content.fireeye.com Open in urlscan Pro
174.129.192.76  Public Scan

1 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

30 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request rpt-apt38 Show response content.fireeye.com/apt/	41 KB 12 KB	1088ms 252ms	Document text/html	174.129.192.76 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://content.fireeye.com/apt/rpt-apt38 Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 174.129.192.76 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-174-129-192-76.compute-1.amazonaws.com Software / Resource Hash 796ed709754d7e243a9533fc7178fa5413351dae6769e56ce09bfddd3c8a9be6 Security Headers Name Value Content-Security-Policy Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers cache-control max-age=0, private, must-revalidate content-encoding gzip content-security-policy content-type text/html; charset=utf-8 date Fri, 30 Sep 2022 19:51:45 GMT etag W/"796ed709754d7e243a9533fc7178fa54" referrer-policy no-referrer-when-downgrade strict-transport-security max-age=31536000; includeSubDomains vary Origin Accept-Encoding x-content-type-options nosniff x-request-id dfc71ffa-5a1b-436d-804e-0c2a24afd9c7 x-runtime 0.148012
GET H2	200	css fonts.googleapis.com/	5 KB 1 KB	61ms 22ms	Stylesheet text/css	2a00:1450:400c:c00::5f GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.googleapis.com/css?family=Roboto:400,700|Lato:400,700 Requested by Host: content.fireeye.com URL: https://content.fireeye.com/apt/rpt-apt38 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:400c:c00::5f Brussels, Belgium, ASN15169 (GOOGLE, US), Reverse DNS Software ESF / Resource Hash 390aca4ba708128182c4802df7c4a1d3a85566b96bf2542caa3b4ea1f1507c1a Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://content.fireeye.com/apt/rpt-apt38 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36 Response headers strict-transport-security max-age=31536000 date Fri, 30 Sep 2022 19:51:45 GMT content-encoding gzip x-content-type-options nosniff cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" x-xss-protection 0 last-modified Fri, 30 Sep 2022 19:51:45 GMT server ESF cross-origin-opener-policy same-origin-allow-popups x-frame-options SAMEORIGIN content-type text/css; charset=utf-8 access-control-allow-origin * cache-control private, max-age=86400, stale-while-revalidate=604800 timing-allow-origin * link <https://fonts.gstatic.com>; rel=preconnect; crossorigin expires Fri, 30 Sep 2022 19:51:45 GMT
GET H2	200	font-awesome.min.css maxcdn.bootstrapcdn.com/font-awesome/4.6.1/css/	28 KB 7 KB	80ms 46ms	Stylesheet text/css	2606:4700::6812:bcf CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://maxcdn.bootstrapcdn.com/font-awesome/4.6.1/css/font-awesome.min.css Requested by Host: content.fireeye.com URL: https://content.fireeye.com/apt/rpt-apt38 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:bcf , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash b5d7707ea8fc00aae40bf500ac7498d7f32f6b1bbff7b4fde976a40345eb5f9d Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://content.fireeye.com/apt/rpt-apt38 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36 Response headers date Fri, 30 Sep 2022 19:51:45 GMT strict-transport-security max-age=31536000; includeSubDomains; preload x-content-type-options nosniff cf-cache-status HIT content-encoding br cdn-edgestorageid 632, 617, 617 age 18524885 cdn-cachedat 2021-06-08 21:36:06 cdn-pullzone 252412 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 last-modified Mon, 25 Jan 2021 22:04:54 GMT server cloudflare cdn-requestpullcode 200 vary Accept-Encoding content-type text/css; charset=utf-8 access-control-allow-origin * cdn-cache HIT cdn-uid b1941f61-b576-4f40-80de-5677acb38f74 cache-control public, max-age=31919000 cdn-requestid 0da3e6fa0421515cbcf5425517fc7012 timing-allow-origin * cdn-requestcountrycode DE cdn-status 200 cf-ray 752f7ebf18566967-FRA cdn-requestpullsuccess True
GET H2	200	overpass.css overpass-30e2.kxcdn.com/	6 KB 842 B	138ms 17ms	Stylesheet text/css	2a0b:4d07:401::1 PROINITY PROINITY
General Check archive.org Show headers Download Go to Full URL https://overpass-30e2.kxcdn.com/overpass.css Requested by Host: content.fireeye.com URL: https://content.fireeye.com/apt/rpt-apt38 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a0b:4d07:401::1 , Switzerland, ASN44239 (PROINITY PROINITY, CH), Reverse DNS Software keycdn-engine / Resource Hash b25e835722ffbec8ab733d999dc194aa9ef7fcf00edc594e453f2823e0c65fb9 Request headers accept-language de-DE,de;q=0.9 Referer https://content.fireeye.com/apt/rpt-apt38 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36 Response headers date Fri, 30 Sep 2022 19:51:45 GMT content-encoding br last-modified Fri, 30 Dec 2016 09:56:37 GMT server keycdn-engine x-edge-location atvi etag W/"58662f55-180e" vary Accept-Encoding access-control-allow-methods * content-type text/css access-control-allow-origin * cache-control max-age=604800 access-control-allow-headers * expires Fri, 07 Oct 2022 19:51:45 GMT
GET H2	200	arrive.min.js Show response cdnjs.cloudflare.com/ajax/libs/arrive/2.4.1/	5 KB 2 KB	68ms 34ms	Script application/javascript	2606:4700::6811:190e CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdnjs.cloudflare.com/ajax/libs/arrive/2.4.1/arrive.min.js Requested by Host: content.fireeye.com URL: https://content.fireeye.com/apt/rpt-apt38 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6811:190e , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 5971de670aef1d6f90a63e6ed8d095ca22f95c455ffc0ceb60be62e30e1a4473 Security Headers Name Value Strict-Transport-Security max-age=15780000 X-Content-Type-Options nosniff Request headers Referer https://content.fireeye.com/apt/rpt-apt38 Origin https://content.fireeye.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36 Response headers date Fri, 30 Sep 2022 19:51:45 GMT content-encoding br x-content-type-options nosniff cf-cache-status HIT nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} strict-transport-security max-age=15780000 age 1698551 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 content-length 1577 last-modified Mon, 04 May 2020 16:05:50 GMT server cloudflare cf-cdnjs-via cfworker/kv etag "5eb03d5e-13e2" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=1XeBwoiE46L6KLPbXyBMVmTnF1usxdgEFoIXtsP5aexb38F5kncqZo6oRyCKPy14tDbrTQEuIprB0A7kLK2f32IpbaxWO3BtDwPhfZ%2Bg4pwV1WsFkxBDGORrBL%2FroWT2RmHrDKVI1bfWhULNAkmYwJhz"}],"group":"cf-nel","max_age":604800} content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control public, max-age=30672000 accept-ranges bytes timing-allow-origin * cf-ray 752f7ebf185d9196-FRA expires Wed, 20 Sep 2023 19:51:45 GMT
GET H2	200	js Show response www.googletagmanager.com/gtag/	106 KB 42 KB	134ms 52ms	Script application/javascript	2a00:1450:4001:808::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtag/js?id=UA-363943-1 Requested by Host: content.fireeye.com URL: https://content.fireeye.com/apt/rpt-apt38 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:808::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash f3b904c6f2a47ee5e08e8bf566bb31878c6aba75f5058f307381b2c824953f87 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://content.fireeye.com/apt/rpt-apt38 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36 Response headers date Fri, 30 Sep 2022 19:51:45 GMT content-encoding br strict-transport-security max-age=31536000; includeSubDomains cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 42363 x-xss-protection 0 last-modified Fri, 30 Sep 2022 18:00:00 GMT server Google Tag Manager vary Accept-Encoding content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true access-control-allow-headers Cache-Control expires Fri, 30 Sep 2022 19:51:45 GMT
GET H2	200	rpt-apt38-2018-web_v5.pdf app.cdn.lookbookhq.com/lbhq-production/10427/content/original/5de5022e-bbc4-4175-af8d-6bf8d4e48630/ Frame 1CC3	0 0	153ms 87ms	Document application/pdf	99.86.159.76 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://app.cdn.lookbookhq.com/lbhq-production/10427/content/original/5de5022e-bbc4-4175-af8d-6bf8d4e48630/rpt-apt38-2018-web_v5.pdf Requested by Host: content.fireeye.com URL: https://content.fireeye.com/apt/rpt-apt38 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 99.86.159.76 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-99-86-159-76.mxp64.r.cloudfront.net Software AmazonS3 / Resource Hash Request headers Referer https://content.fireeye.com/apt/rpt-apt38 Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers accept-ranges bytes age 26440 content-length 3095178 content-type application/pdf date Fri, 30 Sep 2022 12:31:07 GMT etag "d1c07d514df3357fe889159153abfaf0" last-modified Mon, 08 Oct 2018 20:42:53 GMT server AmazonS3 via 1.1 ec6f32a0d1c5fef22993e49d055871c2.cloudfront.net (CloudFront) x-amz-cf-id KsGoTx--HV0QeZ7oSGH4wTx4mKac_9JbDlR5YALLKNJW2suZAMtEVg== x-amz-cf-pop MXP64-C2 x-amz-version-id 3PfYDLQQvHkr7e2aTj8C7xUQB80ONtLX x-cache Hit from cloudfront
GET H2	200	tracks.js Show response cdn-app.pathfactory.com/production/jukebox/current/	2 MB 433 KB	37ms 8ms	Script text/javascript	13.32.99.99 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://cdn-app.pathfactory.com/production/jukebox/current/tracks.js?x=2 Requested by Host: content.fireeye.com URL: https://content.fireeye.com/apt/rpt-apt38 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 13.32.99.99 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-13-32-99-99.fra60.r.cloudfront.net Software AmazonS3 / Resource Hash 08ea5f20e1b29b8c96059641b4d1f0751994f7c3085743f6f6590e437ad8b36d Request headers accept-language de-DE,de;q=0.9 Referer https://content.fireeye.com/apt/rpt-apt38 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36 Response headers x-amz-version-id null content-encoding gzip via 1.1 231be1c97cc722fa08b64d21072ebfac.cloudfront.net (CloudFront) date Fri, 30 Sep 2022 13:03:33 GMT last-modified Wed, 28 Sep 2022 01:01:04 GMT server AmazonS3 x-amz-cf-pop FRA60-P3 age 24515 etag W/"066407b0976f663dbc61dbed05c96b04" vary Accept-Encoding x-cache Hit from cloudfront content-type text/javascript cache-control max-age=43200 x-amz-cf-id H__OANkFGS-ehYINOvm-O8CKdGxXPmCKrTsK1GdTqjXhnHr8Q4ySag==
GET H2	200	6si.min.js Show response j.6sc.co/	30 KB 10 KB	57ms 9ms	Script application/javascript	96.16.137.162 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://j.6sc.co/6si.min.js Requested by Host: content.fireeye.com URL: https://content.fireeye.com/apt/rpt-apt38 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 96.16.137.162 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a96-16-137-162.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash aca17711b2bcab8335b7bd9c2880033b2aa69a0e9f33ce2e1a507dbb0f9cade3 Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://content.fireeye.com/apt/rpt-apt38 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36 Response headers pragma no-cache date Fri, 30 Sep 2022 19:51:45 GMT content-encoding gzip x-content-type-options nosniff last-modified Thu, 29 Sep 2022 20:55:46 GMT server nginx/1.14.0 (Ubuntu) etag "63360652-7700" vary Accept-Encoding content-type application/javascript cache-control private, no-cache, proxy-revalidate accept-ranges bytes content-length 9869 expires Fri, 30 Sep 2022 19:51:45 GMT
GET H/1.1	200 OK	getuidj Show response secure.adnxs.com/	11 B 709 B	52ms 16ms	XHR application/json	185.83.142.19 ASN-APPNEX
General Check archive.org Show headers Download Go to Full URL https://secure.adnxs.com/getuidj Requested by Host: j.6sc.co URL: https://j.6sc.co/6si.min.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 185.83.142.19 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US), Reverse DNS 960.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net Software nginx/1.21.3 / Resource Hash 31b45c462302ac175bfa43f9e5591491db780ca094f6ecdd2907f25ad578448d Security Headers Name Value X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://content.fireeye.com/apt/rpt-apt38 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36 Response headers Pragma no-cache Date Fri, 30 Sep 2022 19:51:45 GMT AN-X-Request-Uuid 3e0ebf6f-f80c-4d86-ad20-8aa41ec1dda2 Server nginx/1.21.3 Content-Type application/json; charset=utf-8 P3P policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE" Access-Control-Allow-Origin https://content.fireeye.com Cache-Control no-store, no-cache, private Access-Control-Allow-Credentials true Connection keep-alive X-Proxy-Origin 185.213.155.169; 185.213.155.169; 960.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com Content-Length 11 X-XSS-Protection 0 Expires Sat, 15 Nov 2008 16:00:00 GMT
GET H2	200	/ Show response c.6sc.co/	7 B 204 B	138ms 7ms	XHR text/html	96.16.137.162 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://c.6sc.co/ Requested by Host: j.6sc.co URL: https://j.6sc.co/6si.min.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 96.16.137.162 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a96-16-137-162.deploy.static.akamaitechnologies.com Software / Resource Hash fe04a9dc88d3f3be8d4f6bc63a9a80f45a4c6d8460e7551dab849457c091920a Request headers accept-language de-DE,de;q=0.9 Referer https://content.fireeye.com/apt/rpt-apt38 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36 Response headers date Fri, 30 Sep 2022 19:51:46 GMT access-control-max-age 86400 access-control-allow-methods GET,POST content-type text/html access-control-allow-origin https://content.fireeye.com access-control-allow-credentials true access-control-allow-headers * content-length 7
GET H2	200	/ Show response ipv6.6sc.co/	20 B 257 B	134ms 19ms	XHR text/html	2a02:26f0:10e:3aa::1c91 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://ipv6.6sc.co/ Requested by Host: j.6sc.co URL: https://j.6sc.co/6si.min.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:10e:3aa::1c91 Vienna, Austria, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software / Resource Hash ab387a27fa712c46def740a80752bbc8f22e48f2fe710eb13311b38ef1807e97 Request headers accept-language de-DE,de;q=0.9 Referer https://content.fireeye.com/apt/rpt-apt38 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36 Response headers pragma no-cache date Fri, 30 Sep 2022 19:51:46 GMT vary Origin content-type text/html access-control-allow-origin https://content.fireeye.com cache-control max-age=0, no-cache, no-store 6si-ipv6 2a03:1b20:6:f011::9e server-timing cdn-cache; desc=HIT, edge; dur=1 content-length 20 expires Fri, 30 Sep 2022 19:51:46 GMT
OPTIONS H2	200	page_views jukebox.lookbookhq.com/api/public/v1/ Frame	0 0	342ms 104ms	Preflight	3.90.23.130 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://jukebox.lookbookhq.com/api/public/v1/page_views Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 3.90.23.130 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-3-90-23-130.compute-1.amazonaws.com Software / Resource Hash Request headers Accept */* Access-Control-Request-Headers content-type Access-Control-Request-Method POST Origin https://content.fireeye.com Sec-Fetch-Mode cors User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36 Response headers access-control-allow-credentials true access-control-allow-headers content-type access-control-allow-methods GET, PUT, POST, PATCH, OPTIONS access-control-allow-origin https://content.fireeye.com access-control-expose-headers access-control-max-age 7200 date Fri, 30 Sep 2022 19:51:46 GMT
POST H2	200	page_views Show response jukebox.lookbookhq.com/api/public/v1/	153 B 1 KB	484ms 280ms	XHR application/json	3.90.23.130 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://jukebox.lookbookhq.com/api/public/v1/page_views Requested by Host: cdn-app.pathfactory.com URL: https://cdn-app.pathfactory.com/production/jukebox/current/tracks.js?x=2 Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 3.90.23.130 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-3-90-23-130.compute-1.amazonaws.com Software / Resource Hash 2afd3096cd56ed9c34e0824cc276ebdb5ae6576e6e7ebb6faf44aa412c5c6a34 Security Headers Name Value Content-Security-Policy Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff Request headers Accept application/json Referer https://content.fireeye.com/apt/rpt-apt38 accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36 Content-Type application/json Response headers date Fri, 30 Sep 2022 19:51:46 GMT strict-transport-security max-age=31536000; includeSubDomains x-content-type-options nosniff content-security-policy content-encoding gzip x-request-id 193aa52d-350d-4add-8d9d-ef9c2ed3bf8f x-runtime 0.172317 referrer-policy no-referrer-when-downgrade etag W/"2afd3096cd56ed9c34e0824cc276ebdb" access-control-max-age 7200 access-control-allow-methods GET, PUT, POST, PATCH, OPTIONS content-type application/json; charset=utf-8 access-control-allow-origin https://content.fireeye.com access-control-expose-headers vary Accept, Origin, Accept-Encoding access-control-allow-credentials true cache-control max-age=0, private, must-revalidate
GET H2	200	img.gif b.6sc.co/v1/beacon/	43 B 494 B	251ms 194ms	Image image/gif	96.16.137.162 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=1322340356018696d853e0ac6f7ce3a2&svisitor=null&visitor=84e85c72-f4e2-4732-8350-2c2f3176948c&session=6c0c57e6-506f-4ff5-8d53-161bc44a0ade&event=a_pageload&q=%7B%22pageLoadTime%22%3A%22Fri%2C%2030%20Sep%202022%2019%3A51%3A45%20GMT%22%7D&isIframe=false&m=%7B%22description%22%3A%22Today%2C%20we%20are%20releasing%20details%20on%20the%20threat%20group%20that%20we%20believe%20is%20responsible%20for%20conducting%20financial%20crime%20on%20behalf%20of%20the%20North%20Korean%20regime%2C%20stealing%20millions%20of%20dollars%20from%20banks%20worldwide.%20The%20group%20is%20particularly%20aggressive%3B%20they%20regularly%20use%20destructive%20malware%20to%20render%20victim%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Report%20APT38%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fcontent.fireeye.com%2Fapt%2Frpt-apt38&pageViewId=8dcf7a22-8cc7-47e4-8c85-79ed7e02b54e&an_uid=0 Requested by Host: content.fireeye.com URL: https://content.fireeye.com/apt/rpt-apt38 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 96.16.137.162 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a96-16-137-162.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://content.fireeye.com/apt/rpt-apt38 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36 Response headers date Fri, 30 Sep 2022 19:51:46 GMT x-content-type-options nosniff content-length 43 pragma no-cache last-modified Tue, 05 Oct 2021 22:17:52 GMT server nginx/1.14.0 (Ubuntu) etag "615ccf10-2b" access-control-max-age 86400 access-control-allow-methods GET,POST content-type image/gif access-control-allow-origin cache-control private, no-cache, no-cache=Set-Cookie, proxy-revalidate access-control-allow-credentials true accept-ranges bytes access-control-allow-headers * expires Wed, 19 Apr 2000 11:43:00 GMT
GET H2	200	img.gif b.6sc.co/v1/beacon/	43 B 493 B	251ms 195ms	Image image/gif	96.16.137.162 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=1322340356018696d853e0ac6f7ce3a2&svisitor=null&visitor=84e85c72-f4e2-4732-8350-2c2f3176948c&session=6c0c57e6-506f-4ff5-8d53-161bc44a0ade&event=ipv6&q=%7B%22address%22%3A%222a03%3A1b20%3A6%3Af011%3A%3A9e%22%7D&isIframe=false&m=%7B%22description%22%3A%22Today%2C%20we%20are%20releasing%20details%20on%20the%20threat%20group%20that%20we%20believe%20is%20responsible%20for%20conducting%20financial%20crime%20on%20behalf%20of%20the%20North%20Korean%20regime%2C%20stealing%20millions%20of%20dollars%20from%20banks%20worldwide.%20The%20group%20is%20particularly%20aggressive%3B%20they%20regularly%20use%20destructive%20malware%20to%20render%20victim%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Report%20APT38%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fcontent.fireeye.com%2Fapt%2Frpt-apt38&pageViewId=8dcf7a22-8cc7-47e4-8c85-79ed7e02b54e&an_uid=0 Requested by Host: content.fireeye.com URL: https://content.fireeye.com/apt/rpt-apt38 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 96.16.137.162 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a96-16-137-162.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://content.fireeye.com/apt/rpt-apt38 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36 Response headers date Fri, 30 Sep 2022 19:51:46 GMT x-content-type-options nosniff content-length 43 pragma no-cache last-modified Tue, 05 Oct 2021 22:17:52 GMT server nginx/1.14.0 (Ubuntu) etag "615ccf10-2b" access-control-max-age 86400 access-control-allow-methods GET,POST content-type image/gif access-control-allow-origin cache-control private, no-cache, no-cache=Set-Cookie, proxy-revalidate access-control-allow-credentials true accept-ranges bytes access-control-allow-headers * expires Wed, 19 Apr 2000 11:43:00 GMT
GET H2	200	analytics.js Show response www.google-analytics.com/	49 KB 20 KB	105ms 31ms	Script text/javascript	2001:4860:4802:36::178 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google-analytics.com/analytics.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtag/js?id=UA-363943-1 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2001:4860:4802:36::178 , United States, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash 9e25469f734732205f33dd80ff8ca12080406c18d2fa99a1f368103e51f7999f Security Headers Name Value Strict-Transport-Security max-age=10886400; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://content.fireeye.com/apt/rpt-apt38 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36 Response headers strict-transport-security max-age=10886400; includeSubDomains; preload content-encoding gzip x-content-type-options nosniff date Fri, 30 Sep 2022 19:01:59 GMT last-modified Sun, 11 Sep 2022 13:50:09 GMT server Golfe2 age 2987 vary Accept-Encoding content-type text/javascript cache-control public, max-age=7200 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 19826 expires Fri, 30 Sep 2022 21:01:59 GMT
POST H2	200	collect Show response www.google-analytics.com/j/	2 B 209 B	39ms 38ms	XHR text/plain	2001:4860:4802:36::178 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google-analytics.com/j/collect?v=1&_v=j97&a=1509374322&t=pageview&_s=1&dl=https%3A%2F%2Fcontent.fireeye.com%2Fapt%2Frpt-apt38&ul=en-us&de=UTF-8&dt=Report%20APT38&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YEBAAUABAAAAAC~&jid=838634286&gjid=1247355204&cid=533216947.1664567506&tid=UA-363943-1&_gid=2141675450.1664567506&_r=1&gtm=2ou9s0&z=873289440 Requested by Host: www.google-analytics.com URL: https://www.google-analytics.com/analytics.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2001:4860:4802:36::178 , United States, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af Security Headers Name Value X-Content-Type-Options nosniff Request headers Referer https://content.fireeye.com/apt/rpt-apt38 accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36 Content-Type text/plain Response headers pragma no-cache date Fri, 30 Sep 2022 19:51:46 GMT x-content-type-options nosniff last-modified Sun, 17 May 1998 03:00:00 GMT server Golfe2 content-type text/plain access-control-allow-origin https://content.fireeye.com cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 2 expires Fri, 01 Jan 1990 00:00:00 GMT
POST H2	200	collect Show response stats.g.doubleclick.net/j/	4 B 444 B	58ms 19ms	XHR text/plain	2a00:1450:400c:c0c::9d GOOGLE
General Check archive.org Show headers Download Go to Full URL https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j97&tid=UA-363943-1&cid=533216947.1664567506&jid=838634286&gjid=1247355204&_gid=2141675450.1664567506&_u=YEBAAUAAAAAAAC~&z=1873155367 Requested by Host: www.google-analytics.com URL: https://www.google-analytics.com/analytics.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:400c:c0c::9d Brussels, Belgium, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash 84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80 Security Headers Name Value Strict-Transport-Security max-age=10886400; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer https://content.fireeye.com/apt/rpt-apt38 accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36 Content-Type text/plain Response headers pragma no-cache strict-transport-security max-age=10886400; includeSubDomains; preload date Fri, 30 Sep 2022 19:51:46 GMT x-content-type-options nosniff last-modified Sun, 17 May 1998 03:00:00 GMT server Golfe2 content-type text/plain access-control-allow-origin https://content.fireeye.com cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 4 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	ga-audiences www.google.com/ads/	42 B 501 B	154ms 74ms	Image image/gif	2a00:1450:4001:82a::2004 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j97&tid=UA-363943-1&cid=533216947.1664567506&jid=838634286&_u=YEBAAUAAAAAAAC~&z=1634296712 Requested by Host: content.fireeye.com URL: https://content.fireeye.com/apt/rpt-apt38 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:82a::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://content.fireeye.com/apt/rpt-apt38 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36 Response headers pragma no-cache date Fri, 30 Sep 2022 19:51:46 GMT x-content-type-options nosniff server cafe content-type image/gif p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin timing-allow-origin * alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	ga-audiences www.google.de/ads/	42 B 501 B	217ms 95ms	Image image/gif	2a00:1450:400d:805::2003 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j97&tid=UA-363943-1&cid=533216947.1664567506&jid=838634286&_u=YEBAAUAAAAAAAC~&z=1634296712 Requested by Host: content.fireeye.com URL: https://content.fireeye.com/apt/rpt-apt38 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:400d:805::2003 , Ireland, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://content.fireeye.com/apt/rpt-apt38 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36 Response headers pragma no-cache date Fri, 30 Sep 2022 19:51:46 GMT x-content-type-options nosniff server cafe content-type image/gif p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin timing-allow-origin * alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
OPTIONS H2	200	create_event jukebox.lookbookhq.com/api/public/v1/page_views/ Frame	0 0	106ms 106ms	Preflight	3.90.23.130 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://jukebox.lookbookhq.com/api/public/v1/page_views/create_event Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 3.90.23.130 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-3-90-23-130.compute-1.amazonaws.com Software / Resource Hash Request headers Accept */* Access-Control-Request-Headers content-type Access-Control-Request-Method POST Origin https://content.fireeye.com Sec-Fetch-Mode cors User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36 Response headers access-control-allow-credentials true access-control-allow-headers content-type access-control-allow-methods GET, PUT, POST, PATCH, OPTIONS access-control-allow-origin https://content.fireeye.com access-control-expose-headers access-control-max-age 7200 date Fri, 30 Sep 2022 19:51:47 GMT
POST H2	204	create_event Show response jukebox.lookbookhq.com/api/public/v1/page_views/	0 754 B	123ms 122ms	XHR text/plain	3.90.23.130 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://jukebox.lookbookhq.com/api/public/v1/page_views/create_event Requested by Host: cdn-app.pathfactory.com URL: https://cdn-app.pathfactory.com/production/jukebox/current/tracks.js?x=2 Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 3.90.23.130 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-3-90-23-130.compute-1.amazonaws.com Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value Content-Security-Policy Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff Request headers Accept application/json Referer https://content.fireeye.com/apt/rpt-apt38 accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36 Content-Type application/json Response headers x-runtime 0.014825 date Fri, 30 Sep 2022 19:51:47 GMT strict-transport-security max-age=31536000; includeSubDomains x-content-type-options nosniff referrer-policy no-referrer-when-downgrade content-security-policy access-control-max-age 7200 access-control-allow-methods GET, PUT, POST, PATCH, OPTIONS access-control-allow-origin https://content.fireeye.com access-control-expose-headers cache-control no-cache access-control-allow-credentials true vary Origin x-request-id 596b7673-dd63-42f5-9d46-508b3f239ae8
GET H2	200	4016ed74-b343-4630-b53a-4fa4742cd7f2.otf app.cdn.lookbookhq.com/lbhq-production/10427/fonts/	97 KB 98 KB	471ms 433ms	Font application/octet-stream	99.86.159.76 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://app.cdn.lookbookhq.com/lbhq-production/10427/fonts/4016ed74-b343-4630-b53a-4fa4742cd7f2.otf Protocol H2 Security TLS 1.3, , AES_128_GCM Server 99.86.159.76 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-99-86-159-76.mxp64.r.cloudfront.net Software AmazonS3 / Resource Hash 5607c31583a387bc428a264f2c51f7c3e332ca288fc7d98247f604b556ac6fdd Request headers Referer https://content.fireeye.com/ Origin https://content.fireeye.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36 Response headers x-amz-version-id null date Fri, 30 Sep 2022 19:51:48 GMT via 1.1 20f1bd00b8898dc48034147896cabd74.cloudfront.net (CloudFront) x-amz-cf-pop MXP64-C2 x-cache RefreshHit from cloudfront content-length 99364 last-modified Mon, 08 Apr 2019 20:27:37 GMT server AmazonS3 etag "03dfaa3b91df30f10a7e1e9264545db7" access-control-max-age 3000 access-control-allow-methods GET, PUT, HEAD access-control-allow-origin * cache-control max-age=60, must-revalidate vary Accept-Encoding,Origin accept-ranges bytes x-amz-cf-id hxYtxQdBSITqaH8FbwtvEzvOkcZyFZPwEDpE60sdvDhiLIV12qp_VQ==
GET H2	200	7bc17219-7381-4ab4-9c3f-033d46ba7240.otf app.cdn.lookbookhq.com/lbhq-production/10427/fonts/	100 KB 101 KB	500ms 462ms	Font application/octet-stream	99.86.159.76 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://app.cdn.lookbookhq.com/lbhq-production/10427/fonts/7bc17219-7381-4ab4-9c3f-033d46ba7240.otf Protocol H2 Security TLS 1.3, , AES_128_GCM Server 99.86.159.76 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-99-86-159-76.mxp64.r.cloudfront.net Software AmazonS3 / Resource Hash b2a5e7aaecb08fba9b769c0a4d05aad3d5535eaf01bc44f1d7a036cf012aa764 Request headers Referer https://content.fireeye.com/ Origin https://content.fireeye.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36 Response headers x-amz-version-id null date Fri, 30 Sep 2022 19:51:48 GMT via 1.1 20f1bd00b8898dc48034147896cabd74.cloudfront.net (CloudFront) x-amz-cf-pop MXP64-C2 x-cache RefreshHit from cloudfront content-length 102900 last-modified Mon, 08 Apr 2019 20:28:28 GMT server AmazonS3 etag "44a74d9657c6abfee3c47de7732ba4e5" access-control-max-age 3000 access-control-allow-methods GET, PUT, HEAD access-control-allow-origin * cache-control max-age=60, must-revalidate vary Accept-Encoding,Origin accept-ranges bytes x-amz-cf-id JeUBPXVUn4CwXr5ky6tsesOYGFNHgEGVcUxxWswnL1HWpOiEKvA6WQ==
GET H2	200	img.gif b.6sc.co/v1/beacon/	43 B 493 B	192ms 192ms	Image image/gif	96.16.137.162 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=1322340356018696d853e0ac6f7ce3a2&svisitor=null&visitor=84e85c72-f4e2-4732-8350-2c2f3176948c&session=6c0c57e6-506f-4ff5-8d53-161bc44a0ade&event=active_time_track&q=%7B%22currentTime%22%3A%22Fri%2C%2030%20Sep%202022%2019%3A51%3A46%20GMT%22%2C%22lastTrackTime%22%3A%22Fri%2C%2030%20Sep%202022%2019%3A51%3A45%20GMT%22%2C%22timeSpent%22%3A%221029%22%2C%22totalTimeSpent%22%3A%221029%22%7D&isIframe=false&m=%7B%22description%22%3A%22Today%2C%20we%20are%20releasing%20details%20on%20the%20threat%20group%20that%20we%20believe%20is%20responsible%20for%20conducting%20financial%20crime%20on%20behalf%20of%20the%20North%20Korean%20regime%2C%20stealing%20millions%20of%20dollars%20from%20banks%20worldwide.%20The%20group%20is%20particularly%20aggressive%3B%20they%20regularly%20use%20destructive%20malware%20to%20render%20victim%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Report%20APT38%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fcontent.fireeye.com%2Fapt%2Frpt-apt38&pageViewId=8dcf7a22-8cc7-47e4-8c85-79ed7e02b54e&an_uid=0 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 96.16.137.162 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a96-16-137-162.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://content.fireeye.com/apt/rpt-apt38 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36 Response headers date Fri, 30 Sep 2022 19:51:47 GMT x-content-type-options nosniff content-length 43 pragma no-cache last-modified Fri, 21 Feb 2020 18:57:20 GMT server nginx/1.14.0 (Ubuntu) etag "5e502810-2b" access-control-max-age 86400 access-control-allow-methods GET,POST content-type image/gif access-control-allow-origin cache-control private, no-cache, no-cache=Set-Cookie, proxy-revalidate access-control-allow-credentials true accept-ranges bytes access-control-allow-headers * expires Wed, 19 Apr 2000 11:43:00 GMT
GET H2	200	img.gif b.6sc.co/v1/beacon/	43 B 494 B	189ms 189ms	Image image/gif	96.16.137.162 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=1322340356018696d853e0ac6f7ce3a2&svisitor=null&visitor=84e85c72-f4e2-4732-8350-2c2f3176948c&session=6c0c57e6-506f-4ff5-8d53-161bc44a0ade&event=active_time_track&q=%7B%22currentTime%22%3A%22Fri%2C%2030%20Sep%202022%2019%3A51%3A47%20GMT%22%2C%22lastTrackTime%22%3A%22Fri%2C%2030%20Sep%202022%2019%3A51%3A46%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%222030%22%7D&isIframe=false&m=%7B%22description%22%3A%22Today%2C%20we%20are%20releasing%20details%20on%20the%20threat%20group%20that%20we%20believe%20is%20responsible%20for%20conducting%20financial%20crime%20on%20behalf%20of%20the%20North%20Korean%20regime%2C%20stealing%20millions%20of%20dollars%20from%20banks%20worldwide.%20The%20group%20is%20particularly%20aggressive%3B%20they%20regularly%20use%20destructive%20malware%20to%20render%20victim%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Report%20APT38%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fcontent.fireeye.com%2Fapt%2Frpt-apt38&pageViewId=8dcf7a22-8cc7-47e4-8c85-79ed7e02b54e&an_uid=0 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 96.16.137.162 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a96-16-137-162.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://content.fireeye.com/apt/rpt-apt38 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36 Response headers date Fri, 30 Sep 2022 19:51:48 GMT x-content-type-options nosniff content-length 43 pragma no-cache last-modified Sat, 05 Jun 2021 07:56:05 GMT server nginx/1.14.0 (Ubuntu) etag "60bb2e15-2b" access-control-max-age 86400 access-control-allow-methods GET,POST content-type image/gif access-control-allow-origin cache-control private, no-cache, no-cache=Set-Cookie, proxy-revalidate access-control-allow-credentials true accept-ranges bytes access-control-allow-headers * expires Wed, 19 Apr 2000 11:43:00 GMT
GET H2	200	img.gif b.6sc.co/v1/beacon/	43 B 493 B	184ms 183ms	Image image/gif	96.16.137.162 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=1322340356018696d853e0ac6f7ce3a2&svisitor=null&visitor=84e85c72-f4e2-4732-8350-2c2f3176948c&session=6c0c57e6-506f-4ff5-8d53-161bc44a0ade&event=active_time_track&q=%7B%22currentTime%22%3A%22Fri%2C%2030%20Sep%202022%2019%3A51%3A48%20GMT%22%2C%22lastTrackTime%22%3A%22Fri%2C%2030%20Sep%202022%2019%3A51%3A47%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%223031%22%7D&isIframe=false&m=%7B%22description%22%3A%22Today%2C%20we%20are%20releasing%20details%20on%20the%20threat%20group%20that%20we%20believe%20is%20responsible%20for%20conducting%20financial%20crime%20on%20behalf%20of%20the%20North%20Korean%20regime%2C%20stealing%20millions%20of%20dollars%20from%20banks%20worldwide.%20The%20group%20is%20particularly%20aggressive%3B%20they%20regularly%20use%20destructive%20malware%20to%20render%20victim%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Report%20APT38%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fcontent.fireeye.com%2Fapt%2Frpt-apt38&pageViewId=8dcf7a22-8cc7-47e4-8c85-79ed7e02b54e&an_uid=0 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 96.16.137.162 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a96-16-137-162.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://content.fireeye.com/apt/rpt-apt38 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36 Response headers date Fri, 30 Sep 2022 19:51:49 GMT x-content-type-options nosniff content-length 43 pragma no-cache last-modified Fri, 21 Feb 2020 18:57:20 GMT server nginx/1.14.0 (Ubuntu) etag "5e502810-2b" access-control-max-age 86400 access-control-allow-methods GET,POST content-type image/gif access-control-allow-origin cache-control private, no-cache, no-cache=Set-Cookie, proxy-revalidate access-control-allow-credentials true accept-ranges bytes access-control-allow-headers * expires Wed, 19 Apr 2000 11:43:00 GMT
GET H2	200	img.gif b.6sc.co/v1/beacon/	43 B 493 B	185ms 183ms	Image image/gif	96.16.137.162 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=1322340356018696d853e0ac6f7ce3a2&svisitor=null&visitor=84e85c72-f4e2-4732-8350-2c2f3176948c&session=6c0c57e6-506f-4ff5-8d53-161bc44a0ade&event=active_time_track&q=%7B%22currentTime%22%3A%22Fri%2C%2030%20Sep%202022%2019%3A51%3A49%20GMT%22%2C%22lastTrackTime%22%3A%22Fri%2C%2030%20Sep%202022%2019%3A51%3A48%20GMT%22%2C%22timeSpent%22%3A%221003%22%2C%22totalTimeSpent%22%3A%224034%22%7D&isIframe=false&m=%7B%22description%22%3A%22Today%2C%20we%20are%20releasing%20details%20on%20the%20threat%20group%20that%20we%20believe%20is%20responsible%20for%20conducting%20financial%20crime%20on%20behalf%20of%20the%20North%20Korean%20regime%2C%20stealing%20millions%20of%20dollars%20from%20banks%20worldwide.%20The%20group%20is%20particularly%20aggressive%3B%20they%20regularly%20use%20destructive%20malware%20to%20render%20victim%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Report%20APT38%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fcontent.fireeye.com%2Fapt%2Frpt-apt38&pageViewId=8dcf7a22-8cc7-47e4-8c85-79ed7e02b54e&an_uid=0 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 96.16.137.162 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a96-16-137-162.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://content.fireeye.com/apt/rpt-apt38 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36 Response headers date Fri, 30 Sep 2022 19:51:50 GMT x-content-type-options nosniff content-length 43 pragma no-cache last-modified Tue, 05 Oct 2021 22:17:52 GMT server nginx/1.14.0 (Ubuntu) etag "615ccf10-2b" access-control-max-age 86400 access-control-allow-methods GET,POST content-type image/gif access-control-allow-origin cache-control private, no-cache, no-cache=Set-Cookie, proxy-revalidate access-control-allow-credentials true accept-ranges bytes access-control-allow-headers * expires Wed, 19 Apr 2000 11:43:00 GMT
GET H2	200	img.gif b.6sc.co/v1/beacon/	43 B 493 B	183ms 183ms	Image image/gif	96.16.137.162 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=1322340356018696d853e0ac6f7ce3a2&svisitor=null&visitor=84e85c72-f4e2-4732-8350-2c2f3176948c&session=6c0c57e6-506f-4ff5-8d53-161bc44a0ade&event=active_time_track&q=%7B%22currentTime%22%3A%22Fri%2C%2030%20Sep%202022%2019%3A51%3A50%20GMT%22%2C%22lastTrackTime%22%3A%22Fri%2C%2030%20Sep%202022%2019%3A51%3A49%20GMT%22%2C%22timeSpent%22%3A%221003%22%2C%22totalTimeSpent%22%3A%225037%22%7D&isIframe=false&m=%7B%22description%22%3A%22Today%2C%20we%20are%20releasing%20details%20on%20the%20threat%20group%20that%20we%20believe%20is%20responsible%20for%20conducting%20financial%20crime%20on%20behalf%20of%20the%20North%20Korean%20regime%2C%20stealing%20millions%20of%20dollars%20from%20banks%20worldwide.%20The%20group%20is%20particularly%20aggressive%3B%20they%20regularly%20use%20destructive%20malware%20to%20render%20victim%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Report%20APT38%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fcontent.fireeye.com%2Fapt%2Frpt-apt38&pageViewId=8dcf7a22-8cc7-47e4-8c85-79ed7e02b54e&an_uid=0 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 96.16.137.162 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a96-16-137-162.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://content.fireeye.com/apt/rpt-apt38 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36 Response headers date Fri, 30 Sep 2022 19:51:51 GMT x-content-type-options nosniff content-length 43 pragma no-cache last-modified Tue, 05 Oct 2021 22:17:52 GMT server nginx/1.14.0 (Ubuntu) etag "615ccf10-2b" access-control-max-age 86400 access-control-allow-methods GET,POST content-type image/gif access-control-allow-origin cache-control private, no-cache, no-cache=Set-Cookie, proxy-revalidate access-control-allow-credentials true accept-ranges bytes access-control-allow-headers * expires Wed, 19 Apr 2000 11:43:00 GMT

36 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| onbeforeinput object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails function| queryLocalFonts object| navigation object| __PATHFACTORY__ function| getPFContact object| Arrive string| gtmId object| addgtmjs function| gtag object| dataLayer string| pfObject function| pf object| _6si function| lbhq function| _ function| cookieResponse function| pfCookieResponse function| pfConsentStatus object| google_tag_manager object| google_tag_data string| GoogleAnalyticsObject function| ga object| gaplugins object| gaGlobal object| gaData function| arrive function| unbindArrive function| leave function| unbindLeave

10 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			content.fireeye.com/	1970-01-20 15:58:47	Name: _session_id Value: SmV2c3IzTnlGL2NCWFlSWDdvQ2Y0cTBYUlBlTDJsSUtnRVZVa1RreFdHbkR1SDZuZ3FKNjVxb2pUV3RMeWVtVkx4Q1Z0dHNSMC9pbWR2VjR6UzJlY2VsUXlaS01YWUZGUTRFZlBxZUljUURnM1FhdjNGdFJmTHA5OWNnQXNiMkpEQVQvWTdDVW5FQy81U04wQ2JuQ2xEbTJlSDQwM1JUSDBVRFZtRGpUWlIyQmxDTUNVU3BlKy9ha0FnNUNuSTExZDBYVC9kWmRFVTJlVUgwMnNjRGVSN1FwQk9KZkhqZXR4dVVhMDA3M0xjNDBMaGJ5dm1LZkJKTXp3Yks2UUc2ckRyUDdWLzkxNWExYmhkZkZIRWRVVlIycGJKTkF6WUdxS0NKeFZKRWNLQXM9LS1wZHRQeTV2dlR5WkgzalhmZ3ZCRXh3PT0%3D--fbc5f5a6fee230afe285c5dc1a143ee3e13d1899
			.fireeye.com/	1970-01-20 06:22:49	Name: vid Value: 838bde53-b289-4da8-8b8c-c0c3a5245eae
			content.fireeye.com/	1970-01-20 06:32:52	Name: _an_uid Value: 0
			content.fireeye.com/	1970-01-20 15:58:47	Name: _gd_visitor Value: 84e85c72-f4e2-4732-8350-2c2f3176948c
			content.fireeye.com/	1970-01-20 06:23:01	Name: _gd_session Value: 6c0c57e6-506f-4ff5-8d53-161bc44a0ade
			.fireeye.com/	1970-01-20 15:58:47	Name: _ga Value: GA1.2.533216947.1664567506
			.fireeye.com/	1970-01-20 06:24:13	Name: _gid Value: GA1.2.2141675450.1664567506
			.fireeye.com/	1970-01-20 06:22:47	Name: _gat_gtag_UA_363943_1 Value: 1
			.6sc.co/	1970-01-20 15:58:47	Name: 6suuid Value: cfd5ce17656f0000d248376370010000cef30400
			jukebox.lookbookhq.com/	1970-01-20 15:58:47	Name: _session_id Value: RlJGMnZINGF1U214VzNzNzg1cFJtNllzNml3SXBCenBRdTlyYm1jMjBpOVpTbDZYQTg0ekRlNzNOMkd2ZXZFTVBpODJNT1hMbmZaVjZFSTgxMVVKdlZUQm9tQTNHTUg3bWR3S3NKbE1URmlxcWRnVGRTL0VMRDlvYzZDZ2xITHlkN285YmV1aEx3aHRGaXpjenBiLzlzanlNTWZMVFZWbGhPMm92bFN2U2dtQmNuNUJ4cFJ6ZU9IVy9YM2tIK1pSLS1aT2hEaGJydDJuclNDc0hqcmhIV2FBPT0%3D--65bc0f3394cce8d5863db7a5057d1563c16ff630

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

app.cdn.lookbookhq.com
b.6sc.co
c.6sc.co
cdn-app.pathfactory.com
cdnjs.cloudflare.com
content.fireeye.com
fonts.googleapis.com
ipv6.6sc.co
j.6sc.co
jukebox.lookbookhq.com
maxcdn.bootstrapcdn.com
overpass-30e2.kxcdn.com
secure.adnxs.com
stats.g.doubleclick.net
www.google-analytics.com
www.google.com
www.google.de
www.googletagmanager.com
13.32.99.99
174.129.192.76
185.83.142.19
2001:4860:4802:36::178
2606:4700::6811:190e
2606:4700::6812:bcf
2a00:1450:4001:808::2008
2a00:1450:4001:82a::2004
2a00:1450:400c:c00::5f
2a00:1450:400c:c0c::9d
2a00:1450:400d:805::2003
2a02:26f0:10e:3aa::1c91
2a0b:4d07:401::1
3.90.23.130
96.16.137.162
99.86.159.76
08ea5f20e1b29b8c96059641b4d1f0751994f7c3085743f6f6590e437ad8b36d
2afd3096cd56ed9c34e0824cc276ebdb5ae6576e6e7ebb6faf44aa412c5c6a34
31b45c462302ac175bfa43f9e5591491db780ca094f6ecdd2907f25ad578448d
390aca4ba708128182c4802df7c4a1d3a85566b96bf2542caa3b4ea1f1507c1a
5607c31583a387bc428a264f2c51f7c3e332ca288fc7d98247f604b556ac6fdd
5971de670aef1d6f90a63e6ed8d095ca22f95c455ffc0ceb60be62e30e1a4473
796ed709754d7e243a9533fc7178fa5413351dae6769e56ce09bfddd3c8a9be6
84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80
9e25469f734732205f33dd80ff8ca12080406c18d2fa99a1f368103e51f7999f
ab387a27fa712c46def740a80752bbc8f22e48f2fe710eb13311b38ef1807e97
aca17711b2bcab8335b7bd9c2880033b2aa69a0e9f33ce2e1a507dbb0f9cade3
b25e835722ffbec8ab733d999dc194aa9ef7fcf00edc594e453f2823e0c65fb9
b2a5e7aaecb08fba9b769c0a4d05aad3d5535eaf01bc44f1d7a036cf012aa764
b5d7707ea8fc00aae40bf500ac7498d7f32f6b1bbff7b4fde976a40345eb5f9d
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f3b904c6f2a47ee5e08e8bf566bb31878c6aba75f5058f307381b2c824953f87
fe04a9dc88d3f3be8d4f6bc63a9a80f45a4c6d8460e7551dab849457c091920a