www.fireeye.com Open in urlscan Pro
2606:4700:300b::a29f:f77d Public Scan

Go To Rescan
Add Verdict Report

URL:
https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incid...
Submission: On July 25 via api (July 25th 2020, 3:57:23 am UTC) from US

Summary HTTP 100 Redirects Links 27 Behaviour Indicators

Summary

This website contacted 49 IPs in 9 countries across 44 domains to perform 100 HTTP transactions. The main IP is 2606:4700:300b::a29f:f77d, located in United States and belongs to CLOUDFLARENET, US. The main domain is www.fireeye.com.
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on July 1st 2020. Valid for: a year.

This is the only time www.fireeye.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
28	2606:4700:300... 2606:4700:300b::a29f:f77d	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1 1	184.25.217.53 184.25.217.53	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	13.108.251.7 13.108.251.7	14340 (SALESFORCE) (SALESFORCE)
6	104.17.73.206 104.17.73.206	13335 (CLOUDFLAR...) (CLOUDFLARENET)
5	23.210.248.44 23.210.248.44	16625 (AKAMAI-AS) (AKAMAI-AS)
1	2a00:1450:400... 2a00:1450:4001:816::2008	15169 (GOOGLE) (GOOGLE)
2	2606:4700::68... 2606:4700::6810:262f	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a02:26f0:6c0... 2a02:26f0:6c00:28c::25ea	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
2	2620:1ec:c11:... 2620:1ec:c11::200	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
2 4	2a00:1450:400... 2a00:1450:4001:816::200e	15169 (GOOGLE) (GOOGLE)
1	151.101.112.157 151.101.112.157	54113 (FASTLY) (FASTLY)
1	216.58.212.130 216.58.212.130	15169 (GOOGLE) (GOOGLE)
1 2	172.217.23.134 172.217.23.134	15169 (GOOGLE) (GOOGLE)
2	2a03:2880:f01... 2a03:2880:f01c:8012:face:b00c:0:3	32934 (FACEBOOK) (FACEBOOK)
2	104.109.95.62 104.109.95.62	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	143.204.201.52 143.204.201.52	16509 (AMAZON-02) (AMAZON-02)
1	2606:4700:303... 2606:4700:3036::681b:9d96	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	143.204.201.78 143.204.201.78	16509 (AMAZON-02) (AMAZON-02)
1 1	68.67.153.60 68.67.153.60	29990 (ASN-APPNEX) (ASN-APPNEX)
2 3	185.33.220.243 185.33.220.243	29990 (ASN-APPNEX) (ASN-APPNEX)
1	13.35.254.21 13.35.254.21	16509 (AMAZON-02) (AMAZON-02)
1	143.204.201.28 143.204.201.28	16509 (AMAZON-02) (AMAZON-02)
2 2	2a00:1450:400... 2a00:1450:400c:c0a::9d	15169 (GOOGLE) (GOOGLE)
2 3	2a00:1450:400... 2a00:1450:4001:81d::2004	15169 (GOOGLE) (GOOGLE)
3	2a00:1450:400... 2a00:1450:4001:81a::2003	15169 (GOOGLE) (GOOGLE)
1 2	2a05:f500:11:... 2a05:f500:11:101::b93f:9005	14413 (LINKEDIN) (LINKEDIN)
1 1	2620:1ec:21::14 2620:1ec:21::14	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	104.244.42.133 104.244.42.133	13414 (TWITTER) (TWITTER)
1	2a00:1450:400... 2a00:1450:4001:80b::2002	15169 (GOOGLE) (GOOGLE)
1	2600:9000:214... 2600:9000:214f:9400:1a:2af:6d00:93a1	16509 (AMAZON-02) (AMAZON-02)
1	2001:4de0:ac1... 2001:4de0:ac19::1:b:3a	20446 (HIGHWINDS3) (HIGHWINDS3)
1	2a00:1450:400... 2a00:1450:4001:819::200a	15169 (GOOGLE) (GOOGLE)
1	143.204.201.10 143.204.201.10	16509 (AMAZON-02) (AMAZON-02)
1	18.208.65.88 18.208.65.88	14618 (AMAZON-AES) (AMAZON-AES)
1	143.204.201.123 143.204.201.123	16509 (AMAZON-02) (AMAZON-02)
2	2a03:2880:f11... 2a03:2880:f11c:8183:face:b00c:0:25de	32934 (FACEBOOK) (FACEBOOK)
3	54.81.89.51 54.81.89.51	14618 (AMAZON-AES) (AMAZON-AES)
1 2	34.251.7.133 34.251.7.133	16509 (AMAZON-02) (AMAZON-02)
2	52.86.170.32 52.86.170.32	14618 (AMAZON-AES) (AMAZON-AES)
3	23.34.183.125 23.34.183.125	16625 (AKAMAI-AS) (AKAMAI-AS)
1	2.18.235.40 2.18.235.40	16625 (AKAMAI-AS) (AKAMAI-AS)
1	104.244.42.3 104.244.42.3	13414 (TWITTER) (TWITTER)
1	13.108.251.135 13.108.251.135	14340 (SALESFORCE) (SALESFORCE)
1	182.22.24.124 182.22.24.124	23816 (YAHOO Yah...) (YAHOO Yahoo Japan Corporation)
1	52.57.44.100 52.57.44.100	16509 (AMAZON-02) (AMAZON-02)
1	192.28.147.68 192.28.147.68	53580 (MARKETO) (MARKETO)
1	13.110.67.53 13.110.67.53	14340 (SALESFORCE) (SALESFORCE)
1	183.79.255.28 183.79.255.28	24572 (YAHOO-JP-...) (YAHOO-JP-AS-AP Yahoo Japan)
2	2a00:1288:f03... 2a00:1288:f03d:1fa::2000	10310 (YAHOO-1) (YAHOO-1)
1	54.76.99.142 54.76.99.142	16509 (AMAZON-02) (AMAZON-02)
1	212.82.100.181 212.82.100.181	34010 (YAHOO-IRD) (YAHOO-IRD)
2	143.204.201.104 143.204.201.104	16509 (AMAZON-02) (AMAZON-02)
100	49

28 2606:4700:300b::a29f:f77d (United States)

ASN13335 (CLOUDFLARENET, US)

www.fireeye.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 184.25.217.53 (Netherlands) 1 redirects

ASN20940 (AKAMAI-ASN1, EU)

cloud.typography.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.108.251.7 (United States)

ASN14340 (SALESFORCE, US)
PTR: dcl7-ord.la1-c2-ord.salesforceliveagent.com

c.la2c2.salesforceliveagent.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 104.17.73.206 (United States)

ASN13335 (CLOUDFLARENET, US)

www2.fireeye.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 23.210.248.44 (Netherlands)

ASN16625 (AKAMAI-AS, US)
PTR: a23-210-248-44.deploy.static.akamaitechnologies.com

s7.addthis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
v1.addthisedge.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
m.addthis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:816::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700::6810:262f (United States)

ASN13335 (CLOUDFLARENET, US)

js.maxmind.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:26f0:6c00:28c::25ea (Ascension Island)

ASN20940 (AKAMAI-ASN1, EU)

snap.licdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2620:1ec:c11::200 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

bat.bing.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:816::200e (Frankfurt am Main, Germany) 2 redirects

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.112.157 (Frankfurt am Main, Germany)

ASN54113 (FASTLY, US)

static.ads-twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 216.58.212.130 (Mountain View, United States)

ASN15169 (GOOGLE, US)

www.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 172.217.23.134 (United States) 1 redirects

ASN15169 (GOOGLE, US)

8443343.fls.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f01c:8012:face:b00c:0:3 (Ireland)

ASN32934 (FACEBOOK, US)

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 104.109.95.62 (Netherlands)

ASN20940 (AKAMAI-ASN1, EU)

munchkin.marketo.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 143.204.201.52 (Seattle, United States)

ASN16509 (AMAZON-02, US)

app.cdn.lookbookhq.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:3036::681b:9d96 (United States)

ASN13335 (CLOUDFLARENET, US)

v2.listenloop.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 143.204.201.78 (Seattle, United States)

ASN16509 (AMAZON-02, US)

js.driftt.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 68.67.153.60 (United States) 1 redirects

ASN29990 (ASN-APPNEX, US)

s.ml-attr.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 185.33.220.243 (Netherlands) 2 redirects

ASN29990 (ASN-APPNEX, US)

secure.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.35.254.21 (Seattle, United States)

ASN16509 (AMAZON-02, US)

attr.ml-api.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 143.204.201.28 (Seattle, United States)

ASN16509 (AMAZON-02, US)

lftracker.leadfeeder.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:400c:c0a::9d (Brussels, Belgium) 2 redirects

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:81d::2004 (Frankfurt am Main, Germany) 2 redirects

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:81a::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a05:f500:11:101::b93f:9005 (Ireland) 1 redirects

ASN14413 (LINKEDIN, US)

px.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2620:1ec:21::14 (United States) 1 redirects

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

www.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.244.42.133 (United States)

ASN13414 (TWITTER, US)

t.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:80b::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:214f:9400:1a:2af:6d00:93a1 (United States)

ASN16509 (AMAZON-02, US)

tr.lfeeder.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2001:4de0:ac19::1:b:3a (Netherlands)

ASN20446 (HIGHWINDS3, US)

maxcdn.bootstrapcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:819::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 143.204.201.10 (Seattle, United States)

ASN16509 (AMAZON-02, US)

cdn.pathfactory.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.208.65.88 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)

jukebox.pathfactory.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 143.204.201.123 (Seattle, United States)

ASN16509 (AMAZON-02, US)

widget.driftqa.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f11c:8183:face:b00c:0:25de (Ireland)

ASN32934 (FACEBOOK, US)

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 54.81.89.51 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)

abm2.listenloop.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 34.251.7.133 (Dublin, Ireland) 1 redirects

ASN16509 (AMAZON-02, US)

segment.prod.bidr.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.86.170.32 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)

jukebox.lookbookhq.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 23.34.183.125 (Netherlands)

ASN16625 (AKAMAI-AS, US)

j.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
c.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
b.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2.18.235.40 (Ascension Island)

ASN16625 (AKAMAI-AS, US)

z.moatads.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.244.42.3 (United States)

ASN13414 (TWITTER, US)

analytics.twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.108.251.135 (United States)

ASN14340 (SALESFORCE, US)

d.la2c2.salesforceliveagent.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 182.22.24.124 (Tokyo, Japan)

ASN23816 (YAHOO Yahoo Japan Corporation, JP)

s.yimg.jp	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.57.44.100 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)

epsilon.6sense.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 192.28.147.68 (United States)

ASN53580 (MARKETO, US)

848-did-242.mktoresp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.110.67.53 (United States)

ASN14340 (SALESFORCE, US)

d.la1-c1-ia5.salesforceliveagent.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 183.79.255.28 (Japan)

ASN24572 (YAHOO-JP-AS-AP Yahoo Japan, JP)

b91.yahoo.co.jp	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1288:f03d:1fa::2000 (United Kingdom)

ASN10310 (YAHOO-1, US)

s.yimg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 54.76.99.142 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)

fireeye.tt.omtrdc.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 212.82.100.181 (Switzerland)

ASN34010 (YAHOO-IRD, GB)

sp.analytics.yahoo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 143.204.201.104 (Seattle, United States)

ASN16509 (AMAZON-02, US)

widget.drift.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
34	fireeye.com www.fireeye.com www2.fireeye.com	2 MB
5	doubleclick.net 3 redirects 8443343.fls.doubleclick.net stats.g.doubleclick.net googleads.g.doubleclick.net	3 KB
4	listenloop.com v2.listenloop.com abm2.listenloop.com	60 KB
4	google-analytics.com 2 redirects www.google-analytics.com	19 KB
4	addthis.com s7.addthis.com m.addthis.com	190 KB
3	6sc.co j.6sc.co c.6sc.co b.6sc.co	8 KB
3	linkedin.com 2 redirects px.ads.linkedin.com www.linkedin.com	3 KB
3	google.de www.google.de	365 B
3	google.com 2 redirects www.google.com	487 B
3	adnxs.com 2 redirects secure.adnxs.com	3 KB
3	lookbookhq.com app.cdn.lookbookhq.com jukebox.lookbookhq.com	234 KB
3	salesforceliveagent.com c.la2c2.salesforceliveagent.com d.la2c2.salesforceliveagent.com d.la1-c1-ia5.salesforceliveagent.com	42 KB
2	drift.com widget.drift.com
2	yimg.com s.yimg.com	6 KB
2	bidr.io 1 redirects segment.prod.bidr.io	1 KB
2	facebook.com www.facebook.com	476 B
2	pathfactory.com cdn.pathfactory.com jukebox.pathfactory.com	32 KB
2	marketo.net munchkin.marketo.net	6 KB
2	facebook.net connect.facebook.net	166 KB
2	bing.com bat.bing.com	8 KB
2	maxmind.com js.maxmind.com	2 KB
1	yahoo.com sp.analytics.yahoo.com	528 B
1	omtrdc.net fireeye.tt.omtrdc.net	2 KB
1	yahoo.co.jp b91.yahoo.co.jp	909 B
1	mktoresp.com 848-did-242.mktoresp.com	304 B
1	6sense.com epsilon.6sense.com	562 B
1	yimg.jp s.yimg.jp	2 KB
1	addthisedge.com v1.addthisedge.com	958 B
1	twitter.com analytics.twitter.com	651 B
1	moatads.com z.moatads.com	1 KB
1	driftqa.com widget.driftqa.com	21 KB
1	googleapis.com fonts.googleapis.com	759 B
1	bootstrapcdn.com maxcdn.bootstrapcdn.com	7 KB
1	lfeeder.com tr.lfeeder.com	291 B
1	t.co t.co	448 B
1	leadfeeder.com lftracker.leadfeeder.com	4 KB
1	ml-api.io attr.ml-api.io	484 B
1	ml-attr.com 1 redirects s.ml-attr.com	277 B
1	driftt.com js.driftt.com	70 KB
1	googleadservices.com www.googleadservices.com	12 KB
1	ads-twitter.com static.ads-twitter.com	2 KB
1	licdn.com snap.licdn.com	2 KB
1	googletagmanager.com www.googletagmanager.com	87 KB
1	typography.com 1 redirects cloud.typography.com	456 B
100	44

	Domain	Requested by
28	www.fireeye.com	www.fireeye.com
6	www2.fireeye.com	www.fireeye.com www2.fireeye.com
4	www.google-analytics.com	2 redirects www.googletagmanager.com www.fireeye.com
3	abm2.listenloop.com	www.fireeye.com
3	www.google.de	www.fireeye.com
3	www.google.com	2 redirects www.fireeye.com
3	secure.adnxs.com	2 redirects www.fireeye.com
3	s7.addthis.com	www.fireeye.com s7.addthis.com
2	widget.drift.com	www.fireeye.com
2	s.yimg.com	www.fireeye.com
2	jukebox.lookbookhq.com	www.fireeye.com
2	segment.prod.bidr.io	1 redirects www.fireeye.com
2	www.facebook.com	www.fireeye.com
2	px.ads.linkedin.com	1 redirects www.fireeye.com
2	stats.g.doubleclick.net	2 redirects
2	munchkin.marketo.net	www.googletagmanager.com munchkin.marketo.net
2	connect.facebook.net	www.fireeye.com connect.facebook.net
2	8443343.fls.doubleclick.net	1 redirects www.googletagmanager.com
2	bat.bing.com	www.googletagmanager.com www.fireeye.com
2	js.maxmind.com	www.fireeye.com
1	sp.analytics.yahoo.com	www.fireeye.com
1	fireeye.tt.omtrdc.net	www.fireeye.com
1	b91.yahoo.co.jp	www.fireeye.com
1	d.la1-c1-ia5.salesforceliveagent.com	www.fireeye.com
1	848-did-242.mktoresp.com	www.fireeye.com
1	epsilon.6sense.com	www.fireeye.com
1	s.yimg.jp	www.googletagmanager.com
1	b.6sc.co	www.fireeye.com
1	m.addthis.com	s7.addthis.com
1	v1.addthisedge.com	s7.addthis.com
1	d.la2c2.salesforceliveagent.com	www.fireeye.com
1	analytics.twitter.com	www.fireeye.com
1	z.moatads.com	s7.addthis.com
1	c.6sc.co	www.fireeye.com
1	j.6sc.co	www.fireeye.com
1	widget.driftqa.com	www.fireeye.com
1	jukebox.pathfactory.com	www.fireeye.com
1	cdn.pathfactory.com	www.fireeye.com
1	fonts.googleapis.com	www.fireeye.com
1	maxcdn.bootstrapcdn.com	www.fireeye.com
1	tr.lfeeder.com	www.fireeye.com
1	googleads.g.doubleclick.net	www.fireeye.com
1	t.co	www.fireeye.com
1	www.linkedin.com	1 redirects
1	lftracker.leadfeeder.com	www.fireeye.com
1	attr.ml-api.io	www.fireeye.com
1	s.ml-attr.com	1 redirects
1	js.driftt.com	www.fireeye.com
1	v2.listenloop.com	www.fireeye.com
1	app.cdn.lookbookhq.com	www.fireeye.com
1	www.googleadservices.com	www.googletagmanager.com
1	static.ads-twitter.com	www.googletagmanager.com
1	snap.licdn.com	www.googletagmanager.com
1	www.googletagmanager.com	www.fireeye.com
1	c.la2c2.salesforceliveagent.com	www.fireeye.com
1	cloud.typography.com	1 redirects
100	56

This site contains links to these domains. Also see Links.

Domain
fireeyecommunity.force.com
docs.fireeye.com
partners.fireeye.com
training.fireeye.com
www2.fireeye.com
vision.fireeye.com
fireeye.market
investors.fireeye.com
www.brighttalk.com
www.bleepingcomputer.com
www.proofpoint.com
gallery.technet.microsoft.com
customer.verodin.com
csportal.fireeye.com
community.fireeye.com
www.linkedin.com
twitter.com
www.facebook.com
www.youtube.com
itunes.apple.com
www.fireeye.fr
www.fireeye.de
www.fireeye.jp
www.fireeye.kr
www.addthis.com

Subject Issuer	Validity	Valid
fireeye.com Cloudflare Inc ECC CA-3	`2020-07-01` - `2021-07-01`	a year	crt.sh
la1-c2-ord.salesforceliveagent.com DigiCert SHA2 Secure Server CA	`2020-07-09` - `2021-07-06`	a year	crt.sh
www2.fireeye.com Cloudflare Inc ECC CA-3	`2020-07-05` - `2021-07-05`	a year	crt.sh
odc-prod-01.oracle.com DigiCert Secure Site ECC CA-1	`2020-07-22` - `2021-10-13`	a year	crt.sh
*.google-analytics.com GTS CA 1O1	`2020-07-07` - `2020-09-29`	3 months	crt.sh
*.maxmind.com COMODO RSA Organization Validation Secure Server CA	`2018-10-15` - `2020-11-06`	2 years	crt.sh
*.licdn.com DigiCert SHA2 Secure Server CA	`2019-04-01` - `2021-05-07`	2 years	crt.sh
www.bing.com Microsoft IT TLS CA 2	`2019-04-30` - `2021-04-30`	2 years	crt.sh
ads-twitter.com DigiCert SHA2 High Assurance Server CA	`2019-08-14` - `2020-08-18`	a year	crt.sh
www.googleadservices.com GTS CA 1O1	`2020-07-07` - `2020-09-29`	3 months	crt.sh
*.doubleclick.net GTS CA 1O1	`2020-07-07` - `2020-09-29`	3 months	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2020-07-21` - `2020-10-12`	3 months	crt.sh
*.marketo.net DigiCert SHA2 Secure Server CA	`2020-03-14` - `2021-04-13`	a year	crt.sh
cdn.lookbookhq.com Amazon	`2019-12-06` - `2021-01-06`	a year	crt.sh
sni.cloudflaressl.com CloudFlare Inc ECC CA-2	`2020-02-04` - `2020-10-09`	8 months	crt.sh
drift.com Amazon	`2019-10-03` - `2020-11-03`	a year	crt.sh
*.ml-api.io Amazon	`2020-02-06` - `2021-03-06`	a year	crt.sh
*.leadfeeder.com Amazon	`2020-03-13` - `2021-04-13`	a year	crt.sh
www.google.de GTS CA 1O1	`2020-07-07` - `2020-09-29`	3 months	crt.sh
px.ads.linkedin.com DigiCert SHA2 Secure Server CA	`2020-03-04` - `2020-09-04`	6 months	crt.sh
t.co DigiCert SHA2 High Assurance Server CA	`2020-03-05` - `2021-03-02`	a year	crt.sh
*.g.doubleclick.net GTS CA 1O1	`2020-07-07` - `2020-09-29`	3 months	crt.sh
*.lfeeder.com Amazon	`2019-10-02` - `2020-11-02`	a year	crt.sh
*.bootstrapcdn.com Sectigo RSA Domain Validation Secure Server CA	`2019-09-14` - `2020-10-13`	a year	crt.sh
upload.video.google.com GTS CA 1O1	`2020-07-07` - `2020-09-29`	3 months	crt.sh
*.pathfactory.com Amazon	`2020-04-05` - `2021-05-05`	a year	crt.sh
www.google.com GTS CA 1O1	`2020-07-07` - `2020-09-29`	3 months	crt.sh
driftqa.com Amazon	`2020-02-10` - `2021-03-10`	a year	crt.sh
*.listenloop.com RapidSSL RSA CA 2018	`2019-06-14` - `2021-06-17`	2 years	crt.sh
*.segment.prod.bidr.io Amazon	`2020-03-26` - `2021-04-26`	a year	crt.sh
*.lookbookhq.com Amazon	`2020-04-28` - `2021-05-28`	a year	crt.sh
*.6sc.co DigiCert SHA2 Secure Server CA	`2020-01-07` - `2021-04-07`	a year	crt.sh
*.adnxs.com DigiCert ECC Secure Server CA	`2019-01-23` - `2021-03-08`	2 years	crt.sh
moatads.com DigiCert SHA2 Secure Server CA	`2020-01-17` - `2021-03-17`	a year	crt.sh
*.twitter.com DigiCert SHA2 High Assurance Server CA	`2020-03-05` - `2021-03-02`	a year	crt.sh
*.yahoo.co.jp Cybertrust Japan Public CA G3	`2019-09-24` - `2020-10-23`	a year	crt.sh
*.6sense.com Amazon	`2019-08-16` - `2020-09-16`	a year	crt.sh
*.mktoresp.com DigiCert SHA2 Secure Server CA	`2020-01-17` - `2022-01-21`	2 years	crt.sh
la1-c1-ia5.salesforceliveagent.com DigiCert SHA2 Secure Server CA	`2019-05-14` - `2021-05-13`	2 years	crt.sh
rd.listing.yahoo.co.jp Cybertrust Japan Public CA G3	`2019-08-30` - `2020-09-29`	a year	crt.sh
*.yahoo.com DigiCert SHA2 High Assurance Server CA	`2020-07-02` - `2020-08-16`	a month	crt.sh
*.tt.omtrdc.net DigiCert SHA2 High Assurance Server CA	`2017-10-19` - `2020-11-25`	3 years	crt.sh
*.analytics.yahoo.com DigiCert SHA2 High Assurance Server CA	`2020-03-04` - `2020-08-31`	6 months	crt.sh

This page contains 7 frames:

Primary Page: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html
Frame ID: B603D88E13B12C3B6F2C0CB95CFF7971
Requests: 103 HTTP requests in this frame

Frame: https://8443343.fls.doubleclick.net/activityi;dc_pre=COLiq6jB5-oCFVnRuwgdObwMNA;src=8443343;type=sitew0;cat=firee0;ord=5473167791019;gtm=2wg7f0;auiddc=811955511.1595649423;u1=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2020%2F05%2Ftactics-techniques-procedures-associated-with-maze-ransomware-incidents.html;u2=Navigating%20the%20MAZE%3A%20Tactics%2C%20Techniques%20and%20Procedures%20Associated%20With%20MAZE%20Ransomware%20Incidents%20%7C%20FireEye%20Inc;~oref=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2020%2F05%2Ftactics-techniques-procedures-associated-with-maze-ransomware-incidents.html
Frame ID: 2F4D49B1DF5B4C4F0CE563C6B613235B
Requests: 1 HTTP requests in this frame

Frame: https://s7.addthis.com/static/sh.f48a1a04fe8dbf021b4cda1d.html
Frame ID: 341A31D48507DE40016ED226FF2D0FB1
Requests: 1 HTTP requests in this frame

Frame: https://s7.addthis.com/static/sh.f48a1a04fe8dbf021b4cda1d.html
Frame ID: BA484ECCB1DE690262B9F489E16F544E
Requests: 1 HTTP requests in this frame

Frame: https://www2.fireeye.com/index.php/form/XDFrame
Frame ID: 681714A39B829B032D0E1FF5ECE1E41E
Requests: 2 HTTP requests in this frame

Frame: https://widget.drift.com/core?embedId=wm3vc3smix6y&forceShow=false&skipCampaigns=false&sessionId=8df041b7-45da-4be7-9767-ce63cdc26364&sessionStarted=1595649427&campaignRefreshToken=ade2e7e1-be91-46b8-a2f0-80201d49ca4f
Frame ID: E6A5C60375B5E17BC2C00C415D2505C7
Requests: 1 HTTP requests in this frame

Frame: https://widget.drift.com/core/chat
Frame ID: 98A1289501304A34FB4AB6C8559C4070
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

Adobe Experience Manager (CMS) Expand

Overall confidence: 100%
Detected patterns

script /\/etc\/designs\//i
script /\/etc.clientlibs\//i

Java (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

script /\/etc\/designs\//i
script /\/etc.clientlibs\//i

CloudFlare (CDN) Expand

Overall confidence: 100%
Detected patterns

headers server /^cloudflare$/i

Facebook (Widgets) Expand

Overall confidence: 100%
Detected patterns

script /\/\/connect\.facebook\.net\/[^/]*\/[a-z]*\.js/i

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

script /google-analytics\.com\/(?:ga|urchin|analytics)\.js/i

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i

Page Statistics

100
Requests

99 %
HTTPS

37 %
IPv6

44
Domains

56
Subdomains

49
IPs

9
Countries

3609 kB
Transfer

6991 kB
Size

1
Cookies

27 Outgoing links

These are links going to different origins than the main page.

URL: https://fireeyecommunity.force.com/CustomerCommunity/s/
Title: Customer Portal

Search URL Search Domain Scan URL

URL: https://fireeyecommunity.force.com/CustomerCommunity/s/support-community
Title: Communities

Search URL Search Domain Scan URL

URL: https://docs.fireeye.com/
Title: Documentation Portal

Search URL Search Domain Scan URL

URL: https://partners.fireeye.com/directory/
Title: Partner Locator

Search URL Search Domain Scan URL

URL: http://training.fireeye.com/
Title: Partner Education Center

Search URL Search Domain Scan URL

URL: https://www2.fireeye.com/Partner-Request-LP-New.html
Title: Become a Partner

Search URL Search Domain Scan URL

URL: https://partners.fireeye.com/
Title: Partner Portal

Search URL Search Domain Scan URL

URL: https://vision.fireeye.com/
Title: The Vision – Digital Magazine

Search URL Search Domain Scan URL

URL: https://fireeye.market/
Title: FireEye Market

Search URL Search Domain Scan URL

URL: http://investors.fireeye.com/
Title: Investor Relations

Search URL Search Domain Scan URL

URL: https://www.brighttalk.com/webcast/10469/408167
Title: MAZE ransomware threat in a May 21 webinar

Search URL Search Domain Scan URL

URL: https://www.bleepingcomputer.com/news/security/maze-ransomware-says-computer-type-determines-ransom-amount/
Title: exploit kits

Search URL Search Domain Scan URL

URL: https://www.proofpoint.com/us/threat-insight/post/ta2101-plays-government-imposter-distribute-malware-german-italian-and-us
Title: spam campaigns

Search URL Search Domain Scan URL

URL: https://gallery.technet.microsoft.com/scriptcenter/80647f66-139c-40a4-bb7a-04a2d73d423c#content)
Title: script first posted

Search URL Search Domain Scan URL

URL: https://customer.verodin.com/
Title: Mandiant Security Validation Customer Portal

Search URL Search Domain Scan URL

URL: https://csportal.fireeye.com/secur/login_portal.jsp?orgId=00D3000000063LS&portalId=06030000000pSNE
Title: Customer Portal

Search URL Search Domain Scan URL

URL: https://community.fireeye.com/welcome
Title: Communities

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/company/fireeye
Title: LinkedIn

Search URL Search Domain Scan URL

URL: https://twitter.com/fireeye
Title: Twitter

Search URL Search Domain Scan URL

URL: https://www.facebook.com/FireEye
Title: Facebook

Search URL Search Domain Scan URL

URL: https://www.youtube.com/user/FireEyeInc
Title: YouTube

Search URL Search Domain Scan URL

URL: https://itunes.apple.com/us/podcast/eye-on-security/id1073779629?mt=2
Title: Podcast

Search URL Search Domain Scan URL

URL: https://www.fireeye.fr/
Title: French (Français)

Search URL Search Domain Scan URL

URL: https://www.fireeye.de/
Title: German (Deutsch)

Search URL Search Domain Scan URL

URL: https://www.fireeye.jp/
Title: Japanese (日本語)

Search URL Search Domain Scan URL

URL: https://www.fireeye.kr/
Title: Korean (한국어)

Search URL Search Domain Scan URL

URL: https://www.addthis.com/website-tools/overview?utm_source=AddThis%20Tools&utm_medium=image
Title: AddThis

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 3

https://cloud.typography.com/6746836/6977592/css/fonts.css HTTP 302
https://www.fireeye.com/content/dam/fireeye-www/fw/f/775489/3982EDB9831683D51.css

Request Chain 33

https://8443343.fls.doubleclick.net/activityi;src=8443343;type=sitew0;cat=firee0;ord=5473167791019;gtm=2wg7f0;auiddc=811955511.1595649423;u1=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2020%2F05%2Ftactics-techniques-procedures-associated-with-maze-ransomware-incidents.html;u2=Navigating%20the%20MAZE%3A%20Tactics%2C%20Techniques%20and%20Procedures%20Associated%20With%20MAZE%20Ransomware%20Incidents%20%7C%20FireEye%20Inc;~oref=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2020%2F05%2Ftactics-techniques-procedures-associated-with-maze-ransomware-incidents.html HTTP 302
https://8443343.fls.doubleclick.net/activityi;dc_pre=COLiq6jB5-oCFVnRuwgdObwMNA;src=8443343;type=sitew0;cat=firee0;ord=5473167791019;gtm=2wg7f0;auiddc=811955511.1595649423;u1=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2020%2F05%2Ftactics-techniques-procedures-associated-with-maze-ransomware-incidents.html;u2=Navigating%20the%20MAZE%3A%20Tactics%2C%20Techniques%20and%20Procedures%20Associated%20With%20MAZE%20Ransomware%20Incidents%20%7C%20FireEye%20Inc;~oref=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2020%2F05%2Ftactics-techniques-procedures-associated-with-maze-ransomware-incidents.html

Request Chain 39

https://s.ml-attr.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dfireeye.com%26pId%3d%24UID HTTP 302
https://secure.adnxs.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dfireeye.com%26pId%3d%24UID HTTP 307
https://secure.adnxs.com/bounce?%2Fgetuid%3Fhttps%253a%252f%252fattr.ml-api.io%252f%253fdomain%253dfireeye.com%2526pId%253d%2524UID HTTP 302
https://attr.ml-api.io/?domain=fireeye.com&pId=5037491777373379988

Request Chain 41

https://www.google-analytics.com/r/collect?v=1&_v=j83&a=1653155333&t=pageview&_s=1&dl=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2020%2F05%2Ftactics-techniques-procedures-associated-with-maze-ransomware-incidents.html&ul=en-us&de=UTF-8&dt=Navigating%20the%20MAZE%3A%20Tactics%2C%20Techniques%20and%20Procedures%20Associated%20With%20MAZE%20Ransomware%20Incidents%20%7C%20FireEye%20Inc&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YEBAAEAB~&jid=1473877237&gjid=271236939&cid=716160653.1595649423&tid=UA-363943-1&_gid=1262071136.1595649423&_r=1&gtm=2wg7f0MVGC8KK&cd39=716160653.1595649423&z=2114633882 HTTP 302
https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-363943-1&cid=716160653.1595649423&jid=1473877237&_gid=1262071136.1595649423&gjid=271236939&_v=j83&z=2114633882 HTTP 302
https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-363943-1&cid=716160653.1595649423&jid=1473877237&_v=j83&z=2114633882 HTTP 302
https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-363943-1&cid=716160653.1595649423&jid=1473877237&_v=j83&z=2114633882&slf_rd=1&random=29584241

Request Chain 42

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=6572&url=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2020%2F05%2Ftactics-techniques-procedures-associated-with-maze-ransomware-incidents.html&time=1595649422974 HTTP 302
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D6572%26url%3Dhttps%253A%252F%252Fwww.fireeye.com%252Fblog%252Fthreat-research%252F2020%252F05%252Ftactics-techniques-procedures-associated-with-maze-ransomware-incidents.html%26time%3D1595649422974%26liSync%3Dtrue HTTP 302
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=6572&url=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2020%2F05%2Ftactics-techniques-procedures-associated-with-maze-ransomware-incidents.html&time=1595649422974&liSync=true

Request Chain 58

https://segment.prod.bidr.io/associate-segment?buzz_key=listenloop&segment_key=listenloop-11912&value= HTTP 303
https://segment.prod.bidr.io/associate-segment?buzz_key=listenloop&segment_key=listenloop-11912&value=&_bee_ppp=1

Request Chain 108

https://www.google-analytics.com/r/collect?v=1&_v=j83&a=1653155333&t=event&ni=0&_s=1&dl=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2020%2F05%2Ftactics-techniques-procedures-associated-with-maze-ransomware-incidents.html&ul=en-us&de=UTF-8&dt=Navigating%20the%20MAZE%3A%20Tactics%2C%20Techniques%20and%20Procedures%20Associated%20With%20MAZE%20Ransomware%20Incidents%20%7C%20FireEye%20Inc&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=Site%20Section&ea=FireEye%20Blogs&el=Threat%20Research&ev=0&_u=aHjAAEAB~&jid=1674544131&gjid=977194290&cid=716160653.1595649423&tid=UA-363943-1&_gid=1247463997.1595649427&_r=1&gtm=2wg7f0MVGC8KK&z=1108971003 HTTP 302
https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-363943-1&cid=716160653.1595649423&jid=1674544131&_gid=1247463997.1595649427&gjid=977194290&_v=j83&z=1108971003 HTTP 302
https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-363943-1&cid=716160653.1595649423&jid=1674544131&_v=j83&z=1108971003 HTTP 302
https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-363943-1&cid=716160653.1595649423&jid=1674544131&_v=j83&z=1108971003&slf_rd=1&random=4277967870

100 HTTP transactions
10 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html Show response
www.fireeye.com/blog/threat-research/2020/05/ 116 KB
31 KB 65ms
33ms Document
text/html 2606:4700:300b::a29f:f77d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:300b::a29f:f77d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

414f3b767a63e80c21480cecdef2d5175d813c6d0363feb5580b50ab968a8909

Security Headers

Name	Value
Content-Security-Policy	worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff nosniff
X-Frame-Options	ALLOW-FROM https://content.fireeye.com
X-Xss-Protection	1; mode=block

Request headers

:method: GET
:authority: www.fireeye.com
:scheme: https
:path: /blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status: 200
date: Sat, 25 Jul 2020 03:57:02 GMT
content-type: text/html; charset=UTF-8
set-cookie: __cfduid=df51a1f8e293bdc2ce3851b5edd361f9b1595649422; expires=Mon, 24-Aug-20 03:57:02 GMT; path=/; domain=.fireeye.com; HttpOnly; SameSite=Lax; Secure
cf-ray: 5b82f45bf82cdfef-FRA
age: 804
cache-control: no-cache="set-cookie"
strict-transport-security: max-age=31536000; includeSubDomains
vary: Accept-Encoding,User-Agent
cf-cache-status: HIT
cf-request-id: 0425b70d7c0000dfef219cf200000001
content-security-policy: worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-content-type-options: nosniff nosniff
x-dispatcher: dispatcher1uswest1
x-frame-options: ALLOW-FROM https://content.fireeye.com
x-vhost: publish
x-xss-protection: 1; mode=block
server: cloudflare
content-encoding: gzip

GET
H2 200 jquery.min.js Show response
www.fireeye.com/etc.clientlibs/clientlibs/granite/ 111 KB
38 KB 32ms
32ms Script
application/javascript 2606:4700:300b::a29f:f77d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery.min.js

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:300b::a29f:f77d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b397476bcbcf8c9eae3f82007cc4f9495661b367e02e6d3dea6e15f0610ef20a

Security Headers

Name	Value
Content-Security-Policy	worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff, nosniff
X-Frame-Options	ALLOW-FROM https://content.fireeye.com
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-dispatcher: dispatcher1uswest1
date: Sat, 25 Jul 2020 03:57:02 GMT
content-encoding: gzip
x-content-type-options: nosniff, nosniff
cf-cache-status: HIT
age: 325
x-vhost: publish
status: 200
vary: Accept-Encoding,User-Agent
content-length: 38305
cf-request-id: 0425b70da70000dfef219d1200000001
last-modified: Fri, 26 Jul 2019 09:42:21 GMT
server: cloudflare
x-frame-options: ALLOW-FROM https://content.fireeye.com
etag: "1baa2-58e925bdaf940-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript
x-xss-protection: 1; mode=block
cache-control: no-cache="set-cookie"
content-security-policy: worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
accept-ranges: bytes
cf-ray: 5b82f45c3891dfef-FRA

GET
H2 200 csrf.min.js Show response
www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite/ 4 KB
2 KB 34ms
30ms Script
application/javascript 2606:4700:300b::a29f:f77d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.js

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:300b::a29f:f77d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

fbcc2c7d4dfbc5d0251c789843b8d7edf25306dfa23188ad267e2786357233c0

Security Headers

Name	Value
Content-Security-Policy	worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff, nosniff
X-Frame-Options	ALLOW-FROM https://content.fireeye.com
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-dispatcher: dispatcher2uswest1
date: Sat, 25 Jul 2020 03:57:02 GMT
content-encoding: gzip
x-content-type-options: nosniff, nosniff
cf-cache-status: HIT
age: 899
x-vhost: publish
status: 200
vary: Accept-Encoding,User-Agent
content-length: 1676
cf-request-id: 0425b70dab0000dfef219d2200000001
last-modified: Fri, 26 Jul 2019 09:54:26 GMT
server: cloudflare
x-frame-options: ALLOW-FROM https://content.fireeye.com
etag: "f3e-58e9287119880-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript
x-xss-protection: 1; mode=block
cache-control: no-cache="set-cookie"
content-security-policy: worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
accept-ranges: bytes
cf-ray: 5b82f45c4895dfef-FRA

GET
H2 200 clientlibs_nav.min.js Show response
www.fireeye.com/etc/designs/fireeye-www/ 12 KB
4 KB 45ms
41ms Script
application/javascript 2606:4700:300b::a29f:f77d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.fireeye.com/etc/designs/fireeye-www/clientlibs_nav.min.js

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:300b::a29f:f77d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

84a91ff2a1a995e3816750f53342b4499bfefc817a8ee1a5d4b401433692d510

Security Headers

Name	Value
Content-Security-Policy	worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff, nosniff
X-Frame-Options	ALLOW-FROM https://content.fireeye.com
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-dispatcher: dispatcher2uswest1
date: Sat, 25 Jul 2020 03:57:02 GMT
content-encoding: gzip
x-content-type-options: nosniff, nosniff
cf-cache-status: HIT
age: 899
x-vhost: publish
status: 200
vary: Accept-Encoding,User-Agent
content-length: 3882
cf-request-id: 0425b70dac0000dfef219d6200000001
last-modified: Fri, 24 Apr 2020 04:08:24 GMT
server: cloudflare
x-frame-options: ALLOW-FROM https://content.fireeye.com
etag: "2f77-5a401843bfe00-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript
x-xss-protection: 1; mode=block
cache-control: no-cache="set-cookie"
content-security-policy: worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
accept-ranges: bytes
cf-ray: 5b82f45c48a1dfef-FRA

GET
H2

200

3982EDB9831683D51.css
www.fireeye.com/content/dam/fireeye-www/fw/f/775489/
Redirect Chain

https://cloud.typography.com/6746836/6977592/css/fonts.css
https://www.fireeye.com/content/dam/fireeye-www/fw/f/775489/3982EDB9831683D51.css

293 KB
219 KB

35ms
35ms

Stylesheet
text/css

2606:4700:300b::a29f:f77d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.fireeye.com/content/dam/fireeye-www/fw/f/775489/3982EDB9831683D51.css

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:300b::a29f:f77d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a0a0933f843198c607baaf63f153e3fb5fd900d91f31d37d0f71b53ca66c4ab9

Security Headers

Name	Value
Content-Security-Policy	worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	ALLOW-FROM https://content.fireeye.com
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-dispatcher: dispatcher1uswest1
date: Sat, 25 Jul 2020 03:57:04 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
age: 27711
cf-polished: origSize=301416
x-vhost: publish
status: 200
vary: Accept-Encoding,User-Agent
cf-request-id: 0425b712c30000dfef21a10200000001
last-modified: Wed, 01 Apr 2020 20:06:18 GMT
server: cloudflare
x-frame-options: ALLOW-FROM https://content.fireeye.com
etag: W/"49968-5a240379a0280-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains
content-type: text/css
x-xss-protection: 1; mode=block
content-security-policy: worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
cf-ray: 5b82f4646d7ddfef-FRA
cf-bgj: minify

Redirect headers

Date: Sat, 25 Jul 2020 03:57:04 GMT
Last-Modified: Wed, 01 Apr 2020 20:12:09 GMT
Server: AkamaiNetStorage
ETag: "d0795af83d79e23ccaffb60b4a75e364:1585771928"
Content-Type: text/html
Location: https://www.fireeye.com/content/dam/fireeye-www/fw/f/775489/3982EDB9831683D51.css
Cache-Control: must-revalidate, private
Connection: keep-alive
X-HCo-pid: 14
Content-Length: 154
Expires: Sat, 25 July 2020 03:57:03 GMT

GET
H2 200 patch.css
www.fireeye.com/content/dam/fireeye-www/fw/css/ 543 B
405 B 34ms
31ms Stylesheet
text/css 2606:4700:300b::a29f:f77d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.fireeye.com/content/dam/fireeye-www/fw/css/patch.css

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:300b::a29f:f77d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f08cea88c54a644c35abf8c3b33f3d997ff5bd673b940936f82bb80fcb37b6e2

Security Headers

Name	Value
Content-Security-Policy	worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	ALLOW-FROM https://content.fireeye.com
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-dispatcher: dispatcher2uswest1
date: Sat, 25 Jul 2020 03:57:02 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
age: 29109
cf-polished: origSize=827
x-vhost: publish
status: 200
vary: Accept-Encoding,User-Agent
cf-request-id: 0425b70dab0000dfef219d3200000001
last-modified: Fri, 24 Jul 2020 04:17:04 GMT
server: cloudflare
x-frame-options: ALLOW-FROM https://content.fireeye.com
etag: W/"33b-5ab283ec9b000-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains
content-type: text/css
x-xss-protection: 1; mode=block
cache-control: no-cache="set-cookie"
content-security-policy: worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
cf-ray: 5b82f45c489adfef-FRA
cf-bgj: minify

GET
H2 200 clientlibs_fw-2019.min.css
www.fireeye.com/etc/designs/fireeye-www/ 210 KB
40 KB 28ms
25ms Stylesheet
text/css 2606:4700:300b::a29f:f77d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.fireeye.com/etc/designs/fireeye-www/clientlibs_fw-2019.min.css

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:300b::a29f:f77d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d20cf953b941d38ca8b450334f135fbe787dc4cb8371f4032fda9337cbfd5836

Security Headers

Name	Value
Content-Security-Policy	worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff, nosniff
X-Frame-Options	ALLOW-FROM https://content.fireeye.com
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-dispatcher: dispatcher1uswest1
date: Sat, 25 Jul 2020 03:57:02 GMT
content-encoding: gzip
x-content-type-options: nosniff, nosniff
cf-cache-status: HIT
age: 29109
x-vhost: publish
status: 200
vary: Accept-Encoding,User-Agent
content-length: 41247
cf-request-id: 0425b70dac0000dfef219d4200000001
last-modified: Fri, 29 May 2020 04:36:44 GMT
server: cloudflare
x-frame-options: ALLOW-FROM https://content.fireeye.com
etag: "3467b-5a6c1fe020f00-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains
content-type: text/css
x-xss-protection: 1; mode=block
cache-control: no-cache="set-cookie"
content-security-policy: worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
accept-ranges: bytes
cf-ray: 5b82f45c489ddfef-FRA

GET
H2 200 clientlibs_base.min.css
www.fireeye.com/etc/clientlibs/fireeye-blog/ 5 KB
2 KB 36ms
33ms Stylesheet
text/css 2606:4700:300b::a29f:f77d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.fireeye.com/etc/clientlibs/fireeye-blog/clientlibs_base.min.css

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:300b::a29f:f77d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

757eb886edd9a887fc95b701c88b08191eb743657027636c0c9d4973547ebb4a

Security Headers

Name	Value
Content-Security-Policy	worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff, nosniff
X-Frame-Options	ALLOW-FROM https://content.fireeye.com
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-dispatcher: dispatcher1uswest1
date: Sat, 25 Jul 2020 03:57:02 GMT
content-encoding: gzip
x-content-type-options: nosniff, nosniff
cf-cache-status: HIT
age: 29108
x-vhost: publish
status: 200
vary: Accept-Encoding,User-Agent
content-length: 1501
cf-request-id: 0425b70dac0000dfef219d5200000001
last-modified: Fri, 04 Oct 2019 04:55:04 GMT
server: cloudflare
x-frame-options: ALLOW-FROM https://content.fireeye.com
etag: "1507-5940e81577a00-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains
content-type: text/css
x-xss-protection: 1; mode=block
cache-control: no-cache="set-cookie"
content-security-policy: worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
accept-ranges: bytes
cf-ray: 5b82f45c48a0dfef-FRA

GET
H2 200 utils.min.js Show response
www.fireeye.com/etc.clientlibs/clientlibs/granite/ 10 KB
4 KB 29ms
26ms Script
application/javascript 2606:4700:300b::a29f:f77d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.fireeye.com/etc.clientlibs/clientlibs/granite/utils.min.js

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:300b::a29f:f77d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

799cb15a25ed2fa78bdba496d1afbc68f033a3a5dd9ead12f4eaac4e0a93236d

Security Headers

Name	Value
Content-Security-Policy	worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff, nosniff
X-Frame-Options	ALLOW-FROM https://content.fireeye.com
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-dispatcher: dispatcher1uswest1
date: Sat, 25 Jul 2020 03:57:02 GMT
content-encoding: gzip
x-content-type-options: nosniff, nosniff
cf-cache-status: HIT
age: 12
x-vhost: publish
status: 200
vary: Accept-Encoding,User-Agent
content-length: 3706
cf-request-id: 0425b70dac0000dfef219d7200000001
last-modified: Fri, 26 Jul 2019 09:42:21 GMT
server: cloudflare
x-frame-options: ALLOW-FROM https://content.fireeye.com
etag: "26ad-58e925bdaf940-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript
x-xss-protection: 1; mode=block
cache-control: no-cache="set-cookie"
content-security-policy: worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
accept-ranges: bytes
cf-ray: 5b82f45c48a2dfef-FRA

GET
H2 200 granite.min.js Show response
www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/ 4 KB
2 KB 36ms
33ms Script
application/javascript 2606:4700:300b::a29f:f77d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite.min.js

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:300b::a29f:f77d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c986afd07a4082d65befeef18869a4cd5e00f3ac6e8228d49658802c7453a1b8

Security Headers

Name	Value
Content-Security-Policy	worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff, nosniff
X-Frame-Options	ALLOW-FROM https://content.fireeye.com
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-dispatcher: dispatcher1uswest1
date: Sat, 25 Jul 2020 03:57:02 GMT
content-encoding: gzip
x-content-type-options: nosniff, nosniff
cf-cache-status: HIT
age: 12
x-vhost: publish
status: 200
vary: Accept-Encoding,User-Agent
content-length: 1702
cf-request-id: 0425b70dac0000dfef219d8200000001
last-modified: Fri, 26 Jul 2019 09:42:21 GMT
server: cloudflare
x-frame-options: ALLOW-FROM https://content.fireeye.com
etag: "f90-58e925bdaf940-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript
x-xss-protection: 1; mode=block
cache-control: no-cache="set-cookie"
content-security-policy: worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
accept-ranges: bytes
cf-ray: 5b82f45c48a4dfef-FRA

GET
H2 200 jquery.min.js Show response
www.fireeye.com/etc.clientlibs/foundation/clientlibs/ 16 B
169 B 29ms
26ms Script
application/javascript 2606:4700:300b::a29f:f77d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.fireeye.com/etc.clientlibs/foundation/clientlibs/jquery.min.js

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:300b::a29f:f77d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c084b47104c493fb377b6d35d8c08df67d773f6dcf8294c0a7360710cd8cacbd

Security Headers

Name	Value
Content-Security-Policy	worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff, nosniff
X-Frame-Options	ALLOW-FROM https://content.fireeye.com
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-dispatcher: dispatcher1uswest1
date: Sat, 25 Jul 2020 03:57:02 GMT
x-content-type-options: nosniff, nosniff
cf-cache-status: HIT
age: 12
x-vhost: publish
status: 200
vary: User-Agent, Accept-Encoding
content-length: 16
cf-request-id: 0425b70dac0000dfef219d9200000001
last-modified: Fri, 26 Jul 2019 09:42:45 GMT
server: cloudflare
x-frame-options: ALLOW-FROM https://content.fireeye.com
etag: "10-58e925d492f40"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript
x-xss-protection: 1; mode=block
cache-control: no-cache="set-cookie"
content-security-policy: worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
accept-ranges: bytes
cf-ray: 5b82f45c48a5dfef-FRA

GET
H2 200 shared.min.js Show response
www.fireeye.com/etc.clientlibs/foundation/clientlibs/ 24 KB
7 KB 38ms
36ms Script
application/javascript 2606:4700:300b::a29f:f77d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.fireeye.com/etc.clientlibs/foundation/clientlibs/shared.min.js

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:300b::a29f:f77d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

4086c8cd4c3361452c1c1da9af3034fc90f4a375c4f6195f31d6dcf1c7b56f00

Security Headers

Name	Value
Content-Security-Policy	worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff, nosniff
X-Frame-Options	ALLOW-FROM https://content.fireeye.com
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-dispatcher: dispatcher2uswest1
date: Sat, 25 Jul 2020 03:57:02 GMT
content-encoding: gzip
x-content-type-options: nosniff, nosniff
cf-cache-status: HIT
age: 12
x-vhost: publish
status: 200
vary: Accept-Encoding,User-Agent
content-length: 6920
cf-request-id: 0425b70dac0000dfef219da200000001
last-modified: Fri, 26 Jul 2019 09:54:49 GMT
server: cloudflare
x-frame-options: ALLOW-FROM https://content.fireeye.com
etag: "5e7e-58e9288708c40-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript
x-xss-protection: 1; mode=block
cache-control: no-cache="set-cookie"
content-security-policy: worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
accept-ranges: bytes
cf-ray: 5b82f45c48a6dfef-FRA

GET
H2 200 modern.min.js Show response
www.fireeye.com/etc.clientlibs/clientlibs/granite/lodash/ 34 KB
12 KB 29ms
27ms Script
application/javascript 2606:4700:300b::a29f:f77d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.fireeye.com/etc.clientlibs/clientlibs/granite/lodash/modern.min.js

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:300b::a29f:f77d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

355604a949ef95ceffcd21a7e9b5ed27c95d847f95127e0ddad5aa1793f1bb74

Security Headers

Name	Value
Content-Security-Policy	worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff, nosniff
X-Frame-Options	ALLOW-FROM https://content.fireeye.com
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-dispatcher: dispatcher2uswest1
date: Sat, 25 Jul 2020 03:57:02 GMT
content-encoding: gzip
x-content-type-options: nosniff, nosniff
cf-cache-status: HIT
age: 12
x-vhost: publish
status: 200
vary: Accept-Encoding,User-Agent
content-length: 11784
cf-request-id: 0425b70dac0000dfef219db200000001
last-modified: Tue, 17 Oct 2017 06:49:31 GMT
server: cloudflare
x-frame-options: ALLOW-FROM https://content.fireeye.com
etag: "87c8-55bb8866db4c0-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript
x-xss-protection: 1; mode=block
cache-control: no-cache="set-cookie"
content-security-policy: worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
accept-ranges: bytes
cf-ray: 5b82f45c48a7dfef-FRA

GET
H2 200 kernel.min.js Show response
www.fireeye.com/etc.clientlibs/cq/personalization/clientlib/personalization/ 119 KB
26 KB 34ms
32ms Script
application/javascript 2606:4700:300b::a29f:f77d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.fireeye.com/etc.clientlibs/cq/personalization/clientlib/personalization/kernel.min.js

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:300b::a29f:f77d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

79b2448738716f0daf11d4a206e105e3b79e9d082f9c9bf4ad2bd55e591a1a3c

Security Headers

Name	Value
Content-Security-Policy	worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff, nosniff
X-Frame-Options	ALLOW-FROM https://content.fireeye.com
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-dispatcher: dispatcher1uswest1
date: Sat, 25 Jul 2020 03:57:02 GMT
content-encoding: gzip
x-content-type-options: nosniff, nosniff
cf-cache-status: HIT
age: 12
x-vhost: publish
status: 200
vary: Accept-Encoding,User-Agent
content-length: 26194
cf-request-id: 0425b70dac0000dfef219dc200000001
last-modified: Fri, 26 Jul 2019 09:42:47 GMT
server: cloudflare
x-frame-options: ALLOW-FROM https://content.fireeye.com
etag: "1dd96-58e925d67b3c0-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript
x-xss-protection: 1; mode=block
cache-control: no-cache="set-cookie"
content-security-policy: worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
accept-ranges: bytes
cf-ray: 5b82f45c48a8dfef-FRA

GET
H/1.1 200
OK deployment.js Show response
c.la2c2.salesforceliveagent.com/content/g/js/34.0/ 40 KB
41 KB 694ms
108ms Script
application/javascript 13.108.251.7
SALESFORCE

General

Check archive.org

Show headers Download Go to

Full URL: https://c.la2c2.salesforceliveagent.com/content/g/js/34.0/deployment.js
Requested by: Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 13.108.251.7 , United States, ASN14340 (SALESFORCE, US),
Reverse DNS: dcl7-ord.la1-c2-ord.salesforceliveagent.com
Software: Jetty(9.4.z-SNAPSHOT) /
Resource Hash: 3aadac47cf44df595934bec631a78bf2ba62081ab95528e684a85b4c74453e77

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Sat, 25 Jul 2020 03:57:03 GMT
Cache-Control: max-age=60, must-revalidate
Last-Modified: Fri, 17 Jul 2020 17:41:24 GMT
Server: Jetty(9.4.z-SNAPSHOT)
Accept-Ranges: bytes
Content-Length: 41338
Content-Type: application/javascript

GET
H2 200 fe-logo-color.svg
www.fireeye.com/content/dam/fireeye-www/fw/images/ 3 KB
1 KB 22ms
20ms Image
image/svg+xml 2606:4700:300b::a29f:f77d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fireeye.com/content/dam/fireeye-www/fw/images/fe-logo-color.svg

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:300b::a29f:f77d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f684d50dc9b24df0a4845f688a45b856d945f79d79549240187e171e1655f236

Security Headers

Name	Value
Content-Security-Policy	worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	ALLOW-FROM https://content.fireeye.com
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-dispatcher: dispatcher2uswest1
date: Sat, 25 Jul 2020 03:57:02 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
age: 27964
x-vhost: publish
status: 200
vary: Accept-Encoding,User-Agent
content-length: 1239
cf-request-id: 0425b70de80000dfef219e4200000001
last-modified: Wed, 22 Jul 2020 19:07:05 GMT
server: cloudflare
x-frame-options: ALLOW-FROM https://content.fireeye.com
etag: "cec-5ab0c720d8840-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/svg+xml
x-xss-protection: 1; mode=block
content-security-policy: worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
accept-ranges: bytes
cf-ray: 5b82f45ca94edfef-FRA

GET
H2 200 Picture1.png
www.fireeye.com/content/dam/fireeye-www/blog/images/maze/ 381 KB
381 KB 692ms
689ms Image
image/png 2606:4700:300b::a29f:f77d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fireeye.com/content/dam/fireeye-www/blog/images/maze/Picture1.png

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:300b::a29f:f77d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

1755acef8199c66af06c7e1d318bb90542a3053412575d978dcb6dafad7cd98b

Security Headers

Name	Value
Content-Security-Policy	worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	ALLOW-FROM https://content.fireeye.com
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-dispatcher: dispatcher2uswest1
date: Sat, 25 Jul 2020 03:57:03 GMT
x-content-type-options: nosniff
cf-cache-status: REVALIDATED
cf-polished: origSize=591321
x-vhost: publish
status: 200
vary: Accept-Encoding
content-length: 389632
cf-request-id: 0425b70de80000dfef219e5200000001
last-modified: Thu, 07 May 2020 19:42:31 GMT
server: cloudflare
x-frame-options: ALLOW-FROM https://content.fireeye.com
etag: "905d9-5a51414d537c0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/png
x-xss-protection: 1; mode=block
cache-control: no-cache="set-cookie"
content-security-policy: worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
accept-ranges: bytes
cf-ray: 5b82f45ca94fdfef-FRA
cf-bgj: imgq:85,h2pri

GET
H2 200 Picture2.png
www.fireeye.com/content/dam/fireeye-www/blog/images/maze/ 233 KB
234 KB 657ms
655ms Image
image/png 2606:4700:300b::a29f:f77d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fireeye.com/content/dam/fireeye-www/blog/images/maze/Picture2.png

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:300b::a29f:f77d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

771f01c80b031bd10d587c781474cc0f896b4d08a20356fdef47b0eb2e586b6d

Security Headers

Name	Value
Content-Security-Policy	worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	ALLOW-FROM https://content.fireeye.com
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-dispatcher: dispatcher2uswest1
date: Sat, 25 Jul 2020 03:57:03 GMT
x-content-type-options: nosniff
cf-cache-status: REVALIDATED
cf-polished: origSize=385644
x-vhost: publish
status: 200
vary: Accept-Encoding
content-length: 238920
cf-request-id: 0425b70de80000dfef219e6200000001
last-modified: Thu, 07 May 2020 19:42:32 GMT
server: cloudflare
x-frame-options: ALLOW-FROM https://content.fireeye.com
etag: "5e26c-5a51414e47a00"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/png
x-xss-protection: 1; mode=block
cache-control: no-cache="set-cookie"
content-security-policy: worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
accept-ranges: bytes
cf-ray: 5b82f45ca950dfef-FRA
cf-bgj: imgq:85,h2pri

GET
H2 200 Picture3.png
www.fireeye.com/content/dam/fireeye-www/blog/images/maze/ 165 KB
165 KB 665ms
663ms Image
image/png 2606:4700:300b::a29f:f77d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fireeye.com/content/dam/fireeye-www/blog/images/maze/Picture3.png

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:300b::a29f:f77d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a968b17677c357d33a924969a798e009e63d3c6667e41f8997c9804007f17fe0

Security Headers

Name	Value
Content-Security-Policy	worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	ALLOW-FROM https://content.fireeye.com
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-dispatcher: dispatcher1uswest1
date: Sat, 25 Jul 2020 03:57:03 GMT
x-content-type-options: nosniff
cf-cache-status: REVALIDATED
cf-polished: origSize=169029
x-vhost: publish
status: 200
vary: Accept-Encoding
content-length: 168888
cf-request-id: 0425b70de80000dfef219e7200000001
last-modified: Thu, 07 May 2020 19:42:33 GMT
server: cloudflare
x-frame-options: ALLOW-FROM https://content.fireeye.com
etag: "29445-5a51414f3bc40"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/png
x-xss-protection: 1; mode=block
cache-control: no-cache="set-cookie"
content-security-policy: worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
accept-ranges: bytes
cf-ray: 5b82f45ca951dfef-FRA
cf-bgj: imgq:85,h2pri

GET
H2 200 Picture4.png
www.fireeye.com/content/dam/fireeye-www/blog/images/maze/ 286 KB
287 KB 686ms
684ms Image
image/png 2606:4700:300b::a29f:f77d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fireeye.com/content/dam/fireeye-www/blog/images/maze/Picture4.png

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:300b::a29f:f77d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

553a661ebca404c9efff0b67e7c71f3dfd78a53d0c8fb6a498c914d7910772af

Security Headers

Name	Value
Content-Security-Policy	worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	ALLOW-FROM https://content.fireeye.com
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-dispatcher: dispatcher2uswest1
date: Sat, 25 Jul 2020 03:57:03 GMT
x-content-type-options: nosniff
cf-cache-status: REVALIDATED
cf-polished: origSize=333586
x-vhost: publish
status: 200
vary: Accept-Encoding
content-length: 293289
cf-request-id: 0425b70de80000dfef219e8200000001
last-modified: Thu, 07 May 2020 19:42:33 GMT
server: cloudflare
x-frame-options: ALLOW-FROM https://content.fireeye.com
etag: "51712-5a51414f3bc40"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/png
x-xss-protection: 1; mode=block
cache-control: no-cache="set-cookie"
content-security-policy: worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
accept-ranges: bytes
cf-ray: 5b82f45ca953dfef-FRA
cf-bgj: imgq:85,h2pri

GET
H2 200 Picture5.png
www.fireeye.com/content/dam/fireeye-www/blog/images/maze/ 234 KB
234 KB 690ms
689ms Image
image/png 2606:4700:300b::a29f:f77d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fireeye.com/content/dam/fireeye-www/blog/images/maze/Picture5.png

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:300b::a29f:f77d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

cdb1913bcbe7fc4c6b5275adaa24244fd793424baef358810990b57b5c686ac7

Security Headers

Name	Value
Content-Security-Policy	worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	ALLOW-FROM https://content.fireeye.com
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-dispatcher: dispatcher1uswest1
date: Sat, 25 Jul 2020 03:57:03 GMT
x-content-type-options: nosniff
cf-cache-status: REVALIDATED
cf-polished: origSize=239307
x-vhost: publish
status: 200
vary: Accept-Encoding
content-length: 239118
cf-request-id: 0425b70de80000dfef219e9200000001
last-modified: Thu, 07 May 2020 19:42:34 GMT
server: cloudflare
x-frame-options: ALLOW-FROM https://content.fireeye.com
etag: "3a6cb-5a5141502fe80"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/png
x-xss-protection: 1; mode=block
cache-control: no-cache="set-cookie"
content-security-policy: worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
accept-ranges: bytes
cf-ray: 5b82f45ca954dfef-FRA
cf-bgj: imgq:85,h2pri

GET
H2 200 email-decode.min.js Show response
www.fireeye.com/cdn-cgi/scripts/5c5dd728/cloudflare-static/ 1 KB
838 B 11ms
8ms Script
application/javascript 2606:4700:300b::a29f:f77d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.fireeye.com/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:300b::a29f:f77d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sat, 25 Jul 2020 03:57:02 GMT
content-encoding: gzip
vary: Accept-Encoding
last-modified: Thu, 23 Jul 2020 16:13:23 GMT
server: cloudflare
etag: W/"5f19b723-4d7"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-frame-options: SAMEORIGIN
content-type: application/javascript
status: 200
cache-control: max-age=172800, public
cf-ray: 5b82f45ca94bdfef-FRA
cf-request-id: 0425b70de80000dfef219e2200000001
expires: Mon, 27 Jul 2020 03:57:02 GMT

GET
H2 200 blog-vision-edition7.gif
www.fireeye.com/content/dam/fireeye-www/blog/images/ 570 KB
571 KB 29ms
28ms Image
image/gif 2606:4700:300b::a29f:f77d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fireeye.com/content/dam/fireeye-www/blog/images/blog-vision-edition7.gif

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:300b::a29f:f77d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5062a8070951a1c77103a1bb6d96a11f185c50e4ee7b317320a8588243f6d828

Security Headers

Name	Value
Content-Security-Policy	worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	ALLOW-FROM https://content.fireeye.com
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-dispatcher: dispatcher1uswest1
date: Sat, 25 Jul 2020 03:57:02 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
age: 891
cf-polished: origSize=592867
x-vhost: publish
status: 200
vary: Accept-Encoding
content-length: 584046
cf-request-id: 0425b70de80000dfef219ea200000001
last-modified: Thu, 04 Jun 2020 22:12:02 GMT
server: cloudflare
x-frame-options: ALLOW-FROM https://content.fireeye.com
etag: "90be3-5a7496f1a5080"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
x-xss-protection: 1; mode=block
cache-control: no-cache="set-cookie"
content-security-policy: worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
accept-ranges: bytes
cf-ray: 5b82f45ca955dfef-FRA
cf-bgj: imgq:85,h2pri

GET
H2 200 forms2.min.js Show response
www2.fireeye.com/js/forms2/js/ 203 KB
68 KB 102ms
24ms Script
application/x-javascript 104.17.73.206
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www2.fireeye.com/js/forms2/js/forms2.min.js

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

104.17.73.206 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

30b92b1d67692c95ef6d322b21cb9e0c2f7d5a4c68c05b4e3e3e87489ec41309

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sat, 25 Jul 2020 03:57:02 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
age: 4939
status: 200
cf-request-id: 0425b70e370000cd8fee82e200000001
last-modified: Sat, 06 Jun 2020 07:41:36 GMT
server: cloudflare
etag: "4617e8-32dcc-5a76581e289b9"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: public, max-age=14400
cf-ray: 5b82f45d2db9cd8f-CDG
expires: Sat, 25 Jul 2020 07:57:02 GMT

GET
H2 200 clientlibs_fw.min.js Show response
www.fireeye.com/etc/designs/fireeye-www/ 164 KB
49 KB 26ms
23ms Script
application/javascript 2606:4700:300b::a29f:f77d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.fireeye.com/etc/designs/fireeye-www/clientlibs_fw.min.js

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:300b::a29f:f77d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0590bf440f1352fb0ef85c8f6c4c50ccfa58715f148ba274078f5a574d54450d

Security Headers

Name	Value
Content-Security-Policy	worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff, nosniff
X-Frame-Options	ALLOW-FROM https://content.fireeye.com
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-dispatcher: dispatcher2uswest1
date: Sat, 25 Jul 2020 03:57:02 GMT
content-encoding: gzip
x-content-type-options: nosniff, nosniff
cf-cache-status: HIT
age: 325
x-vhost: publish
status: 200
vary: Accept-Encoding,User-Agent
content-length: 50458
cf-request-id: 0425b70de80000dfef219e3200000001
last-modified: Fri, 24 Jul 2020 06:42:42 GMT
server: cloudflare
x-frame-options: ALLOW-FROM https://content.fireeye.com
etag: "28e32-5ab2a479cfc80-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript
x-xss-protection: 1; mode=block
cache-control: no-cache="set-cookie"
content-security-policy: worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
accept-ranges: bytes
cf-ray: 5b82f45ca94ddfef-FRA

GET
H2 200 addthis_widget.js Show response
s7.addthis.com/js/300/ 353 KB
114 KB 35ms
13ms Script
application/javascript 23.210.248.44
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://s7.addthis.com/js/300/addthis_widget.js

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.210.248.44 , Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-210-248-44.deploy.static.akamaitechnologies.com

Software

nginx/1.15.8 /

Resource Hash

eb12a261a24e54883613710a4c12f4d9205f634ca1a29d1df07f90105a93e746

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=15724800; includeSubDomains
content-encoding: gzip
last-modified: Thu, 04 Jun 2020 15:49:19 GMT
server: nginx/1.15.8
etag: W/"5ed917ff-5834c"
vary: Accept-Encoding
x-distribution: 99
content-type: application/javascript
status: 200
cache-control: public, max-age=600
date: Sat, 25 Jul 2020 03:57:02 GMT
x-host: s7.addthis.com
content-length: 116324

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 292 KB
87 KB 36ms
34ms Script
application/javascript 2a00:1450:4001:816::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-MVGC8KK

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:816::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

9d9b4530e8bfa71ef5fbdfbb9a8c08b126244321b2ee060849bff635d4551329

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sat, 25 Jul 2020 03:57:02 GMT
content-encoding: br
vary: Accept-Encoding
status: 200
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 89426
x-xss-protection: 0
last-modified: Sat, 25 Jul 2020 03:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Sat, 25 Jul 2020 03:57:02 GMT

GET
H2 200 token.json Show response
www.fireeye.com/libs/granite/csrf/ 2 B
476 B 699ms
699ms XHR
application/json 2606:4700:300b::a29f:f77d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.fireeye.com/libs/granite/csrf/token.json

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:300b::a29f:f77d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Security Headers

Name	Value
Content-Security-Policy	worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff, nosniff
X-Frame-Options	ALLOW-FROM https://content.fireeye.com
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-dispatcher: dispatcher2uswest1
date: Sat, 25 Jul 2020 03:57:03 GMT
x-content-type-options: nosniff, nosniff
cf-cache-status: DYNAMIC
x-vhost: publish
status: 200
vary: User-Agent, Accept-Encoding
content-length: 2
cf-request-id: 0425b70de30000dfef219e1200000001
server: cloudflare
x-frame-options: ALLOW-FROM https://content.fireeye.com
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/json;charset=iso-8859-1
x-xss-protection: 1; mode=block
cache-control: no-cache, no-cache="set-cookie"
content-security-policy: worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
cf-ray: 5b82f45c993ddfef-FRA
expires: -1

GET
H2 200 me Show response
js.maxmind.com/geoip/v2.1/country/ 771 B
1 KB 72ms
53ms XHR
application/vnd.maxmind.com-country+json 2606:4700::6810:262f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js.maxmind.com/geoip/v2.1/country/me?referrer=https%3A%2F%2Fwww.fireeye.com
Requested by: Host: www.fireeye.com
URL: https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6810:262f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4d0e25f8bb3e86a79810cbef186fcf12d3355c679beb0c8a295c0f8dfe361b41

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sat, 25 Jul 2020 03:57:02 GMT
cf-cache-status: DYNAMIC
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
status: 200
content-type: application/vnd.maxmind.com-country+json; charset=UTF-8; version=2.1
access-control-allow-origin: *
cf-ray: 5b82f45ccb3fc281-FRA
content-length: 771
cf-request-id: 0425b70df90000c281b0a46200000001

GET
H/1.1 200
OK insight.min.js Show response
snap.licdn.com/li.lms-analytics/ 3 KB
2 KB 22ms
7ms Script
application/x-javascript 2a02:26f0:6c00:28c::25ea
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://snap.licdn.com/li.lms-analytics/insight.min.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MVGC8KK
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:6c00:28c::25ea , Ascension Island, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS
Software: /
Resource Hash: 41dd5e421fe221a7d2921d6fa2b36e8b01a9f2c054aaef5fad866fe896c1d1e0

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Sat, 25 Jul 2020 03:57:02 GMT
Content-Encoding: gzip
Last-Modified: Mon, 07 Oct 2019 16:41:31 GMT
X-CDN: AKAM
Vary: Accept-Encoding
Content-Type: application/x-javascript;charset=utf-8
Cache-Control: max-age=9506
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 1576

GET
H2 200 bat.js Show response
bat.bing.com/ 26 KB
8 KB 28ms
27ms Script
application/javascript 2620:1ec:c11::200
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://bat.bing.com/bat.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MVGC8KK
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: 5c622f5433cbb6ea1df5c0dd8671e55ef7d1464366074730473c453de50a579b

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sat, 25 Jul 2020 03:57:02 GMT
content-encoding: gzip
last-modified: Thu, 16 Jul 2020 20:00:00 GMT
x-msedge-ref: Ref A: E6C625E1DC1047D28A44C75DE09CD8C1 Ref B: FRAEDGE1413 Ref C: 2020-07-25T03:57:02Z
status: 200
etag: "0e0bdafab5bd61:0"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: private,max-age=1800
accept-ranges: bytes
content-length: 8022

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 45 KB
18 KB 6ms
5ms Script
text/javascript 2a00:1450:4001:816::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MVGC8KK

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:816::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

fd361b57998c76f86335afa28b8a62527d88a8200fb5c428d6f0fff73383e955

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Thu, 04 Jun 2020 23:38:14 GMT
server: Golfe2
age: 6083
date: Sat, 25 Jul 2020 02:15:39 GMT
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: public, max-age=7200
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 18469
expires: Sat, 25 Jul 2020 04:15:39 GMT

GET
H2 200 uwt.js Show response
static.ads-twitter.com/ 5 KB
2 KB 27ms
7ms Script
application/javascript 151.101.112.157
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://static.ads-twitter.com/uwt.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MVGC8KK
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.112.157 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 319949c8c08b86e9c35ea542c0dc0c30cedaa9b8d3d3c3327a36c91aefbd8af5

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sat, 25 Jul 2020 03:57:02 GMT
content-encoding: gzip
age: 23105
x-cache: HIT
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
status: 200
content-length: 1954
x-served-by: cache-hhn4036-HHN
last-modified: Tue, 23 Jan 2018 20:09:00 GMT
x-timer: S1595649423.948480,VS0,VE0
etag: "b7b33882a4f3ffd5cbf07434f3137166+gzip"
vary: Accept-Encoding,Host
content-type: application/javascript; charset=utf-8
via: 1.1 varnish
cache-control: no-cache
accept-ranges: bytes

GET
H2 200 conversion_async.js Show response
www.googleadservices.com/pagead/ 29 KB
12 KB 49ms
17ms Script
text/javascript 216.58.212.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/conversion_async.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MVGC8KK

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

216.58.212.130 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

71aa66e3c94df617c70a1b9530acaa18c9f049d6d29dbaa6d0efe84d7104805a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sat, 25 Jul 2020 03:57:02 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 11323
x-xss-protection: 0
server: cafe
etag: 17153042000983114910
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Sat, 25 Jul 2020 03:57:02 GMT

GET
H2

200

activityi;dc_pre=COLiq6jB5-oCFVnRuwgdObwMNA;src=8443343;type=sitew0;cat=firee0;ord=5473167791019;gtm=2wg7f0;auiddc=811955511.1595649423;u1=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2...
8443343.fls.doubleclick.net/ Frame 2F4D
Redirect Chain

https://8443343.fls.doubleclick.net/activityi;src=8443343;type=sitew0;cat=firee0;ord=5473167791019;gtm=2wg7f0;auiddc=811955511.1595649423;u1=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2...
https://8443343.fls.doubleclick.net/activityi;dc_pre=COLiq6jB5-oCFVnRuwgdObwMNA;src=8443343;type=sitew0;cat=firee0;ord=5473167791019;gtm=2wg7f0;auiddc=811955511.1595649423;u1=https%3A%2F%2Fwww.fire...

0
0

17ms
17ms

Document
text/html

172.217.23.134
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://8443343.fls.doubleclick.net/activityi;dc_pre=COLiq6jB5-oCFVnRuwgdObwMNA;src=8443343;type=sitew0;cat=firee0;ord=5473167791019;gtm=2wg7f0;auiddc=811955511.1595649423;u1=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2020%2F05%2Ftactics-techniques-procedures-associated-with-maze-ransomware-incidents.html;u2=Navigating%20the%20MAZE%3A%20Tactics%2C%20Techniques%20and%20Procedures%20Associated%20With%20MAZE%20Ransomware%20Incidents%20%7C%20FireEye%20Inc;~oref=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2020%2F05%2Ftactics-techniques-procedures-associated-with-maze-ransomware-incidents.html?

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MVGC8KK

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.23.134 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: 8443343.fls.doubleclick.net
:scheme: https
:path: /activityi;dc_pre=COLiq6jB5-oCFVnRuwgdObwMNA;src=8443343;type=sitew0;cat=firee0;ord=5473167791019;gtm=2wg7f0;auiddc=811955511.1595649423;u1=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2020%2F05%2Ftactics-techniques-procedures-associated-with-maze-ransomware-incidents.html;u2=Navigating%20the%20MAZE%3A%20Tactics%2C%20Techniques%20and%20Procedures%20Associated%20With%20MAZE%20Ransomware%20Incidents%20%7C%20FireEye%20Inc;~oref=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2020%2F05%2Ftactics-techniques-procedures-associated-with-maze-ransomware-incidents.html?
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: about:blank

Response headers

status: 200
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
date: Sat, 25 Jul 2020 03:57:02 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, must-revalidate
strict-transport-security: max-age=21600
content-type: text/html; charset=UTF-8
pragma: no-cache
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 531
x-xss-protection: 0
set-cookie: test_cookie=CheckForPermission; expires=Sat, 25-Jul-2020 04:12:02 GMT; path=/; domain=.doubleclick.net; Secure; SameSite=none
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

Redirect headers

status: 302
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
date: Sat, 25 Jul 2020 03:57:02 GMT
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, must-revalidate
follow-only-when-prerender-shown: 1
strict-transport-security: max-age=21600
location: https://8443343.fls.doubleclick.net/activityi;dc_pre=COLiq6jB5-oCFVnRuwgdObwMNA;src=8443343;type=sitew0;cat=firee0;ord=5473167791019;gtm=2wg7f0;auiddc=811955511.1595649423;u1=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2020%2F05%2Ftactics-techniques-procedures-associated-with-maze-ransomware-incidents.html;u2=Navigating%20the%20MAZE%3A%20Tactics%2C%20Techniques%20and%20Procedures%20Associated%20With%20MAZE%20Ransomware%20Incidents%20%7C%20FireEye%20Inc;~oref=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2020%2F05%2Ftactics-techniques-procedures-associated-with-maze-ransomware-incidents.html?
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
server: cafe
content-length: 0
x-xss-protection: 0
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 fbevents.js Show response
connect.facebook.net/en_US/ 134 KB
34 KB 20ms
6ms Script
application/x-javascript 2a03:2880:f01c:8012:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f01c:8012:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

f630c6ea4e44c35a93c0ee2950e68857311d9500d6025abe4a5db3ecaf270e3c

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob:;script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .virtualearth.net .google.com 127.0.0.1:* .spotilocal.com: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net .spotilocal.com: wss://.facebook.com: https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
status: 200
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 34220
x-xss-protection: 0
pragma: public
x-fb-debug: 6fFb8jo4YtJLyohO7h6J+R0ziyvlsQGvwq5M7fDM2VO5ZolLCYmwE6I0RlN4nT+CV0+Csj9w87od0ro31b9LUQ==
x-fb-trip-id: 664085054
x-frame-options: DENY
date: Sat, 25 Jul 2020 03:57:02 GMT
vary: Accept-Encoding
content-type: application/x-javascript; charset=utf-8
cache-control: public, max-age=1200
content-security-policy: default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H/1.1 200
OK munchkin.js Show response
munchkin.marketo.net/ 1 KB
1 KB 177ms
7ms Script
application/x-javascript 104.109.95.62
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://munchkin.marketo.net/munchkin.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MVGC8KK
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.109.95.62 , Netherlands, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: e33257e40a5420d325cbdd826a42403d63e4fa3c32efb3d7a4b3596aa0541a64

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Sat, 25 Jul 2020 03:57:03 GMT
Content-Encoding: gzip
Last-Modified: Fri, 10 Jul 2020 02:50:40 GMT
Server: AkamaiNetStorage
ETag: "bc06a6fbc5f82b85379e5482b06ad372:1594349440.875338"
Vary: Accept-Encoding
P3P: policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR"
Connection: keep-alive
Accept-Ranges: bytes
Content-Type: application/x-javascript
Content-Length: 760

GET
H2 200 jukebox.js Show response
app.cdn.lookbookhq.com/production/jukebox/current/ 939 KB
233 KB 49ms
9ms Script
text/javascript 143.204.201.52
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://app.cdn.lookbookhq.com/production/jukebox/current/jukebox.js
Requested by: Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 143.204.201.52 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: ffd2814d8b7dfe4aaeb635596f0259871e16ad9dce8ee04e25edff58b8b425f3

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-amz-version-id: null
content-encoding: gzip
last-modified: Thu, 23 Jul 2020 00:53:09 GMT
server: AmazonS3
age: 10825
date: Sat, 25 Jul 2020 00:56:37 GMT
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: text/javascript
status: 200
cache-control: max-age=43200
x-amz-cf-pop: FRA53-C1
x-amz-cf-id: kn6Lu7_7R6mkg0Skpsp2Cu-x4Zv2T7MlI0_Njk13SdOOr2MOFp5UGg==
via: 1.1 cc77875ec7dfc885cffaa2ec6fa578f6.cloudfront.net (CloudFront)

GET
H2 200 loop.bundle.js Show response
v2.listenloop.com/ 175 KB
58 KB 80ms
32ms Script
application/javascript 2606:4700:3036::681b:9d96
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://v2.listenloop.com/loop.bundle.js
Requested by: Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3036::681b:9d96 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 880b294f78530ed392f3e5e9c35d9f3a3e761e0855312edd340d8df857cf5069

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sat, 25 Jul 2020 03:57:03 GMT
content-encoding: br
cf-cache-status: HIT
age: 1608
status: 200
x-amz-request-id: C49975C7D60ECA02
x-amz-id-2: kEPg/W/diOotiWLeRaj/CCHtIKETKT67kQu5SodxrdeCGvUVK4x+gGoXFoJrasLSOyR/bZL9tHA=
last-modified: Fri, 24 Jul 2020 13:11:51 GMT
server: cloudflare
etag: W/"25e3e7eca5f7c8266090c0aa64353ae8"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=1800
cf-request-id: 0425b70e8a0000bf23cd957200000001
cf-ray: 5b82f45dafdcbf23-FRA

GET
H2 200 wm3vc3smix6y.js Show response
js.driftt.com/include/1595649600000/ 243 KB
70 KB 147ms
124ms Script
application/javascript 143.204.201.78
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/include/1595649600000/wm3vc3smix6y.js

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

143.204.201.78 Seattle, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

98204ac22dba30568464061966f90acb7872abdd8c432867274b05a6a2bc9d75

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
content-encoding: gzip
x-amz-cf-pop: FRA53-C1
x-amz-server-side-encryption: AES256
x-cache: RefreshHit from cloudfront
status: 200
access-control-allow-origin: *
last-modified: Thu, 23 Jul 2020 19:40:58 GMT
server: nginx
date: Sat, 25 Jul 2020 03:57:03 GMT
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=UTF-8
via: 1.1 997f66fda0069dac50a85c7a4fa51b7e.cloudfront.net (CloudFront)
cache-control: no-cache
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: P8m79TLoeslSQWckyrnOck1Amuzjy0TO0fpN8onkIqfnijooEuHctw==

GET
H/1.1

200
OK

/
attr.ml-api.io/
Redirect Chain

https://s.ml-attr.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dfireeye.com%26pId%3d%24UID
https://secure.adnxs.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dfireeye.com%26pId%3d%24UID
https://secure.adnxs.com/bounce?%2Fgetuid%3Fhttps%253a%252f%252fattr.ml-api.io%252f%253fdomain%253dfireeye.com%2526pId%253d%2524UID
https://attr.ml-api.io/?domain=fireeye.com&pId=5037491777373379988

4 B
484 B

425ms
337ms

Image
image/jpeg

13.35.254.21
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://attr.ml-api.io/?domain=fireeye.com&pId=5037491777373379988
Requested by: Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 13.35.254.21 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Sat, 25 Jul 2020 03:57:03 GMT
Via: 1.1 1277de71b2472d19ca0bfc510db9ec54.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: FRA6-C1
x-amzn-RequestId: 0ad80f50-b696-42a9-b92a-02ddba888f16
X-Cache: Miss from cloudfront
Content-Type: image/jpeg
X-Amzn-Trace-Id: Root=1-5f1bad8f-fc02b1c49624026c331dd230;Sampled=0
Connection: keep-alive
x-amz-apigw-id: QNgOdECfoAMFUew=
Content-Length: 4
X-Amz-Cf-Id: nwMW6V-TZpxma9s7h60__Z3gjYXo-TTONPrtHWTHArLwvXSfbmfNXg==

Redirect headers

Pragma: no-cache
Date: Sat, 25 Jul 2020 03:57:03 GMT
X-Proxy-Origin: 185.220.70.68; 185.220.70.68; 722.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.220.234:80
AN-X-Request-Uuid: 4e54aefb-04aa-4510-b93a-02f655eb10f7
Server: nginx/1.13.4
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://attr.ml-api.io/?domain=fireeye.com&pId=5037491777373379988
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 lftracker_v1_3P1w24dgrmJ7mY5n.js Show response
lftracker.leadfeeder.com/ 10 KB
4 KB 82ms
20ms Script
application/javascript 143.204.201.28
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://lftracker.leadfeeder.com/lftracker_v1_3P1w24dgrmJ7mY5n.js
Requested by: Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 143.204.201.28 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: c12b0339ae4601edf3d549f50b7996d241b44ac2a4d1268adf7d8a0695ccb142

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sat, 25 Jul 2020 03:57:03 GMT
content-encoding: gzip
last-modified: Thu, 23 Jul 2020 09:23:02 GMT
server: AmazonS3
x-amz-cf-pop: FRA53-C1
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
status: 200
cache-control: max-age=3600
x-amz-cf-id: 4GiZUwmIdyXhk477M4amtAblOpz6LYKIhfr8AAyjYJ-IkanvNIvDuA==
via: 1.1 660f4277d8fbef27985e8a4a97e362cc.cloudfront.net (CloudFront)

GET
H2

200

ga-audiences
www.google.de/ads/
Redirect Chain

https://www.google-analytics.com/r/collect?v=1&_v=j83&a=1653155333&t=pageview&_s=1&dl=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2020%2F05%2Ftactics-techniques-procedures-associated-w...
https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-363943-1&cid=716160653.1595649423&jid=1473877237&_gid=1262071136.1595649423&gjid=271236939&_v=j83&z=2114633882
https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-363943-1&cid=716160653.1595649423&jid=1473877237&_v=j83&z=2114633882
https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-363943-1&cid=716160653.1595649423&jid=1473877237&_v=j83&z=2114633882&slf_rd=1&random=29584241

42 B
106 B

16ms
16ms

Image
image/gif

2a00:1450:4001:81a::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-363943-1&cid=716160653.1595649423&jid=1473877237&_v=j83&z=2114633882&slf_rd=1&random=29584241

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81a::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 25 Jul 2020 03:57:03 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Sat, 25 Jul 2020 03:57:03 GMT
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 302
content-type: text/html; charset=UTF-8
location: https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-363943-1&cid=716160653.1595649423&jid=1473877237&_v=j83&z=2114633882&slf_rd=1&random=29584241
cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

collect
px.ads.linkedin.com/
Redirect Chain

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=6572&url=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2020%2F05%2Ftactics-techniques-procedures-associated-with-maze-ransomware-incide...
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D6572%26url%3Dhttps%253A%252F%252Fwww.fireeye.com%252Fblog%252Fthreat-research%252...
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=6572&url=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2020%2F05%2Ftactics-techniques-procedures-associated-with-maze-ransomware-incide...

0
57 B

171ms
171ms

Image
application/javascript

2a05:f500:11:101::b93f:9005
LINKEDIN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=6572&url=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2020%2F05%2Ftactics-techniques-procedures-associated-with-maze-ransomware-incidents.html&time=1595649422974&liSync=true
Requested by: Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2a05:f500:11:101::b93f:9005 , Ireland, ASN14413 (LINKEDIN, US),
Reverse DNS
Software: Play /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sat, 25 Jul 2020 03:57:03 GMT
server: Play
linkedin-action: 1
x-li-fabric: prod-lor1
status: 200
x-li-proto: http/2
x-li-pop: prod-tln1
content-type: application/javascript
content-length: 0
x-li-uuid: ModjTLLiJBawP0b9oysAAA==

Redirect headers

content-security-policy: default-src *; connect-src 'self' https://media-src.linkedin.com/media/ www.linkedin.com s.c.lnkd.licdn.com m.c.lnkd.licdn.com s.c.exp1.licdn.com s.c.exp2.licdn.com m.c.exp1.licdn.com m.c.exp2.licdn.com wss://*.linkedin.com dms.licdn.com https://dpm.demdex.net/id https://lnkd.demdex.net/event blob: https://accounts.google.com/gsi/status https://linkedin.sc.omtrdc.net/b/ss/ static.licdn.com static-exp1.licdn.com static-exp2.licdn.com static-exp3.licdn.com media.licdn.com media-exp1.licdn.com media-exp2.licdn.com media-exp3.licdn.com; img-src data: blob: *; font-src data: *; style-src 'unsafe-inline' 'self' static-src.linkedin.com *.licdn.com; script-src 'report-sample' 'unsafe-inline' 'unsafe-eval' 'self' spdy.linkedin.com static-src.linkedin.com *.ads.linkedin.com *.licdn.com static.chartbeat.com www.google-analytics.com ssl.google-analytics.com bcvipva02.rightnowtech.com www.bizographics.com sjs.bizographics.com js.bizographics.com d.la4-c1-was.salesforceliveagent.com slideshare.www.linkedin.com https://snap.licdn.com/li.lms-analytics/insight.min.js platform.linkedin.com platform-akam.linkedin.com platform-ecst.linkedin.com platform-azur.linkedin.com; object-src 'none'; media-src blob: *; child-src blob: lnkd-communities: voyager: *; frame-ancestors 'self'
x-content-type-options: nosniff
nel: {"report_to":"network-errors","max_age":1296000,"success_fraction":0.00066,"failure_fraction":1,"include_subdomains":true}
linkedin-action: 1
status: 302
content-length: 0
x-li-uuid: IHssRrLiJBYweiHQWysAAA==
pragma: no-cache
x-li-pop: afd-prod-lor1
x-msedge-ref: Ref A: 5DD3FD6A5E274E0280D7ABED7E34A3A3 Ref B: FRAEDGE0819 Ref C: 2020-07-25T03:57:03Z
x-frame-options: sameorigin
date: Sat, 25 Jul 2020 03:57:02 GMT
expect-ct: max-age=86400, report-uri="https://www.linkedin.com/platform-telemetry/ct"
strict-transport-security: max-age=2592000
report-to: {"group":"network-errors","max_age":2592000,"endpoints":[{"url":"https://www.linkedin.com/li/rep"}],"include_subdomains":true}
x-li-fabric: prod-lor1
location: https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=6572&url=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2020%2F05%2Ftactics-techniques-procedures-associated-with-maze-ransomware-incidents.html&time=1595649422974&liSync=true
x-xss-protection: 1; mode=block
cache-control: no-cache, no-store
x-li-proto: http/2
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 204 0
bat.bing.com/action/ 0
134 B 28ms
27ms Image
text/plain 2620:1ec:c11::200
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://bat.bing.com/action/0?ti=5870833&Ver=2&mid=b06719dd-4c53-bd42-72fb-25084de9b143&sid=f6012d61831a0e2794989bf010cf7138&vid=1e8d95d0355e87c719e8f0f747d98ca7&vids=1&pi=0&lg=en-US&sw=1600&sh=1200&sc=24&tl=Navigating%20the%20MAZE%3A%20Tactics,%20Techniques%20and%20Procedures%20Associated%20With%20MAZE%20Ransomware%20Incidents%20%7C%20FireEye%20Inc&p=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2020%2F05%2Ftactics-techniques-procedures-associated-with-maze-ransomware-incidents.html&r=&evt=pageLoad&msclkid=N&sv=1&rn=441333
Requested by: Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status: 204
pragma: no-cache
date: Sat, 25 Jul 2020 03:57:02 GMT
cache-control: no-cache, must-revalidate
x-msedge-ref: Ref A: 905DC096B8114A259817B15FB1888960 Ref B: FRAEDGE1413 Ref C: 2020-07-25T03:57:02Z
access-control-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 1847206522249226 Show response
connect.facebook.net/signals/config/ 522 KB
132 KB 103ms
103ms Script
application/x-javascript 2a03:2880:f01c:8012:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/1847206522249226?v=2.9.22&r=stable

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f01c:8012:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

7a9b430c967ef28f18302a4a877bb473585ec7568b929e61207f9853a0ec67dc

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob:;script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .virtualearth.net .google.com 127.0.0.1:* .spotilocal.com: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net .spotilocal.com: wss://.facebook.com: https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
status: 200
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
x-xss-protection: 0
pragma: public
x-fb-debug: DLfYCKSwa5uiXnCnCqiyit8eBpnnaCGDFDf7oNzY4MxENeO93+qgD9bFfRXRIkeswJWmSzFvfxl7Kh7Uw4R+XA==
x-fb-trip-id: 664085054
x-frame-options: DENY
date: Sat, 25 Jul 2020 03:57:03 GMT
vary: Accept-Encoding
content-type: application/x-javascript; charset=utf-8
cache-control: public, max-age=1200
content-security-policy: default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 adsct
t.co/i/ 43 B
448 B 137ms
119ms Image
image/gif 104.244.42.133
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://t.co/i/adsct?p_id=Twitter&p_user_id=0&txn_id=nw2v7&events=%5B%5B%22pageview%22%2Cnull%5D%5D&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=0

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

104.244.42.133 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=0
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sat, 25 Jul 2020 03:57:03 GMT
content-encoding: gzip
x-content-type-options: nosniff
status: 200, 200 OK
x-twitter-response-tags: BouncerCompliant
content-length: 65
x-xss-protection: 0
x-response-time: 111
pragma: no-cache
last-modified: Sat, 25 Jul 2020 03:57:03 GMT
server: tsa_o
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=0
content-type: image/gif;charset=utf-8
cache-control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash: 632067deb8b1b5993a6be56f9edb01ff
x-transaction: 00bbe55a00322d88
expires: Tue, 31 Mar 1981 05:00:00 GMT

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/968899429/ 3 KB
1 KB 19ms
19ms Script
text/javascript 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/968899429/?random=1595649422997&cv=9&fst=1595649422997&num=1&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2wg7f0&sendb=1&ig=1&frm=0&url=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2020%2F05%2Ftactics-techniques-procedures-associated-with-maze-ransomware-incidents.html&tiba=Navigating%20the%20MAZE%3A%20Tactics%2C%20Techniques%20and%20Procedures%20Associated%20With%20MAZE%20Ransomware%20Incidents%20%7C%20FireEye%20Inc&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

bf117733c4577e9f7081237ef499af90631146d12759cf11ad847fafee83ac21

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 25 Jul 2020 03:57:03 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status: 200
cache-control: no-cache, must-revalidate
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 1125
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
tr.lfeeder.com/ 43 B
291 B 100ms
37ms Image
image/gif 2600:9000:214f:9400:1a:2af:6d00:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tr.lfeeder.com/?sid=3P1w24dgrmJ7mY5n&data=eyJnYVRyYWNraW5nSWRzIjpbIlVBLTM2Mzk0My0xIl0sImdhQ2xpZW50SWRzIjpbIjcxNjE2MDY1My4xNTk1NjQ5NDIzIl0sImNvbnRleHQiOnsibGlicmFyeSI6eyJuYW1lIjoibGZ0cmFja2VyIiwidmVyc2lvbiI6IjEuNi4xIn0sInBhZ2VVcmwiOiJodHRwczovL3d3dy5maXJlZXllLmNvbS9ibG9nL3RocmVhdC1yZXNlYXJjaC8yMDIwLzA1L3RhY3RpY3MtdGVjaG5pcXVlcy1wcm9jZWR1cmVzLWFzc29jaWF0ZWQtd2l0aC1tYXplLXJhbnNvbXdhcmUtaW5jaWRlbnRzLmh0bWwiLCJwYWdlVGl0bGUiOiJOYXZpZ2F0aW5nIHRoZSBNQVpFOiBUYWN0aWNzLCBUZWNobmlxdWVzIGFuZCBQcm9jZWR1cmVzIEFzc29jaWF0ZWQgV2l0aCBNQVpFIFJhbnNvbXdhcmUgSW5jaWRlbnRzIHwgRmlyZUV5ZSBJbmMiLCJyZWZlcnJlciI6IiJ9LCJldmVudCI6InRyYWNraW5nLWV2ZW50IiwiY2xpZW50VGltZXN0YW1wIjoiMjAyMC0wNy0yNVQwMzo1NzowMy4wMzJaIiwiY2xpZW50VGltZXpvbmUiOi0xMjAsInNjcmlwdElkIjoiM1AxdzI0ZGdybUo3bVk1biIsImNvb2tpZXNFbmFibGVkIjp0cnVlLCJhbm9ueW1pemVJcCI6ZmFsc2UsImxmQ2xpZW50SWQiOiJMRjEuMS41MzU0Yzc0YWFlYWU0Zjk0LjE1OTU2NDk0MjMwMzEiLCJmb3JlaWduQ29va2llcyI6W10sInByb3BlcnRpZXMiOnt9fQ==
Requested by: Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:9000:214f:9400:1a:2af:6d00:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: CloudFront /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sat, 25 Jul 2020 03:57:03 GMT
via: 1.1 2d1e1e8dc0f3eb7773ec9d89a7d50ce2.cloudfront.net (CloudFront)
server: CloudFront
x-amz-cf-pop: FRA53-C1
x-cache: LambdaGeneratedResponse from cloudfront
content-type: image/gif
status: 200
content-length: 43
x-amz-cf-id: d0x9xCcfx0ojjx5tiTk3044g35kIGR7aJu2ththYwpT8UGyf8wQw3g==

GET
H2 200 font-awesome.min.css
maxcdn.bootstrapcdn.com/font-awesome/4.6.1/css/ 28 KB
7 KB 25ms
8ms Stylesheet
text/css 2001:4de0:ac19::1:b:3a
HIGHWINDS3

General

Check archive.org

Show headers Download Go to

Full URL

https://maxcdn.bootstrapcdn.com/font-awesome/4.6.1/css/font-awesome.min.css

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2001:4de0:ac19::1:b:3a , Netherlands, ASN20446 (HIGHWINDS3, US),

Reverse DNS

Software

Resource Hash

b5d7707ea8fc00aae40bf500ac7498d7f32f6b1bbff7b4fde976a40345eb5f9d

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sat, 25 Jul 2020 03:57:03 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 12 Dec 2018 18:35:20 GMT
status: 200
etag: "1544639720"
vary: Accept-Encoding
x-cache: HIT
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
content-length: 6591

GET
H2 200 css
fonts.googleapis.com/ 5 KB
759 B 15ms
14ms Stylesheet
text/css 2a00:1450:4001:819::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto:400,700

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:819::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

d32996520262a9559a26eafe3413cf1a2fe53f448da989d0493e7851f887a1b0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
status: 200
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Sat, 25 Jul 2020 02:25:10 GMT
server: ESF
date: Sat, 25 Jul 2020 03:57:03 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Sat, 25 Jul 2020 03:57:03 GMT

GET
H2 200 sp.js Show response
cdn.pathfactory.com/sp/2.14.0/ 98 KB
30 KB 40ms
12ms Script
application/javascript 143.204.201.10
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.pathfactory.com/sp/2.14.0/sp.js
Requested by: Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 143.204.201.10 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 50cf303cfaa020fcbedd6ad1bf045a008cbb88dfc792f731f07235dd1ca13599

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 10 Jun 2020 01:02:30 GMT
content-encoding: gzip
last-modified: Wed, 06 May 2020 07:53:19 GMT
server: AmazonS3
age: 3898474
x-amz-server-side-encryption: AES256
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
status: 200
cache-control: max-age=315360000
x-amz-cf-pop: FRA53-C1
x-amz-cf-id: haq1HIw5a6poZy7qHGnWfU8o31ydLqC3EfsslwcWwntBr9Kiz7j71w==
via: 1.1 f2db75b601dc30df73b1beb29596a375.cloudfront.net (CloudFront)

GET
H2 200 website_experience Show response
jukebox.pathfactory.com/api/public/v1/ 5 KB
2 KB 422ms
217ms XHR
application/json 18.208.65.88
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://jukebox.pathfactory.com/api/public/v1/website_experience?clientId=LB-9AC90F09-10427&visitorUuid=&title=Navigating%20the%20MAZE%3A%20Tactics%2C%20Techniques%20and%20Procedures%20Associated%20With%0AMAZE%20Ransomware%20Incidents&url=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2020%2F05%2Ftactics-techniques-procedures-associated-with-maze-ransomware-incidents.html&image=https%3A%2F%2Fwww.fireeye.com%2Fcontent%2Fdam%2Ffireeye-www%2Ffw%2Fimages%2Ffireeye-2-color-square.png

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

18.208.65.88 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

2d08fbb551cffc4e12771f69d762b5debab879d64f3d29c2a7f6235bad4b24d8

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept: application/json
Referer: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: application/json

Response headers

x-runtime: 0.108313
date: Sat, 25 Jul 2020 03:57:03 GMT
content-encoding: gzip
x-content-type-options: nosniff
status: 200
etag: W/"2d08fbb551cffc4e12771f69d762b5de"
access-control-max-age: 1728000
access-control-allow-methods: GET, PUT, POST, PATCH, OPTIONS
content-type: application/json; charset=utf-8
access-control-allow-origin: https://www.fireeye.com
access-control-expose-headers
cache-control: max-age=0, private, must-revalidate
access-control-allow-credentials: true
vary: Origin, Accept-Encoding
x-request-id: 7ebbdae2-c02b-4e85-8e6b-5802323aa41f

GET
H2 200 /
www.google.com/pagead/1p-user-list/968899429/ 42 B
148 B 20ms
19ms Image
image/gif 2a00:1450:4001:81d::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/968899429/?random=1595649422997&cv=9&fst=1595646000000&num=1&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2wg7f0&sendb=1&frm=0&url=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2020%2F05%2Ftactics-techniques-procedures-associated-with-maze-ransomware-incidents.html&tiba=Navigating%20the%20MAZE%3A%20Tactics%2C%20Techniques%20and%20Procedures%20Associated%20With%20MAZE%20Ransomware%20Incidents%20%7C%20FireEye%20Inc&async=1&fmt=3&is_vtc=1&random=2114919786&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81d::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 25 Jul 2020 03:57:03 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.de/pagead/1p-user-list/968899429/ 42 B
153 B 19ms
18ms Image
image/gif 2a00:1450:4001:81a::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/968899429/?random=1595649422997&cv=9&fst=1595646000000&num=1&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2wg7f0&sendb=1&frm=0&url=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2020%2F05%2Ftactics-techniques-procedures-associated-with-maze-ransomware-incidents.html&tiba=Navigating%20the%20MAZE%3A%20Tactics%2C%20Techniques%20and%20Procedures%20Associated%20With%20MAZE%20Ransomware%20Incidents%20%7C%20FireEye%20Inc&async=1&fmt=3&is_vtc=1&random=2114919786&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81a::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 25 Jul 2020 03:57:03 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 206 notification.d46d7db1.mp3
widget.driftqa.com/conductor/assets/media/ 20 KB
21 KB 60ms
13ms Media
audio/mpeg 143.204.201.123
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://widget.driftqa.com/conductor/assets/media/notification.d46d7db1.mp3

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

143.204.201.123 Seattle, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

ad80ac33ed04b4e6d78167b4162ecd3d2e8c29d17b43eb3df1f35b216b2ac5c5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html
Accept-Encoding: identity;q=1, *;q=0
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Range: bytes=0-

Response headers

date: Mon, 17 Feb 2020 15:48:57 GMT
via: 1.1 3f6fbf009bb5cf969f92ba2e59576614.cloudfront.net (CloudFront)
age: 13694886
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
status: 206
Content-Length: 20897
Content-Range: bytes 0-20896/20897
last-modified: Fri, 14 Feb 2020 21:02:41 GMT
server: nginx
etag: "d46d7db110874da77e094dcbc4bec8e6"
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-methods: GET, POST, OPTIONS
content-type: audio/mpeg
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: FRA53-C1
accept-ranges: bytes
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: w4jPwqZVDYDdC0RNHhvqm-NoWu8N1P-yZ6SvzkFCRYysDro15Ctx7A==

GET
H2 200 /
www.facebook.com/tr/ 44 B
376 B 19ms
6ms Image
image/gif 2a03:2880:f11c:8183:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=1847206522249226&ev=PageView&dl=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2020%2F05%2Ftactics-techniques-procedures-associated-with-maze-ransomware-incidents.html&rl=&if=false&ts=1595649423240&sw=1600&sh=1200&v=2.9.22&r=stable&ec=0&o=30&fbp=fb.1.1595649423239.2096336296&it=1595649422993&coo=false&rqm=GET

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f11c:8183:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sat, 25 Jul 2020 03:57:03 GMT
last-modified: Fri, 21 Dec 2012 00:00:01 GMT
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
status: 200
cache-control: no-cache, must-revalidate, max-age=0
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 44
expires: Sat, 25 Jul 2020 03:57:03 GMT

GET
H/1.1 200
OK me Show response
abm2.listenloop.com/api/v1/public/organizations/ 574 B
1 KB 430ms
110ms XHR
application/json 54.81.89.51
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://abm2.listenloop.com/api/v1/public/organizations/me?public_key=MRxJc5qdz5T-wKxBNsh4
Requested by: Host: www.fireeye.com
URL: https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.81.89.51 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: nginx /
Resource Hash: 56bf97572cc7de5a19131a062e5e0e64ffa38dc71e87cdfa7c0e481e15f2d628

Request headers

Accept: */*
Referer: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

X-Runtime: 0.004367
Date: Sat, 25 Jul 2020 03:57:03 GMT
Content-Encoding: gzip
Server: nginx
ETag: W/"9b3e14d8f33c99a360cd867ecc8c0081"
Vary: Accept-Encoding
Access-Control-Allow-Methods: GET, POST, DELETE, PUT, PATCH, OPTIONS, HEAD
Content-Type: application/json; charset=utf-8
Access-Control-Allow-Origin: https://www.fireeye.com
Cache-Control: max-age=0, private, must-revalidate
Access-Control-Allow-Credentials: true
Connection: keep-alive
Access-Control-Allow-Headers: Access-Control-Request-Headers,X-User-Token,X-User-email,content-type,X-RateLimit-Limit,X-RateLimit-Remaining,X-RateLimit-Reset
Content-Length: 361
X-Request-Id: a23c655e-0430-42b1-abed-cf5685474e6a

POST
H/1.1 200
OK retargeting_segments Show response
abm2.listenloop.com/api/v1/public/ 27 B
760 B 434ms
106ms XHR
application/json 54.81.89.51
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://abm2.listenloop.com/api/v1/public/retargeting_segments
Requested by: Host: www.fireeye.com
URL: https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.81.89.51 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: nginx /
Resource Hash: 1cddcd88d3332d560856627ab2cecc7d9aa6c9d616729701ae13902d1671d0b0

Request headers

Accept: */*
Referer: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8

Response headers

X-Runtime: 0.004088
Date: Sat, 25 Jul 2020 03:57:03 GMT
Content-Encoding: gzip
Server: nginx
ETag: W/"b700f640fc15ed25258facf069859c26"
Vary: Accept-Encoding
Access-Control-Allow-Methods: GET, POST, DELETE, PUT, PATCH, OPTIONS, HEAD
Content-Type: application/json; charset=utf-8
Access-Control-Allow-Origin: https://www.fireeye.com
Cache-Control: max-age=0, private, must-revalidate
Access-Control-Allow-Credentials: true
Connection: keep-alive
Access-Control-Allow-Headers: Access-Control-Request-Headers,X-User-Token,X-User-email,content-type,X-RateLimit-Limit,X-RateLimit-Remaining,X-RateLimit-Reset
Content-Length: 53
X-Request-Id: 59be80f3-3713-4e5e-a654-416f8fba61d8

GET
H/1.1

200
OK

associate-segment
segment.prod.bidr.io/
Redirect Chain

https://segment.prod.bidr.io/associate-segment?buzz_key=listenloop&segment_key=listenloop-11912&value=
https://segment.prod.bidr.io/associate-segment?buzz_key=listenloop&segment_key=listenloop-11912&value=&_bee_ppp=1

43 B
793 B

30ms
29ms

Image
image/gif

34.251.7.133
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://segment.prod.bidr.io/associate-segment?buzz_key=listenloop&segment_key=listenloop-11912&value=&_bee_ppp=1

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

34.251.7.133 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
Date: Sat, 25 Jul 2020 03:57:03 GMT
Server: nginx
strict-transport-security: max-age=2592000; includeSubDomains
p3p: CP="This is not a P3P policy! See https://beeswax.com/privacy for more info."
cache-control: no-cache, must-revalidate
Connection: keep-alive
content-type: image/gif
Content-Length: 43
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://segment.prod.bidr.io/associate-segment?buzz_key=listenloop&segment_key=listenloop-11912&value=&_bee_ppp=1
Date: Sat, 25 Jul 2020 03:57:03 GMT
Server: nginx
Connection: keep-alive
Content-Length: 0
strict-transport-security: max-age=2592000; includeSubDomains

GET
H2 200 /
www.facebook.com/tr/ 44 B
100 B 6ms
6ms Image
image/gif 2a03:2880:f11c:8183:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=1847206522249226&ev=Microdata&dl=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2020%2F05%2Ftactics-techniques-procedures-associated-with-maze-ransomware-incidents.html&rl=&if=false&ts=1595649423743&cd[DataLayer]=%5B%5D&cd[Meta]=%7B%22title%22%3A%22Navigating%20the%20MAZE%3A%20Tactics%2C%20Techniques%20and%20Procedures%20Associated%20With%5CnMAZE%20Ransomware%20Incidents%20%7C%20FireEye%20Inc%22%2C%22meta%3Adescription%22%3A%22Malicious%20actors%20have%20been%20actively%20deploying%20MAZE%20ransomware%20since%20at%20least%20May%202019.%5Cn%22%7D&cd[OpenGraph]=%7B%22og%3Atitle%22%3A%22Navigating%20the%20MAZE%3A%20Tactics%2C%20Techniques%20and%20Procedures%20Associated%20With%5CnMAZE%20Ransomware%20Incidents%22%2C%22og%3Atype%22%3A%22website%22%2C%22og%3Aurl%22%3A%22https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2020%2F05%2Ftactics-techniques-procedures-associated-with-maze-ransomware-incidents.html%22%2C%22og%3Aimage%22%3A%22https%3A%2F%2Fwww.fireeye.com%2Fcontent%2Fdam%2Ffireeye-www%2Ffw%2Fimages%2Ffireeye-2-color-square.png%22%2C%22og%3Adescription%22%3A%22Malicious%20actors%20have%20been%20actively%20deploying%20MAZE%20ransomware%20since%20at%20least%20May%202019.%5Cn%22%2C%22og%3Asite_name%22%3A%22FireEye%22%7D&cd[Schema.org]=%5B%5D&cd[JSON-LD]=%5B%5D&sw=1600&sh=1200&v=2.9.22&r=stable&ec=1&o=30&fbp=fb.1.1595649423239.2096336296&it=1595649422993&coo=false&es=automatic&tm=3&rqm=GET

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f11c:8183:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sat, 25 Jul 2020 03:57:03 GMT
last-modified: Fri, 21 Dec 2012 00:00:01 GMT
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
status: 200
cache-control: no-cache, must-revalidate, max-age=0
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 44
expires: Sat, 25 Jul 2020 03:57:03 GMT

POST
H2 200 page_views Show response
jukebox.lookbookhq.com/api/public/v1/ 153 B
656 B 395ms
192ms XHR
application/json 52.86.170.32
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://jukebox.lookbookhq.com/api/public/v1/page_views

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.86.170.32 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

aca0199001d18fd46c7defac2467bfebb49fb930b77ed5412fd3a7578b5120f8

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept: application/json
Referer: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: application/json

Response headers

x-runtime: 0.083370
date: Sat, 25 Jul 2020 03:57:04 GMT
content-encoding: gzip
x-content-type-options: nosniff
status: 200
etag: W/"aca0199001d18fd46c7defac2467bfeb"
access-control-max-age: 1728000
access-control-allow-methods: GET, PUT, POST, PATCH, OPTIONS
content-type: application/json; charset=utf-8
access-control-allow-origin: https://www.fireeye.com
access-control-expose-headers
cache-control: max-age=0, private, must-revalidate
access-control-allow-credentials: true
vary: Origin, Accept-Encoding
x-request-id: 04567522-0e05-4aa4-a2ec-38edbef2c249

GET
H/1.1 200
OK 6si.min.js Show response
j.6sc.co/ 14 KB
7 KB 51ms
17ms Script
application/javascript 23.34.183.125
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://j.6sc.co/6si.min.js
Requested by: Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.34.183.125 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS
Software: nginx/1.14.0 (Ubuntu) /
Resource Hash: b7fd7aa1e35ad07b9abc18df313e20bf48b0dfb9a9047e54aea920768db23003

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Sat, 25 Jul 2020 03:57:04 GMT
Content-Encoding: gzip
Last-Modified: Fri, 10 Jul 2020 22:14:47 GMT
Server: nginx/1.14.0 (Ubuntu)
ETag: "5f08e857-39a0"
Vary: Accept-Encoding
Access-Control-Allow-Methods: GET,POST
Content-Type: application/javascript
Access-Control-Allow-Origin
Access-Control-Max-Age: 86400
Access-Control-Allow-Credentials: true
Connection: keep-alive
Accept-Ranges: bytes
Access-Control-Allow-Headers: *
Content-Length: 6038

GET
DATA 200
OK truncated
/ 17 KB
17 KB Font
application/x-font-woff2

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: f20b7aacff69fbfc6fc0aaff9220bab48d3ce87c45bd077fea61e5d9e7662c2c

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
Origin: https://www.fireeye.com

Response headers

Content-Type: application/x-font-woff2

GET
H2 200 fireicons.woff
www.fireeye.com/content/dam/fireeye-www/fw/f/ 72 KB
37 KB 28ms
27ms Font
application/x-font-woff 2606:4700:300b::a29f:f77d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.fireeye.com/content/dam/fireeye-www/fw/f/fireicons.woff?mva1rk

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:300b::a29f:f77d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

1de5a2b057fc1fd85e8b3ccffa91101c8304a88b32fccb33e19d7657a1460dae

Security Headers

Name	Value
Content-Security-Policy	worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	ALLOW-FROM https://content.fireeye.com
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://www.fireeye.com/etc/designs/fireeye-www/clientlibs_fw-2019.min.css
Origin: https://www.fireeye.com

Response headers

x-dispatcher: dispatcher2uswest1
date: Sat, 25 Jul 2020 03:57:04 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
age: 28559
x-vhost: publish
status: 200
vary: Accept-Encoding,User-Agent
content-length: 36804
cf-request-id: 0425b7130e0000dfef21a13200000001
last-modified: Tue, 24 Sep 2019 21:47:18 GMT
server: cloudflare
x-frame-options: ALLOW-FROM https://content.fireeye.com
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/x-font-woff
x-xss-protection: 1; mode=block
cache-control: no-cache="set-cookie"
content-security-policy: worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
accept-ranges: bytes
cf-ray: 5b82f464ee2bdfef-FRA

GET
DATA 200
OK truncated
/ 17 KB
17 KB Font
application/x-font-woff2

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: ac8511a575f9ff43c005f8be9f0fb7b81b8aebf2fd2e1df8df7809df4b77cc07

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
Origin: https://www.fireeye.com

Response headers

Content-Type: application/x-font-woff2

GET
DATA 200
OK truncated
/ 17 KB
17 KB Font
application/x-font-woff2

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 7d6fd646e0efeb5d1209c2d9008343cb061cc7d70408fbd108f683dbc4d17fa8

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
Origin: https://www.fireeye.com

Response headers

Content-Type: application/x-font-woff2

GET
DATA 200
OK truncated
/ 17 KB
17 KB Font
application/x-font-woff2

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 9b935949913b686e1e44928fb476ad5611303afc06e844ff620f59370d9c77bd

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
Origin: https://www.fireeye.com

Response headers

Content-Type: application/x-font-woff2

GET
DATA 200
OK truncated
/ 18 KB
18 KB Font
application/x-font-woff2

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 3091b6187cdf72d32615fd3df8c882e3cf6ca0f3e8b010d5f4f937ab2d619d94

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
Origin: https://www.fireeye.com

Response headers

Content-Type: application/x-font-woff2

GET
DATA 200
OK truncated
/ 5 KB
5 KB Font
application/x-font-woff2

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 1c7c6cbe8b5beb7e138cfcc8f6301d21b35437e5559be7afd0afe3f536d5fc02

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
Origin: https://www.fireeye.com

Response headers

Content-Type: application/x-font-woff2

GET
DATA 200
OK truncated
/ 4 KB
4 KB Font
application/x-font-woff2

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 5b701db4813b82b18ad7f0db593b1dcc5c435f7be396ef3a937f8ed1ec7b343d

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
Origin: https://www.fireeye.com

Response headers

Content-Type: application/x-font-woff2

GET
DATA 200
OK truncated
/ 4 KB
4 KB Font
application/x-font-woff2

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: aeb54739ad664ca0dde2785d1a4c64495b8d91e7eee6ab4d7788769655746f88

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
Origin: https://www.fireeye.com

Response headers

Content-Type: application/x-font-woff2

GET
DATA 200
OK truncated
/ 5 KB
5 KB Font
application/x-font-woff2

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 325788f630aa3ff90d75e60d764ebba3adf2d304671b57e327fe3801bbdad9de

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
Origin: https://www.fireeye.com

Response headers

Content-Type: application/x-font-woff2

GET
DATA 200
OK truncated
/ 5 KB
5 KB Font
application/x-font-woff2

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 0e28cd255cac05ac63cb7b021b9436cbf1bd24b34218edefc7b9675bbcb6dec7

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
Origin: https://www.fireeye.com

Response headers

Content-Type: application/x-font-woff2

GET
H2 200 getForm Show response
www2.fireeye.com/index.php/form/ 8 KB
3 KB 512ms
511ms Script
application/javascript 104.17.73.206
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www2.fireeye.com/index.php/form/getForm?munchkinId=848-DID-242&form=3353&url=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2020%2F05%2Ftactics-techniques-procedures-associated-with-maze-ransomware-incidents.html&callback=jQuery112409098969383938327_1595649424341&_=1595649424342

Requested by

Host: www2.fireeye.com
URL: https://www2.fireeye.com/js/forms2/js/forms2.min.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

104.17.73.206 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

dab13d67a41e3de07e721c8b35ae3a41c5d04bfd25a00a24125816768521065a

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sat, 25 Jul 2020 03:57:04 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
server: cloudflare
status: 200
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cached: false
accept-ranges: bytes
cf-ray: 5b82f4663e09cd8f-CDG
cf-request-id: 0425b713e50000cd8fee8a1200000001

GET
H/1.1 200
OK / Show response
c.6sc.co/ 47 B
371 B 45ms
14ms XHR
text/plain 23.34.183.125
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://c.6sc.co/
Requested by: Host: www.fireeye.com
URL: https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.34.183.125 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS
Software: /
Resource Hash: 3c0d15c27b324cc20afc87a72ac54515967cae4cb086fe5ba272df704b774ebe

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Sat, 25 Jul 2020 03:57:04 GMT
Access-Control-Max-Age: 86400
Access-Control-Allow-Methods: GET,POST
Content-Type: text/plain
Access-Control-Allow-Origin: https://www.fireeye.com
Access-Control-Allow-Credentials: true
Connection: keep-alive
Access-Control-Allow-Headers: *
Content-Length: 47

GET
H/1.1 200
OK getuidj Show response
secure.adnxs.com/ 29 B
875 B 14ms
14ms XHR
application/json 185.33.220.243
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.adnxs.com/getuidj

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.220.243 , Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.13.4 /

Resource Hash

c67285da3e4cf32db0353c683a2dda13afaeb90c36c92fb90566b8eb23c6f626

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: no-cache
Date: Sat, 25 Jul 2020 03:57:04 GMT
X-Proxy-Origin: 185.220.70.68; 185.220.70.68; 722.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.220.49:80
AN-X-Request-Uuid: 5349f171-242e-48d0-9df0-b88330ef0a0d
Server: nginx/1.13.4
P3P: policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://www.fireeye.com
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json; charset=utf-8
Content-Length: 29
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 moatframe.js Show response
z.moatads.com/addthismoatframe568911941483/ 2 KB
1 KB 25ms
7ms Script
application/x-javascript 2.18.235.40
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://z.moatads.com/addthismoatframe568911941483/moatframe.js
Requested by: Host: s7.addthis.com
URL: https://s7.addthis.com/js/300/addthis_widget.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 05090f9390f5bc0cd23fe5f432037cc92d7cbce1ced9bfe8faf3d1c9abae85cd

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sat, 25 Jul 2020 03:57:04 GMT
content-encoding: gzip
last-modified: Fri, 08 Nov 2019 20:13:52 GMT
server: AmazonS3
x-amz-request-id: D5503D14AA2F06AA
etag: "f14b4e1f799b14f798a195f43cf58376"
vary: Accept-Encoding
content-type: application/x-javascript
status: 200
cache-control: max-age=7220
accept-ranges: bytes
content-length: 948
x-amz-id-2: JgalEtxvSAtZmM7+naGfrhsdf0JFS0gJW8lypWF8Tp90EkcPp4c3eAnpK+RDOIL1ltWgpx8wc3s=

GET
H/1.1 200
OK munchkin.js Show response
munchkin.marketo.net/158/ 11 KB
5 KB 8ms
8ms Script
application/x-javascript 104.109.95.62
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://munchkin.marketo.net/158/munchkin.js
Requested by: Host: munchkin.marketo.net
URL: https://munchkin.marketo.net/munchkin.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.109.95.62 , Netherlands, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 5f967fd41346c0fc1b9b44fa69c52bf1e754420c59c8017cefb0a14a764cafa4

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Sat, 25 Jul 2020 03:57:04 GMT
Content-Encoding: gzip
Last-Modified: Tue, 28 Jan 2020 03:01:21 GMT
Server: AkamaiNetStorage
ETag: "67df7eb9e9e68638308f14367dddec10:1580180481"
Vary: Accept-Encoding
P3P: policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR"
Cache-Control: max-age=8640000
Connection: keep-alive
Accept-Ranges: bytes
Content-Type: application/x-javascript
Content-Length: 4686
Expires: Mon, 02 Nov 2020 03:57:04 GMT

GET
H2 200 me Show response
js.maxmind.com/geoip/v2.1/country/ 771 B
979 B 66ms
65ms XHR
application/vnd.maxmind.com-country+json 2606:4700::6810:262f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js.maxmind.com/geoip/v2.1/country/me?referrer=https%3A%2F%2Fwww.fireeye.com
Requested by: Host: www.fireeye.com
URL: https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6810:262f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e7c5bf547e9a3a4b2bd530bee5fe6bf05aaff95ffce44ce44584b966fc7e7984

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sat, 25 Jul 2020 03:57:04 GMT
cf-cache-status: DYNAMIC
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
status: 200
content-type: application/vnd.maxmind.com-country+json; charset=UTF-8; version=2.1
access-control-allow-origin: *
cf-ray: 5b82f4672f84c281-FRA
content-length: 771
cf-request-id: 0425b714770000c281b0a8d200000001

GET
H2 200 segmentation.segment.js Show response
www.fireeye.com/etc/ 0
128 B 19ms
19ms XHR
application/x-javascript 2606:4700:300b::a29f:f77d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.fireeye.com/etc/segmentation.segment.js

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:300b::a29f:f77d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff, nosniff
X-Frame-Options	ALLOW-FROM https://content.fireeye.com
X-Xss-Protection	1; mode=block

Request headers

Accept: text/javascript, application/javascript, application/ecmascript, application/x-ecmascript, */*; q=0.01
Referer: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-dispatcher: dispatcher2uswest1
date: Sat, 25 Jul 2020 03:57:04 GMT
x-content-type-options: nosniff, nosniff
cf-cache-status: HIT
age: 72317
x-vhost: publish
status: 200
vary: User-Agent, Accept-Encoding
content-length: 0
cf-request-id: 0425b714780000dfef21a2d200000001
cf-bgj: minify
server: cloudflare
x-frame-options: ALLOW-FROM https://content.fireeye.com
etag: "d41d8cd98f00b204e9800998ecf8427e"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/x-javascript
x-xss-protection: 1; mode=block
content-security-policy: worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
accept-ranges: bytes
cf-ray: 5b82f46729a1dfef-FRA

GET
H2 403 stores.init.js Show response
www.fireeye.com/etc/clientcontext/default/content/jcr:content/ 3 KB
1 KB 12ms
11ms XHR
text/html 2606:4700:300b::a29f:f77d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.fireeye.com/etc/clientcontext/default/content/jcr:content/stores.init.js?path=%2Fcontent%2Ffireeye-www%2Fen_US%2Fblog%2Fthreat-research%2F2020%2F05%2Ftactics-techniques-procedures-associated-with-maze-ransomware-incidents&_=1595649422814

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:300b::a29f:f77d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

dba1808b3ae42768762130293e50e1bebee2f7aff688a309910fa3bf0e528c21

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Accept: text/javascript, application/javascript, application/ecmascript, application/x-ecmascript, */*; q=0.01
Referer: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sat, 25 Jul 2020 03:57:04 GMT
content-encoding: gzip
server: cloudflare
x-frame-options: SAMEORIGIN
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/html; charset=UTF-8
status: 403
cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
cf-ray: 5b82f46729a6dfef-FRA
cf-request-id: 0425b7147b0000dfef21a2e200000001
expires: Thu, 01 Jan 1970 00:00:01 GMT

GET
H2 200 read-blogentries Show response
www.fireeye.com/bin/www-blogs/ 96 KB
17 KB 1063ms
1062ms XHR
text/plain 2606:4700:300b::a29f:f77d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.fireeye.com/bin/www-blogs/read-blogentries?categoryPath=%2Fcontent%2Ffireeye-www%2Fen_US%2Fblog%2Fthreat-research

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:300b::a29f:f77d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5d8034a0d52ee6e47c205de5ef84391120e1fd51ce1d18a5508b3757021d749c

Security Headers

Name	Value
Content-Security-Policy	worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff, nosniff
X-Frame-Options	ALLOW-FROM https://content.fireeye.com
X-Xss-Protection	1; mode=block

Request headers

Accept: application/json, text/javascript, */*; q=0.01
Referer: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-dispatcher: dispatcher2uswest1
date: Sat, 25 Jul 2020 03:57:05 GMT
content-encoding: gzip
x-content-type-options: nosniff, nosniff
cf-cache-status: DYNAMIC
x-vhost: publish
status: 200
vary: Accept-Encoding,User-Agent
content-length: 17052
x-xss-protection: 1; mode=block
server: cloudflare
x-frame-options: ALLOW-FROM https://content.fireeye.com
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains
content-security-policy: worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
cf-request-id: 0425b7147c0000dfef21a30200000001
cf-ray: 5b82f46729addfef-FRA

GET sh.f48a1a04fe8dbf021b4cda1d.html
s7.addthis.com/static/ Frame 341A 0
0

GET
H2 200 adsct Show response
analytics.twitter.com/i/ 31 B
651 B 152ms
128ms Script
application/javascript 104.244.42.3
TWITTER

General

Check archive.org

Show headers Download Go to

Full URL

https://analytics.twitter.com/i/adsct?p_id=Twitter&p_user_id=0&txn_id=nw2v7&events=%5B%5B%22pageview%22%2Cnull%5D%5D&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=0&tpx_cb=twttr.conversion.loadPixels&tw_document_href=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2020%2F05%2Ftactics-techniques-procedures-associated-with-maze-ransomware-incidents.html

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

104.244.42.3 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

df3e003cc30e9bdd0313100e8ee5d468070b4b34d11ad355f276a356d4b9c7bf

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sat, 25 Jul 2020 03:57:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
status: 200, 200 OK
x-twitter-response-tags: BouncerCompliant
strict-transport-security: max-age=631138519
content-length: 57
x-xss-protection: 0
x-response-time: 116
pragma: no-cache
last-modified: Sat, 25 Jul 2020 03:57:05 GMT
server: tsa_o
x-frame-options: SAMEORIGIN
content-type: application/javascript;charset=utf-8
cache-control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash: c3ab21ea569efd542528a61a44c53d99
x-transaction: 00b85e2e000c962f
expires: Tue, 31 Mar 1981 05:00:00 GMT

GET
H/1.1 200
OK MultiNoun.jsonp Show response
d.la2c2.salesforceliveagent.com/chat/rest/System/ 226 B
591 B 700ms
110ms Script
text/javascript 13.108.251.135
SALESFORCE

General

Check archive.org

Show headers Download Go to

Full URL

https://d.la2c2.salesforceliveagent.com/chat/rest/System/MultiNoun.jsonp?nouns=VisitorId,Settings&VisitorId.prefix=Visitor&Settings.prefix=Visitor&Settings.buttonIds=[573a00000008kP3]&Settings.updateBreadcrumb=1&Settings.urlPrefix=undefined&callback=liveagent._.handlePing&deployment_id=572a0000000H8aJ&org_id=00D3000000063LS&version=34

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

13.108.251.135 , United States, ASN14340 (SALESFORCE, US),

Reverse DNS

Software

Resource Hash

ceb867b23e8f349b2d1a80d581bc3dc0307b19445aaab5dc39226946928c20f5

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: no-cache
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Content-Type: text/javascript
Access-Control-Allow-Origin: *
Cache-Control: no-cache
Access-Control-Allow-Credentials: true
Connection: close
Expires: -1

GET
H2 200 _ate.track.config_resp Show response
v1.addthisedge.com/live/boost/fewebadmin/ 3 KB
958 B 130ms
126ms Script
application/javascript 23.210.248.44
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://v1.addthisedge.com/live/boost/fewebadmin/_ate.track.config_resp
Requested by: Host: s7.addthis.com
URL: https://s7.addthis.com/js/300/addthis_widget.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.210.248.44 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-210-248-44.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 4e040b6884ad0623aece79feb28b75ee490c568a930c6bbfd83255d058d54611

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sat, 25 Jul 2020 03:57:05 GMT
content-encoding: gzip
etag: 2015823830--gzip
vary: Accept-Encoding
content-type: application/javascript;charset=utf-8
status: 200
cache-control: public, max-age=43, s-maxage=86400
content-disposition: attachment; filename=1.txt
content-length: 782

GET
H2 200 300lo.json Show response
m.addthis.com/live/red_lojson/ 89 B
249 B 172ms
171ms Script
application/javascript 23.210.248.44
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://m.addthis.com/live/red_lojson/300lo.json?si=5f1bad907e4099a9&bkl=0&bl=1&pdt=92&sid=5f1bad907e4099a9&pub=fewebadmin&rev=v8.28.7-wp&ln=en&pc=men&cb=0&ab=-&dp=www.fireeye.com&fp=blog%2Fthreat-research%2F2020%2F05%2Ftactics-techniques-procedures-associated-with-maze-ransomware-incidents.html&fr=&of=0&pd=0&irt=0&vcl=0&md=0&ct=0&tct=0&abt=0&cdn=0&pi=1&rb=0&gen=100&chr=UTF-8&colc=1595649425602&jsl=8193&uvs=5f1bad9044b794b0000&skipb=1&callback=addthis.cbs.jsonp__76282023140450430
Requested by: Host: s7.addthis.com
URL: https://s7.addthis.com/js/300/addthis_widget.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.210.248.44 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-210-248-44.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 12889f3e24272835452e1b9472bb3af9fab1c7958821287fbac099ba542efa3c

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status: 200
pragma: no-cache
date: Sat, 25 Jul 2020 03:57:05 GMT
cache-control: max-age=0, no-cache, no-store, no-transform
content-disposition: attachment; filename=1.txt
content-length: 89
content-type: application/javascript;charset=utf-8

GET
H2 200 sh.f48a1a04fe8dbf021b4cda1d.html
s7.addthis.com/static/ Frame BA48 0
0 15ms
14ms Document
text/html 23.210.248.44
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://s7.addthis.com/static/sh.f48a1a04fe8dbf021b4cda1d.html

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.210.248.44 , Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-210-248-44.deploy.static.akamaitechnologies.com

Software

nginx/1.15.8 /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains

Request headers

:method: GET
:authority: s7.addthis.com
:scheme: https
:path: /static/sh.f48a1a04fe8dbf021b4cda1d.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html

Response headers

status: 200
server: nginx/1.15.8
content-type: text/html
last-modified: Mon, 09 Sep 2019 15:34:57 GMT
etag: W/"5d767121-1115f"
timing-allow-origin: *
cache-control: public, max-age=86313600
p3p: CP="NON ADM OUR DEV IND COM STA"
strict-transport-security: max-age=15724800; includeSubDomains
content-encoding: gzip
content-length: 25412
date: Sat, 25 Jul 2020 03:57:05 GMT
vary: Accept-Encoding
x-host: s7.addthis.com

GET
H/1.1 200
OK img.gif
b.6sc.co/v1/beacon/ 43 B
774 B 251ms
221ms Image
image/gif 23.34.183.125
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=1322340356018696d853e0ac6f7ce3a2&svisitor=&visitor=4d6c4b6c-0aff-4bd8-89ba-d867daf9c9af&session=06b03f4a-a9b8-49b3-8884-2e2a24974b23&event=a_pageload&q=%7B%7D&isIframe=false&m=%7B%22description%22%3A%22Malicious%20actors%20have%20been%20actively%20deploying%20MAZE%20ransomware%20since%20at%20least%20May%202019.%5Cn%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Navigating%20the%20MAZE%3A%20Tactics%2C%20Techniques%20and%20Procedures%20Associated%20With%5CnMAZE%20Ransomware%20Incidents%20%7C%20FireEye%20Inc%22%7D&cb=49425614&r=&thirdParty=%7B%7D&an_uid=5037491777373379988

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

23.34.183.125 , Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Sat, 25 Jul 2020 03:57:05 GMT
X-Content-Type-Options: nosniff
Connection: keep-alive
Content-Length: 43
Pragma: no-cache
Last-Modified: Fri, 21 Feb 2020 18:51:25 GMT
Server: nginx/1.14.0 (Ubuntu)
ETag: "5e5026ad-2b"
Access-Control-Max-Age: 86400
Access-Control-Allow-Methods: GET,POST
Content-Type: image/gif
Access-Control-Allow-Origin
Cache-Control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
Access-Control-Allow-Credentials: true
Accept-Ranges: bytes
Access-Control-Allow-Headers: *
Expires: Wed, 19 Apr 2000 11:43:00 GMT

POST
H2 204 create_event Show response
jukebox.lookbookhq.com/api/public/v1/page_views/ 0
379 B 121ms
120ms XHR
text/plain 52.86.170.32
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://jukebox.lookbookhq.com/api/public/v1/page_views/create_event

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.86.170.32 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept: application/json
Referer: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: application/json

Response headers

x-runtime: 0.014944
date: Sat, 25 Jul 2020 03:57:05 GMT
x-content-type-options: nosniff
status: 204
access-control-max-age: 1728000
access-control-allow-methods: GET, PUT, POST, PATCH, OPTIONS
access-control-allow-origin: https://www.fireeye.com
access-control-expose-headers
cache-control: no-cache
access-control-allow-credentials: true
vary: Origin
x-request-id: 65573e4d-7888-4cb1-8f4d-55152a48fd4a

GET
H2 200 conversion.js Show response
s.yimg.jp/images/listing/tool/cv/ 4 KB
2 KB 715ms
237ms Script
application/javascript 182.22.24.124
YAHOO Yahoo Japan...

General

Check archive.org

Show headers Download Go to

Full URL: https://s.yimg.jp/images/listing/tool/cv/conversion.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MVGC8KK
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 182.22.24.124 Tokyo, Japan, ASN23816 (YAHOO Yahoo Japan Corporation, JP),
Reverse DNS
Software: ATS /
Resource Hash: e55596fc1c3349cbbc926529c29c27e1de7b98b47a31cc7bb4789970e571065f

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

ats-carp-promotion: 1
date: Sat, 25 Jul 2020 03:50:59 GMT
content-encoding: gzip
last-modified: Thu, 29 Aug 2019 10:27:08 GMT
server: ATS
age: 367
vary: Accept-Encoding
p3p: policyref="http://privacy.yahoo.co.jp/w3c/p3p_jp.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE GOV"
status: 200
cache-control: public, max-age=600
accept-ranges: bytes
content-type: application/javascript
content-length: 1421
via: http/1.1 edge1267.img.bbt.yahoo.co.jp (ApacheTrafficServer [cRs f ]), http/1.1 edge1205.img.bbt.yahoo.co.jp (ApacheTrafficServer [cRs f ])
expires: Sat, 25 Jul 2020 04:00:59 GMT

GET
H2 200 details Show response
epsilon.6sense.com/v1/company/ 577 B
562 B 29ms
12ms XHR
application/json 52.57.44.100
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://epsilon.6sense.com/v1/company/details
Requested by: Host: www.fireeye.com
URL: https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.57.44.100 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx/1.16.0 /
Resource Hash: 02b6eb84173fa73324f511f7ad8d8c2d45ef64fd8a1503febe7b9cb6717f85f3

Request headers

Authorization: Token 325d6d60e24c7cfc3a782839d85ce08c8d3bb27c
Referer: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
EpsilonCookie: cbf315026f54000090ad1b5f9c000000dd7d0500

Response headers

date: Sat, 25 Jul 2020 03:57:05 GMT
content-encoding: gzip
server: nginx/1.16.0
status: 200
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: https://www.fireeye.com
access-control-allow-credentials: true
content-length: 373

POST
H/1.1 200
OK page_views Show response
abm2.listenloop.com/api/v1/public/ 379 B
966 B 1424ms
1424ms XHR
application/json 54.81.89.51
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://abm2.listenloop.com/api/v1/public/page_views
Requested by: Host: www.fireeye.com
URL: https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.81.89.51 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: nginx /
Resource Hash: d8ae076bb3e923a21140fc50ec52241c1204d8807c1f963626f659973fac3f77

Request headers

Accept: application/json, text/javascript, */*; q=0.01
Referer: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: application/json

Response headers

X-Runtime: 1.321531
Date: Sat, 25 Jul 2020 03:57:07 GMT
Content-Encoding: gzip
Server: nginx
ETag: W/"6e881f208517dc97f54a81e48ae96f5e"
Vary: Accept-Encoding
Access-Control-Allow-Methods: GET, POST, DELETE, PUT, PATCH, OPTIONS, HEAD
Content-Type: application/json; charset=utf-8
Access-Control-Allow-Origin: https://www.fireeye.com
Cache-Control: max-age=0, private, must-revalidate
Access-Control-Allow-Credentials: true
Connection: keep-alive
Access-Control-Allow-Headers: Access-Control-Request-Headers,X-User-Token,X-User-email,content-type,X-RateLimit-Limit,X-RateLimit-Remaining,X-RateLimit-Reset
Content-Length: 258
X-Request-Id: c7bdae4a-66f4-4e02-9a8f-9508b17d7ff8

GET
H/1.1 200
OK visitWebPage Show response
848-did-242.mktoresp.com/webevents/ 2 B
304 B 844ms
152ms XHR
text/plain 192.28.147.68
MARKETO

General

Check archive.org

Show headers Download Go to

Full URL: https://848-did-242.mktoresp.com/webevents/visitWebPage?_mchNc=1595649425721&_mchCn=&_mchId=848-DID-242&_mchTk=_mch-fireeye.com-1595649425721-41390&_mchHo=www.fireeye.com&_mchPo=&_mchRu=%2Fblog%2Fthreat-research%2F2020%2F05%2Ftactics-techniques-procedures-associated-with-maze-ransomware-incidents.html&_mchPc=https%3A&_mchVr=158&_mchEcid=&_mchHa=&_mchRe=&_mchQp=
Requested by: Host: www.fireeye.com
URL: https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 192.28.147.68 , United States, ASN53580 (MARKETO, US),
Reverse DNS
Software: akka-http/10.1.11 /
Resource Hash: 565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Access-Control-Allow-Origin: *
Date: Sat, 25 Jul 2020 03:57:06 GMT
Content-Encoding: gzip
Server: akka-http/10.1.11
Transfer-Encoding: chunked
X-Request-Id: f0fcb6c0-a972-4f41-ac36-7f014a162b21
Content-Type: text/plain; charset=UTF-8

GET
H2 200 forms2.css
www2.fireeye.com/js/forms2/css/ 13 KB
3 KB 22ms
21ms Stylesheet
text/css 104.17.73.206
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www2.fireeye.com/js/forms2/css/forms2.css

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

104.17.73.206 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

397d07fbfb19b6ac538d7b8bcdf5ebf7be881c9f9ad3982278d9d4f3a02c160b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sat, 25 Jul 2020 03:57:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
age: 2465
status: 200
content-length: 2610
cf-request-id: 0425b719430000cd8fee8c7200000001
last-modified: Wed, 27 May 2020 19:45:35 GMT
server: cloudflare
etag: "201e0f-33f8-5a6a674a055c0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/css
cache-control: public, max-age=14400
accept-ranges: bytes
cf-ray: 5b82f46ede49cd8f-CDG
expires: Sat, 25 Jul 2020 07:57:05 GMT

GET
H2 200 forms2-theme-simple.css
www2.fireeye.com/js/forms2/css/ 826 B
351 B 25ms
24ms Stylesheet
text/css 104.17.73.206
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www2.fireeye.com/js/forms2/css/forms2-theme-simple.css

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

104.17.73.206 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

14c8c62dc692fd8faa04434e3fed25e7c23d596b732f9db88f6e9f9ff5dfa61c

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sat, 25 Jul 2020 03:57:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
age: 2465
status: 200
content-length: 242
cf-request-id: 0425b719440000cd8fee8c8200000001
last-modified: Wed, 27 May 2020 19:45:35 GMT
server: cloudflare
etag: "201e15-33a-5a6a674a055c0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/css
cache-control: public, max-age=14400
accept-ranges: bytes
cf-ray: 5b82f46ede4acd8f-CDG
expires: Sat, 25 Jul 2020 07:57:05 GMT

GET
H2 200 layers.33f5b85045a5f2308467.js Show response
s7.addthis.com/static/ 263 KB
76 KB 11ms
10ms Script
application/javascript 23.210.248.44
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://s7.addthis.com/static/layers.33f5b85045a5f2308467.js

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.210.248.44 , Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-210-248-44.deploy.static.akamaitechnologies.com

Software

nginx/1.15.8 /

Resource Hash

137e41c449677deb7c8da3afde63fc781b095bb028f78b789be44192e8e3f4be

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=15724800; includeSubDomains
content-encoding: gzip
last-modified: Thu, 04 Jun 2020 15:49:19 GMT
server: nginx/1.15.8
etag: W/"5ed917ff-41b9f"
vary: Accept-Encoding
content-type: application/javascript
status: 200
cache-control: public, max-age=86313600
date: Sat, 25 Jul 2020 03:57:05 GMT
x-host: s7.addthis.com
timing-allow-origin: *
content-length: 77540

GET
H2 200 collect
www.google-analytics.com/ 35 B
96 B 6ms
5ms Image
image/gif 2a00:1450:4001:816::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j83&a=1653155333&t=event&ni=0&_s=1&dl=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2020%2F05%2Ftactics-techniques-procedures-associated-with-maze-ransomware-incidents.html&ul=en-us&de=UTF-8&dt=Navigating%20the%20MAZE%3A%20Tactics%2C%20Techniques%20and%20Procedures%20Associated%20With%20MAZE%20Ransomware%20Incidents%20%7C%20FireEye%20Inc&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=Page%20views%20with%20form&ea=view&el=Form&_u=aHDAAEAB~&jid=&gjid=&cid=716160653.1595649423&tid=UA-363943-1&_gid=1262071136.1595649423&gtm=2wg7f0MVGC8KK&cd3=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2020%2F05%2Ftactics-techniques-procedures-associated-with-maze-ransomware-incidents.html&cd17=Form&cd18=3353&cd19=Navigating%20the%20MAZE%3A%20Tactics%2C%20Techniques%20and%20Procedures%20Associated%20With%20MAZE%20Ransomware%20Incidents%20%7C%20FireEye%20Inc&z=197342450

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:816::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 22 Jul 2020 21:32:37 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 195868
status: 200
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H2 200 XDFrame Show response
www2.fireeye.com/index.php/form/ Frame 6817 2 KB
784 B 183ms
182ms Document
text/html 104.17.73.206
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www2.fireeye.com/index.php/form/XDFrame

Requested by

Host: www2.fireeye.com
URL: https://www2.fireeye.com/js/forms2/js/forms2.min.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

104.17.73.206 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

4ecd284b8811543e88f4c470ba7b3fe3f4b7a458c512bb92ab41d2b491aee6ca

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

:method: GET
:authority: www2.fireeye.com
:scheme: https
:path: /index.php/form/XDFrame
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: __cfduid=df51a1f8e293bdc2ce3851b5edd361f9b1595649422; _gcl_au=1.1.811955511.1595649423; __cf_bm=fb367dec9a6a1c6ee6aed660b04ccee46ddc744b-1595649422-1800-ATlvrg2l/w2fOxnyjgNC32PFSNdPI47ZrZ7GZfSs7xiTvVb8Ok8NOoRBw7Kng1OE6ES+PMvQxd28QeQT5MD2mk4=; _ga=GA1.2.716160653.1595649423; _gid=GA1.2.1262071136.1595649423; _gat_UA-363943-1=1; _uetsid=f6012d61831a0e2794989bf010cf7138; _uetvid=1e8d95d0355e87c719e8f0f747d98ca7; _lfa=eyIzUDF3MjRkZ3JtSjdtWTVuIjoiTEYxLjEuNTM1NGM3NGFhZWFlNGY5NC4xNTk1NjQ5NDIzMDMxIn0%3D; _sp_ses.81ef=*; _sp_id.81ef=b7a04115-b095-4a2a-a44d-60ac0495d123.1595649423.1.1595649423.1595649423.50d34ca4-97db-417e-ab05-a43e14fa4c66; _fbp=fb.1.1595649423239.2096336296; BIGipServersjiweb-nginx-app_https=!obupHgEDWMEoL+HInuzRy4alk/3R/nnwcW3C4/6T4WubFhlXzwyWd6CdLnta8WU2c6sBzZukFF3o3n0=; vid=bebf10ec-2763-466a-ae17-6ce964d60208; _mkto_trk=id:848-DID-242&token:_mch-fireeye.com-1595649425721-41390
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html

Response headers

status: 200
date: Sat, 25 Jul 2020 03:57:06 GMT
content-type: text/html; charset=utf-8
cache-control: max-age=3600
x-content-type-options: nosniff
vary: Accept-Encoding
cf-cache-status: DYNAMIC
cf-request-id: 0425b719bb0000cd8fee8ca200000001
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server: cloudflare
cf-ray: 5b82f46f9f0acd8f-CDG
content-encoding: gzip

GET
H2 200 forms2.min.js Show response
www2.fireeye.com/js/forms2/js/ Frame 6817 203 KB
68 KB 27ms
27ms Script
application/x-javascript 104.17.73.206
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www2.fireeye.com/js/forms2/js/forms2.min.js

Requested by

Host: www2.fireeye.com
URL: https://www2.fireeye.com/index.php/form/XDFrame

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

104.17.73.206 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

30b92b1d67692c95ef6d322b21cb9e0c2f7d5a4c68c05b4e3e3e87489ec41309

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www2.fireeye.com/index.php/form/XDFrame
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sat, 25 Jul 2020 03:57:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
age: 4943
status: 200
cf-request-id: 0425b71a770000cd8fee8d2200000001
last-modified: Sat, 06 Jun 2020 07:41:36 GMT
server: cloudflare
etag: "4617e8-32dcc-5a76581e289b9"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: public, max-age=14400
cf-ray: 5b82f470b813cd8f-CDG
expires: Sat, 25 Jul 2020 07:57:06 GMT

GET
H/1.1 200
OK MultiNoun.jsonp Show response
d.la1-c1-ia5.salesforceliveagent.com/chat/rest/System/ 496 B
758 B 381ms
94ms Script
text/javascript 13.110.67.53
SALESFORCE

General

Check archive.org

Show headers Download Go to

Full URL

https://d.la1-c1-ia5.salesforceliveagent.com/chat/rest/System/MultiNoun.jsonp?nouns=VisitorId,Settings&VisitorId.prefix=Visitor&Settings.prefix=Visitor&Settings.buttonIds=[573a00000008kP3]&Settings.updateBreadcrumb=1&Settings.urlPrefix=undefined&callback=liveagent._.handlePing&deployment_id=572a0000000H8aJ&org_id=00D3000000063LS&version=34

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

13.110.67.53 , United States, ASN14340 (SALESFORCE, US),

Reverse DNS

Software

Resource Hash

d965343b3c647dcdd891e6f696a33c8403a61b87ffe3d1933de161eeae13fe6d

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: no-cache
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Content-Type: text/javascript
Access-Control-Allow-Origin: *
Cache-Control: no-cache
Access-Control-Allow-Credentials: true
Connection: close
Expires: -1

GET
H/1.1 200
OK /
b91.yahoo.co.jp/pagead/conversion/1000244663/ 42 B
909 B 1030ms
304ms Image
image/gif 183.79.255.28
YAHOO-JP-AS-AP Ya...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b91.yahoo.co.jp/pagead/conversion/1000244663/?random=1595649426366&cv=9&fst=1595649426366&num=1&fmt=3&value=0&label=ppcGCKvb3mcQ_c2swgM&guid=ON&disvt=true&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&sendb=1&ig=1&frm=0&url=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2020%2F05%2Ftactics-techniques-procedures-associated-with-maze-ransomware-incidents.html&tiba=Navigating%20the%20MAZE%3A%20Tactics%2C%20Techniques%20and%20Procedures%20Associated%20With%20MAZE%20Ransomware%20Incidents%20%7C%20FireEye%20Inc&hn=www.googleadservices.com&async=1

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

183.79.255.28 , Japan, ASN24572 (YAHOO-JP-AS-AP Yahoo Japan, JP),

Reverse DNS

Software

ATS /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: no-cache
Date: Sat, 25 Jul 2020 03:57:07 GMT
Via: http/1.1 mscedge2104.img.umd.yahoo.co.jp (ApacheTrafficServer [c sSf ])
X-Content-Type-Options: nosniff
Server: ATS
Timing-Allow-Origin: *
Age: 0
P3P: policyref="http://privacy.yahoo.co.jp/w3c/p3p_jp.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE GOV"
Cache-Control: no-cache, must-revalidate, private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 42
X-XSS-Protection: 0
Expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ytc.js Show response
s.yimg.com/wi/ 14 KB
6 KB 18ms
17ms Script
application/javascript 2a00:1288:f03d:1fa::2000
YAHOO-1

General

Check archive.org

Show headers Download Go to

Full URL

https://s.yimg.com/wi/ytc.js

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1288:f03d:1fa::2000 , United Kingdom, ASN10310 (YAHOO-1, US),

Reverse DNS

Software

ATS /

Resource Hash

a3ce11e17464ae96ee2f1245fbf3c6cffa1aa6e7f6460fb6f8cbe95cfe1874cc

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sat, 25 Jul 2020 03:49:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 478
x-amz-server-side-encryption: AES256
status: 200
vary: Origin, Accept-Encoding
x-amz-request-id: F5F96C404EE00DFC
x-amz-id-2: JG5jgnSrFXmMf50sdifqaD1syc967pE1LsdSb9m+JDLsDAG6GO7k1yCRJP/YoxIziXYxApJbNYY=
accept-ranges: bytes
referrer-policy: no-referrer-when-downgrade
x-amz-expiration: expiry-date="Wed, 18 Aug 2021 00:00:00 GMT", rule-id="oath-standard-lifecycle"
last-modified: Mon, 13 Jul 2020 09:52:56 GMT
server: ATS
etag: "c83019cecf523f1903b97d476c683822-df"
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security: max-age=15552000
x-amz-version-id: ANdKZB5CZM6v65L5sAW33.1KG2ruBZ8a
x-xss-protection: 1; mode=block
cache-control: public,max-age=3600
content-length: 5540
content-type: application/javascript

GET
H2 200 json Show response
fireeye.tt.omtrdc.net/m2/fireeye/mbox/ 12 KB
2 KB 122ms
36ms XHR
application/json 54.76.99.142
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://fireeye.tt.omtrdc.net/m2/fireeye/mbox/json?mbox=target-global-mbox&mboxSession=52c7d6ed8dc54dd18620f58232b9ba2d&mboxPC=&mboxPage=c7609b8490904813932765661d311f59&mboxRid=186d51ae872c4f7ca20fe1ee4f4e0989&mboxVersion=1.7.1&mboxCount=1&mboxTime=1595656626394&mboxHost=www.fireeye.com&mboxURL=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2020%2F05%2Ftactics-techniques-procedures-associated-with-maze-ransomware-incidents.html&mboxReferrer=&browserHeight=1200&browserWidth=1600&browserTimeOffset=120&screenHeight=1200&screenWidth=1600&colorDepth=24&devicePixelRatio=1&screenOrientation=landscape&companyRevenueRange=%245B%2B&companyCountry=Germany&companyIndustry=Transportation%20and%20Logistics&companyName=American%20Airlines&companyRegion=Western%20Europe&companyDomain=aa.com&segments=%5B%22FY2020%20Security%20Effectiveness%20Intent%22%5D
Requested by: Host: www.fireeye.com
URL: https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.76.99.142 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: f139ca0c992d47ee2eeb0bb92f77fdf828638fbc5145a2fa4705b4701582270b

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 25 Jul 2020 03:57:06 GMT
content-encoding: gzip
status: 200
vary: Origin,Accept-Encoding
content-type: application/json;charset=UTF-8
access-control-allow-origin: https://www.fireeye.com
cache-control: no-cache
access-control-allow-credentials: true
timing-allow-origin: *
x-request-id: 186d51ae872c4f7ca20fe1ee4f4e0989

GET
H2 200 435600.json Show response
s.yimg.com/wi/config/ 2 B
494 B 54ms
19ms XHR
application/json 2a00:1288:f03d:1fa::2000
YAHOO-1

General

Check archive.org

Show headers Download Go to

Full URL

https://s.yimg.com/wi/config/435600.json

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1288:f03d:1fa::2000 , United Kingdom, ASN10310 (YAHOO-1, US),

Reverse DNS

Software

ATS /

Resource Hash

44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sat, 25 Jul 2020 03:23:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1993
status: 200
vary: Origin, Access-Control-Request-Headers, Access-Control-Request-Method, Accept-Encoding
x-amz-request-id: 18DD81A0325215B4
x-amz-id-2: d+q0iJsg0rLf/2VGE+APCeiYnbUAb/AqjGPWE76Y/FJFg+KSLbhaehSjhoaS3Od2mNs0nOXi3tA=
referrer-policy: no-referrer-when-downgrade
server: ATS
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security: max-age=15552000
access-control-allow-methods: GET
content-type: application/json
access-control-allow-origin: *
x-xss-protection: 1; mode=block
cache-control: public,max-age=3600
content-length: 22

GET
H2 200 sp.pl Show response
sp.analytics.yahoo.com/ 0
528 B 97ms
33ms Script
application/x-javascript 212.82.100.181
YAHOO-IRD

General

Check archive.org

Show headers Download Go to

Full URL

https://sp.analytics.yahoo.com/sp.pl?a=10000&d=Sat%2C%2025%20Jul%202020%2003%3A57%3A06%20GMT&n=-2d&b=Navigating%20the%20MAZE%3A%20Tactics%2C%20Techniques%20and%20Procedures%20Associated%20With%20MAZE%20Ransomware%20Incidents%20%7C%20FireEye%20Inc&.yp=435600&f=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2020%2F05%2Ftactics-techniques-procedures-associated-with-maze-ransomware-incidents.html&enc=UTF-8&tagmgr=gtm%2Cadobe

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

212.82.100.181 , Switzerland, ASN34010 (YAHOO-IRD, GB),

Reverse DNS

Software

ATS /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sat, 25 Jul 2020 03:57:06 GMT
x-content-type-options: nosniff
age: 0
status: 200
content-length: 0
x-xss-protection: 1; mode=block
pragma: no-cache
referrer-policy: strict-origin-when-cross-origin
server: ATS
x-frame-options: DENY
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security: max-age=31536000
content-type: application/x-javascript
cache-control: no-cache, private, must-revalidate
accept-ranges: bytes
expires: Sat, 25 Jul 2020 03:57:06 GMT

GET
H2 200 core
widget.drift.com/ Frame E6A5 0
0 325ms
287ms Document
text/html 143.204.201.104
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://widget.drift.com/core?embedId=wm3vc3smix6y&forceShow=false&skipCampaigns=false&sessionId=8df041b7-45da-4be7-9767-ce63cdc26364&sessionStarted=1595649427&campaignRefreshToken=ade2e7e1-be91-46b8-a2f0-80201d49ca4f

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

143.204.201.104 Seattle, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

:method: GET
:authority: widget.drift.com
:scheme: https
:path: /core?embedId=wm3vc3smix6y&forceShow=false&skipCampaigns=false&sessionId=8df041b7-45da-4be7-9767-ce63cdc26364&sessionStarted=1595649427&campaignRefreshToken=ade2e7e1-be91-46b8-a2f0-80201d49ca4f
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html

Response headers

status: 200
content-type: text/html
server: nginx
last-modified: Thu, 23 Jul 2020 19:40:43 GMT
x-amz-server-side-encryption: AES256
access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
strict-transport-security: max-age=31536000; includeSubDomains
content-encoding: gzip
date: Sat, 25 Jul 2020 03:57:07 GMT
etag: "53dca38969e77024b85c5c0dec388ec9"
cache-control: no-cache
vary: Accept-Encoding
x-cache: RefreshHit from cloudfront
via: 1.1 269bfdd288bfea5423a4e9e701777da6.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA53-C1
x-amz-cf-id: Pcxf_XevSPHgUqdk3XZI9Pc-vrcKw0SDOX1nKiRvVaSXL_a_NhrYNw==

GET
H2 200 chat
widget.drift.com/core/ Frame 98A1 0
0 325ms
289ms Document
text/html 143.204.201.104
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://widget.drift.com/core/chat

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

143.204.201.104 Seattle, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

:method: GET
:authority: widget.drift.com
:scheme: https
:path: /core/chat
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html

Response headers

status: 200
content-type: text/html
server: nginx
last-modified: Thu, 23 Jul 2020 19:40:43 GMT
x-amz-server-side-encryption: AES256
access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
strict-transport-security: max-age=31536000; includeSubDomains
content-encoding: gzip
date: Sat, 25 Jul 2020 03:57:07 GMT
etag: "53dca38969e77024b85c5c0dec388ec9"
cache-control: no-cache
vary: Accept-Encoding
x-cache: RefreshHit from cloudfront
via: 1.1 269bfdd288bfea5423a4e9e701777da6.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA53-C1
x-amz-cf-id: nna5WfAIMkUVoVCvldHMIzVjYw2-KXsUcFx8H9MCQBUZgYShiUuPVA==

GET
H2

200

ga-audiences
www.google.de/ads/
Redirect Chain

https://www.google-analytics.com/r/collect?v=1&_v=j83&a=1653155333&t=event&ni=0&_s=1&dl=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2020%2F05%2Ftactics-techniques-procedures-associated...
https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-363943-1&cid=716160653.1595649423&jid=1674544131&_gid=1247463997.1595649427&gjid=977194290&_v=j83&z=1108971003
https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-363943-1&cid=716160653.1595649423&jid=1674544131&_v=j83&z=1108971003
https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-363943-1&cid=716160653.1595649423&jid=1674544131&_v=j83&z=1108971003&slf_rd=1&random=4277967870

42 B
106 B

17ms
15ms

Image
image/gif

2a00:1450:4001:81a::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-363943-1&cid=716160653.1595649423&jid=1674544131&_v=j83&z=1108971003&slf_rd=1&random=4277967870

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81a::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 25 Jul 2020 03:57:07 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Sat, 25 Jul 2020 03:57:07 GMT
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 302
content-type: text/html; charset=UTF-8
location: https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-363943-1&cid=716160653.1595649423&jid=1674544131&_v=j83&z=1108971003&slf_rd=1&random=4277967870
cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: s7.addthis.com
URL: https://s7.addthis.com/static/sh.f48a1a04fe8dbf021b4cda1d.html

Verdicts & Comments Add Verdict or Comment

205 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			www.fireeye.com/	1970-01-19 11:14:11	Name: drift_campaign_refresh Value: ade2e7e1-be91-46b8-a2f0-80201d49ca4f

10 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
console-api	debug	URL: https://v2.listenloop.com/loop.bundle.js(Line 4) Message: [bugsnag] Loaded!
console-api	log	URL: https://v2.listenloop.com/loop.bundle.js(Line 4) Message: currentPagePath :: /blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents
console-api	log	URL: https://v2.listenloop.com/loop.bundle.js(Line 4) Message: [object Object]
console-api	log	URL: https://v2.listenloop.com/loop.bundle.js(Line 4) Message: [object Object]
console-api	log	URL: https://v2.listenloop.com/loop.bundle.js(Line 4) Message: 716160653.1595649423
console-api	warning	URL: https://v2.listenloop.com/loop.bundle.js(Line 4) Message: AT: Failed actions [object Object],[object Object],[object Object]
console-api	log	URL: https://v2.listenloop.com/loop.bundle.js(Line 4) Message: cookie value
console-api	log	URL: https://v2.listenloop.com/loop.bundle.js(Line 4) Message: cookie value
console-api	log	URL: https://v2.listenloop.com/loop.bundle.js(Line 4) Message: cookie value
console-api	log	URL: https://v2.listenloop.com/loop.bundle.js(Line 4) Message: cookie value

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff nosniff
X-Frame-Options	ALLOW-FROM https://content.fireeye.com
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

8443343.fls.doubleclick.net
848-did-242.mktoresp.com
abm2.listenloop.com
analytics.twitter.com
app.cdn.lookbookhq.com
attr.ml-api.io
b.6sc.co
b91.yahoo.co.jp
bat.bing.com
c.6sc.co
c.la2c2.salesforceliveagent.com
cdn.pathfactory.com
cloud.typography.com
connect.facebook.net
d.la1-c1-ia5.salesforceliveagent.com
d.la2c2.salesforceliveagent.com
epsilon.6sense.com
fireeye.tt.omtrdc.net
fonts.googleapis.com
googleads.g.doubleclick.net
j.6sc.co
js.driftt.com
js.maxmind.com
jukebox.lookbookhq.com
jukebox.pathfactory.com
lftracker.leadfeeder.com
m.addthis.com
maxcdn.bootstrapcdn.com
munchkin.marketo.net
px.ads.linkedin.com
s.ml-attr.com
s.yimg.com
s.yimg.jp
s7.addthis.com
secure.adnxs.com
segment.prod.bidr.io
snap.licdn.com
sp.analytics.yahoo.com
static.ads-twitter.com
stats.g.doubleclick.net
t.co
tr.lfeeder.com
v1.addthisedge.com
v2.listenloop.com
widget.drift.com
widget.driftqa.com
www.facebook.com
www.fireeye.com
www.google-analytics.com
www.google.com
www.google.de
www.googleadservices.com
www.googletagmanager.com
www.linkedin.com
www2.fireeye.com
z.moatads.com
s7.addthis.com
104.109.95.62
104.17.73.206
104.244.42.133
104.244.42.3
13.108.251.135
13.108.251.7
13.110.67.53
13.35.254.21
143.204.201.10
143.204.201.104
143.204.201.123
143.204.201.28
143.204.201.52
143.204.201.78
151.101.112.157
172.217.23.134
18.208.65.88
182.22.24.124
183.79.255.28
184.25.217.53
185.33.220.243
192.28.147.68
2.18.235.40
2001:4de0:ac19::1:b:3a
212.82.100.181
216.58.212.130
23.210.248.44
23.34.183.125
2600:9000:214f:9400:1a:2af:6d00:93a1
2606:4700:300b::a29f:f77d
2606:4700:3036::681b:9d96
2606:4700::6810:262f
2620:1ec:21::14
2620:1ec:c11::200
2a00:1288:f03d:1fa::2000
2a00:1450:4001:80b::2002
2a00:1450:4001:816::2008
2a00:1450:4001:816::200e
2a00:1450:4001:819::200a
2a00:1450:4001:81a::2003
2a00:1450:4001:81d::2004
2a00:1450:400c:c0a::9d
2a02:26f0:6c00:28c::25ea
2a03:2880:f01c:8012:face:b00c:0:3
2a03:2880:f11c:8183:face:b00c:0:25de
2a05:f500:11:101::b93f:9005
34.251.7.133
52.57.44.100
52.86.170.32
54.76.99.142
54.81.89.51
68.67.153.60
02b6eb84173fa73324f511f7ad8d8c2d45ef64fd8a1503febe7b9cb6717f85f3
05090f9390f5bc0cd23fe5f432037cc92d7cbce1ced9bfe8faf3d1c9abae85cd
0590bf440f1352fb0ef85c8f6c4c50ccfa58715f148ba274078f5a574d54450d
0e28cd255cac05ac63cb7b021b9436cbf1bd24b34218edefc7b9675bbcb6dec7
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
12889f3e24272835452e1b9472bb3af9fab1c7958821287fbac099ba542efa3c
137e41c449677deb7c8da3afde63fc781b095bb028f78b789be44192e8e3f4be
14c8c62dc692fd8faa04434e3fed25e7c23d596b732f9db88f6e9f9ff5dfa61c
1755acef8199c66af06c7e1d318bb90542a3053412575d978dcb6dafad7cd98b
1c7c6cbe8b5beb7e138cfcc8f6301d21b35437e5559be7afd0afe3f536d5fc02
1cddcd88d3332d560856627ab2cecc7d9aa6c9d616729701ae13902d1671d0b0
1de5a2b057fc1fd85e8b3ccffa91101c8304a88b32fccb33e19d7657a1460dae
2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8
2d08fbb551cffc4e12771f69d762b5debab879d64f3d29c2a7f6235bad4b24d8
3091b6187cdf72d32615fd3df8c882e3cf6ca0f3e8b010d5f4f937ab2d619d94
30b92b1d67692c95ef6d322b21cb9e0c2f7d5a4c68c05b4e3e3e87489ec41309
319949c8c08b86e9c35ea542c0dc0c30cedaa9b8d3d3c3327a36c91aefbd8af5
325788f630aa3ff90d75e60d764ebba3adf2d304671b57e327fe3801bbdad9de
355604a949ef95ceffcd21a7e9b5ed27c95d847f95127e0ddad5aa1793f1bb74
397d07fbfb19b6ac538d7b8bcdf5ebf7be881c9f9ad3982278d9d4f3a02c160b
3aadac47cf44df595934bec631a78bf2ba62081ab95528e684a85b4c74453e77
3c0d15c27b324cc20afc87a72ac54515967cae4cb086fe5ba272df704b774ebe
4086c8cd4c3361452c1c1da9af3034fc90f4a375c4f6195f31d6dcf1c7b56f00
414f3b767a63e80c21480cecdef2d5175d813c6d0363feb5580b50ab968a8909
41dd5e421fe221a7d2921d6fa2b36e8b01a9f2c054aaef5fad866fe896c1d1e0
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
4d0e25f8bb3e86a79810cbef186fcf12d3355c679beb0c8a295c0f8dfe361b41
4e040b6884ad0623aece79feb28b75ee490c568a930c6bbfd83255d058d54611
4ecd284b8811543e88f4c470ba7b3fe3f4b7a458c512bb92ab41d2b491aee6ca
5062a8070951a1c77103a1bb6d96a11f185c50e4ee7b317320a8588243f6d828
50cf303cfaa020fcbedd6ad1bf045a008cbb88dfc792f731f07235dd1ca13599
553a661ebca404c9efff0b67e7c71f3dfd78a53d0c8fb6a498c914d7910772af
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3
56bf97572cc7de5a19131a062e5e0e64ffa38dc71e87cdfa7c0e481e15f2d628
5b701db4813b82b18ad7f0db593b1dcc5c435f7be396ef3a937f8ed1ec7b343d
5c622f5433cbb6ea1df5c0dd8671e55ef7d1464366074730473c453de50a579b
5d8034a0d52ee6e47c205de5ef84391120e1fd51ce1d18a5508b3757021d749c
5f967fd41346c0fc1b9b44fa69c52bf1e754420c59c8017cefb0a14a764cafa4
71aa66e3c94df617c70a1b9530acaa18c9f049d6d29dbaa6d0efe84d7104805a
757eb886edd9a887fc95b701c88b08191eb743657027636c0c9d4973547ebb4a
771f01c80b031bd10d587c781474cc0f896b4d08a20356fdef47b0eb2e586b6d
799cb15a25ed2fa78bdba496d1afbc68f033a3a5dd9ead12f4eaac4e0a93236d
79b2448738716f0daf11d4a206e105e3b79e9d082f9c9bf4ad2bd55e591a1a3c
7a9b430c967ef28f18302a4a877bb473585ec7568b929e61207f9853a0ec67dc
7d6fd646e0efeb5d1209c2d9008343cb061cc7d70408fbd108f683dbc4d17fa8
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
84a91ff2a1a995e3816750f53342b4499bfefc817a8ee1a5d4b401433692d510
880b294f78530ed392f3e5e9c35d9f3a3e761e0855312edd340d8df857cf5069
98204ac22dba30568464061966f90acb7872abdd8c432867274b05a6a2bc9d75
9b935949913b686e1e44928fb476ad5611303afc06e844ff620f59370d9c77bd
9d9b4530e8bfa71ef5fbdfbb9a8c08b126244321b2ee060849bff635d4551329
a0a0933f843198c607baaf63f153e3fb5fd900d91f31d37d0f71b53ca66c4ab9
a3ce11e17464ae96ee2f1245fbf3c6cffa1aa6e7f6460fb6f8cbe95cfe1874cc
a968b17677c357d33a924969a798e009e63d3c6667e41f8997c9804007f17fe0
ac8511a575f9ff43c005f8be9f0fb7b81b8aebf2fd2e1df8df7809df4b77cc07
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
aca0199001d18fd46c7defac2467bfebb49fb930b77ed5412fd3a7578b5120f8
ad80ac33ed04b4e6d78167b4162ecd3d2e8c29d17b43eb3df1f35b216b2ac5c5
aeb54739ad664ca0dde2785d1a4c64495b8d91e7eee6ab4d7788769655746f88
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b397476bcbcf8c9eae3f82007cc4f9495661b367e02e6d3dea6e15f0610ef20a
b5d7707ea8fc00aae40bf500ac7498d7f32f6b1bbff7b4fde976a40345eb5f9d
b7fd7aa1e35ad07b9abc18df313e20bf48b0dfb9a9047e54aea920768db23003
bf117733c4577e9f7081237ef499af90631146d12759cf11ad847fafee83ac21
c084b47104c493fb377b6d35d8c08df67d773f6dcf8294c0a7360710cd8cacbd
c12b0339ae4601edf3d549f50b7996d241b44ac2a4d1268adf7d8a0695ccb142
c67285da3e4cf32db0353c683a2dda13afaeb90c36c92fb90566b8eb23c6f626
c986afd07a4082d65befeef18869a4cd5e00f3ac6e8228d49658802c7453a1b8
cdb1913bcbe7fc4c6b5275adaa24244fd793424baef358810990b57b5c686ac7
ceb867b23e8f349b2d1a80d581bc3dc0307b19445aaab5dc39226946928c20f5
d20cf953b941d38ca8b450334f135fbe787dc4cb8371f4032fda9337cbfd5836
d32996520262a9559a26eafe3413cf1a2fe53f448da989d0493e7851f887a1b0
d8ae076bb3e923a21140fc50ec52241c1204d8807c1f963626f659973fac3f77
d965343b3c647dcdd891e6f696a33c8403a61b87ffe3d1933de161eeae13fe6d
dab13d67a41e3de07e721c8b35ae3a41c5d04bfd25a00a24125816768521065a
dba1808b3ae42768762130293e50e1bebee2f7aff688a309910fa3bf0e528c21
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
df3e003cc30e9bdd0313100e8ee5d468070b4b34d11ad355f276a356d4b9c7bf
e33257e40a5420d325cbdd826a42403d63e4fa3c32efb3d7a4b3596aa0541a64
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e55596fc1c3349cbbc926529c29c27e1de7b98b47a31cc7bb4789970e571065f
e7c5bf547e9a3a4b2bd530bee5fe6bf05aaff95ffce44ce44584b966fc7e7984
eb12a261a24e54883613710a4c12f4d9205f634ca1a29d1df07f90105a93e746
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f08cea88c54a644c35abf8c3b33f3d997ff5bd673b940936f82bb80fcb37b6e2
f139ca0c992d47ee2eeb0bb92f77fdf828638fbc5145a2fa4705b4701582270b
f20b7aacff69fbfc6fc0aaff9220bab48d3ce87c45bd077fea61e5d9e7662c2c
f630c6ea4e44c35a93c0ee2950e68857311d9500d6025abe4a5db3ecaf270e3c
f684d50dc9b24df0a4845f688a45b856d945f79d79549240187e171e1655f236
fbcc2c7d4dfbc5d0251c789843b8d7edf25306dfa23188ad267e2786357233c0
fd361b57998c76f86335afa28b8a62527d88a8200fb5c428d6f0fff73383e955
ffd2814d8b7dfe4aaeb635596f0259871e16ad9dce8ee04e25edff58b8b425f3

www.fireeye.com Open in urlscan Pro 2606:4700:300b::a29f:f77d Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

100 Requests

99 %HTTPS

37 %IPv6

44 Domains

56 Subdomains

49 IPs

9 Countries

3609 kBTransfer

6991 kBSize

1 Cookies

27 Outgoing links

Redirected requests

100 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 10 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

www.fireeye.com Open in urlscan Pro
2606:4700:300b::a29f:f77d Public Scan

Screenshot
Live screenshot

Full Image

100
Requests

99 %
HTTPS

37 %
IPv6

44
Domains

56
Subdomains

49
IPs

9
Countries

3609 kB
Transfer

6991 kB
Size

1
Cookies

100 HTTP transactions
10 data transactions