blog.group-ib.com Open in urlscan Pro
185.129.100.113 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://blog.group-ib.com/apt41-world-tour-2021
Submission: On August 18 via api (August 18th 2022, 8:15:46 pm UTC) from US — Scanned from DE

Summary HTTP 117 Redirects Links 35 Behaviour Indicators

Summary

This website contacted 34 IPs in 4 countries across 27 domains to perform 117 HTTP transactions. The main IP is 185.129.100.113, located in Russian Federation and belongs to DDOS-GUARD, RU. The main domain is blog.group-ib.com.
TLS certificate: Issued by R3 on August 9th 2022. Valid for: 3 months.

This is the only time blog.group-ib.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1	185.129.100.113 185.129.100.113	57724 (DDOS-GUARD) (DDOS-GUARD)
1	162.55.188.142 162.55.188.142	24940 (HETZNER-AS) (HETZNER-AS)
56	2a03:90c0:41:... 2a03:90c0:41:2801::254	199524 (GCORE) (GCORE)
2	178.248.236.28 178.248.236.28	197068 (QRATOR) (QRATOR)
3	2a00:1450:400... 2a00:1450:4001:827::2008	15169 (GOOGLE) (GOOGLE)
9	96.16.137.162 96.16.137.162	16625 (AKAMAI-AS) (AKAMAI-AS)
1	2a00:1450:400... 2a00:1450:4001:827::200e	15169 (GOOGLE) (GOOGLE)
1	199.232.136.157 199.232.136.157	54113 (FASTLY) (FASTLY)
1	172.217.16.194 172.217.16.194	15169 (GOOGLE) (GOOGLE)
1	2a02:26f0:350... 2a02:26f0:3500:16::215:149b	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
3	2a03:2880:f02... 2a03:2880:f02d:12:face:b00c:0:3	32934 (FACEBOOK) (FACEBOOK)
1	172.65.208.22 172.65.208.22	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	104.244.42.133 104.244.42.133	13414 (TWITTER) (TWITTER)
1	104.244.42.131 104.244.42.131	13414 (TWITTER) (TWITTER)
1	2606:4700::68... 2606:4700::6810:5714	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	37.252.173.215 37.252.173.215	29990 (ASN-APPNEX) (ASN-APPNEX)
1	2a02:26f0:350... 2a02:26f0:3500:884::1c91	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
3 3	2620:1ec:21::14 2620:1ec:21::14	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	13.107.42.14 13.107.42.14	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
4	2a00:1450:400... 2a00:1450:4001:829::2002	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:82a::200e	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:400c:c08::9b	15169 (GOOGLE) (GOOGLE)
4	2a03:2880:f12... 2a03:2880:f12d:83:face:b00c:0:25de	32934 (FACEBOOK) (FACEBOOK)
5	2a00:1450:400... 2a00:1450:4001:801::2004	15169 (GOOGLE) (GOOGLE)
5	2a00:1450:400... 2a00:1450:4001:803::2003	15169 (GOOGLE) (GOOGLE)
1	172.65.219.229 172.65.219.229	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	172.65.202.201 172.65.202.201	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	172.65.238.60 172.65.238.60	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	172.65.192.122 172.65.192.122	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	172.65.193.34 172.65.193.34	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700::68... 2606:4700::6811:c8cc	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	172.65.232.43 172.65.232.43	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	172.65.240.166 172.65.240.166	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	193.3.17.197 193.3.17.197	210753 (TILDAPUBL...) (TILDAPUBLISHING-RU-1)
117	34

1 185.129.100.113 (Russian Federation)

ASN57724 (DDOS-GUARD, RU)
PTR: ddos-guard.net

blog.group-ib.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 162.55.188.142 (Germany)

ASN24940 (HETZNER-AS, DE)
PTR: static.142.188.55.162.clients.your-server.de

neo.tildacdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

56 2a03:90c0:41:2801::254 (Frankfurt am Main, Germany)

ASN199524 (GCORE, LU)

static.tildacdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
thumb.tildacdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 178.248.236.28 (Russian Federation)

ASN197068 (QRATOR, RU)

ws.tildacdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:827::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 96.16.137.162 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a96-16-137-162.deploy.static.akamaitechnologies.com

j.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
c.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
b.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:827::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googleoptimize.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 199.232.136.157 (Frankfurt am Main, Germany)

ASN54113 (FASTLY, US)

static.ads-twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 172.217.16.194 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s65-in-f2.1e100.net

www.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:26f0:3500:16::215:149b (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)

snap.licdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a03:2880:f02d:12:face:b00c:0:3 (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 172.65.208.22 (United States)

ASN13335 (CLOUDFLARENET, US)

js-eu1.hs-scripts.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.244.42.133 (United States)

ASN13414 (TWITTER, US)

t.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.244.42.131 (United States)

ASN13414 (TWITTER, US)

analytics.twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6810:5714 (United States)

ASN13335 (CLOUDFLARENET, US)

cdn.jsdelivr.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 37.252.173.215 (Frankfurt am Main, Germany)

ASN29990 (ASN-APPNEX, US)
PTR: 867.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net

secure.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:26f0:3500:884::1c91 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)

ipv6.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2620:1ec:21::14 (United States) 3 redirects

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

px.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
www.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.107.42.14 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

px4.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:829::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:82a::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:400c:c08::9b (Brussels, Belgium)

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a03:2880:f12d:83:face:b00c:0:25de (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2a00:1450:4001:801::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2a00:1450:4001:803::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 172.65.219.229 (United States)

ASN13335 (CLOUDFLARENET, US)

js-eu1.hsadspixel.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 172.65.202.201 (United States)

ASN13335 (CLOUDFLARENET, US)

js-eu1.hs-banner.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 172.65.238.60 (United States)

ASN13335 (CLOUDFLARENET, US)

js-eu1.hs-analytics.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 172.65.192.122 (United States)

ASN13335 (CLOUDFLARENET, US)

js-eu1.hscollectedforms.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 172.65.193.34 (United States)

ASN13335 (CLOUDFLARENET, US)

forms-eu1.hubspot.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6811:c8cc (United States)

ASN13335 (CLOUDFLARENET, US)

api-eu1.hubapi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 172.65.232.43 (United States)

ASN13335 (CLOUDFLARENET, US)

forms-eu1.hsforms.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 172.65.240.166 (United States)

ASN13335 (CLOUDFLARENET, US)

track-eu1.hubspot.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 193.3.17.197 (Russian Federation)

ASN210753 (TILDAPUBLISHING-RU-1, RU)

stat.tildacdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
60	tildacdn.com neo.tildacdn.com — Cisco Umbrella Rank: 134783 static.tildacdn.com — Cisco Umbrella Rank: 62318 ws.tildacdn.com — Cisco Umbrella Rank: 97198 thumb.tildacdn.com — Cisco Umbrella Rank: 91112 stat.tildacdn.com — Cisco Umbrella Rank: 80255	418 KB
10	6sc.co j.6sc.co — Cisco Umbrella Rank: 6540 c.6sc.co — Cisco Umbrella Rank: 9685 ipv6.6sc.co — Cisco Umbrella Rank: 6874 b.6sc.co — Cisco Umbrella Rank: 4472	14 KB
5	google.de www.google.de — Cisco Umbrella Rank: 6076	803 B
5	google.com www.google.com — Cisco Umbrella Rank: 9	803 B
5	doubleclick.net googleads.g.doubleclick.net — Cisco Umbrella Rank: 52 stats.g.doubleclick.net — Cisco Umbrella Rank: 108	5 KB
4	facebook.com www.facebook.com — Cisco Umbrella Rank: 111	418 B
4	linkedin.com 3 redirects px.ads.linkedin.com — Cisco Umbrella Rank: 370 www.linkedin.com — Cisco Umbrella Rank: 530 px4.ads.linkedin.com — Cisco Umbrella Rank: 5716	3 KB
3	facebook.net connect.facebook.net — Cisco Umbrella Rank: 158	195 KB
3	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 78	208 KB
2	hsforms.com forms-eu1.hsforms.com — Cisco Umbrella Rank: 48773	710 B
2	hubspot.com forms-eu1.hubspot.com — Cisco Umbrella Rank: 44384 track-eu1.hubspot.com — Cisco Umbrella Rank: 35104	2 KB
2	google-analytics.com www.google-analytics.com — Cisco Umbrella Rank: 45	20 KB
1	hubapi.com api-eu1.hubapi.com — Cisco Umbrella Rank: 63796	958 B
1	hscollectedforms.net js-eu1.hscollectedforms.net — Cisco Umbrella Rank: 45022	25 KB
1	hs-analytics.net js-eu1.hs-analytics.net — Cisco Umbrella Rank: 33395	20 KB
1	hs-banner.com js-eu1.hs-banner.com — Cisco Umbrella Rank: 32827	16 KB
1	hsadspixel.net js-eu1.hsadspixel.net — Cisco Umbrella Rank: 62408	3 KB
1	adnxs.com secure.adnxs.com — Cisco Umbrella Rank: 463	697 B
1	jsdelivr.net cdn.jsdelivr.net — Cisco Umbrella Rank: 422	4 KB
1	twitter.com analytics.twitter.com — Cisco Umbrella Rank: 517	354 B
1	t.co t.co — Cisco Umbrella Rank: 489	337 B
1	hs-scripts.com js-eu1.hs-scripts.com — Cisco Umbrella Rank: 30638	982 B
1	licdn.com snap.licdn.com — Cisco Umbrella Rank: 717	3 KB
1	googleadservices.com www.googleadservices.com — Cisco Umbrella Rank: 130	16 KB
1	ads-twitter.com static.ads-twitter.com — Cisco Umbrella Rank: 606	15 KB
1	googleoptimize.com www.googleoptimize.com — Cisco Umbrella Rank: 1226	42 KB
1	group-ib.com blog.group-ib.com	40 KB
117	27

	Domain	Requested by
53	static.tildacdn.com	blog.group-ib.com ws.tildacdn.com
7	b.6sc.co	blog.group-ib.com
5	www.google.de	blog.group-ib.com
5	www.google.com	blog.group-ib.com
4	www.facebook.com	blog.group-ib.com
4	googleads.g.doubleclick.net	www.googleadservices.com
3	thumb.tildacdn.com	blog.group-ib.com
3	connect.facebook.net	blog.group-ib.com connect.facebook.net
3	www.googletagmanager.com	blog.group-ib.com js-eu1.hsadspixel.net www.googletagmanager.com
2	forms-eu1.hsforms.com	blog.group-ib.com js-eu1.hscollectedforms.net
2	www.google-analytics.com	www.googletagmanager.com blog.group-ib.com
2	px.ads.linkedin.com	2 redirects
2	ws.tildacdn.com	blog.group-ib.com
1	stat.tildacdn.com	static.tildacdn.com
1	track-eu1.hubspot.com
1	api-eu1.hubapi.com	js-eu1.hsadspixel.net
1	forms-eu1.hubspot.com	js-eu1.hscollectedforms.net
1	js-eu1.hscollectedforms.net	js-eu1.hs-scripts.com
1	js-eu1.hs-analytics.net	js-eu1.hs-scripts.com
1	js-eu1.hs-banner.com	js-eu1.hs-scripts.com
1	js-eu1.hsadspixel.net	js-eu1.hs-scripts.com
1	stats.g.doubleclick.net	www.google-analytics.com
1	px4.ads.linkedin.com	blog.group-ib.com
1	www.linkedin.com	1 redirects
1	ipv6.6sc.co	j.6sc.co
1	c.6sc.co	j.6sc.co
1	secure.adnxs.com	j.6sc.co
1	cdn.jsdelivr.net	www.googletagmanager.com
1	analytics.twitter.com	blog.group-ib.com
1	t.co	blog.group-ib.com
1	js-eu1.hs-scripts.com	www.googletagmanager.com
1	snap.licdn.com	www.googletagmanager.com
1	www.googleadservices.com	www.googletagmanager.com
1	static.ads-twitter.com	www.googletagmanager.com
1	www.googleoptimize.com	www.googletagmanager.com
1	j.6sc.co	blog.group-ib.com
1	neo.tildacdn.com	blog.group-ib.com
1	blog.group-ib.com
117	38

This site contains links to these domains. Also see Links.

Domain
www.group-ib.com
www.mandiant.com
www.fbi.gov
documents.trendmicro.com
www.facebook.com
twitter.com
www.youtube.com
www.linkedin.com

Subject Issuer	Validity	Valid
blog.group-ib.com R3	`2022-08-09` - `2022-11-07`	3 months	crt.sh
*.tildacdn.com Sectigo RSA Domain Validation Secure Server CA	`2022-02-21` - `2023-03-19`	a year	crt.sh
*.google-analytics.com GTS CA 1C3	`2022-08-01` - `2022-10-24`	3 months	crt.sh
*.6sc.co DigiCert TLS Hybrid ECC SHA384 2020 CA1	`2022-03-08` - `2023-03-11`	a year	crt.sh
ads-twitter.com DigiCert TLS RSA SHA256 2020 CA1	`2022-07-22` - `2023-08-22`	a year	crt.sh
www.googleadservices.com GTS CA 1C3	`2022-07-18` - `2022-10-10`	3 months	crt.sh
snap.licdn.com DigiCert SHA2 Secure Server CA	`2022-03-01` - `2023-03-01`	a year	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2022-05-28` - `2022-08-26`	3 months	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2022-06-03` - `2023-06-02`	a year	crt.sh
t.co DigiCert TLS Hybrid ECC SHA384 2020 CA1	`2022-03-07` - `2023-03-06`	a year	crt.sh
*.twitter.com DigiCert TLS Hybrid ECC SHA384 2020 CA1	`2022-03-07` - `2023-03-06`	a year	crt.sh
*.adnxs.com GeoTrust ECC CA 2018	`2022-02-11` - `2023-03-14`	a year	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2022-08-01` - `2022-10-24`	3 months	crt.sh
www.google.com GTS CA 1C3	`2022-07-18` - `2022-10-10`	3 months	crt.sh
www.google.de GTS CA 1C3	`2022-08-01` - `2022-10-24`	3 months	crt.sh
*.google.com GTS CA 1C3	`2022-07-18` - `2022-10-10`	3 months	crt.sh
*.google.de GTS CA 1C3	`2022-08-01` - `2022-10-24`	3 months	crt.sh
hubspot.com Cloudflare Inc ECC CA-3	`2022-03-08` - `2023-03-07`	a year	crt.sh
hubapi.com Cloudflare Inc ECC CA-3	`2022-05-07` - `2023-05-07`	a year	crt.sh

This page contains 3 frames:

Primary Page: https://blog.group-ib.com/apt41-world-tour-2021
Frame ID: D951DA2CF5A4D7C3C6BAA8044535FAF5
Requests: 118 HTTP requests in this frame

Frame: https://www.facebook.com/tr/
Frame ID: 4BCAD2B18478B948810B4A57A38F5608
Requests: 1 HTTP requests in this frame

Frame: https://www.facebook.com/tr/
Frame ID: 8250B47B6E5DEBEB6DE4A3ADA116973A
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

APT41 World Tour 2021 on a tight schedule

Detected technologies

Tilda (CMS) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]+tilda(?:cdn|\.ws|-blocks)
tilda(?:cdn|\.ws|-blocks)

AppNexus (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

adnxs\.(?:net|com)

Facebook (Widgets) Expand

Overall confidence: 100%
Detected patterns

//connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

google-analytics\.com/(?:ga|urchin|analytics)\.js

Google Optimize (A/B Testing) Expand

Overall confidence: 100%
Detected patterns

googleoptimize\.com/optimize\.js

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtm\.js
googletagmanager\.com/gtag/js

Hammer.js (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

hammer(?:\.min)?\.js

Highlight.js (Miscellaneous) Expand

Overall confidence: 100%
Detected patterns

/(?:([\d.])+/)?highlight(?:\.min)?\.js

Linkedin Insight Tag (Analytics) Expand

Overall confidence: 100%
Detected patterns

snap\.licdn\.com/li\.lms-analytics/insight\.min\.js

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

jsDelivr (CDN) Expand

Overall confidence: 100%
Detected patterns

//cdn\.jsdelivr\.net/

Page Statistics

117
Requests

99 %
HTTPS

44 %
IPv6

27
Domains

38
Subdomains

34
IPs

4
Countries

1051 kB
Transfer

2808 kB
Size

29
Cookies

35 Outgoing links

These are links going to different origins than the main page.

URL: https://www.group-ib.com/

Search URL Search Domain Scan URL

URL: https://www.group-ib.com/blog/

Search URL Search Domain Scan URL

URL: https://www.mandiant.com/resources/apt41-initiates-global-intrusion-campaign-using-multiple-exploits
Title: have reported

Search URL Search Domain Scan URL

URL: https://www.group-ib.com/products/threat-intelligence/
Title: Group-IB Threat Intelligence

Search URL Search Domain Scan URL

URL: https://www.fbi.gov/wanted/cyber/apt-41-group
Title: charges

Search URL Search Domain Scan URL

URL: https://documents.trendmicro.com/assets/white_papers/wp-earth-baku-an-apt-group-targeting-indo-pacific-countries.pdf
Title: described

Search URL Search Domain Scan URL

URL: https://www.group-ib.com/resources/threat-research/conti_2022.html
Title: CONTI ARMADA: THE ARMATTACK CAMPAIGN

Search URL Search Domain Scan URL

URL: https://www.facebook.com/sharer.php?src=sp&u=https%3A%2F%2Fblog.group-ib.com%2Fapt41-world-tour-2021&title=APT41%20World%20Tour%202021%20on%20a%20tight%20schedule&utm_source=share2
Title: Facebook

Search URL Search Domain Scan URL

URL: https://twitter.com/intent/tweet?text=APT41%20World%20Tour%202021%20on%20a%20tight%20schedule&url=https%3A%2F%2Fblog.group-ib.com%2Fapt41-world-tour-2021&utm_source=share2
Title: Twitter

Search URL Search Domain Scan URL

URL: https://www.group-ib.com/security-assessment.html
Title: Security Assessment

Search URL Search Domain Scan URL

URL: https://www.group-ib.com/red-teaming.html
Title: Red Teaming

Search URL Search Domain Scan URL

URL: https://www.group-ib.com/pre-ir.html
Title: Pre-IR Assessment

Search URL Search Domain Scan URL

URL: https://www.group-ib.com/compromise-assessment.html
Title: Compromise Assessment

Search URL Search Domain Scan URL

URL: https://www.group-ib.com/cyberschool.html
Title: Cyber Education

Search URL Search Domain Scan URL

URL: https://www.group-ib.com/investigation.html
Title: Investigations

Search URL Search Domain Scan URL

URL: https://www.group-ib.com/digital-forensics.html
Title: Digital Forensics

Search URL Search Domain Scan URL

URL: https://www.group-ib.com/ediscovery.html
Title: eDiscovery

Search URL Search Domain Scan URL

URL: https://www.group-ib.com/intelligence-attribution.html
Title: Threat Intelligence & Attribution

Search URL Search Domain Scan URL

URL: https://www.group-ib.com/threat-hunting-framework.html
Title: Threat Hunting Framework

Search URL Search Domain Scan URL

URL: https://www.group-ib.com/fraud-hunting-platform.html
Title: Fraud Hunting Platform

Search URL Search Domain Scan URL

URL: https://www.group-ib.com/digital-risk-protection.html
Title: Digital Risk Protection

Search URL Search Domain Scan URL

URL: https://www.group-ib.com/antipiracy.html

Search URL Search Domain Scan URL

URL: https://www.group-ib.com/about.html
Title: About Group-IB

Search URL Search Domain Scan URL

URL: https://www.group-ib.com/media/
Title: Media Center

Search URL Search Domain Scan URL

URL: https://www.group-ib.com/leadership.html
Title: Leadership

Search URL Search Domain Scan URL

URL: https://www.group-ib.com/contacts.html
Title: Contact

Search URL Search Domain Scan URL

URL: https://www.group-ib.com/careers.html
Title: Careers

Search URL Search Domain Scan URL

URL: https://www.facebook.com/groupibHQ

Search URL Search Domain Scan URL

URL: https://twitter.com/GroupIB_GIB

Search URL Search Domain Scan URL

URL: https://www.youtube.com/channel/UC9dl4udfrq8IqHKkETt86QQ

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/organization/1382013/

Search URL Search Domain Scan URL

URL: https://www.group-ib.com/blog/rss.xml

Search URL Search Domain Scan URL

URL: https://www.group-ib.com/cert.html
Title: CERT-GIB

Search URL Search Domain Scan URL

URL: https://www.group-ib.com/incident-response.html
Title: Incident Response

Search URL Search Domain Scan URL

URL: https://www.group-ib.com/incident-response/retainer.html
Title: Incident Response Retainer

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 72

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=4496601&time=1660853740897&url=https%3A%2F%2Fblog.group-ib.com%2Fapt41-world-tour-2021&tm=gtmv2 HTTP 302
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D4496601%26time%3D1660853740897%26url%3Dhttps%253A%252F%252Fblog.group-ib.com%252Fapt41-world-tour-2021%26tm%3Dgtmv2%26liSync%3Dtrue HTTP 302
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=4496601&time=1660853740897&url=https%3A%2F%2Fblog.group-ib.com%2Fapt41-world-tour-2021&tm=gtmv2&liSync=true HTTP 302
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=4496601&time=1660853740897&url=https%3A%2F%2Fblog.group-ib.com%2Fapt41-world-tour-2021&tm=gtmv2&liSync=true&e_ipv6=AQLAOOzXmPlB_AAAAYKymObpaM_Oz8BAJSO6mL5UqTA005mEHjbfwB1zT7Nyna7E

117 HTTP transactions
3 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request apt41-world-tour-2021 Show response
blog.group-ib.com/ 260 KB
40 KB 119ms
75ms Document
text/html 185.129.100.113
DDOS-GUARD

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.group-ib.com/apt41-world-tour-2021

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

185.129.100.113 , Russian Federation, ASN57724 (DDOS-GUARD, RU),

Reverse DNS

ddos-guard.net

Software

ddos-guard /

Resource Hash

82b8ba2c3f19e72e7c59ddccb017ded4e2bb9e57040eba51999f8aaece44bc55

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
cache-control: max-age=0 public
content-encoding: gzip
content-length: 40889
content-type: text/html; charset=UTF-8
date: Thu, 18 Aug 2022 20:15:40 GMT
etag: "40f06-5e682f0f86e3b-gzip"
last-modified: Thu, 18 Aug 2022 12:15:46 GMT
server: ddos-guard
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
x-host: blog.group-ib.com

GET
H2 200 tilda-fallback-1.0.min.js Show response
neo.tildacdn.com/js/ 2 KB
962 B 47ms
11ms Script
application/javascript 162.55.188.142
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://neo.tildacdn.com/js/tilda-fallback-1.0.min.js
Requested by: Host: blog.group-ib.com
URL: https://blog.group-ib.com/apt41-world-tour-2021
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 162.55.188.142 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.142.188.55.162.clients.your-server.de
Software: nginx /
Resource Hash: 9d3bb68757509f6474c1bdaea8560e0ac2a7525c954a6223059d9e831a9e0780

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Thu, 18 Aug 2022 20:15:40 GMT
content-encoding: gzip
last-modified: Mon, 08 Aug 2022 16:50:27 GMT
server: nginx
etag: W/"62f13ed3-770"
content-type: application/javascript

GET
H2 200 tilda-grid-3.0.min.css
static.tildacdn.com/css/ 4 KB
1 KB 55ms
11ms Stylesheet
text/css 2a03:90c0:41:2801::254
GCORE

General

Check archive.org

Show headers Download Go to

Full URL: https://static.tildacdn.com/css/tilda-grid-3.0.min.css
Requested by: Host: blog.group-ib.com
URL: https://blog.group-ib.com/apt41-world-tour-2021
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a03:90c0:41:2801::254 Frankfurt am Main, Germany, ASN199524 (GCORE, LU),
Reverse DNS
Software: nginx /
Resource Hash: f5c301b8769579afae9deb4eda7659df32661229039c6b7a37cfabd1827317ce

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

x-id: m9-up-gc58, fr5-up-gc38
date: Thu, 18 Aug 2022 20:15:40 GMT
content-encoding: br
tserver: 11
last-modified: Thu, 18 Mar 2021 12:08:37 GMT
server: nginx
etag: W/"605342c5-1010"
vary: Accept-Encoding
x-cached-since: 2022-06-04T13:59:54+00:00, 2022-07-14T09:09:20+00:00
content-type: text/css
cache: HIT, HIT

GET
H/1.1 200
OK tilda-blocks-page29625858.min.css
ws.tildacdn.com/project200703/ 33 KB
7 KB 244ms
218ms Stylesheet
text/css 178.248.236.28
QRATOR

General

Check archive.org

Show headers Download Go to

Full URL: https://ws.tildacdn.com/project200703/tilda-blocks-page29625858.min.css?t=1660824946
Requested by: Host: blog.group-ib.com
URL: https://blog.group-ib.com/apt41-world-tour-2021
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 178.248.236.28 , Russian Federation, ASN197068 (QRATOR, RU),
Reverse DNS
Software: QRATOR /
Resource Hash: ea3ccad1b7fd88237740d6f7eb0da1fcbf46d651b7b3fc90e1b601bdf1caf4cd

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

Date: Thu, 18 Aug 2022 20:15:40 GMT
Content-Encoding: gzip
Last-Modified: Thu, 18 Aug 2022 12:15:46 GMT
Server: QRATOR
Transfer-Encoding: chunked
Content-Type: text/css
cache-control: max-age=0, public
X-Host: ws.tildacdn.com
Connection: keep-alive
Keep-Alive: timeout=15

GET
H2 200 tilda-cover-1.0.min.css
static.tildacdn.com/css/ 3 KB
740 B 58ms
15ms Stylesheet
text/css 2a03:90c0:41:2801::254
GCORE

General

Check archive.org

Show headers Download Go to

Full URL: https://static.tildacdn.com/css/tilda-cover-1.0.min.css
Requested by: Host: blog.group-ib.com
URL: https://blog.group-ib.com/apt41-world-tour-2021
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a03:90c0:41:2801::254 Frankfurt am Main, Germany, ASN199524 (GCORE, LU),
Reverse DNS
Software: nginx /
Resource Hash: cde2a83170b825c3818657a383ea3ee45947493d31822cd6de2a813ef2f5eeb4

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

x-id: m9-up-gc58, fr5-up-gc38
date: Thu, 18 Aug 2022 20:15:40 GMT
content-encoding: br
tserver: 12
last-modified: Mon, 08 Aug 2022 10:26:17 GMT
server: nginx
etag: W/"62f0e4c9-a9f"
vary: Accept-Encoding
x-cached-since: 2022-08-08T10:26:24+00:00, 2022-08-08T10:26:25+00:00
content-type: text/css
cache: HIT, HIT

GET
H2 200 highlight.min.css
static.tildacdn.com/css/ 1 KB
601 B 57ms
14ms Stylesheet
text/css 2a03:90c0:41:2801::254
GCORE

General

Check archive.org

Show headers Download Go to

Full URL: https://static.tildacdn.com/css/highlight.min.css
Requested by: Host: blog.group-ib.com
URL: https://blog.group-ib.com/apt41-world-tour-2021
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a03:90c0:41:2801::254 Frankfurt am Main, Germany, ASN199524 (GCORE, LU),
Reverse DNS
Software: nginx /
Resource Hash: 07a23b618075104849d8dc806499faf025761532347d5c244e488142de01e106

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

x-id: m9p-up-gc10, fr5-up-gc38
date: Thu, 18 Aug 2022 20:15:40 GMT
content-encoding: br
tserver: 10
last-modified: Thu, 18 Mar 2021 12:08:37 GMT
server: nginx
etag: W/"605342c5-52d"
vary: Accept-Encoding
x-cached-since: 2022-06-01T09:02:45+00:00, 2022-06-21T15:23:17+00:00
content-type: text/css
cache: HIT, HIT

GET
H2 200 jquery-1.10.2.min.js Show response
static.tildacdn.com/js/ 91 KB
31 KB 55ms
12ms Script
application/javascript 2a03:90c0:41:2801::254
GCORE

General

Check archive.org

Show headers Download Go to

Full URL: https://static.tildacdn.com/js/jquery-1.10.2.min.js
Requested by: Host: blog.group-ib.com
URL: https://blog.group-ib.com/apt41-world-tour-2021
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a03:90c0:41:2801::254 Frankfurt am Main, Germany, ASN199524 (GCORE, LU),
Reverse DNS
Software: nginx /
Resource Hash: c73b004ebf31b395cf237c3d2b13c1e576f385e04660ceb5f7be163ff3c201dc

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

x-id: m9-up-gc52, fr5-up-gc38
date: Thu, 18 Aug 2022 20:15:40 GMT
content-encoding: br
tserver: 13
last-modified: Sun, 25 Apr 2021 08:11:36 GMT
server: nginx
etag: W/"60852438-16b88"
vary: Accept-Encoding
x-cached-since: 2022-07-13T17:46:04+00:00, 2022-08-18T09:11:17+00:00
content-type: application/javascript; charset=utf-8
cache-control: max-age=86400
cache: HIT, HIT
x-cdn-edge-id: 150
x-cdn-request-id: 8bb9737d3cb836b381ca160cefc2bd59
x-cdn-edge-cache: HIT

GET
H2 200 tilda-scripts-3.0.min.js Show response
static.tildacdn.com/js/ 13 KB
4 KB 57ms
14ms Script
application/javascript 2a03:90c0:41:2801::254
GCORE

General

Check archive.org

Show headers Download Go to

Full URL: https://static.tildacdn.com/js/tilda-scripts-3.0.min.js
Requested by: Host: blog.group-ib.com
URL: https://blog.group-ib.com/apt41-world-tour-2021
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a03:90c0:41:2801::254 Frankfurt am Main, Germany, ASN199524 (GCORE, LU),
Reverse DNS
Software: nginx /
Resource Hash: 9098e0e2cb65cab749fa783c1309a9843074cac78ba67af0f859e850753091db

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

x-id: m9-up-gc66, fr5-up-gc38
date: Thu, 18 Aug 2022 20:15:40 GMT
content-encoding: br
tserver: 13
last-modified: Wed, 27 Jul 2022 13:56:52 GMT
server: nginx
etag: W/"62e14424-3399"
vary: Accept-Encoding
x-cached-since: 2022-07-27T13:56:57+00:00, 2022-07-27T13:56:59+00:00
content-type: application/javascript; charset=utf-8
cache: HIT, HIT

GET
H/1.1 200
OK tilda-blocks-page29625858.min.js Show response
ws.tildacdn.com/project200703/ 4 KB
2 KB 246ms
221ms Script
application/javascript 178.248.236.28
QRATOR

General

Check archive.org

Show headers Download Go to

Full URL: https://ws.tildacdn.com/project200703/tilda-blocks-page29625858.min.js?t=1660824946
Requested by: Host: blog.group-ib.com
URL: https://blog.group-ib.com/apt41-world-tour-2021
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 178.248.236.28 , Russian Federation, ASN197068 (QRATOR, RU),
Reverse DNS
Software: QRATOR /
Resource Hash: 4b423c19ca90fea6b3cd29c76da97c56346c4ad6ba6f8e2473e350f8f50013db

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

Date: Thu, 18 Aug 2022 20:15:40 GMT
Content-Encoding: gzip
Last-Modified: Thu, 18 Aug 2022 12:15:46 GMT
Server: QRATOR
Transfer-Encoding: chunked
Content-Type: application/javascript
cache-control: max-age=0, public
X-Host: ws.tildacdn.com
Connection: keep-alive
Keep-Alive: timeout=15

GET
H2 200 lazyload-1.3.min.js Show response
static.tildacdn.com/js/ 19 KB
6 KB 11ms
9ms Script
application/javascript 2a03:90c0:41:2801::254
GCORE

General

Check archive.org

Show headers Download Go to

Full URL: https://static.tildacdn.com/js/lazyload-1.3.min.js
Requested by: Host: blog.group-ib.com
URL: https://blog.group-ib.com/apt41-world-tour-2021
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a03:90c0:41:2801::254 Frankfurt am Main, Germany, ASN199524 (GCORE, LU),
Reverse DNS
Software: nginx /
Resource Hash: 1dedd7e231907c6bec401b7fd16f441b2523a866496489e79ed329b3507e5529

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

x-id: m9-up-gc53, fr5-up-gc38
date: Thu, 18 Aug 2022 20:15:40 GMT
content-encoding: br
tserver: 13
last-modified: Thu, 18 Aug 2022 13:28:05 GMT
server: nginx
etag: W/"62fe3e65-4bb9"
vary: Accept-Encoding
x-cached-since: 2022-08-18T13:29:57+00:00, 2022-08-18T13:30:05+00:00
content-type: application/javascript; charset=utf-8
cache: HIT, HIT

GET
H2 200 tilda-cover-1.0.min.js Show response
static.tildacdn.com/js/ 11 KB
3 KB 9ms
8ms Script
application/javascript 2a03:90c0:41:2801::254
GCORE

General

Check archive.org

Show headers Download Go to

Full URL: https://static.tildacdn.com/js/tilda-cover-1.0.min.js
Requested by: Host: blog.group-ib.com
URL: https://blog.group-ib.com/apt41-world-tour-2021
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a03:90c0:41:2801::254 Frankfurt am Main, Germany, ASN199524 (GCORE, LU),
Reverse DNS
Software: nginx /
Resource Hash: 885405644f0b9e41c762f39390b853552522ced2d4650e809baf4b34173b44ae

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

x-id: m9-up-gc58, fr5-up-gc38
date: Thu, 18 Aug 2022 20:15:40 GMT
content-encoding: br
tserver: 12
last-modified: Tue, 02 Aug 2022 12:52:32 GMT
server: nginx
etag: W/"62e91e10-2dd1"
vary: Accept-Encoding
x-cached-since: 2022-08-04T09:00:13+00:00, 2022-08-04T09:00:22+00:00
content-type: application/javascript; charset=utf-8
cache: HIT, HIT

GET
H2 200 tilda-zoom-2.0.min.js Show response
static.tildacdn.com/js/ 25 KB
6 KB 33ms
25ms Script
application/javascript 2a03:90c0:41:2801::254
GCORE

General

Check archive.org

Show headers Download Go to

Full URL: https://static.tildacdn.com/js/tilda-zoom-2.0.min.js
Requested by: Host: blog.group-ib.com
URL: https://blog.group-ib.com/apt41-world-tour-2021
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a03:90c0:41:2801::254 Frankfurt am Main, Germany, ASN199524 (GCORE, LU),
Reverse DNS
Software: nginx /
Resource Hash: fe991316b19d066a4e8ca3fb5899e5aa9b52147dddc9df95c5158120ec0f7093

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

x-id: m9-up-gc52, fr5-up-gc38
date: Thu, 18 Aug 2022 20:15:40 GMT
content-encoding: br
tserver: 13
last-modified: Fri, 01 Jul 2022 14:43:30 GMT
server: nginx
etag: W/"62bf0812-6373"
vary: Accept-Encoding
x-cached-since: 2022-07-01T14:43:38+00:00, 2022-07-01T14:43:39+00:00
content-type: application/javascript; charset=utf-8
cache: HIT, HIT

GET
H2 200 hammer.min.js Show response
static.tildacdn.com/js/ 20 KB
7 KB 34ms
26ms Script
application/javascript 2a03:90c0:41:2801::254
GCORE

General

Check archive.org

Show headers Download Go to

Full URL: https://static.tildacdn.com/js/hammer.min.js
Requested by: Host: blog.group-ib.com
URL: https://blog.group-ib.com/apt41-world-tour-2021
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a03:90c0:41:2801::254 Frankfurt am Main, Germany, ASN199524 (GCORE, LU),
Reverse DNS
Software: nginx /
Resource Hash: 090a7068a2209545279f858c6f41ff7ae42815e11c3d69463a2a2ea835282bd9

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

x-id: m9-up-gc58, fr5-up-gc38
date: Thu, 18 Aug 2022 20:15:40 GMT
content-encoding: br
tserver: 8
last-modified: Thu, 18 Mar 2021 12:08:37 GMT
server: nginx
etag: W/"605342c5-50f6"
vary: Accept-Encoding
x-cached-since: 2022-06-04T13:58:31+00:00, 2022-07-14T09:09:19+00:00
content-type: application/javascript; charset=utf-8
cache: HIT, HIT

GET
H2 200 highlight.min.js Show response
static.tildacdn.com/js/ 41 KB
16 KB 58ms
15ms Script
application/javascript 2a03:90c0:41:2801::254
GCORE

General

Check archive.org

Show headers Download Go to

Full URL: https://static.tildacdn.com/js/highlight.min.js
Requested by: Host: blog.group-ib.com
URL: https://blog.group-ib.com/apt41-world-tour-2021
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a03:90c0:41:2801::254 Frankfurt am Main, Germany, ASN199524 (GCORE, LU),
Reverse DNS
Software: nginx /
Resource Hash: 5ad5171287c6d8cd3f604df3559129c28c5aaea6cc67ccdef3d0a509dbdd7a64

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

x-id: m9-up-gc52, fr5-up-gc38
date: Thu, 18 Aug 2022 20:15:40 GMT
content-encoding: br
tserver: 8
last-modified: Thu, 18 Mar 2021 12:08:37 GMT
server: nginx
etag: W/"605342c5-a5cd"
vary: Accept-Encoding
x-cached-since: 2022-05-17T11:47:05+00:00, 2022-06-21T15:23:17+00:00
content-type: application/javascript; charset=utf-8
cache: HIT, HIT

GET
H2 200 tilda-slds-1.4.min.js Show response
static.tildacdn.com/js/ 35 KB
6 KB 34ms
26ms Script
application/javascript 2a03:90c0:41:2801::254
GCORE

General

Check archive.org

Show headers Download Go to

Full URL: https://static.tildacdn.com/js/tilda-slds-1.4.min.js
Requested by: Host: blog.group-ib.com
URL: https://blog.group-ib.com/apt41-world-tour-2021
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a03:90c0:41:2801::254 Frankfurt am Main, Germany, ASN199524 (GCORE, LU),
Reverse DNS
Software: nginx /
Resource Hash: b1b1ddab9ead076f86471e26c5309ae03c38bac87960f3954f556e12c2012a4e

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

x-id: m9-up-gc57, fr5-up-gc38
date: Thu, 18 Aug 2022 20:15:40 GMT
content-encoding: br
tserver: 13
last-modified: Wed, 17 Aug 2022 13:12:57 GMT
server: nginx
etag: W/"62fce959-8b0c"
vary: Accept-Encoding
x-cached-since: 2022-08-17T13:13:06+00:00, 2022-08-17T13:13:17+00:00
content-type: application/javascript; charset=utf-8
cache: HIT, HIT

GET
H2 200 tilda-t431-table-1.0.min.js Show response
static.tildacdn.com/js/ 6 KB
2 KB 35ms
27ms Script
application/javascript 2a03:90c0:41:2801::254
GCORE

General

Check archive.org

Show headers Download Go to

Full URL: https://static.tildacdn.com/js/tilda-t431-table-1.0.min.js
Requested by: Host: blog.group-ib.com
URL: https://blog.group-ib.com/apt41-world-tour-2021
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a03:90c0:41:2801::254 Frankfurt am Main, Germany, ASN199524 (GCORE, LU),
Reverse DNS
Software: nginx /
Resource Hash: 8dfcbd7085c9bd097557529d6fa20b50aad20de04190e7bc22c6b2f20984d6a0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

x-id: m9-up-gc57, fr5-up-gc38
date: Thu, 18 Aug 2022 20:15:40 GMT
content-encoding: br
tserver: 8
last-modified: Wed, 18 May 2022 12:23:09 GMT
server: nginx
etag: W/"6284e52d-1764"
vary: Accept-Encoding
x-cached-since: 2022-07-17T12:37:52+00:00, 2022-08-18T08:03:47+00:00
content-type: application/javascript; charset=utf-8
cache: HIT, HIT

GET
H2 200 tilda-zero-1.0.min.js Show response
static.tildacdn.com/js/ 31 KB
7 KB 35ms
28ms Script
application/javascript 2a03:90c0:41:2801::254
GCORE

General

Check archive.org

Show headers Download Go to

Full URL: https://static.tildacdn.com/js/tilda-zero-1.0.min.js
Requested by: Host: blog.group-ib.com
URL: https://blog.group-ib.com/apt41-world-tour-2021
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a03:90c0:41:2801::254 Frankfurt am Main, Germany, ASN199524 (GCORE, LU),
Reverse DNS
Software: nginx /
Resource Hash: 8c60245f59ca16b47b8ab7922b39d9072ce9d3a3eccf9f8d8dd09673fe68cd06

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

x-id: m9-up-gc58, fr5-up-gc38
date: Thu, 18 Aug 2022 20:15:40 GMT
content-encoding: br
tserver: 9
last-modified: Thu, 18 Aug 2022 15:10:54 GMT
server: nginx
etag: W/"62fe567e-7c4c"
vary: Accept-Encoding
x-cached-since: 2022-08-18T15:11:04+00:00, 2022-08-18T15:11:06+00:00
content-type: application/javascript; charset=utf-8
cache: HIT, HIT

GET
H2 200 tilda-events-1.0.min.js Show response
static.tildacdn.com/js/ 13 KB
3 KB 36ms
28ms Script
application/javascript 2a03:90c0:41:2801::254
GCORE

General

Check archive.org

Show headers Download Go to

Full URL: https://static.tildacdn.com/js/tilda-events-1.0.min.js
Requested by: Host: blog.group-ib.com
URL: https://blog.group-ib.com/apt41-world-tour-2021
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a03:90c0:41:2801::254 Frankfurt am Main, Germany, ASN199524 (GCORE, LU),
Reverse DNS
Software: nginx /
Resource Hash: c61736acb76e337d6afe9613a8b6d71e2f29b1be93a17c61db27da32e322f877

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

x-id: m9-up-gc66, fr5-up-gc38
date: Thu, 18 Aug 2022 20:15:40 GMT
content-encoding: br
tserver: 10
last-modified: Fri, 05 Aug 2022 10:37:23 GMT
server: nginx
etag: W/"62ecf2e3-3316"
vary: Accept-Encoding
x-cached-since: 2022-08-05T10:37:33+00:00, 2022-08-05T10:37:36+00:00
content-type: application/javascript; charset=utf-8
cache: HIT, HIT

GET
H2 200 Facebook.png
static.tildacdn.com/tild6630-6532-4133-b436-623962626561/-/empty/ 379 B
489 B 36ms
28ms Image
image/png 2a03:90c0:41:2801::254
GCORE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.tildacdn.com/tild6630-6532-4133-b436-623962626561/-/empty/Facebook.png
Requested by: Host: blog.group-ib.com
URL: https://blog.group-ib.com/apt41-world-tour-2021
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a03:90c0:41:2801::254 Frankfurt am Main, Germany, ASN199524 (GCORE, LU),
Reverse DNS
Software: nginx /
Resource Hash: 814abf32fb9bec056a8e421e74299e3cdcb3bf1e4306931171d7532a682c42bb

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

x-id: m9p-up-gc10, fr5-up-gc38
date: Thu, 18 Aug 2022 20:15:40 GMT
tserver: 9
server: nginx
x-cached-since: 2022-08-14T00:09:34+00:00, 2022-08-18T13:23:48+00:00
content-type: image/png
cache-control: public
cache: HIT, HIT
expires: Tue, 13 Sep 2022 23:59:59 GMT

GET
H2 200 image.png
static.tildacdn.com/tild3139-6161-4934-b531-663334336238/-/empty/ 996 B
1 KB 36ms
29ms Image
image/png 2a03:90c0:41:2801::254
GCORE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.tildacdn.com/tild3139-6161-4934-b531-663334336238/-/empty/image.png
Requested by: Host: blog.group-ib.com
URL: https://blog.group-ib.com/apt41-world-tour-2021
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a03:90c0:41:2801::254 Frankfurt am Main, Germany, ASN199524 (GCORE, LU),
Reverse DNS
Software: nginx /
Resource Hash: 0338467bccccc4115d78dfc16b3f852927dc9ce4cd819c575ddfb6b93c945a37

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

x-id: m9-up-gc58, fr5-up-gc38
date: Thu, 18 Aug 2022 20:15:40 GMT
tserver: 12
server: nginx
x-cached-since: 2022-08-18T11:08:42+00:00, 2022-08-18T13:23:48+00:00
content-type: image/png
cache-control: public
cache: HIT, HIT
expires: Fri, 16 Sep 2022 23:59:59 GMT

GET
H2 200 image.png
static.tildacdn.com/tild6135-6235-4432-a263-316364386365/-/empty/ 1 KB
1 KB 37ms
29ms Image
image/png 2a03:90c0:41:2801::254
GCORE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.tildacdn.com/tild6135-6235-4432-a263-316364386365/-/empty/image.png
Requested by: Host: blog.group-ib.com
URL: https://blog.group-ib.com/apt41-world-tour-2021
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a03:90c0:41:2801::254 Frankfurt am Main, Germany, ASN199524 (GCORE, LU),
Reverse DNS
Software: nginx /
Resource Hash: 566ba7ee9f5b42934e2a9f6f82a729c758ca5e4b9486c520fc0b8895e604ca9e

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

x-id: m9p-up-gc10, fr5-up-gc38
date: Thu, 18 Aug 2022 20:15:40 GMT
tserver: 13
server: nginx
x-cached-since: 2022-08-18T07:54:28+00:00, 2022-08-18T13:23:48+00:00
content-type: image/png
cache-control: public
cache: HIT, HIT
expires: Fri, 16 Sep 2022 23:59:59 GMT

GET
H2 200 image.png
static.tildacdn.com/tild6538-3134-4632-b862-613834663535/-/empty/ 1 KB
1 KB 33ms
26ms Image
image/png 2a03:90c0:41:2801::254
GCORE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.tildacdn.com/tild6538-3134-4632-b862-613834663535/-/empty/image.png
Requested by: Host: blog.group-ib.com
URL: https://blog.group-ib.com/apt41-world-tour-2021
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a03:90c0:41:2801::254 Frankfurt am Main, Germany, ASN199524 (GCORE, LU),
Reverse DNS
Software: nginx /
Resource Hash: 566ba7ee9f5b42934e2a9f6f82a729c758ca5e4b9486c520fc0b8895e604ca9e

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

x-id: m9p-up-gc10, fr5-up-gc38
date: Thu, 18 Aug 2022 20:15:40 GMT
tserver: 10
server: nginx
x-cached-since: 2022-08-18T07:54:28+00:00, 2022-08-18T13:11:27+00:00
content-type: image/png
cache-control: public
cache: HIT, HIT
expires: Fri, 16 Sep 2022 23:59:59 GMT

GET
H2 200 image.png
static.tildacdn.com/tild3361-3035-4366-a438-396539363435/-/empty/ 327 B
374 B 37ms
30ms Image
image/png 2a03:90c0:41:2801::254
GCORE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.tildacdn.com/tild3361-3035-4366-a438-396539363435/-/empty/image.png
Requested by: Host: blog.group-ib.com
URL: https://blog.group-ib.com/apt41-world-tour-2021
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a03:90c0:41:2801::254 Frankfurt am Main, Germany, ASN199524 (GCORE, LU),
Reverse DNS
Software: nginx /
Resource Hash: 7115145b233d36b71b75fee25e2f937ed82b856bd05891d2ff26c07db0f3920b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

x-id: m9-up-gc52, fr5-up-gc38
date: Thu, 18 Aug 2022 20:15:40 GMT
tserver: 13
server: nginx
x-cached-since: 2022-08-18T11:08:42+00:00, 2022-08-18T13:23:48+00:00
content-type: image/png
cache-control: public
cache: HIT, HIT
expires: Fri, 16 Sep 2022 23:59:59 GMT

GET
H2 200 image.png
static.tildacdn.com/tild6461-3735-4463-b064-363461346562/-/empty/ 1 KB
1 KB 37ms
30ms Image
image/png 2a03:90c0:41:2801::254
GCORE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.tildacdn.com/tild6461-3735-4463-b064-363461346562/-/empty/image.png
Requested by: Host: blog.group-ib.com
URL: https://blog.group-ib.com/apt41-world-tour-2021
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a03:90c0:41:2801::254 Frankfurt am Main, Germany, ASN199524 (GCORE, LU),
Reverse DNS
Software: nginx /
Resource Hash: 566ba7ee9f5b42934e2a9f6f82a729c758ca5e4b9486c520fc0b8895e604ca9e

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

x-id: m9-up-gc53, fr5-up-gc38
date: Thu, 18 Aug 2022 20:15:40 GMT
tserver: 12
server: nginx
x-cached-since: 2022-08-18T07:54:28+00:00, 2022-08-18T13:23:48+00:00
content-type: image/png
cache-control: public
cache: HIT, HIT
expires: Fri, 16 Sep 2022 23:59:59 GMT

GET
H2 200 image.png
static.tildacdn.com/tild3531-3939-4636-b737-636266376266/-/empty/ 1 KB
1 KB 34ms
27ms Image
image/png 2a03:90c0:41:2801::254
GCORE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.tildacdn.com/tild3531-3939-4636-b737-636266376266/-/empty/image.png
Requested by: Host: blog.group-ib.com
URL: https://blog.group-ib.com/apt41-world-tour-2021
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a03:90c0:41:2801::254 Frankfurt am Main, Germany, ASN199524 (GCORE, LU),
Reverse DNS
Software: nginx /
Resource Hash: 566ba7ee9f5b42934e2a9f6f82a729c758ca5e4b9486c520fc0b8895e604ca9e

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

x-id: m9p-up-gc10, fr5-up-gc38
date: Thu, 18 Aug 2022 20:15:40 GMT
tserver: 12
server: nginx
x-cached-since: 2022-08-18T07:54:28+00:00, 2022-08-18T13:10:56+00:00
content-type: image/png
cache-control: public
cache: HIT, HIT
expires: Fri, 16 Sep 2022 23:59:59 GMT

GET
H2 200 tilda-zoom-2.0.min.css
static.tildacdn.com/css/ 6 KB
2 KB 41ms
38ms Stylesheet
text/css 2a03:90c0:41:2801::254
GCORE

General

Check archive.org

Show headers Download Go to

Full URL: https://static.tildacdn.com/css/tilda-zoom-2.0.min.css
Requested by: Host: blog.group-ib.com
URL: https://blog.group-ib.com/apt41-world-tour-2021
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a03:90c0:41:2801::254 Frankfurt am Main, Germany, ASN199524 (GCORE, LU),
Reverse DNS
Software: nginx /
Resource Hash: 0037ace955e198e11485bec5320c8bbf620c5df5116299ff7616108bbe3d5570

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

x-id: m9-up-gc52, fr5-up-gc38
date: Thu, 18 Aug 2022 20:15:40 GMT
content-encoding: br
tserver: 9
last-modified: Tue, 28 Jun 2022 08:54:39 GMT
server: nginx
etag: W/"62bac1cf-1770"
vary: Accept-Encoding
x-cached-since: 2022-06-28T09:37:27+00:00, 2022-07-26T10:00:31+00:00
content-type: text/css
cache: HIT, HIT

GET
H2 200 tilda-slds-1.4.min.css
static.tildacdn.com/css/ 12 KB
2 KB 40ms
37ms Stylesheet
text/css 2a03:90c0:41:2801::254
GCORE

General

Check archive.org

Show headers Download Go to

Full URL: https://static.tildacdn.com/css/tilda-slds-1.4.min.css
Requested by: Host: blog.group-ib.com
URL: https://blog.group-ib.com/apt41-world-tour-2021
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a03:90c0:41:2801::254 Frankfurt am Main, Germany, ASN199524 (GCORE, LU),
Reverse DNS
Software: nginx /
Resource Hash: 8fd129226466f3057ccdaa303eec0bc79c7d72e2e00d0e2a058dc991a7f3ab77

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

x-id: m9-up-gc52, fr5-up-gc38
date: Thu, 18 Aug 2022 20:15:40 GMT
content-encoding: br
tserver: 11
last-modified: Wed, 06 Jul 2022 07:11:53 GMT
server: nginx
etag: W/"62c535b9-2e2a"
vary: Accept-Encoding
x-cached-since: 2022-07-06T07:11:58+00:00, 2022-07-08T11:23:31+00:00
content-type: text/css
cache: HIT, HIT

GET
H2 200 Screen_Shot_2022-08-.png
static.tildacdn.com/tild3538-3764-4630-b230-393663613635/-/empty/ 1 KB
1 KB 37ms
31ms Image
image/png 2a03:90c0:41:2801::254
GCORE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.tildacdn.com/tild3538-3764-4630-b230-393663613635/-/empty/Screen_Shot_2022-08-.png
Requested by: Host: blog.group-ib.com
URL: https://blog.group-ib.com/apt41-world-tour-2021
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a03:90c0:41:2801::254 Frankfurt am Main, Germany, ASN199524 (GCORE, LU),
Reverse DNS
Software: nginx /
Resource Hash: d23d77177c2c99a81edd09c40f5e4c31e8172155880ef68fba17e76b930b9b47

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

x-id: m9-up-gc58, fr5-up-gc38
date: Thu, 18 Aug 2022 20:15:40 GMT
tserver: 11
server: nginx
x-cached-since: 2022-08-18T07:52:03+00:00, 2022-08-18T13:23:48+00:00
content-type: image/png
cache-control: public
cache: HIT, HIT
expires: Thu, 15 Sep 2022 23:59:59 GMT

GET
H2 200 Screen_Shot_2022-08-.png
static.tildacdn.com/tild6632-3063-4261-a332-336334666564/-/empty/ 312 B
401 B 35ms
28ms Image
image/png 2a03:90c0:41:2801::254
GCORE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.tildacdn.com/tild6632-3063-4261-a332-336334666564/-/empty/Screen_Shot_2022-08-.png
Requested by: Host: blog.group-ib.com
URL: https://blog.group-ib.com/apt41-world-tour-2021
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a03:90c0:41:2801::254 Frankfurt am Main, Germany, ASN199524 (GCORE, LU),
Reverse DNS
Software: nginx /
Resource Hash: c3b7b9be623a5918e819b0f82c290ef742da4e14770e9cdb033291f68032505d

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

x-id: m9-up-gc53, fr5-up-gc38
date: Thu, 18 Aug 2022 20:15:40 GMT
tserver: 10
server: nginx
x-cached-since: 2022-08-18T07:52:03+00:00, 2022-08-18T13:23:48+00:00
content-type: image/png
cache-control: public
cache: HIT, HIT
expires: Thu, 15 Sep 2022 23:59:59 GMT

GET
H2 200 Screen_Shot_2022-08-.png
static.tildacdn.com/tild3837-3435-4163-a562-363438626536/-/empty/ 532 B
601 B 35ms
29ms Image
image/png 2a03:90c0:41:2801::254
GCORE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.tildacdn.com/tild3837-3435-4163-a562-363438626536/-/empty/Screen_Shot_2022-08-.png
Requested by: Host: blog.group-ib.com
URL: https://blog.group-ib.com/apt41-world-tour-2021
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a03:90c0:41:2801::254 Frankfurt am Main, Germany, ASN199524 (GCORE, LU),
Reverse DNS
Software: nginx /
Resource Hash: 5ae5f7a650b358bc56f66e8680ec9f3e4d1858ce1c182d679ce40bdadf81c250

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

x-id: m9-up-gc53, fr5-up-gc38
date: Thu, 18 Aug 2022 20:15:40 GMT
tserver: 11
server: nginx
x-cached-since: 2022-08-18T07:52:03+00:00, 2022-08-18T13:23:48+00:00
content-type: image/png
cache-control: public
cache: HIT, HIT
expires: Mon, 12 Sep 2022 23:59:59 GMT

GET
H2 200 Screen_Shot_2022-08-.png
static.tildacdn.com/tild6234-6430-4630-b733-313631386433/-/empty/ 330 B
397 B 37ms
31ms Image
image/png 2a03:90c0:41:2801::254
GCORE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.tildacdn.com/tild6234-6430-4630-b733-313631386433/-/empty/Screen_Shot_2022-08-.png
Requested by: Host: blog.group-ib.com
URL: https://blog.group-ib.com/apt41-world-tour-2021
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a03:90c0:41:2801::254 Frankfurt am Main, Germany, ASN199524 (GCORE, LU),
Reverse DNS
Software: nginx /
Resource Hash: 8b10e3ad964b72065344101dfa8b05e4bccccafb6380043f30f4c56ec096655b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

x-id: m9-up-gc58, fr5-up-gc38
date: Thu, 18 Aug 2022 20:15:40 GMT
tserver: 8
server: nginx
x-cached-since: 2022-08-18T06:43:29+00:00, 2022-08-18T13:23:48+00:00
content-type: image/png
cache-control: public
cache: HIT, HIT
expires: Mon, 12 Sep 2022 23:59:59 GMT

GET
H2 200 image.png
static.tildacdn.com/tild3836-6462-4431-b431-373939323332/-/empty/ 977 B
1023 B 37ms
32ms Image
image/png 2a03:90c0:41:2801::254
GCORE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.tildacdn.com/tild3836-6462-4431-b431-373939323332/-/empty/image.png
Requested by: Host: blog.group-ib.com
URL: https://blog.group-ib.com/apt41-world-tour-2021
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a03:90c0:41:2801::254 Frankfurt am Main, Germany, ASN199524 (GCORE, LU),
Reverse DNS
Software: nginx /
Resource Hash: 449038c8262e499fd959000c5b1b2d75ebb0a6abec54903e5bf3fdd3f60b068f

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

x-id: m9-up-gc57, fr5-up-gc38
date: Thu, 18 Aug 2022 20:15:40 GMT
tserver: 11
server: nginx
x-cached-since: 2022-08-18T11:08:42+00:00, 2022-08-18T13:23:48+00:00
content-type: image/png
cache-control: public
cache: HIT, HIT
expires: Fri, 16 Sep 2022 23:59:59 GMT

GET
H2 200 Screen_Shot_2022-08-.png
static.tildacdn.com/tild6431-3536-4461-b532-353836343462/-/empty/ 940 B
986 B 38ms
33ms Image
image/png 2a03:90c0:41:2801::254
GCORE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.tildacdn.com/tild6431-3536-4461-b532-353836343462/-/empty/Screen_Shot_2022-08-.png
Requested by: Host: blog.group-ib.com
URL: https://blog.group-ib.com/apt41-world-tour-2021
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a03:90c0:41:2801::254 Frankfurt am Main, Germany, ASN199524 (GCORE, LU),
Reverse DNS
Software: nginx /
Resource Hash: b28f94aa1befadb8596f2774f4826049c27bb1e2b8ffcef35bb53c1755d7c5c8

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

x-id: m9-up-gc52, fr5-up-gc38
date: Thu, 18 Aug 2022 20:15:40 GMT
tserver: 10
server: nginx
x-cached-since: 2022-08-18T06:43:29+00:00, 2022-08-18T13:23:48+00:00
content-type: image/png
cache-control: public
cache: HIT, HIT
expires: Mon, 12 Sep 2022 23:59:59 GMT

GET
H2 200 Screen_Shot_2022-08-.png
static.tildacdn.com/tild3337-3363-4331-b832-626665626536/-/empty/ 955 B
1000 B 38ms
32ms Image
image/png 2a03:90c0:41:2801::254
GCORE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.tildacdn.com/tild3337-3363-4331-b832-626665626536/-/empty/Screen_Shot_2022-08-.png
Requested by: Host: blog.group-ib.com
URL: https://blog.group-ib.com/apt41-world-tour-2021
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a03:90c0:41:2801::254 Frankfurt am Main, Germany, ASN199524 (GCORE, LU),
Reverse DNS
Software: nginx /
Resource Hash: 87afed8d20cbe64b357daaab47688278b1337d7d537673e5f4b86c971caa76b2

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

x-id: m9-up-gc66, fr5-up-gc38
date: Thu, 18 Aug 2022 20:15:40 GMT
tserver: 10
server: nginx
x-cached-since: 2022-08-18T06:43:29+00:00, 2022-08-18T13:23:48+00:00
content-type: image/png
cache-control: public
cache: HIT, HIT
expires: Thu, 15 Sep 2022 23:59:59 GMT

GET
H2 200 Screen_Shot_2022-08-.png
static.tildacdn.com/tild3862-3137-4064-b365-613637343833/-/empty/ 941 B
1008 B 38ms
33ms Image
image/png 2a03:90c0:41:2801::254
GCORE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.tildacdn.com/tild3862-3137-4064-b365-613637343833/-/empty/Screen_Shot_2022-08-.png
Requested by: Host: blog.group-ib.com
URL: https://blog.group-ib.com/apt41-world-tour-2021
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a03:90c0:41:2801::254 Frankfurt am Main, Germany, ASN199524 (GCORE, LU),
Reverse DNS
Software: nginx /
Resource Hash: 882c7c93f47238375b91a6e98771361b5acd2e88db62ae591da00877ec41405a

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

x-id: m9-up-gc53, fr5-up-gc38
date: Thu, 18 Aug 2022 20:15:40 GMT
tserver: 11
server: nginx
x-cached-since: 2022-08-17T13:06:24+00:00, 2022-08-18T13:23:48+00:00
content-type: image/png
cache-control: public
cache: HIT, HIT
expires: Thu, 15 Sep 2022 23:59:59 GMT

GET
H2 200 Screen_Shot_2022-08-.png
static.tildacdn.com/tild3232-6562-4834-b362-613933333961/-/empty/ 952 B
998 B 38ms
33ms Image
image/png 2a03:90c0:41:2801::254
GCORE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.tildacdn.com/tild3232-6562-4834-b362-613933333961/-/empty/Screen_Shot_2022-08-.png
Requested by: Host: blog.group-ib.com
URL: https://blog.group-ib.com/apt41-world-tour-2021
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a03:90c0:41:2801::254 Frankfurt am Main, Germany, ASN199524 (GCORE, LU),
Reverse DNS
Software: nginx /
Resource Hash: c9058c22d84d2b4bc2967cf33408e436b77e2d75577f8f59b506e1317176e96a

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

x-id: m9-up-gc53, fr5-up-gc38
date: Thu, 18 Aug 2022 20:15:40 GMT
tserver: 13
server: nginx
x-cached-since: 2022-08-18T07:52:03+00:00, 2022-08-18T13:23:48+00:00
content-type: image/png
cache-control: public
cache: HIT, HIT
expires: Thu, 15 Sep 2022 23:59:59 GMT

GET
H2 200 Screen_Shot_2022-08-.png
static.tildacdn.com/tild3432-6236-4535-b766-626262623833/-/empty/ 947 B
992 B 39ms
34ms Image
image/png 2a03:90c0:41:2801::254
GCORE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.tildacdn.com/tild3432-6236-4535-b766-626262623833/-/empty/Screen_Shot_2022-08-.png
Requested by: Host: blog.group-ib.com
URL: https://blog.group-ib.com/apt41-world-tour-2021
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a03:90c0:41:2801::254 Frankfurt am Main, Germany, ASN199524 (GCORE, LU),
Reverse DNS
Software: nginx /
Resource Hash: 03f2d46d7c992367e1cde2702716bb284b5939c31dc417a700f7e504ebc6c23d

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

x-id: m9-up-gc66, fr5-up-gc38
date: Thu, 18 Aug 2022 20:15:40 GMT
tserver: 8
server: nginx
x-cached-since: 2022-08-18T07:52:03+00:00, 2022-08-18T13:23:48+00:00
content-type: image/png
cache-control: public
cache: HIT, HIT
expires: Thu, 15 Sep 2022 23:59:59 GMT

GET
H2 200 Screen_Shot_2022-08-.png
static.tildacdn.com/tild6562-6662-4466-b334-646261353736/-/empty/ 951 B
998 B 39ms
34ms Image
image/png 2a03:90c0:41:2801::254
GCORE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.tildacdn.com/tild6562-6662-4466-b334-646261353736/-/empty/Screen_Shot_2022-08-.png
Requested by: Host: blog.group-ib.com
URL: https://blog.group-ib.com/apt41-world-tour-2021
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a03:90c0:41:2801::254 Frankfurt am Main, Germany, ASN199524 (GCORE, LU),
Reverse DNS
Software: nginx /
Resource Hash: 1243a7ac1125978234651c0105a1697aca8433d9ac3c5d9fb616254ffec7fe9e

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

x-id: m9-up-gc58, fr5-up-gc38
date: Thu, 18 Aug 2022 20:15:40 GMT
tserver: 13
server: nginx
x-cached-since: 2022-08-18T07:52:03+00:00, 2022-08-18T13:23:48+00:00
content-type: image/png
cache-control: public
cache: HIT, HIT
expires: Thu, 15 Sep 2022 23:59:59 GMT

GET
H2 200 image.png
static.tildacdn.com/tild3463-3162-4233-b733-626264636361/-/empty/ 977 B
1023 B 39ms
34ms Image
image/png 2a03:90c0:41:2801::254
GCORE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.tildacdn.com/tild3463-3162-4233-b733-626264636361/-/empty/image.png
Requested by: Host: blog.group-ib.com
URL: https://blog.group-ib.com/apt41-world-tour-2021
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a03:90c0:41:2801::254 Frankfurt am Main, Germany, ASN199524 (GCORE, LU),
Reverse DNS
Software: nginx /
Resource Hash: 449038c8262e499fd959000c5b1b2d75ebb0a6abec54903e5bf3fdd3f60b068f

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

x-id: m9-up-gc66, fr5-up-gc38
date: Thu, 18 Aug 2022 20:15:40 GMT
tserver: 13
server: nginx
x-cached-since: 2022-08-18T11:08:42+00:00, 2022-08-18T13:23:48+00:00
content-type: image/png
cache-control: public
cache: HIT, HIT
expires: Fri, 16 Sep 2022 23:59:59 GMT

GET
H2 200 Screen_Shot_2022-08-.png
static.tildacdn.com/tild3863-3935-4130-a331-336236643133/-/empty/ 814 B
861 B 39ms
35ms Image
image/png 2a03:90c0:41:2801::254
GCORE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.tildacdn.com/tild3863-3935-4130-a331-336236643133/-/empty/Screen_Shot_2022-08-.png
Requested by: Host: blog.group-ib.com
URL: https://blog.group-ib.com/apt41-world-tour-2021
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a03:90c0:41:2801::254 Frankfurt am Main, Germany, ASN199524 (GCORE, LU),
Reverse DNS
Software: nginx /
Resource Hash: cef052805859951c50100205e7686d49c3b21b05b191727e6d9b590287feed37

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

x-id: m9-up-gc58, fr5-up-gc38
date: Thu, 18 Aug 2022 20:15:40 GMT
tserver: 13
server: nginx
x-cached-since: 2022-08-18T07:52:03+00:00, 2022-08-18T13:23:48+00:00
content-type: image/png
cache-control: public
cache: HIT, HIT
expires: Thu, 15 Sep 2022 23:59:59 GMT

GET
H2 200 Screen_Shot_2022-08-.png
static.tildacdn.com/tild3762-3031-4165-b535-666163316661/-/empty/ 155 B
222 B 40ms
36ms Image
image/png 2a03:90c0:41:2801::254
GCORE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.tildacdn.com/tild3762-3031-4165-b535-666163316661/-/empty/Screen_Shot_2022-08-.png
Requested by: Host: blog.group-ib.com
URL: https://blog.group-ib.com/apt41-world-tour-2021
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a03:90c0:41:2801::254 Frankfurt am Main, Germany, ASN199524 (GCORE, LU),
Reverse DNS
Software: nginx /
Resource Hash: 8df3b04a22f19d6c9afb13dffdbe74db68127e61876b3b8186e29a218f4df079

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

x-id: m9-up-gc52, fr5-up-gc38
date: Thu, 18 Aug 2022 20:15:40 GMT
tserver: 9
server: nginx
x-cached-since: 2022-08-18T06:43:29+00:00, 2022-08-18T13:11:16+00:00
content-type: image/png
cache-control: public
cache: HIT, HIT
expires: Thu, 15 Sep 2022 23:59:59 GMT

GET
H2 200 image.png
static.tildacdn.com/tild6338-3965-4864-b264-333034393332/-/empty/ 992 B
1 KB 42ms
38ms Image
image/png 2a03:90c0:41:2801::254
GCORE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.tildacdn.com/tild6338-3965-4864-b264-333034393332/-/empty/image.png
Requested by: Host: blog.group-ib.com
URL: https://blog.group-ib.com/apt41-world-tour-2021
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a03:90c0:41:2801::254 Frankfurt am Main, Germany, ASN199524 (GCORE, LU),
Reverse DNS
Software: nginx /
Resource Hash: 093e89df4a71989fd6add2687b73da82d03550a4207f4769dfbc3a1a4931b132

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

x-id: m9-up-gc57, fr5-up-gc38
date: Thu, 18 Aug 2022 20:15:40 GMT
tserver: 13
server: nginx
x-cached-since: 2022-08-18T11:08:42+00:00, 2022-08-18T13:23:48+00:00
content-type: image/png
cache-control: public
cache: HIT, HIT
expires: Fri, 16 Sep 2022 23:59:59 GMT

GET
H2 200 image.png
static.tildacdn.com/tild6431-3764-4539-a630-343530633537/-/empty/ 1 KB
1 KB 40ms
36ms Image
image/png 2a03:90c0:41:2801::254
GCORE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.tildacdn.com/tild6431-3764-4539-a630-343530633537/-/empty/image.png
Requested by: Host: blog.group-ib.com
URL: https://blog.group-ib.com/apt41-world-tour-2021
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a03:90c0:41:2801::254 Frankfurt am Main, Germany, ASN199524 (GCORE, LU),
Reverse DNS
Software: nginx /
Resource Hash: 02a7853ff154ba6aeb04d6a295279af4e0f38b9ca157aec73a8da343893fa085

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

x-id: m9-up-gc53, fr5-up-gc38
date: Thu, 18 Aug 2022 20:15:40 GMT
tserver: 9
server: nginx
x-cached-since: 2022-08-18T07:54:28+00:00, 2022-08-18T13:23:48+00:00
content-type: image/png
cache-control: public
cache: HIT, HIT
expires: Fri, 16 Sep 2022 23:59:59 GMT

GET
H2 200 image.png
static.tildacdn.com/tild3562-3536-4230-b039-333734663638/-/empty/ 1 KB
1 KB 40ms
36ms Image
image/png 2a03:90c0:41:2801::254
GCORE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.tildacdn.com/tild3562-3536-4230-b039-333734663638/-/empty/image.png
Requested by: Host: blog.group-ib.com
URL: https://blog.group-ib.com/apt41-world-tour-2021
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a03:90c0:41:2801::254 Frankfurt am Main, Germany, ASN199524 (GCORE, LU),
Reverse DNS
Software: nginx /
Resource Hash: 6d9800c9a8579f2d92f35dca604117e692960983af608da216d40d5803bb9c2e

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

x-id: m9-up-gc53, fr5-up-gc38
date: Thu, 18 Aug 2022 20:15:40 GMT
tserver: 8
server: nginx
x-cached-since: 2022-08-18T07:54:28+00:00, 2022-08-18T13:23:48+00:00
content-type: image/png
cache-control: public
cache: HIT, HIT
expires: Fri, 16 Sep 2022 23:59:59 GMT

GET
H2 200 mitre_eng_1.png
static.tildacdn.com/tild3639-3431-4539-a337-633233663134/-/empty/ 305 B
373 B 41ms
38ms Image
image/png 2a03:90c0:41:2801::254
GCORE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.tildacdn.com/tild3639-3431-4539-a337-633233663134/-/empty/mitre_eng_1.png
Requested by: Host: blog.group-ib.com
URL: https://blog.group-ib.com/apt41-world-tour-2021
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a03:90c0:41:2801::254 Frankfurt am Main, Germany, ASN199524 (GCORE, LU),
Reverse DNS
Software: nginx /
Resource Hash: ea48f8d434d1ce501e9388ba48ec53ada7133e8c701a9aeb3d66c59fd93e6829

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

x-id: m9-up-gc53, fr5-up-gc38
date: Thu, 18 Aug 2022 20:15:40 GMT
tserver: 12
server: nginx
x-cached-since: 2022-08-18T07:54:28+00:00, 2022-08-18T13:23:48+00:00
content-type: image/png
cache-control: public
cache: HIT, HIT
expires: Sat, 17 Sep 2022 23:59:59 GMT

GET
H2 200 ya-share.js Show response
static.tildacdn.com/js/ 82 KB
25 KB 39ms
35ms Script
application/javascript 2a03:90c0:41:2801::254
GCORE

General

Check archive.org

Show headers Download Go to

Full URL: https://static.tildacdn.com/js/ya-share.js
Requested by: Host: blog.group-ib.com
URL: https://blog.group-ib.com/apt41-world-tour-2021
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a03:90c0:41:2801::254 Frankfurt am Main, Germany, ASN199524 (GCORE, LU),
Reverse DNS
Software: nginx /
Resource Hash: 2e59794c9e506814df50c2fe349d9fc8d6418a5959ba5a5b18cbc4742ebba1de

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

x-id: m9p-up-gc10, fr5-up-gc38
date: Thu, 18 Aug 2022 20:15:40 GMT
content-encoding: br
tserver: 10
last-modified: Thu, 18 Mar 2021 12:08:37 GMT
server: nginx
etag: W/"605342c5-147ff"
vary: Accept-Encoding
x-cached-since: 2022-05-26T10:00:00+00:00, 2022-07-06T07:55:39+00:00
content-type: application/javascript; charset=utf-8
cache: HIT, HIT

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 273 KB
86 KB 64ms
40ms Script
application/javascript 2a00:1450:4001:827::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-PW7265

Requested by

Host: blog.group-ib.com
URL: https://blog.group-ib.com/apt41-world-tour-2021

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

9a5fd1ba024578df23a4cbc0638ad5cc907c231f30d36451f9c626dfd7860df1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Thu, 18 Aug 2022 20:15:40 GMT
content-encoding: br
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 87088
x-xss-protection: 0
last-modified: Thu, 18 Aug 2022 19:13:42 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Thu, 18 Aug 2022 20:15:40 GMT

GET
H2 200 image.png
static.tildacdn.com/tild3533-3165-4133-b434-366536616565/-/resize/20x/ 642 B
708 B 40ms
37ms Image
image/png 2a03:90c0:41:2801::254
GCORE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.tildacdn.com/tild3533-3165-4133-b434-366536616565/-/resize/20x/image.png
Requested by: Host: blog.group-ib.com
URL: https://blog.group-ib.com/apt41-world-tour-2021
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a03:90c0:41:2801::254 Frankfurt am Main, Germany, ASN199524 (GCORE, LU),
Reverse DNS
Software: nginx /
Resource Hash: 687b3dc37f53fcd6de65ff25c95457a794a6a62b9c0043f40f5d266c713fd157

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

x-id: m9-up-gc53, fr5-up-gc38
date: Thu, 18 Aug 2022 20:15:40 GMT
tserver: 8
server: nginx
x-cached-since: 2022-08-18T07:54:29+00:00, 2022-08-18T13:23:48+00:00
content-type: image/png
cache-control: public
cache: HIT, HIT
expires: Fri, 16 Sep 2022 23:59:59 GMT

GET
H2 200 SFUIDisplayMedium.woff
static.tildacdn.com/tild3239-3033-4235-a566-376533383664/ 71 KB
71 KB 26ms
9ms Font
application/x-font-woff 2a03:90c0:41:2801::254
GCORE

General

Check archive.org

Show headers Download Go to

Full URL: https://static.tildacdn.com/tild3239-3033-4235-a566-376533383664/SFUIDisplayMedium.woff
Requested by: Host: ws.tildacdn.com
URL: https://ws.tildacdn.com/project200703/tilda-blocks-page29625858.min.css?t=1660824946
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a03:90c0:41:2801::254 Frankfurt am Main, Germany, ASN199524 (GCORE, LU),
Reverse DNS
Software: nginx /
Resource Hash: 19cc6e4b03f164ccb8d68121c3dfc374926bc9eaab12a4216306963bdefd76de

Request headers

Referer: https://ws.tildacdn.com/
Origin: https://blog.group-ib.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

x-id: m9-up-gc53, fr5-up-gc8
date: Thu, 18 Aug 2022 20:15:40 GMT
age: 1
x-cached-since: 2022-07-04T22:14:21+00:00, 2022-08-15T13:06:17+00:00
content-length: 72492
tserver: 8
last-modified: Tue, 18 Apr 2017 12:57:08 GMT
server: nginx
etag: "3ba1b30b31cc1d325b305f3951058787"
content-type: application/x-font-woff
access-control-allow-origin: *
x-timestamp: 1492520227.30915
cache-control: public
cache: HIT, HIT
accept-ranges: bytes
access-control-expose-headers: Cache-Control, Content-Language, Content-Type, Expires, Last-Modified, Pragma, Etag, X-Timestamp, X-Trans-Id, X-Openstack-Request-Id, Content-Length, Accept-Ranges, Expires, Cache-Control

GET
H2 200 SFUIDisplayLight.woff
static.tildacdn.com/tild6463-6361-4432-b234-333934313939/ 71 KB
71 KB 32ms
15ms Font
application/x-font-woff 2a03:90c0:41:2801::254
GCORE

General

Check archive.org

Show headers Download Go to

Full URL: https://static.tildacdn.com/tild6463-6361-4432-b234-333934313939/SFUIDisplayLight.woff
Requested by: Host: ws.tildacdn.com
URL: https://ws.tildacdn.com/project200703/tilda-blocks-page29625858.min.css?t=1660824946
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a03:90c0:41:2801::254 Frankfurt am Main, Germany, ASN199524 (GCORE, LU),
Reverse DNS
Software: nginx /
Resource Hash: 07cc9932ed0e2c7a958c6bf6e3a928847b9fe3f271832767ec89ee34e78f5227

Request headers

Referer: https://ws.tildacdn.com/
Origin: https://blog.group-ib.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

x-id: m9-up-gc53, fr5-up-gc8
date: Thu, 18 Aug 2022 20:15:40 GMT
age: 0
x-cached-since: 2022-07-07T19:00:24+00:00, 2022-08-15T13:06:17+00:00
content-length: 72608
tserver: 12
last-modified: Tue, 18 Apr 2017 12:57:03 GMT
server: nginx
etag: "08edc0015cdeec9e755f0ce361281b27"
content-type: application/x-font-woff
access-control-allow-origin: *
x-timestamp: 1492520222.13412
cache-control: public
cache: HIT, HIT
accept-ranges: bytes
access-control-expose-headers: Cache-Control, Content-Language, Content-Type, Expires, Last-Modified, Pragma, Etag, X-Timestamp, X-Trans-Id, X-Openstack-Request-Id, Content-Length, Accept-Ranges, Expires, Cache-Control

GET
H2 200 6si.min.js Show response
j.6sc.co/ 31 KB
10 KB 41ms
9ms Script
application/javascript 96.16.137.162
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://j.6sc.co/6si.min.js

Requested by

Host: blog.group-ib.com
URL: https://blog.group-ib.com/apt41-world-tour-2021

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

96.16.137.162 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a96-16-137-162.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

8e038b564510a45dc11799f74da367733f3db7f9c0a0434f1e90c44ec5168278

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 18 Aug 2022 20:15:40 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Thu, 05 May 2022 03:45:17 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "6273484d-7b02"
vary: Accept-Encoding
content-type: application/javascript
cache-control: private, no-cache, proxy-revalidate
accept-ranges: bytes
content-length: 9715
expires: Thu, 18 Aug 2022 20:15:40 GMT

GET
H2 200 optimize.js Show response
www.googleoptimize.com/ 108 KB
42 KB 46ms
23ms Script
application/javascript 2a00:1450:4001:827::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleoptimize.com/optimize.js?id=OPT-MG8BP56

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-PW7265

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

74ecb5ca63af9d404c113e606856f5d2a4abd3ed1869abf8d1e79e297151d2a1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Thu, 18 Aug 2022 20:15:40 GMT
content-encoding: br
server: Google Tag Manager
access-control-allow-headers: Cache-Control
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; includeSubDomains
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42409
x-xss-protection: 0
expires: Thu, 18 Aug 2022 20:15:40 GMT

GET
H2 200 uwt.js Show response
static.ads-twitter.com/ 56 KB
15 KB 38ms
8ms Script
application/javascript 199.232.136.157
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://static.ads-twitter.com/uwt.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-PW7265
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 199.232.136.157 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 1287fc0aa84dc8d13adf7173f344a0143511840be8c95fa6203396984a462d4b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Thu, 18 Aug 2022 20:15:40 GMT
content-encoding: gzip
last-modified: Thu, 28 Jul 2022 17:42:23 GMT
etag: "58faa0bb9a63121ea57a3106609bc291+gzip+gzip"
vary: Accept-Encoding,Host
x-tw-cdn: FT
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
cache-control: no-cache
x-cache: HIT, HIT
accept-ranges: bytes
content-type: application/javascript; charset=utf-8
content-length: 15291
x-served-by: cache-iad-kcgs7200032-IAD, cache-hhn11583-HHN

GET
H2 200 conversion_async.js Show response
www.googleadservices.com/pagead/ 40 KB
16 KB 85ms
47ms Script
text/javascript 172.217.16.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/conversion_async.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-PW7265

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.16.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s65-in-f2.1e100.net

Software

cafe /

Resource Hash

ffb169c682184887e61fbb92375424273436b8638ffb1b98779b24842a72cdbf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Thu, 18 Aug 2022 20:15:40 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15380
x-xss-protection: 0
server: cafe
etag: 14955335288317425560
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Thu, 18 Aug 2022 20:15:40 GMT

GET
H2 200 insight.min.js Show response
snap.licdn.com/li.lms-analytics/ 8 KB
3 KB 44ms
9ms Script
application/x-javascript 2a02:26f0:3500:16::215:149b
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://snap.licdn.com/li.lms-analytics/insight.min.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-PW7265
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:3500:16::215:149b Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: /
Resource Hash: b57839788686bf37d29f47bbe45ad8258085e3aebf54650ab389c0b515b977e1

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Thu, 18 Aug 2022 20:15:40 GMT
content-encoding: gzip
last-modified: Fri, 12 Aug 2022 20:23:36 GMT
x-cdn: AKAM
vary: Accept-Encoding
content-type: application/x-javascript;charset=utf-8
cache-control: max-age=35619
accept-ranges: bytes
content-length: 3063

GET
H2 200 fbevents.js Show response
connect.facebook.net/en_US/ 100 KB
27 KB 26ms
9ms Script
application/x-javascript 2a03:2880:f02d:12:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Host: blog.group-ib.com
URL: https://blog.group-ib.com/apt41-world-tour-2021

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f02d:12:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

4ff1b9b91db584b19d20b4d02af9ff7673add161ce3f9ceae9391b3a84fddab1

Security Headers

Name	Value
Content-Security-Policy	default-src facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com data: blob: 'self';script-src .fbcdn.net .facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

content-security-policy: default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
content-encoding: gzip
x-content-type-options: nosniff
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400,h3-29=":443"; ma=86400
content-length: 26515
x-xss-protection: 0
pragma: public
x-fb-debug: Ts352LxNJ0T4b/TxfkRU5U1YAUfZHMdOA4oygH3jBfyf9hX9Hmlzv2tNMAJjCP6Di+aXNf/f7GbKOQ1OR8WA4A==
x-fb-trip-id: 917726464
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: DENY
date: Thu, 18 Aug 2022 20:15:40 GMT
strict-transport-security: max-age=31536000; preload; includeSubDomains
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cache-control: public, max-age=1200
x-fb-rlafr: 0
priority: u=3,i
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 25755956.js Show response
js-eu1.hs-scripts.com/ 2 KB
982 B 477ms
430ms Script
application/javascript 172.65.208.22
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js-eu1.hs-scripts.com/25755956.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-PW7265
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.65.208.22 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 78ed2b14f8cdbac77dc2e69715cd594d123a577d5c03c7864fce6754488872ba

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Thu, 18 Aug 2022 20:15:41 GMT
content-encoding: br
cf-cache-status: EXPIRED
last-modified: Thu, 18 Aug 2022 20:13:28 GMT
server: cloudflare
x-hubspot-correlation-id: fc4c2c1c-cabf-422c-94ba-2690b3ac2397
x-trace: 2B385522793A596713D3F6CD25ECC93490959A147D000000000000000000
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript;charset=utf-8
access-control-allow-origin: https://blog.group-ib.com
access-control-max-age: 3600
cache-control: public, max-age=30
access-control-allow-credentials: true
cf-ray: 73cd52a788ca6946-FRA

GET
H2 200 blog.png
static.tildacdn.com/tild6335-6661-4338-b332-393633643763/-/resize/20x/ 809 B
949 B 12ms
11ms Image
image/png 2a03:90c0:41:2801::254
GCORE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.tildacdn.com/tild6335-6661-4338-b332-393633643763/-/resize/20x/blog.png
Requested by: Host: blog.group-ib.com
URL: https://blog.group-ib.com/apt41-world-tour-2021
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a03:90c0:41:2801::254 Frankfurt am Main, Germany, ASN199524 (GCORE, LU),
Reverse DNS
Software: nginx /
Resource Hash: 87ea279dbcd46fc39de9a4e1cfa5035a6a8d7869d04f9540aea6582c1caa77ba

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

x-id: m9-up-gc58, fr5-up-gc38
date: Thu, 18 Aug 2022 20:15:40 GMT
tserver: 10
server: nginx
x-cached-since: 2022-08-18T01:36:01+00:00, 2022-08-18T13:23:51+00:00
content-type: image/png
cache-control: public
cache: HIT, HIT
expires: Wed, 31 Aug 2022 23:59:59 GMT

GET
H2 200 Frame3.png
static.tildacdn.com/tild6661-3430-4734-b066-336264656663/-/resizeb/20x/ 887 B
958 B 12ms
11ms Image
image/png 2a03:90c0:41:2801::254
GCORE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.tildacdn.com/tild6661-3430-4734-b066-336264656663/-/resizeb/20x/Frame3.png
Requested by: Host: blog.group-ib.com
URL: https://blog.group-ib.com/apt41-world-tour-2021
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a03:90c0:41:2801::254 Frankfurt am Main, Germany, ASN199524 (GCORE, LU),
Reverse DNS
Software: nginx /
Resource Hash: 433d9e9d1898c6d0694a38adba4d7c5ecc5bdbf1cd896bc58df51dcaedbe343b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

x-id: m9-up-gc58, fr5-up-gc38
date: Thu, 18 Aug 2022 20:15:40 GMT
tserver: 9
server: nginx
x-cached-since: 2022-08-13T19:58:57+00:00, 2022-08-17T10:33:35+00:00
content-type: image/png
cache-control: public
cache: HIT, HIT
expires: Sun, 11 Sep 2022 23:59:59 GMT

GET
H2 200 DRP_2.png
static.tildacdn.com/tild3666-3963-4334-a566-623331336233/-/resizeb/20x/ 734 B
827 B 11ms
11ms Image
image/png 2a03:90c0:41:2801::254
GCORE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.tildacdn.com/tild3666-3963-4334-a566-623331336233/-/resizeb/20x/DRP_2.png
Requested by: Host: blog.group-ib.com
URL: https://blog.group-ib.com/apt41-world-tour-2021
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a03:90c0:41:2801::254 Frankfurt am Main, Germany, ASN199524 (GCORE, LU),
Reverse DNS
Software: nginx /
Resource Hash: 751baf89cb4a39284c97a0cb6f03c1d420097d590a1a9ed34a537fb40ad2e20b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

x-id: m9-up-gc66, fr5-up-gc38
date: Thu, 18 Aug 2022 20:15:40 GMT
tserver: 9
server: nginx
x-cached-since: 2022-08-13T19:58:57+00:00, 2022-08-17T10:33:35+00:00
content-type: image/png
cache-control: public
cache: HIT, HIT
expires: Mon, 12 Sep 2022 23:59:59 GMT

GET
H2 200 1_URP_Cover_1680x900.jpg
static.tildacdn.com/tild6462-3339-4363-b365-363162643263/-/resizeb/20x/ 340 B
390 B 12ms
12ms Image
image/jpeg 2a03:90c0:41:2801::254
GCORE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.tildacdn.com/tild6462-3339-4363-b365-363162643263/-/resizeb/20x/1_URP_Cover_1680x900.jpg
Requested by: Host: blog.group-ib.com
URL: https://blog.group-ib.com/apt41-world-tour-2021
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a03:90c0:41:2801::254 Frankfurt am Main, Germany, ASN199524 (GCORE, LU),
Reverse DNS
Software: nginx /
Resource Hash: 3c8478777e4714f32b67e7dff359ccd2ef2dc5ea0b3070573e408b70acb019e1

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

x-id: m9-up-gc53, fr5-up-gc38
date: Thu, 18 Aug 2022 20:15:40 GMT
tserver: 9
server: nginx
x-cached-since: 2022-08-15T17:00:06+00:00, 2022-08-17T10:33:35+00:00
content-type: image/jpeg
cache-control: public
cache: HIT, HIT
expires: Wed, 14 Sep 2022 23:59:59 GMT

GET
H2 200 telegram-cloud-docum.jpg
static.tildacdn.com/tild3633-3131-4931-b363-323635633836/-/resizeb/20x/ 665 B
759 B 12ms
12ms Image
image/png 2a03:90c0:41:2801::254
GCORE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.tildacdn.com/tild3633-3131-4931-b363-323635633836/-/resizeb/20x/telegram-cloud-docum.jpg
Requested by: Host: blog.group-ib.com
URL: https://blog.group-ib.com/apt41-world-tour-2021
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a03:90c0:41:2801::254 Frankfurt am Main, Germany, ASN199524 (GCORE, LU),
Reverse DNS
Software: nginx /
Resource Hash: dc0b82d13fbd68066a65e7241087c2b93e0c6f75bfd300f79d955ec31366ed8c

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

x-id: m9-up-gc53, fr5-up-gc38
date: Thu, 18 Aug 2022 20:15:40 GMT
tserver: 11
server: nginx
x-cached-since: 2022-08-15T17:00:06+00:00, 2022-08-17T10:33:35+00:00
content-type: image/png
cache-control: public
cache: HIT, HIT
expires: Wed, 14 Sep 2022 23:59:59 GMT

GET
DATA 200
OK truncated
/ 66 B
0 Image
image/webp

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: b71c20271d9c80d1a71aa0ab9935281c4fa8ac404533f1a0747d7fb03fc68e79

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

Content-Type: image/webp

GET
DATA 200
OK truncated
/ 280 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: aaa53b7966f71ea94c27d3ec4f5598a616723c1576bbc707698f8fc2db4b54b4

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 579 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 9d005c1939236926ac6f06522f0a1e32eeffda988f6272efb8b7a698be2dfb9d

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H2 200 adsct
t.co/i/ 43 B
337 B 131ms
110ms Image
image/gif 104.244.42.133
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://t.co/i/adsct?bci=3&eci=2&event_id=308241fd-84e3-4b57-8405-8d2dbdbd7945&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&p_id=Twitter&p_user_id=0&pl_id=a42071ea-e881-4ed3-9df0-3086a7b46015&tw_document_href=https%3A%2F%2Fblog.group-ib.com%2Fapt41-world-tour-2021&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=o6fwj&type=javascript&version=2.3.26

Requested by

Host: blog.group-ib.com
URL: https://blog.group-ib.com/apt41-world-tour-2021

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.244.42.133 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

x-response-time: 102
date: Thu, 18 Aug 2022 20:15:40 GMT
server: tsa_o
strict-transport-security: max-age=0
content-type: image/gif;charset=utf-8
cache-control: no-cache, no-store, max-age=0
x-connection-hash: 8c948d9c028f059d3bf5a48e6d88eb9d1dd799b41610de911a51aa2593d817b9
content-length: 43

GET
H2 200 adsct
analytics.twitter.com/i/ 43 B
354 B 138ms
111ms Image
image/gif 104.244.42.131
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://analytics.twitter.com/i/adsct?bci=3&eci=2&event_id=308241fd-84e3-4b57-8405-8d2dbdbd7945&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&p_id=Twitter&p_user_id=0&pl_id=a42071ea-e881-4ed3-9df0-3086a7b46015&tw_document_href=https%3A%2F%2Fblog.group-ib.com%2Fapt41-world-tour-2021&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=o6fwj&type=javascript&version=2.3.26

Requested by

Host: blog.group-ib.com
URL: https://blog.group-ib.com/apt41-world-tour-2021

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.244.42.131 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

x-response-time: 102
date: Thu, 18 Aug 2022 20:15:40 GMT
server: tsa_o
strict-transport-security: max-age=631138519
content-type: image/gif;charset=utf-8
cache-control: no-cache, no-store, max-age=0
x-connection-hash: a25fa81d0a78387d95869225e9e8cab1d47a8231504f9a587040aeb7204564de
content-length: 43

GET
H2 200 649324202964935 Show response
connect.facebook.net/signals/config/ 293 KB
84 KB 49ms
49ms Script
application/x-javascript 2a03:2880:f02d:12:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/649324202964935?v=2.9.75&r=stable

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f02d:12:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

d09070557638ea8826cf22c05d8799721b7ce96cda86aeb6e2d78b5eb839cddd

Security Headers

Name	Value
Content-Security-Policy	default-src facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com data: blob: 'self';script-src .fbcdn.net .facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

content-security-policy: default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
content-encoding: gzip
x-content-type-options: nosniff
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400,h3-29=":443"; ma=86400
x-xss-protection: 0
pragma: public
x-fb-debug: RS7kR19RFzgBnnqqpHN/Nylm+r9F6LfABZnt9C7nTicLCobEha4ozC2P/s7kw7b2C7fLdkE3mWy5LwZbPia1Xg==
x-fb-trip-id: 917726464
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: DENY
date: Thu, 18 Aug 2022 20:15:40 GMT
strict-transport-security: max-age=31536000; preload; includeSubDomains
x-content-cdn-origin-ts: 1660853740929
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cache-control: public, max-age=1200
x-fb-rlafr: 0
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 htmlMediaElementsTracker.min.js Show response
cdn.jsdelivr.net/npm/@analytics-debugger/html-media-elements@latest/dist/ 9 KB
4 KB 339ms
17ms Script
application/javascript 2606:4700::6810:5714
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/npm/@analytics-debugger/html-media-elements@latest/dist/htmlMediaElementsTracker.min.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-PW7265

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:5714 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e7bad5fe315f9cc904e9b2359ac8ae82bb77a049bc6aa6928a69bcc25ce292b6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Thu, 18 Aug 2022 20:15:41 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 34494
x-jsd-version: 0.0.2
x-cache: HIT
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; includeSubDomains; preload
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-served-by: cache-fra19121-FRA
timing-allow-origin: *
x-jsd-version-type: version
server: cloudflare
etag: W/"2552-QY5YDe2QAjm3BD4caHhXhH8nqww"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ZUYyhND5cwSH4cEcfTBp%2BJ9nRenb3GbXfewqD7vl3PJ2oSDIqkIlI9dYvacIQ0up7jM%2FbmrNCI5lVAqtCQnZCCEGHIqjx7zGvdXRfF9SY8dpjl19hK%2FXJ4QCxwLqmzNov2jdDYhKQVZM6LF%2BEWQ%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=604800, s-maxage=43200
cf-ray: 73cd52aa8e40bc01-FRA

GET
H2 200 image.png
thumb.tildacdn.com/tild3533-3165-4133-b434-366536616565/-/format/webp/ 109 KB
110 KB 18ms
9ms Image
image/webp 2a03:90c0:41:2801::254
GCORE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://thumb.tildacdn.com/tild3533-3165-4133-b434-366536616565/-/format/webp/image.png
Requested by: Host: blog.group-ib.com
URL: https://blog.group-ib.com/apt41-world-tour-2021
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a03:90c0:41:2801::254 Frankfurt am Main, Germany, ASN199524 (GCORE, LU),
Reverse DNS
Software: nginx /
Resource Hash: 9d1e135816577e8e584c17143d3c1f873512c07fbce8d23e5ba9672d0ba86669

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

x-id: m9-up-gc57, fr5-up-gc16
date: Thu, 18 Aug 2022 20:15:40 GMT
server: nginx
x-cached-since: 2022-08-18T07:54:30+00:00, 2022-08-18T11:08:43+00:00
content-type: image/webp
access-control-allow-origin: *
cache-control: max-age=2600000
cache: HIT, HIT

GET
H/1.1 200
OK getuidj Show response
secure.adnxs.com/ 11 B
697 B 32ms
12ms XHR
application/json 37.252.173.215
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.adnxs.com/getuidj

Requested by

Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.173.215 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

867.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net

Software

nginx/1.21.3 /

Resource Hash

31b45c462302ac175bfa43f9e5591491db780ca094f6ecdd2907f25ad578448d

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 18 Aug 2022 20:15:40 GMT
X-Proxy-Origin: 81.95.5.35; 81.95.5.35; 867.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
AN-X-Request-Uuid: 9190b893-43ed-4df9-a98b-2a03b170347d
Server: nginx/1.21.3
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://blog.group-ib.com
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json; charset=utf-8
Content-Length: 11
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 / Show response
c.6sc.co/ 7 B
203 B 50ms
32ms XHR
text/html 96.16.137.162
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://c.6sc.co/
Requested by: Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 96.16.137.162 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a96-16-137-162.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: fe04a9dc88d3f3be8d4f6bc63a9a80f45a4c6d8460e7551dab849457c091920a

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Thu, 18 Aug 2022 20:15:40 GMT
access-control-max-age: 86400
access-control-allow-methods: GET,POST
content-type: text/html
access-control-allow-origin: https://blog.group-ib.com
access-control-allow-credentials: true
access-control-allow-headers: *
content-length: 7

GET
H2 200 / Show response
ipv6.6sc.co/ 14 B
246 B 58ms
24ms XHR
text/html 2a02:26f0:3500:884::1c91
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://ipv6.6sc.co/
Requested by: Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:3500:884::1c91 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: /
Resource Hash: 0cbee5f32eeccb2fd9d710b78a7cdfc0293adb361f1675e3db04be4c01f3344c

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 18 Aug 2022 20:15:40 GMT
vary: Origin
content-type: text/html
access-control-allow-origin: https://blog.group-ib.com
cache-control: max-age=0, no-cache, no-store
6si-ipv6: 2a01:4a0:2b::8
server-timing: cdn-cache; desc=HIT, edge; dur=1
content-length: 14
expires: Thu, 18 Aug 2022 20:15:40 GMT

GET
H2

200

collect
px4.ads.linkedin.com/
Redirect Chain

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=4496601&time=1660853740897&url=https%3A%2F%2Fblog.group-ib.com%2Fapt41-world-tour-2021&tm=gtmv2
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D4496601%26time%3D1660853740897%26url%3Dhttps%253A%252F%252Fblog.group-ib.com%252F...
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=4496601&time=1660853740897&url=https%3A%2F%2Fblog.group-ib.com%2Fapt41-world-tour-2021&tm=gtmv2&liSync=true
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=4496601&time=1660853740897&url=https%3A%2F%2Fblog.group-ib.com%2Fapt41-world-tour-2021&tm=gtmv2&liSync=true&e_ipv6=AQLAOOzXmPlB_AAAAYKymObpaM_Oz8...

0
264 B

167ms
122ms

Image
application/javascript

13.107.42.14
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=4496601&time=1660853740897&url=https%3A%2F%2Fblog.group-ib.com%2Fapt41-world-tour-2021&tm=gtmv2&liSync=true&e_ipv6=AQLAOOzXmPlB_AAAAYKymObpaM_Oz8BAJSO6mL5UqTA005mEHjbfwB1zT7Nyna7E
Requested by: Host: blog.group-ib.com
URL: https://blog.group-ib.com/apt41-world-tour-2021
Protocol: H2
Server: 13.107.42.14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Thu, 18 Aug 2022 20:15:41 GMT
x-li-pop: afd-prod-lva1-x
x-msedge-ref: Ref A: 1C1775950A804167BEB4FE396AA70E02 Ref B: FRAEDGE1411 Ref C: 2022-08-18T20:15:41Z
linkedin-action: 1
x-cache: CONFIG_NOCACHE
content-type: application/javascript
x-li-proto: http/2
content-length: 0
x-li-uuid: AAXmiaVIPjPWHyEzbJLLsw==
x-li-fabric: prod-lva1

Redirect headers

date: Thu, 18 Aug 2022 20:15:40 GMT
x-li-pop: afd-prod-lva1-x
x-msedge-ref: Ref A: 7C91B5842D3944108BE30968BB622C19 Ref B: FRAEDGE1312 Ref C: 2022-08-18T20:15:41Z
linkedin-action: 1
x-cache: CONFIG_NOCACHE
x-li-fabric: prod-lva1
location: https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=4496601&time=1660853740897&url=https%3A%2F%2Fblog.group-ib.com%2Fapt41-world-tour-2021&tm=gtmv2&liSync=true&e_ipv6=AQLAOOzXmPlB_AAAAYKymObpaM_Oz8BAJSO6mL5UqTA005mEHjbfwB1zT7Nyna7E
x-li-proto: http/2
content-length: 0
x-li-uuid: AAXmiaVFvgMkRAkFz/Nydw==

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/10897073384/ 2 KB
2 KB 47ms
24ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/10897073384/?random=1660853740898&cv=9&fst=1660853740898&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2wg8h0&sendb=1&ig=1&frm=0&url=https%3A%2F%2Fblog.group-ib.com%2Fapt41-world-tour-2021&tiba=APT41%20World%20Tour%202021%20on%20a%20tight%20schedule&auid=2094880507.1660853741&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

87669ff0e42e4e94915bdbdc93e89a92bcdd0b3528295fe290a8d9d8f4800ed8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 18 Aug 2022 20:15:40 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1046
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 49 KB
20 KB 29ms
7ms Script
text/javascript 2a00:1450:4001:82a::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-PW7265

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

a1925038db769477ab74b4df34350c35688a795bb718727b0f4292a4a78a6210

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 13 Apr 2022 21:02:38 GMT
server: Golfe2
age: 4183
date: Thu, 18 Aug 2022 19:05:57 GMT
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 20006
expires: Thu, 18 Aug 2022 21:05:57 GMT

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
493 B 231ms
223ms Image
image/gif 96.16.137.162
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=e84d9c08a990af8592952e7ac9a983ad&svisitor=null&session=3b301658-601f-400b-84a2-b10bc6b7bf83&event=a_pageload&q=%7B%22pageLoadTime%22%3A%22Thu%2C%2018%20Aug%202022%2020%3A15%3A40%20GMT%22%7D&isIframe=false&m=%7B%22description%22%3A%22%204%20malicious%20campaigns%2C%2013%20confirmed%20victims%2C%20and%20a%20new%20wave%20of%20Cobalt%20Strike%20infections%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22APT41%20World%20Tour%202021%20on%20a%20tight%20schedule%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fblog.group-ib.com%2Fapt41-world-tour-2021&pageViewId=d6e625db-bd94-4840-8073-328b96b51206&an_uid=0

Requested by

Host: blog.group-ib.com
URL: https://blog.group-ib.com/apt41-world-tour-2021

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

96.16.137.162 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a96-16-137-162.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Thu, 18 Aug 2022 20:15:41 GMT
x-content-type-options: nosniff
content-length: 43
pragma: no-cache
last-modified: Tue, 05 Oct 2021 22:17:52 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "615ccf10-2b"
access-control-max-age: 86400
access-control-allow-methods: GET,POST
content-type: image/gif
access-control-allow-origin
cache-control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: *
expires: Wed, 19 Apr 2000 11:43:00 GMT

POST
H2 200 collect Show response
stats.g.doubleclick.net/j/ 4 B
443 B 61ms
21ms XHR
text/plain 2a00:1450:400c:c08::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j96&tid=UA-25492706-2&cid=1318368146.1660853741&jid=573062854&gjid=1427554614&_gid=550767942.1660853741&_u=YGBAgEABQAAAAE~&z=882646407

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400c:c08::9b Brussels, Belgium, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://blog.group-ib.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
date: Thu, 18 Aug 2022 20:15:40 GMT
content-type: text/plain
access-control-allow-origin: https://blog.group-ib.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 collect
www.google-analytics.com/ 35 B
55 B 23ms
7ms Image
image/gif 2a00:1450:4001:82a::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j96&a=1813996804&t=pageview&_s=1&dl=https%3A%2F%2Fblog.group-ib.com%2Fapt41-world-tour-2021&ul=en-us&de=UTF-8&dt=APT41%20World%20Tour%202021%20on%20a%20tight%20schedule&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YGBAgEABQ~&jid=573062854&gjid=1427554614&cid=1318368146.1660853741&tid=UA-25492706-2&_gid=550767942.1660853741&gtm=2wg8h0PW7265&cd1=1318368146.1660853741&z=1381372702

Requested by

Host: blog.group-ib.com
URL: https://blog.group-ib.com/apt41-world-tour-2021

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 18 Aug 2022 19:14:23 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 3677
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.facebook.com/tr/ 44 B
297 B 26ms
9ms Image
image/gif 2a03:2880:f12d:83:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=649324202964935&ev=PageView&dl=https%3A%2F%2Fblog.group-ib.com%2Fapt41-world-tour-2021&rl=&if=false&ts=1660853740961&sw=1600&sh=1200&v=2.9.75&r=stable&ec=0&o=30&fbp=fb.1.1660853740960.706480526&it=1660853740883&coo=false&rqm=GET

Requested by

Host: blog.group-ib.com
URL: https://blog.group-ib.com/apt41-world-tour-2021

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f12d:83:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Thu, 18 Aug 2022 20:15:40 GMT
last-modified: Fri, 21 Dec 2012 00:00:01 GMT
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
cache-control: no-cache, must-revalidate, max-age=0
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 44
expires: Thu, 18 Aug 2022 20:15:40 GMT

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
492 B 210ms
210ms Image
image/gif 96.16.137.162
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=e84d9c08a990af8592952e7ac9a983ad&svisitor=null&session=3b301658-601f-400b-84a2-b10bc6b7bf83&event=ipv6&q=%7B%22address%22%3A%222a01%3A4a0%3A2b%3A%3A8%22%7D&isIframe=false&m=%7B%22description%22%3A%22%204%20malicious%20campaigns%2C%2013%20confirmed%20victims%2C%20and%20a%20new%20wave%20of%20Cobalt%20Strike%20infections%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22APT41%20World%20Tour%202021%20on%20a%20tight%20schedule%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fblog.group-ib.com%2Fapt41-world-tour-2021&pageViewId=d6e625db-bd94-4840-8073-328b96b51206&an_uid=0

Requested by

Host: blog.group-ib.com
URL: https://blog.group-ib.com/apt41-world-tour-2021

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

96.16.137.162 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a96-16-137-162.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Thu, 18 Aug 2022 20:15:41 GMT
x-content-type-options: nosniff
content-length: 43
pragma: no-cache
last-modified: Fri, 21 Feb 2020 18:57:20 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "5e502810-2b"
access-control-max-age: 86400
access-control-allow-methods: GET,POST
content-type: image/gif
access-control-allow-origin
cache-control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: *
expires: Wed, 19 Apr 2000 11:43:00 GMT

GET
H2 200 /
www.google.com/pagead/1p-user-list/10897073384/ 42 B
548 B 54ms
30ms Image
image/gif 2a00:1450:4001:801::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/10897073384/?random=1660853740898&cv=9&fst=1660852800000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2wg8h0&sendb=1&frm=0&url=https%3A%2F%2Fblog.group-ib.com%2Fapt41-world-tour-2021&tiba=APT41%20World%20Tour%202021%20on%20a%20tight%20schedule&async=1&fmt=3&is_vtc=1&random=2029734788&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Requested by

Host: blog.group-ib.com
URL: https://blog.group-ib.com/apt41-world-tour-2021

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:801::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 18 Aug 2022 20:15:41 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.de/pagead/1p-user-list/10897073384/ 42 B
548 B 47ms
23ms Image
image/gif 2a00:1450:4001:803::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/10897073384/?random=1660853740898&cv=9&fst=1660852800000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2wg8h0&sendb=1&frm=0&url=https%3A%2F%2Fblog.group-ib.com%2Fapt41-world-tour-2021&tiba=APT41%20World%20Tour%202021%20on%20a%20tight%20schedule&async=1&fmt=3&is_vtc=1&random=2029734788&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y

Requested by

Host: blog.group-ib.com
URL: https://blog.group-ib.com/apt41-world-tour-2021

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:803::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 18 Aug 2022 20:15:41 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ga-audiences
www.google.com/ads/ 42 B
63 B 78ms
48ms Image
image/gif 2a00:1450:4001:801::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j96&tid=UA-25492706-2&cid=1318368146.1660853741&jid=573062854&_u=YGBAgEABQAAAAE~&z=585102726

Requested by

Host: blog.group-ib.com
URL: https://blog.group-ib.com/apt41-world-tour-2021

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 18 Aug 2022 20:15:41 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ga-audiences
www.google.de/ads/ 42 B
63 B 74ms
45ms Image
image/gif 2a00:1450:4001:803::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j96&tid=UA-25492706-2&cid=1318368146.1660853741&jid=573062854&_u=YGBAgEABQAAAAE~&z=585102726

Requested by

Host: blog.group-ib.com
URL: https://blog.group-ib.com/apt41-world-tour-2021

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 18 Aug 2022 20:15:41 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 fb.js Show response
js-eu1.hsadspixel.net/ 5 KB
3 KB 67ms
21ms Script
application/javascript 172.65.219.229
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js-eu1.hsadspixel.net/fb.js
Requested by: Host: js-eu1.hs-scripts.com
URL: https://js-eu1.hs-scripts.com/25755956.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.65.219.229 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ea2ffede896a8727d9691452b1314e64ac7d2932896e89920599392ba33dd6f1

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Thu, 18 Aug 2022 20:15:41 GMT
via: 1.1 d357d5d597708d2b41e0fea397aa2620.cloudfront.net (CloudFront)
cf-cache-status: HIT
age: 549
x-amz-server-side-encryption: AES256
content-security-policy-report-only: frame-ancestors 'self'; report-uri https://exceptions.hubspot.com/csp/report?resource=adsscriptloaderstatic/static-1.290/bundles/pixels-release.js&cfRay=73cd45433b059b2d-FRA
x-cache: Hit from cloudfront
cache-tag: staticjsapp-AdsScriptLoaderCloudflare-web-prod,staticjsapp-prod
content-type: application/javascript; charset=utf-8
x-amz-replication-status: COMPLETED
content-encoding: br
last-modified: Wed, 10 Aug 2022 01:59:54 UTC
server: cloudflare
etag: W/"4f0b2f5f5adcb58be2f46e95ab35e280"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
x-amz-version-id: .CBGOpqVu8zaE1sKV5DacDTNZHwT9f6j
cache-control: max-age=600
x-hs-cache-status: EXPIRED
x-amz-cf-pop: FRA6-C1
cf-ray: 73cd52aaff8f5b6e-FRA
x-amz-cf-id: K0-8UF6GbrhozqM9FqphIObSkH_hVhOrd2m3YoB38E9PMuiAnkNJcw==
x-hs-target-asset: adsscriptloaderstatic/static-1.290/bundles/pixels-release.js

GET
H2 200 25755956.js Show response
js-eu1.hs-banner.com/ 60 KB
16 KB 107ms
59ms Script
text/javascript 172.65.202.201
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js-eu1.hs-banner.com/25755956.js
Requested by: Host: js-eu1.hs-scripts.com
URL: https://js-eu1.hs-scripts.com/25755956.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.65.202.201 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e8cee6c7ab45067a20152e710e8b3f258571a24421e2451c8fa30ff13413d7dd

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Thu, 18 Aug 2022 20:15:41 GMT
content-encoding: br
cf-cache-status: REVALIDATED
x-amz-request-id: 3HKDPHHB6541EHBV
x-amz-server-side-encryption: AES256
content-type: text/javascript; charset=UTF-8
access-control-max-age: 604800
x-amz-id-2: aoNLg9+wDw8ft66oGEY67f7W78/eXylilkLAOfwu8ht5bda2eooygBMzs14XUi/E+eLoaEXHUQc=
timing-allow-origin: *
last-modified: Wed, 17 Aug 2022 19:42:31 GMT
server: cloudflare
etag: W/"6e21a169a7a284a54942a195ae80d5ff"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD
x-amz-version-id: Z7jHBtr5aVi1Fn53gH5h7TFWvZE.l4vO
access-control-allow-origin: https://www.group-ib.com
access-control-expose-headers: x-last-modified-timestamp, X-HubSpot-NotFound, X-HS-User-Request, Link, Server-Timing
cache-control: max-age=300, public
access-control-allow-credentials: true
cf-ray: 73cd52aaff99901f-FRA
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Accept-Charset, Accept-Encoding, X-Override-Internal-Permissions, X-Properties-Source, X-Properties-SourceId, X-Properties-Flag, X-Hubspot-User-Id, X-Hubspot-Trace, X-Hubspot-Callee, X-Hubspot-Offset, X-Hubspot-No-Trace, X-HubSpot-Static-App-Info, X-HubSpot-Messages-Uri, X-HubSpot-Request-Source, X-HubSpot-Request-Reason, Subscription-Billing-Auth-Token, X-App-CSRF, X-Tools-CSRF, Online-Payment-Signing-UUID, X-Source, X-SourceId, X-Origin-UserId, X-Biden-Request-Source, X-HubSpot-CSRF-hubspotapi, X-Force-Cookie-Refresh, X-Force-Cookie-Refresh-No-Cache, X-HS-User-Request, X-Application-Id, X-HS-Referer, X-HubSpot-Correlation-Id
expires: Thu, 18 Aug 2022 20:20:41 GMT

GET
H2 200 25755956.js Show response
js-eu1.hs-analytics.net/analytics/1660853700000/ 62 KB
20 KB 105ms
58ms Script
text/javascript 172.65.238.60
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js-eu1.hs-analytics.net/analytics/1660853700000/25755956.js
Requested by: Host: js-eu1.hs-scripts.com
URL: https://js-eu1.hs-scripts.com/25755956.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.65.238.60 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: cd0bdbc091563d8f43b647ec9ccc59301c1ee1376153e3bc077769e520dd0c16

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Thu, 18 Aug 2022 20:15:41 GMT
content-encoding: br
cf-cache-status: MISS
x-amz-request-id: H5C9VPR9PMP28FCC
x-amz-server-side-encryption: AES256
x-amz-id-2: SYs+rBUbFEDzgpPjsHyKmf8idi5qNehmwIALDxB3WBn2hXrSPVV41Ez3G7R70Fo24nTdmE30v6w=
last-modified: Tue, 26 Jul 2022 15:29:58 GMT
server: cloudflare
etag: W/"f4c9d65591eb1a23d7d933ac2ab74c90"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/javascript
cache-control: max-age=300, public
access-control-allow-credentials: false
cf-ray: 73cd52aaff80bb74-FRA
expires: Thu, 18 Aug 2022 20:20:41 GMT

GET
H2 200 collectedforms.js Show response
js-eu1.hscollectedforms.net/ 72 KB
25 KB 67ms
20ms Script
application/javascript 172.65.192.122
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js-eu1.hscollectedforms.net/collectedforms.js
Requested by: Host: js-eu1.hs-scripts.com
URL: https://js-eu1.hs-scripts.com/25755956.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.65.192.122 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5e0a88a680075dec852a87e3caa62bbb27bc77affb238de1778e1a8dca88e088

Request headers

Referer: https://blog.group-ib.com/
Origin: https://blog.group-ib.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Thu, 18 Aug 2022 20:15:41 GMT
via: 1.1 1277de71b2472d19ca0bfc510db9ec54.cloudfront.net (CloudFront)
cf-cache-status: HIT
age: 30181
x-amz-server-side-encryption: AES256
content-security-policy-report-only: frame-ancestors 'self'; report-uri https://exceptions.hubspot.com/csp/report?resource=collected-forms-embed-js/static-1.285/bundles/project.js&cfRay=73ca71d29dea9b49-FRA
x-cache: Hit from cloudfront
cache-tag: staticjsapp-collected-forms-embed-js-web-prod,staticjsapp-prod
access-control-max-age: 3000
x-amz-replication-status: COMPLETED
content-encoding: br
cf-ray: 73cd52aaf8136939-FRA
last-modified: Mon, 18 Jul 2022 02:17:32 UTC
server: cloudflare
etag: W/"877e5f54a66a69786dec54038d0864c4"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding,Origin,Access-Control-Request-Headers,Access-Control-Request-Method
access-control-allow-methods: GET
x-amz-version-id: gdKWpz_yvObw8s97wY_QgOhrdmJzIElp
access-control-allow-origin: *
cache-control: s-maxage=86400, max-age=0
x-hs-cache-status: EXPIRED
x-amz-cf-pop: FRA6-C1
content-type: application/javascript; charset=utf-8
x-amz-cf-id: XVHdErlhj6QrTx7MZbkPrd5qIzkbGgg21r9vFJKhsaL5ZQACKsTpKA==
x-hs-target-asset: collected-forms-embed-js/static-1.285/bundles/project.js

GET
H2 200 Vector_1.svg
static.tildacdn.com/tild6464-3039-4230-b436-316464656631/ 2 KB
1 KB 12ms
11ms Image
image/svg+xml 2a03:90c0:41:2801::254
GCORE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.tildacdn.com/tild6464-3039-4230-b436-316464656631/Vector_1.svg
Requested by: Host: blog.group-ib.com
URL: https://blog.group-ib.com/apt41-world-tour-2021
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a03:90c0:41:2801::254 Frankfurt am Main, Germany, ASN199524 (GCORE, LU),
Reverse DNS
Software: nginx /
Resource Hash: a69d487f4aad79ff054dea601829dad1e1afc33ed83e6a24dc07c6d16552c16f

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

x-id: m9-up-gc57, fr5-up-gc38
date: Thu, 18 Aug 2022 20:15:41 GMT
content-encoding: br
age: 0
x-cached-since: 2022-08-16T11:15:56+00:00, 2022-08-17T10:33:37+00:00
x-trans-id: 16bd0ef74ccb5673
tserver: 10
last-modified: Thu, 02 Dec 2021 21:58:15 GMT
server: nginx
etag: W/"3bd0da92e08d20c93a26e4498db2a163"
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
x-timestamp: 1638482294.74620
cache-control: public
cache: HIT, HIT
access-control-expose-headers: Cache-Control, Content-Language, Content-Type, Expires, Last-Modified, Pragma, Etag, X-Timestamp, X-Trans-Id, X-Openstack-Request-Id, Content-Length, Accept-Ranges, Expires, Cache-Control

GET
H2 200 1.png
thumb.tildacdn.com/tild6163-6536-4637-b636-616533643962/-/format/webp/ 196 B
331 B 11ms
10ms Image
image/png 2a03:90c0:41:2801::254
GCORE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://thumb.tildacdn.com/tild6163-6536-4637-b636-616533643962/-/format/webp/1.png
Requested by: Host: blog.group-ib.com
URL: https://blog.group-ib.com/apt41-world-tour-2021
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a03:90c0:41:2801::254 Frankfurt am Main, Germany, ASN199524 (GCORE, LU),
Reverse DNS
Software: nginx /
Resource Hash: bb9a3150006283c76a2f38e1a0e6dfaf3bbfced1e46755421911769bf1381554

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

x-id: m9p-up-gc10, fr5-up-gc33
date: Thu, 18 Aug 2022 20:15:41 GMT
server: nginx
x-cached-since: 2022-07-15T14:31:54+00:00, 2022-08-04T10:34:16+00:00
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=2600000
cache: HIT, HIT

GET
H2 200 Vector_1.svg
static.tildacdn.com/tild6135-3635-4134-b064-363630393233/ 2 KB
1 KB 12ms
11ms Image
image/svg+xml 2a03:90c0:41:2801::254
GCORE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.tildacdn.com/tild6135-3635-4134-b064-363630393233/Vector_1.svg
Requested by: Host: blog.group-ib.com
URL: https://blog.group-ib.com/apt41-world-tour-2021
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a03:90c0:41:2801::254 Frankfurt am Main, Germany, ASN199524 (GCORE, LU),
Reverse DNS
Software: nginx /
Resource Hash: a69d487f4aad79ff054dea601829dad1e1afc33ed83e6a24dc07c6d16552c16f

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

x-id: m9-up-gc52, fr5-up-gc38
date: Thu, 18 Aug 2022 20:15:41 GMT
content-encoding: br
age: 0
x-cached-since: 2022-07-27T21:10:57+00:00, 2022-08-17T10:33:37+00:00
x-trans-id: 16bd0efcedc07eea
tserver: 10
last-modified: Thu, 02 Dec 2021 21:58:39 GMT
server: nginx
etag: W/"3bd0da92e08d20c93a26e4498db2a163"
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
x-timestamp: 1638482318.95914
cache-control: public
cache: HIT, HIT
access-control-expose-headers: Cache-Control, Content-Language, Content-Type, Expires, Last-Modified, Pragma, Etag, X-Timestamp, X-Trans-Id, X-Openstack-Request-Id, Content-Length, Accept-Ranges, Expires, Cache-Control

GET
H2 200 Facebook.png
thumb.tildacdn.com/tild6630-6532-4133-b436-623962626561/-/resize/80x/-/format/webp/ 1 KB
1 KB 12ms
12ms Image
image/webp 2a03:90c0:41:2801::254
GCORE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://thumb.tildacdn.com/tild6630-6532-4133-b436-623962626561/-/resize/80x/-/format/webp/Facebook.png
Requested by: Host: blog.group-ib.com
URL: https://blog.group-ib.com/apt41-world-tour-2021
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a03:90c0:41:2801::254 Frankfurt am Main, Germany, ASN199524 (GCORE, LU),
Reverse DNS
Software: nginx /
Resource Hash: 3a08b1b134620f206c1aba73db081c22a34bda8b6759c99ff42e169e097ad233

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

x-id: m9-up-gc66, fr5-up-gc37
date: Thu, 18 Aug 2022 20:15:41 GMT
server: nginx
x-cached-since: 2022-08-14T08:35:58+00:00, 2022-08-15T22:54:03+00:00
content-type: image/webp
access-control-allow-origin: *
cache-control: max-age=2600000
cache: HIT, HIT

GET
H2 200 json Show response
forms-eu1.hubspot.com/collected-forms/v1/config/ 116 B
1 KB 97ms
47ms XHR
application/json 172.65.193.34
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://forms-eu1.hubspot.com/collected-forms/v1/config/json?portalId=25755956&utk=

Requested by

Host: js-eu1.hscollectedforms.net
URL: https://js-eu1.hscollectedforms.net/collectedforms.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.65.193.34 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

43f22362329b9705cf8629061fb5b1d1a38f1cc2bc9fd46728f73e5cd9eb77cf

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Accept: application/json, text/plain, */*
Referer: https://blog.group-ib.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Thu, 18 Aug 2022 20:15:41 GMT
content-encoding: br
vary: Accept-Encoding
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-hubspot-correlation-id: 69d7e795-59d0-4487-91ce-012968a267d4
access-control-allow-methods: GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD
strict-transport-security: max-age=31536000; includeSubDomains; preload
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
access-control-max-age: 180
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Jq8uA%2BHdJO1GPPC8%2FcsqX7sohM5ZkL7NKxRLTxaZdxobpVbdIO27nmvg9JZufhdaSLxyV4iRDVgNbagOGqxTgWBoUZdLc9cZOFeph8GYgkaDO2ydsfl3PpfqgwXAcKOHmA8iTXPmNg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/json;charset=utf-8
access-control-allow-origin: https://blog.group-ib.com
x-robots-tag: none
access-control-allow-credentials: false
cf-ray: 73cd52ab9a2dbb4d-FRA
access-control-allow-headers: *

GET
H2 200 json Show response
api-eu1.hubapi.com/hs-script-loader-public/v1/config/pixel/ 202 B
958 B 62ms
29ms XHR
application/json 2606:4700::6811:c8cc
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://api-eu1.hubapi.com/hs-script-loader-public/v1/config/pixel/json?portalId=25755956

Requested by

Host: js-eu1.hsadspixel.net
URL: https://js-eu1.hsadspixel.net/fb.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:c8cc , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2e5858ac3b77c03c946d9f6d58fab9185a5f90d993941b7bf97f9ce25014ce74

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Thu, 18 Aug 2022 20:15:41 GMT
content-encoding: br
vary: Accept-Encoding
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-hubspot-correlation-id: e0b1f64f-c25b-43df-9aa8-c2a26d9de8d5
access-control-allow-methods: GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD
strict-transport-security: max-age=31536000; includeSubDomains; preload
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
server: cloudflare
x-trace: 2BF376EAE042599AE999D924B86DE51C723DD3B2EF000000000000000000
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
access-control-max-age: 180
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Vll5gzltYFXdYmvPx68Hg9%2FOyTuIEHKYMKUX83fF1sqB911tp%2BEJifR5GzmHandQaFazAkg6mxFOAR1ZsXw5HhWjC1M5ZqEXmPA37sEEhKqIb96bP87GTmQbWVxUB3yEf%2BAzEdN7c1ywfrGclGNHAA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/json;charset=utf-8
access-control-allow-origin: https://blog.group-ib.com
access-control-allow-credentials: false
cf-ray: 73cd52ab9d9f9a21-FRA
access-control-allow-headers: *

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 168 KB
61 KB 39ms
23ms Script
application/javascript 2a00:1450:4001:827::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-10882981508

Requested by

Host: js-eu1.hsadspixel.net
URL: https://js-eu1.hsadspixel.net/fb.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

6411c23442e699c4f70a32f2f01d76b62de6e30e2edae93a02a1b99db3b2ea9f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Thu, 18 Aug 2022 20:15:41 GMT
content-encoding: br
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 62421
x-xss-protection: 0
last-modified: Thu, 18 Aug 2022 19:13:42 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Thu, 18 Aug 2022 20:15:41 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 168 KB
61 KB 42ms
27ms Script
application/javascript 2a00:1450:4001:827::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-10882981508&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-PW7265

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

0407b0f0d86dd90cd2f57c02bfa35c425f69a59333ef1e4d25c0cb3dcbb6e65a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Thu, 18 Aug 2022 20:15:41 GMT
content-encoding: br
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 62431
x-xss-protection: 0
last-modified: Thu, 18 Aug 2022 19:13:42 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Thu, 18 Aug 2022 20:15:41 GMT

GET
H2 200 counters.gif
forms-eu1.hsforms.com/embed/v3/ 35 B
517 B 78ms
28ms Image
image/gif 172.65.232.43
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://forms-eu1.hsforms.com/embed/v3/counters.gif?key=collected-forms-embed-js-form-bind&count=1

Requested by

Host: blog.group-ib.com
URL: https://blog.group-ib.com/apt41-world-tour-2021

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.65.232.43 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Thu, 18 Aug 2022 20:15:41 GMT
vary: Accept-Encoding
cf-cache-status: DYNAMIC
x-hubspot-correlation-id: 9a150808-2184-4f9f-8a10-264dc93bce98
cf-ray: 73cd52aca8389168-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 35
server: cloudflare
x-trace: 2B01E1AC35CE25815557B75A89A926DBD7EB37F1A1000000000000000000
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: image/gif
access-control-expose-headers: X-Origin-Hublet
cache-control: max-age=0, no-cache, no-store
access-control-allow-credentials: false
x-robots-tag: none

GET
H3 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/10882981508/ 2 KB
1 KB 44ms
28ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/10882981508/?random=1660853741492&cv=9&fst=1660853741492&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa8h0&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fblog.group-ib.com%2Fapt41-world-tour-2021&tiba=APT41%20World%20Tour%202021%20on%20a%20tight%20schedule&auid=2094880507.1660853741&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d8b1418235a32520bbb289a8dfb9121f22af0fe206e3b7c524172ee732cced94

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 18 Aug 2022 20:15:41 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1067
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/10882981508/ 2 KB
1 KB 73ms
58ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/10882981508/?random=1660853741493&cv=9&fst=1660853741493&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa8h0&sendb=1&ig=1&data=event%3Dform_submit&frm=0&url=https%3A%2F%2Fblog.group-ib.com%2Fapt41-world-tour-2021&tiba=APT41%20World%20Tour%202021%20on%20a%20tight%20schedule&auid=2094880507.1660853741&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

68c7a56a35791b1e76171e56a5ec5ed4db13ef988384d3dcd7c821492a254bad

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 18 Aug 2022 20:15:41 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1069
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 200 / Show response
www.facebook.com/tr/ Frame 4BCA 0
18 B 18ms
7ms Document
text/plain 2a03:2880:f12d:83:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/tr/

Requested by

Host: blog.group-ib.com
URL: https://blog.group-ib.com/apt41-world-tour-2021

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f12d:83:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Content-Type: application/x-www-form-urlencoded
Origin: https://blog.group-ib.com
Referer: https://blog.group-ib.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-origin: https://blog.group-ib.com
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 0
content-type: text/plain
cross-origin-resource-policy: cross-origin
date: Thu, 18 Aug 2022 20:15:41 GMT
priority: u=0
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains

GET
H3 200 /
www.google.com/pagead/1p-user-list/10882981508/ 42 B
64 B 21ms
20ms Image
image/gif 2a00:1450:4001:801::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/10882981508/?random=1660853741492&cv=9&fst=1660852800000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa8h0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fblog.group-ib.com%2Fapt41-world-tour-2021&tiba=APT41%20World%20Tour%202021%20on%20a%20tight%20schedule&async=1&fmt=3&is_vtc=1&random=3845638771&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Requested by

Host: blog.group-ib.com
URL: https://blog.group-ib.com/apt41-world-tour-2021

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 18 Aug 2022 20:15:41 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 /
www.google.de/pagead/1p-user-list/10882981508/ 42 B
64 B 19ms
18ms Image
image/gif 2a00:1450:4001:803::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/10882981508/?random=1660853741492&cv=9&fst=1660852800000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa8h0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fblog.group-ib.com%2Fapt41-world-tour-2021&tiba=APT41%20World%20Tour%202021%20on%20a%20tight%20schedule&async=1&fmt=3&is_vtc=1&random=3845638771&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y

Requested by

Host: blog.group-ib.com
URL: https://blog.group-ib.com/apt41-world-tour-2021

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 18 Aug 2022 20:15:41 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 /
www.google.com/pagead/1p-user-list/10882981508/ 42 B
64 B 21ms
21ms Image
image/gif 2a00:1450:4001:801::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/10882981508/?random=1660853741493&cv=9&fst=1660852800000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa8h0&sendb=1&data=event%3Dform_submit&frm=0&url=https%3A%2F%2Fblog.group-ib.com%2Fapt41-world-tour-2021&tiba=APT41%20World%20Tour%202021%20on%20a%20tight%20schedule&async=1&fmt=3&is_vtc=1&random=2665054964&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Requested by

Host: blog.group-ib.com
URL: https://blog.group-ib.com/apt41-world-tour-2021

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 18 Aug 2022 20:15:41 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 /
www.google.de/pagead/1p-user-list/10882981508/ 42 B
64 B 20ms
20ms Image
image/gif 2a00:1450:4001:803::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/10882981508/?random=1660853741493&cv=9&fst=1660852800000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa8h0&sendb=1&data=event%3Dform_submit&frm=0&url=https%3A%2F%2Fblog.group-ib.com%2Fapt41-world-tour-2021&tiba=APT41%20World%20Tour%202021%20on%20a%20tight%20schedule&async=1&fmt=3&is_vtc=1&random=2665054964&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y

Requested by

Host: blog.group-ib.com
URL: https://blog.group-ib.com/apt41-world-tour-2021

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 18 Aug 2022 20:15:41 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 709834390277869 Show response
connect.facebook.net/signals/config/ 293 KB
84 KB 54ms
54ms Script
application/x-javascript 2a03:2880:f02d:12:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/709834390277869?v=2.9.75&r=stable

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f02d:12:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

facbd0d3e7d3b2c8f228b877f72e07ea6bd63f232de0936ff6e567ff7bf92e21

Security Headers

Name	Value
Content-Security-Policy	default-src facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com data: blob: 'self';script-src .fbcdn.net .facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

content-security-policy: default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
content-encoding: gzip
x-content-type-options: nosniff
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400,h3-29=":443"; ma=86400
x-xss-protection: 0
pragma: public
x-fb-debug: z14haSmtYR8mZ45bCAfo+F66KxBstAaiPJTKn82MVLDJ1oLCksq2L14Qh7I94ahmyGMQAv2woCnzUQRVgK2qvg==
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: DENY
date: Thu, 18 Aug 2022 20:15:41 GMT
strict-transport-security: max-age=31536000; preload; includeSubDomains
x-content-cdn-origin-ts: 1660853741645
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cache-control: public, max-age=1200
x-fb-rlafr: 0
priority: u=3,i
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 __ptq.gif
track-eu1.hubspot.com/ 45 B
989 B 105ms
45ms Image
image/gif 172.65.240.166
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://track-eu1.hubspot.com/__ptq.gif?k=1&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=en-us&bfp=1091019263&v=1.1&a=25755956&rcu=https%3A%2F%2Fblog.group-ib.com%2Fapt41-world-tour-2021&pu=https%3A%2F%2Fblog.group-ib.com%2Fapt41-world-tour-2021&t=APT41+World+Tour+2021+on+a+tight+schedule&cts=1660853741598&vi=6fadec195ba1092d75ef65ec4b9bb8a2&nc=true&u=84897990.6fadec195ba1092d75ef65ec4b9bb8a2.1660853741595.1660853741595.1660853741595.1&b=84897990.1.1660853741595&cc=15

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.65.240.166 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Thu, 18 Aug 2022 20:15:41 GMT
vary: Accept-Encoding
cf-cache-status: MISS
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-hubspot-correlation-id: e114cd7a-b1aa-4b9b-ad2d-4dd600bab187
cf-ray: 73cd52ad691a9966-FRA
p3p: CP="NOI CUR ADM OUR NOR STA NID"
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 45
last-modified: Thu, 18 Aug 2022 20:15:41 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=zVETKc3Q7WQqv%2Bk8%2FEvSYlws5Uu3qWOgIVjsH1el%2Ff7O46bezNPvjbnaJY9iVEfugSmWSQi77fR%2BUYyaaDEQl4w78%2FOJiMqC6rNfAS7F7JsxO5sLggNJKOguT8cWFeyjUD%2FqeijroA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/gif
cache-control: no-cache, no-store, no-transform
access-control-allow-credentials: false
accept-ranges: bytes
x-robots-tag: none

GET
H3 200 /
www.facebook.com/tr/ 44 B
88 B 8ms
8ms Image
image/gif 2a03:2880:f12d:83:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=709834390277869&ev=PageView&dl=https%3A%2F%2Fblog.group-ib.com%2Fapt41-world-tour-2021&rl=&if=false&ts=1660853741691&sw=1600&sh=1200&ud[external_id]=6fadec195ba1092d75ef65ec4b9bb8a2&v=2.9.75&r=stable&ec=0&o=30&fbp=fb.1.1660853740960.706480526&it=1660853740883&coo=false&rqm=GET

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f12d:83:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Thu, 18 Aug 2022 20:15:41 GMT
last-modified: Fri, 21 Dec 2012 00:00:01 GMT
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
cache-control: no-cache, must-revalidate, max-age=0
cross-origin-resource-policy: cross-origin
content-length: 44
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
priority: u=3,i
expires: Thu, 18 Aug 2022 20:15:41 GMT

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
492 B 333ms
332ms Image
image/gif 96.16.137.162
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=e84d9c08a990af8592952e7ac9a983ad&svisitor=null&session=3b301658-601f-400b-84a2-b10bc6b7bf83&event=active_time_track&q=%7B%22currentTime%22%3A%22Thu%2C%2018%20Aug%202022%2020%3A15%3A41%20GMT%22%2C%22lastTrackTime%22%3A%22Thu%2C%2018%20Aug%202022%2020%3A15%3A40%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%221001%22%7D&isIframe=false&m=%7B%22description%22%3A%22%204%20malicious%20campaigns%2C%2013%20confirmed%20victims%2C%20and%20a%20new%20wave%20of%20Cobalt%20Strike%20infections%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22APT41%20World%20Tour%202021%20on%20a%20tight%20schedule%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fblog.group-ib.com%2Fapt41-world-tour-2021&pageViewId=d6e625db-bd94-4840-8073-328b96b51206&an_uid=0

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

96.16.137.162 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a96-16-137-162.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Thu, 18 Aug 2022 20:15:42 GMT
x-content-type-options: nosniff
content-length: 43
pragma: no-cache
last-modified: Fri, 21 Feb 2020 18:57:20 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "5e502810-2b"
access-control-max-age: 86400
access-control-allow-methods: GET,POST
content-type: image/gif
access-control-allow-origin
cache-control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: *
expires: Wed, 19 Apr 2000 11:43:00 GMT

GET
H3 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/10882981508/ 2 KB
1 KB 27ms
26ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/10882981508/?random=1660853742230&cv=9&fst=1660853742230&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa8h0&sendb=1&ig=1&data=event%3Dform_submit&frm=0&url=https%3A%2F%2Fblog.group-ib.com%2Fapt41-world-tour-2021&tiba=APT41%20World%20Tour%202021%20on%20a%20tight%20schedule&auid=2094880507.1660853741&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

5f51e69996e33b1a0fd709f286bab0af446759d0048cd03a233d0d1a08386c60

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 18 Aug 2022 20:15:42 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1068
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 counters.gif
forms-eu1.hsforms.com/embed/v3/ 35 B
193 B 337ms
35ms Image
image/gif 172.65.232.43
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://forms-eu1.hsforms.com/embed/v3/counters.gif?key=collected-forms-embed-js-form-bind&count=1

Requested by

Host: js-eu1.hscollectedforms.net
URL: https://js-eu1.hscollectedforms.net/collectedforms.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.65.232.43 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Thu, 18 Aug 2022 20:15:42 GMT
vary: Accept-Encoding
cf-cache-status: DYNAMIC
x-hubspot-correlation-id: f65d8d24-536f-4a5a-b658-03c71deea0d8
cf-ray: 73cd52b2da219168-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 35
server: cloudflare
x-trace: 2B7C48E2437BDA3CD1E02470F4FA81E759BD380A5F000000000000000000
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: image/gif
access-control-expose-headers: X-Origin-Hublet
cache-control: max-age=0, no-cache, no-store
access-control-allow-credentials: false
x-robots-tag: none

POST
H3 200 / Show response
www.facebook.com/tr/ Frame 8250 0
15 B 8ms
8ms Document
text/plain 2a03:2880:f12d:83:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/tr/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f12d:83:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Content-Type: application/x-www-form-urlencoded
Origin: https://blog.group-ib.com
Referer: https://blog.group-ib.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-origin: https://blog.group-ib.com
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 0
content-type: text/plain
cross-origin-resource-policy: cross-origin
date: Thu, 18 Aug 2022 20:15:42 GMT
priority: u=0
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains

GET
H3 200 /
www.google.com/pagead/1p-user-list/10882981508/ 42 B
64 B 25ms
25ms Image
image/gif 2a00:1450:4001:801::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/10882981508/?random=1660853742230&cv=9&fst=1660852800000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa8h0&sendb=1&data=event%3Dform_submit&frm=0&url=https%3A%2F%2Fblog.group-ib.com%2Fapt41-world-tour-2021&tiba=APT41%20World%20Tour%202021%20on%20a%20tight%20schedule&async=1&fmt=3&is_vtc=1&random=3177463095&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 18 Aug 2022 20:15:42 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 /
www.google.de/pagead/1p-user-list/10882981508/ 42 B
64 B 22ms
21ms Image
image/gif 2a00:1450:4001:803::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/10882981508/?random=1660853742230&cv=9&fst=1660852800000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa8h0&sendb=1&data=event%3Dform_submit&frm=0&url=https%3A%2F%2Fblog.group-ib.com%2Fapt41-world-tour-2021&tiba=APT41%20World%20Tour%202021%20on%20a%20tight%20schedule&async=1&fmt=3&is_vtc=1&random=3177463095&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 18 Aug 2022 20:15:42 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 tilda-stat-1.0.min.js Show response
static.tildacdn.com/js/ 8 KB
3 KB 9ms
9ms Script
application/javascript 2a03:90c0:41:2801::254
GCORE

General

Check archive.org

Show headers Download Go to

Full URL: https://static.tildacdn.com/js/tilda-stat-1.0.min.js
Requested by: Host: blog.group-ib.com
URL: https://blog.group-ib.com/apt41-world-tour-2021
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a03:90c0:41:2801::254 Frankfurt am Main, Germany, ASN199524 (GCORE, LU),
Reverse DNS
Software: nginx /
Resource Hash: 5daef6384e28a7e4ea9a31467fb07d4fb40b40f5257052c3eca6f4c4dda7266e

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

x-id: m9p-up-gc10, fr5-up-gc38
date: Thu, 18 Aug 2022 20:15:42 GMT
content-encoding: br
tserver: 13
last-modified: Sun, 12 Jun 2022 21:04:06 GMT
server: nginx
etag: W/"62a654c6-1f57"
vary: Accept-Encoding
x-cached-since: 2022-06-12T21:05:29+00:00, 2022-07-26T10:00:27+00:00
content-type: application/javascript; charset=utf-8
cache: HIT, HIT

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
493 B 182ms
182ms Image
image/gif 96.16.137.162
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=e84d9c08a990af8592952e7ac9a983ad&svisitor=null&session=3b301658-601f-400b-84a2-b10bc6b7bf83&event=active_time_track&q=%7B%22currentTime%22%3A%22Thu%2C%2018%20Aug%202022%2020%3A15%3A42%20GMT%22%2C%22lastTrackTime%22%3A%22Thu%2C%2018%20Aug%202022%2020%3A15%3A41%20GMT%22%2C%22timeSpent%22%3A%221004%22%2C%22totalTimeSpent%22%3A%222005%22%7D&isIframe=false&m=%7B%22description%22%3A%22%204%20malicious%20campaigns%2C%2013%20confirmed%20victims%2C%20and%20a%20new%20wave%20of%20Cobalt%20Strike%20infections%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22APT41%20World%20Tour%202021%20on%20a%20tight%20schedule%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fblog.group-ib.com%2Fapt41-world-tour-2021&pageViewId=d6e625db-bd94-4840-8073-328b96b51206&an_uid=0

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

96.16.137.162 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a96-16-137-162.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Thu, 18 Aug 2022 20:15:43 GMT
x-content-type-options: nosniff
content-length: 43
pragma: no-cache
last-modified: Fri, 21 Feb 2020 18:57:20 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "5e502810-2b"
access-control-max-age: 86400
access-control-allow-methods: GET,POST
content-type: image/gif
access-control-allow-origin
cache-control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: *
expires: Wed, 19 Apr 2000 11:43:00 GMT

POST
H2 200 / Show response
stat.tildacdn.com/event/ 16 B
129 B 327ms
81ms XHR
application/json 193.3.17.197
TILDAPUBLISHING-RU-1

General

Check archive.org

Show headers Download Go to

Full URL: https://stat.tildacdn.com/event/
Requested by: Host: static.tildacdn.com
URL: https://static.tildacdn.com/js/tilda-stat-1.0.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 193.3.17.197 , Russian Federation, ASN210753 (TILDAPUBLISHING-RU-1, RU),
Reverse DNS
Software: nginx /
Resource Hash: fb1bf528d8237aac3e9ead389ab246ba0068f61fe281610110937ef2b8adefce

Request headers

Referer: https://blog.group-ib.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8

Response headers

access-control-allow-origin: https://blog.group-ib.com
date: Thu, 18 Aug 2022 20:15:43 GMT
server: nginx
content-type: application/json;charset=utf-8

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
493 B 185ms
185ms Image
image/gif 96.16.137.162
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=e84d9c08a990af8592952e7ac9a983ad&svisitor=null&session=3b301658-601f-400b-84a2-b10bc6b7bf83&event=active_time_track&q=%7B%22currentTime%22%3A%22Thu%2C%2018%20Aug%202022%2020%3A15%3A43%20GMT%22%2C%22lastTrackTime%22%3A%22Thu%2C%2018%20Aug%202022%2020%3A15%3A42%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%223006%22%7D&isIframe=false&m=%7B%22description%22%3A%22%204%20malicious%20campaigns%2C%2013%20confirmed%20victims%2C%20and%20a%20new%20wave%20of%20Cobalt%20Strike%20infections%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22APT41%20World%20Tour%202021%20on%20a%20tight%20schedule%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fblog.group-ib.com%2Fapt41-world-tour-2021&pageViewId=d6e625db-bd94-4840-8073-328b96b51206&an_uid=0

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

96.16.137.162 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a96-16-137-162.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Thu, 18 Aug 2022 20:15:44 GMT
x-content-type-options: nosniff
content-length: 43
pragma: no-cache
last-modified: Fri, 21 Feb 2020 18:57:20 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "5e502810-2b"
access-control-max-age: 86400
access-control-allow-methods: GET,POST
content-type: image/gif
access-control-allow-origin
cache-control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: *
expires: Wed, 19 Apr 2000 11:43:00 GMT

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
494 B 225ms
224ms Image
image/gif 96.16.137.162
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=e84d9c08a990af8592952e7ac9a983ad&svisitor=null&session=3b301658-601f-400b-84a2-b10bc6b7bf83&event=active_time_track&q=%7B%22currentTime%22%3A%22Thu%2C%2018%20Aug%202022%2020%3A15%3A44%20GMT%22%2C%22lastTrackTime%22%3A%22Thu%2C%2018%20Aug%202022%2020%3A15%3A43%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%224007%22%7D&isIframe=false&m=%7B%22description%22%3A%22%204%20malicious%20campaigns%2C%2013%20confirmed%20victims%2C%20and%20a%20new%20wave%20of%20Cobalt%20Strike%20infections%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22APT41%20World%20Tour%202021%20on%20a%20tight%20schedule%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fblog.group-ib.com%2Fapt41-world-tour-2021&pageViewId=d6e625db-bd94-4840-8073-328b96b51206&an_uid=0

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

96.16.137.162 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a96-16-137-162.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Thu, 18 Aug 2022 20:15:45 GMT
x-content-type-options: nosniff
content-length: 43
pragma: no-cache
last-modified: Sat, 05 Jun 2021 07:56:05 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "60bb2e15-2b"
access-control-max-age: 86400
access-control-allow-methods: GET,POST
content-type: image/gif
access-control-allow-origin
cache-control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: *
expires: Wed, 19 Apr 2000 11:43:00 GMT

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
494 B 371ms
370ms Image
image/gif 96.16.137.162
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=e84d9c08a990af8592952e7ac9a983ad&svisitor=null&session=3b301658-601f-400b-84a2-b10bc6b7bf83&event=active_time_track&q=%7B%22currentTime%22%3A%22Thu%2C%2018%20Aug%202022%2020%3A15%3A45%20GMT%22%2C%22lastTrackTime%22%3A%22Thu%2C%2018%20Aug%202022%2020%3A15%3A44%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%225008%22%7D&isIframe=false&m=%7B%22description%22%3A%22%204%20malicious%20campaigns%2C%2013%20confirmed%20victims%2C%20and%20a%20new%20wave%20of%20Cobalt%20Strike%20infections%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22APT41%20World%20Tour%202021%20on%20a%20tight%20schedule%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fblog.group-ib.com%2Fapt41-world-tour-2021&pageViewId=d6e625db-bd94-4840-8073-328b96b51206&an_uid=0

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

96.16.137.162 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a96-16-137-162.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Thu, 18 Aug 2022 20:15:46 GMT
x-content-type-options: nosniff
content-length: 43
pragma: no-cache
last-modified: Sat, 05 Jun 2021 07:56:05 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "60bb2e15-2b"
access-control-max-age: 86400
access-control-allow-methods: GET,POST
content-type: image/gif
access-control-allow-origin
cache-control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: *
expires: Wed, 19 Apr 2000 11:43:00 GMT

Verdicts & Comments Add Verdict or Comment

261 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

29 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.group-ib.com/	1970-01-20 14:06:29	Name: __ddg1_ Value: OtkFCSZMwwg1JqDgKes4
.group-ib.com/	1970-01-20 07:30:29	Name: _gcl_au Value: 1.1.2094880507.1660853741
blog.group-ib.com/	1970-01-20 05:30:58	Name: _an_uid Value: 0
blog.group-ib.com/	1970-01-20 14:56:53	Name: _gd_visitor Value: 63558920-523d-40e6-8be5-1f1096d0e01d
blog.group-ib.com/	1970-01-20 05:21:08	Name: _gd_session Value: 3b301658-601f-400b-84a2-b10bc6b7bf83
.group-ib.com/	1970-01-20 14:56:53	Name: _ga Value: GA1.2.1318368146.1660853741
.group-ib.com/	1970-01-20 05:22:20	Name: _gid Value: GA1.2.550767942.1660853741
.group-ib.com/	1970-01-20 05:20:53	Name: _dc_gtm_UA-25492706-2 Value: 1
.group-ib.com/	1970-01-20 07:30:29	Name: _fbp Value: fb.1.1660853740960.706480526
.t.co/	1970-01-20 14:56:53	Name: muc_ads Value: 94e2e6c8-04c0-4eb8-ae29-754542196e46
.twitter.com/	1970-01-20 14:56:53	Name: personalization_id Value: "v1_2RxcDkwJG46+exxAOVpdeQ=="
.linkedin.com/	1970-01-20 06:04:05	Name: UserMatchHistory Value: AQIfXOIcOjIHCQAAAYKymOW6wrskfm2LHuQBEyHQcM95OXKogb96ptIaHV2aP262dn5ow0wwCvgtaQ
.linkedin.com/	1970-01-20 06:04:05	Name: AnalyticsSyncHistory Value: AQJoyVCfB3OAogAAAYKymOW6BUvGjngJda5K9m5gmgqaQNLtQNk0OedDVF4XEXSbD9L9BP4agh_l0TMBUfRMtA
.ads.linkedin.com/	1969-12-31 23:59:59	Name: lang Value: v=2&lang=en-us
.linkedin.com/	1970-01-20 14:06:29	Name: bcookie Value: "v=2&4c229fa3-d563-4fa5-8ad4-f8da749231d5"
.linkedin.com/	1970-01-20 05:22:20	Name: lidc Value: "b=VGST03:s=V:r=V:a=V:p=V:g=2661:u=1:x=1:i=1660853740:t=1660940140:v=2:sig=AQFRf3bMQ-gPX2tQcoioRdevyMY0rdsl"
.linkedin.com/	1969-12-31 23:59:59	Name: lang Value: v=2&lang=de-de
.www.linkedin.com/	1970-01-20 14:06:29	Name: bscookie Value: "v=1&2022081820154160831ed5-59fc-41be-8b82-9cc813104e43AQESc_5bVpW6fEvZtHU8HNRfTuOLTI1-"
.linkedin.com/	1970-01-20 09:40:05	Name: li_gc Value: MTswOzE2NjA4NTM3NDE7MjswMjFWAQiW2kMmxUUllVkIwd8AVKyoNm3uQaTZCF3XBvSIMg==
.6sc.co/	1970-01-20 14:56:53	Name: 6suuid Value: cbd5ce177a130000ed9dfe62a600000077452200
.doubleclick.net/	1970-01-20 14:42:29	Name: IDE Value: AHWqTUn0F7NaSWFBSbD5WvoRpE9xGm8RWroC2WnBJzIlB2kAbaikSsJH2eksNCeV
.group-ib.com/	1970-01-20 09:40:05	Name: __hstc Value: 84897990.6fadec195ba1092d75ef65ec4b9bb8a2.1660853741595.1660853741595.1660853741595.1
.group-ib.com/	1970-01-20 09:40:05	Name: hubspotutk Value: 6fadec195ba1092d75ef65ec4b9bb8a2
.group-ib.com/	1969-12-31 23:59:59	Name: __hssrc Value: 1
.group-ib.com/	1970-01-20 05:20:55	Name: __hssc Value: 84897990.1.1660853741595
.hubspot.com/	1970-01-20 05:20:55	Name: __cf_bm Value: oJMlpk6Kbgb2trp3uPub.mE7CL5Gm45IjNuklTUf0KY-1660853741-0-AXIY3f/pp3YHFGkdmkb23FkdJH2hD7iaUuk6ump4t6jQXQduq/Jm//r66z2OstCnJzpXKSY8CgJCcT6UGF3u0KA=
blog.group-ib.com/	1970-01-20 07:30:29	Name: tildauid Value: 1660853742729.612877
blog.group-ib.com/	1970-01-20 05:20:55	Name: tildasid Value: 1660853742729.317187
blog.group-ib.com/	1970-01-20 05:20:55	Name: previousUrl Value: blog.group-ib.com%2Fapt41-world-tour-2021

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
X-Frame-Options	SAMEORIGIN

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

analytics.twitter.com
api-eu1.hubapi.com
b.6sc.co
blog.group-ib.com
c.6sc.co
cdn.jsdelivr.net
connect.facebook.net
forms-eu1.hsforms.com
forms-eu1.hubspot.com
googleads.g.doubleclick.net
ipv6.6sc.co
j.6sc.co
js-eu1.hs-analytics.net
js-eu1.hs-banner.com
js-eu1.hs-scripts.com
js-eu1.hsadspixel.net
js-eu1.hscollectedforms.net
neo.tildacdn.com
px.ads.linkedin.com
px4.ads.linkedin.com
secure.adnxs.com
snap.licdn.com
stat.tildacdn.com
static.ads-twitter.com
static.tildacdn.com
stats.g.doubleclick.net
t.co
thumb.tildacdn.com
track-eu1.hubspot.com
ws.tildacdn.com
www.facebook.com
www.google-analytics.com
www.google.com
www.google.de
www.googleadservices.com
www.googleoptimize.com
www.googletagmanager.com
www.linkedin.com
104.244.42.131
104.244.42.133
13.107.42.14
162.55.188.142
172.217.16.194
172.65.192.122
172.65.193.34
172.65.202.201
172.65.208.22
172.65.219.229
172.65.232.43
172.65.238.60
172.65.240.166
178.248.236.28
185.129.100.113
193.3.17.197
199.232.136.157
2606:4700::6810:5714
2606:4700::6811:c8cc
2620:1ec:21::14
2a00:1450:4001:801::2004
2a00:1450:4001:803::2003
2a00:1450:4001:827::2008
2a00:1450:4001:827::200e
2a00:1450:4001:829::2002
2a00:1450:4001:82a::200e
2a00:1450:400c:c08::9b
2a02:26f0:3500:16::215:149b
2a02:26f0:3500:884::1c91
2a03:2880:f02d:12:face:b00c:0:3
2a03:2880:f12d:83:face:b00c:0:25de
2a03:90c0:41:2801::254
37.252.173.215
96.16.137.162
0037ace955e198e11485bec5320c8bbf620c5df5116299ff7616108bbe3d5570
02a7853ff154ba6aeb04d6a295279af4e0f38b9ca157aec73a8da343893fa085
0338467bccccc4115d78dfc16b3f852927dc9ce4cd819c575ddfb6b93c945a37
03f2d46d7c992367e1cde2702716bb284b5939c31dc417a700f7e504ebc6c23d
0407b0f0d86dd90cd2f57c02bfa35c425f69a59333ef1e4d25c0cb3dcbb6e65a
07a23b618075104849d8dc806499faf025761532347d5c244e488142de01e106
07cc9932ed0e2c7a958c6bf6e3a928847b9fe3f271832767ec89ee34e78f5227
090a7068a2209545279f858c6f41ff7ae42815e11c3d69463a2a2ea835282bd9
093e89df4a71989fd6add2687b73da82d03550a4207f4769dfbc3a1a4931b132
0cbee5f32eeccb2fd9d710b78a7cdfc0293adb361f1675e3db04be4c01f3344c
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
1243a7ac1125978234651c0105a1697aca8433d9ac3c5d9fb616254ffec7fe9e
1287fc0aa84dc8d13adf7173f344a0143511840be8c95fa6203396984a462d4b
19cc6e4b03f164ccb8d68121c3dfc374926bc9eaab12a4216306963bdefd76de
1dedd7e231907c6bec401b7fd16f441b2523a866496489e79ed329b3507e5529
2e5858ac3b77c03c946d9f6d58fab9185a5f90d993941b7bf97f9ce25014ce74
2e59794c9e506814df50c2fe349d9fc8d6418a5959ba5a5b18cbc4742ebba1de
31b45c462302ac175bfa43f9e5591491db780ca094f6ecdd2907f25ad578448d
3a08b1b134620f206c1aba73db081c22a34bda8b6759c99ff42e169e097ad233
3c8478777e4714f32b67e7dff359ccd2ef2dc5ea0b3070573e408b70acb019e1
433d9e9d1898c6d0694a38adba4d7c5ecc5bdbf1cd896bc58df51dcaedbe343b
43f22362329b9705cf8629061fb5b1d1a38f1cc2bc9fd46728f73e5cd9eb77cf
449038c8262e499fd959000c5b1b2d75ebb0a6abec54903e5bf3fdd3f60b068f
4b423c19ca90fea6b3cd29c76da97c56346c4ad6ba6f8e2473e350f8f50013db
4ff1b9b91db584b19d20b4d02af9ff7673add161ce3f9ceae9391b3a84fddab1
566ba7ee9f5b42934e2a9f6f82a729c758ca5e4b9486c520fc0b8895e604ca9e
5ad5171287c6d8cd3f604df3559129c28c5aaea6cc67ccdef3d0a509dbdd7a64
5ae5f7a650b358bc56f66e8680ec9f3e4d1858ce1c182d679ce40bdadf81c250
5daef6384e28a7e4ea9a31467fb07d4fb40b40f5257052c3eca6f4c4dda7266e
5e0a88a680075dec852a87e3caa62bbb27bc77affb238de1778e1a8dca88e088
5f51e69996e33b1a0fd709f286bab0af446759d0048cd03a233d0d1a08386c60
6411c23442e699c4f70a32f2f01d76b62de6e30e2edae93a02a1b99db3b2ea9f
687b3dc37f53fcd6de65ff25c95457a794a6a62b9c0043f40f5d266c713fd157
68c7a56a35791b1e76171e56a5ec5ed4db13ef988384d3dcd7c821492a254bad
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992
6d9800c9a8579f2d92f35dca604117e692960983af608da216d40d5803bb9c2e
7115145b233d36b71b75fee25e2f937ed82b856bd05891d2ff26c07db0f3920b
74ecb5ca63af9d404c113e606856f5d2a4abd3ed1869abf8d1e79e297151d2a1
751baf89cb4a39284c97a0cb6f03c1d420097d590a1a9ed34a537fb40ad2e20b
78ed2b14f8cdbac77dc2e69715cd594d123a577d5c03c7864fce6754488872ba
814abf32fb9bec056a8e421e74299e3cdcb3bf1e4306931171d7532a682c42bb
82b8ba2c3f19e72e7c59ddccb017ded4e2bb9e57040eba51999f8aaece44bc55
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80
87669ff0e42e4e94915bdbdc93e89a92bcdd0b3528295fe290a8d9d8f4800ed8
87afed8d20cbe64b357daaab47688278b1337d7d537673e5f4b86c971caa76b2
87ea279dbcd46fc39de9a4e1cfa5035a6a8d7869d04f9540aea6582c1caa77ba
882c7c93f47238375b91a6e98771361b5acd2e88db62ae591da00877ec41405a
885405644f0b9e41c762f39390b853552522ced2d4650e809baf4b34173b44ae
8b10e3ad964b72065344101dfa8b05e4bccccafb6380043f30f4c56ec096655b
8c60245f59ca16b47b8ab7922b39d9072ce9d3a3eccf9f8d8dd09673fe68cd06
8df3b04a22f19d6c9afb13dffdbe74db68127e61876b3b8186e29a218f4df079
8dfcbd7085c9bd097557529d6fa20b50aad20de04190e7bc22c6b2f20984d6a0
8e038b564510a45dc11799f74da367733f3db7f9c0a0434f1e90c44ec5168278
8fd129226466f3057ccdaa303eec0bc79c7d72e2e00d0e2a058dc991a7f3ab77
9098e0e2cb65cab749fa783c1309a9843074cac78ba67af0f859e850753091db
9a5fd1ba024578df23a4cbc0638ad5cc907c231f30d36451f9c626dfd7860df1
9d005c1939236926ac6f06522f0a1e32eeffda988f6272efb8b7a698be2dfb9d
9d1e135816577e8e584c17143d3c1f873512c07fbce8d23e5ba9672d0ba86669
9d3bb68757509f6474c1bdaea8560e0ac2a7525c954a6223059d9e831a9e0780
a1925038db769477ab74b4df34350c35688a795bb718727b0f4292a4a78a6210
a69d487f4aad79ff054dea601829dad1e1afc33ed83e6a24dc07c6d16552c16f
aaa53b7966f71ea94c27d3ec4f5598a616723c1576bbc707698f8fc2db4b54b4
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
b1b1ddab9ead076f86471e26c5309ae03c38bac87960f3954f556e12c2012a4e
b28f94aa1befadb8596f2774f4826049c27bb1e2b8ffcef35bb53c1755d7c5c8
b57839788686bf37d29f47bbe45ad8258085e3aebf54650ab389c0b515b977e1
b71c20271d9c80d1a71aa0ab9935281c4fa8ac404533f1a0747d7fb03fc68e79
bb9a3150006283c76a2f38e1a0e6dfaf3bbfced1e46755421911769bf1381554
c3b7b9be623a5918e819b0f82c290ef742da4e14770e9cdb033291f68032505d
c61736acb76e337d6afe9613a8b6d71e2f29b1be93a17c61db27da32e322f877
c73b004ebf31b395cf237c3d2b13c1e576f385e04660ceb5f7be163ff3c201dc
c9058c22d84d2b4bc2967cf33408e436b77e2d75577f8f59b506e1317176e96a
cd0bdbc091563d8f43b647ec9ccc59301c1ee1376153e3bc077769e520dd0c16
cde2a83170b825c3818657a383ea3ee45947493d31822cd6de2a813ef2f5eeb4
cef052805859951c50100205e7686d49c3b21b05b191727e6d9b590287feed37
d09070557638ea8826cf22c05d8799721b7ce96cda86aeb6e2d78b5eb839cddd
d23d77177c2c99a81edd09c40f5e4c31e8172155880ef68fba17e76b930b9b47
d8b1418235a32520bbb289a8dfb9121f22af0fe206e3b7c524172ee732cced94
dc0b82d13fbd68066a65e7241087c2b93e0c6f75bfd300f79d955ec31366ed8c
dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e7bad5fe315f9cc904e9b2359ac8ae82bb77a049bc6aa6928a69bcc25ce292b6
e8cee6c7ab45067a20152e710e8b3f258571a24421e2451c8fa30ff13413d7dd
ea2ffede896a8727d9691452b1314e64ac7d2932896e89920599392ba33dd6f1
ea3ccad1b7fd88237740d6f7eb0da1fcbf46d651b7b3fc90e1b601bdf1caf4cd
ea48f8d434d1ce501e9388ba48ec53ada7133e8c701a9aeb3d66c59fd93e6829
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f5c301b8769579afae9deb4eda7659df32661229039c6b7a37cfabd1827317ce
facbd0d3e7d3b2c8f228b877f72e07ea6bd63f232de0936ff6e567ff7bf92e21
fb1bf528d8237aac3e9ead389ab246ba0068f61fe281610110937ef2b8adefce
fe04a9dc88d3f3be8d4f6bc63a9a80f45a4c6d8460e7551dab849457c091920a
fe991316b19d066a4e8ca3fb5899e5aa9b52147dddc9df95c5158120ec0f7093
ffb169c682184887e61fbb92375424273436b8638ffb1b98779b24842a72cdbf

blog.group-ib.com Open in urlscan Pro 185.129.100.113 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

117 Requests

99 %HTTPS

44 %IPv6

27 Domains

38 Subdomains

34 IPs

4 Countries

1051 kBTransfer

2808 kBSize

29 Cookies

35 Outgoing links

Redirected requests

117 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 3 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

blog.group-ib.com Open in urlscan Pro
185.129.100.113 Public Scan

Screenshot
Live screenshot

Full Image

117
Requests

99 %
HTTPS

44 %
IPv6

27
Domains

38
Subdomains

34
IPs

4
Countries

1051 kB
Transfer

2808 kB
Size

29
Cookies

117 HTTP transactions
3 data transactions