cbf7fdcbc7c81b2ae7328d
8d3a1bf6e2df7ec1dc004f9ea76c89627a5a1d3350d2e01f833dd20ffddee5b6
8d5da73586712159bb569fbfbd370f05a258113b2591ba238ef4e7bde1db13b7
8e081ea7988f4b0266528e9ec8b76799e66157ff1a989f649710d6c725a7855a
94c1047f45725fdfd62ad286aae8ff577b87af99f3c6ff9e271fca751398cbbc
96b04582ae3d1f5759bce9653b8e407d2f233745f72e54f9a1c145379b5821a7
9a496e8b9da307a0d817e4104c0418c6ff0c8841c6bbb8e426a424d304ac3296
9d9e8a96a73580c975860c5b2fa6488d785af4b44e2f0a0a35cbbc891c863746
a57d51de6bc8303a6cb9a28f6dd9a90e23b683d4a4a8b6d8857914943665ab89
aadc9e1a13a480ebf46e128f841559fa28e2d73cc47a2cf75f3ec5e63a0250d6
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
aec60bc104db041b1512185839f18f52986df7e569e5445f740dd60f763fbca8
afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277
b247376c3e2732c8d76dd1d9db2151db9261ad2f27b068835af63c14c17401e1
be9814e6a9078f839720af16bf4859cc5c386ea740b72439b34b194dbd483cf3
c1bf2f1787d4c57156e2faff7d7259eccbafd4ea70e2cfdb065448e9e9a866fc
c38430e8e8eeedf87f6a7860ee009e354dbd44f3865a62663239922b35590d7f
c8e3b35aa911b1e6364305e850e35072e75dbceb7fb3ed39b6c9fdf1d216b464
c9476026edd0c62a79ca209ab6ccb1b5f2611ef3049b8d771071878003f6871e
c9a95f9262273cfe4ae43a8a0dbb61ce3d4fbcff4b54d2350258b39cd08b32e0
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
d66b13d15c9f6d62412758da1d16472e96466304912f1fe178ef8d5b3b44cda0
dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4
dd2c60ce2a0e8c99bffd15d5941f53f0b508eaeb2c66b0181d563ed23240ff15
de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e550590605f348a6163e6f1d157578a98364ee307dd221516f9f2401363e0c20
ec123bd26b1064cd72ca8c52f9c5576d95587da65aa9e2efdbc2fcccf892a8f4
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
ef6c6142ca7d544ac9af662547dc404225e959789e811607d8acea4f07e0d89d
efb5dc6835aeb8a8e1615ca49df1828cfaf708dc73651c5f1c651f2d2ab3907a
f3e4e112b2d5e33eab4dc97800b6ea00858a4fedaf26f0fe21d5748863df3991
f6735d6295b7bd837a2fa51038cbc7a6bb2e2b2b41550a7ea49619487175a48e
f94786fe65dcbc65b0099b471ae2bb89bbabd7fa7d8573dd3c4e0f5bbe555447
fda80d24f1bfe5a68b5f719a1febecfe747c79720e3a26b4b78b6a42b67b37b7
fe2d748cbd7dde62aad4dd1fcf6e6a81675c7fec34601791ac4ab1d2ce6317f7
feadef6719ca44406d0eeb1c80724f6212e37d284782ea336576a216ad24b90b
fff0bdb3f70b85b820a949503a24610fb007cf4582f1e67f4835a14de511d50f

www.deepinstinct.com Open in urlscan Pro 3.70.101.28 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

112 Requests

97 %HTTPS

0 %IPv6

33 Domains

42 Subdomains

40 IPs

4 Countries

2155 kBTransfer

6003 kBSize

44 Cookies

40 Outgoing links

Redirected requests

112 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

www.deepinstinct.com Open in urlscan Pro
3.70.101.28 Public Scan

Screenshot
Live screenshot

Full Image

112
Requests

97 %
HTTPS

0 %
IPv6

33
Domains

42
Subdomains

40
IPs

4
Countries

2155 kB
Transfer

6003 kB
Size

44
Cookies

112 HTTP transactions
0 data transactions