URL: https://www.bankinfosecurity.com/chinese-apt-group-uses-new-tradecraft-to-live-off-land-a-22379
Submission: On June 27 via api from TR — Scanned from DE

Summary

This website contacted 41 IPs in 4 countries across 28 domains to perform 250 HTTP transactions. The main IP is 50.56.167.254, located in United States and belongs to RMH-14, US. The main domain is www.bankinfosecurity.com. The Cisco Umbrella rank of the primary domain is 232795.
TLS certificate: Issued by Go Daddy Secure Certificate Authority... on October 13th 2022. Valid for: 9 months.
This is the only time www.bankinfosecurity.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
32 50.56.167.254 33070 (RMH-14)
2 2a00:1450:400... 15169 (GOOGLE)
1 13.32.99.34 16509 (AMAZON-02)
3 65.9.66.72 16509 (AMAZON-02)
76 184.30.16.143 16625 (AKAMAI-AS)
1 104.130.251.6 33070 (RMH-14)
7 2a00:1450:400... 15169 (GOOGLE)
2 23.206.100.200 16625 (AKAMAI-AS)
5 2a00:1450:400... 15169 (GOOGLE)
7 2a00:1450:400... 15169 (GOOGLE)
1 2600:9000:26d... 16509 (AMAZON-02)
1 35.158.33.255 16509 (AMAZON-02)
1 199.232.192.134 54113 (FASTLY)
4 2a00:1450:400... 15169 (GOOGLE)
2 34.111.234.236 396982 (GOOGLE-CL...)
1 2a02:26f0:310... 20940 (AKAMAI-ASN1)
2 2a02:26f0:310... 20940 (AKAMAI-ASN1)
10 2.17.100.184 20940 (AKAMAI-ASN1)
1 13.32.23.57 16509 (AMAZON-02)
4 2606:2800:134... 15133 (EDGECAST)
15 2a00:1450:400... 15169 (GOOGLE)
3 2600:9000:205... 16509 (AMAZON-02)
4 2001:4860:480... 15169 (GOOGLE)
2 2a00:1450:400... 15169 (GOOGLE)
1 52.20.71.154 14618 (AMAZON-AES)
2 2a02:26f0:ab0... 20940 (AKAMAI-ASN1)
2 2600:9000:26d... 16509 (AMAZON-02)
4 4 2620:1ec:21::14 8068 (MICROSOFT...)
1 13.107.42.14 8068 (MICROSOFT...)
2 2606:4700::68... 13335 (CLOUDFLAR...)
4 151.101.0.134 54113 (FASTLY)
2 192.28.147.68 15224 (OMNITURE)
1 2a00:1450:400... 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
2 2a00:1450:400... 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
2 54.93.166.220 16509 (AMAZON-02)
13 2600:9000:26d... 16509 (AMAZON-02)
21 2a00:1450:400... 15169 (GOOGLE)
7 2a00:1450:400... 15169 (GOOGLE)
1 199.232.196.134 54113 (FASTLY)
250 41
76    184.30.16.143 (Frankfurt am Main, Germany)
ASN16625 (AKAMAI-AS, US)
PTR: a184-30-16-143.deploy.static.akamaitechnologies.com
130e178e8f8ba617604b-8aedd782b7d22cfe0d1146da69a52436.ssl.cf1.rackcdn.com
0267f973c7f511eda6a4-193e28812cee85d6e20ea22afb83e185.ssl.cf1.rackcdn.com
4a7efb2d53317100f611-1d7064c4f7b6de25658a4199efb34975.ssl.cf1.rackcdn.com
75d03c5f1bfbbbb9cc13-369a671ebb934b49b239e372822005c5.ssl.cf1.rackcdn.com
6d63d49ccb7c52435540-5070aa97eaa2b8df4eb5a91600e69901.ssl.cf1.rackcdn.com
dbac8a2e962120c65098-4d6abce208e5e17c2085b466b98c2083.ssl.cf1.rackcdn.com
fa94d5c47256403c613d-7164cafcaac68bfd3318486ab257f999.ssl.cf1.rackcdn.com
21aaef15263171502b5a-3fc6a64a094676b060fa7dc8c4490be9.ssl.cf1.rackcdn.com
752b069ec945bee67d86-1021436e05aad7b2347bf3096cc7e309.ssl.cf1.rackcdn.com
f5bd7c2823d8d0533dcb-62d55445ed2ff88556926faa498f48fa.ssl.cf1.rackcdn.com
Apex Domain
Subdomains
Transfer
76 rackcdn.com
130e178e8f8ba617604b-8aedd782b7d22cfe0d1146da69a52436.ssl.cf1.rackcdn.com — Cisco Umbrella Rank: 342235
0267f973c7f511eda6a4-193e28812cee85d6e20ea22afb83e185.ssl.cf1.rackcdn.com — Cisco Umbrella Rank: 687940
4a7efb2d53317100f611-1d7064c4f7b6de25658a4199efb34975.ssl.cf1.rackcdn.com — Cisco Umbrella Rank: 777381
75d03c5f1bfbbbb9cc13-369a671ebb934b49b239e372822005c5.ssl.cf1.rackcdn.com — Cisco Umbrella Rank: 415355
6d63d49ccb7c52435540-5070aa97eaa2b8df4eb5a91600e69901.ssl.cf1.rackcdn.com — Cisco Umbrella Rank: 793590
dbac8a2e962120c65098-4d6abce208e5e17c2085b466b98c2083.ssl.cf1.rackcdn.com — Cisco Umbrella Rank: 510593
fa94d5c47256403c613d-7164cafcaac68bfd3318486ab257f999.ssl.cf1.rackcdn.com
21aaef15263171502b5a-3fc6a64a094676b060fa7dc8c4490be9.ssl.cf1.rackcdn.com — Cisco Umbrella Rank: 933036
752b069ec945bee67d86-1021436e05aad7b2347bf3096cc7e309.ssl.cf1.rackcdn.com — Cisco Umbrella Rank: 405483
f5bd7c2823d8d0533dcb-62d55445ed2ff88556926faa498f48fa.ssl.cf1.rackcdn.com
8 MB
32 bankinfosecurity.com
www.bankinfosecurity.com — Cisco Umbrella Rank: 232795
464 KB
29 googlesyndication.com
4e406dee87576dea2e9dda2919145c30.safeframe.googlesyndication.com
tpc.googlesyndication.com — Cisco Umbrella Rank: 155
pagead2.googlesyndication.com — Cisco Umbrella Rank: 133
363 KB
17 doubleclick.net
securepubads.g.doubleclick.net — Cisco Umbrella Rank: 219
stats.g.doubleclick.net — Cisco Umbrella Rank: 124
168 KB
13 disquscdn.com
c.disquscdn.com — Cisco Umbrella Rank: 4748
289 KB
12 6sc.co
j.6sc.co — Cisco Umbrella Rank: 6484
c.6sc.co — Cisco Umbrella Rank: 9628
ipv6.6sc.co — Cisco Umbrella Rank: 6605
b.6sc.co — Cisco Umbrella Rank: 4269
15 KB
8 google-analytics.com
www.google-analytics.com — Cisco Umbrella Rank: 60
region1.google-analytics.com — Cisco Umbrella Rank: 1832
22 KB
7 gstatic.com
fonts.gstatic.com
178 KB
7 googletagservices.com
www.googletagservices.com — Cisco Umbrella Rank: 207
363 KB
6 disqus.com
bankinfosecurity.disqus.com
disqus.com — Cisco Umbrella Rank: 1251
referrer.disqus.com — Cisco Umbrella Rank: 6981
52 KB
6 sharethis.com
platform-api.sharethis.com — Cisco Umbrella Rank: 4986
buttons-config.sharethis.com — Cisco Umbrella Rank: 5695
l.sharethis.com — Cisco Umbrella Rank: 5019
platform-cdn.sharethis.com — Cisco Umbrella Rank: 11133
49 KB
5 linkedin.com
px.ads.linkedin.com — Cisco Umbrella Rank: 408
www.linkedin.com — Cisco Umbrella Rank: 563
px4.ads.linkedin.com — Cisco Umbrella Rank: 6542
5 KB
5 googletagmanager.com
www.googletagmanager.com — Cisco Umbrella Rank: 82
327 KB
4 twimg.com
pbs.twimg.com — Cisco Umbrella Rank: 829
9 KB
3 google.com
adservice.google.com — Cisco Umbrella Rank: 107
www.google.com — Cisco Umbrella Rank: 3
2 KB
3 ml314.com
ml314.com — Cisco Umbrella Rank: 1986
in.ml314.com — Cisco Umbrella Rank: 9992
12 KB
3 ensighten.com
nexus.ensighten.com — Cisco Umbrella Rank: 3081
11 KB
2 6sense.com
epsilon.6sense.com — Cisco Umbrella Rank: 10859
591 B
2 mktoresp.com
051-zxi-237.mktoresp.com — Cisco Umbrella Rank: 941443
636 B
2 crazyegg.com
script.crazyegg.com — Cisco Umbrella Rank: 2355
3 KB
2 oribi.io
cdn.linkedin.oribi.io — Cisco Umbrella Rank: 1027
796 B
2 licdn.com
snap.licdn.com — Cisco Umbrella Rank: 960
6 KB
2 marketo.net
munchkin.marketo.net — Cisco Umbrella Rank: 4000
6 KB
2 googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 80
2 KB
1 google.de
www.google.de — Cisco Umbrella Rank: 4835
408 B
1 cloudfront.net
dnn506yrbagrg.cloudfront.net
821 B
1 bizographics.com
sjs.bizographics.com — Cisco Umbrella Rank: 33113
772 B
1 ismgcorp.com
worker.ismgcorp.com
195 B
250 28
Domain Requested by
32 www.bankinfosecurity.com www.bankinfosecurity.com
21 tpc.googlesyndication.com securepubads.g.doubleclick.net
tpc.googlesyndication.com
17 130e178e8f8ba617604b-8aedd782b7d22cfe0d1146da69a52436.ssl.cf1.rackcdn.com www.bankinfosecurity.com
15 securepubads.g.doubleclick.net www.googletagservices.com
securepubads.g.doubleclick.net
www.bankinfosecurity.com
13 c.disquscdn.com disqus.com
c.disquscdn.com
bankinfosecurity.disqus.com
13 dbac8a2e962120c65098-4d6abce208e5e17c2085b466b98c2083.ssl.cf1.rackcdn.com www.bankinfosecurity.com
11 75d03c5f1bfbbbb9cc13-369a671ebb934b49b239e372822005c5.ssl.cf1.rackcdn.com www.bankinfosecurity.com
10 0267f973c7f511eda6a4-193e28812cee85d6e20ea22afb83e185.ssl.cf1.rackcdn.com www.bankinfosecurity.com
7 pagead2.googlesyndication.com securepubads.g.doubleclick.net
tpc.googlesyndication.com
www.googletagservices.com
7 b.6sc.co www.bankinfosecurity.com
7 fonts.gstatic.com fonts.googleapis.com
7 www.googletagservices.com www.bankinfosecurity.com
securepubads.g.doubleclick.net
6 6d63d49ccb7c52435540-5070aa97eaa2b8df4eb5a91600e69901.ssl.cf1.rackcdn.com www.bankinfosecurity.com
5 www.googletagmanager.com www.bankinfosecurity.com
www.googletagmanager.com
www.google-analytics.com
4 disqus.com bankinfosecurity.disqus.com
c.disquscdn.com
4 region1.google-analytics.com www.googletagmanager.com
4 pbs.twimg.com www.bankinfosecurity.com
4 www.google-analytics.com www.bankinfosecurity.com
www.google-analytics.com
4 f5bd7c2823d8d0533dcb-62d55445ed2ff88556926faa498f48fa.ssl.cf1.rackcdn.com www.bankinfosecurity.com
4 21aaef15263171502b5a-3fc6a64a094676b060fa7dc8c4490be9.ssl.cf1.rackcdn.com www.bankinfosecurity.com
4 fa94d5c47256403c613d-7164cafcaac68bfd3318486ab257f999.ssl.cf1.rackcdn.com www.bankinfosecurity.com
4 4a7efb2d53317100f611-1d7064c4f7b6de25658a4199efb34975.ssl.cf1.rackcdn.com www.bankinfosecurity.com
3 px.ads.linkedin.com 3 redirects
3 platform-cdn.sharethis.com www.bankinfosecurity.com
3 752b069ec945bee67d86-1021436e05aad7b2347bf3096cc7e309.ssl.cf1.rackcdn.com www.bankinfosecurity.com
3 nexus.ensighten.com www.bankinfosecurity.com
nexus.ensighten.com
2 epsilon.6sense.com j.6sc.co
2 www.google.com www.bankinfosecurity.com
tpc.googlesyndication.com
2 051-zxi-237.mktoresp.com munchkin.marketo.net
2 script.crazyegg.com dnn506yrbagrg.cloudfront.net
script.crazyegg.com
2 cdn.linkedin.oribi.io snap.licdn.com
2 ipv6.6sc.co j.6sc.co
2 c.6sc.co j.6sc.co
2 stats.g.doubleclick.net www.google-analytics.com
2 snap.licdn.com www.bankinfosecurity.com
sjs.bizographics.com
2 ml314.com www.bankinfosecurity.com
ml314.com
2 munchkin.marketo.net www.bankinfosecurity.com
munchkin.marketo.net
2 fonts.googleapis.com www.bankinfosecurity.com
client
1 referrer.disqus.com
1 www.google.de www.bankinfosecurity.com
1 4e406dee87576dea2e9dda2919145c30.safeframe.googlesyndication.com securepubads.g.doubleclick.net
1 adservice.google.com securepubads.g.doubleclick.net
1 px4.ads.linkedin.com www.bankinfosecurity.com
1 www.linkedin.com 1 redirects
1 in.ml314.com ml314.com
1 dnn506yrbagrg.cloudfront.net www.bankinfosecurity.com
1 j.6sc.co www.bankinfosecurity.com
1 sjs.bizographics.com www.bankinfosecurity.com
1 bankinfosecurity.disqus.com www.bankinfosecurity.com
1 l.sharethis.com platform-api.sharethis.com
1 buttons-config.sharethis.com platform-api.sharethis.com
1 worker.ismgcorp.com www.bankinfosecurity.com
1 platform-api.sharethis.com www.bankinfosecurity.com
250 53
Subject Issuer Validity Valid
ismg.io
Go Daddy Secure Certificate Authority - G2
2022-10-13 -
2023-07-09
9 months crt.sh
upload.video.google.com
GTS CA 1C3
2023-05-29 -
2023-08-21
3 months crt.sh
sharethis.com
Amazon RSA 2048 M02
2023-05-20 -
2024-06-17
a year crt.sh
nexus.ensighten.com
DigiCert TLS RSA SHA256 2020 CA1
2022-10-07 -
2023-10-14
a year crt.sh
*.ssl.cf1.rackcdn.com
DigiCert TLS RSA SHA256 2020 CA1
2023-03-27 -
2024-03-28
a year crt.sh
worker.ismgcorp.com
Go Daddy Secure Certificate Authority - G2
2023-02-12 -
2024-03-15
a year crt.sh
*.g.doubleclick.net
GTS CA 1C3
2023-05-29 -
2023-08-21
3 months crt.sh
*.marketo.net
DigiCert TLS RSA SHA256 2020 CA1
2023-02-06 -
2024-02-05
a year crt.sh
*.google-analytics.com
GTS CA 1C3
2023-05-29 -
2023-08-21
3 months crt.sh
*.gstatic.com
GTS CA 1C3
2023-05-29 -
2023-08-21
3 months crt.sh
*.disqus.com
Sectigo RSA Domain Validation Secure Server CA
2023-04-13 -
2024-04-20
a year crt.sh
ml314.com
GTS CA 1D4
2023-06-07 -
2023-09-05
3 months crt.sh
js.bizographics.com
DigiCert SHA2 Secure Server CA
2022-09-08 -
2023-09-08
a year crt.sh
snap.licdn.com
DigiCert SHA2 Secure Server CA
2023-02-01 -
2024-01-31
a year crt.sh
6sc.co
R3
2023-05-25 -
2023-08-23
3 months crt.sh
*.cloudfront.net
Amazon RSA 2048 M01
2022-12-08 -
2023-12-07
a year crt.sh
*.twimg.com
DigiCert TLS RSA SHA256 2020 CA1
2022-10-06 -
2023-11-06
a year crt.sh
*.ml314.com
Amazon RSA 2048 M02
2023-02-27 -
2023-12-14
10 months crt.sh
linkedin.oribi.io
Amazon RSA 2048 M01
2023-06-08 -
2024-07-07
a year crt.sh
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3
2023-03-09 -
2024-03-08
a year crt.sh
*.mktoresp.com
DigiCert TLS RSA SHA256 2020 CA1
2022-10-05 -
2023-11-05
a year crt.sh
*.google.com
GTS CA 1C3
2023-05-29 -
2023-08-21
3 months crt.sh
www.google.com
GTS CA 1C3
2023-05-29 -
2023-08-21
3 months crt.sh
www.google.de
GTS CA 1C3
2023-05-29 -
2023-08-21
3 months crt.sh
*.6sense.com
Amazon RSA 2048 M01
2023-05-01 -
2024-05-29
a year crt.sh
a.disquscdn.com
Amazon RSA 2048 M01
2023-03-01 -
2023-10-29
8 months crt.sh
tpc.googlesyndication.com
GTS CA 1C3
2023-05-29 -
2023-08-21
3 months crt.sh

This page contains 13 frames:

Primary Page: https://www.bankinfosecurity.com/chinese-apt-group-uses-new-tradecraft-to-live-off-land-a-22379
Frame ID: 158968D8ADD2EB4EBCBAA9D7A196F744
Requests: 179 HTTP requests in this frame

Frame: https://disqus.com/embed/comments/?base=default&f=bankinfosecurity&t_u=https%3A%2F%2Fwww.bankinfosecurity.com%2Fchinese-apt-group-uses-new-tradecraft-to-live-off-land-a-22379&t_d=Chinese%20APT%20Group%20Uses%20New%20Tradecraft%20to%20Live%20Off%20the%20Land&t_t=Chinese%20APT%20Group%20Uses%20New%20Tradecraft%20to%20Live%20Off%20the%20Land&s_o=default
Frame ID: 969921E56089E6CF7CEB032E401694DF
Requests: 23 HTTP requests in this frame

Frame: https://4e406dee87576dea2e9dda2919145c30.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Frame ID: C33A896A355B732CE276B5565452B113
Requests: 1 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjssxgJw6SG0G5S_d7JPacn047I7KsLmWnXooOEmfBQNf3AbI8wpY_fBaOeMNDNcn_aKAV2FiK8mjv0PIEwXst--VNjho5gNQiXaAH4Ddo9NhxnWm6_mTgFzIH8802jegSoFitHVsEIl8utyctHhghOTRVCS-7wqNfOMbNgpF4FYWqYHZ9Vr_p3g-rqzBAvgDLfCpssdtftW5lmKP1ZoQ6fcqyxddQZn-4Qrtprd9fJFyGdaMvuEui8sYRkENUlU2l9e9XDUHa9aplk9mr2RReCmhCUtu3P1A6OulJdJprhwLRGVvq0u0vuPqun6tcNiYY5CvZPNmiQAo8Czr50Vckc8&sai=AMfl-YSOjgOSmbp9nKK_lg8adaecWRhY9Q_wvIASzv_g79fsqFRPZ8k0SM_JHD5T2QflQK4veZC1fk74gMCVEnJRAL_JRcESOv4t4fH7nV60GcHOMJkmhxj0KAU2eiPA_pFXpLdAUIFffCCBkhKqLy4&sig=Cg0ArKJSzANDUJoTr6djEAE&uach_m=[UACH]&adurl=
Frame ID: F2845FDCB9394C7998657191BFDF78A1
Requests: 8 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjstQp11d9fZBedobTh9YW5KTiNnUbBy2L41wQmDCNBeaH7SZljh8EQ59hMcJPhySJz9YIB302Nn51Yrd99-uPO9Sw14qKlXZWpConMaThGO4NnvJ9j_JzrnnlHS3u8kW9U-i5iGbt_yYERoaBRLVYD9-Y0fgAQZ4-2SPjySd7QRYoIGZIjppbegDAG00-TGk_3nWRTPZFSSrUXRI8ACjczJcznBJUsHCj_Xgp-mdu0Ywvr4JxmZNmTG5bi6kWbKWqofmE1GaQyyjkfhtdlIK5pG2mDsRVzh14D1rulPBhhKHqzXe1hdUHGW4UTgxBB5mfUzfhrzQXcH1zG-gjn0BptkrvSPC&sai=AMfl-YRjICjyp7h5diEaPMJA0JifSpxaIqkavXR0LDWkKWn_WR1yDyZtcvXV91JyRe1AAYCZkE4RBQDqCzPDyo6prWtNDNjH5p-nkuoJ3c395mql0TgPtKD5046U9Ug9VOdWYQle7zGPHRv_u2Wnd2s&sig=Cg0ArKJSzK7NfvyxNA5hEAE&uach_m=[UACH]&adurl=
Frame ID: FD1BBF359BA459E8076262810EE45176
Requests: 8 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvU71KAECttiyrqHTRlKse2_k5RfEBBnaEGTfEmS4vlLu61b2rsJ5XxljT0fKIlA_aUBmYL7Jq_7pucNZVeKVakL6Sw8o-MkN8lPI-yXjTOYcb6LdtzZdqUj52mgjn2ZmBCLCjpnZm8M4y55aiu__FVvmFFlWQMPLNq5YjpqhbDkXwrZNClTIlO38tpDzRaJKd_cajWBZtMRHhIhtERdB8T7Xr2l2uenSovYTfq-pDcKPvxhgt4p7UNmeNccShdzM5JVZJc1fZjPRDyOmj2UyQ_7Y1cPYxJ9fGzN8geWgHk-M9DK56F7fu6MP0LXEo67IIx3lDZg1eCLyy_bkzxUyIQaUCpGfI&sai=AMfl-YSCL8R8sTMHpeAYyLRbdJPiXf8vdlSIgnllmh4Y_LGn7f4N1eqofMa1EMLiX7CAsDXw7a7b50v2ricBPiqez4hn8qNO4ZiaPXFqb90XqvXZCYBXij5Oi56lc7027Q7pWgCp4eeXg6F55hJzJ3s&sig=Cg0ArKJSzPgdhzmNSvDmEAE&uach_m=[UACH]&adurl=
Frame ID: 072B9FDE29232D2B0343511CE4567556
Requests: 7 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjstZWT7DhshrYjhi9K9vuYlMNdvjdOcc9olVbHCAw3yxE-FfhTFxbO_Zrd-i0yONPg1vSC7OXOBS1CVFRg7kPOZ9mY2shZKOzns2uSyUPCODyJPADGVAoggmquCrElqsGsFyGDT15q4ZM8_3vPxW3fF14NsoAp5eP-HFOFzjZw-RkEu-aqjGt8OevKdc7rhfkwt--9g1Nkn1sJW_EF3mHVM10XBzTDU6O-PNi4xEgrFsE1mQkBlLH5YOvfIerpns1FPsf2Gjk7I2VBQPzL8obgfLzguu2il1qJ3xr0hZHlu-Y_55YXSEFikWlFzGHFiGLEAeaiWxaMSabdccMgxrCElee8aV&sai=AMfl-YRT4ylJpUv1Ux-mCKYBRHVpXjG1dw4HQKin6vxX6ebN7l0bqeofA-QB-1ZbDt4u448fMboB2n5mDeuz30P874llXA2UcFypTtbqGSqtKfgzTRbFgIvZCnxDsqMnyLt1ex5Lq-6NDQZLdMGlMi8&sig=Cg0ArKJSzKMpjC_By8ywEAE&uach_m=[UACH]&adurl=
Frame ID: 136A39D9622CD347223FBDCE9E5F6DF6
Requests: 7 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsthPtWr_8IxRde8zPNK77m89VvdQKsYULmWIDLx7PM6InqBFTRsVwlncoF17g9GL1b_mI08erqQ-cX3rkWv6vfyhkJ96GOS1LCu9Y5BZBVScir8v_1msz4NsW0nQA6bQIitJ0f14bZt6zz0YiBiWB1wdyLzvjpJ75GkbkkQf4oN7YEnnbkepi--9WItFx9dhYQS2DGOhOpT4EIfJMQJ_mHrCrRPFgBG4syEXyGqyJJ9GuXUIxPoef9PMbfH7Gx3FtTc592kMHGkPE1vwUTq4Y1MKfhbpRjgx7V2yfTCsPcsDiO73D8i1cZDNloCUA0Obt5Iw3-2QHJJ8Km5xv3vox4pYTc&sai=AMfl-YTKMUFf_hHDeEnnCsdUqtUUQB5XZTFKUgdKztfZsm8B6Ma8jTi1adJW97zp-R0ypB6XnVkHxg5FzklqfP9kaqvmNR2lboftSfei5zrsfSnTHs0CuVJKmqPYW1v9-B27TtPQgW_TcN805JNUZbc&sig=Cg0ArKJSzENBryZfnR_uEAE&uach_m=[UACH]&adurl=
Frame ID: 09E283F380BD6AFEB36F5EBF6030811A
Requests: 7 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsuLSEzShUZUE6joB7acwNYq5wbAXozBQBXLRtcUtN5Nw3pmM_94FesrL8_7h_z7zMnPb8pxbsxyyJ6M-KGdBx16vzChJIueLMX8pAIpL_c-nyqQl82S4B_Y3YXzEWZGNee_duXYWxgCqgCU72pQJriIT3dcoB0HpnHm1GNk-gfchVpY7HQ1ofhvYsXaOcKU691v7ckr6RIjM8Qw5RaAVUYawNQ6tsNqlptK74RQXp8HwxWnxxMZS6D8G3RD0hnO1XAPS2T_TjMsXriMSt_2ErMY8AFniUSNZ-XOW6QzxStiXp0IcXny6_TiwFLVhk0jxeKq36lUFvqnQVG2TMypvVuuqA&sai=AMfl-YRvfuemNBWxg4Wi1hAaTGu0Mfl8_0tVSUnfnCuPOJ3kes-Si_LXKpI9OR83X8xIvgtOiV-E6PtRmcbBwOTq9QVcO73f9iZR5fWwZp2uzcUB7wqz_1HB3L6Vjn4zYhR_Swu8zMNJ70rMkAXf60c&sig=Cg0ArKJSzLE7CbEbmRqOEAE&uach_m=[UACH]&adurl=
Frame ID: 65F639ADCD341E598176D0DCCF0CF378
Requests: 8 HTTP requests in this frame

Frame: https://c.disquscdn.com/next/embed/styles/realtime.b23ff3c36dd0169627f8e54ca1621eca.css
Frame ID: 3C8CFCAA9F9303FAADB2DD235406DD72
Requests: 1 HTTP requests in this frame

Frame: https://c.disquscdn.com/next/embed/styles/realtime.b23ff3c36dd0169627f8e54ca1621eca.css
Frame ID: FABF895556F3A2FB1BCECAED79731E64
Requests: 1 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
Frame ID: 2F45C2A2428FE2D7FAA89E676C9E9020
Requests: 3 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/aframe
Frame ID: C77EA61BC059522BC6B7E35C6481003D
Requests: 2 HTTP requests in this frame

Screenshot

Page Title

Chinese APT Group Uses New Tradecraft to Live Off the Land

Detected technologies

Overall confidence: 100%
Detected patterns
  • /tiny_?mce(?:\.min)?\.js

Overall confidence: 100%
Detected patterns
  • bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

Overall confidence: 100%
Detected patterns
  • script\.crazyegg\.com/pages/scripts/\d+/\d+\.js

Overall confidence: 100%
Detected patterns
  • googletagservices\.com/tag/js/gpt(?:_mobile)?\.js

Overall confidence: 100%
Detected patterns
  • //nexus\.ensighten\.com/

Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]+(?:([\d.]+)/)?(?:css/)?font-awesome(?:\.min)?\.css
  • <link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
  • (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)

Overall confidence: 100%
Detected patterns
  • googlesyndication\.com/

Overall confidence: 100%
Detected patterns
  • google-analytics\.com/(?:ga|urchin|analytics)\.js

Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com

Overall confidence: 100%
Detected patterns
  • googletagmanager\.com/gtm\.js
  • googletagmanager\.com/gtag/js

Overall confidence: 100%
Detected patterns
  • snap\.licdn\.com/li\.lms-analytics/insight\.min\.js

Overall confidence: 100%
Detected patterns
  • munchkin\.marketo\.\w+/(?:([\d.]+)/)?munchkin\.js

Overall confidence: 100%
Detected patterns
  • ([\d.]+)?/modernizr(?:\.([\d.]+))?.*\.js

Overall confidence: 100%
Detected patterns
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Overall confidence: 100%
Detected patterns
  • jquery-ui.*\.js

Overall confidence: 100%
Detected patterns
  • (?:<link [^>]*href="[^"]*prettyPhoto(?:\.min)?\.css|<a [^>]*rel="prettyPhoto)
  • jquery\.prettyPhoto\.js

Page Statistics

250
Requests

100 %
HTTPS

59 %
IPv6

28
Domains

53
Subdomains

41
IPs

4
Countries

10809 kB
Transfer

19459 kB
Size

24
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 155
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=749%2C2330930&time=1687831840626&url=https%3A%2F%2Fwww.bankinfosecurity.com%2Fchinese-apt-group-uses-new-tradecraft-to-live-off-land-a-22379 HTTP 302
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=749%2C2330930&time=1687831840626&url=https%3A%2F%2Fwww.bankinfosecurity.com%2Fchinese-apt-group-uses-new-tradecraft-to-live-off-land-a-22379&cookiesTest=true HTTP 302
  • https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D749%252C2330930%26time%3D1687831840626%26url%3Dhttps%253A%252F%252Fwww.bankinfosecurity.com%252Fchinese-apt-group-uses-new-tradecraft-to-live-off-land-a-22379%26cookiesTest%3Dtrue%26liSync%3Dtrue HTTP 302
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=749%2C2330930&time=1687831840626&url=https%3A%2F%2Fwww.bankinfosecurity.com%2Fchinese-apt-group-uses-new-tradecraft-to-live-off-land-a-22379&cookiesTest=true&liSync=true HTTP 302
  • https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=749%2C2330930&time=1687831840626&url=https%3A%2F%2Fwww.bankinfosecurity.com%2Fchinese-apt-group-uses-new-tradecraft-to-live-off-land-a-22379&cookiesTest=true&liSync=true&e_ipv6=AQJOzCj5IVPzbgAAAYj6ngmi8fZQ5hf8JEflTkDva-gPgeMv3xgA6r8Lu-Dn6T10pKp2Ji6Rfe0RPg

250 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request chinese-apt-group-uses-new-tradecraft-to-live-off-land-a-22379
www.bankinfosecurity.com/
381 KB
54 KB
Document
General
Full URL
https://www.bankinfosecurity.com/chinese-apt-group-uses-new-tradecraft-to-live-off-land-a-22379
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
50.56.167.254 , United States, ASN33070 (RMH-14, US),
Reverse DNS
Software
Apache /
Resource Hash
9f258869b4e9dc3a2fb475fd02b669a7e6141203738801307f9c5de64f0713e7
Security Headers
Name Value
Strict-Transport-Security max-age=63072000

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

Cache-Control
no-store, no-cache, must-revalidate
Connection
Keep-Alive
Content-Encoding
gzip
Content-Type
text/html; charset=UTF-8
Date
Tue, 27 Jun 2023 02:10:38 GMT
Expires
Thu, 19 Nov 1981 08:52:00 GMT
Keep-Alive
timeout=5, max=100
Pragma
no-cache
Server
Apache
Strict-Transport-Security
max-age=63072000
Transfer-Encoding
chunked
Vary
Accept-Encoding
jquery-ui.min.css
www.bankinfosecurity.com/css-responsive/vendor/
25 KB
5 KB
Stylesheet
General
Full URL
https://www.bankinfosecurity.com/css-responsive/vendor/jquery-ui.min.css?s=1687831838.6541
Requested by
Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/chinese-apt-group-uses-new-tradecraft-to-live-off-land-a-22379
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
50.56.167.254 , United States, ASN33070 (RMH-14, US),
Reverse DNS
Software
Apache /
Resource Hash
fc54c09a7a71615ec35a22ed20afa4034588986ed88c3fc184b2c0bc637c33fb
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.bankinfosecurity.com/chinese-apt-group-uses-new-tradecraft-to-live-off-land-a-22379
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Tue, 27 Jun 2023 02:10:39 GMT
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
Content-Encoding
gzip
Server
Apache
Vary
Accept-Encoding
Content-Type
text/css
Cache-Control
max-age=86400, private, must-revalidate
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=99
Content-Length
4896
mediaelementplayer-updated.css
www.bankinfosecurity.com/css-responsive/vendor/
11 KB
3 KB
Stylesheet
General
Full URL
https://www.bankinfosecurity.com/css-responsive/vendor/mediaelementplayer-updated.css?s=1687831838.6541
Requested by
Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/chinese-apt-group-uses-new-tradecraft-to-live-off-land-a-22379
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
50.56.167.254 , United States, ASN33070 (RMH-14, US),
Reverse DNS
Software
Apache /
Resource Hash
1a0bbdba57f90a60fef89419fc940d8eae55c5b0d12ecbadde2beaef32ab2d90
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.bankinfosecurity.com/chinese-apt-group-uses-new-tradecraft-to-live-off-land-a-22379
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Tue, 27 Jun 2023 02:10:39 GMT
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
Content-Encoding
gzip
Server
Apache
Vary
Accept-Encoding
Content-Type
text/css
Cache-Control
max-age=86400, private, must-revalidate
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=98
Content-Length
2622
css
fonts.googleapis.com/
27 KB
1 KB
Stylesheet
General
Full URL
https://fonts.googleapis.com/css?family=Open+Sans:300italic,400italic,600italic,700italic,800italic,400,300,600,700,800
Requested by
Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/chinese-apt-group-uses-new-tradecraft-to-live-off-land-a-22379
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:828::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
ab618c26a11027f879b5e9a4b28120545ba14270a5da6d33e623f9a2b8b8d38d
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.bankinfosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
date
Tue, 27 Jun 2023 02:10:38 GMT
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection
0
last-modified
Tue, 27 Jun 2023 01:56:23 GMT
server
ESF
cross-origin-opener-policy
same-origin-allow-popups
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Tue, 27 Jun 2023 02:10:38 GMT
main.css
www.bankinfosecurity.com/css-responsive/
232 KB
42 KB
Stylesheet
General
Full URL
https://www.bankinfosecurity.com/css-responsive/main.css?s=1687831838.6541
Requested by
Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/chinese-apt-group-uses-new-tradecraft-to-live-off-land-a-22379
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
50.56.167.254 , United States, ASN33070 (RMH-14, US),
Reverse DNS
Software
Apache /
Resource Hash
5abf860184508569d93b93fe5f3218dceff6e80842c84ca0b9048224e7c53a21
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.bankinfosecurity.com/chinese-apt-group-uses-new-tradecraft-to-live-off-land-a-22379
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Tue, 27 Jun 2023 02:10:39 GMT
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
Content-Encoding
gzip
Server
Apache
Vary
Accept-Encoding
Content-Type
text/css
Cache-Control
max-age=86400, private, must-revalidate
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=100
Content-Length
43126
prettyPhoto.css
www.bankinfosecurity.com/css-responsive/
21 KB
3 KB
Stylesheet
General
Full URL
https://www.bankinfosecurity.com/css-responsive/prettyPhoto.css?s=1687831838.6541
Requested by
Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/chinese-apt-group-uses-new-tradecraft-to-live-off-land-a-22379
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
50.56.167.254 , United States, ASN33070 (RMH-14, US),
Reverse DNS
Software
Apache /
Resource Hash
7d0bada0d9b66aa1ca8eb906bb9736ca96e3859e9c05287a8f0cf5ffa9ff8760
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.bankinfosecurity.com/chinese-apt-group-uses-new-tradecraft-to-live-off-land-a-22379
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Tue, 27 Jun 2023 02:10:39 GMT
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
Content-Encoding
gzip
Server
Apache
Vary
Accept-Encoding
Content-Type
text/css
Cache-Control
max-age=86400, private, must-revalidate
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=100
Content-Length
2840
bis-hdr.desktop.r2.css
www.bankinfosecurity.com/css-responsive/vendor/
8 KB
2 KB
Stylesheet
General
Full URL
https://www.bankinfosecurity.com/css-responsive/vendor/bis-hdr.desktop.r2.css?s=1687831838.6541
Requested by
Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/chinese-apt-group-uses-new-tradecraft-to-live-off-land-a-22379
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
50.56.167.254 , United States, ASN33070 (RMH-14, US),
Reverse DNS
Software
Apache /
Resource Hash
eefc2533a82b69fab9b19b9e316bb606e70d17d61b57f9ea841b26c59624bc20
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.bankinfosecurity.com/chinese-apt-group-uses-new-tradecraft-to-live-off-land-a-22379
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Tue, 27 Jun 2023 02:10:39 GMT
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
Content-Encoding
gzip
Server
Apache
Vary
Accept-Encoding
Content-Type
text/css
Cache-Control
max-age=86400, private, must-revalidate
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=100
Content-Length
1956
bis-hdr.mobile.r2.css
www.bankinfosecurity.com/css-responsive/vendor/
9 KB
2 KB
Stylesheet
General
Full URL
https://www.bankinfosecurity.com/css-responsive/vendor/bis-hdr.mobile.r2.css?s=1687831838.6541
Requested by
Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/chinese-apt-group-uses-new-tradecraft-to-live-off-land-a-22379
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
50.56.167.254 , United States, ASN33070 (RMH-14, US),
Reverse DNS
Software
Apache /
Resource Hash
77c36fad51d04a56e55d1d454094c4312c3b11443f42b456c3f5082d66696be1
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.bankinfosecurity.com/chinese-apt-group-uses-new-tradecraft-to-live-off-land-a-22379
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Tue, 27 Jun 2023 02:10:39 GMT
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
Content-Encoding
gzip
Server
Apache
Vary
Accept-Encoding
Content-Type
text/css
Cache-Control
max-age=86400, private, must-revalidate
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=100
Content-Length
2133
font-awesome.min.css
www.bankinfosecurity.com/css-responsive/vendor/
22 KB
5 KB
Stylesheet
General
Full URL
https://www.bankinfosecurity.com/css-responsive/vendor/font-awesome.min.css?s=1687831838.6541
Requested by
Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/chinese-apt-group-uses-new-tradecraft-to-live-off-land-a-22379
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
50.56.167.254 , United States, ASN33070 (RMH-14, US),
Reverse DNS
Software
Apache /
Resource Hash
93f466f6b1a81c848140e51c839a5372034ab22182601e86dd86947ad3a7fe94
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.bankinfosecurity.com/chinese-apt-group-uses-new-tradecraft-to-live-off-land-a-22379
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Tue, 27 Jun 2023 02:10:39 GMT
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
Content-Encoding
gzip
Server
Apache
Vary
Accept-Encoding
Content-Type
text/css
Cache-Control
max-age=86400, private, must-revalidate
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=100
Content-Length
5049
jquery.min.js
www.bankinfosecurity.com/javascripts-responsive/vendor/
91 KB
33 KB
Script
General
Full URL
https://www.bankinfosecurity.com/javascripts-responsive/vendor/jquery.min.js?s=1687831838.6541
Requested by
Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/chinese-apt-group-uses-new-tradecraft-to-live-off-land-a-22379
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
50.56.167.254 , United States, ASN33070 (RMH-14, US),
Reverse DNS
Software
Apache /
Resource Hash
eccabf5cc7613433c3ddc71ff34391ae850d304d3aceb5666868c4947134f3b5
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.bankinfosecurity.com/chinese-apt-group-uses-new-tradecraft-to-live-off-land-a-22379
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Tue, 27 Jun 2023 02:10:39 GMT
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
Content-Encoding
gzip
Server
Apache
Vary
Accept-Encoding
Content-Type
application/javascript
Cache-Control
max-age=86400, private, must-revalidate
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=97
Content-Length
33094
modernizr.js
www.bankinfosecurity.com/javascripts-responsive/vendor/
0
0
Script
General
Full URL
https://www.bankinfosecurity.com/javascripts-responsive/vendor/modernizr.js?s=1687831838.6541
Requested by
Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/chinese-apt-group-uses-new-tradecraft-to-live-off-land-a-22379
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
50.56.167.254 , United States, ASN33070 (RMH-14, US),
Reverse DNS
Software
Apache /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=63072000

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.bankinfosecurity.com/chinese-apt-group-uses-new-tradecraft-to-live-off-land-a-22379
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 27 Jun 2023 02:10:39 GMT
Content-Encoding
gzip
Strict-Transport-Security
max-age=63072000
Server
Apache
Vary
Accept-Encoding
Transfer-Encoding
chunked
Content-Type
text/html; charset=UTF-8
Cache-Control
no-store, no-cache, must-revalidate
Connection
Keep-Alive
Keep-Alive
timeout=5, max=99
Expires
Thu, 19 Nov 1981 08:52:00 GMT
bootstrap.min.js
www.bankinfosecurity.com/javascripts-responsive/vendor/
35 KB
9 KB
Script
General
Full URL
https://www.bankinfosecurity.com/javascripts-responsive/vendor/bootstrap.min.js?s=1687831838.6541
Requested by
Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/chinese-apt-group-uses-new-tradecraft-to-live-off-land-a-22379
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
50.56.167.254 , United States, ASN33070 (RMH-14, US),
Reverse DNS
Software
Apache /
Resource Hash
3fede2d0c0a8c93b0c5d0ab0c38289a5743bb88720255b8298c520d2e3d90939
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.bankinfosecurity.com/chinese-apt-group-uses-new-tradecraft-to-live-off-land-a-22379
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Tue, 27 Jun 2023 02:10:39 GMT
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
Content-Encoding
gzip
Server
Apache
Vary
Accept-Encoding
Content-Type
application/javascript
Cache-Control
max-age=86400, private, must-revalidate
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=99
Content-Length
9328
jquery.validate.min.js
www.bankinfosecurity.com/javascripts-responsive/vendor/
21 KB
7 KB
Script
General
Full URL
https://www.bankinfosecurity.com/javascripts-responsive/vendor/jquery.validate.min.js?s=1687831838.6541
Requested by
Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/chinese-apt-group-uses-new-tradecraft-to-live-off-land-a-22379
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
50.56.167.254 , United States, ASN33070 (RMH-14, US),
Reverse DNS
Software
Apache /
Resource Hash
e51831d751ef667b1f703a47bb05802b681e6a30816f5cce0d56c3552a4eaa31
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.bankinfosecurity.com/chinese-apt-group-uses-new-tradecraft-to-live-off-land-a-22379
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Tue, 27 Jun 2023 02:10:39 GMT
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
Content-Encoding
gzip
Server
Apache
Vary
Accept-Encoding
Content-Type
application/javascript
Cache-Control
max-age=86400, private, must-revalidate
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=99
Content-Length
6689
mediaelement-and-player-updated.min.js
www.bankinfosecurity.com/javascripts-responsive/vendor/
154 KB
38 KB
Script
General
Full URL
https://www.bankinfosecurity.com/javascripts-responsive/vendor/mediaelement-and-player-updated.min.js?s=1687831838.6541
Requested by
Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/chinese-apt-group-uses-new-tradecraft-to-live-off-land-a-22379
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
50.56.167.254 , United States, ASN33070 (RMH-14, US),
Reverse DNS
Software
Apache /
Resource Hash
4e7304371ef9bcaea396e8928a9647f8306c296b9195c8763848d70c7f6f1390
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.bankinfosecurity.com/chinese-apt-group-uses-new-tradecraft-to-live-off-land-a-22379
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Tue, 27 Jun 2023 02:10:39 GMT
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
Content-Encoding
gzip
Server
Apache
Vary
Accept-Encoding
Content-Type
application/javascript
Cache-Control
max-age=86400, private, must-revalidate
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=99
Content-Length
38476
tinymce.min.js
www.bankinfosecurity.com/javascripts-responsive/vendor/
295 KB
101 KB
Script
General
Full URL
https://www.bankinfosecurity.com/javascripts-responsive/vendor/tinymce.min.js?s=1687831838.6541
Requested by
Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/chinese-apt-group-uses-new-tradecraft-to-live-off-land-a-22379
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
50.56.167.254 , United States, ASN33070 (RMH-14, US),
Reverse DNS
Software
Apache /
Resource Hash
247d04c4d14c60a79c16245a74a792a662f9e7adf784d68edd4520a35ec90251
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.bankinfosecurity.com/chinese-apt-group-uses-new-tradecraft-to-live-off-land-a-22379
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Tue, 27 Jun 2023 02:10:39 GMT
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
Content-Encoding
gzip
Server
Apache
Vary
Accept-Encoding
Transfer-Encoding
chunked
Content-Type
application/javascript
Cache-Control
max-age=86400, private, must-revalidate
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=96
jquery.validate.bootstrap.popover.js
www.bankinfosecurity.com/javascripts-responsive/vendor/
2 KB
1 KB
Script
General
Full URL
https://www.bankinfosecurity.com/javascripts-responsive/vendor/jquery.validate.bootstrap.popover.js?s=1687831838.6541
Requested by
Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/chinese-apt-group-uses-new-tradecraft-to-live-off-land-a-22379
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
50.56.167.254 , United States, ASN33070 (RMH-14, US),
Reverse DNS
Software
Apache /
Resource Hash
04d304d7ee49ac157f146382a46f02a666279bd7f29074f50e863b88f2affae9
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.bankinfosecurity.com/chinese-apt-group-uses-new-tradecraft-to-live-off-land-a-22379
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Tue, 27 Jun 2023 02:10:39 GMT
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
Content-Encoding
gzip
Server
Apache
Vary
Accept-Encoding
Content-Type
application/javascript
Cache-Control
max-age=86400, private, must-revalidate
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=98
Content-Length
926
jquery.placeholder.js
www.bankinfosecurity.com/javascripts-responsive/vendor/
2 KB
1 KB
Script
General
Full URL
https://www.bankinfosecurity.com/javascripts-responsive/vendor/jquery.placeholder.js?s=1687831838.6541
Requested by
Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/chinese-apt-group-uses-new-tradecraft-to-live-off-land-a-22379
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
50.56.167.254 , United States, ASN33070 (RMH-14, US),
Reverse DNS
Software
Apache /
Resource Hash
256a489beea4a14eca458f6e5436758f1fcb8dd34034d3c36dd21b22a5841f3b
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.bankinfosecurity.com/chinese-apt-group-uses-new-tradecraft-to-live-off-land-a-22379
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Tue, 27 Jun 2023 02:10:39 GMT
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
Content-Encoding
gzip
Server
Apache
Vary
Accept-Encoding
Content-Type
application/javascript
Cache-Control
max-age=86400, private, must-revalidate
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=98
Content-Length
922
jquery-ui.min.js
www.bankinfosecurity.com/javascripts-responsive/vendor/
222 KB
60 KB
Script
General
Full URL
https://www.bankinfosecurity.com/javascripts-responsive/vendor/jquery-ui.min.js?s=1687831838.6541
Requested by
Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/chinese-apt-group-uses-new-tradecraft-to-live-off-land-a-22379
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
50.56.167.254 , United States, ASN33070 (RMH-14, US),
Reverse DNS
Software
Apache /
Resource Hash
78cf63898c91ce3b95e37bc53e07adba5c2ee705ff28c2dd1dd784173c264ad1
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.bankinfosecurity.com/chinese-apt-group-uses-new-tradecraft-to-live-off-land-a-22379
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Tue, 27 Jun 2023 02:10:39 GMT
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
Content-Encoding
gzip
Server
Apache
Vary
Accept-Encoding
Content-Type
application/javascript
Cache-Control
max-age=86400, private, must-revalidate
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=99
Content-Length
61345
crypt_des.js
www.bankinfosecurity.com/javascripts-responsive/vendor/
9 KB
3 KB
Script
General
Full URL
https://www.bankinfosecurity.com/javascripts-responsive/vendor/crypt_des.js?s=1687831838.6541
Requested by
Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/chinese-apt-group-uses-new-tradecraft-to-live-off-land-a-22379
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
50.56.167.254 , United States, ASN33070 (RMH-14, US),
Reverse DNS
Software
Apache /
Resource Hash
aed1d71b7280c09f06dc1f8e87795f9d89f7a1a8ab1af32ff8c92037ddeed6ee
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.bankinfosecurity.com/chinese-apt-group-uses-new-tradecraft-to-live-off-land-a-22379
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Tue, 27 Jun 2023 02:10:39 GMT
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
Content-Encoding
gzip
Server
Apache
Vary
Accept-Encoding
Content-Type
application/javascript
Cache-Control
max-age=86400, private, must-revalidate
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=97
Content-Length
2857
sharethis.js
platform-api.sharethis.com/js/
201 KB
45 KB
Script
General
Full URL
https://platform-api.sharethis.com/js/sharethis.js
Requested by
Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/chinese-apt-group-uses-new-tradecraft-to-live-off-land-a-22379
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.32.99.34 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-32-99-34.fra60.r.cloudfront.net
Software
/
Resource Hash
e9b6e5d6207dea3753f55720cef88d4c6a60758ffacb7808ec6081b2a63bbc5e
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Frame-Options SAMEORIGIN

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.bankinfosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 27 Jun 2023 02:06:52 GMT
content-encoding
gzip
via
1.1 4612dc3b414cf2057f542e94733d59bc.cloudfront.net (CloudFront)
strict-transport-security
max-age=31536000; includeSubDomains
x-amz-cf-pop
FRA60-P3
age
227
etag
W/"3225f-sMYnyFmnB+/njI8u5nwE2QPqhYo"
x-frame-options
SAMEORIGIN
vary
Accept-Encoding
content-type
text/javascript; charset=utf-8
edge-control
cache-maxage=60m,downstream-ttl=60m
cache-control
max-age=600, public
x-cache
Hit from cloudfront
x-amz-cf-id
drhSB68fr74S5VdiGFNMz4abOH6JVleoNAU0KvB1dDCtpYeuEW3d_g==
Bootstrap.js
nexus.ensighten.com/choozle/12567/
28 KB
10 KB
Script
General
Full URL
https://nexus.ensighten.com/choozle/12567/Bootstrap.js
Requested by
Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/chinese-apt-group-uses-new-tradecraft-to-live-off-land-a-22379
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
65.9.66.72 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-65-9-66-72.fra56.r.cloudfront.net
Software
CloudFront /
Resource Hash
feb6a4829cc0a55f2fed1d3aaceb83b52e6823f15c649c5ef1c14a7e86e4988b

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.bankinfosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Sat, 25 Mar 2023 07:39:49 GMT
x-amz-version-id
0KqOWWU87g0SIKxyT9NkwphSo_2GLxdg
content-encoding
gzip
via
1.1 b3dc72c60418e8887de31f772538f118.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA56-C1
age
8101850
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
x-amz-replication-status
COMPLETED
last-modified
Thu, 12 Aug 2021 16:05:49 GMT
server
CloudFront
etag
W/"a6af76675d59c279c990b96bb66c9f00"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
cache-control
max-age=300
x-amz-cf-id
TMdG_8tG-Ko864QgWByl9-rd8ydBmZwMtqh2fy28TB0fsjKdenx9bA==
headerlogo-bis.png
www.bankinfosecurity.com/images-responsive/logos/
2 KB
2 KB
Image
General
Full URL
https://www.bankinfosecurity.com/images-responsive/logos/headerlogo-bis.png
Requested by
Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/chinese-apt-group-uses-new-tradecraft-to-live-off-land-a-22379
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
50.56.167.254 , United States, ASN33070 (RMH-14, US),
Reverse DNS
Software
Apache /
Resource Hash
ea3325c2094d82033ce9583d4180194fb82729dfae65b62925831a88a6838d7c
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.bankinfosecurity.com/chinese-apt-group-uses-new-tradecraft-to-live-off-land-a-22379
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Tue, 27 Jun 2023 02:10:39 GMT
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
Content-Encoding
gzip
Server
Apache
Vary
Accept-Encoding
Content-Type
image/png
Cache-Control
max-age=86400, private, must-revalidate
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=98
Content-Length
1682
chinese-apt-group-uses-new-tradecraft-to-live-off-land-showcase_image-4-a-22379.jpg
130e178e8f8ba617604b-8aedd782b7d22cfe0d1146da69a52436.ssl.cf1.rackcdn.com/
270 KB
271 KB
Image
General
Full URL
https://130e178e8f8ba617604b-8aedd782b7d22cfe0d1146da69a52436.ssl.cf1.rackcdn.com/chinese-apt-group-uses-new-tradecraft-to-live-off-land-showcase_image-4-a-22379.jpg
Requested by
Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/chinese-apt-group-uses-new-tradecraft-to-live-off-land-a-22379
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
184.30.16.143 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-30-16-143.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
7e78a118484984c2c91bb17193121067664b3cccd7a37f4e4cef0713bdfd2aa1

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.bankinfosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Tue, 27 Jun 2023 02:10:39 GMT
Last-Modified
Mon, 26 Jun 2023 19:49:34 GMT
ETag
c563edfbc555e18b188bd0237c41d1ac
Content-Type
image/jpeg
X-Timestamp
1687808973.53289
Cache-Control
public, max-age=66218
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
276828
X-Trans-Id
tx337b542d8857456faebae-006499f659dfw1
Expires
Tue, 27 Jun 2023 20:34:17 GMT
victim-count-in-maryland-ransomware-breach-jumps-five-fold-showcase_image-10-a-22378.jpg
130e178e8f8ba617604b-8aedd782b7d22cfe0d1146da69a52436.ssl.cf1.rackcdn.com/
41 KB
42 KB
Image
General
Full URL
https://130e178e8f8ba617604b-8aedd782b7d22cfe0d1146da69a52436.ssl.cf1.rackcdn.com/victim-count-in-maryland-ransomware-breach-jumps-five-fold-showcase_image-10-a-22378.jpg
Requested by
Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/chinese-apt-group-uses-new-tradecraft-to-live-off-land-a-22379
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
184.30.16.143 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-30-16-143.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
00f307d7a013d85e23132a122a7caaa908d6736512adf6f4c1b59788bf3dd98b

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.bankinfosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Tue, 27 Jun 2023 02:10:39 GMT
Last-Modified
Mon, 26 Jun 2023 19:42:19 GMT
ETag
7568e9cf97120dea2002aa38cf3a6cd2
Content-Type
image/jpeg
X-Timestamp
1687808538.80488
Cache-Control
public, max-age=65281
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
42108
X-Trans-Id
tx023e4b11f41e4671a865c-006499f27ddfw1
Expires
Tue, 27 Jun 2023 20:18:40 GMT
irish-government-accused-trying-to-muzzle-privacy-critics-showcase_image-1-a-22375.jpg
130e178e8f8ba617604b-8aedd782b7d22cfe0d1146da69a52436.ssl.cf1.rackcdn.com/
106 KB
107 KB
Image
General
Full URL
https://130e178e8f8ba617604b-8aedd782b7d22cfe0d1146da69a52436.ssl.cf1.rackcdn.com/irish-government-accused-trying-to-muzzle-privacy-critics-showcase_image-1-a-22375.jpg
Requested by
Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/chinese-apt-group-uses-new-tradecraft-to-live-off-land-a-22379
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
184.30.16.143 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-30-16-143.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
6d523c0cca92419aa80dbf8b5fa0bd26227241048b977ea90cfd9517c12689da

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.bankinfosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Tue, 27 Jun 2023 02:10:39 GMT
Last-Modified
Mon, 26 Jun 2023 16:21:08 GMT
ETag
64444c8813ddd979ac488c3f997ea3ce
Content-Type
image/jpeg
X-Timestamp
1687796467.10868
Cache-Control
public, max-age=57965
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
108883
X-Trans-Id
txa0dc878e2a5b4c34b6252-006499d608dfw1
Expires
Tue, 27 Jun 2023 18:16:44 GMT
sec-alleges-solarwinds-cfo-ciso-violated-us-securities-laws-showcase_image-2-a-22367.jpg
130e178e8f8ba617604b-8aedd782b7d22cfe0d1146da69a52436.ssl.cf1.rackcdn.com/
108 KB
109 KB
Image
General
Full URL
https://130e178e8f8ba617604b-8aedd782b7d22cfe0d1146da69a52436.ssl.cf1.rackcdn.com/sec-alleges-solarwinds-cfo-ciso-violated-us-securities-laws-showcase_image-2-a-22367.jpg
Requested by
Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/chinese-apt-group-uses-new-tradecraft-to-live-off-land-a-22379
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
184.30.16.143 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-30-16-143.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
8291a8de09d9f934302b3c47f1a0ed3d56c712c241c6876b2a014275caca6a38

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.bankinfosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Tue, 27 Jun 2023 02:10:39 GMT
Last-Modified
Fri, 23 Jun 2023 22:23:44 GMT
ETag
72c1c793b5da6c3e1ee4c85dbf8f74f2
Content-Type
image/jpeg
X-Timestamp
1687559023.15005
Cache-Control
public, max-age=49028
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
110968
X-Trans-Id
txf5e884a11d644ecf9669e-00649621cadfw1
Expires
Tue, 27 Jun 2023 15:47:47 GMT
mdm-balancing-need-for-user-privacy-corporate-control-showcase_image-2-i-5266.jpg
0267f973c7f511eda6a4-193e28812cee85d6e20ea22afb83e185.ssl.cf1.rackcdn.com/
62 KB
62 KB
Image
General
Full URL
https://0267f973c7f511eda6a4-193e28812cee85d6e20ea22afb83e185.ssl.cf1.rackcdn.com/mdm-balancing-need-for-user-privacy-corporate-control-showcase_image-2-i-5266.jpg
Requested by
Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/chinese-apt-group-uses-new-tradecraft-to-live-off-land-a-22379
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
184.30.16.143 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-30-16-143.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
fa974a608349f8186bcb66723f030b7213b95f7bf41f18c8cdfe76d5696d19f9

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.bankinfosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Tue, 27 Jun 2023 02:10:40 GMT
Last-Modified
Fri, 23 Jun 2023 16:11:39 GMT
ETag
7323f79ab6af247c4e905b1fb888779e
Content-Type
image/jpeg
X-Timestamp
1687536698.08470
Cache-Control
public, max-age=29210
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
63321
X-Trans-Id
txbdca29dfb0a64d8094924-006495d431dfw1
Expires
Tue, 27 Jun 2023 10:17:30 GMT
navigating-complexities-cyber-insurance-showcase_image-3-i-5263.jpg
0267f973c7f511eda6a4-193e28812cee85d6e20ea22afb83e185.ssl.cf1.rackcdn.com/
60 KB
60 KB
Image
General
Full URL
https://0267f973c7f511eda6a4-193e28812cee85d6e20ea22afb83e185.ssl.cf1.rackcdn.com/navigating-complexities-cyber-insurance-showcase_image-3-i-5263.jpg
Requested by
Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/chinese-apt-group-uses-new-tradecraft-to-live-off-land-a-22379
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
184.30.16.143 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-30-16-143.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
20d983725a28705f154c9a1440a19573a34e1c8b779866452d556aa36c6cfa57

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.bankinfosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Tue, 27 Jun 2023 02:10:40 GMT
Last-Modified
Wed, 14 Jun 2023 22:13:24 GMT
ETag
f4448643e874a7a095f90bf381dac67d
Content-Type
image/jpeg
X-Timestamp
1686780803.62407
Cache-Control
public, max-age=45385
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
61001
X-Trans-Id
tx1a5663053512430eb3873-00648b58aedfw1
Expires
Tue, 27 Jun 2023 14:47:05 GMT
using-detection-models-to-identify-abnormal-behavior-showcase_image-4-i-5261.jpg
0267f973c7f511eda6a4-193e28812cee85d6e20ea22afb83e185.ssl.cf1.rackcdn.com/
65 KB
66 KB
Image
General
Full URL
https://0267f973c7f511eda6a4-193e28812cee85d6e20ea22afb83e185.ssl.cf1.rackcdn.com/using-detection-models-to-identify-abnormal-behavior-showcase_image-4-i-5261.jpg
Requested by
Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/chinese-apt-group-uses-new-tradecraft-to-live-off-land-a-22379
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
184.30.16.143 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-30-16-143.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
6ae8a9d4457102eb3d8a5c78db6afa290388979669531ac8bbf8b22e6e20230f

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.bankinfosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Tue, 27 Jun 2023 02:10:40 GMT
Last-Modified
Wed, 07 Jun 2023 16:36:47 GMT
ETag
e40356a8f70f5f1f3ec59c661fc80aed
Content-Type
image/jpeg
X-Timestamp
1686155806.15071
Cache-Control
public, max-age=62998
Connection
keep-alive
Accept-Ranges
bytes
X-Trans-Id
tx695a873dba6f436699be2-0064978a1edfw1
Content-Length
67039
Expires
Tue, 27 Jun 2023 19:40:38 GMT
exploring-increase-in-attacks-on-ot-iot-showcase_image-2-i-5260.jpg
0267f973c7f511eda6a4-193e28812cee85d6e20ea22afb83e185.ssl.cf1.rackcdn.com/
49 KB
50 KB
Image
General
Full URL
https://0267f973c7f511eda6a4-193e28812cee85d6e20ea22afb83e185.ssl.cf1.rackcdn.com/exploring-increase-in-attacks-on-ot-iot-showcase_image-2-i-5260.jpg
Requested by
Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/chinese-apt-group-uses-new-tradecraft-to-live-off-land-a-22379
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
184.30.16.143 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-30-16-143.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
1f02740954f421a1ce6ad2064a644c1ac65b592f3f3fbf12fc36e39b01869868

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.bankinfosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Tue, 27 Jun 2023 02:10:40 GMT
Last-Modified
Mon, 05 Jun 2023 16:12:59 GMT
ETag
57648d1fd224e651d03400c9cb659de2
Content-Type
image/jpeg
X-Timestamp
1685981578.20725
Cache-Control
public, max-age=45096
Connection
keep-alive
Accept-Ranges
bytes
X-Trans-Id
tx38329ce5c5724d78bc849-006489008cdfw1
Content-Length
50511
Expires
Tue, 27 Jun 2023 14:42:16 GMT
army-alert-on-free-smartwatches-dont-sport-these-wearables-showcase_image-2-p-3461.jpg
4a7efb2d53317100f611-1d7064c4f7b6de25658a4199efb34975.ssl.cf1.rackcdn.com/
51 KB
51 KB
Image
General
Full URL
https://4a7efb2d53317100f611-1d7064c4f7b6de25658a4199efb34975.ssl.cf1.rackcdn.com/army-alert-on-free-smartwatches-dont-sport-these-wearables-showcase_image-2-p-3461.jpg
Requested by
Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/chinese-apt-group-uses-new-tradecraft-to-live-off-land-a-22379
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
184.30.16.143 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-30-16-143.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
cee7e1ef5403dfeacb53955ea835cda536b946e35f9f343d1ac0078a74149baf

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.bankinfosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Tue, 27 Jun 2023 02:10:40 GMT
Last-Modified
Mon, 26 Jun 2023 16:56:48 GMT
ETag
67c62561d097e5798d0849930547c328
Content-Type
image/jpeg
X-Timestamp
1687798607.73067
Cache-Control
public, max-age=64680
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
52210
X-Trans-Id
tx5bc97bac6e944195b8896-006499f067dfw1
Expires
Tue, 27 Jun 2023 20:08:40 GMT
3-boardroom-initiatives-to-see-you-through-cyber-winter-showcase_image-3-p-3441.jpg
4a7efb2d53317100f611-1d7064c4f7b6de25658a4199efb34975.ssl.cf1.rackcdn.com/
63 KB
64 KB
Image
General
Full URL
https://4a7efb2d53317100f611-1d7064c4f7b6de25658a4199efb34975.ssl.cf1.rackcdn.com/3-boardroom-initiatives-to-see-you-through-cyber-winter-showcase_image-3-p-3441.jpg
Requested by
Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/chinese-apt-group-uses-new-tradecraft-to-live-off-land-a-22379
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
184.30.16.143 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-30-16-143.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
527205f9c4921a3189f09da7644db4bb07f0563bbea45a99447e7661c2762219

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.bankinfosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Tue, 27 Jun 2023 02:10:40 GMT
Last-Modified
Tue, 18 Apr 2023 18:50:58 GMT
ETag
6a42aa06718b354405513e38be5b3ce6
Content-Type
image/jpeg
X-Timestamp
1681843857.94796
Cache-Control
public, max-age=9134
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
64810
X-Trans-Id
tx71e6ebd5fb814fc7a4962-0064945098dfw1
Expires
Tue, 27 Jun 2023 04:42:54 GMT
blackcat-claims-hit-on-reddit-threatens-sensitive-data-leak-showcase_image-2-p-3460.jpg
4a7efb2d53317100f611-1d7064c4f7b6de25658a4199efb34975.ssl.cf1.rackcdn.com/
56 KB
56 KB
Image
General
Full URL
https://4a7efb2d53317100f611-1d7064c4f7b6de25658a4199efb34975.ssl.cf1.rackcdn.com/blackcat-claims-hit-on-reddit-threatens-sensitive-data-leak-showcase_image-2-p-3460.jpg
Requested by
Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/chinese-apt-group-uses-new-tradecraft-to-live-off-land-a-22379
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
184.30.16.143 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-30-16-143.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
c3b29b4092d0bca93f4110dc0aa8b879436c0c0c6f0e9cd8b4d3ceb8457244c7

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.bankinfosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Tue, 27 Jun 2023 02:10:40 GMT
Last-Modified
Mon, 19 Jun 2023 13:10:46 GMT
ETag
fa3fe77d9767933282f7f56c92e4cb29
Content-Type
image/jpeg
X-Timestamp
1687180245.21327
Cache-Control
public, max-age=66143
Connection
keep-alive
Accept-Ranges
bytes
X-Trans-Id
txd9a4e3f4929643d59cbe2-00649532b1dfw1
Content-Length
57209
Expires
Tue, 27 Jun 2023 20:33:03 GMT
new-entrants-to-ransomware-unleash-frankenstein-malware-showcase_image-1-p-3459.jpg
4a7efb2d53317100f611-1d7064c4f7b6de25658a4199efb34975.ssl.cf1.rackcdn.com/
72 KB
72 KB
Image
General
Full URL
https://4a7efb2d53317100f611-1d7064c4f7b6de25658a4199efb34975.ssl.cf1.rackcdn.com/new-entrants-to-ransomware-unleash-frankenstein-malware-showcase_image-1-p-3459.jpg
Requested by
Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/chinese-apt-group-uses-new-tradecraft-to-live-off-land-a-22379
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
184.30.16.143 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-30-16-143.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
958741625f5a4684c6cbb693f04970ca3372fa881e5fd95b036d91eeea71e27b

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.bankinfosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Tue, 27 Jun 2023 02:10:40 GMT
Last-Modified
Fri, 09 Jun 2023 17:06:57 GMT
ETag
083318c4fcadd4e5f42703d4dcec8dfb
Content-Type
image/jpeg
X-Timestamp
1686330416.13400
Cache-Control
public, max-age=72931
Connection
keep-alive
Accept-Ranges
bytes
X-Trans-Id
txa1f0b8cb554f4bb4a681a-00649a10afdfw1
Content-Length
73461
Expires
Tue, 27 Jun 2023 22:26:11 GMT
the-public-cloud-more-secure-than-legacy-data-centers-showcase_image-10-a-22348.jpg
130e178e8f8ba617604b-8aedd782b7d22cfe0d1146da69a52436.ssl.cf1.rackcdn.com/
85 KB
86 KB
Image
General
Full URL
https://130e178e8f8ba617604b-8aedd782b7d22cfe0d1146da69a52436.ssl.cf1.rackcdn.com/the-public-cloud-more-secure-than-legacy-data-centers-showcase_image-10-a-22348.jpg
Requested by
Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/chinese-apt-group-uses-new-tradecraft-to-live-off-land-a-22379
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
184.30.16.143 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-30-16-143.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
e6a8f5b2b6a5b8dfbf571c7fe00eb4209571fa1bac6dabfd7679319568e6efad

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.bankinfosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Tue, 27 Jun 2023 02:10:39 GMT
Last-Modified
Thu, 22 Jun 2023 17:00:27 GMT
ETag
6273548d6af43d0017d4a3380d66c706
Content-Type
image/jpeg
X-Timestamp
1687453226.86613
Cache-Control
public, max-age=19717
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
87166
X-Trans-Id
tx258f371030a24cbab4a8c-0064947ef1dfw1
Expires
Tue, 27 Jun 2023 07:39:16 GMT
getting-handle-on-cyber-threats-facing-rural-hospitals-showcase_image-2-a-22314.jpg
130e178e8f8ba617604b-8aedd782b7d22cfe0d1146da69a52436.ssl.cf1.rackcdn.com/
91 KB
91 KB
Image
General
Full URL
https://130e178e8f8ba617604b-8aedd782b7d22cfe0d1146da69a52436.ssl.cf1.rackcdn.com/getting-handle-on-cyber-threats-facing-rural-hospitals-showcase_image-2-a-22314.jpg
Requested by
Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/chinese-apt-group-uses-new-tradecraft-to-live-off-land-a-22379
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
184.30.16.143 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-30-16-143.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
f48f38f3d39171eb79fd3264f9c2e5d99e1703dfec1b687e0b2d6ebab21d05c1

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.bankinfosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Tue, 27 Jun 2023 02:10:39 GMT
Last-Modified
Fri, 16 Jun 2023 16:00:32 GMT
ETag
64cbb110461e83d2ae302f7b204957f7
Content-Type
image/jpeg
X-Timestamp
1686931231.86102
Cache-Control
public, max-age=55996
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
93078
X-Trans-Id
txaa1e80f5d7fa4fdb8a772-00648cb260dfw1
Expires
Tue, 27 Jun 2023 17:43:55 GMT
forrester-report-3-top-new-threats-in-2023-showcase_image-8-a-22315.jpg
130e178e8f8ba617604b-8aedd782b7d22cfe0d1146da69a52436.ssl.cf1.rackcdn.com/
81 KB
81 KB
Image
General
Full URL
https://130e178e8f8ba617604b-8aedd782b7d22cfe0d1146da69a52436.ssl.cf1.rackcdn.com/forrester-report-3-top-new-threats-in-2023-showcase_image-8-a-22315.jpg
Requested by
Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/chinese-apt-group-uses-new-tradecraft-to-live-off-land-a-22379
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
184.30.16.143 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-30-16-143.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
b174c56cc02f8e22768cc85936d770e6ad391322a817e294f908062d0581b20c

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.bankinfosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Tue, 27 Jun 2023 02:10:40 GMT
Last-Modified
Fri, 16 Jun 2023 16:02:45 GMT
ETag
4a715d72e88f2e1b47bf564357e5078a
Content-Type
image/jpeg
X-Timestamp
1686931364.88156
Cache-Control
public, max-age=47722
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
82659
X-Trans-Id
tx1ecf4af52953469e91f5e-00648c9a65dfw1
Expires
Tue, 27 Jun 2023 15:26:02 GMT
ismg-editors-changing-nature-security-profession-showcase_image-2-a-22313.jpg
130e178e8f8ba617604b-8aedd782b7d22cfe0d1146da69a52436.ssl.cf1.rackcdn.com/
191 KB
191 KB
Image
General
Full URL
https://130e178e8f8ba617604b-8aedd782b7d22cfe0d1146da69a52436.ssl.cf1.rackcdn.com/ismg-editors-changing-nature-security-profession-showcase_image-2-a-22313.jpg
Requested by
Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/chinese-apt-group-uses-new-tradecraft-to-live-off-land-a-22379
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
184.30.16.143 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-30-16-143.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
6457a0e63ae355f0e5d1fd81a701c169f4fe3aab8ec7d6702bbab00fe9df03b5

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.bankinfosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Tue, 27 Jun 2023 02:10:40 GMT
Last-Modified
Fri, 16 Jun 2023 14:44:22 GMT
ETag
f8f4e40a3d1f985b499c977ca28ee9cd
Content-Type
image/jpeg
X-Timestamp
1686926661.72872
Cache-Control
public, max-age=42687
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
195258
X-Trans-Id
tx802cbedb1e4e4c8c9df1e-00648c7e62dfw1
Expires
Tue, 27 Jun 2023 14:02:07 GMT
live-webinar-master-class-on-security-roger-grimes-teaches-you-phishing-mitigation-showcase_image-1-w-4925.jpg
75d03c5f1bfbbbb9cc13-369a671ebb934b49b239e372822005c5.ssl.cf1.rackcdn.com/
73 KB
73 KB
Image
General
Full URL
https://75d03c5f1bfbbbb9cc13-369a671ebb934b49b239e372822005c5.ssl.cf1.rackcdn.com/live-webinar-master-class-on-security-roger-grimes-teaches-you-phishing-mitigation-showcase_image-1-w-4925.jpg
Requested by
Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/chinese-apt-group-uses-new-tradecraft-to-live-off-land-a-22379
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
184.30.16.143 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-30-16-143.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
9c0eece4e399b03e88bde7d9d6fdbb5149681bd096e6ab23fc0accab35fb460d

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.bankinfosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Tue, 27 Jun 2023 02:10:40 GMT
Last-Modified
Mon, 26 Jun 2023 20:05:14 GMT
ETag
6495e6c40657401d58d090e0d2b6c60b
Content-Type
image/jpeg
X-Timestamp
1687809913.46846
Cache-Control
public, max-age=68710
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
74837
X-Trans-Id
txc1a2fa99f96c441f9d922-00649a002edfw1
Expires
Tue, 27 Jun 2023 21:15:50 GMT
live-webinar-native-database-protection-enough-showcase_image-5-w-4920.jpg
75d03c5f1bfbbbb9cc13-369a671ebb934b49b239e372822005c5.ssl.cf1.rackcdn.com/
73 KB
73 KB
Image
General
Full URL
https://75d03c5f1bfbbbb9cc13-369a671ebb934b49b239e372822005c5.ssl.cf1.rackcdn.com/live-webinar-native-database-protection-enough-showcase_image-5-w-4920.jpg
Requested by
Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/chinese-apt-group-uses-new-tradecraft-to-live-off-land-a-22379
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
184.30.16.143 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-30-16-143.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
4c73802f936c2994c43d3af01b39ed725c31070279faea523dcec3154587dcda

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.bankinfosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Tue, 27 Jun 2023 02:10:40 GMT
Last-Modified
Fri, 23 Jun 2023 15:53:24 GMT
ETag
415a569cd31b3f11ca2d9ff449cfa55e
Content-Type
image/jpeg
X-Timestamp
1687535603.78679
Cache-Control
public, max-age=30302
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
74340
X-Trans-Id
tx581a674e7b29457fbdd9f-006495d7fedfw1
Expires
Tue, 27 Jun 2023 10:35:42 GMT
generative-ai-cybersecurity-friend-or-foe-showcase_image-10-w-4922.jpg
75d03c5f1bfbbbb9cc13-369a671ebb934b49b239e372822005c5.ssl.cf1.rackcdn.com/
57 KB
58 KB
Image
General
Full URL
https://75d03c5f1bfbbbb9cc13-369a671ebb934b49b239e372822005c5.ssl.cf1.rackcdn.com/generative-ai-cybersecurity-friend-or-foe-showcase_image-10-w-4922.jpg
Requested by
Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/chinese-apt-group-uses-new-tradecraft-to-live-off-land-a-22379
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
184.30.16.143 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-30-16-143.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
ac65146dbd1c7f71965e57e0ec033fdcdb1260865e282d86568bca6a7aa283f2

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.bankinfosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Tue, 27 Jun 2023 02:10:40 GMT
Last-Modified
Fri, 23 Jun 2023 16:22:50 GMT
ETag
d2dde6a1a27398edb8adeb6b502a4870
Content-Type
image/jpeg
X-Timestamp
1687537369.42896
Cache-Control
public, max-age=47895
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
58878
X-Trans-Id
txa49462d38cce4699a8967-006499aeaddfw1
Expires
Tue, 27 Jun 2023 15:28:55 GMT
live-webinar-i-putting-x-in-edr-vmware-carbon-black-showcase_image-9-w-4907.jpg
75d03c5f1bfbbbb9cc13-369a671ebb934b49b239e372822005c5.ssl.cf1.rackcdn.com/
44 KB
45 KB
Image
General
Full URL
https://75d03c5f1bfbbbb9cc13-369a671ebb934b49b239e372822005c5.ssl.cf1.rackcdn.com/live-webinar-i-putting-x-in-edr-vmware-carbon-black-showcase_image-9-w-4907.jpg
Requested by
Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/chinese-apt-group-uses-new-tradecraft-to-live-off-land-a-22379
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
184.30.16.143 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-30-16-143.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
2410eb6ce15c2386b260ac6366e9b22bb3fe19fb0f7bca727df233e6ee39b2b7

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.bankinfosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Tue, 27 Jun 2023 02:10:40 GMT
Last-Modified
Sat, 17 Jun 2023 10:33:32 GMT
ETag
a2f31b4de5c2dbaf3641ec21f0f90f04
Content-Type
image/jpeg
X-Timestamp
1686998011.52908
Cache-Control
public, max-age=27663
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
45340
X-Trans-Id
tx22cbb7a06f8640e78665d-00648fd812dfw1
Expires
Tue, 27 Jun 2023 09:51:43 GMT
live-webinar-eliminate-cyber-threats-vulnerabilities-api-security-testing-showcase_image-5-w-4868.jpg
75d03c5f1bfbbbb9cc13-369a671ebb934b49b239e372822005c5.ssl.cf1.rackcdn.com/
49 KB
49 KB
Image
General
Full URL
https://75d03c5f1bfbbbb9cc13-369a671ebb934b49b239e372822005c5.ssl.cf1.rackcdn.com/live-webinar-eliminate-cyber-threats-vulnerabilities-api-security-testing-showcase_image-5-w-4868.jpg
Requested by
Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/chinese-apt-group-uses-new-tradecraft-to-live-off-land-a-22379
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
184.30.16.143 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-30-16-143.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
2268b1d927116d04d3e2ef05e2c553ed82a3a8865530a2d764cae005854cb208

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.bankinfosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Tue, 27 Jun 2023 02:10:40 GMT
Last-Modified
Fri, 26 May 2023 18:30:03 GMT
ETag
f7fc6ba368c76b359fdf60be2a54dd63
Content-Type
image/jpeg
X-Timestamp
1685125802.81963
Cache-Control
public, max-age=83323
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
49964
X-Trans-Id
tx0bf2577179f94fb08367a-0064767611dfw1
Expires
Wed, 28 Jun 2023 01:19:23 GMT
live-webinar-protecting-microsoft-sql-server-at-scale-showcase_image-3-w-4880.jpg
75d03c5f1bfbbbb9cc13-369a671ebb934b49b239e372822005c5.ssl.cf1.rackcdn.com/
47 KB
48 KB
Image
General
Full URL
https://75d03c5f1bfbbbb9cc13-369a671ebb934b49b239e372822005c5.ssl.cf1.rackcdn.com/live-webinar-protecting-microsoft-sql-server-at-scale-showcase_image-3-w-4880.jpg
Requested by
Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/chinese-apt-group-uses-new-tradecraft-to-live-off-land-a-22379
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
184.30.16.143 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-30-16-143.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
bfadafc237c8d28e9b6b3ba53dd00cb08baf1b9c43b53205b0f908dfff2e0bdc

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.bankinfosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Tue, 27 Jun 2023 02:10:40 GMT
Last-Modified
Wed, 07 Jun 2023 15:34:46 GMT
ETag
efc10eabc4b3d883c974ff8da55af788
Content-Type
image/jpeg
X-Timestamp
1686152085.04710
Cache-Control
public, max-age=63014
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
48390
X-Trans-Id
tx8b14d54b22a54ba1b9756-006480b121dfw1
Expires
Tue, 27 Jun 2023 19:40:54 GMT
how-to-step-up-your-cybersecurity-panel-discussion-showcase_image-6-w-4895.jpg
75d03c5f1bfbbbb9cc13-369a671ebb934b49b239e372822005c5.ssl.cf1.rackcdn.com/
39 KB
39 KB
Image
General
Full URL
https://75d03c5f1bfbbbb9cc13-369a671ebb934b49b239e372822005c5.ssl.cf1.rackcdn.com/how-to-step-up-your-cybersecurity-panel-discussion-showcase_image-6-w-4895.jpg
Requested by
Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/chinese-apt-group-uses-new-tradecraft-to-live-off-land-a-22379
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
184.30.16.143 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-30-16-143.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
50971142cb40342d5737ebd327d6b41ee85394a1d8fd1519b3e09a2fa5ffc214

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.bankinfosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Tue, 27 Jun 2023 02:10:39 GMT
Last-Modified
Tue, 13 Jun 2023 15:06:22 GMT
ETag
21cacd9742692ea3e0046279a42952c7
Content-Type
image/jpeg
X-Timestamp
1686668781.71827
Cache-Control
public, max-age=77263
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
39519
X-Trans-Id
tx64a1552ce1784fc1b2091-0064909cfbdfw1
Expires
Tue, 27 Jun 2023 23:38:22 GMT
ellen-richey-largeImage-4-a-874.jpg
6d63d49ccb7c52435540-5070aa97eaa2b8df4eb5a91600e69901.ssl.cf1.rackcdn.com/
36 KB
37 KB
Image
General
Full URL
https://6d63d49ccb7c52435540-5070aa97eaa2b8df4eb5a91600e69901.ssl.cf1.rackcdn.com/ellen-richey-largeImage-4-a-874.jpg
Requested by
Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/chinese-apt-group-uses-new-tradecraft-to-live-off-land-a-22379
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
184.30.16.143 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-30-16-143.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
2825e209bff20491277f30470767ae04daff595b611fc6cbdc524edf5c4cb382

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.bankinfosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Tue, 27 Jun 2023 02:10:40 GMT
Last-Modified
Thu, 01 May 2014 20:52:05 GMT
ETag
85ad3a04d43078f4834e1b23041dfd7f
Content-Type
image/jpeg
X-Timestamp
1398977524.50319
Cache-Control
public, max-age=47491
Connection
keep-alive
Accept-Ranges
bytes
X-Trans-Id
txe5d6392211ef4aa883c24-0064664516dfw1
Content-Length
37040
Expires
Tue, 27 Jun 2023 15:22:11 GMT
thurain-tun-largeImage-6-a-4148.jpg
6d63d49ccb7c52435540-5070aa97eaa2b8df4eb5a91600e69901.ssl.cf1.rackcdn.com/
84 KB
84 KB
Image
General
Full URL
https://6d63d49ccb7c52435540-5070aa97eaa2b8df4eb5a91600e69901.ssl.cf1.rackcdn.com/thurain-tun-largeImage-6-a-4148.jpg
Requested by
Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/chinese-apt-group-uses-new-tradecraft-to-live-off-land-a-22379
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
184.30.16.143 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-30-16-143.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
4027b2655fb5d5fc650c12508adfe326ace67de2433edabc35e47850f5480ae8

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.bankinfosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Tue, 27 Jun 2023 02:10:40 GMT
Last-Modified
Sun, 06 Jun 2021 16:21:28 GMT
ETag
a0d8941f30efdaa537fc14351a2be8f9
Content-Type
image/jpeg
X-Timestamp
1622996487.98037
Cache-Control
public, max-age=22439
Connection
keep-alive
Accept-Ranges
bytes
X-Trans-Id
tx54a647ed147e4938867fa-00648d8aa5dfw1
Content-Length
85631
Expires
Tue, 27 Jun 2023 08:24:39 GMT
matthew-braverman-largeImage-7-a-1927.jpg
6d63d49ccb7c52435540-5070aa97eaa2b8df4eb5a91600e69901.ssl.cf1.rackcdn.com/
106 KB
106 KB
Image
General
Full URL
https://6d63d49ccb7c52435540-5070aa97eaa2b8df4eb5a91600e69901.ssl.cf1.rackcdn.com/matthew-braverman-largeImage-7-a-1927.jpg
Requested by
Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/chinese-apt-group-uses-new-tradecraft-to-live-off-land-a-22379
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
184.30.16.143 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-30-16-143.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
00ad09aae591af794f681fd401c5025da35b44c131e20ad263b854164a8c6e85

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.bankinfosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Tue, 27 Jun 2023 02:10:40 GMT
Last-Modified
Wed, 03 May 2017 21:30:40 GMT
ETag
f539e25613c0ee8c251808e9439ae9e0
Content-Type
image/jpeg
X-Timestamp
1493847039.65955
Cache-Control
public, max-age=14232
Connection
keep-alive
Accept-Ranges
bytes
X-Trans-Id
tx87b41536a10f48d3b2099-00647957f7dfw1
Content-Length
108505
Expires
Tue, 27 Jun 2023 06:07:52 GMT
roger-grimes-largeImage-10-a-2536.jpg
6d63d49ccb7c52435540-5070aa97eaa2b8df4eb5a91600e69901.ssl.cf1.rackcdn.com/
53 KB
53 KB
Image
General
Full URL
https://6d63d49ccb7c52435540-5070aa97eaa2b8df4eb5a91600e69901.ssl.cf1.rackcdn.com/roger-grimes-largeImage-10-a-2536.jpg
Requested by
Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/chinese-apt-group-uses-new-tradecraft-to-live-off-land-a-22379
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
184.30.16.143 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-30-16-143.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
d18e6e1e3eb133e23f96fd76d22a94821fb034eb542885bbdc89fb7a5c67ec65

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.bankinfosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Tue, 27 Jun 2023 02:10:40 GMT
Last-Modified
Mon, 15 Oct 2018 16:37:11 GMT
ETag
560681c53c4a3fe082450fedfd9d2761
Content-Type
image/jpeg
X-Timestamp
1539621430.64915
Cache-Control
public, max-age=23136
Connection
keep-alive
Accept-Ranges
bytes
X-Trans-Id
tx213b65475ddf43039766d-0064867fcfdfw1
Content-Length
54117
Expires
Tue, 27 Jun 2023 08:36:16 GMT
soc-build-vs-buy-when-right-pdf-8-w-12164.jpg
dbac8a2e962120c65098-4d6abce208e5e17c2085b466b98c2083.ssl.cf1.rackcdn.com/
311 KB
311 KB
Image
General
Full URL
https://dbac8a2e962120c65098-4d6abce208e5e17c2085b466b98c2083.ssl.cf1.rackcdn.com/soc-build-vs-buy-when-right-pdf-8-w-12164.jpg
Requested by
Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/chinese-apt-group-uses-new-tradecraft-to-live-off-land-a-22379
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
184.30.16.143 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-30-16-143.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
7e201f2a13c1277de84732ca1228c8af49f797edf512456560f1970a9e69853d

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.bankinfosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Tue, 27 Jun 2023 02:10:40 GMT
Last-Modified
Thu, 22 Jun 2023 13:34:25 GMT
ETag
3736501291c38181c2ee3117541554b9
Content-Type
image/jpeg
X-Timestamp
1687440864.19413
Cache-Control
public, max-age=8557
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
318096
X-Trans-Id
tx10066190b57a486ca0be3-0064945036dfw1
Expires
Tue, 27 Jun 2023 04:33:17 GMT
2023-data-breach-investigations-report-public-sector-snapshot-pdf-4-w-12149.jpg
dbac8a2e962120c65098-4d6abce208e5e17c2085b466b98c2083.ssl.cf1.rackcdn.com/
155 KB
155 KB
Image
General
Full URL
https://dbac8a2e962120c65098-4d6abce208e5e17c2085b466b98c2083.ssl.cf1.rackcdn.com/2023-data-breach-investigations-report-public-sector-snapshot-pdf-4-w-12149.jpg
Requested by
Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/chinese-apt-group-uses-new-tradecraft-to-live-off-land-a-22379
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
184.30.16.143 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-30-16-143.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
51c9dd2b116b821c23f948bfcada14fb1dc71eb9f3840ed020357a0e83572e4d

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.bankinfosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Tue, 27 Jun 2023 02:10:40 GMT
Last-Modified
Wed, 21 Jun 2023 13:10:40 GMT
ETag
a69964fbd38121d35d602b13a49dcdaf
Content-Type
image/jpeg
X-Timestamp
1687353039.80764
Cache-Control
public, max-age=77165
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
158286
X-Trans-Id
txa77a2a510a6b433498231-0064942da6dfw1
Expires
Tue, 27 Jun 2023 23:36:45 GMT
augmenting-your-microsoft-365-email-security-infrastructure-pdf-7-w-12141.jpg
dbac8a2e962120c65098-4d6abce208e5e17c2085b466b98c2083.ssl.cf1.rackcdn.com/
199 KB
199 KB
Image
General
Full URL
https://dbac8a2e962120c65098-4d6abce208e5e17c2085b466b98c2083.ssl.cf1.rackcdn.com/augmenting-your-microsoft-365-email-security-infrastructure-pdf-7-w-12141.jpg
Requested by
Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/chinese-apt-group-uses-new-tradecraft-to-live-off-land-a-22379
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
184.30.16.143 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-30-16-143.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
de97f31631e402844be35c90f749425cb168ebdcf3dfcb6e9b5ff3f8bdbc1d28

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.bankinfosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Tue, 27 Jun 2023 02:10:40 GMT
Last-Modified
Mon, 19 Jun 2023 14:47:44 GMT
ETag
2f4a816cb54e92ebb7c7aa6eb19fd6a5
Content-Type
image/jpeg
X-Timestamp
1687186063.14124
Cache-Control
public, max-age=14329
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
203473
X-Trans-Id
tx8bf0c0287fd2463596e7b-00649206eddfw1
Expires
Tue, 27 Jun 2023 06:09:29 GMT
how-to-avoid-tradeoffs-between-security-user-experience-logo-10-w-11889.PNG
dbac8a2e962120c65098-4d6abce208e5e17c2085b466b98c2083.ssl.cf1.rackcdn.com/
314 KB
314 KB
Image
General
Full URL
https://dbac8a2e962120c65098-4d6abce208e5e17c2085b466b98c2083.ssl.cf1.rackcdn.com/how-to-avoid-tradeoffs-between-security-user-experience-logo-10-w-11889.PNG
Requested by
Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/chinese-apt-group-uses-new-tradecraft-to-live-off-land-a-22379
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
184.30.16.143 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-30-16-143.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
e5f642d2f033427623818296e1b6cfccbdd3ce10dd8aadda10bdfef52a5f31f7

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.bankinfosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Tue, 27 Jun 2023 02:10:40 GMT
Last-Modified
Thu, 20 Apr 2023 21:30:57 GMT
ETag
a93581f3ac2fcf96e4811a241bdfad9e
Content-Type
image/png
X-Timestamp
1682026256.09344
Cache-Control
public, max-age=53981
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
321568
X-Trans-Id
txdd68d76d0f3746f48b98c-00648eea42dfw1
Expires
Tue, 27 Jun 2023 17:10:21 GMT
2021-year-complexity-pdf-9-h-106.jpg
fa94d5c47256403c613d-7164cafcaac68bfd3318486ab257f999.ssl.cf1.rackcdn.com/
167 KB
168 KB
Image
General
Full URL
https://fa94d5c47256403c613d-7164cafcaac68bfd3318486ab257f999.ssl.cf1.rackcdn.com/2021-year-complexity-pdf-9-h-106.jpg
Requested by
Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/chinese-apt-group-uses-new-tradecraft-to-live-off-land-a-22379
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
184.30.16.143 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-30-16-143.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
7feb9afd2b66cb0776368af51a4e74d22787d4cbe836e1d6490fc1badbd46d5e

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.bankinfosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Tue, 27 Jun 2023 02:10:40 GMT
Last-Modified
Fri, 14 Jan 2022 21:05:07 GMT
ETag
9cea7f13e1a59b282e81257964303095
Content-Type
image/jpeg
X-Timestamp
1642194306.07043
Cache-Control
public, max-age=37228
Connection
keep-alive
Accept-Ranges
bytes
X-Trans-Id
tx88dc6b402c454c698def5-006460bf67dfw1
Content-Length
171288
Expires
Tue, 27 Jun 2023 12:31:08 GMT
combatting-cybercrime-pdf-9-h-103.jpg
fa94d5c47256403c613d-7164cafcaac68bfd3318486ab257f999.ssl.cf1.rackcdn.com/
358 KB
358 KB
Image
General
Full URL
https://fa94d5c47256403c613d-7164cafcaac68bfd3318486ab257f999.ssl.cf1.rackcdn.com/combatting-cybercrime-pdf-9-h-103.jpg
Requested by
Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/chinese-apt-group-uses-new-tradecraft-to-live-off-land-a-22379
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
184.30.16.143 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-30-16-143.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
7ff5b98c09ec9d2af43d4108160ea0455f91f415f83031cc79fbe24a3a765bb8

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.bankinfosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Tue, 27 Jun 2023 02:10:40 GMT
Last-Modified
Tue, 26 Nov 2019 19:37:47 GMT
ETag
11a3adb400c0ff282a505428b1d7be73
Content-Type
image/jpeg
X-Timestamp
1574797066.57975
Cache-Control
public, max-age=15034
Connection
keep-alive
Accept-Ranges
bytes
X-Trans-Id
tx9c221642996349cf8525b-006486a24edfw1
Content-Length
366322
Expires
Tue, 27 Jun 2023 06:21:14 GMT
top-canadian-cyber-threats-expected-in-2020-logo-9-h-102.jpg
fa94d5c47256403c613d-7164cafcaac68bfd3318486ab257f999.ssl.cf1.rackcdn.com/
76 KB
77 KB
Image
General
Full URL
https://fa94d5c47256403c613d-7164cafcaac68bfd3318486ab257f999.ssl.cf1.rackcdn.com/top-canadian-cyber-threats-expected-in-2020-logo-9-h-102.jpg
Requested by
Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/chinese-apt-group-uses-new-tradecraft-to-live-off-land-a-22379
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
184.30.16.143 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-30-16-143.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
eb9ec684a7198fded61e248eaff2d28d0c9f8a15dfee8d9afff66aa6ff200461

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.bankinfosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Tue, 27 Jun 2023 02:10:40 GMT
Last-Modified
Mon, 28 Oct 2019 13:57:45 GMT
ETag
69913c61181f1fc9d730d6c8298e55c4
Content-Type
image/jpeg
X-Timestamp
1572271064.63410
Cache-Control
public, max-age=79427
Connection
keep-alive
Accept-Ranges
bytes
X-Trans-Id
tx8c23b5a49ffe47b1b540c-00648bb2fddfw1
Content-Length
78320
Expires
Wed, 28 Jun 2023 00:14:27 GMT
leveraging-new-technologies-in-fraud-investigations-logo-7-h-101.jpg
fa94d5c47256403c613d-7164cafcaac68bfd3318486ab257f999.ssl.cf1.rackcdn.com/
197 KB
198 KB
Image
General
Full URL
https://fa94d5c47256403c613d-7164cafcaac68bfd3318486ab257f999.ssl.cf1.rackcdn.com/leveraging-new-technologies-in-fraud-investigations-logo-7-h-101.jpg
Requested by
Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/chinese-apt-group-uses-new-tradecraft-to-live-off-land-a-22379
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
184.30.16.143 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-30-16-143.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
c70242480ad0a0ecc7c305d659f1fdb3a9cb1eb480927b46f8bd62d33ed0f8b2

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.bankinfosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Tue, 27 Jun 2023 02:10:40 GMT
Last-Modified
Tue, 15 Oct 2019 14:06:53 GMT
ETag
e3e068e355cdbfaa15e88b627d7ebc55
Content-Type
image/jpeg
X-Timestamp
1571148412.42493
Cache-Control
public, max-age=22853
Connection
keep-alive
Accept-Ranges
bytes
X-Trans-Id
tx5098aa0a81da45f69a1c0-00646ae697dfw1
Content-Length
202154
Expires
Tue, 27 Jun 2023 08:31:33 GMT
2023-faces-fraud-survey-showcase_image-6-s-107.jpg
21aaef15263171502b5a-3fc6a64a094676b060fa7dc8c4490be9.ssl.cf1.rackcdn.com/
48 KB
49 KB
Image
General
Full URL
https://21aaef15263171502b5a-3fc6a64a094676b060fa7dc8c4490be9.ssl.cf1.rackcdn.com/2023-faces-fraud-survey-showcase_image-6-s-107.jpg
Requested by
Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/chinese-apt-group-uses-new-tradecraft-to-live-off-land-a-22379
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
184.30.16.143 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-30-16-143.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
5a5c61d64361c9a4f8de2a6ef550bb2229334d178f577f59c4639ae932c90ad2

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.bankinfosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Tue, 27 Jun 2023 02:10:40 GMT
Last-Modified
Wed, 07 Jun 2023 14:19:14 GMT
ETag
dea229980212791a8735e12fa4f2e011
Content-Type
image/jpeg
X-Timestamp
1686147553.28163
Cache-Control
public, max-age=43829
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
49455
X-Trans-Id
tx7d731734c0ef46a0a74c2-006480951ddfw1
Expires
Tue, 27 Jun 2023 14:21:09 GMT
identifying-critical-gaps-in-securing-identity-in-finance-2023-research-survey-showcase_image-2-s-106.jpg
21aaef15263171502b5a-3fc6a64a094676b060fa7dc8c4490be9.ssl.cf1.rackcdn.com/
53 KB
53 KB
Image
General
Full URL
https://21aaef15263171502b5a-3fc6a64a094676b060fa7dc8c4490be9.ssl.cf1.rackcdn.com/identifying-critical-gaps-in-securing-identity-in-finance-2023-research-survey-showcase_image-2-s-106.jpg
Requested by
Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/chinese-apt-group-uses-new-tradecraft-to-live-off-land-a-22379
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
184.30.16.143 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-30-16-143.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
f31fd1d112cb45538d3e7b306ca3effb82f67b60c39f28010e1e11078410e34f

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.bankinfosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Tue, 27 Jun 2023 02:10:40 GMT
Last-Modified
Tue, 07 Mar 2023 16:44:44 GMT
ETag
9797010981024ffdd1acf0e9776051a6
Content-Type
image/jpeg
X-Timestamp
1678207483.09043
Cache-Control
public, max-age=52677
Connection
keep-alive
Accept-Ranges
bytes
X-Trans-Id
tx7ec8ce18a2504209b8960-006443781adfw1
Content-Length
54265
Expires
Tue, 27 Jun 2023 16:48:37 GMT
endpoint-security-challenges-in-manufacturing-ot-systems-survey-showcase_image-2-s-105.jpg
21aaef15263171502b5a-3fc6a64a094676b060fa7dc8c4490be9.ssl.cf1.rackcdn.com/
38 KB
39 KB
Image
General
Full URL
https://21aaef15263171502b5a-3fc6a64a094676b060fa7dc8c4490be9.ssl.cf1.rackcdn.com/endpoint-security-challenges-in-manufacturing-ot-systems-survey-showcase_image-2-s-105.jpg
Requested by
Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/chinese-apt-group-uses-new-tradecraft-to-live-off-land-a-22379
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
184.30.16.143 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-30-16-143.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
3969009089521bedcd44b2659dd05fc845ea94193d12e5db9a02db6ed3c63adc

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.bankinfosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Tue, 27 Jun 2023 02:10:40 GMT
Last-Modified
Fri, 09 Dec 2022 14:01:24 GMT
ETag
8657f2babda12f812b9871ec571f8a08
Content-Type
image/jpeg
X-Timestamp
1670594483.18250
Cache-Control
public, max-age=81240
Connection
keep-alive
Accept-Ranges
bytes
X-Trans-Id
tx725266d1e6324ed8b3929-00642208d8dfw1
Content-Length
39086
Expires
Wed, 28 Jun 2023 00:44:40 GMT
whats-priority-for-mssmdr-selection-for-2023-showcase_image-9-s-104.jpg
21aaef15263171502b5a-3fc6a64a094676b060fa7dc8c4490be9.ssl.cf1.rackcdn.com/
158 KB
158 KB
Image
General
Full URL
https://21aaef15263171502b5a-3fc6a64a094676b060fa7dc8c4490be9.ssl.cf1.rackcdn.com/whats-priority-for-mssmdr-selection-for-2023-showcase_image-9-s-104.jpg
Requested by
Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/chinese-apt-group-uses-new-tradecraft-to-live-off-land-a-22379
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
184.30.16.143 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-30-16-143.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
a55ff643a6e62f28b827480adc9f6cc30810bce85dc3925e44790b2620419f63

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.bankinfosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Tue, 27 Jun 2023 02:10:40 GMT
Last-Modified
Tue, 15 Nov 2022 14:43:19 GMT
ETag
0fb35cacf1d13ce6a955b5ff50f1337a
Content-Type
image/jpeg
X-Timestamp
1668523398.85950
Cache-Control
public, max-age=21356
Connection
keep-alive
Accept-Ranges
bytes
X-Trans-Id
tx2089f64d0d654579820b6-0064895bcadfw1
Content-Length
161861
Expires
Tue, 27 Jun 2023 08:06:36 GMT
ismgs-healthcare-summit-showcase_image-7-e-398.jpg
752b069ec945bee67d86-1021436e05aad7b2347bf3096cc7e309.ssl.cf1.rackcdn.com/
162 KB
163 KB
Image
General
Full URL
https://752b069ec945bee67d86-1021436e05aad7b2347bf3096cc7e309.ssl.cf1.rackcdn.com/ismgs-healthcare-summit-showcase_image-7-e-398.jpg
Requested by
Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/chinese-apt-group-uses-new-tradecraft-to-live-off-land-a-22379
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
184.30.16.143 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-30-16-143.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
75b8b5c6f7ce4f8b37c96f68b4162c06e050685d10485f75852cd0cb4aa0261f

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.bankinfosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Tue, 27 Jun 2023 02:10:40 GMT
Last-Modified
Mon, 19 Jun 2023 04:35:50 GMT
ETag
42e75d6ce2eddab873aa5eed462a8aae
Content-Type
image/jpeg
X-Timestamp
1687149349.71528
Cache-Control
public, max-age=31782
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
166197
X-Trans-Id
tx17056e86adbf4f8a8d2f0-00648fe5a2dfw1
Expires
Tue, 27 Jun 2023 11:00:22 GMT
ismg-engage-seattle-showcase_image-1-e-394.jpg
752b069ec945bee67d86-1021436e05aad7b2347bf3096cc7e309.ssl.cf1.rackcdn.com/
120 KB
120 KB
Image
General
Full URL
https://752b069ec945bee67d86-1021436e05aad7b2347bf3096cc7e309.ssl.cf1.rackcdn.com/ismg-engage-seattle-showcase_image-1-e-394.jpg
Requested by
Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/chinese-apt-group-uses-new-tradecraft-to-live-off-land-a-22379
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
184.30.16.143 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-30-16-143.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
5f4b11370823a700240b0bd482f10f6fcbb6dd59119841824c1f973dc2405bc7

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.bankinfosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Tue, 27 Jun 2023 02:10:40 GMT
Last-Modified
Tue, 23 May 2023 12:16:03 GMT
ETag
0ed49fdc3cb7bdc0077d9bdfbcd4de6c
Content-Type
image/jpeg
X-Timestamp
1684844162.75999
Cache-Control
public, max-age=77503
Connection
keep-alive
Accept-Ranges
bytes
X-Trans-Id
tx6e48c04439ed41e6b0137-00648a883edfw1
Content-Length
122415
Expires
Tue, 27 Jun 2023 23:42:23 GMT
ismg-engage-washington-dc-imageFileLarge-9-e-388.jpg
752b069ec945bee67d86-1021436e05aad7b2347bf3096cc7e309.ssl.cf1.rackcdn.com/
82 KB
83 KB
Image
General
Full URL
https://752b069ec945bee67d86-1021436e05aad7b2347bf3096cc7e309.ssl.cf1.rackcdn.com/ismg-engage-washington-dc-imageFileLarge-9-e-388.jpg
Requested by
Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/chinese-apt-group-uses-new-tradecraft-to-live-off-land-a-22379
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
184.30.16.143 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-30-16-143.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
ef70188b0511b29572b69e473e8ad0d8b88b5e37e854b88c42c777c3c8ed6fdb

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.bankinfosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Tue, 27 Jun 2023 02:10:40 GMT
Last-Modified
Thu, 15 Dec 2022 23:13:36 GMT
ETag
a869358b428fd92a9df406fa0434946d
Content-Type
image/jpeg
X-Timestamp
1671146015.08303
Cache-Control
public, max-age=48533
Connection
keep-alive
Accept-Ranges
bytes
X-Trans-Id
tx573663da7a39400886301-00648bb2fddfw1
Content-Length
84282
Expires
Tue, 27 Jun 2023 15:39:33 GMT
empty_menu_image.png
www.bankinfosecurity.com/images/navigation/generic/
5 KB
4 KB
Image
General
Full URL
https://www.bankinfosecurity.com/images/navigation/generic/empty_menu_image.png
Requested by
Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/chinese-apt-group-uses-new-tradecraft-to-live-off-land-a-22379
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
50.56.167.254 , United States, ASN33070 (RMH-14, US),
Reverse DNS
Software
Apache /
Resource Hash
69278fe35261286939e10f3832f461f9bf6addf267ffe0134e26be3d313dbd7d
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.bankinfosecurity.com/chinese-apt-group-uses-new-tradecraft-to-live-off-land-a-22379
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Tue, 27 Jun 2023 02:10:40 GMT
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
Content-Encoding
gzip
Server
Apache
Vary
Accept-Encoding
Content-Type
image/png
Cache-Control
max-age=86400, private, must-revalidate
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=95
Content-Length
3692
rsa-conference-2023-compendium-160-interviews-more-showcase_image-8-a-22138.jpg
130e178e8f8ba617604b-8aedd782b7d22cfe0d1146da69a52436.ssl.cf1.rackcdn.com/
56 KB
56 KB
Image
General
Full URL
https://130e178e8f8ba617604b-8aedd782b7d22cfe0d1146da69a52436.ssl.cf1.rackcdn.com/rsa-conference-2023-compendium-160-interviews-more-showcase_image-8-a-22138.jpg
Requested by
Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/chinese-apt-group-uses-new-tradecraft-to-live-off-land-a-22379
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
184.30.16.143 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-30-16-143.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
441132f48c606bab601058cec5283d3268d69356c7124b04476d42207db99163

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.bankinfosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Tue, 27 Jun 2023 02:10:40 GMT
Last-Modified
Mon, 22 May 2023 21:09:03 GMT
ETag
f856606b199f038d193ccec767c10182
Content-Type
image/jpeg
X-Timestamp
1684789742.23903
Cache-Control
public, max-age=44844
Connection
keep-alive
Accept-Ranges
bytes
X-Trans-Id
txb8bf353a14724a0b8bffb-0064890094dfw1
Content-Length
56844
Expires
Tue, 27 Jun 2023 14:38:04 GMT
pulling-covers-off-secret-sprawl-to-reduce-risk-showcase_image-4-a-21921.jpg
130e178e8f8ba617604b-8aedd782b7d22cfe0d1146da69a52436.ssl.cf1.rackcdn.com/
128 KB
128 KB
Image
General
Full URL
https://130e178e8f8ba617604b-8aedd782b7d22cfe0d1146da69a52436.ssl.cf1.rackcdn.com/pulling-covers-off-secret-sprawl-to-reduce-risk-showcase_image-4-a-21921.jpg
Requested by
Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/chinese-apt-group-uses-new-tradecraft-to-live-off-land-a-22379
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
184.30.16.143 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-30-16-143.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
7baaef85b1c6761ac939c7dc62d8cdd899f179113d7a1f55925dc82c15bba0b7

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.bankinfosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Tue, 27 Jun 2023 02:10:40 GMT
Last-Modified
Tue, 02 May 2023 11:25:08 GMT
ETag
417dd3ccb914ec05ef9004d49802c9cf
Content-Type
image/jpeg
X-Timestamp
1683026707.37529
Cache-Control
public, max-age=75672
Connection
keep-alive
Accept-Ranges
bytes
X-Trans-Id
tx75383aef111940cb9dbfd-006498ea82dfw1
Content-Length
130922
Expires
Tue, 27 Jun 2023 23:11:52 GMT
detecting-mitigating-fraud-through-trust-building-showcase_image-2-a-21864.jpg
130e178e8f8ba617604b-8aedd782b7d22cfe0d1146da69a52436.ssl.cf1.rackcdn.com/
175 KB
176 KB
Image
General
Full URL
https://130e178e8f8ba617604b-8aedd782b7d22cfe0d1146da69a52436.ssl.cf1.rackcdn.com/detecting-mitigating-fraud-through-trust-building-showcase_image-2-a-21864.jpg
Requested by
Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/chinese-apt-group-uses-new-tradecraft-to-live-off-land-a-22379
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
184.30.16.143 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-30-16-143.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
d8b70e292d312ceb95a91962382d246c54ef08ccb92adb4e0f7f96a426f6d922

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.bankinfosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Tue, 27 Jun 2023 02:10:40 GMT
Last-Modified
Thu, 27 Apr 2023 00:16:14 GMT
ETag
4fb2741b4f24b46eea088fb6e2acee8b
Content-Type
image/jpeg
X-Timestamp
1682554573.29034
Cache-Control
public, max-age=37272
Connection
keep-alive
Accept-Ranges
bytes
X-Trans-Id
tx900ac1392cd9419fbbad1-0064857d24dfw1
Content-Length
179702
Expires
Tue, 27 Jun 2023 12:31:52 GMT
moving-beyond-standards-compliance-for-third-party-security-showcase_image-5-a-21986.jpg
130e178e8f8ba617604b-8aedd782b7d22cfe0d1146da69a52436.ssl.cf1.rackcdn.com/
88 KB
88 KB
Image
General
Full URL
https://130e178e8f8ba617604b-8aedd782b7d22cfe0d1146da69a52436.ssl.cf1.rackcdn.com/moving-beyond-standards-compliance-for-third-party-security-showcase_image-5-a-21986.jpg
Requested by
Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/chinese-apt-group-uses-new-tradecraft-to-live-off-land-a-22379
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
184.30.16.143 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-30-16-143.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
5d762593b646a2242421a80e7ea121628902af967f264bddae7a43a13821c7ab

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.bankinfosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Tue, 27 Jun 2023 02:10:40 GMT
Last-Modified
Fri, 05 May 2023 08:56:25 GMT
ETag
211c2c9e2ca53c254c6e973ed7c3b6cd
Content-Type
image/jpeg
X-Timestamp
1683276984.73238
Cache-Control
public, max-age=70504
Connection
keep-alive
Accept-Ranges
bytes
X-Trans-Id
tx8c8fd75a82dd478aa913c-006471747cdfw1
Content-Length
90084
Expires
Tue, 27 Jun 2023 21:45:44 GMT
infosec-europe-2019-compendium-imageFile-2-a-12739.jpg
130e178e8f8ba617604b-8aedd782b7d22cfe0d1146da69a52436.ssl.cf1.rackcdn.com/
89 KB
89 KB
Image
General
Full URL
https://130e178e8f8ba617604b-8aedd782b7d22cfe0d1146da69a52436.ssl.cf1.rackcdn.com/infosec-europe-2019-compendium-imageFile-2-a-12739.jpg
Requested by
Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/chinese-apt-group-uses-new-tradecraft-to-live-off-land-a-22379
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
184.30.16.143 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-30-16-143.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
4546d13ea9bae9935dcd23f61d215a528120a53479bf51e372de3420029ed535

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.bankinfosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Tue, 27 Jun 2023 02:10:40 GMT
Last-Modified
Fri, 05 Jul 2019 20:13:34 GMT
ETag
f9dab7917669551bb50361c2dcd43aa7
Content-Type
image/jpeg
X-Timestamp
1562357613.59432
Cache-Control
public, max-age=77587
Connection
keep-alive
Accept-Ranges
bytes
X-Trans-Id
tx1ff8249cca2a419b9b816-0064825534dfw1
Content-Length
91187
Expires
Tue, 27 Jun 2023 23:43:47 GMT
improving-iot-risk-management-showcase_image-10-a-12689.jpg
130e178e8f8ba617604b-8aedd782b7d22cfe0d1146da69a52436.ssl.cf1.rackcdn.com/
60 KB
61 KB
Image
General
Full URL
https://130e178e8f8ba617604b-8aedd782b7d22cfe0d1146da69a52436.ssl.cf1.rackcdn.com/improving-iot-risk-management-showcase_image-10-a-12689.jpg
Requested by
Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/chinese-apt-group-uses-new-tradecraft-to-live-off-land-a-22379
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
184.30.16.143 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-30-16-143.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
6ec9288103b5919c36e28909faf04364cdf19cf7687e234663d0d9daab65a3c0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.bankinfosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Tue, 27 Jun 2023 02:10:40 GMT
Last-Modified
Fri, 28 Jun 2019 14:04:32 GMT
ETag
7f5fdd9cf37f980ea13c12c231815e13
Content-Type
image/jpeg
X-Timestamp
1561730671.53151
Cache-Control
public, max-age=67051
Connection
keep-alive
Accept-Ranges
bytes
X-Trans-Id
txfd36adbc90e4426682df6-00649666cfdfw1
Content-Length
61807
Expires
Tue, 27 Jun 2023 20:48:11 GMT
gdpr-where-do-we-go-from-here-showcase_image-1-a-12681.jpg
130e178e8f8ba617604b-8aedd782b7d22cfe0d1146da69a52436.ssl.cf1.rackcdn.com/
62 KB
62 KB
Image
General
Full URL
https://130e178e8f8ba617604b-8aedd782b7d22cfe0d1146da69a52436.ssl.cf1.rackcdn.com/gdpr-where-do-we-go-from-here-showcase_image-1-a-12681.jpg
Requested by
Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/chinese-apt-group-uses-new-tradecraft-to-live-off-land-a-22379
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
184.30.16.143 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-30-16-143.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
8bc7f122cae9e9efd75cd58076d06fb057d8f50abf07ffc1716e17d87682b9cf

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.bankinfosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Tue, 27 Jun 2023 02:10:40 GMT
Last-Modified
Tue, 25 Jun 2019 19:30:48 GMT
ETag
bba47bed092092a1c82b09a86a3a0e40
Content-Type
image/jpeg
X-Timestamp
1561491047.60933
Cache-Control
public, max-age=10408
Connection
keep-alive
Accept-Ranges
bytes
X-Trans-Id
tx76d1a1f118994bfa8d164-006492770bdfw1
Content-Length
63007
Expires
Tue, 27 Jun 2023 05:04:08 GMT
reinventing-application-security-showcase_image-10-a-12671.jpg
130e178e8f8ba617604b-8aedd782b7d22cfe0d1146da69a52436.ssl.cf1.rackcdn.com/
53 KB
53 KB
Image
General
Full URL
https://130e178e8f8ba617604b-8aedd782b7d22cfe0d1146da69a52436.ssl.cf1.rackcdn.com/reinventing-application-security-showcase_image-10-a-12671.jpg
Requested by
Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/chinese-apt-group-uses-new-tradecraft-to-live-off-land-a-22379
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
184.30.16.143 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-30-16-143.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
4179815331b1b050e45da1ccf1d1a8cb50904e1cbb92228b32d55d545d4aaf7c

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.bankinfosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Tue, 27 Jun 2023 02:10:40 GMT
Last-Modified
Tue, 25 Jun 2019 19:54:35 GMT
ETag
89521d60b07d7e85acabbf0301821f45
Content-Type
image/jpeg
X-Timestamp
1561492474.52472
Cache-Control
public, max-age=17054
Connection
keep-alive
Accept-Ranges
bytes
X-Trans-Id
tx0db1dab964394b7da3811-006483d0ccdfw1
Content-Length
54026
Expires
Tue, 27 Jun 2023 06:54:54 GMT
anviksha-more-largeImage-6-a-5461.jpg
6d63d49ccb7c52435540-5070aa97eaa2b8df4eb5a91600e69901.ssl.cf1.rackcdn.com/
40 KB
40 KB
Image
General
Full URL
https://6d63d49ccb7c52435540-5070aa97eaa2b8df4eb5a91600e69901.ssl.cf1.rackcdn.com/anviksha-more-largeImage-6-a-5461.jpg
Requested by
Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/chinese-apt-group-uses-new-tradecraft-to-live-off-land-a-22379
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
184.30.16.143 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-30-16-143.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
69ad576fdc01cae1e0f0773d85546889f60bd73dfd9325cc755c3c29ba7f420d

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.bankinfosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Tue, 27 Jun 2023 02:10:40 GMT
Last-Modified
Thu, 20 Oct 2022 22:40:35 GMT
ETag
a4de17bc1a73efc4cd928c81f472548a
Content-Type
image/jpeg
X-Timestamp
1666305634.48004
Cache-Control
public, max-age=47130
Connection
keep-alive
Accept-Ranges
bytes
X-Trans-Id
tx4885c3e735cd4f4690d8d-006473a3e7dfw1
Content-Length
40984
Expires
Tue, 27 Jun 2023 15:16:10 GMT
live-webinar-securing-business-growth-road-to-247-detection-response-showcase_image-1-w-3534.jpg
75d03c5f1bfbbbb9cc13-369a671ebb934b49b239e372822005c5.ssl.cf1.rackcdn.com/
93 KB
93 KB
Image
General
Full URL
https://75d03c5f1bfbbbb9cc13-369a671ebb934b49b239e372822005c5.ssl.cf1.rackcdn.com/live-webinar-securing-business-growth-road-to-247-detection-response-showcase_image-1-w-3534.jpg
Requested by
Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/chinese-apt-group-uses-new-tradecraft-to-live-off-land-a-22379
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
184.30.16.143 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-30-16-143.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
97fede359991df79883efa68e75db4c07d30dd92107a4b8c1e9147b4c159f2f4

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.bankinfosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Tue, 27 Jun 2023 02:10:40 GMT
Last-Modified
Mon, 04 Oct 2021 19:44:30 GMT
ETag
c49707df3c71b9069dd3b7c9464d7e42
Content-Type
image/jpeg
X-Timestamp
1633376669.40466
Cache-Control
public, max-age=13774
Connection
keep-alive
Accept-Ranges
bytes
X-Trans-Id
txd5de031e37764ec3b3cf5-0064890095dfw1
Content-Length
94991
Expires
Tue, 27 Jun 2023 06:00:14 GMT
no-more-inside-jobs-stopping-insider-threats-at-banks-pdf-1-w-12095.jpg
dbac8a2e962120c65098-4d6abce208e5e17c2085b466b98c2083.ssl.cf1.rackcdn.com/
113 KB
113 KB
Image
General
Full URL
https://dbac8a2e962120c65098-4d6abce208e5e17c2085b466b98c2083.ssl.cf1.rackcdn.com/no-more-inside-jobs-stopping-insider-threats-at-banks-pdf-1-w-12095.jpg
Requested by
Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/chinese-apt-group-uses-new-tradecraft-to-live-off-land-a-22379
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
184.30.16.143 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-30-16-143.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
15e30b5370b0dfa91752f324a330ea998ebfaf0b7a8ffe749d77582014e3f517

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.bankinfosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Tue, 27 Jun 2023 02:10:40 GMT
Last-Modified
Mon, 05 Jun 2023 16:34:19 GMT
ETag
e4f82347f6a3a47323bc5d00d2ea9884
Content-Type
image/jpeg
X-Timestamp
1685982858.02662
Cache-Control
public, max-age=62787
Connection
keep-alive
Accept-Ranges
bytes
X-Trans-Id
tx67001c8142a147d3b4529-00648bc4f8dfw1
Content-Length
115634
Expires
Tue, 27 Jun 2023 19:37:07 GMT
five-cybersecurity-essentials-for-banks-in-uncertain-times-pdf-6-w-12094.jpg
dbac8a2e962120c65098-4d6abce208e5e17c2085b466b98c2083.ssl.cf1.rackcdn.com/
166 KB
166 KB
Image
General
Full URL
https://dbac8a2e962120c65098-4d6abce208e5e17c2085b466b98c2083.ssl.cf1.rackcdn.com/five-cybersecurity-essentials-for-banks-in-uncertain-times-pdf-6-w-12094.jpg
Requested by
Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/chinese-apt-group-uses-new-tradecraft-to-live-off-land-a-22379
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
184.30.16.143 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-30-16-143.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
26c05d915c6b49300b3b12ea85263fb1a65fcf2c62b03f1c45121f5bd43af993

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.bankinfosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Tue, 27 Jun 2023 02:10:40 GMT
Last-Modified
Mon, 05 Jun 2023 16:11:02 GMT
ETag
a6147731b14225d441433267e17440bb
Content-Type
image/jpeg
X-Timestamp
1685981461.63654
Cache-Control
public, max-age=65077
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
169516
X-Trans-Id
txe1ce8cd9f10a470da1e7a-00647e2ed2dfw1
Expires
Tue, 27 Jun 2023 20:15:17 GMT
ueba-using-ai-ml-for-behavioral-analytics-to-stop-insider-threats-pdf-1-w-12096.jpg
dbac8a2e962120c65098-4d6abce208e5e17c2085b466b98c2083.ssl.cf1.rackcdn.com/
126 KB
127 KB
Image
General
Full URL
https://dbac8a2e962120c65098-4d6abce208e5e17c2085b466b98c2083.ssl.cf1.rackcdn.com/ueba-using-ai-ml-for-behavioral-analytics-to-stop-insider-threats-pdf-1-w-12096.jpg
Requested by
Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/chinese-apt-group-uses-new-tradecraft-to-live-off-land-a-22379
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
184.30.16.143 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-30-16-143.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
93d460a5e1ac912ca45ff1393c39d2a4d1c1648e0fca69006a3314bb1ef6f574

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.bankinfosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Tue, 27 Jun 2023 02:10:40 GMT
Last-Modified
Mon, 05 Jun 2023 17:00:24 GMT
ETag
64d677fb0766b7053aa0c8d3ad6ccca7
Content-Type
image/jpeg
X-Timestamp
1685984423.56043
Cache-Control
public, max-age=60575
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
129214
X-Trans-Id
txadb17648efe4467780a33-00647e2ed2dfw1
Expires
Tue, 27 Jun 2023 19:00:15 GMT
freeing-public-security-networking-talent-to-do-more-automation-pdf-2-w-11983.jpg
dbac8a2e962120c65098-4d6abce208e5e17c2085b466b98c2083.ssl.cf1.rackcdn.com/
266 KB
266 KB
Image
General
Full URL
https://dbac8a2e962120c65098-4d6abce208e5e17c2085b466b98c2083.ssl.cf1.rackcdn.com/freeing-public-security-networking-talent-to-do-more-automation-pdf-2-w-11983.jpg
Requested by
Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/chinese-apt-group-uses-new-tradecraft-to-live-off-land-a-22379
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
184.30.16.143 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-30-16-143.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
78984eab4c0c22f67e60da3ce2b8cdfeb6846b060abfc9b72683992266763379

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.bankinfosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Tue, 27 Jun 2023 02:10:40 GMT
Last-Modified
Tue, 09 May 2023 05:52:37 GMT
ETag
7a0689780b8a9a1f08edb98259c33d44
Content-Type
image/jpeg
X-Timestamp
1683611556.82064
Cache-Control
public, max-age=5353
Connection
keep-alive
Accept-Ranges
bytes
X-Trans-Id
txc52e64fbbdc247faa8152-00647ac37bdfw1
Content-Length
272145
Expires
Tue, 27 Jun 2023 03:39:53 GMT
guess-who-no-more-how-to-unlock-power-identity-graphs-for-fraud-prevention-showcase_image-8-w-3776.jpg
75d03c5f1bfbbbb9cc13-369a671ebb934b49b239e372822005c5.ssl.cf1.rackcdn.com/
217 KB
217 KB
Image
General
Full URL
https://75d03c5f1bfbbbb9cc13-369a671ebb934b49b239e372822005c5.ssl.cf1.rackcdn.com/guess-who-no-more-how-to-unlock-power-identity-graphs-for-fraud-prevention-showcase_image-8-w-3776.jpg
Requested by
Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/chinese-apt-group-uses-new-tradecraft-to-live-off-land-a-22379
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
184.30.16.143 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-30-16-143.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
09bbed0d4841d1b1b5df95504ef8e54d487ec069ef30a3166888201e0477d82e

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.bankinfosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Tue, 27 Jun 2023 02:10:40 GMT
Last-Modified
Tue, 08 Feb 2022 19:21:33 GMT
ETag
7364ae801d83423bf9f10b04e2bc537b
Content-Type
image/jpeg
X-Timestamp
1644348092.41709
Cache-Control
public, max-age=21211
Connection
keep-alive
Accept-Ranges
bytes
X-Trans-Id
tx9556f744eb5245f5a6d1d-006454d4cddfw1
Content-Length
221713
Expires
Tue, 27 Jun 2023 08:04:11 GMT
5-ways-to-improve-asset-inventory-management-using-ordr-pdf-2-w-7395.jpg
dbac8a2e962120c65098-4d6abce208e5e17c2085b466b98c2083.ssl.cf1.rackcdn.com/
225 KB
226 KB
Image
General
Full URL
https://dbac8a2e962120c65098-4d6abce208e5e17c2085b466b98c2083.ssl.cf1.rackcdn.com/5-ways-to-improve-asset-inventory-management-using-ordr-pdf-2-w-7395.jpg
Requested by
Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/chinese-apt-group-uses-new-tradecraft-to-live-off-land-a-22379
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
184.30.16.143 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-30-16-143.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
12dd40a3b07049494f1146a175b1d67611b5a7699bbf0bafcb2fd1eae96f5aad

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.bankinfosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Tue, 27 Jun 2023 02:10:40 GMT
Last-Modified
Mon, 11 Jan 2021 02:34:31 GMT
ETag
18ef245b440eb482d3c630c8f5de04bb
Content-Type
image/jpeg
X-Timestamp
1610332470.52784
Cache-Control
public, max-age=25942
Connection
keep-alive
Accept-Ranges
bytes
X-Trans-Id
txd461180e6cd84295b762d-00647d2dfbdfw1
Content-Length
230889
Expires
Tue, 27 Jun 2023 09:23:02 GMT
2022-unit-42-incident-response-report-pdf-2-w-11063.jpg
dbac8a2e962120c65098-4d6abce208e5e17c2085b466b98c2083.ssl.cf1.rackcdn.com/
280 KB
281 KB
Image
General
Full URL
https://dbac8a2e962120c65098-4d6abce208e5e17c2085b466b98c2083.ssl.cf1.rackcdn.com/2022-unit-42-incident-response-report-pdf-2-w-11063.jpg
Requested by
Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/chinese-apt-group-uses-new-tradecraft-to-live-off-land-a-22379
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
184.30.16.143 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-30-16-143.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
3fc0011d4c74f735c60aa294e781136521de6772c720bc30d7e409cfb047b153

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.bankinfosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Tue, 27 Jun 2023 02:10:40 GMT
Last-Modified
Thu, 20 Oct 2022 15:43:28 GMT
ETag
79ca6a7f4e9ccdd0e5c7e0127366d50d
Content-Type
image/jpeg
X-Timestamp
1666280607.90303
Cache-Control
public, max-age=34358
Connection
keep-alive
Accept-Ranges
bytes
X-Trans-Id
txa1b9728acb8c4b62897a7-0064796b91dfw1
Content-Length
287226
Expires
Tue, 27 Jun 2023 11:43:18 GMT
cybersecurity-trends-predictions-for-2022-2023-pdf-6-w-11377.jpg
dbac8a2e962120c65098-4d6abce208e5e17c2085b466b98c2083.ssl.cf1.rackcdn.com/
153 KB
153 KB
Image
General
Full URL
https://dbac8a2e962120c65098-4d6abce208e5e17c2085b466b98c2083.ssl.cf1.rackcdn.com/cybersecurity-trends-predictions-for-2022-2023-pdf-6-w-11377.jpg
Requested by
Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/chinese-apt-group-uses-new-tradecraft-to-live-off-land-a-22379
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
184.30.16.143 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-30-16-143.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
41b8e7c8b87cdf96b7a159a5fe9112e0000df2d69ef144700fdec01a306cf834

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.bankinfosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Tue, 27 Jun 2023 02:10:40 GMT
Last-Modified
Fri, 06 Jan 2023 21:02:13 GMT
ETag
715630f169befd87c875d59b4fbc0b69
Content-Type
image/jpeg
X-Timestamp
1673038932.78758
Cache-Control
public, max-age=10334
Connection
keep-alive
Accept-Ranges
bytes
X-Trans-Id
txfc73ef78c59343ec86d15-006493cab3dfw1
Content-Length
156406
Expires
Tue, 27 Jun 2023 05:02:54 GMT
live-webinar-secret-sauce-to-secrets-management-showcase_image-4-w-4862.jpg
75d03c5f1bfbbbb9cc13-369a671ebb934b49b239e372822005c5.ssl.cf1.rackcdn.com/
186 KB
186 KB
Image
General
Full URL
https://75d03c5f1bfbbbb9cc13-369a671ebb934b49b239e372822005c5.ssl.cf1.rackcdn.com/live-webinar-secret-sauce-to-secrets-management-showcase_image-4-w-4862.jpg
Requested by
Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/chinese-apt-group-uses-new-tradecraft-to-live-off-land-a-22379
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
184.30.16.143 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-30-16-143.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
121b58c4179ff5a0d261fbb85e38a5a4b0b90afad8e3b2bca573d86faf8e75ee

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.bankinfosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Tue, 27 Jun 2023 02:10:39 GMT
Last-Modified
Mon, 22 May 2023 15:59:00 GMT
ETag
102cd660c0d553baf6d7ae44c0491994
Content-Type
image/jpeg
X-Timestamp
1684771139.30017
Cache-Control
public, max-age=83105
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
190558
X-Trans-Id
txf5c3a95d4a484c0899591-00646bb2f8dfw1
Expires
Wed, 28 Jun 2023 01:15:44 GMT
reimagine-soc-need-for-enhanced-security-analytics-showcase_image-6-w-4887.jpg
75d03c5f1bfbbbb9cc13-369a671ebb934b49b239e372822005c5.ssl.cf1.rackcdn.com/
90 KB
90 KB
Image
General
Full URL
https://75d03c5f1bfbbbb9cc13-369a671ebb934b49b239e372822005c5.ssl.cf1.rackcdn.com/reimagine-soc-need-for-enhanced-security-analytics-showcase_image-6-w-4887.jpg
Requested by
Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/chinese-apt-group-uses-new-tradecraft-to-live-off-land-a-22379
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
184.30.16.143 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-30-16-143.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
db2467e2e1faf8e14680a182109a1ee5ff2e221c138109eec3cff7daae01453a

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.bankinfosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Tue, 27 Jun 2023 02:10:39 GMT
Last-Modified
Wed, 07 Jun 2023 16:35:21 GMT
ETag
4fd4d504498d77876d0865f18485e6f1
Content-Type
image/jpeg
X-Timestamp
1686155720.21303
Cache-Control
public, max-age=37266
Connection
keep-alive
Accept-Ranges
bytes
X-Trans-Id
txf447266518254c68b9a80-0064939347dfw1
Content-Length
92053
Expires
Tue, 27 Jun 2023 12:31:45 GMT
javascript-blockchain-technologies-you-cant-ignore-pdf-4-w-4323.jpg
dbac8a2e962120c65098-4d6abce208e5e17c2085b466b98c2083.ssl.cf1.rackcdn.com/
242 KB
242 KB
Image
General
Full URL
https://dbac8a2e962120c65098-4d6abce208e5e17c2085b466b98c2083.ssl.cf1.rackcdn.com/javascript-blockchain-technologies-you-cant-ignore-pdf-4-w-4323.jpg
Requested by
Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/chinese-apt-group-uses-new-tradecraft-to-live-off-land-a-22379
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
184.30.16.143 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-30-16-143.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
bbbd7bccd313fafa0275f24bb6c30268a0f26f668894cf2ac68a664d95a962f6

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.bankinfosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Tue, 27 Jun 2023 02:10:39 GMT
Last-Modified
Thu, 10 May 2018 20:39:34 GMT
ETag
a1abea62e815280443173bebee773666
Content-Type
image/jpeg
X-Timestamp
1525984773.18562
Cache-Control
public, max-age=26981
Connection
keep-alive
Accept-Ranges
bytes
X-Trans-Id
tx4ceaaeab58284b53aa686-0064927e40dfw1
Content-Length
247335
Expires
Tue, 27 Jun 2023 09:40:20 GMT
assessing-cyber-risk-for-defense-industrial-base-pdf-4-w-9027.jpg
dbac8a2e962120c65098-4d6abce208e5e17c2085b466b98c2083.ssl.cf1.rackcdn.com/
310 KB
310 KB
Image
General
Full URL
https://dbac8a2e962120c65098-4d6abce208e5e17c2085b466b98c2083.ssl.cf1.rackcdn.com/assessing-cyber-risk-for-defense-industrial-base-pdf-4-w-9027.jpg
Requested by
Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/chinese-apt-group-uses-new-tradecraft-to-live-off-land-a-22379
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
184.30.16.143 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-30-16-143.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
77dae683f322fee272645ec8bf91c9299fe571556138c282f6d7e8cf88a2b2d2

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.bankinfosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Tue, 27 Jun 2023 02:10:39 GMT
Last-Modified
Mon, 11 Oct 2021 20:08:44 GMT
ETag
3b6616f2ff7d19a030ac6326b587eee9
Content-Type
image/jpeg
X-Timestamp
1633982923.08285
Cache-Control
public, max-age=71731
Connection
keep-alive
Accept-Ranges
bytes
X-Trans-Id
tx230adb1f1a674cf884756-006497964fdfw1
Content-Length
317025
Expires
Tue, 27 Jun 2023 22:06:10 GMT
24-year-old-british-man-sentenced-to-5-years-in-twitter-hack-showcase_image-3-a-22376.jpg
130e178e8f8ba617604b-8aedd782b7d22cfe0d1146da69a52436.ssl.cf1.rackcdn.com/
37 KB
37 KB
Image
General
Full URL
https://130e178e8f8ba617604b-8aedd782b7d22cfe0d1146da69a52436.ssl.cf1.rackcdn.com/24-year-old-british-man-sentenced-to-5-years-in-twitter-hack-showcase_image-3-a-22376.jpg
Requested by
Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/chinese-apt-group-uses-new-tradecraft-to-live-off-land-a-22379
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
184.30.16.143 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-30-16-143.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
ce962b78a26656883501635849e98206497e3b18620d8e33b2e1f804e0397cf1

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.bankinfosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Tue, 27 Jun 2023 02:10:40 GMT
Last-Modified
Mon, 26 Jun 2023 16:50:59 GMT
ETag
c006c369ffc2669e23cee92dc0b308bd
Content-Type
image/jpeg
X-Timestamp
1687798258.73640
Cache-Control
public, max-age=58755
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
37444
X-Trans-Id
tx59bdd3aa77e64b4db927f-006499d977dfw1
Expires
Tue, 27 Jun 2023 18:29:55 GMT
are-we-facing-massive-cybersecurity-threat-showcase_image-5-i-5258.jpg
0267f973c7f511eda6a4-193e28812cee85d6e20ea22afb83e185.ssl.cf1.rackcdn.com/
191 KB
192 KB
Image
General
Full URL
https://0267f973c7f511eda6a4-193e28812cee85d6e20ea22afb83e185.ssl.cf1.rackcdn.com/are-we-facing-massive-cybersecurity-threat-showcase_image-5-i-5258.jpg
Requested by
Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/chinese-apt-group-uses-new-tradecraft-to-live-off-land-a-22379
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
184.30.16.143 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-30-16-143.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
35ea875420833eea83b7015a613753400af890484415c3341e0c3b6a595412a5

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.bankinfosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Tue, 27 Jun 2023 02:10:40 GMT
Last-Modified
Thu, 01 Jun 2023 16:37:58 GMT
ETag
6918fd3478d86b41d1952cd2f9d7a3b2
Content-Type
image/jpeg
X-Timestamp
1685637477.02271
Cache-Control
public, max-age=24830
Connection
keep-alive
Accept-Ranges
bytes
X-Trans-Id
tx089b6b0d9a214356a1a80-00648e7bfedfw1
Content-Length
195801
Expires
Tue, 27 Jun 2023 09:04:30 GMT
website-tracking-tools-top-privacy-considerations-showcase_image-10-i-5256.jpg
0267f973c7f511eda6a4-193e28812cee85d6e20ea22afb83e185.ssl.cf1.rackcdn.com/
79 KB
80 KB
Image
General
Full URL
https://0267f973c7f511eda6a4-193e28812cee85d6e20ea22afb83e185.ssl.cf1.rackcdn.com/website-tracking-tools-top-privacy-considerations-showcase_image-10-i-5256.jpg
Requested by
Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/chinese-apt-group-uses-new-tradecraft-to-live-off-land-a-22379
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
184.30.16.143 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-30-16-143.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
63a825f068607162b35a5133415c146f7865b3436a8a67d96ed3c547ec8e58b6

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.bankinfosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Tue, 27 Jun 2023 02:10:40 GMT
Last-Modified
Fri, 26 May 2023 18:06:27 GMT
ETag
1dbdc3224639b692862c62107d39b95b
Content-Type
image/jpeg
X-Timestamp
1685124386.06052
Cache-Control
public, max-age=34015
Connection
keep-alive
Accept-Ranges
bytes
X-Trans-Id
tx5a1d332522af4fe69dac8-00647821b5dfw1
Content-Length
81033
Expires
Tue, 27 Jun 2023 11:37:35 GMT
cyber-defenders-need-partnerships-tools-education-showcase_image-6-i-5259.jpg
0267f973c7f511eda6a4-193e28812cee85d6e20ea22afb83e185.ssl.cf1.rackcdn.com/
47 KB
48 KB
Image
General
Full URL
https://0267f973c7f511eda6a4-193e28812cee85d6e20ea22afb83e185.ssl.cf1.rackcdn.com/cyber-defenders-need-partnerships-tools-education-showcase_image-6-i-5259.jpg
Requested by
Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/chinese-apt-group-uses-new-tradecraft-to-live-off-land-a-22379
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
184.30.16.143 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-30-16-143.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
02b4c1e0e73903f2145529f409eebc12aa3a2d82ea394efa3ef087cf8f1b4ba5

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.bankinfosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Tue, 27 Jun 2023 02:10:40 GMT
Last-Modified
Mon, 05 Jun 2023 19:04:52 GMT
ETag
9a16b2098d9eda930c419e49e221ea95
Content-Type
image/jpeg
X-Timestamp
1685991891.95318
Cache-Control
public, max-age=46900
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
48428
X-Trans-Id
txbd467ed81a724f75a5ff5-00647e3640dfw1
Expires
Tue, 27 Jun 2023 15:12:20 GMT
whats-inside-washington-states-new-my-health-my-data-act-showcase_image-5-i-5254.jpg
0267f973c7f511eda6a4-193e28812cee85d6e20ea22afb83e185.ssl.cf1.rackcdn.com/
60 KB
60 KB
Image
General
Full URL
https://0267f973c7f511eda6a4-193e28812cee85d6e20ea22afb83e185.ssl.cf1.rackcdn.com/whats-inside-washington-states-new-my-health-my-data-act-showcase_image-5-i-5254.jpg
Requested by
Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/chinese-apt-group-uses-new-tradecraft-to-live-off-land-a-22379
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
184.30.16.143 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-30-16-143.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
123e7ddaacd2b7b4bb165ab3c29869973933e5f4debaae247da11522fe85398a

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.bankinfosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Tue, 27 Jun 2023 02:10:40 GMT
Last-Modified
Mon, 15 May 2023 17:29:22 GMT
ETag
f886912620ca009630c7cecf77a50009
Content-Type
image/jpeg
X-Timestamp
1684171761.09328
Cache-Control
public, max-age=62653
Connection
keep-alive
Accept-Ranges
bytes
X-Trans-Id
tx2f796d42effd414dac4e2-006476db17dfw1
Content-Length
61245
Expires
Tue, 27 Jun 2023 19:34:53 GMT
integrating-generative-ai-into-threat-detection-process-showcase_image-4-i-5257.jpg
0267f973c7f511eda6a4-193e28812cee85d6e20ea22afb83e185.ssl.cf1.rackcdn.com/
74 KB
74 KB
Image
General
Full URL
https://0267f973c7f511eda6a4-193e28812cee85d6e20ea22afb83e185.ssl.cf1.rackcdn.com/integrating-generative-ai-into-threat-detection-process-showcase_image-4-i-5257.jpg
Requested by
Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/chinese-apt-group-uses-new-tradecraft-to-live-off-land-a-22379
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
184.30.16.143 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-30-16-143.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
046f0918fc9faeb5cce32d33a94180b8032db60619642eac71db41bcb3bff6e0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.bankinfosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Tue, 27 Jun 2023 02:10:40 GMT
Last-Modified
Wed, 31 May 2023 14:24:10 GMT
ETag
7e3f4160de238051f35e0c7297844844
Content-Type
image/jpeg
X-Timestamp
1685543049.83676
Cache-Control
public, max-age=68693
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
75373
X-Trans-Id
txaad727ddb33d460eb30dd-006477727fdfw1
Expires
Tue, 27 Jun 2023 21:15:33 GMT
cyberark-ceo-matt-cohen-showcase_image-4-i-5255.jpg
0267f973c7f511eda6a4-193e28812cee85d6e20ea22afb83e185.ssl.cf1.rackcdn.com/
115 KB
115 KB
Image
General
Full URL
https://0267f973c7f511eda6a4-193e28812cee85d6e20ea22afb83e185.ssl.cf1.rackcdn.com/cyberark-ceo-matt-cohen-showcase_image-4-i-5255.jpg
Requested by
Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/chinese-apt-group-uses-new-tradecraft-to-live-off-land-a-22379
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
184.30.16.143 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-30-16-143.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
d3189a856ca159c541b0e2eeace2c9b5a9f6611fd6433d827828375a07e4c958

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.bankinfosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Tue, 27 Jun 2023 02:10:40 GMT
Last-Modified
Wed, 24 May 2023 18:39:26 GMT
ETag
57765e4d36902763f8ce94ac01cc1de0
Content-Type
image/jpeg
X-Timestamp
1684953565.76267
Cache-Control
public, max-age=24901
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
117785
X-Trans-Id
txd875d4c0e62d414da2a40-00646e8167dfw1
Expires
Tue, 27 Jun 2023 09:05:41 GMT
logo-ismg-with-text.png
www.bankinfosecurity.com/images-responsive/
4 KB
4 KB
Image
General
Full URL
https://www.bankinfosecurity.com/images-responsive/logo-ismg-with-text.png
Requested by
Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/chinese-apt-group-uses-new-tradecraft-to-live-off-land-a-22379
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
50.56.167.254 , United States, ASN33070 (RMH-14, US),
Reverse DNS
Software
Apache /
Resource Hash
4e2db1bef009e01901b4083a153f1607301428277a76f508e659dc2849cefa04
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.bankinfosecurity.com/chinese-apt-group-uses-new-tradecraft-to-live-off-land-a-22379
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Tue, 27 Jun 2023 02:10:40 GMT
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
Content-Encoding
gzip
Server
Apache
Vary
Accept-Encoding
Content-Type
image/png
Cache-Control
max-age=86400, private, must-revalidate
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=96
Content-Length
4175
logo-ismg-print.png
www.bankinfosecurity.com/images-responsive/
5 KB
6 KB
Image
General
Full URL
https://www.bankinfosecurity.com/images-responsive/logo-ismg-print.png
Requested by
Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/chinese-apt-group-uses-new-tradecraft-to-live-off-land-a-22379
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
50.56.167.254 , United States, ASN33070 (RMH-14, US),
Reverse DNS
Software
Apache /
Resource Hash
5133e2e1a213ca44a8adb1f42f103a2d2e495849dfa4d42bf67c04fcc962e577
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.bankinfosecurity.com/chinese-apt-group-uses-new-tradecraft-to-live-off-land-a-22379
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Tue, 27 Jun 2023 02:10:40 GMT
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
Content-Encoding
gzip
Server
Apache
Vary
Accept-Encoding
Content-Type
image/png
Cache-Control
max-age=86400, private, must-revalidate
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=97
Content-Length
5598
ondemand-preview-w-255.jpg
f5bd7c2823d8d0533dcb-62d55445ed2ff88556926faa498f48fa.ssl.cf1.rackcdn.com/
56 KB
57 KB
Image
General
Full URL
https://f5bd7c2823d8d0533dcb-62d55445ed2ff88556926faa498f48fa.ssl.cf1.rackcdn.com/ondemand-preview-w-255.jpg
Requested by
Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/chinese-apt-group-uses-new-tradecraft-to-live-off-land-a-22379
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
184.30.16.143 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-30-16-143.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
3059f92e36a564c5cbcedc195f764e3c55c8cf919c84129c5f202870e7026b61

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.bankinfosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Tue, 27 Jun 2023 02:10:40 GMT
Last-Modified
Fri, 05 Jul 2013 12:55:26 GMT
ETag
7aece0902995efedc289b7c24037434b
Content-Type
image/jpeg
X-Timestamp
1373028925.94439
Cache-Control
public, max-age=539
Connection
keep-alive
Accept-Ranges
bytes
X-Trans-Id
tx9bb28d7c36d94a9dbea83-00649a43b7dfw1
Content-Length
57633
Expires
Tue, 27 Jun 2023 02:19:39 GMT
ron-ross-smallImage-a-558.jpg
6d63d49ccb7c52435540-5070aa97eaa2b8df4eb5a91600e69901.ssl.cf1.rackcdn.com/
10 KB
11 KB
Image
General
Full URL
https://6d63d49ccb7c52435540-5070aa97eaa2b8df4eb5a91600e69901.ssl.cf1.rackcdn.com/ron-ross-smallImage-a-558.jpg
Requested by
Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/chinese-apt-group-uses-new-tradecraft-to-live-off-land-a-22379
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
184.30.16.143 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-30-16-143.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
9c8bb391a723e088d163b560afa73f709c42a69df5647c4fefce9d16e4226895

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.bankinfosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Tue, 27 Jun 2023 02:10:40 GMT
Last-Modified
Fri, 01 Nov 2013 13:09:25 GMT
ETag
fac8c56390d084c4f1dfaa9b24a58c33
Content-Type
image/jpeg
X-Timestamp
1383311364.81114
Cache-Control
public, max-age=16961
Connection
keep-alive
Accept-Ranges
bytes
X-Trans-Id
tx74d0de8a7d9248fca2ad9-00646854d5dfw1
Content-Length
10640
Expires
Tue, 27 Jun 2023 06:53:21 GMT
main.js
www.bankinfosecurity.com/javascripts-responsive/
44 KB
10 KB
Script
General
Full URL
https://www.bankinfosecurity.com/javascripts-responsive/main.js?s=1687831838.6541
Requested by
Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/chinese-apt-group-uses-new-tradecraft-to-live-off-land-a-22379
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
50.56.167.254 , United States, ASN33070 (RMH-14, US),
Reverse DNS
Software
Apache /
Resource Hash
b48e375595153df77fb7e7c5cc839ab093064ba54ce5fbea202855d99819c963
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.bankinfosecurity.com/chinese-apt-group-uses-new-tradecraft-to-live-off-land-a-22379
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Tue, 27 Jun 2023 02:10:39 GMT
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
Content-Encoding
gzip
Server
Apache
Vary
Accept-Encoding
Content-Type
application/javascript
Cache-Control
max-age=86400, private, must-revalidate
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=95
Content-Length
10288
media-transcript-navigation.js
www.bankinfosecurity.com/javascripts-responsive/
26 KB
7 KB
Script
General
Full URL
https://www.bankinfosecurity.com/javascripts-responsive/media-transcript-navigation.js?s=1687831838.6541
Requested by
Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/chinese-apt-group-uses-new-tradecraft-to-live-off-land-a-22379
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
50.56.167.254 , United States, ASN33070 (RMH-14, US),
Reverse DNS
Software
Apache /
Resource Hash
ae3c472ff47a96820c1acdf9574b231a88f62a006b84d320eb313af40f32f2db
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.bankinfosecurity.com/chinese-apt-group-uses-new-tradecraft-to-live-off-land-a-22379
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Tue, 27 Jun 2023 02:10:39 GMT
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
Content-Encoding
gzip
Server
Apache
Vary
Accept-Encoding
Content-Type
application/javascript
Cache-Control
max-age=86400, private, must-revalidate
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=98
Content-Length
6519
bis-hdr.r1.js
www.bankinfosecurity.com/javascripts-responsive/
1 KB
839 B
Script
General
Full URL
https://www.bankinfosecurity.com/javascripts-responsive/bis-hdr.r1.js?s=1687831838.6541
Requested by
Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/chinese-apt-group-uses-new-tradecraft-to-live-off-land-a-22379
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
50.56.167.254 , United States, ASN33070 (RMH-14, US),
Reverse DNS
Software
Apache /
Resource Hash
4c92262ff23b2116bad93fc1e36f1a597dc713ad8b3cd03d56f8e49bec4cb186
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.bankinfosecurity.com/chinese-apt-group-uses-new-tradecraft-to-live-off-land-a-22379
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Tue, 27 Jun 2023 02:10:39 GMT
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
Content-Encoding
gzip
Server
Apache
Vary
Accept-Encoding
Content-Type
application/javascript
Cache-Control
max-age=86400, private, must-revalidate
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=94
Content-Length
455
jquery.browser.js
www.bankinfosecurity.com/javascripts-responsive/
2 KB
1 KB
Script
General
Full URL
https://www.bankinfosecurity.com/javascripts-responsive/jquery.browser.js
Requested by
Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/chinese-apt-group-uses-new-tradecraft-to-live-off-land-a-22379
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
50.56.167.254 , United States, ASN33070 (RMH-14, US),
Reverse DNS
Software
Apache /
Resource Hash
bbe0aa82dca8a36f677fb17025c3baa011d355bd7cb42d4aacea1b0265855d6e
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.bankinfosecurity.com/chinese-apt-group-uses-new-tradecraft-to-live-off-land-a-22379
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Tue, 27 Jun 2023 02:10:39 GMT
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
Content-Encoding
gzip
Server
Apache
Vary
Accept-Encoding
Content-Type
application/javascript
Cache-Control
max-age=86400, private, must-revalidate
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=96
Content-Length
1022
jquery.prettyPhoto.js
www.bankinfosecurity.com/javascripts-responsive/
24 KB
7 KB
Script
General
Full URL
https://www.bankinfosecurity.com/javascripts-responsive/jquery.prettyPhoto.js
Requested by
Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/chinese-apt-group-uses-new-tradecraft-to-live-off-land-a-22379
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
50.56.167.254 , United States, ASN33070 (RMH-14, US),
Reverse DNS
Software
Apache /
Resource Hash
1edbdbe7dd4c59e2fef20ef8dc4615a18d116fdf43daf018dce46a93e6cb153e
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.bankinfosecurity.com/chinese-apt-group-uses-new-tradecraft-to-live-off-land-a-22379
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Tue, 27 Jun 2023 02:10:39 GMT
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
Content-Encoding
gzip
Server
Apache
Vary
Accept-Encoding
Content-Type
application/javascript
Cache-Control
max-age=86400, private, must-revalidate
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=97
Content-Length
6459
ismg-user-ip
worker.ismgcorp.com/
12 B
195 B
XHR
General
Full URL
https://worker.ismgcorp.com/ismg-user-ip
Requested by
Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/javascripts-responsive/vendor/jquery.min.js?s=1687831838.6541
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.130.251.6 , United States, ASN33070 (RMH-14, US),
Reverse DNS
Software
Apache /
Resource Hash
39520329caed7b6cd60a945da725e448a17fdd7a19975c94ee724a97d4da2b5e

Request headers

Accept
*/*
Referer
https://www.bankinfosecurity.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 27 Jun 2023 02:10:40 GMT
content-encoding
gzip
server
Apache
vary
Accept-Encoding
content-type
text/html; charset=UTF-8
access-control-allow-origin
*
cache-control
no-cache, private
content-length
29
gpt.js
www.googletagservices.com/tag/js/
78 KB
26 KB
Script
General
Full URL
https://www.googletagservices.com/tag/js/gpt.js
Requested by
Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/chinese-apt-group-uses-new-tradecraft-to-live-off-land-a-22379
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
02c252c05ac201f6546a542fdd0b40545de727710fd8544f807bb35cbaf89f32
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.bankinfosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 27 Jun 2023 02:10:40 GMT
content-encoding
br
x-content-type-options
nosniff
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
26663
x-xss-protection
0
server
cafe
etag
175 / 19535 / 31075684 / config-hash: 11975207651237578680
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=900, stale-while-revalidate=3600
timing-allow-origin
*
expires
Tue, 27 Jun 2023 02:10:40 GMT
munchkin.js
munchkin.marketo.net/
1 KB
1 KB
Script
General
Full URL
https://munchkin.marketo.net/munchkin.js
Requested by
Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/javascripts-responsive/vendor/jquery.min.js?s=1687831838.6541
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
23.206.100.200 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-206-100-200.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
5206536707c84baa892d3c3231b351985ee828cb8b9c0bd8db42cd3363995fc4

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.bankinfosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Tue, 27 Jun 2023 02:10:40 GMT
Content-Encoding
gzip
Last-Modified
Fri, 17 Mar 2023 01:24:48 GMT
Server
AkamaiNetStorage
ETag
"cb731cc5c2bd9f31d6bfeb19f3c8b1ff:1679016288.730763"
Vary
Accept-Encoding
P3P
policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR"
Content-Type
application/x-javascript
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
729
gtm.js
www.googletagmanager.com/
136 KB
47 KB
Script
General
Full URL
https://www.googletagmanager.com/gtm.js?id=GTM-T6KM3T
Requested by
Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/chinese-apt-group-uses-new-tradecraft-to-live-off-land-a-22379
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:829::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
467b38388a35d30f0361f72edd912b6ee3aa04228029fead621acbe6474e8d45
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.bankinfosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 27 Jun 2023 02:10:40 GMT
content-encoding
br
strict-transport-security
max-age=31536000; includeSubDomains
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
48472
x-xss-protection
0
last-modified
Tue, 27 Jun 2023 00:00:00 GMT
server
Google Tag Manager
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Tue, 27 Jun 2023 02:10:40 GMT
gtm.js
www.googletagmanager.com/
105 KB
41 KB
Script
General
Full URL
https://www.googletagmanager.com/gtm.js?id=GTM-T8C2JFW
Requested by
Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/chinese-apt-group-uses-new-tradecraft-to-live-off-land-a-22379
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:829::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
688bce9fb39e5f6d65058eaa253c7d39523a966d578ae1e382b4f7e5b3a8a519
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.bankinfosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 27 Jun 2023 02:10:40 GMT
content-encoding
br
strict-transport-security
max-age=31536000; includeSubDomains
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
41958
x-xss-protection
0
last-modified
Tue, 27 Jun 2023 00:00:00 GMT
server
Google Tag Manager
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Tue, 27 Jun 2023 02:10:40 GMT
memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2
fonts.gstatic.com/s/opensans/v35/
47 KB
48 KB
Font
General
Full URL
https://fonts.gstatic.com/s/opensans/v35/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Open+Sans:300italic,400italic,600italic,700italic,800italic,400,300,600,700,800
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:806::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
7c7818c25a18e8a38553fcbcbc2ad0b5e964103a7d2e494f82815e3f70bf3fc5
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://www.bankinfosecurity.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Sat, 24 Jun 2023 00:21:44 GMT
x-content-type-options
nosniff
age
265735
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
48412
x-xss-protection
0
last-modified
Tue, 02 May 2023 15:08:53 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Sun, 23 Jun 2024 00:21:44 GMT
fontawesome-webfont.woff
www.bankinfosecurity.com/css-responsive/fonts/
43 KB
44 KB
Font
General
Full URL
https://www.bankinfosecurity.com/css-responsive/fonts/fontawesome-webfont.woff?v=4.2.0
Requested by
Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/css-responsive/vendor/font-awesome.min.css?s=1687831838.6541
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
50.56.167.254 , United States, ASN33070 (RMH-14, US),
Reverse DNS
Software
Apache /
Resource Hash
0fd28fece9ebd606b8b071460ebd3fc2ed7bc7a66ef91c8834f11dfacab4a849
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

Referer
https://www.bankinfosecurity.com/css-responsive/vendor/font-awesome.min.css?s=1687831838.6541
Origin
https://www.bankinfosecurity.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Tue, 27 Jun 2023 02:10:39 GMT
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
Last-Modified
Mon, 26 Jun 2023 14:53:59 GMT
Server
Apache
ETag
"ad90-5ff098548b6a1"
Content-Type
application/font-woff
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=97
Content-Length
44432
serverComponent.php
nexus.ensighten.com/choozle/12567/
279 B
587 B
Script
General
Full URL
https://nexus.ensighten.com/choozle/12567/serverComponent.php?r=989212.3463813569&namespace=Bootstrapper&staticJsPath=nexus.ensighten.com/choozle/12567/code/&publishedOn=Mon%20Mar%2001%2015:40:45%20GMT%202021&ClientID=923&PageID=https%3A%2F%2Fwww.bankinfosecurity.com%2Fchinese-apt-group-uses-new-tradecraft-to-live-off-land-a-22379
Requested by
Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/choozle/12567/Bootstrap.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
65.9.66.72 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-65-9-66-72.fra56.r.cloudfront.net
Software
CloudFront /
Resource Hash
dd4805f260848c27bc7e43fc3a7c828986da4f0611a7926b23b08ac7f3af0086

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.bankinfosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 27 Jun 2023 02:10:39 GMT
via
1.1 b3dc72c60418e8887de31f772538f118.cloudfront.net (CloudFront)
server
CloudFront
x-amz-cf-pop
FRA56-C1
x-cache
Miss from cloudfront
content-type
text/javascript
cache-control
no-cache, no-store
content-length
279
x-amz-cf-id
Iz3AV1hWVC-rMjC_dE8ULaD2B34wtAqEMiwV7ER1Fzqq003nf8z5pQ==
expires
Tue, 27 Jun 2023 02:10:38 GMT
memtYaGs126MiZpBA-UFUIcVXSCEkx2cmqvXlWqWuU6F.woff2
fonts.gstatic.com/s/opensans/v35/
49 KB
49 KB
Font
General
Full URL
https://fonts.gstatic.com/s/opensans/v35/memtYaGs126MiZpBA-UFUIcVXSCEkx2cmqvXlWqWuU6F.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Open+Sans:300italic,400italic,600italic,700italic,800italic,400,300,600,700,800
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:806::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
3642c7e774562f7483d7b0de93dd1759fc6928e85eebd7e62ddae72e9d46c9cb
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://www.bankinfosecurity.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Sat, 24 Jun 2023 12:23:10 GMT
x-content-type-options
nosniff
age
222449
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
50440
x-xss-protection
0
last-modified
Tue, 02 May 2023 15:13:42 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Sun, 23 Jun 2024 12:23:10 GMT
ondemand-preview-w-255.mp4
f5bd7c2823d8d0533dcb-62d55445ed2ff88556926faa498f48fa.ssl.cf1.rackcdn.com/
992 KB
0
Media
General
Full URL
https://f5bd7c2823d8d0533dcb-62d55445ed2ff88556926faa498f48fa.ssl.cf1.rackcdn.com/ondemand-preview-w-255.mp4
Requested by
Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/chinese-apt-group-uses-new-tradecraft-to-live-off-land-a-22379
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
184.30.16.143 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-30-16-143.deploy.static.akamaitechnologies.com
Software
/
Resource Hash

Request headers

Referer
https://www.bankinfosecurity.com/
Accept-Encoding
identity;q=1, *;q=0
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Range
bytes=0-

Response headers

Date
Tue, 27 Jun 2023 02:10:39 GMT
Last-Modified
Fri, 05 Jul 2013 12:56:36 GMT
ETag
e5d65b36cc2f1ee7de6cc53cd6609280
Content-Type
video/mp4
Content-Range
bytes 0-10621769/10621770
X-Timestamp
1373028995.98411
Cache-Control
public, max-age=368
Connection
keep-alive
Accept-Ranges
bytes
X-Trans-Id
txd91cbe944b6148b48e7e4-006498a804dfw1
Content-Length
10621770
Expires
Tue, 27 Jun 2023 02:16:47 GMT
7e3bcccbe9be6061a65a6eb142929580.js
nexus.ensighten.com/choozle/12567/code/
2 KB
846 B
Script
General
Full URL
https://nexus.ensighten.com/choozle/12567/code/7e3bcccbe9be6061a65a6eb142929580.js?conditionId0=421905
Requested by
Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/choozle/12567/Bootstrap.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
65.9.66.72 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-65-9-66-72.fra56.r.cloudfront.net
Software
CloudFront /
Resource Hash
9186ad0839410bf3d20f3c5b242b36027562baac85ffb8cba18b50b6e4d7945d

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.bankinfosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Sun, 26 Mar 2023 05:56:44 GMT
x-amz-version-id
vDzooJCM9ZF5stJjlIBLRuP6nw5SaTlz
content-encoding
gzip
via
1.1 b3dc72c60418e8887de31f772538f118.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA56-C1
age
8021635
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
x-amz-replication-status
COMPLETED
last-modified
Thu, 12 Aug 2021 16:05:52 GMT
server
CloudFront
etag
W/"45d815f98cb1ba2123f41b1c2cacac1e"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
cache-control
max-age=315360000
x-amz-cf-id
F3WypKInKsUVBZc3D8pTWBEsG_9QGhkl1V_wh8dgc_YY5hZpw_Kj3g==
64270ee65d783b00125f1b83.js
buttons-config.sharethis.com/js/
521 B
967 B
Script
General
Full URL
https://buttons-config.sharethis.com/js/64270ee65d783b00125f1b83.js
Requested by
Host: platform-api.sharethis.com
URL: https://platform-api.sharethis.com/js/sharethis.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:26da:200:c:abe:f440:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
5983be7036fc26270495fd1a318795ac3538b9e8e8a34dff25685a3e4fbe3858
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.bankinfosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 27 Jun 2023 02:10:40 GMT
via
1.1 42dac3d09c367576dbfe5b6113ecddce.cloudfront.net (CloudFront)
strict-transport-security
max-age=31536000; includeSubDomains
x-amz-cf-pop
MUC50-P4
age
19
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
content-length
521
last-modified
Fri, 31 Mar 2023 17:48:50 GMT
server
AmazonS3
etag
"b1b92dd067a349c8db8fab212b24e99e"
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=60
accept-ranges
bytes
x-amz-cf-id
eTfLNtlKCAfJ-SNjgqCbZ3wguJ9aA3L49a6DFpNvdkh5tg9EKuhklA==
pview
l.sharethis.com/
0
411 B
XHR
General
Full URL
https://l.sharethis.com/pview?event=pview&hostname=www.bankinfosecurity.com&location=%2Fchinese-apt-group-uses-new-tradecraft-to-live-off-land-a-22379&product=inline-share-buttons&url=https%3A%2F%2Fwww.bankinfosecurity.com%2Fchinese-apt-group-uses-new-tradecraft-to-live-off-land-a-22379&source=platform&fcmp=false&fcmpv2=false&has_segmentio=false&title=Chinese%20APT%20Group%20Uses%20New%20Tradecraft%20to%20Live%20Off%20the%20Land&cms=unknown&publisher=64270ee65d783b00125f1b83&sop=true&version=st_sop.js&lang=en&description=A%20Chinese%20state%20hacker%20is%20using%20novel%20tradecraft%20to%20gain%20initial%20access%20to%20victim%20systems%2C%20according%20to%20CrowdStrike.%20Targeted%20organizations%20include%20those%20in%20the&ua=&ua_mobile=false&ua_full_version_list=
Requested by
Host: platform-api.sharethis.com
URL: https://platform-api.sharethis.com/js/sharethis.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.158.33.255 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-35-158-33-255.eu-central-1.compute.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains;

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.bankinfosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Tue, 27 Jun 2023 02:10:40 GMT
Strict-Transport-Security
max-age=63072000; includeSubDomains;
Access-Control-Max-Age
1728000
Access-Control-Allow-Origin
https://www.bankinfosecurity.com
Access-Control-Expose-Headers
stid
Cache-Control
no-cache, no-store, must-revalidate
Access-Control-Allow-Credentials
true
Connection
keep-alive
Access-Control-Allow-Headers
*
embed.js
bankinfosecurity.disqus.com/
78 KB
25 KB
Script
General
Full URL
https://bankinfosecurity.disqus.com/embed.js
Requested by
Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/chinese-apt-group-uses-new-tradecraft-to-live-off-land-a-22379
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
199.232.192.134 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
openresty /
Resource Hash
97e5d742b8ab51088f7168580fdfaffe91ce99d5c16dfde19b12e3d6259262b2
Security Headers
Name Value
Strict-Transport-Security max-age=300; includeSubdomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.bankinfosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Tue, 27 Jun 2023 02:10:40 GMT
Content-Encoding
gzip
Strict-Transport-Security
max-age=300; includeSubdomains
Server
openresty
Age
15
Vary
Accept-Encoding
Content-Type
application/javascript; charset=utf-8
Cache-Control
private, max-age=60
X-Service
router
Cross-Origin-Resource-Policy
cross-origin
Connection
keep-alive
Link
<https://disqus.com>; rel=preconnect, <https://c.disquscdn.com>; rel=preconnect
Content-Length
25397
analytics.js
www.google-analytics.com/
52 KB
21 KB
Script
General
Full URL
https://www.google-analytics.com/analytics.js
Requested by
Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/chinese-apt-group-uses-new-tradecraft-to-live-off-land-a-22379
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:811::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.bankinfosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
date
Tue, 27 Jun 2023 00:35:22 GMT
last-modified
Mon, 12 Jun 2023 18:23:07 GMT
server
Golfe2
age
5718
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=7200
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
20994
expires
Tue, 27 Jun 2023 02:35:22 GMT
tag.aspx
ml314.com/
31 KB
11 KB
Script
General
Full URL
https://ml314.com/tag.aspx?2752023
Requested by
Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/chinese-apt-group-uses-new-tradecraft-to-live-off-land-a-22379
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.111.234.236 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
236.234.111.34.bc.googleusercontent.com
Software
UploadServer /
Resource Hash
23f95a90d6e6ba09a92bd4eae99823b0a6b0137a9abe10e3c050c062fb15efe4

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.bankinfosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 27 Jun 2023 01:38:13 GMT
content-encoding
br
age
1947
x-guploader-uploadid
ADPycdtrWB5gWmXKRM0Irh0KGo94auHDW3OrpX87RR1vnu48raqqlPcGnAmmFlJ4KYvvP6eFAUrpslIBvM1Rdyu-GM1efA
x-goog-storage-class
STANDARD
x-goog-metageneration
1
x-goog-stored-content-encoding
identity
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
10527
last-modified
Mon, 10 Apr 2023 17:13:24 GMT
server
UploadServer
etag
W/"b0965f051977c0dd95ffe2c736cac352"
vary
Accept-Encoding
x-goog-generation
1681146804366265
x-goog-hash
crc32c=wVdAwA==, md5=sJZfBRl3wN2V/+LHNsrDUg==
content-type
application/javascript
cache-id
AMS-cba56054
cache-control
public,max-age=3600
x-cache-hit
hit
x-goog-stored-content-length
32213
accept-ranges
none
insight.min.js
sjs.bizographics.com/
1 KB
772 B
Script
General
Full URL
https://sjs.bizographics.com/insight.min.js
Requested by
Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/chinese-apt-group-uses-new-tradecraft-to-live-off-land-a-22379
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:3100::1735:28c0 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
42c9d1df23e2f7d82d90b2bd6bab3b5398e81889cb9bde1d4a530acc663c9c63
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.bankinfosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 27 Jun 2023 02:10:40 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Mon, 26 Jun 2023 17:35:57 GMT
x-cdn
AKAM
x-amz-server-side-encryption
AES256
vary
Accept-Encoding
content-type
application/x-javascript;charset=utf-8
cache-control
max-age=55557
accept-ranges
bytes
content-length
560
insight.min.js
snap.licdn.com/li.lms-analytics/
1 KB
772 B
Script
General
Full URL
https://snap.licdn.com/li.lms-analytics/insight.min.js
Requested by
Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/chinese-apt-group-uses-new-tradecraft-to-live-off-land-a-22379
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:3100::1735:28a8 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
42c9d1df23e2f7d82d90b2bd6bab3b5398e81889cb9bde1d4a530acc663c9c63
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.bankinfosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 27 Jun 2023 02:10:40 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Mon, 26 Jun 2023 17:35:57 GMT
x-cdn
AKAM
x-amz-server-side-encryption
AES256
vary
Accept-Encoding
content-type
application/x-javascript;charset=utf-8
cache-control
max-age=55619
accept-ranges
bytes
content-length
560
6si.min.js
j.6sc.co/
35 KB
11 KB
Script
General
Full URL
https://j.6sc.co/6si.min.js
Requested by
Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/chinese-apt-group-uses-new-tradecraft-to-live-off-land-a-22379
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.17.100.184 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a2-17-100-184.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
4aec96eddab69454e554bb60664da2e5043c363ebef6921644f619523e7274d7
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.bankinfosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 27 Jun 2023 02:10:40 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Wed, 17 May 2023 00:27:16 GMT
server
nginx/1.14.0 (Ubuntu)
etag
"64641f64-8a3f"
vary
Accept-Encoding
content-type
application/javascript
cache-control
private, no-cache, proxy-revalidate
accept-ranges
bytes
content-length
11052
expires
Tue, 27 Jun 2023 02:10:40 GMT
ajax.php
www.bankinfosecurity.com/
4 KB
1 KB
XHR
General
Full URL
https://www.bankinfosecurity.com/ajax.php?json=twitterWidget
Requested by
Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/javascripts-responsive/vendor/jquery.min.js?s=1687831838.6541
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
50.56.167.254 , United States, ASN33070 (RMH-14, US),
Reverse DNS
Software
Apache /
Resource Hash
0284b9bfe4f14587be4717e5cd330029477c991add2232945c5a7e15b7d0699b

Request headers

Accept
text/html, */*; q=0.01
Referer
https://www.bankinfosecurity.com/chinese-apt-group-uses-new-tradecraft-to-live-off-land-a-22379
X-Requested-With
XMLHttpRequest
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 27 Jun 2023 02:10:40 GMT
Content-Encoding
gzip
Server
Apache
Vary
Accept-Encoding
Transfer-Encoding
chunked
Content-Type
text/html; charset=UTF-8
Cache-Control
no-store, no-cache, must-revalidate
Connection
Keep-Alive
Keep-Alive
timeout=5, max=96
Expires
Thu, 19 Nov 1981 08:52:00 GMT
2682.js
dnn506yrbagrg.cloudfront.net/pages/scripts/0021/
309 B
821 B
Script
General
Full URL
https://dnn506yrbagrg.cloudfront.net/pages/scripts/0021/2682.js?468842
Requested by
Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/chinese-apt-group-uses-new-tradecraft-to-live-off-land-a-22379
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
13.32.23.57 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-32-23-57.fra56.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
6caf904d3dfc096ae3b4e40aed43181686bdf1bac4722b3dd2a775ab6d2a9992

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.bankinfosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Mon, 15 May 2023 01:12:40 GMT
Via
1.1 f891d17fa862cc74a05434e03fa58dca.cloudfront.net (CloudFront)
Last-Modified
Tue, 03 Mar 2020 19:14:28 GMT
Server
AmazonS3
X-Amz-Cf-Pop
FRA56-C2
Age
3718680
ETag
"53b0291ca3900aca920ad48e9790c1b7"
X-Cache
Hit from cloudfront
Content-Type
application/x-javascript
Cache-Control
max-age=31536000
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
309
X-Amz-Cf-Id
7eVumP15RWGS7otcG4vaP8cUBqdhTLrlkPqIzKmEgQlHVMSG4SIvgg==
ondemand-preview-w-255.mp4
f5bd7c2823d8d0533dcb-62d55445ed2ff88556926faa498f48fa.ssl.cf1.rackcdn.com/
62 KB
0
Media
General
Full URL
https://f5bd7c2823d8d0533dcb-62d55445ed2ff88556926faa498f48fa.ssl.cf1.rackcdn.com/ondemand-preview-w-255.mp4
Requested by
Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/chinese-apt-group-uses-new-tradecraft-to-live-off-land-a-22379
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
184.30.16.143 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-30-16-143.deploy.static.akamaitechnologies.com
Software
/
Resource Hash

Request headers

Referer
https://www.bankinfosecurity.com/
Accept-Encoding
identity;q=1, *;q=0
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Range
bytes=0-

Response headers

Date
Tue, 27 Jun 2023 02:10:40 GMT
Last-Modified
Fri, 05 Jul 2013 12:56:36 GMT
ETag
e5d65b36cc2f1ee7de6cc53cd6609280
Content-Type
video/mp4
Content-Range
bytes 0-10621769/10621770
X-Timestamp
1373028995.98411
Cache-Control
public, max-age=367
Connection
keep-alive
Accept-Ranges
bytes
X-Trans-Id
txd91cbe944b6148b48e7e4-006498a804dfw1
Content-Length
10621770
Expires
Tue, 27 Jun 2023 02:16:47 GMT
pJvtZAB9_normal.jpg
pbs.twimg.com/profile_images/1626263896540553217/
2 KB
2 KB
Image
General
Full URL
https://pbs.twimg.com/profile_images/1626263896540553217/pJvtZAB9_normal.jpg
Requested by
Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/chinese-apt-group-uses-new-tradecraft-to-live-off-land-a-22379
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:134:1a0d:1429:742:782:b6 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECS (frb/6795) /
Resource Hash
e26475b29b6c6ad70a6cc7156eed3a0e3d1e9f9900c9108fc67554b29f077c07
Security Headers
Name Value
Strict-Transport-Security max-age=631138519
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.bankinfosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 27 Jun 2023 02:10:40 GMT
strict-transport-security
max-age=631138519
x-content-type-options
nosniff
age
597524
x-cache
HIT
server-timing
x-cache;desc= HIT,x-tw-cdn;desc=VZ
content-length
2187
x-response-time
108
surrogate-key
profile_images profile_images/bucket/1 profile_images/1626263896540553217
last-modified
Thu, 16 Feb 2023 16:53:02 GMT
server
ECS (frb/6795)
x-tw-cdn
VZ, VZ, VZ
content-type
image/jpeg
access-control-allow-origin
*
x-transaction-id
13c49ec4dc9ff9a1
access-control-expose-headers
Content-Length
cache-control
max-age=604800, must-revalidate
perf
7626143928
x-connection-hash
2363b97f3f9ae742901180c34215b71dcf19720b7259da6a1e3fc6b8e77a22f9
accept-ranges
bytes
timing-allow-origin
https://twitter.com, https://mobile.twitter.com
6YOFNWat_normal.jpg
pbs.twimg.com/profile_images/1622707740534505473/
2 KB
2 KB
Image
General
Full URL
https://pbs.twimg.com/profile_images/1622707740534505473/6YOFNWat_normal.jpg
Requested by
Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/chinese-apt-group-uses-new-tradecraft-to-live-off-land-a-22379
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:134:1a0d:1429:742:782:b6 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECS (frb/67C1) /
Resource Hash
74245b5aae3834ddb8901e2eee520902bf193c895566c73dde9bb06d66b63f6c
Security Headers
Name Value
Strict-Transport-Security max-age=631138519
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.bankinfosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 27 Jun 2023 02:10:40 GMT
strict-transport-security
max-age=631138519
x-content-type-options
nosniff
age
309592
x-cache
HIT
server-timing
x-cache;desc= HIT,x-tw-cdn;desc=VZ
content-length
2035
x-response-time
115
surrogate-key
profile_images profile_images/bucket/4 profile_images/1622707740534505473
last-modified
Mon, 06 Feb 2023 21:22:08 GMT
server
ECS (frb/67C1)
x-tw-cdn
VZ, VZ, VZ
content-type
image/jpeg
access-control-allow-origin
*
x-transaction-id
fd0eee351f3d841f
access-control-expose-headers
Content-Length
cache-control
max-age=604800, must-revalidate
perf
7626143928
x-connection-hash
8f7b6c0d3c36b49e27a95a06bf71110318ac0150fe956cb2da32cf8923f72dcd
accept-ranges
bytes
timing-allow-origin
https://twitter.com, https://mobile.twitter.com
T5iem5Hk_normal.jpg
pbs.twimg.com/profile_images/1672699773638385664/
2 KB
2 KB
Image
General
Full URL
https://pbs.twimg.com/profile_images/1672699773638385664/T5iem5Hk_normal.jpg
Requested by
Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/chinese-apt-group-uses-new-tradecraft-to-live-off-land-a-22379
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:134:1a0d:1429:742:782:b6 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECS (frb/673A) /
Resource Hash
63b42989e8929ddac473f263487c093f5bf5cbbc0afa9af052b5277007d34170
Security Headers
Name Value
Strict-Transport-Security max-age=631138519
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.bankinfosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 27 Jun 2023 02:10:40 GMT
strict-transport-security
max-age=631138519
x-content-type-options
nosniff
age
193855
x-cache
HIT
server-timing
x-cache;desc= HIT,x-tw-cdn;desc=VZ
content-length
2111
x-response-time
116
surrogate-key
profile_images profile_images/bucket/4 profile_images/1672699773638385664
last-modified
Sat, 24 Jun 2023 20:12:37 GMT
server
ECS (frb/673A)
x-tw-cdn
VZ, VZ, VZ
content-type
image/jpeg
access-control-allow-origin
*
x-transaction-id
8084e867c040baf7
access-control-expose-headers
Content-Length
cache-control
max-age=604800, must-revalidate
perf
7626143928
x-connection-hash
b8e1a073da52752fea6085175767ee369043e3bee4f6a673d04e63b09c026c3f
accept-ranges
bytes
timing-allow-origin
https://twitter.com, https://mobile.twitter.com
BDqsH4xQ_normal.jpg
pbs.twimg.com/profile_images/1246205882922201088/
2 KB
2 KB
Image
General
Full URL
https://pbs.twimg.com/profile_images/1246205882922201088/BDqsH4xQ_normal.jpg
Requested by
Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/chinese-apt-group-uses-new-tradecraft-to-live-off-land-a-22379
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:134:1a0d:1429:742:782:b6 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECS (frb/6762) /
Resource Hash
e988625f007b2e96b5f5796e7ae0619f5348c319851ddffc668c216ff5583a70
Security Headers
Name Value
Strict-Transport-Security max-age=631138519
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.bankinfosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 27 Jun 2023 02:10:40 GMT
strict-transport-security
max-age=631138519
x-content-type-options
nosniff
age
390051
x-cache
HIT
server-timing
x-cache;desc= HIT,x-tw-cdn;desc=VZ
content-length
2111
x-response-time
183
surrogate-key
profile_images profile_images/bucket/8 profile_images/1246205882922201088
last-modified
Fri, 03 Apr 2020 22:38:10 GMT
server
ECS (frb/6762)
x-tw-cdn
VZ, VZ, VZ
content-type
image/jpeg
access-control-allow-origin
*
x-transaction-id
0a68f20f4d71698e
access-control-expose-headers
Content-Length
cache-control
max-age=604800, must-revalidate
perf
7626143928
x-connection-hash
b316e533422d43bc7e2c4113d0e92548cafad2706b75b796d00341b4b7d5ac46
accept-ranges
bytes
timing-allow-origin
https://twitter.com, https://mobile.twitter.com
ajax.php
www.bankinfosecurity.com/
5 B
388 B
XHR
General
Full URL
https://www.bankinfosecurity.com/ajax.php?json=notificationCookies&action=getNotifications
Requested by
Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/javascripts-responsive/vendor/jquery.min.js?s=1687831838.6541
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
50.56.167.254 , United States, ASN33070 (RMH-14, US),
Reverse DNS
Software
Apache /
Resource Hash
fcbcf165908dd18a9e49f7ff27810176db8e9f63b4352213741664245224f8aa

Request headers

Accept
*/*
Referer
https://www.bankinfosecurity.com/chinese-apt-group-uses-new-tradecraft-to-live-off-land-a-22379
X-Requested-With
XMLHttpRequest
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 27 Jun 2023 02:10:40 GMT
Content-Encoding
gzip
Server
Apache
Vary
Accept-Encoding
Transfer-Encoding
chunked
Content-Type
text/html; charset=UTF-8
Cache-Control
no-store, no-cache, must-revalidate
Connection
Keep-Alive
Keep-Alive
timeout=5, max=94
Expires
Thu, 19 Nov 1981 08:52:00 GMT
js
www.googletagmanager.com/gtag/
231 KB
82 KB
Script
General
Full URL
https://www.googletagmanager.com/gtag/js?id=G-XJ8Q4QGGRH&l=dataLayer&cx=c
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-T6KM3T
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:829::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
c0fbcd0d8bbe84a1383a64557ab76db8d7fd1c2825db2e180a51dc8fbfc544e8
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.bankinfosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 27 Jun 2023 02:10:40 GMT
content-encoding
br
strict-transport-security
max-age=31536000; includeSubDomains
server
Google Tag Manager
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
access-control-allow-headers
Cache-Control
content-length
83453
x-xss-protection
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires
Tue, 27 Jun 2023 02:10:40 GMT
js
www.googletagmanager.com/gtag/
218 KB
78 KB
Script
General
Full URL
https://www.googletagmanager.com/gtag/js?id=G-2RK1HGW2E4&l=dataLayer&cx=c
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-T6KM3T
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:829::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
693beca9d72ac0a0060cbad1887e2944d4490472f8045a8efaa239f196419542
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.bankinfosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 27 Jun 2023 02:10:40 GMT
content-encoding
br
strict-transport-security
max-age=31536000; includeSubDomains
server
Google Tag Manager
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
access-control-allow-headers
Cache-Control
content-length
79893
x-xss-protection
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires
Tue, 27 Jun 2023 02:10:40 GMT
pubads_impl.js
securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202306220101/
393 KB
125 KB
Script
General
Full URL
https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202306220101/pubads_impl.js?cb=31075684
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
3086c49956d51c2cba2562ba86a083aedf01d66f41c264f158f5d4f6e632c3eb
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.bankinfosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Mon, 26 Jun 2023 10:37:08 GMT
content-encoding
br
x-content-type-options
nosniff
age
56012
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
127939
x-xss-protection
0
server
cafe
etag
10569078359274256513
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
public, immutable, max-age=31536000
timing-allow-origin
*
expires
Tue, 25 Jun 2024 10:37:08 GMT
ppub_config
securepubads.g.doubleclick.net/pagead/
46 B
585 B
XHR
General
Full URL
https://securepubads.g.doubleclick.net/pagead/ppub_config?ippd=www.bankinfosecurity.com
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
886cbcafd4491d4e1f178b55099ad1ca892a88f7cd68f9e04604d370e0a5baeb
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.bankinfosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 27 Jun 2023 02:10:40 GMT
content-encoding
br
x-content-type-options
nosniff
server
cafe
content-type
application/json; charset=UTF-8
access-control-allow-origin
*
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
private, max-age=3600, stale-while-revalidate=3600
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
43
x-xss-protection
0
expires
Tue, 27 Jun 2023 02:10:40 GMT
facebook.svg
platform-cdn.sharethis.com/img/
301 B
742 B
Image
General
Full URL
https://platform-cdn.sharethis.com/img/facebook.svg
Requested by
Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/chinese-apt-group-uses-new-tradecraft-to-live-off-land-a-22379
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2057:600:1d:85c3:6640:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
768d97ec0916217ae82c70aeda3a61b9b0dab344edc4a3240a4f7cd94af00307
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.bankinfosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Thu, 22 Jun 2023 01:12:15 GMT
via
1.1 c6b364b1181abfafd7a69f210841edca.cloudfront.net (CloudFront)
strict-transport-security
max-age=31536000; includeSubDomains
x-amz-cf-pop
FRA6-C1
age
435506
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
content-length
301
last-modified
Thu, 10 Oct 2019 01:20:12 GMT
server
AmazonS3
etag
"c6e9be45643e197ce1db1d7e24a99adc"
vary
Accept-Encoding
content-type
image/svg+xml
cache-control
public, max-age=2592000
accept-ranges
bytes
x-amz-cf-id
me7znSLtS9lS_oOtrx2DkL4Dv5Dd6qdNJOo4k0U8efLXVGI10gBLoQ==
twitter.svg
platform-cdn.sharethis.com/img/
731 B
1 KB
Image
General
Full URL
https://platform-cdn.sharethis.com/img/twitter.svg
Requested by
Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/chinese-apt-group-uses-new-tradecraft-to-live-off-land-a-22379
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2057:600:1d:85c3:6640:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
7c93346d4f681a0be90d1dfc19346382a4700f1810f41caa54415688dee1777f
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.bankinfosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Mon, 26 Jun 2023 10:31:06 GMT
via
1.1 c6b364b1181abfafd7a69f210841edca.cloudfront.net (CloudFront)
strict-transport-security
max-age=31536000; includeSubDomains
x-amz-cf-pop
FRA6-C1
age
56375
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
content-length
731
last-modified
Thu, 10 Oct 2019 01:20:13 GMT
server
AmazonS3
etag
"0af2fb38987598376c99e21af17ade45"
vary
Accept-Encoding
content-type
image/svg+xml
cache-control
public, max-age=2592000
accept-ranges
bytes
x-amz-cf-id
5N5okOtNGKNtHgvimU5fUbLe3BfLWOCElxkWVzcMvgqexQEq6N7TnQ==
linkedin.svg
platform-cdn.sharethis.com/img/
456 B
881 B
Image
General
Full URL
https://platform-cdn.sharethis.com/img/linkedin.svg
Requested by
Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/chinese-apt-group-uses-new-tradecraft-to-live-off-land-a-22379
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2057:600:1d:85c3:6640:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
cb8c2b19fd9b56c41db14bd71b5c0616c1ba4e99b08c8e75084cf695f74b7120
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.bankinfosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Sun, 18 Jun 2023 18:06:18 GMT
via
1.1 c6b364b1181abfafd7a69f210841edca.cloudfront.net (CloudFront)
strict-transport-security
max-age=31536000; includeSubDomains
last-modified
Thu, 10 Oct 2019 01:20:12 GMT
server
AmazonS3
x-amz-cf-pop
FRA6-C1
age
720263
etag
"fa43b4ede18498b114fc7185993f6da7"
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
content-type
image/svg+xml
cache-control
public, max-age=2592000
accept-ranges
bytes
content-length
456
x-amz-cf-id
OZMaOIlinWlWDsNJHyus0PgQ1IrkZULPCr6H7N_QGBe6VAHpRxzfHw==
ondemand-preview-w-255.mp4
f5bd7c2823d8d0533dcb-62d55445ed2ff88556926faa498f48fa.ssl.cf1.rackcdn.com/
3 MB
0
Media
General
Full URL
https://f5bd7c2823d8d0533dcb-62d55445ed2ff88556926faa498f48fa.ssl.cf1.rackcdn.com/ondemand-preview-w-255.mp4
Requested by
Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/chinese-apt-group-uses-new-tradecraft-to-live-off-land-a-22379
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
184.30.16.143 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-30-16-143.deploy.static.akamaitechnologies.com
Software
/
Resource Hash

Request headers

Referer
https://www.bankinfosecurity.com/
Accept-Encoding
identity;q=1, *;q=0
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Range
bytes=753664-

Response headers

Date
Tue, 27 Jun 2023 02:10:40 GMT
Last-Modified
Fri, 05 Jul 2013 12:56:36 GMT
ETag
e5d65b36cc2f1ee7de6cc53cd6609280
Content-Type
video/mp4
Content-Range
bytes 753664-10621769/10621770
X-Timestamp
1373028995.98411
Cache-Control
public, max-age=367
Connection
keep-alive
Accept-Ranges
bytes
X-Trans-Id
txd91cbe944b6148b48e7e4-006498a804dfw1
Content-Length
9868106
Expires
Tue, 27 Jun 2023 02:16:47 GMT
collect
www.google-analytics.com/j/
16 B
167 B
XHR
General
Full URL
https://www.google-analytics.com/j/collect?v=1&_v=j101&a=755552529&t=pageview&_s=1&dl=https%3A%2F%2Fwww.bankinfosecurity.com%2Fchinese-apt-group-uses-new-tradecraft-to-live-off-land-a-22379&ul=en-us&de=UTF-8&dt=Chinese%20APT%20Group%20Uses%20New%20Tradecraft%20to%20Live%20Off%20the%20Land&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=IEBAAEABAAAAACAAI~&jid=908799544&gjid=1416433054&cid=793751499.1687831841&tid=UA-212197-2&_gid=176277998.1687831841&_r=1&_slc=1&z=1282267466
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:811::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
86e361ef0e3c927e1dce9d2d2ea6c3ca7d6f09bc5157dd93218609ca38689bb1
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://www.bankinfosecurity.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Tue, 27 Jun 2023 02:10:40 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://www.bankinfosecurity.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
16
expires
Fri, 01 Jan 1990 00:00:00 GMT
collect
www.google-analytics.com/j/
4 B
71 B
XHR
General
Full URL
https://www.google-analytics.com/j/collect?v=1&_v=j101&a=755552529&t=pageview&_s=1&dl=https%3A%2F%2Fwww.bankinfosecurity.com%2Fchinese-apt-group-uses-new-tradecraft-to-live-off-land-a-22379&ul=en-us&de=UTF-8&dt=Chinese%20APT%20Group%20Uses%20New%20Tradecraft%20to%20Live%20Off%20the%20Land&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=IEDAAEABAAAAACAAI~&jid=1001153561&gjid=1911959645&cid=793751499.1687831841&tid=UA-212197-36&_gid=176277998.1687831841&_r=1&_slc=1&cd1=cat%3D420%26cat%3D409%26cat%3D93%26cat%3D524%26cat%3D515%26cat%3D431%26cat%3D467%26cat%3D476%26assetID%3D22379%26assetType%3Darticle%26key%3Dcrowdstrike%26key%3Dmicrosoft%26key%3Dchina%26key%3Dhacker%26key%3Dzoho%26key%3D&z=870332858
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:811::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
aec60bc104db041b1512185839f18f52986df7e569e5445f740dd60f763fbca8
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://www.bankinfosecurity.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Tue, 27 Jun 2023 02:10:40 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://www.bankinfosecurity.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
4
expires
Fri, 01 Jan 1990 00:00:00 GMT
collect
www.google-analytics.com/
35 B
194 B
Image
General
Full URL
https://www.google-analytics.com/collect?v=1&_v=j101&a=755552529&t=event&_s=2&dl=https%3A%2F%2Fwww.bankinfosecurity.com%2Fchinese-apt-group-uses-new-tradecraft-to-live-off-land-a-22379&ul=en-us&de=UTF-8&dt=Chinese%20APT%20Group%20Uses%20New%20Tradecraft%20to%20Live%20Off%20the%20Land&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=dailyemailupdates&ea=impression&el=&_u=IEDAAEABAAAAACAAI~&jid=&gjid=&cid=793751499.1687831841&tid=UA-212197-2&_gid=176277998.1687831841&z=150032662
Requested by
Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/chinese-apt-group-uses-new-tradecraft-to-live-off-land-a-22379
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:811::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.bankinfosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 26 Jun 2023 21:52:42 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
age
15478
content-type
image/gif
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
35
expires
Mon, 01 Jan 1990 00:00:00 GMT
insight.beta.min.js
snap.licdn.com/li.lms-analytics/
13 KB
5 KB
Script
General
Full URL
https://snap.licdn.com/li.lms-analytics/insight.beta.min.js
Requested by
Host: sjs.bizographics.com
URL: https://sjs.bizographics.com/insight.min.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:3100::1735:28a8 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
87ca2d8adbd10be0e5e89784dbb7aa8bb67f77247471f437e6af535009955f8c
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.bankinfosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 27 Jun 2023 02:10:40 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Wed, 21 Jun 2023 22:23:45 GMT
x-cdn
AKAM
x-amz-server-side-encryption
AES256
vary
Accept-Encoding
content-type
application/x-javascript;charset=utf-8
cache-control
max-age=78212
accept-ranges
bytes
content-length
4807
collect
region1.google-analytics.com/g/
0
261 B
Ping
General
Full URL
https://region1.google-analytics.com/g/collect?v=2&tid=G-2RK1HGW2E4&gtm=45je36q0&_p=755552529&cid=793751499.1687831841&ul=en-us&sr=1600x1200&ir=1&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_eu=EA&ngs=1&_s=1&sid=1687831840&sct=1&seg=0&dl=https%3A%2F%2Fwww.bankinfosecurity.com%2Fchinese-apt-group-uses-new-tradecraft-to-live-off-land-a-22379&dt=Chinese%20APT%20Group%20Uses%20New%20Tradecraft%20to%20Live%20Off%20the%20Land&en=page_view&_fv=1&_ss=1
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-2RK1HGW2E4&l=dataLayer&cx=c
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:4860:4802:34::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.bankinfosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 27 Jun 2023 02:10:40 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://www.bankinfosecurity.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
collect
region1.google-analytics.com/g/
0
54 B
Ping
General
Full URL
https://region1.google-analytics.com/g/collect?v=2&tid=G-XJ8Q4QGGRH&gtm=45je36q0&_p=755552529&cid=793751499.1687831841&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_s=1&sid=1687831840&sct=1&seg=0&dl=https%3A%2F%2Fwww.bankinfosecurity.com%2Fchinese-apt-group-uses-new-tradecraft-to-live-off-land-a-22379&dt=Chinese%20APT%20Group%20Uses%20New%20Tradecraft%20to%20Live%20Off%20the%20Land&en=page_view&_fv=1&_ss=1&ep.asset_type=article22379&ep.asset_categories=420%2C409%2C93%2C524%2C515%2C431%2C467%2C476&ep.asset_keywords_1=Crowdstrike%2C%20Microsoft%2C%20China%2C%20hacker%2C%20Zoho&ep.asset_keywords_2=&ep.asset_keywords_3=&ep.asset_keywords_4=&ep.asset_keywords_5=&ep.asset_keywords_6=&ep.asset_keywords_7=&ep.asset_keywords_8=&ep.asset_keywords_9=&ep.asset_keywords_10=
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-XJ8Q4QGGRH&l=dataLayer&cx=c
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:4860:4802:34::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.bankinfosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 27 Jun 2023 02:10:40 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://www.bankinfosecurity.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
collect
stats.g.doubleclick.net/j/
4 B
356 B
XHR
General
Full URL
https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j101&tid=UA-212197-2&cid=793751499.1687831841&jid=908799544&gjid=1416433054&_gid=176277998.1687831841&_u=IEBAAEAAAAAAACAAI~&z=1404344931
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:400c:c0c::9d Brussels, Belgium, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.bankinfosecurity.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
strict-transport-security
max-age=10886400; includeSubDomains; preload
date
Tue, 27 Jun 2023 02:10:40 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://www.bankinfosecurity.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
4
expires
Fri, 01 Jan 1990 00:00:00 GMT
js
www.googletagmanager.com/gtag/
218 KB
78 KB
Script
General
Full URL
https://www.googletagmanager.com/gtag/js?id=G-2RK1HGW2E4&cx=c&_slc=1
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:829::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
693beca9d72ac0a0060cbad1887e2944d4490472f8045a8efaa239f196419542
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.bankinfosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 27 Jun 2023 02:10:40 GMT
content-encoding
br
strict-transport-security
max-age=31536000; includeSubDomains
server
Google Tag Manager
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
access-control-allow-headers
Cache-Control
content-length
79893
x-xss-protection
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires
Tue, 27 Jun 2023 02:10:40 GMT
collect
stats.g.doubleclick.net/j/
1 B
69 B
XHR
General
Full URL
https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j101&tid=UA-212197-36&cid=793751499.1687831841&jid=1001153561&gjid=1911959645&_gid=176277998.1687831841&_u=IEDAAEABAAAAACAAI~&z=1604989995
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:400c:c0c::9d Brussels, Belgium, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.bankinfosecurity.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
strict-transport-security
max-age=10886400; includeSubDomains; preload
date
Tue, 27 Jun 2023 02:10:40 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://www.bankinfosecurity.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
1
expires
Fri, 01 Jan 1990 00:00:00 GMT
utsync.ashx
ml314.com/
62 B
309 B
Script
General
Full URL
https://ml314.com/utsync.ashx?pub=&adv=&et=0&eid=57819&ct=js&pi=&fp=&clid=&if=0&ps=&cl=&mlt=&data=&&cp=https%3A%2F%2Fwww.bankinfosecurity.com%2Fchinese-apt-group-uses-new-tradecraft-to-live-off-land-a-22379&pv=1687831840603_8c277i1uq&bl=en-us&cb=188744&return=&ht=&d=&dc=&si=1687831840603_8c277i1uq&cid=&s=1600x1200&rp=&v=2.5.3.49
Requested by
Host: ml314.com
URL: https://ml314.com/tag.aspx?2752023
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.111.234.236 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
236.234.111.34.bc.googleusercontent.com
Software
Microsoft-IIS/10.0 / ASP.NET
Resource Hash
5a1ba6ff6db12f791bbbfc4da3cb389e06f0cd53eede09ef3eb3ceb074089ef1

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.bankinfosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 27 Jun 2023 02:10:40 GMT
via
1.1 google
server
Microsoft-IIS/10.0
x-aspnet-version
4.0.30319
x-powered-by
ASP.NET
content-type
application/javascript; charset=utf-8
p3p
CP="NON DSP COR ADMo PSAo DEVo BUS COM UNI NAV DEM STA"
cache-control
no-cache, no-store, must-revalidate
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
62
expires
0
ud.ashx
in.ml314.com/
20 B
482 B
Script
General
Full URL
https://in.ml314.com/ud.ashx?topiclimit=&cb=2752023&v=2.5.3.49
Requested by
Host: ml314.com
URL: https://ml314.com/tag.aspx?2752023
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.20.71.154 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-52-20-71-154.compute-1.amazonaws.com
Software
Microsoft-IIS/10.0 / ASP.NET
Resource Hash
d0e4a6372d6fb5ffe9505dbe9e94aee8f1b9b96ec8e5e20684cce8b4c5a88fa7

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.bankinfosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Tue, 27 Jun 2023 02:10:40 GMT
Content-Encoding
gzip
Server
Microsoft-IIS/10.0
X-AspNet-Version
4.0.30319
X-Powered-By
ASP.NET
Vary
Accept-Encoding
Content-Type
application/javascript; charset=utf-8
Cache-Control
public
Connection
keep-alive
Content-Length
138
Expires
Wed, 28 Jun 2023 02:10:41 GMT
munchkin.js
munchkin.marketo.net/163/
11 KB
5 KB
Script
General
Full URL
https://munchkin.marketo.net/163/munchkin.js
Requested by
Host: munchkin.marketo.net
URL: https://munchkin.marketo.net/munchkin.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
23.206.100.200 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-206-100-200.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
68cc280ce370c6f1f51a4fc5950103fc38df80a429552c549add04ebd8bd3a23

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.bankinfosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Tue, 27 Jun 2023 02:10:40 GMT
Content-Encoding
gzip
Last-Modified
Fri, 06 Jan 2023 02:26:40 GMT
Server
AkamaiNetStorage
ETag
"ea7826f34518d7c2295738f39c7640fa:1672972000.238769"
Vary
Accept-Encoding
P3P
policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR"
Content-Type
application/x-javascript
Cache-Control
max-age=8640000
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
4741
Expires
Thu, 05 Oct 2023 02:10:40 GMT
/
c.6sc.co/
7 B
200 B
XHR
General
Full URL
https://c.6sc.co/
Requested by
Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.17.100.184 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a2-17-100-184.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
fe04a9dc88d3f3be8d4f6bc63a9a80f45a4c6d8460e7551dab849457c091920a

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.bankinfosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 27 Jun 2023 02:10:40 GMT
access-control-max-age
86400
access-control-allow-methods
GET,POST
content-type
text/html
access-control-allow-origin
https://www.bankinfosecurity.com
access-control-allow-credentials
true
access-control-allow-headers
*
content-length
7
/
ipv6.6sc.co/
24 B
316 B
XHR
General
Full URL
https://ipv6.6sc.co/
Requested by
Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:ab00::214:8e70 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
41a8990d122f143d451739e4b1f703abbbe64adfa7083efc81af5dbd97ea8c71

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.bankinfosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 27 Jun 2023 02:10:40 GMT
vary
Origin
content-type
text/html
access-control-allow-origin
https://www.bankinfosecurity.com
cache-control
max-age=0, no-cache, no-store
6si-ipv6
2a00:c98:2030:a004:1::15
server-timing
cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="468842_34901612_440689683_28_717_9_0_-";dur=1
content-length
24
expires
Tue, 27 Jun 2023 02:10:40 GMT
img.gif
b.6sc.co/v1/beacon/
43 B
485 B
Image
General
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=8cde4267f2ac828e1ae5d1fbcd5ef992&svisitor=null&visitor=04c7f47b-0a02-4084-868c-8579f4a04d2f&session=a5cdfbdc-5a43-4db1-88be-632d70cb33b7&event=a_pageload&q=%7B%22pageLoadTime%22%3A%22Tue%2C%2027%20Jun%202023%2002%3A10%3A40%20GMT%22%2C%22settings%22%3A%22%5B%7B%5C%22name%5C%22%3A%5C%22enableEventTracking%5C%22%2C%5C%22value%5C%22%3A%5C%22true%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Tue%2C%2027%20Jun%202023%2002%3A10%3A40%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setToken%5C%22%2C%5C%22value%5C%22%3A%5C%228cde4267f2ac828e1ae5d1fbcd5ef992%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Tue%2C%2027%20Jun%202023%2002%3A10%3A40%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setEndpoint%5C%22%2C%5C%22value%5C%22%3A%5C%22b.6sc.co%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Tue%2C%2027%20Jun%202023%2002%3A10%3A40%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22enableEventTracking%5C%22%2C%5C%22value%5C%22%3A%5C%22true%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Tue%2C%2027%20Jun%202023%2002%3A10%3A40%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setToken%5C%22%2C%5C%22value%5C%22%3A%5C%228cde4267f2ac828e1ae5d1fbcd5ef992%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Tue%2C%2027%20Jun%202023%2002%3A10%3A40%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setEndpoint%5C%22%2C%5C%22value%5C%22%3A%5C%22b.6sc.co%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Tue%2C%2027%20Jun%202023%2002%3A10%3A40%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setEpsilonKey%5C%22%2C%5C%22value%5C%22%3A%5C%227207ef3e32cb3a527876a3e90b6bf51dbd9d9339%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Tue%2C%2027%20Jun%202023%2002%3A10%3A40%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22enableCompanyDetails%5C%22%2C%5C%22value%5C%22%3A%5C%22%5Btrue%2Cnull%2C3%5D%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Tue%2C%2027%20Jun%202023%2002%3A10%3A40%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%5D%22%7D&isIframe=false&m=%7B%22description%22%3A%22A%20Chinese%20state%20hacker%20is%20using%20novel%20tradecraft%20to%20gain%20initial%20access%20to%20victim%20systems%2C%20according%20to%20CrowdStrike.%20Targeted%20organizations%20include%20those%20in%20the%22%2C%22keywords%22%3A%22Crowdstrike%2C%20Microsoft%2C%20China%2C%20hacker%2C%20Zoho%22%2C%22title%22%3A%22Chinese%20APT%20Group%20Uses%20New%20Tradecraft%20to%20Live%20Off%20the%20Land%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.bankinfosecurity.com%2Fchinese-apt-group-uses-new-tradecraft-to-live-off-land-a-22379&pageViewId=cf6ed08c-aff2-4d14-81f7-d216b016f600
Requested by
Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/chinese-apt-group-uses-new-tradecraft-to-live-off-land-a-22379
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.17.100.184 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a2-17-100-184.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.bankinfosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 27 Jun 2023 02:10:40 GMT
x-content-type-options
nosniff
content-length
43
pragma
no-cache
last-modified
Sat, 18 Feb 2023 02:04:22 GMT
server
nginx/1.14.0 (Ubuntu)
etag
"63f03226-2b"
access-control-max-age
86400
access-control-allow-methods
GET,POST
content-type
image/gif
access-control-allow-origin
cache-control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials
true
accept-ranges
bytes
access-control-allow-headers
*
expires
Wed, 19 Apr 2000 11:43:00 GMT
/
c.6sc.co/
7 B
200 B
XHR
General
Full URL
https://c.6sc.co/
Requested by
Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.17.100.184 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a2-17-100-184.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
fe04a9dc88d3f3be8d4f6bc63a9a80f45a4c6d8460e7551dab849457c091920a

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.bankinfosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 27 Jun 2023 02:10:40 GMT
access-control-max-age
86400
access-control-allow-methods
GET,POST
content-type
text/html
access-control-allow-origin
https://www.bankinfosecurity.com
access-control-allow-credentials
true
access-control-allow-headers
*
content-length
7
/
ipv6.6sc.co/
24 B
316 B
XHR
General
Full URL
https://ipv6.6sc.co/
Requested by
Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:ab00::214:8e70 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
41a8990d122f143d451739e4b1f703abbbe64adfa7083efc81af5dbd97ea8c71

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.bankinfosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 27 Jun 2023 02:10:40 GMT
vary
Origin
content-type
text/html
access-control-allow-origin
https://www.bankinfosecurity.com
cache-control
max-age=0, no-cache, no-store
6si-ipv6
2a00:c98:2030:a004:1::15
server-timing
cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="468842_34901612_440689684_27_713_9_0_-";dur=1
content-length
24
expires
Tue, 27 Jun 2023 02:10:40 GMT
token
cdn.linkedin.oribi.io/partner/2330930,749/domain/bankinfosecurity.com/
36 B
398 B
XHR
General
Full URL
https://cdn.linkedin.oribi.io/partner/2330930,749/domain/bankinfosecurity.com/token
Requested by
Host: snap.licdn.com
URL: https://snap.licdn.com/li.lms-analytics/insight.beta.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:26db:fc00:2:53b2:240:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
/
Resource Hash
7b1eaaaf180a13c29b6dddc3b0ae23333b4397e0f3c065b4c86da2f2530a5f89

Request headers

Accept
*
Referer
https://www.bankinfosecurity.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 27 Jun 2023 01:59:36 GMT
content-encoding
gzip
via
1.1 66e1af4a9e82225c770ca97b3baaf86e.cloudfront.net (CloudFront)
x-amz-cf-pop
MUC50-P3
age
664
vary
accept-encoding
x-cache
Hit from cloudfront
content-type
application/json
access-control-allow-origin
*
access-control-expose-headers
*
cache-control
public, max-age=3600
x-amz-cf-id
hS50e3jeD12y-rrt--EOkTh50BQ7FBpM6rUeMHcbQecOo9xgkKQUzA==
collect
px4.ads.linkedin.com/
Redirect Chain
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=749%2C2330930&time=1687831840626&url=https%3A%2F%2Fwww.bankinfosecurity.com%2Fchinese-apt-group-uses-new-tradecraft-to-live-off-land-a-22379
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=749%2C2330930&time=1687831840626&url=https%3A%2F%2Fwww.bankinfosecurity.com%2Fchinese-apt-group-uses-new-tradecraft-to-live-off-land-a-22379&cooki...
  • https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D749%252C2330930%26time%3D1687831840626%26url%3Dhttps%253A%252F%252Fwww.bankinfose...
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=749%2C2330930&time=1687831840626&url=https%3A%2F%2Fwww.bankinfosecurity.com%2Fchinese-apt-group-uses-new-tradecraft-to-live-off-land-a-22379&cooki...
  • https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=749%2C2330930&time=1687831840626&url=https%3A%2F%2Fwww.bankinfosecurity.com%2Fchinese-apt-group-uses-new-tradecraft-to-live-off-land-a-22379&cook...
0
265 B
Image
General
Full URL
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=749%2C2330930&time=1687831840626&url=https%3A%2F%2Fwww.bankinfosecurity.com%2Fchinese-apt-group-uses-new-tradecraft-to-live-off-land-a-22379&cookiesTest=true&liSync=true&e_ipv6=AQJOzCj5IVPzbgAAAYj6ngmi8fZQ5hf8JEflTkDva-gPgeMv3xgA6r8Lu-Dn6T10pKp2Ji6Rfe0RPg
Requested by
Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/chinese-apt-group-uses-new-tradecraft-to-live-off-land-a-22379
Protocol
H2
Server
13.107.42.14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.bankinfosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 27 Jun 2023 02:10:40 GMT
x-li-pop
afd-prod-lva1-x
x-msedge-ref
Ref A: 657D8E76ED6741E2920CA554D0C4A0FA Ref B: FRAEDGE1806 Ref C: 2023-06-27T02:10:41Z
linkedin-action
1
x-cache
CONFIG_NOCACHE
content-type
application/javascript
x-li-fabric
prod-lva1
x-li-proto
http/2
content-length
0
x-li-uuid
AAX/EvlYAHGBspR6NXhgsg==

Redirect headers

date
Tue, 27 Jun 2023 02:10:40 GMT
x-li-pop
afd-prod-lva1-x
x-msedge-ref
Ref A: BF81B814A19940FEA1B3BFC9AB61ACD5 Ref B: FRAEDGE1305 Ref C: 2023-06-27T02:10:41Z
linkedin-action
1
x-cache
CONFIG_NOCACHE
x-li-fabric
prod-lva1
location
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=749%2C2330930&time=1687831840626&url=https%3A%2F%2Fwww.bankinfosecurity.com%2Fchinese-apt-group-uses-new-tradecraft-to-live-off-land-a-22379&cookiesTest=true&liSync=true&e_ipv6=AQJOzCj5IVPzbgAAAYj6ngmi8fZQ5hf8JEflTkDva-gPgeMv3xgA6r8Lu-Dn6T10pKp2Ji6Rfe0RPg
x-li-proto
http/2
content-length
0
x-li-uuid
AAX/EvlViLtjf0MoH0yMeQ==
token
cdn.linkedin.oribi.io/partner/2330930,749/domain/bankinfosecurity.com/
36 B
398 B
XHR
General
Full URL
https://cdn.linkedin.oribi.io/partner/2330930,749/domain/bankinfosecurity.com/token
Requested by
Host: snap.licdn.com
URL: https://snap.licdn.com/li.lms-analytics/insight.beta.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:26db:fc00:2:53b2:240:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
/
Resource Hash
7b1eaaaf180a13c29b6dddc3b0ae23333b4397e0f3c065b4c86da2f2530a5f89

Request headers

Accept
*
Referer
https://www.bankinfosecurity.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 27 Jun 2023 01:59:36 GMT
content-encoding
gzip
via
1.1 66e1af4a9e82225c770ca97b3baaf86e.cloudfront.net (CloudFront)
x-amz-cf-pop
MUC50-P3
age
664
vary
accept-encoding
x-cache
Hit from cloudfront
content-type
application/json
access-control-allow-origin
*
access-control-expose-headers
*
cache-control
public, max-age=3600
x-amz-cf-id
O2wPLY7oiEH18tYDpsSPbURoiTIRbSTgkCFO7XKsZpphb0Mhh3S6Xg==
2682.js
script.crazyegg.com/pages/scripts/0021/
6 KB
2 KB
Script
General
Full URL
https://script.crazyegg.com/pages/scripts/0021/2682.js
Requested by
Host: dnn506yrbagrg.cloudfront.net
URL: https://dnn506yrbagrg.cloudfront.net/pages/scripts/0021/2682.js?468842
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:9408 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
f122b139d8c6ba64f1c708876df711b40c32536f251fa3ea5fcbb10fd24abf3d

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.bankinfosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 27 Jun 2023 02:10:40 GMT
content-encoding
gzip
cf-cache-status
HIT
age
37157
cf-polished
origSize=6063
ce-version
11.5.89
cf-bgj
minify
last-modified
Mon, 26 Jun 2023 15:51:23 GMT
server
cloudflare
vary
Accept-Encoding
content-type
text/javascript
access-control-allow-origin
*
access-control-expose-headers
CE-Version
cache-control
public, max-age=300, s-maxage=1209600
timing-allow-origin
*
cf-ray
7dda27ac59041987-FRA
/
disqus.com/embed/comments/ Frame 9699
7 KB
4 KB
Document
General
Full URL
https://disqus.com/embed/comments/?base=default&f=bankinfosecurity&t_u=https%3A%2F%2Fwww.bankinfosecurity.com%2Fchinese-apt-group-uses-new-tradecraft-to-live-off-land-a-22379&t_d=Chinese%20APT%20Group%20Uses%20New%20Tradecraft%20to%20Live%20Off%20the%20Land&t_t=Chinese%20APT%20Group%20Uses%20New%20Tradecraft%20to%20Live%20Off%20the%20Land&s_o=default
Requested by
Host: bankinfosecurity.disqus.com
URL: https://bankinfosecurity.disqus.com/embed.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
151.101.0.134 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
afbab9bb4c188af9906f69d3e8d9bf91e24e98418d46185eadcc304b35905f06
Security Headers
Name Value
Content-Security-Policy script-src https://*.twitter.com:* https://www.gstatic.com/recaptcha/ https://a.disquscdn.com https://c.disquscdn.com c.disquscdn.com https://*.services.disqus.com:* https://cdn.boomtrain.com/p13n/ https://com-disqus.netmng.com:* 'unsafe-inline' https://referrer.disqus.com/juggler/ https://connect.facebook.net/en_US/sdk.js https://cdn.syndication.twimg.com/tweets.json https://apis.google.com https://www.google.com/recaptcha/ https://cf.ignitionone.com:* https://disqus.com
Strict-Transport-Security max-age=300; includeSubdomains
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.bankinfosecurity.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

Age
0
Cache-Control
stale-if-error=3600, s-stalewhilerevalidate=3600, stale-while-revalidate=30, no-cache, must-revalidate, public, s-maxage=5
Connection
keep-alive
Content-Encoding
gzip
Content-Length
2846
Content-Security-Policy
script-src https://*.twitter.com:* https://www.gstatic.com/recaptcha/ https://a.disquscdn.com https://c.disquscdn.com c.disquscdn.com https://*.services.disqus.com:* https://cdn.boomtrain.com/p13n/ https://com-disqus.netmng.com:* 'unsafe-inline' https://referrer.disqus.com/juggler/ https://connect.facebook.net/en_US/sdk.js https://cdn.syndication.twimg.com/tweets.json https://apis.google.com https://www.google.com/recaptcha/ https://cf.ignitionone.com:* https://disqus.com
Content-Type
text/html; charset=utf-8
Cross-Origin-Resource-Policy
cross-origin
Date
Tue, 27 Jun 2023 02:10:40 GMT
ETag
W/"lounge:view:9750651139.524808b6f647db393a7d6901f3fc62ec.2"
Last-Modified
Mon, 26 Jun 2023 20:24:12 GMT
Link
<https://c.disquscdn.com>;rel=preconnect,<https://c.disquscdn.com>;rel=dns-prefetch
Referrer-Policy
no-referrer-when-downgrade
Server
nginx
Strict-Transport-Security
max-age=300; includeSubdomains
Timing-Allow-Origin
*
Vary
Accept-Encoding
X-Content-Type-Options
nosniff
X-XSS-Protection
1; mode=block
p3p
CP="DSP IDC CUR ADM DELi STP NAV COM UNI INT PHY DEM"
visitWebPage
051-zxi-237.mktoresp.com/webevents/
2 B
318 B
Ping
General
Full URL
https://051-zxi-237.mktoresp.com/webevents/visitWebPage?_mchNc=1687831840659&_mchCn=&_mchId=051-ZXI-237&_mchTk=_mch-bankinfosecurity.com-1687831840658-76648&_mchHo=www.bankinfosecurity.com&_mchPo=&_mchRu=%2Fchinese-apt-group-uses-new-tradecraft-to-live-off-land-a-22379&_mchPc=https%3A&_mchVr=163&_mchEcid=&_mchHa=&_mchRe=&_mchQp=
Requested by
Host: munchkin.marketo.net
URL: https://munchkin.marketo.net/163/munchkin.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
192.28.147.68 , United States, ASN15224 (OMNITURE, US),
Reverse DNS
Software
nginx/1.20.1 /
Resource Hash
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.bankinfosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Tue, 27 Jun 2023 02:10:41 GMT
Content-Encoding
gzip
Server
nginx/1.20.1
Transfer-Encoding
chunked
Content-Type
text/plain; charset=UTF-8
Access-Control-Allow-Origin
*
Connection
keep-alive
X-Request-Id
dd1966c3-e0db-49e7-b327-6fb99e305c8e
visitWebPage
051-zxi-237.mktoresp.com/webevents/
2 B
318 B
Ping
General
Full URL
https://051-zxi-237.mktoresp.com/webevents/visitWebPage?_mchNc=1687831840659&_mchRu=%2Fchinese-apt-group-uses-new-tradecraft-to-live-off-land-a-22379&_mchQp=cat%3D420%26cat%3D409%26cat%3D93%26cat%3D524%26cat%3D515%26cat%3D431%26cat%3D467%26cat%3D476%26assetID%3D22379%26assetType%3Darticle%26key%3Dcrowdstrike%26key%3Dmicrosoft%26key%3Dchina%26key%3Dhacker%26key%3Dzoho%26key%3D&_mchId=051-ZXI-237&_mchTk=_mch-bankinfosecurity.com-1687831840658-76648&_mchHo=www.bankinfosecurity.com&_mchPo=&_mchPc=https%3A&_mchVr=163&_mchEcid=&_mchRe=
Requested by
Host: munchkin.marketo.net
URL: https://munchkin.marketo.net/163/munchkin.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
192.28.147.68 , United States, ASN15224 (OMNITURE, US),
Reverse DNS
Software
nginx/1.20.1 /
Resource Hash
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.bankinfosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Tue, 27 Jun 2023 02:10:41 GMT
Content-Encoding
gzip
Server
nginx/1.20.1
Transfer-Encoding
chunked
Content-Type
text/plain; charset=UTF-8
Access-Control-Allow-Origin
*
Connection
keep-alive
X-Request-Id
fe6d0f21-5cbe-43bf-bd63-76e687c73e68
integrator.js
adservice.google.com/adsid/
107 B
456 B
Script
General
Full URL
https://adservice.google.com/adsid/integrator.js?domain=www.bankinfosecurity.com
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202306220101/pubads_impl.js?cb=31075684
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.bankinfosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 27 Jun 2023 02:10:40 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
content-type
application/javascript; charset=UTF-8
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control
private, no-cache, no-store
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
100
x-xss-protection
0
ads
securepubads.g.doubleclick.net/gampad/
453 KB
42 KB
XHR
General
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?pvsid=4188951840722999&correlator=3170965652068442&eid=31072020%2C31075613%2C31075684&output=ldjh&gdfp_req=1&vrg=202306220101&ptt=17&impl=fifs&iu_parts=4444691%2CBIS_TOP_728x90%2CBIS_MID_RB_300x250%2CBIS_MID_RB_2_300x250%2CBIS_MID_RB_3_300x250%2CBIS_MID_RB_300x600%2CBIS_MID_L_180x150%2CBIS_MID_R_180x150%2CBIS_MID2_L_180x150%2CBIS_MID2_R_180x150%2CBIS_TEXT_1%2CBIS_TEXT_2%2CBIS_BOTTOM_728x90%2CBIS_MID_728x90%2CBIS_Interstitial%2CBIS_TOP_320x50%2CBIS_BOTTOM_320x50%2CBIS_MID_320x50%2CBIS_CAT_LOGO&enc_prev_ius=%2F0%2F1%2C%2F0%2F2%2C%2F0%2F3%2C%2F0%2F4%2C%2F0%2F5%2C%2F0%2F6%2C%2F0%2F7%2C%2F0%2F8%2C%2F0%2F9%2C%2F0%2F10%2C%2F0%2F11%2C%2F0%2F12%2C%2F0%2F13%2C%2F0%2F14%2C%2F0%2F15%2C%2F0%2F16%2C%2F0%2F17%2C%2F0%2F18&prev_iu_szs=728x90%2C300x250%2C300x250%2C300x250%2C300x600%2C180x150%2C180x150%2C180x150%2C180x150%2C280x70%2C280x70%2C728x90%2C728x90%2C640x480%2C320x50%2C320x50%2C320x50%2C216x54&ifi=1&adks=606436291%2C592806581%2C4037182823%2C700692632%2C585369811%2C2214922354%2C1142555781%2C3687202745%2C1536889060%2C1397140349%2C824892936%2C1158310571%2C1554130010%2C3082656849%2C1657167512%2C3519266287%2C3120678580%2C3463778582&sfv=1-0-40&cust_params=category%3D%255B420%252C409%252C93%252C524%252C515%252C431%252C467%252C476%255D%26gated%3Dn&sc=1&cookie_enabled=1&abxe=1&dt=1687831840706&lmt=1687831840&dlt=1687831838891&idt=1777&adxs=615%2C1025%2C1025%2C-9%2C1010%2C-9%2C-9%2C-9%2C-9%2C-9%2C-9%2C15%2C-9%2C-12245933%2C-12245933%2C-12245933%2C-9%2C-12245933&adys=71%2C584%2C2781%2C-9%2C1810%2C-9%2C-9%2C-9%2C-9%2C-9%2C-9%2C3457%2C-9%2C-12245933%2C-12245933%2C-12245933%2C-9%2C-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0%7C0%7C1%7C-1%7C2%7C-1%7C-1%7C-1%7C-1%7C-1%7C-1%7C3%7C-1%7C-1%7C-1%7C-1%7C-1%7C-1&ucis=1%7C2%7C3%7C4%7C5%7C6%7C7%7C8%7C9%7Ca%7Cb%7Cc%7Cd%7Ce%7Cf%7Cg%7Ch%7Ci&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&nvt=1&url=https%3A%2F%2Fwww.bankinfosecurity.com%2Fchinese-apt-group-uses-new-tradecraft-to-live-off-land-a-22379&frm=20&vis=1&psz=800x1%7C360x0%7C360x0%7C0x-1%7C390x0%7C0x-1%7C0x-1%7C0x-1%7C0x-1%7C0x-1%7C0x-1%7C1600x1%7C0x-1%7C0x-1%7C0x0%7C0x0%7C0x-1%7C780x3098&msz=770x0%7C360x1%7C360x1%7C0x-1%7C390x1%7C0x-1%7C0x-1%7C0x-1%7C0x-1%7C0x-1%7C0x-1%7C1570x0%7C0x-1%7C0x-1%7C0x0%7C0x0%7C0x-1%7C236x36&fws=0%2C0%2C0%2C2%2C0%2C2%2C2%2C2%2C2%2C2%2C2%2C0%2C2%2C644%2C128%2C128%2C2%2C128&ohw=0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C1600%2C0%2C0%2C0%2C0&ga_vid=793751499.1687831841&ga_sid=1687831841&ga_hid=755552529&ga_fc=true
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202306220101/pubads_impl.js?cb=31075684
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
e5483067555ac512d12aad7462badacb64ed7e7fa704bf321b9234ddd3be87b9
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.bankinfosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 27 Jun 2023 02:10:40 GMT
content-encoding
br
x-content-type-options
nosniff
google-mediationgroup-id
-2,-2,-2,-2,-2,-2,-2,-2,-2,-2,-2,-2,-2,-2,-2,-2,-2,-2
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42704
x-xss-protection
0
google-lineitem-id
6335591497,6335591497,6316842665,6316842665,6335591497,-2,-2,-2,-2,-2,-2,6316842665,6316842665,6333044555,-2,-2,-2,-2
pragma
no-cache
server
cafe
google-mediationtag-id
-2
google-creative-id
138437438373,138437412365,138434693348,138435428797,138437438379,-2,-2,-2,-2,-2,-2,138434693345,138435428791,138437616382,-2,-2,-2,-2
content-type
text/plain; charset=UTF-8
access-control-allow-origin
https://www.bankinfosecurity.com
cache-control
no-cache, must-revalidate
access-control-allow-credentials
true
timing-allow-origin
*
expires
Fri, 01 Jan 1990 00:00:00 GMT
container.html
4e406dee87576dea2e9dda2919145c30.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame C33A
6 KB
3 KB
Document
General
Full URL
https://4e406dee87576dea2e9dda2919145c30.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202306220101/pubads_impl.js?cb=31075684
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.bankinfosecurity.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

accept-ranges
bytes
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
public, immutable, max-age=31536000
content-encoding
br
content-length
2653
content-type
text/html
cross-origin-opener-policy-report-only
same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy
cross-origin
date
Tue, 27 Jun 2023 02:10:40 GMT
expires
Wed, 26 Jun 2024 02:10:40 GMT
last-modified
Thu, 03 Nov 2022 19:10:08 GMT
report-to
{"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server
sffe
timing-allow-origin
*
vary
Accept-Encoding
x-content-type-options
nosniff
x-xss-protection
0
ga-audiences
www.google.com/ads/
42 B
408 B
Image
General
Full URL
https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j101&tid=UA-212197-2&cid=793751499.1687831841&jid=908799544&_u=IEBAAEAAAAAAACAAI~&z=1689629126
Requested by
Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/chinese-apt-group-uses-new-tradecraft-to-live-off-land-a-22379
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82a::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.bankinfosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 27 Jun 2023 02:10:40 GMT
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
ga-audiences
www.google.de/ads/
42 B
408 B
Image
General
Full URL
https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j101&tid=UA-212197-2&cid=793751499.1687831841&jid=908799544&_u=IEBAAEAAAAAAACAAI~&z=1689629126
Requested by
Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/chinese-apt-group-uses-new-tradecraft-to-live-off-land-a-22379
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:831::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.bankinfosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 27 Jun 2023 02:10:40 GMT
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
img.gif
b.6sc.co/v1/beacon/
43 B
484 B
Image
General
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=8cde4267f2ac828e1ae5d1fbcd5ef992&svisitor=null&visitor=04c7f47b-0a02-4084-868c-8579f4a04d2f&session=a5cdfbdc-5a43-4db1-88be-632d70cb33b7&event=ipv6&q=%7B%22address%22%3A%222a00%3Ac98%3A2030%3Aa004%3A1%3A%3A15%22%7D&isIframe=false&m=%7B%22description%22%3A%22A%20Chinese%20state%20hacker%20is%20using%20novel%20tradecraft%20to%20gain%20initial%20access%20to%20victim%20systems%2C%20according%20to%20CrowdStrike.%20Targeted%20organizations%20include%20those%20in%20the%22%2C%22keywords%22%3A%22Crowdstrike%2C%20Microsoft%2C%20China%2C%20hacker%2C%20Zoho%22%2C%22title%22%3A%22Chinese%20APT%20Group%20Uses%20New%20Tradecraft%20to%20Live%20Off%20the%20Land%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.bankinfosecurity.com%2Fchinese-apt-group-uses-new-tradecraft-to-live-off-land-a-22379&pageViewId=cf6ed08c-aff2-4d14-81f7-d216b016f600
Requested by
Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/chinese-apt-group-uses-new-tradecraft-to-live-off-land-a-22379
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.17.100.184 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a2-17-100-184.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.bankinfosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 27 Jun 2023 02:10:40 GMT
x-content-type-options
nosniff
content-length
43
pragma
no-cache
last-modified
Tue, 05 Oct 2021 22:17:52 GMT
server
nginx/1.14.0 (Ubuntu)
etag
"615ccf10-2b"
access-control-max-age
86400
access-control-allow-methods
GET,POST
content-type
image/gif
access-control-allow-origin
cache-control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials
true
accept-ranges
bytes
access-control-allow-headers
*
expires
Wed, 19 Apr 2000 11:43:00 GMT
www.bankinfosecurity.com.json
script.crazyegg.com/pages/data-scripts/0021/2682/site/
960 B
711 B
XHR
General
Full URL
https://script.crazyegg.com/pages/data-scripts/0021/2682/site/www.bankinfosecurity.com.json?t=1
Requested by
Host: script.crazyegg.com
URL: https://script.crazyegg.com/pages/scripts/0021/2682.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:9408 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
2f788a262f282b360828f84ee2608aa7ca117831001057c8096bd72f29944795

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.bankinfosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 27 Jun 2023 02:10:40 GMT
content-encoding
gzip
cf-cache-status
HIT
age
38369
ce-version
11.5.89
content-length
440
last-modified
Mon, 26 Jun 2023 15:31:11 GMT
server
cloudflare
vary
Accept-Encoding
content-type
application/json
access-control-allow-origin
*
access-control-expose-headers
CE-Version
cache-control
public, max-age=300, s-maxage=1209600
accept-ranges
bytes
timing-allow-origin
*
cf-ray
7dda27acca4a3a9a-FRA
details
epsilon.6sense.com/v3/company/ Frame
0
0
Preflight
General
Full URL
https://epsilon.6sense.com/v3/company/details
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.93.166.220 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-54-93-166-220.eu-central-1.compute.amazonaws.com
Software
nginx /
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Headers
authorization
Access-Control-Request-Method
GET
Origin
https://www.bankinfosecurity.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

access-control-allow-credentials
true
access-control-allow-headers
authorization
access-control-allow-methods
OPTIONS,GET
access-control-allow-origin
https://www.bankinfosecurity.com
access-control-max-age
1800
date
Tue, 27 Jun 2023 02:10:40 GMT
server
nginx
details
epsilon.6sense.com/v3/company/
746 B
591 B
XHR
General
Full URL
https://epsilon.6sense.com/v3/company/details
Requested by
Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.93.166.220 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-54-93-166-220.eu-central-1.compute.amazonaws.com
Software
nginx /
Resource Hash
9b2dc2a6592abd91e0dee577ef85461138e643d96bf3f3756f7c6d856d8d5e8b

Request headers

Referer
https://www.bankinfosecurity.com/
accept-language
de-DE,de;q=0.9
Authorization
Token 7207ef3e32cb3a527876a3e90b6bf51dbd9d9339
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 27 Jun 2023 02:10:40 GMT
content-encoding
gzip
server
nginx
vary
Accept-Encoding
content-type
application/json
access-control-allow-origin
https://www.bankinfosecurity.com
access-control-allow-credentials
true
content-length
399
lounge.load.4f6c84d9c117966654eabd9c43811df4.js
c.disquscdn.com/next/embed/ Frame 9699
1 KB
1 KB
Script
General
Full URL
https://c.disquscdn.com/next/embed/lounge.load.4f6c84d9c117966654eabd9c43811df4.js
Requested by
Host: disqus.com
URL: https://disqus.com/embed/comments/?base=default&f=bankinfosecurity&t_u=https%3A%2F%2Fwww.bankinfosecurity.com%2Fchinese-apt-group-uses-new-tradecraft-to-live-off-land-a-22379&t_d=Chinese%20APT%20Group%20Uses%20New%20Tradecraft%20to%20Live%20Off%20the%20Land&t_t=Chinese%20APT%20Group%20Uses%20New%20Tradecraft%20to%20Live%20Off%20the%20Land&s_o=default
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:26db:8800:6:8656:f5c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
nginx /
Resource Hash
65186d014d673005637f3a8e9f19632396369033161adb87fd3051f986413523
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://disqus.com/embed/comments/?base=default&f=bankinfosecurity&t_u=https%3A%2F%2Fwww.bankinfosecurity.com%2Fchinese-apt-group-uses-new-tradecraft-to-live-off-land-a-22379&t_d=Chinese%20APT%20Group%20Uses%20New%20Tradecraft%20to%20Live%20Off%20the%20Land&t_t=Chinese%20APT%20Group%20Uses%20New%20Tradecraft%20to%20Live%20Off%20the%20Land&s_o=default
Origin
https://disqus.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-cache-hits
0
date
Wed, 21 Jun 2023 17:02:27 GMT
content-encoding
gzip
x-content-type-options
nosniff
via
1.1 667b60dd320c04dc9adf041517122fc2.cloudfront.net (CloudFront)
x-amz-cf-pop
MUC50-P3
age
464893
x-cache
Hit from cloudfront
cross-origin-resource-policy
cross-origin
content-length
624
x-xss-protection
1; mode=block
x-served-by
static-web-2
surrogate-key
next
last-modified
Wed, 21 Jun 2023 16:51:48 GMT
server
nginx
etag
"64932aa4-270"
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000, public, immutable, no-transform
timing-allow-origin
*
x-amz-cf-id
VN5cC3U7By0jfn7PPW9NhKHc2kuvGVS8dbjxKf8iytr_UUGv_-qd3A==
expires
Thu, 20 Jun 2024 17:02:27 GMT
view
securepubads.g.doubleclick.net/pcs/ Frame F284
0
0
Fetch
General
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjssxgJw6SG0G5S_d7JPacn047I7KsLmWnXooOEmfBQNf3AbI8wpY_fBaOeMNDNcn_aKAV2FiK8mjv0PIEwXst--VNjho5gNQiXaAH4Ddo9NhxnWm6_mTgFzIH8802jegSoFitHVsEIl8utyctHhghOTRVCS-7wqNfOMbNgpF4FYWqYHZ9Vr_p3g-rqzBAvgDLfCpssdtftW5lmKP1ZoQ6fcqyxddQZn-4Qrtprd9fJFyGdaMvuEui8sYRkENUlU2l9e9XDUHa9aplk9mr2RReCmhCUtu3P1A6OulJdJprhwLRGVvq0u0vuPqun6tcNiYY5CvZPNmiQAo8Czr50Vckc8&sai=AMfl-YSOjgOSmbp9nKK_lg8adaecWRhY9Q_wvIASzv_g79fsqFRPZ8k0SM_JHD5T2QflQK4veZC1fk74gMCVEnJRAL_JRcESOv4t4fH7nV60GcHOMJkmhxj0KAU2eiPA_pFXpLdAUIFffCCBkhKqLy4&sig=Cg0ArKJSzANDUJoTr6djEAE&uach_m=[UACH]&adurl=
Requested by
Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/chinese-apt-group-uses-new-tradecraft-to-live-off-land-a-22379
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.bankinfosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 27 Jun 2023 02:10:40 GMT
x-content-type-options
nosniff
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server
cafe
content-type
image/gif
access-control-allow-origin
*
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
private
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
x-xss-protection
0
expires
Tue, 27 Jun 2023 02:10:40 GMT
abg_lite_fy2021.js
tpc.googlesyndication.com/pagead/js/r20230620/r20110914/ Frame F284
22 KB
9 KB
Script
General
Full URL
https://tpc.googlesyndication.com/pagead/js/r20230620/r20110914/abg_lite_fy2021.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202306220101/pubads_impl.js?cb=31075684
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:803::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
81f66fb840c902b62f902bc4e27a6e3dee001d2f8babf5e767f78f16136ff0b7
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.bankinfosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Mon, 26 Jun 2023 18:49:13 GMT
content-encoding
br
x-content-type-options
nosniff
age
26487
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
9007
x-xss-protection
0
server
cafe
etag
10216374826415589524
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Mon, 10 Jul 2023 18:49:13 GMT
window_focus_fy2021.js
tpc.googlesyndication.com/pagead/js/r20230620/r20110914/client/ Frame F284
3 KB
1 KB
Script
General
Full URL
https://tpc.googlesyndication.com/pagead/js/r20230620/r20110914/client/window_focus_fy2021.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202306220101/pubads_impl.js?cb=31075684
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:803::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.bankinfosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Mon, 26 Jun 2023 15:02:48 GMT
content-encoding
br
x-content-type-options
nosniff
age
40072
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
1236
x-xss-protection
0
server
cafe
etag
15004572836499977866
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Mon, 10 Jul 2023 15:02:48 GMT
rx_lidar.js
www.googletagservices.com/activeview/js/current/ Frame F284
179 KB
56 KB
Script
General
Full URL
https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202306220101/pubads_impl.js?cb=31075684
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
cdd152da46fe3cee3e804d967f5dead6756bfb9698b157766bbbdc0ab5ce9b0c
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.bankinfosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 27 Jun 2023 02:10:40 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
57261
x-xss-protection
0
server
sffe
cross-origin-opener-policy
same-origin; report-to="active-view-scs-read-write-acl"
etag
"1687779365227900"
vary
Accept-Encoding
report-to
{"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type
text/javascript
cache-control
private, max-age=3000
accept-ranges
bytes
timing-allow-origin
*
expires
Tue, 27 Jun 2023 02:10:40 GMT
17395049339061330183
tpc.googlesyndication.com/simgad/ Frame F284
29 KB
29 KB
Image
General
Full URL
https://tpc.googlesyndication.com/simgad/17395049339061330183
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202306220101/pubads_impl.js?cb=31075684
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:803::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
72fa757c7c54440cb310386a9671755ee9f201e116dc8627dfb30c357ebc7e73
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.bankinfosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Mon, 26 Jun 2023 02:57:23 GMT
x-content-type-options
nosniff
age
83597
x-dns-prefetch-control
off
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
29350
x-xss-protection
0
last-modified
Mon, 26 Jun 2023 02:32:53 GMT
server
sffe
report-to
{"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="content-ads-owners"
expires
Tue, 25 Jun 2024 02:57:23 GMT
view
securepubads.g.doubleclick.net/pcs/ Frame FD1B
0
0
Fetch
General
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjstQp11d9fZBedobTh9YW5KTiNnUbBy2L41wQmDCNBeaH7SZljh8EQ59hMcJPhySJz9YIB302Nn51Yrd99-uPO9Sw14qKlXZWpConMaThGO4NnvJ9j_JzrnnlHS3u8kW9U-i5iGbt_yYERoaBRLVYD9-Y0fgAQZ4-2SPjySd7QRYoIGZIjppbegDAG00-TGk_3nWRTPZFSSrUXRI8ACjczJcznBJUsHCj_Xgp-mdu0Ywvr4JxmZNmTG5bi6kWbKWqofmE1GaQyyjkfhtdlIK5pG2mDsRVzh14D1rulPBhhKHqzXe1hdUHGW4UTgxBB5mfUzfhrzQXcH1zG-gjn0BptkrvSPC&sai=AMfl-YRjICjyp7h5diEaPMJA0JifSpxaIqkavXR0LDWkKWn_WR1yDyZtcvXV91JyRe1AAYCZkE4RBQDqCzPDyo6prWtNDNjH5p-nkuoJ3c395mql0TgPtKD5046U9Ug9VOdWYQle7zGPHRv_u2Wnd2s&sig=Cg0ArKJSzK7NfvyxNA5hEAE&uach_m=[UACH]&adurl=
Requested by
Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/chinese-apt-group-uses-new-tradecraft-to-live-off-land-a-22379
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.bankinfosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 27 Jun 2023 02:10:40 GMT
x-content-type-options
nosniff
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server
cafe
content-type
image/gif
access-control-allow-origin
*
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
private
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
x-xss-protection
0
expires
Tue, 27 Jun 2023 02:10:40 GMT
abg_lite_fy2021.js
tpc.googlesyndication.com/pagead/js/r20230620/r20110914/ Frame FD1B
22 KB
9 KB
Script
General
Full URL
https://tpc.googlesyndication.com/pagead/js/r20230620/r20110914/abg_lite_fy2021.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202306220101/pubads_impl.js?cb=31075684
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:803::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
81f66fb840c902b62f902bc4e27a6e3dee001d2f8babf5e767f78f16136ff0b7
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.bankinfosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Mon, 26 Jun 2023 18:49:13 GMT
content-encoding
br
x-content-type-options
nosniff
age
26487
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
9007
x-xss-protection
0
server
cafe
etag
10216374826415589524
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Mon, 10 Jul 2023 18:49:13 GMT
window_focus_fy2021.js
tpc.googlesyndication.com/pagead/js/r20230620/r20110914/client/ Frame FD1B
3 KB
1 KB
Script
General
Full URL
https://tpc.googlesyndication.com/pagead/js/r20230620/r20110914/client/window_focus_fy2021.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202306220101/pubads_impl.js?cb=31075684
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:803::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.bankinfosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Mon, 26 Jun 2023 15:02:48 GMT
content-encoding
br
x-content-type-options
nosniff
age
40072
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
1236
x-xss-protection
0
server
cafe
etag
15004572836499977866
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Mon, 10 Jul 2023 15:02:48 GMT
rx_lidar.js
www.googletagservices.com/activeview/js/current/ Frame FD1B
179 KB
56 KB
Script
General
Full URL
https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202306220101/pubads_impl.js?cb=31075684
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
cdd152da46fe3cee3e804d967f5dead6756bfb9698b157766bbbdc0ab5ce9b0c
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.bankinfosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 27 Jun 2023 02:10:40 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
57261
x-xss-protection
0
server
sffe
cross-origin-opener-policy
same-origin; report-to="active-view-scs-read-write-acl"
etag
"1687779365227900"
vary
Accept-Encoding
report-to
{"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type
text/javascript
cache-control
private, max-age=3000
accept-ranges
bytes
timing-allow-origin
*
expires
Tue, 27 Jun 2023 02:10:40 GMT
10898854310458856929
tpc.googlesyndication.com/simgad/ Frame FD1B
37 KB
37 KB
Image
General
Full URL
https://tpc.googlesyndication.com/simgad/10898854310458856929
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202306220101/pubads_impl.js?cb=31075684
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:803::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
8e7e5fbc9637d3993c3b658a7683b81bcc6fbeb841021d868d0795c0f4be1bed
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.bankinfosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Mon, 26 Jun 2023 02:57:23 GMT
x-content-type-options
nosniff
age
83597
x-dns-prefetch-control
off
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
37744
x-xss-protection
0
last-modified
Mon, 26 Jun 2023 02:32:53 GMT
server
sffe
report-to
{"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="content-ads-owners"
expires
Tue, 25 Jun 2024 02:57:23 GMT
view
securepubads.g.doubleclick.net/pcs/ Frame 072B
0
0
Fetch
General
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvU71KAECttiyrqHTRlKse2_k5RfEBBnaEGTfEmS4vlLu61b2rsJ5XxljT0fKIlA_aUBmYL7Jq_7pucNZVeKVakL6Sw8o-MkN8lPI-yXjTOYcb6LdtzZdqUj52mgjn2ZmBCLCjpnZm8M4y55aiu__FVvmFFlWQMPLNq5YjpqhbDkXwrZNClTIlO38tpDzRaJKd_cajWBZtMRHhIhtERdB8T7Xr2l2uenSovYTfq-pDcKPvxhgt4p7UNmeNccShdzM5JVZJc1fZjPRDyOmj2UyQ_7Y1cPYxJ9fGzN8geWgHk-M9DK56F7fu6MP0LXEo67IIx3lDZg1eCLyy_bkzxUyIQaUCpGfI&sai=AMfl-YSCL8R8sTMHpeAYyLRbdJPiXf8vdlSIgnllmh4Y_LGn7f4N1eqofMa1EMLiX7CAsDXw7a7b50v2ricBPiqez4hn8qNO4ZiaPXFqb90XqvXZCYBXij5Oi56lc7027Q7pWgCp4eeXg6F55hJzJ3s&sig=Cg0ArKJSzPgdhzmNSvDmEAE&uach_m=[UACH]&adurl=
Requested by
Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/chinese-apt-group-uses-new-tradecraft-to-live-off-land-a-22379
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.bankinfosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 27 Jun 2023 02:10:40 GMT
x-content-type-options
nosniff
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server
cafe
content-type
image/gif
access-control-allow-origin
*
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
private
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
x-xss-protection
0
expires
Tue, 27 Jun 2023 02:10:40 GMT
abg_lite_fy2021.js
tpc.googlesyndication.com/pagead/js/r20230620/r20110914/ Frame 072B
22 KB
9 KB
Script
General
Full URL
https://tpc.googlesyndication.com/pagead/js/r20230620/r20110914/abg_lite_fy2021.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202306220101/pubads_impl.js?cb=31075684
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:803::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
81f66fb840c902b62f902bc4e27a6e3dee001d2f8babf5e767f78f16136ff0b7
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.bankinfosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Mon, 26 Jun 2023 18:49:13 GMT
content-encoding
br
x-content-type-options
nosniff
age
26487
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
9007
x-xss-protection
0
server
cafe
etag
10216374826415589524
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Mon, 10 Jul 2023 18:49:13 GMT
window_focus_fy2021.js
tpc.googlesyndication.com/pagead/js/r20230620/r20110914/client/ Frame 072B
3 KB
1 KB
Script
General
Full URL
https://tpc.googlesyndication.com/pagead/js/r20230620/r20110914/client/window_focus_fy2021.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202306220101/pubads_impl.js?cb=31075684
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:803::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.bankinfosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Mon, 26 Jun 2023 15:02:48 GMT
content-encoding
br
x-content-type-options
nosniff
age
40072
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
1236
x-xss-protection
0
server
cafe
etag
15004572836499977866
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Mon, 10 Jul 2023 15:02:48 GMT
rx_lidar.js
www.googletagservices.com/activeview/js/current/ Frame 072B
179 KB
56 KB
Script
General
Full URL
https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202306220101/pubads_impl.js?cb=31075684
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
cdd152da46fe3cee3e804d967f5dead6756bfb9698b157766bbbdc0ab5ce9b0c
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.bankinfosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 27 Jun 2023 02:10:40 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
57261
x-xss-protection
0
server
sffe
cross-origin-opener-policy
same-origin; report-to="active-view-scs-read-write-acl"
etag
"1687779365227900"
vary
Accept-Encoding
report-to
{"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type
text/javascript
cache-control
private, max-age=3000
accept-ranges
bytes
timing-allow-origin
*
expires
Tue, 27 Jun 2023 02:10:40 GMT
16481584344287117447
tpc.googlesyndication.com/simgad/ Frame 072B
18 KB
18 KB
Image
General
Full URL
https://tpc.googlesyndication.com/simgad/16481584344287117447
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202306220101/pubads_impl.js?cb=31075684
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:803::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
e9946aa96be85eba684cf6ab11e5c07594281d2981749345302a992b5c11d3cd
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.bankinfosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 27 Jun 2023 02:10:40 GMT
x-content-type-options
nosniff
x-dns-prefetch-control
off
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
18602
x-xss-protection
0
last-modified
Wed, 31 May 2023 14:18:00 GMT
server
sffe
report-to
{"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="content-ads-owners"
expires
Wed, 26 Jun 2024 02:10:40 GMT
view
securepubads.g.doubleclick.net/pcs/ Frame 136A
0
0
Fetch
General
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjstZWT7DhshrYjhi9K9vuYlMNdvjdOcc9olVbHCAw3yxE-FfhTFxbO_Zrd-i0yONPg1vSC7OXOBS1CVFRg7kPOZ9mY2shZKOzns2uSyUPCODyJPADGVAoggmquCrElqsGsFyGDT15q4ZM8_3vPxW3fF14NsoAp5eP-HFOFzjZw-RkEu-aqjGt8OevKdc7rhfkwt--9g1Nkn1sJW_EF3mHVM10XBzTDU6O-PNi4xEgrFsE1mQkBlLH5YOvfIerpns1FPsf2Gjk7I2VBQPzL8obgfLzguu2il1qJ3xr0hZHlu-Y_55YXSEFikWlFzGHFiGLEAeaiWxaMSabdccMgxrCElee8aV&sai=AMfl-YRT4ylJpUv1Ux-mCKYBRHVpXjG1dw4HQKin6vxX6ebN7l0bqeofA-QB-1ZbDt4u448fMboB2n5mDeuz30P874llXA2UcFypTtbqGSqtKfgzTRbFgIvZCnxDsqMnyLt1ex5Lq-6NDQZLdMGlMi8&sig=Cg0ArKJSzKMpjC_By8ywEAE&uach_m=[UACH]&adurl=
Requested by
Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/chinese-apt-group-uses-new-tradecraft-to-live-off-land-a-22379
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.bankinfosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 27 Jun 2023 02:10:40 GMT
x-content-type-options
nosniff
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server
cafe
content-type
image/gif
access-control-allow-origin
*
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
private
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
x-xss-protection
0
expires
Tue, 27 Jun 2023 02:10:40 GMT
abg_lite_fy2021.js
tpc.googlesyndication.com/pagead/js/r20230620/r20110914/ Frame 136A
22 KB
9 KB
Script
General
Full URL
https://tpc.googlesyndication.com/pagead/js/r20230620/r20110914/abg_lite_fy2021.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202306220101/pubads_impl.js?cb=31075684
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:803::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
81f66fb840c902b62f902bc4e27a6e3dee001d2f8babf5e767f78f16136ff0b7
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.bankinfosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Mon, 26 Jun 2023 18:49:13 GMT
content-encoding
br
x-content-type-options
nosniff
age
26487
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
9007
x-xss-protection
0
server
cafe
etag
10216374826415589524
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Mon, 10 Jul 2023 18:49:13 GMT
window_focus_fy2021.js
tpc.googlesyndication.com/pagead/js/r20230620/r20110914/client/ Frame 136A
3 KB
1 KB
Script
General
Full URL
https://tpc.googlesyndication.com/pagead/js/r20230620/r20110914/client/window_focus_fy2021.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202306220101/pubads_impl.js?cb=31075684
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:803::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.bankinfosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Mon, 26 Jun 2023 15:02:48 GMT
content-encoding
br
x-content-type-options
nosniff
age
40072
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
1236
x-xss-protection
0
server
cafe
etag
15004572836499977866
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Mon, 10 Jul 2023 15:02:48 GMT
rx_lidar.js
www.googletagservices.com/activeview/js/current/ Frame 136A
179 KB
56 KB
Script
General
Full URL
https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202306220101/pubads_impl.js?cb=31075684
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
cdd152da46fe3cee3e804d967f5dead6756bfb9698b157766bbbdc0ab5ce9b0c
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.bankinfosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 27 Jun 2023 02:10:40 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
57261
x-xss-protection
0
server
sffe
cross-origin-opener-policy
same-origin; report-to="active-view-scs-read-write-acl"
etag
"1687779365227900"
vary
Accept-Encoding
report-to
{"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type
text/javascript
cache-control
private, max-age=3000
accept-ranges
bytes
timing-allow-origin
*
expires
Tue, 27 Jun 2023 02:10:40 GMT
13410157052909889607
tpc.googlesyndication.com/simgad/ Frame 136A
68 KB
68 KB
Image
General
Full URL
https://tpc.googlesyndication.com/simgad/13410157052909889607
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202306220101/pubads_impl.js?cb=31075684
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:803::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
15433c147fa5773cc659a2c0fb85d95fab7b0e381721090c9d8209410cdd4b93
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.bankinfosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Mon, 26 Jun 2023 03:39:45 GMT
x-content-type-options
nosniff
age
81055
x-dns-prefetch-control
off
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
69902
x-xss-protection
0
last-modified
Mon, 26 Jun 2023 02:32:52 GMT
server
sffe
report-to
{"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="content-ads-owners"
expires
Tue, 25 Jun 2024 03:39:45 GMT
view
securepubads.g.doubleclick.net/pcs/ Frame 09E2
0
0
Fetch
General
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsthPtWr_8IxRde8zPNK77m89VvdQKsYULmWIDLx7PM6InqBFTRsVwlncoF17g9GL1b_mI08erqQ-cX3rkWv6vfyhkJ96GOS1LCu9Y5BZBVScir8v_1msz4NsW0nQA6bQIitJ0f14bZt6zz0YiBiWB1wdyLzvjpJ75GkbkkQf4oN7YEnnbkepi--9WItFx9dhYQS2DGOhOpT4EIfJMQJ_mHrCrRPFgBG4syEXyGqyJJ9GuXUIxPoef9PMbfH7Gx3FtTc592kMHGkPE1vwUTq4Y1MKfhbpRjgx7V2yfTCsPcsDiO73D8i1cZDNloCUA0Obt5Iw3-2QHJJ8Km5xv3vox4pYTc&sai=AMfl-YTKMUFf_hHDeEnnCsdUqtUUQB5XZTFKUgdKztfZsm8B6Ma8jTi1adJW97zp-R0ypB6XnVkHxg5FzklqfP9kaqvmNR2lboftSfei5zrsfSnTHs0CuVJKmqPYW1v9-B27TtPQgW_TcN805JNUZbc&sig=Cg0ArKJSzENBryZfnR_uEAE&uach_m=[UACH]&adurl=
Requested by
Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/chinese-apt-group-uses-new-tradecraft-to-live-off-land-a-22379
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.bankinfosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 27 Jun 2023 02:10:40 GMT
x-content-type-options
nosniff
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server
cafe
content-type
image/gif
access-control-allow-origin
*
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
private
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
x-xss-protection
0
expires
Tue, 27 Jun 2023 02:10:40 GMT
abg_lite_fy2021.js
tpc.googlesyndication.com/pagead/js/r20230620/r20110914/ Frame 09E2
22 KB
9 KB
Script
General
Full URL
https://tpc.googlesyndication.com/pagead/js/r20230620/r20110914/abg_lite_fy2021.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202306220101/pubads_impl.js?cb=31075684
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:803::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
81f66fb840c902b62f902bc4e27a6e3dee001d2f8babf5e767f78f16136ff0b7
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.bankinfosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Mon, 26 Jun 2023 18:49:13 GMT
content-encoding
br
x-content-type-options
nosniff
age
26487
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
9007
x-xss-protection
0
server
cafe
etag
10216374826415589524
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Mon, 10 Jul 2023 18:49:13 GMT
window_focus_fy2021.js
tpc.googlesyndication.com/pagead/js/r20230620/r20110914/client/ Frame 09E2
3 KB
1 KB
Script
General
Full URL
https://tpc.googlesyndication.com/pagead/js/r20230620/r20110914/client/window_focus_fy2021.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202306220101/pubads_impl.js?cb=31075684
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:803::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.bankinfosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Mon, 26 Jun 2023 15:02:48 GMT
content-encoding
br
x-content-type-options
nosniff
age
40072
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
1236
x-xss-protection
0
server
cafe
etag
15004572836499977866
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Mon, 10 Jul 2023 15:02:48 GMT
rx_lidar.js
www.googletagservices.com/activeview/js/current/ Frame 09E2
179 KB
56 KB
Script
General
Full URL
https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202306220101/pubads_impl.js?cb=31075684
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
cdd152da46fe3cee3e804d967f5dead6756bfb9698b157766bbbdc0ab5ce9b0c
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.bankinfosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 27 Jun 2023 02:10:40 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
57261
x-xss-protection
0
server
sffe
cross-origin-opener-policy
same-origin; report-to="active-view-scs-read-write-acl"
etag
"1687779365227900"
vary
Accept-Encoding
report-to
{"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type
text/javascript
cache-control
private, max-age=3000
accept-ranges
bytes
timing-allow-origin
*
expires
Tue, 27 Jun 2023 02:10:40 GMT
14079387446634266919
tpc.googlesyndication.com/simgad/ Frame 09E2
56 KB
56 KB
Image
General
Full URL
https://tpc.googlesyndication.com/simgad/14079387446634266919
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202306220101/pubads_impl.js?cb=31075684
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:803::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
e4dc8f9167d1856456fef1e09e3281cc2c9d192de855ff75d32939a46f1b4108
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.bankinfosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Mon, 26 Jun 2023 04:55:30 GMT
x-content-type-options
nosniff
age
76510
x-dns-prefetch-control
off
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
57189
x-xss-protection
0
last-modified
Wed, 31 May 2023 14:18:00 GMT
server
sffe
report-to
{"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="content-ads-owners"
expires
Tue, 25 Jun 2024 04:55:30 GMT
view
securepubads.g.doubleclick.net/pcs/ Frame 65F6
0
0
Fetch
General
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsuLSEzShUZUE6joB7acwNYq5wbAXozBQBXLRtcUtN5Nw3pmM_94FesrL8_7h_z7zMnPb8pxbsxyyJ6M-KGdBx16vzChJIueLMX8pAIpL_c-nyqQl82S4B_Y3YXzEWZGNee_duXYWxgCqgCU72pQJriIT3dcoB0HpnHm1GNk-gfchVpY7HQ1ofhvYsXaOcKU691v7ckr6RIjM8Qw5RaAVUYawNQ6tsNqlptK74RQXp8HwxWnxxMZS6D8G3RD0hnO1XAPS2T_TjMsXriMSt_2ErMY8AFniUSNZ-XOW6QzxStiXp0IcXny6_TiwFLVhk0jxeKq36lUFvqnQVG2TMypvVuuqA&sai=AMfl-YRvfuemNBWxg4Wi1hAaTGu0Mfl8_0tVSUnfnCuPOJ3kes-Si_LXKpI9OR83X8xIvgtOiV-E6PtRmcbBwOTq9QVcO73f9iZR5fWwZp2uzcUB7wqz_1HB3L6Vjn4zYhR_Swu8zMNJ70rMkAXf60c&sig=Cg0ArKJSzLE7CbEbmRqOEAE&uach_m=[UACH]&adurl=
Requested by
Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/chinese-apt-group-uses-new-tradecraft-to-live-off-land-a-22379
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.bankinfosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 27 Jun 2023 02:10:40 GMT
x-content-type-options
nosniff
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server
cafe
content-type
image/gif
access-control-allow-origin
*
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
private
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
x-xss-protection
0
abg_lite_fy2021.js
tpc.googlesyndication.com/pagead/js/r20230620/r20110914/ Frame 65F6
22 KB
9 KB
Script
General
Full URL
https://tpc.googlesyndication.com/pagead/js/r20230620/r20110914/abg_lite_fy2021.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202306220101/pubads_impl.js?cb=31075684
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:803::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
81f66fb840c902b62f902bc4e27a6e3dee001d2f8babf5e767f78f16136ff0b7
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.bankinfosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Mon, 26 Jun 2023 18:49:13 GMT
content-encoding
br
x-content-type-options
nosniff
age
26487
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
9007
x-xss-protection
0
server
cafe
etag
10216374826415589524
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Mon, 10 Jul 2023 18:49:13 GMT
window_focus_fy2021.js
tpc.googlesyndication.com/pagead/js/r20230620/r20110914/client/ Frame 65F6
3 KB
1 KB
Script
General
Full URL
https://tpc.googlesyndication.com/pagead/js/r20230620/r20110914/client/window_focus_fy2021.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202306220101/pubads_impl.js?cb=31075684
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:803::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.bankinfosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Mon, 26 Jun 2023 15:02:48 GMT
content-encoding
br
x-content-type-options
nosniff
age
40072
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
1236
x-xss-protection
0
server
cafe
etag
15004572836499977866
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Mon, 10 Jul 2023 15:02:48 GMT
rx_lidar.js
www.googletagservices.com/activeview/js/current/ Frame 65F6
179 KB
56 KB
Script
General
Full URL
https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202306220101/pubads_impl.js?cb=31075684
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
cdd152da46fe3cee3e804d967f5dead6756bfb9698b157766bbbdc0ab5ce9b0c
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.bankinfosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 27 Jun 2023 02:10:40 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
57261
x-xss-protection
0
server
sffe
cross-origin-opener-policy
same-origin; report-to="active-view-scs-read-write-acl"
etag
"1687779365227900"
vary
Accept-Encoding
report-to
{"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type
text/javascript
cache-control
private, max-age=3000
accept-ranges
bytes
timing-allow-origin
*
expires
Tue, 27 Jun 2023 02:10:40 GMT
14109220165712799808
tpc.googlesyndication.com/simgad/ Frame 65F6
52 KB
52 KB
Image
General
Full URL
https://tpc.googlesyndication.com/simgad/14109220165712799808
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202306220101/pubads_impl.js?cb=31075684
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:803::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
28db89fed8f9941c0121e95646258a71bf8b7d949c4ea6f68c74e480a0137309
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.bankinfosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Thu, 22 Jun 2023 00:18:17 GMT
x-content-type-options
nosniff
age
438743
x-dns-prefetch-control
off
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
53537
x-xss-protection
0
last-modified
Tue, 20 Jun 2023 15:31:51 GMT
server
sffe
report-to
{"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="content-ads-owners"
expires
Fri, 21 Jun 2024 00:18:17 GMT
truncated
/ Frame F284
217 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
d0ed4f397601c0435a8b870a821ac197137e78eb4874ae1dc3ec9f2ec64a1d44

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Type
image/png
truncated
/ Frame FD1B
214 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
f410f7fa29905bee85ed053ca8a9a8fa39dbca90e00a06ae5d5ae2cab2e3daa4

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Type
image/png
truncated
/ Frame 072B
218 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
33daca130e3db5535cd4b1392f26485c692d5e48ad36185abe0b0401131b2776

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Type
image/png
truncated
/ Frame 136A
215 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
b54c7e7ce2ef254781ac3a5dba2ebbd664016990bf5543879d48e6f1a5eb4167

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Type
image/png
truncated
/ Frame 09E2
219 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
768a132cf00c824b9b9a4a3d12e388adcc331006b6df73754799ba3dc2b9c48f

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Type
image/png
common.bundle.42272221620e218896f3973a3bb140e2.js
c.disquscdn.com/next/embed/ Frame 9699
280 KB
93 KB
Script
General
Full URL
https://c.disquscdn.com/next/embed/common.bundle.42272221620e218896f3973a3bb140e2.js
Requested by
Host: c.disquscdn.com
URL: https://c.disquscdn.com/next/embed/lounge.load.4f6c84d9c117966654eabd9c43811df4.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:26db:8800:6:8656:f5c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
nginx /
Resource Hash
d23fd6a13b657ba55789f4a8b098f72d86e253917a83af15a2e4e6ed23a9e5c9
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://disqus.com/embed/comments/?base=default&f=bankinfosecurity&t_u=https%3A%2F%2Fwww.bankinfosecurity.com%2Fchinese-apt-group-uses-new-tradecraft-to-live-off-land-a-22379&t_d=Chinese%20APT%20Group%20Uses%20New%20Tradecraft%20to%20Live%20Off%20the%20Land&t_t=Chinese%20APT%20Group%20Uses%20New%20Tradecraft%20to%20Live%20Off%20the%20Land&s_o=default
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-cache-hits
0
date
Fri, 16 Jun 2023 20:18:25 GMT
content-encoding
gzip
x-content-type-options
nosniff
via
1.1 d45f06116647d4cd21c9ad69cb1b14fc.cloudfront.net (CloudFront)
x-amz-cf-pop
MUC50-P3
age
885136
x-cache
Hit from cloudfront
cross-origin-resource-policy
cross-origin
content-length
94141
x-xss-protection
1; mode=block
x-served-by
static-web-1
surrogate-key
next
last-modified
Fri, 16 Jun 2023 20:12:30 GMT
server
nginx
etag
"648cc22e-16fbd"
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000, public, immutable, no-transform
timing-allow-origin
*
x-amz-cf-id
XA9eqmhBtqm4q1c7NN3d933ncLkN7CI8_pz-nW3bnlAZC6V2jJmHTA==
expires
Sat, 15 Jun 2024 20:18:25 GMT
view
securepubads.g.doubleclick.net/pcs/ Frame F284
0
0
Fetch
General
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsu843rRyLKSiIbLhG17V9tgWXJYe3GiUti_WrcHe-hepd6q2SnhVUxfobak0W_qo-wBfBIhwos5roGIexHRAYuCmZV-D9SvgqrVzNePOFjarr-gF7503iu3X0AVgqae_wf_9uizhTu9xZ5Y6F_ZlPEqnROr22K15ARgLpwQI1lBMMXBLIAc99NGpaq_Gj1RIDLIsx6V8ZMP8YQ5FChsMK0MMgzAcCt1o29ntR0j1z7mhmSjMf4vR458vKjgGtEU-e1hYI1c2KhwhsQfP2knWPkcPLWEEXYHDkrmSa_L0dqi06J-elE4rD5l5SVPkaE0P6FPILnsw5KUqp2bn5_uneCYfg&sai=AMfl-YS2M-sk39flZgAR950tE_lDPs6S0otCC3AJRWyzy3AsjDpjga3gZWuka9NaFEJYZiGeElDscf5YiHgZEEywh0i-xthMQ3AodVNljejhrIlu3rCRNbKg50YwiLOvYGkkA9O9b0FWLuuJMd3k1wY&sig=Cg0ArKJSzJ-FoMj071CgEAE&uach_m=[UACH]&adurl=
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.bankinfosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 27 Jun 2023 02:10:41 GMT
x-content-type-options
nosniff
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server
cafe
content-type
image/gif
access-control-allow-origin
*
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
private
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
x-xss-protection
0
expires
Tue, 27 Jun 2023 02:10:41 GMT
view
securepubads.g.doubleclick.net/pcs/ Frame 09E2
0
0
Fetch
General
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsuCxZlzc0fTsc5YyuTybrOd4XdbeYqc4TkISy8ySglRlFChOJ2WnvSBDPjmDYTfmlGHex5ip5SMN17Rfx_HedyiYcYHRwbnkDk-l3KOGVFELaZfhDZAg1ZjOO4ah9Q22--lbWCswxo5ka-bvhu8rLLXR6dVFo6fgJU2VuSdAS0l8wdyp40hla0-sUhIRR2DsITtpj16UuMh_Vq4eDJcg1lh3c4rifAOSxM9v4-vs9JI8U7cGQbESGf5fE_QiFW4-W7r-PEHxT8xEKI-WhlD5OW6zETlnh75DCPHUSZfk5BJSdvLJTQsWSYArOPwcqiDgBvHIKenHaP6FQhsTl1xky0eFIHRpw&sai=AMfl-YRcpyhHEeWAzWvrwaEtdB0hQzPAaoenuiwDwZ5cO6BGBMcUvq_wr9E22q99Tb46tFwWeTT90UwcE_Wv4zcifwM5JFXPO2GtM-hXsmrbZabZ7K9TCY_s2GV171TBJgsYxnetlvOfhZErgCayvEY&sig=Cg0ArKJSzHef7TIodC-WEAE&uach_m=[UACH]&adurl=
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.bankinfosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 27 Jun 2023 02:10:41 GMT
x-content-type-options
nosniff
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server
cafe
content-type
image/gif
access-control-allow-origin
*
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
private
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
x-xss-protection
0
expires
Tue, 27 Jun 2023 02:10:41 GMT
view
securepubads.g.doubleclick.net/pcs/ Frame 072B
0
0
Fetch
General
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsuROiModVwx0rJ6FKpbgLy3t2LI0dyZv7CiKHuw6-dDOHdKyEFWXpFVVcoVOn5oZxzq2hN38MhRG-qpZUSN297n5H2q3ozgfaYjQpHmqwTphsFmz-CqDk2YUoAZHWZsziNdWZd3ZYymDbPwu3yfOPa7_2Ni6eeoO0gE3e2eBIzn74XjilOQGlXZVTMQousuZaNNd6gIzZHoo5mOLXdJo6NDEZ4lTQ91laa2mjmdGJL_b7CPtSjEiTcc9eDrJkgMFJBRzhu1M4GggGNA8s6mT-LPzfnSURUi8k-Tg5_ORoRDGLunx_QAggND1qXrpbAVgx9NXNJTj8ByELSQAV_0o_g4l-1nTTYLpQ&sai=AMfl-YSR0yzFZbxpJeAEEHu1yrZuI6KpglrNZa4Lq_EMmmd-gMRQ0xXlLGWgTplZeQ9v2X1dN9n8U--rsPrJ-FEzt-SVkpkdJsMU9ng9FtZDVxUk-jQ1cXsDsQydNMdtT8StjDX0YLnfgzsQDdmlba8&sig=Cg0ArKJSzOl37wRpzuc9EAE&uach_m=[UACH]&adurl=
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.bankinfosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 27 Jun 2023 02:10:41 GMT
x-content-type-options
nosniff
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server
cafe
content-type
image/gif
access-control-allow-origin
*
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
private
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
x-xss-protection
0
expires
Tue, 27 Jun 2023 02:10:41 GMT
view
securepubads.g.doubleclick.net/pcs/ Frame FD1B
0
0
Fetch
General
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvxGLm6uCYMo_lOAZ_Q58_Ah2VgjOFVIwbmTMC9UNKbA_F_G94r2HuVe1TzWEHVNaaCiNd4r4r9vQ3Q6K8ZhnrCDw6OM2SuPBgYyDtrkAj0fvZ8Rw2B0SBQ5gzu2xDvJNLrAxXwP6jKchfmGBDY66-pJGe3EKmvuPTzM426UcFJs2o9rAfnKXSjEUFGqT6PREz_hLNGbMy13pgPqG7eRLoX9KReQnHNAqpL4v2KDrAMd3lb7_x3Kz-At42gI_s7NNQijLaW19iF7eOgWwcMG2Ci3jaG2J0EiSOPeuhH5NbCKGx9n01081_tDilcRpAvNkndiaySCCu8Ru8dyU1J2DBC3oAccXI&sai=AMfl-YTgpGWBlYyNM-GxlJ0u4qQakASHsT1UMug9JR08ESxpTKaRgqE6ZE9JnsOIL59j0pVB-TZ4Z_HRLaIzEPTqHtdnwh0oVZiYhnBIfk_M-w1ufdam9KRT-myFKVCsq7NmgRo9fMfCLZWCJMBkb8o&sig=Cg0ArKJSzOSOWJWWJ3jNEAE&uach_m=[UACH]&adurl=
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.bankinfosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 27 Jun 2023 02:10:41 GMT
x-content-type-options
nosniff
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server
cafe
content-type
image/gif
access-control-allow-origin
*
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
private
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
x-xss-protection
0
expires
Tue, 27 Jun 2023 02:10:41 GMT
view
securepubads.g.doubleclick.net/pcs/ Frame 136A
0
0
Fetch
General
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvS3Q-OH6jN9NvHun5KnhcVDEiEE7QhTO4KlycQDq7qLfoDfmyR_U4PnZoXLGLaI99Xne6n9fxGjAwJOCqyZGOfCtQN1V5qC4Qneq8U2qxtVrtEosSUwGuiqbScoSwtNuDpm1dpKy1wvbrJvblC8BULLIHOTpJojmccuQU93eU1dyaFmid1K28DOUOOf672XGeeI9b7TyYpMvjb8bCFVkGSZpvyOO3sliNwhAxEzPficquN5xgrxvLyOOgnuu5yymVJI54E96l7rR7DbthQiYU1ISNyr_zcX08HQah7GhD4AP3OArU9UN7UHVaVQFfT8nvfDwORemf1wwyINdTc4yS9Ve5bNQ8&sai=AMfl-YQ6icbUn7Fm0UQW6yTz09kAp57Th3G_dwtS3NNINailVgo3bdJvQIUyUlyPSWm4QGByxQpZTca8cCMuPBmyjCCVO7MXwZzpCIPLRAGzPcKX06g8l8o1qAAllDCdJK94FTS9wybj6I3oKPDwStg&sig=Cg0ArKJSzLt3cYoP-HjlEAE&uach_m=[UACH]&adurl=
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.bankinfosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 27 Jun 2023 02:10:41 GMT
x-content-type-options
nosniff
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server
cafe
content-type
image/gif
access-control-allow-origin
*
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
private
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
x-xss-protection
0
expires
Tue, 27 Jun 2023 02:10:41 GMT
view
securepubads.g.doubleclick.net/pcs/ Frame 65F6
0
0
Fetch
General
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvXx4r6Vk1J97JNmE3UrtRLupAY5B7IhZ7P7ZqQBh-A1V_seS-_6gXXWM-DTzBFgaye_jqM9UX4cNsiAOK_6_q9RSwrR87k-2ZEJpjCDEnK0WQlMem4ubeRNMXjeALWI8gvInSV8QVButzZzeueGKXw73V9uKBHBEW3xTkgPI0Nf8ULNFnCqlKjyGlfY7Fw0yHsNrII11wL0wJhpKuPt5yeCSPM9EC0weD9UFgHNFWFB87KOrpkGX-4XP7eSkUnuCnQnCmvmPpVGcRJ7Fzg0OVe0pTW0GTHkfug5ifHZzZ4fHoxbq07d_UJVOTwzgULBaFkm1ObYUwsjYbif0qeZ6qiUJgb&sai=AMfl-YQSPfT6nubEvgUv-F4vJUUIozqE6tx8AVYzpi1GxY_JLgRD22RAOrGuUDZt-ioDNr_QaRDF0yTMgoa3JvWR5p4UMn5T7NSK_1qJek2ziY6fO73MUkax8xWAb9ngHGVnFZJLxLft_Mlm8MQz6ms&sig=Cg0ArKJSzOP8Itpm1HTrEAE&uach_m=[UACH]&adurl=
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.bankinfosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 27 Jun 2023 02:10:41 GMT
x-content-type-options
nosniff
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server
cafe
content-type
image/gif
access-control-allow-origin
*
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
private
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
x-xss-protection
0
expires
Tue, 27 Jun 2023 02:10:41 GMT
lounge.dbc47866f009f9d6f1556cd58214d9a3.css
c.disquscdn.com/next/embed/styles/ Frame 9699
233 KB
33 KB
Stylesheet
General
Full URL
https://c.disquscdn.com/next/embed/styles/lounge.dbc47866f009f9d6f1556cd58214d9a3.css
Requested by
Host: c.disquscdn.com
URL: https://c.disquscdn.com/next/embed/common.bundle.42272221620e218896f3973a3bb140e2.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:26db:8800:6:8656:f5c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
nginx /
Resource Hash
61779c74768b5eb298860ceb7d7cf06f2b228fdc53df72b530490a792a5b8a59
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://disqus.com/embed/comments/?base=default&f=bankinfosecurity&t_u=https%3A%2F%2Fwww.bankinfosecurity.com%2Fchinese-apt-group-uses-new-tradecraft-to-live-off-land-a-22379&t_d=Chinese%20APT%20Group%20Uses%20New%20Tradecraft%20to%20Live%20Off%20the%20Land&t_t=Chinese%20APT%20Group%20Uses%20New%20Tradecraft%20to%20Live%20Off%20the%20Land&s_o=default
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-cache-hits
0
date
Tue, 30 May 2023 18:53:20 GMT
content-encoding
gzip
x-content-type-options
nosniff
via
1.1 d45f06116647d4cd21c9ad69cb1b14fc.cloudfront.net (CloudFront)
x-amz-cf-pop
MUC50-P3
age
2359041
x-cache
Hit from cloudfront
cross-origin-resource-policy
cross-origin
content-length
33282
x-xss-protection
1; mode=block
x-served-by
static-web-2
surrogate-key
next
last-modified
Tue, 30 May 2023 18:28:53 GMT
server
nginx
etag
"64764065-8202"
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000, public, immutable, no-transform
timing-allow-origin
*
x-amz-cf-id
81OKaUTdegfSF9V5rTat4PWr8aIbtlksXXDcvWMmkkX0nQmZ165Ylw==
expires
Wed, 29 May 2024 18:53:20 GMT
lounge.bundle.84cb4099df463f3408130c617a21ec1d.js
c.disquscdn.com/next/embed/ Frame 9699
513 KB
129 KB
Script
General
Full URL
https://c.disquscdn.com/next/embed/lounge.bundle.84cb4099df463f3408130c617a21ec1d.js
Requested by
Host: c.disquscdn.com
URL: https://c.disquscdn.com/next/embed/common.bundle.42272221620e218896f3973a3bb140e2.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:26db:8800:6:8656:f5c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
nginx /
Resource Hash
7e76e206743f8dd0f4356c42f27c2073f04ac56c69857646808d6b9c72ecab96
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://disqus.com/embed/comments/?base=default&f=bankinfosecurity&t_u=https%3A%2F%2Fwww.bankinfosecurity.com%2Fchinese-apt-group-uses-new-tradecraft-to-live-off-land-a-22379&t_d=Chinese%20APT%20Group%20Uses%20New%20Tradecraft%20to%20Live%20Off%20the%20Land&t_t=Chinese%20APT%20Group%20Uses%20New%20Tradecraft%20to%20Live%20Off%20the%20Land&s_o=default
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-cache-hits
0
date
Wed, 21 Jun 2023 17:02:27 GMT
content-encoding
gzip
x-content-type-options
nosniff
via
1.1 d45f06116647d4cd21c9ad69cb1b14fc.cloudfront.net (CloudFront)
x-amz-cf-pop
MUC50-P3
age
464894
x-cache
Hit from cloudfront
cross-origin-resource-policy
cross-origin
content-length
131018
x-xss-protection
1; mode=block
x-served-by
static-web-2
surrogate-key
next
last-modified
Wed, 21 Jun 2023 16:51:49 GMT
server
nginx
etag
"64932aa5-1ffca"
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000, public, immutable, no-transform
timing-allow-origin
*
x-amz-cf-id
n-60xlxp7JbJZSLQEHeXoOsBaebk0h7Izv_ZsQaYPUqxwnbkILuvCw==
expires
Thu, 20 Jun 2024 17:02:27 GMT
config.js
disqus.com/next/ Frame 9699
18 KB
19 KB
Script
General
Full URL
https://disqus.com/next/config.js
Requested by
Host: c.disquscdn.com
URL: https://c.disquscdn.com/next/embed/common.bundle.42272221620e218896f3973a3bb140e2.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
151.101.0.134 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
32c90e971a59e9629d1b986e9069fed8bec61a425f331c71efc3d1dbc2352e91
Security Headers
Name Value
Strict-Transport-Security max-age=300; includeSubdomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://disqus.com/embed/comments/?base=default&f=bankinfosecurity&t_u=https%3A%2F%2Fwww.bankinfosecurity.com%2Fchinese-apt-group-uses-new-tradecraft-to-live-off-land-a-22379&t_d=Chinese%20APT%20Group%20Uses%20New%20Tradecraft%20to%20Live%20Off%20the%20Land&t_t=Chinese%20APT%20Group%20Uses%20New%20Tradecraft%20to%20Live%20Off%20the%20Land&s_o=default
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Tue, 27 Jun 2023 02:10:41 GMT
Strict-Transport-Security
max-age=300; includeSubdomains
X-Content-Type-Options
nosniff
Server
nginx
Age
44
X-Frame-Options
SAMEORIGIN
p3p
CP="DSP IDC CUR ADM DELi STP NAV COM UNI INT PHY DEM"
Access-Control-Allow-Origin
*
Content-Type
application/javascript; charset=UTF-8
Cache-Control
public, stale-while-revalidate=300, s-stalewhilerevalidate=3600, max-age=60
Cross-Origin-Resource-Policy
cross-origin
Connection
keep-alive
Timing-Allow-Origin
*
Content-Length
18658
X-XSS-Protection
1; mode=block
details
disqus.com/api/3.0/forums/ Frame 9699
3 KB
4 KB
XHR
General
Full URL
https://disqus.com/api/3.0/forums/details?forum=bankinfosecurity&attach=forumFeatures&api_key=E8Uh5l5fHZ6gD8U3KycjAIAk46f68Zw7C6eW8WSjZvCLXebZ7p0r1yrYDrLilk2F
Requested by
Host: c.disquscdn.com
URL: https://c.disquscdn.com/next/embed/common.bundle.42272221620e218896f3973a3bb140e2.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
151.101.0.134 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
a2d9c309c9e6ba6279dc21f67b04f9b0525d2a72cf3a879501b11f6a0f0558bf
Security Headers
Name Value
Strict-Transport-Security max-age=300; includeSubdomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Accept
*/*
Referer
https://disqus.com/embed/comments/?base=default&f=bankinfosecurity&t_u=https%3A%2F%2Fwww.bankinfosecurity.com%2Fchinese-apt-group-uses-new-tradecraft-to-live-off-land-a-22379&t_d=Chinese%20APT%20Group%20Uses%20New%20Tradecraft%20to%20Live%20Off%20the%20Land&t_t=Chinese%20APT%20Group%20Uses%20New%20Tradecraft%20to%20Live%20Off%20the%20Land&s_o=default
X-Requested-With
XMLHttpRequest
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Tue, 27 Jun 2023 02:10:41 GMT
Strict-Transport-Security
max-age=300; includeSubdomains
X-Content-Type-Options
nosniff
Server
nginx
Age
0
X-Frame-Options
SAMEORIGIN
Vary
Origin, Cookie
p3p
CP="DSP IDC CUR ADM DELi STP NAV COM UNI INT PHY DEM"
Content-Type
application/json
Cross-Origin-Resource-Policy
cross-origin
Connection
keep-alive
Content-Length
3158
X-XSS-Protection
1; mode=block
css2
fonts.googleapis.com/ Frame 9699
11 KB
970 B
Stylesheet
General
Full URL
https://fonts.googleapis.com/css2?family=Roboto:ital,wght@0,400;0,500;0,600;0,700;1,400;1,700&display=swap
Requested by
Host: client
URL: about:client
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:828::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
4dbc45bd7ed8caf2aeeae8de34e519d874987d5285c79b5b4a93a1d670a929c4
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://disqus.com/embed/comments/?base=default&f=bankinfosecurity&t_u=https%3A%2F%2Fwww.bankinfosecurity.com%2Fchinese-apt-group-uses-new-tradecraft-to-live-off-land-a-22379&t_d=Chinese%20APT%20Group%20Uses%20New%20Tradecraft%20to%20Live%20Off%20the%20Land&t_t=Chinese%20APT%20Group%20Uses%20New%20Tradecraft%20to%20Live%20Off%20the%20Land&s_o=default
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
date
Tue, 27 Jun 2023 02:10:41 GMT
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection
0
last-modified
Tue, 27 Jun 2023 01:22:17 GMT
server
ESF
cross-origin-opener-policy
same-origin-allow-popups
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Tue, 27 Jun 2023 02:10:41 GMT
threadDetails.json
disqus.com/api/3.0/embed/ Frame 9699
36 B
463 B
XHR
General
Full URL
https://disqus.com/api/3.0/embed/threadDetails.json?thread=9750651139&api_key=E8Uh5l5fHZ6gD8U3KycjAIAk46f68Zw7C6eW8WSjZvCLXebZ7p0r1yrYDrLilk2F
Requested by
Host: c.disquscdn.com
URL: https://c.disquscdn.com/next/embed/common.bundle.42272221620e218896f3973a3bb140e2.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
151.101.0.134 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
89f4889eebc36f4ad79abb20ba84c4e8b0dac9bce1c0dfbe779ac8d5022572bd
Security Headers
Name Value
Strict-Transport-Security max-age=300; includeSubdomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Accept
*/*
Referer
https://disqus.com/embed/comments/?base=default&f=bankinfosecurity&t_u=https%3A%2F%2Fwww.bankinfosecurity.com%2Fchinese-apt-group-uses-new-tradecraft-to-live-off-land-a-22379&t_d=Chinese%20APT%20Group%20Uses%20New%20Tradecraft%20to%20Live%20Off%20the%20Land&t_t=Chinese%20APT%20Group%20Uses%20New%20Tradecraft%20to%20Live%20Off%20the%20Land&s_o=default
X-Requested-With
XMLHttpRequest
X-Disqus-Publisher-API-Key
kgLGW0evKY3stsTyDzF6Uv5Etlrt7MzZ7AWQESkvyZPev49GJCrbtByseVYlfQj6
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
X-Disqus-Remote-Auth
W10= af36c94950a61d36d197aad4192d56801750bea7 1687831838

Response headers

Date
Tue, 27 Jun 2023 02:10:41 GMT
Strict-Transport-Security
max-age=300; includeSubdomains
X-Content-Type-Options
nosniff
Server
nginx
X-Frame-Options
SAMEORIGIN
Vary
Origin, Cookie
p3p
CP="DSP IDC CUR ADM DELi STP NAV COM UNI INT PHY DEM"
Content-Type
application/json
Cross-Origin-Resource-Policy
cross-origin
Connection
keep-alive
Content-Length
36
X-XSS-Protection
1; mode=block
disqus-sso-login.png
www.bankinfosecurity.com/images/ Frame 9699
4 KB
4 KB
Image
General
Full URL
https://www.bankinfosecurity.com/images/disqus-sso-login.png
Requested by
Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/chinese-apt-group-uses-new-tradecraft-to-live-off-land-a-22379
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
50.56.167.254 , United States, ASN33070 (RMH-14, US),
Reverse DNS
Software
Apache /
Resource Hash
c15d7c72b50d4cad5e7a1fcbd75c78ded4c75eaf3ec382783a1903f88e6db1cf
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://disqus.com/embed/comments/?base=default&f=bankinfosecurity&t_u=https%3A%2F%2Fwww.bankinfosecurity.com%2Fchinese-apt-group-uses-new-tradecraft-to-live-off-land-a-22379&t_d=Chinese%20APT%20Group%20Uses%20New%20Tradecraft%20to%20Live%20Off%20the%20Land&t_t=Chinese%20APT%20Group%20Uses%20New%20Tradecraft%20to%20Live%20Off%20the%20Land&s_o=default
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Tue, 27 Jun 2023 02:10:41 GMT
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
Content-Encoding
gzip
Server
Apache
Vary
Accept-Encoding
Content-Type
image/png
Cache-Control
max-age=86400, private, must-revalidate
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=93
Content-Length
3979
svg-sprite.4da5413f5086c5755b46094b813dbfcd.svg
c.disquscdn.com/next/embed/assets/img/ Frame 9699
13 KB
13 KB
Image
General
Full URL
https://c.disquscdn.com/next/embed/assets/img/svg-sprite.4da5413f5086c5755b46094b813dbfcd.svg
Requested by
Host: c.disquscdn.com
URL: https://c.disquscdn.com/next/embed/styles/lounge.dbc47866f009f9d6f1556cd58214d9a3.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:26db:8800:6:8656:f5c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
nginx /
Resource Hash
3270642c89180c12db93775e2a774b6dadd9bd98cffc963075c85afd2c17b6e4
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://c.disquscdn.com/next/embed/styles/lounge.dbc47866f009f9d6f1556cd58214d9a3.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-cache-hits
0
date
Sat, 20 May 2023 12:57:54 GMT
via
1.1 d45f06116647d4cd21c9ad69cb1b14fc.cloudfront.net (CloudFront)
x-content-type-options
nosniff
x-amz-cf-pop
MUC50-P3
age
3244367
x-cache
Hit from cloudfront
cross-origin-resource-policy
cross-origin
content-length
13079
x-xss-protection
1; mode=block
x-served-by
static-web-1
surrogate-key
next
last-modified
Thu, 18 May 2023 20:44:46 GMT
server
nginx
etag
"64668e3e-3317"
content-type
image/svg+xml; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000, public, immutable, no-transform
accept-ranges
bytes
timing-allow-origin
*
x-amz-cf-id
rugzj-jdFCcLzifPUlqYe78JMJwm2cwB0YCrkyauZXeN77YiD8sovA==
expires
Sun, 19 May 2024 12:57:54 GMT
loader.ba7c86e8b4b6135bb668d05223f8f127.gif
c.disquscdn.com/next/embed/assets/img/ Frame 9699
3 KB
3 KB
Image
General
Full URL
https://c.disquscdn.com/next/embed/assets/img/loader.ba7c86e8b4b6135bb668d05223f8f127.gif
Requested by
Host: c.disquscdn.com
URL: https://c.disquscdn.com/next/embed/styles/lounge.dbc47866f009f9d6f1556cd58214d9a3.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:26db:8800:6:8656:f5c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
nginx /
Resource Hash
4c4491dcfa94cb46fb73742fc2caf49a1cd59027304af1830c7dc6ce1889857c
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://c.disquscdn.com/next/embed/styles/lounge.dbc47866f009f9d6f1556cd58214d9a3.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-cache-hits
0
date
Mon, 15 May 2023 04:11:29 GMT
via
1.1 d45f06116647d4cd21c9ad69cb1b14fc.cloudfront.net (CloudFront)
x-content-type-options
nosniff
x-amz-cf-pop
MUC50-P3
age
3707951
x-cache
Hit from cloudfront
cross-origin-resource-policy
cross-origin
content-length
2971
x-xss-protection
1; mode=block
x-served-by
static-web-1
surrogate-key
next
last-modified
Tue, 09 May 2023 18:32:30 GMT
server
nginx
etag
"645a91be-b9b"
content-type
image/gif
access-control-allow-origin
*
cache-control
max-age=31536000, public, immutable, no-transform
accept-ranges
bytes
timing-allow-origin
*
x-amz-cf-id
lCtKlaRN9Z1Ov-SXcTpXUYUNJCfotMoE9nw9lkoQ6MRICZnO7_-3cA==
expires
Tue, 14 May 2024 04:11:29 GMT
email.727e30eb9b6c1e85cb010b9c8eb04c7e.svg
c.disquscdn.com/next/embed/assets/img/ Frame 9699
840 B
1 KB
Image
General
Full URL
https://c.disquscdn.com/next/embed/assets/img/email.727e30eb9b6c1e85cb010b9c8eb04c7e.svg
Requested by
Host: c.disquscdn.com
URL: https://c.disquscdn.com/next/embed/styles/lounge.dbc47866f009f9d6f1556cd58214d9a3.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:26db:8800:6:8656:f5c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
nginx /
Resource Hash
0589c5845288117448d7aa710af60618b151d78efd1a2653f89a0b57f7eb3de8
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://c.disquscdn.com/next/embed/styles/lounge.dbc47866f009f9d6f1556cd58214d9a3.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-cache-hits
0
date
Mon, 22 May 2023 07:46:28 GMT
via
1.1 d45f06116647d4cd21c9ad69cb1b14fc.cloudfront.net (CloudFront)
x-content-type-options
nosniff
x-amz-cf-pop
MUC50-P3
age
3090253
x-cache
Hit from cloudfront
cross-origin-resource-policy
cross-origin
content-length
840
x-xss-protection
1; mode=block
x-served-by
static-web-2
surrogate-key
next
last-modified
Thu, 18 May 2023 20:44:46 GMT
server
nginx
etag
"64668e3e-348"
content-type
image/svg+xml; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000, public, immutable, no-transform
accept-ranges
bytes
timing-allow-origin
*
x-amz-cf-id
Z-6bkDCVne1KIAAKYwp-oRaNJE5b7ZWd5ahh1DHTmTCCdJ-HNWtnxQ==
expires
Tue, 21 May 2024 07:46:28 GMT
privacy.8c96be6b50de1c3fab838c5f050e0be5.svg
c.disquscdn.com/next/embed/assets/img/ Frame 9699
891 B
1 KB
Image
General
Full URL
https://c.disquscdn.com/next/embed/assets/img/privacy.8c96be6b50de1c3fab838c5f050e0be5.svg
Requested by
Host: c.disquscdn.com
URL: https://c.disquscdn.com/next/embed/styles/lounge.dbc47866f009f9d6f1556cd58214d9a3.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:26db:8800:6:8656:f5c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
nginx /
Resource Hash
068753b8f09b32ad8a3283199c7252090d0076a56924df724dda72828ae31b95
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://c.disquscdn.com/next/embed/styles/lounge.dbc47866f009f9d6f1556cd58214d9a3.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-cache-hits
0
date
Fri, 12 May 2023 01:14:12 GMT
via
1.1 d45f06116647d4cd21c9ad69cb1b14fc.cloudfront.net (CloudFront)
x-content-type-options
nosniff
x-amz-cf-pop
MUC50-P3
age
3977789
x-cache
Hit from cloudfront
cross-origin-resource-policy
cross-origin
content-length
891
x-xss-protection
1; mode=block
x-served-by
static-web-2
surrogate-key
next
last-modified
Tue, 09 May 2023 18:32:30 GMT
server
nginx
etag
"645a91be-37b"
content-type
image/svg+xml; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000, public, immutable, no-transform
accept-ranges
bytes
timing-allow-origin
*
x-amz-cf-id
RD22Lv-suPryUyWqUk6zAzn243XsGVm6BC7ORphDd03fG-KNt5_6GA==
expires
Sat, 11 May 2024 01:14:12 GMT
warning.3bc0b4bff6c268a4ceaf404014b9be42.svg
c.disquscdn.com/next/embed/assets/img/ Frame 9699
605 B
1 KB
Image
General
Full URL
https://c.disquscdn.com/next/embed/assets/img/warning.3bc0b4bff6c268a4ceaf404014b9be42.svg
Requested by
Host: c.disquscdn.com
URL: https://c.disquscdn.com/next/embed/styles/lounge.dbc47866f009f9d6f1556cd58214d9a3.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:26db:8800:6:8656:f5c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
nginx /
Resource Hash
a657bedd3bc0c106f7cfa5fe6556a0b7e175870d33bd7da9ef67ffcffbafda69
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://c.disquscdn.com/next/embed/styles/lounge.dbc47866f009f9d6f1556cd58214d9a3.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-cache-hits
0
date
Fri, 19 May 2023 05:10:26 GMT
via
1.1 d45f06116647d4cd21c9ad69cb1b14fc.cloudfront.net (CloudFront)
x-content-type-options
nosniff
x-amz-cf-pop
MUC50-P3
age
3358815
x-cache
Hit from cloudfront
cross-origin-resource-policy
cross-origin
content-length
605
x-xss-protection
1; mode=block
x-served-by
static-web-1
surrogate-key
next
last-modified
Thu, 18 May 2023 20:44:46 GMT
server
nginx
etag
"64668e3e-25d"
content-type
image/svg+xml; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000, public, immutable, no-transform
accept-ranges
bytes
timing-allow-origin
*
x-amz-cf-id
jpIjCArjDBfTQW98S3mzn9BF3n4cNfEoQ4Cw06y2Ieoteq0m2ErQGA==
expires
Sat, 18 May 2024 05:10:26 GMT
sprite.ad630a07080a45451f139a7487853ff8.png
c.disquscdn.com/next/embed/assets/img/ Frame 9699
2 KB
2 KB
Image
General
Full URL
https://c.disquscdn.com/next/embed/assets/img/sprite.ad630a07080a45451f139a7487853ff8.png
Requested by
Host: c.disquscdn.com
URL: https://c.disquscdn.com/next/embed/styles/lounge.dbc47866f009f9d6f1556cd58214d9a3.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:26db:8800:6:8656:f5c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
nginx /
Resource Hash
9714221c828961b20f45a782c3281c0596f6652cfe1299bee18097f98e8fb7b3
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://c.disquscdn.com/next/embed/styles/lounge.dbc47866f009f9d6f1556cd58214d9a3.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-cache-hits
0
date
Tue, 09 May 2023 02:17:05 GMT
via
1.1 d45f06116647d4cd21c9ad69cb1b14fc.cloudfront.net (CloudFront)
x-content-type-options
nosniff
x-amz-cf-pop
MUC50-P3
age
4233216
x-cache
Hit from cloudfront
cross-origin-resource-policy
cross-origin
content-length
1763
x-xss-protection
1; mode=block
x-served-by
static-web-1
surrogate-key
next
last-modified
Fri, 05 May 2023 08:10:53 GMT
server
nginx
etag
"6454ba0d-6e3"
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=31536000, public, immutable, no-transform
accept-ranges
bytes
timing-allow-origin
*
x-amz-cf-id
p-kvCQd5RjRw2t9JHezlymC0TmHLLeWiA9ofgQ9rRGZHb034HqQlTA==
expires
Wed, 08 May 2024 02:17:05 GMT
icons.4cc7a703d2fdfe684151ff8ac24d45f1.woff2
c.disquscdn.com/next/embed/assets/font/ Frame 9699
8 KB
8 KB
Font
General
Full URL
https://c.disquscdn.com/next/embed/assets/font/icons.4cc7a703d2fdfe684151ff8ac24d45f1.woff2
Requested by
Host: c.disquscdn.com
URL: https://c.disquscdn.com/next/embed/styles/lounge.dbc47866f009f9d6f1556cd58214d9a3.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:26db:8800:6:8656:f5c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
nginx /
Resource Hash
f2a341fc815d45c21da726d4c843c2c5d3e1f333465347c3c75d040d556df4e5
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://c.disquscdn.com/next/embed/styles/lounge.dbc47866f009f9d6f1556cd58214d9a3.css
Origin
https://disqus.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-cache-hits
0
date
Tue, 09 May 2023 18:27:36 GMT
via
1.1 667b60dd320c04dc9adf041517122fc2.cloudfront.net (CloudFront)
x-content-type-options
nosniff
x-amz-cf-pop
MUC50-P3
age
4174985
x-cache
Hit from cloudfront
cross-origin-resource-policy
cross-origin
content-length
7900
x-xss-protection
1; mode=block
x-served-by
static-web-1
surrogate-key
next
last-modified
Fri, 05 May 2023 08:10:53 GMT
server
nginx
etag
"6454ba0d-1edc"
content-type
application/octet-stream
access-control-allow-origin
*
cache-control
max-age=31536000, public, immutable, no-transform
accept-ranges
bytes
timing-allow-origin
*
x-amz-cf-id
NyKI7ZZBSbp8uDBJHba949GKIpoYaIeifEwWeAo-T__KKoGOwwSdJQ==
expires
Wed, 08 May 2024 18:27:36 GMT
realtime.b23ff3c36dd0169627f8e54ca1621eca.css
c.disquscdn.com/next/embed/styles/ Frame 3C8C
337 B
839 B
Stylesheet
General
Full URL
https://c.disquscdn.com/next/embed/styles/realtime.b23ff3c36dd0169627f8e54ca1621eca.css
Requested by
Host: bankinfosecurity.disqus.com
URL: https://bankinfosecurity.disqus.com/embed.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:26db:8800:6:8656:f5c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
nginx /
Resource Hash
c284dcb06ef882b1b45e11e0a16baa223b4117eca94e243c8e725c4ce3f909b3
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.bankinfosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-cache-hits
0
date
Thu, 18 May 2023 12:15:40 GMT
content-encoding
gzip
x-content-type-options
nosniff
via
1.1 d45f06116647d4cd21c9ad69cb1b14fc.cloudfront.net (CloudFront)
x-amz-cf-pop
MUC50-P3
age
3419701
x-cache
Hit from cloudfront
cross-origin-resource-policy
cross-origin
content-length
244
x-xss-protection
1; mode=block
x-served-by
static-web-1
surrogate-key
next
last-modified
Wed, 17 May 2023 16:02:42 GMT
server
nginx
etag
"6464faa2-f4"
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000, public, immutable, no-transform
timing-allow-origin
*
x-amz-cf-id
FLGtgbTeIGsSUnscHJECpnzZ6wKGfS5J1sEgFH1-W-hRe9n0l6MxSQ==
expires
Fri, 17 May 2024 12:15:40 GMT
realtime.b23ff3c36dd0169627f8e54ca1621eca.css
c.disquscdn.com/next/embed/styles/ Frame FABF
337 B
839 B
Stylesheet
General
Full URL
https://c.disquscdn.com/next/embed/styles/realtime.b23ff3c36dd0169627f8e54ca1621eca.css
Requested by
Host: bankinfosecurity.disqus.com
URL: https://bankinfosecurity.disqus.com/embed.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:26db:8800:6:8656:f5c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
nginx /
Resource Hash
c284dcb06ef882b1b45e11e0a16baa223b4117eca94e243c8e725c4ce3f909b3
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.bankinfosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-cache-hits
0
date
Thu, 18 May 2023 12:15:40 GMT
content-encoding
gzip
x-content-type-options
nosniff
via
1.1 d45f06116647d4cd21c9ad69cb1b14fc.cloudfront.net (CloudFront)
x-amz-cf-pop
MUC50-P3
age
3419701
x-cache
Hit from cloudfront
cross-origin-resource-policy
cross-origin
content-length
244
x-xss-protection
1; mode=block
x-served-by
static-web-1
surrogate-key
next
last-modified
Wed, 17 May 2023 16:02:42 GMT
server
nginx
etag
"6464faa2-f4"
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000, public, immutable, no-transform
timing-allow-origin
*
x-amz-cf-id
xSJLVWkgyxnI86mhxs2vkrUV58SlRuYIEls2zfUw92R8GynyClDNsg==
expires
Fri, 17 May 2024 12:15:40 GMT
KFOlCnqEu92Fr1MmWUlfBBc4.woff2
fonts.gstatic.com/s/roboto/v30/ Frame 9699
15 KB
16 KB
Font
General
Full URL
https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmWUlfBBc4.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Roboto:ital,wght@0,400;0,500;0,600;0,700;1,400;1,700&display=swap
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:806::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
f5aebdfea35d1e7656ef4acc5db1f243209755ae3300943ef8fc6280f363c860
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://disqus.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Sat, 24 Jun 2023 17:04:15 GMT
x-content-type-options
nosniff
age
205586
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
15860
x-xss-protection
0
last-modified
Wed, 11 May 2022 19:24:42 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Sun, 23 Jun 2024 17:04:15 GMT
KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v30/ Frame 9699
15 KB
15 KB
Font
General
Full URL
https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Roboto:ital,wght@0,400;0,500;0,600;0,700;1,400;1,700&display=swap
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:806::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://disqus.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Sat, 24 Jun 2023 03:30:27 GMT
x-content-type-options
nosniff
age
254414
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
15744
x-xss-protection
0
last-modified
Wed, 11 May 2022 19:24:48 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Sun, 23 Jun 2024 03:30:27 GMT
KFOlCnqEu92Fr1MmEU9fBBc4.woff2
fonts.gstatic.com/s/roboto/v30/ Frame 9699
16 KB
16 KB
Font
General
Full URL
https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmEU9fBBc4.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Roboto:ital,wght@0,400;0,500;0,600;0,700;1,400;1,700&display=swap
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:806::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
b019538234514166ec7665359d097403358f8a4c991901983922fb4d56989f1e
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://disqus.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Sat, 24 Jun 2023 01:50:32 GMT
x-content-type-options
nosniff
age
260409
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
15920
x-xss-protection
0
last-modified
Wed, 11 May 2022 19:24:45 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Sun, 23 Jun 2024 01:50:32 GMT
KFOkCnqEu92Fr1Mu51xIIzI.woff2
fonts.gstatic.com/s/roboto/v30/ Frame 9699
17 KB
17 KB
Font
General
Full URL
https://fonts.gstatic.com/s/roboto/v30/KFOkCnqEu92Fr1Mu51xIIzI.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Roboto:ital,wght@0,400;0,500;0,600;0,700;1,400;1,700&display=swap
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:806::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
db0424fb67fb52e7e538490240cc7fb9c05aa076333a4968f3dee30b825dabf9
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://disqus.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Wed, 21 Jun 2023 15:43:49 GMT
x-content-type-options
nosniff
age
469612
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
17368
x-xss-protection
0
last-modified
Wed, 11 May 2022 19:24:42 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Thu, 20 Jun 2024 15:43:49 GMT
KFOjCnqEu92Fr1Mu51TzBic6CsQ.woff2
fonts.gstatic.com/s/roboto/v30/ Frame 9699
17 KB
17 KB
Font
General
Full URL
https://fonts.gstatic.com/s/roboto/v30/KFOjCnqEu92Fr1Mu51TzBic6CsQ.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Roboto:ital,wght@0,400;0,500;0,600;0,700;1,400;1,700&display=swap
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:806::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
6be97ca17228a69c406231d89c003194c3dfba7401eaa9fe9e9ed0ef1c18dc38
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://disqus.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Sat, 24 Jun 2023 16:54:27 GMT
x-content-type-options
nosniff
age
206174
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
17032
x-xss-protection
0
last-modified
Wed, 11 May 2022 19:24:52 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Sun, 23 Jun 2024 16:54:27 GMT
bis-hdr.desktop.r2.js
www.bankinfosecurity.com/javascripts-responsive/
2 KB
979 B
Script
General
Full URL
https://www.bankinfosecurity.com/javascripts-responsive/bis-hdr.desktop.r2.js
Requested by
Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/chinese-apt-group-uses-new-tradecraft-to-live-off-land-a-22379
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
50.56.167.254 , United States, ASN33070 (RMH-14, US),
Reverse DNS
Software
Apache /
Resource Hash
a952a44375a3d8c869e96f85505fcbae076f4226021f08676a1b4627152252d0
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.bankinfosecurity.com/chinese-apt-group-uses-new-tradecraft-to-live-off-land-a-22379
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Tue, 27 Jun 2023 02:10:41 GMT
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
Content-Encoding
gzip
Server
Apache
Vary
Accept-Encoding
Content-Type
application/javascript
Cache-Control
max-age=86400, private, must-revalidate
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=92
Content-Length
595
sodar
pagead2.googlesyndication.com/getconfig/
15 KB
11 KB
XHR
General
Full URL
https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gpt&tv=m202306220101&st=env
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202306220101/pubads_impl.js?cb=31075684
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
2f086e760d4621d65cd9ca4236cb101dc36828332b20d34e7911fa56c55dcdfb
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.bankinfosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 27 Jun 2023 02:10:41 GMT
content-encoding
br
x-content-type-options
nosniff
server
cafe
content-type
application/json; charset=UTF-8
access-control-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
11296
x-xss-protection
0
truncated
/ Frame 65F6
209 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
19ff6bce34e148f91cac2fb048d8473da48ee3090392d85cbb4ae31f51bb0e8c

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Type
image/png
sodar2.js
tpc.googlesyndication.com/sodar/
17 KB
6 KB
Script
General
Full URL
https://tpc.googlesyndication.com/sodar/sodar2.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202306220101/pubads_impl.js?cb=31075684
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:803::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.bankinfosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 27 Jun 2023 02:10:41 GMT
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
6386
x-xss-protection
0
server
sffe
cross-origin-opener-policy
same-origin; report-to="adspam-signals-scs"
etag
"1637097310169751"
vary
Accept-Encoding
report-to
{"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type
text/javascript
cache-control
private, max-age=3000
accept-ranges
bytes
expires
Tue, 27 Jun 2023 02:10:41 GMT
event.gif
referrer.disqus.com/juggler/ Frame 9699
43 B
339 B
Image
General
Full URL
https://referrer.disqus.com/juggler/event.gif?abe=0&embed_hidden=0&load_time=286&event=init_embed&thread=9750651139&forum=bankinfosecurity&forum_id=1538940&imp=77v82gh1spj0bt&thread_slug=chinese_apt_group_uses_new_tradecraft_to_live_off_the_land&user_type=anon&referrer=https%3A%2F%2Fwww.bankinfosecurity.com%2F&theme=next&dnt=0&tracking_enabled=0&experiment=network_default_hidden&variant=fallthrough&service=dynamic&promoted_enabled=false&max_enabled=false
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
199.232.196.134 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://disqus.com/embed/comments/?base=default&f=bankinfosecurity&t_u=https%3A%2F%2Fwww.bankinfosecurity.com%2Fchinese-apt-group-uses-new-tradecraft-to-live-off-land-a-22379&t_d=Chinese%20APT%20Group%20Uses%20New%20Tradecraft%20to%20Live%20Off%20the%20Land&t_t=Chinese%20APT%20Group%20Uses%20New%20Tradecraft%20to%20Live%20Off%20the%20Land&s_o=default
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Tue, 27 Jun 2023 02:10:41 GMT
X-Content-Type-Options
nosniff
Last-Modified
Mon, 28 Sep 1970 06:00:00 GMT
Server
nginx
Content-Type
image/gif
Cross-Origin-Resource-Policy
cross-origin
Connection
keep-alive
Content-Length
43
X-XSS-Protection
1; mode=block
runner.html
tpc.googlesyndication.com/sodar/sodar2/225/ Frame 2F45
13 KB
5 KB
Document
General
Full URL
https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:803::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.bankinfosecurity.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

accept-ranges
bytes
age
39162
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
public, max-age=31536000
content-encoding
gzip
content-length
5046
content-type
text/html
cross-origin-opener-policy
same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy
cross-origin
date
Mon, 26 Jun 2023 15:17:59 GMT
expires
Tue, 25 Jun 2024 15:17:59 GMT
last-modified
Mon, 21 Jun 2021 20:47:05 GMT
report-to
{"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server
sffe
vary
Accept-Encoding
x-content-type-options
nosniff
x-xss-protection
0
aframe
www.google.com/recaptcha/api2/ Frame C77E
783 B
973 B
Document
General
Full URL
https://www.google.com/recaptcha/api2/aframe
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82a::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
GSE /
Resource Hash
7038c44fa2093af9acc4caf329b2255290992ca1395f1fadd7cffa2b0cf67af8
Security Headers
Name Value
Content-Security-Policy script-src 'report-sample' 'nonce-9j9THRLCSMwjKVgLX6x6jQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.bankinfosecurity.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
private, max-age=300
content-encoding
gzip
content-length
515
content-security-policy
script-src 'report-sample' 'nonce-9j9THRLCSMwjKVgLX6x6jQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type
text/html; charset=utf-8
cross-origin-embedder-policy
require-corp
cross-origin-resource-policy
cross-origin
date
Tue, 27 Jun 2023 02:10:41 GMT
expires
Tue, 27 Jun 2023 02:10:41 GMT
report-to
{"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server
GSE
x-content-type-options
nosniff
x-xss-protection
1; mode=block
YTnPKPJ-Q--T2AJ4Qj25FxWmw7bAoVXE9zhtz1eN5hc.js
pagead2.googlesyndication.com/bg/ Frame 2F45
37 KB
14 KB
Script
General
Full URL
https://pagead2.googlesyndication.com/bg/YTnPKPJ-Q--T2AJ4Qj25FxWmw7bAoVXE9zhtz1eN5hc.js
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
6139cf28f27e43ef93d80278423db91715a6c3b6c0a155c4f7386dcf578de617
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://tpc.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Mon, 26 Jun 2023 10:30:33 GMT
content-encoding
br
x-content-type-options
nosniff
age
56408
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
14704
x-xss-protection
0
last-modified
Mon, 19 Jun 2023 09:38:00 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="botguard-scs"
vary
Accept-Encoding
report-to
{"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Tue, 25 Jun 2024 10:30:33 GMT
sodar
pagead2.googlesyndication.com/pagead/ Frame C77E
0
0
Image
General
Full URL
https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&li=gpt_m202306220101&jk=4188951840722999&rc=
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.google.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

generate_204
tpc.googlesyndication.com/ Frame 2F45
0
10 B
Image
General
Full URL
https://tpc.googlesyndication.com/generate_204?KIOeWA
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:803::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 27 Jun 2023 02:10:41 GMT
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
img.gif
b.6sc.co/v1/beacon/
43 B
484 B
Image
General
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=8cde4267f2ac828e1ae5d1fbcd5ef992&svisitor=null&visitor=04c7f47b-0a02-4084-868c-8579f4a04d2f&session=a5cdfbdc-5a43-4db1-88be-632d70cb33b7&event=active_time_track&q=%7B%22currentTime%22%3A%22Tue%2C%2027%20Jun%202023%2002%3A10%3A41%20GMT%22%2C%22lastTrackTime%22%3A%22Tue%2C%2027%20Jun%202023%2002%3A10%3A40%20GMT%22%2C%22timeSpent%22%3A%221004%22%2C%22totalTimeSpent%22%3A%221004%22%7D&isIframe=false&m=%7B%22description%22%3A%22A%20Chinese%20state%20hacker%20is%20using%20novel%20tradecraft%20to%20gain%20initial%20access%20to%20victim%20systems%2C%20according%20to%20CrowdStrike.%20Targeted%20organizations%20include%20those%20in%20the%22%2C%22keywords%22%3A%22Crowdstrike%2C%20Microsoft%2C%20China%2C%20hacker%2C%20Zoho%22%2C%22title%22%3A%22Chinese%20APT%20Group%20Uses%20New%20Tradecraft%20to%20Live%20Off%20the%20Land%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.bankinfosecurity.com%2Fchinese-apt-group-uses-new-tradecraft-to-live-off-land-a-22379&pageViewId=cf6ed08c-aff2-4d14-81f7-d216b016f600
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.17.100.184 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a2-17-100-184.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.bankinfosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 27 Jun 2023 02:10:41 GMT
x-content-type-options
nosniff
content-length
43
pragma
no-cache
last-modified
Fri, 21 Feb 2020 18:57:20 GMT
server
nginx/1.14.0 (Ubuntu)
etag
"5e502810-2b"
access-control-max-age
86400
access-control-allow-methods
GET,POST
content-type
image/gif
access-control-allow-origin
cache-control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials
true
accept-ranges
bytes
access-control-allow-headers
*
expires
Wed, 19 Apr 2000 11:43:00 GMT
activeview
pagead2.googlesyndication.com/pcs/ Frame F284
42 B
174 B
Fetch
General
Full URL
https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjstbclTTrUs-qAGwvZcFRlVklIDoUpsPldIFa2v32yhmVMFrkdUejEF6h71YZtHptwf5-t-JJ91EiBpiVaWK7ivhc0N2pOyRhJXPhyK_LcttaEJO611b&sig=Cg0ArKJSzGo-fJdPQwOEEAE&id=lidar2&mcvt=1000&p=71,636,161,1364&mtos=1000,1000,1000,1000,1000&tos=1000,0,0,0,0&v=20230626&bin=7&avms=nio&bs=1600,1200&mc=1&vu=1&app=0&itpl=3&adk=606436291&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ%3D%3D&vs=4&r=v&rst=1687831840899&rpt=132&isd=0&lsd=0&met=mue&wmsd=0&pbe=0&vae=0&spb=0&ffslot=0&reach=0&io2=0
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.bankinfosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 27 Jun 2023 02:10:42 GMT
x-content-type-options
nosniff
server
cafe
content-type
image/gif
access-control-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
activeview
pagead2.googlesyndication.com/pcs/ Frame FD1B
42 B
108 B
Fetch
General
Full URL
https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjstFa9W8YN1O-TTzqONHaDzx5t85jPZo1jn85KdBhqEdK_BD2VmOSvy_oAdtVRkI-kb5m6QjVZUk1uevjXMiNEbfGWYzTCo7iiKPVSA8HxV2wOP9sCPH&sig=Cg0ArKJSzBlX5zYmlygSEAE&id=lidar2&mcvt=1002&p=589,1040,839,1340&mtos=1002,1002,1002,1002,1002&tos=1002,0,0,0,0&v=20230626&bin=7&avms=nio&bs=1600,1200&mc=1&vu=1&app=0&itpl=3&adk=592806581&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ%3D%3D&vs=4&r=v&rst=1687831840912&rpt=168&isd=0&lsd=0&met=mue&wmsd=0&pbe=0&vae=0&spb=0&ffslot=0&reach=0&io2=0
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.bankinfosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 27 Jun 2023 02:10:42 GMT
x-content-type-options
nosniff
server
cafe
content-type
image/gif
access-control-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
sodar
pagead2.googlesyndication.com/pagead/
0
0
Image
General
Full URL
https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&t=2&li=gpt_m202306220101&jk=4188951840722999&bg=!sLOls-fNAAYQ3eRoMN07ADkAdvg8WhUvQvGi87MqwmpNdqUacNJBmrcWpufGQKXvdL-O2zEOaaDePbX7X4L_iJnyMMbawcAgqrYCAAAAQ1IAAAADaAEHmQKi83KzQYA7v1mLrkImTvqmvOXoQ8LYnm7ZFkCAPTOGhZjS_s35EVLUSQ-ZhCWlUCX6iWU1f0q32w8aCNMBJubd_xO6tMsJG5aErKusXph1nr3GcKji2OQHeE5KEnnspmJcRwLP4g9Ly0zHbz8k443CAs6umuLO4H4Sn6naKyzXlSb4t5sGPH_SJ2UZZrLfbHP-jR3ZuqQ-3o8RYaVyx8XmwbBHoMGjVqDalJnnq9LHoMAxju9rW03HJApIjkajjIqX1MySaFSKNxVpnZ_cpB9WbX6jkLsrad9l96aq5aLio4oh4uFmePaCTQU97WVVepDYOvkA-Pmc5OMxp3VR3bfvZ0LXVLF2tvV_Kp4YtRMZqNa48MXPPlTv83ytom2pjMzY26PeGC41zcctv1Le6L49WRyXXI3XCiD90rkCMVfX7VgNBQGb5qk7a_ESebXJWyosGSTe5KBaLV45_so0mBnSYA5mE6c9jGB593hePywgmhl7F73HvVU3H7KFKySy4dvDk4ff-xStuqqmdmr17Wjx68cDuVCE8FLmTWuR-KFTGX2ab7X8zx12MZMgEUy7dXV9o1eGUbDkVLAFiTl1S2qqERht_U01x6tjHQH_Jk_kIehwiZHHYP_7dC2S0Tafd4XRiLDvNTWa4_v4l2Q9DiK8_n9OfXoPxMo4qJ3jcIS3H4KEAgTEOBzobU2LZPnoQcmdm2Xg_PO0dlINKrmuDvYAl7TB7Jt4ydA9npq-D4BDfeYwizcVYZSU10NYQHArX3lYwp9GJK2GJPZ_n0HF34G3t8SKAkbAUJDF-V31eeGacrgIICG30uF2YFUJTRHY6I2RJ_d4WKoB3wgwQkVibfUF2Ie_YXn6hZ_pyz6Nrt7IKIgTeaQs6LtK3v1SXhrRdW1_N9s
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.bankinfosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

activeview
pagead2.googlesyndication.com/pcs/ Frame 65F6
42 B
64 B
Fetch
General
Full URL
https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjssYZZ3QHcycpGqNk0jfPKa3zuJgCBvnlPqRFLt4g7lpYgRo_Yn-VkVE92ibGcN2Dd1cXNquHrn2q4zLNbO3xm0j_OZGq8uM89aoaQyFB7QiI-cgNKu-&sig=Cg0ArKJSzFgcDS_UBtDZEAE&id=lidar2&mcvt=1000&p=0,0,480,640&mtos=1000,1000,1000,1000,1000&tos=1000,0,0,0,0&v=20230626&bin=7&avms=nio&bs=1600,1200&mc=1&vu=1&app=0&itpl=3&adk=3082656849&rs=4&la=1&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ%3D%3D&vs=4&r=v&rst=1687831840959&rpt=152&isd=0&lsd=0&met=mue&wmsd=0&pbe=0&vae=0&spb=0&ffslot=0&reach=0&io2=0
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.bankinfosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 27 Jun 2023 02:10:42 GMT
x-content-type-options
nosniff
server
cafe
content-type
image/gif
access-control-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
img.gif
b.6sc.co/v1/beacon/
43 B
485 B
Image
General
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=8cde4267f2ac828e1ae5d1fbcd5ef992&svisitor=null&visitor=04c7f47b-0a02-4084-868c-8579f4a04d2f&session=a5cdfbdc-5a43-4db1-88be-632d70cb33b7&event=active_time_track&q=%7B%22currentTime%22%3A%22Tue%2C%2027%20Jun%202023%2002%3A10%3A42%20GMT%22%2C%22lastTrackTime%22%3A%22Tue%2C%2027%20Jun%202023%2002%3A10%3A41%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%222005%22%7D&isIframe=false&m=%7B%22description%22%3A%22A%20Chinese%20state%20hacker%20is%20using%20novel%20tradecraft%20to%20gain%20initial%20access%20to%20victim%20systems%2C%20according%20to%20CrowdStrike.%20Targeted%20organizations%20include%20those%20in%20the%22%2C%22keywords%22%3A%22Crowdstrike%2C%20Microsoft%2C%20China%2C%20hacker%2C%20Zoho%22%2C%22title%22%3A%22Chinese%20APT%20Group%20Uses%20New%20Tradecraft%20to%20Live%20Off%20the%20Land%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.bankinfosecurity.com%2Fchinese-apt-group-uses-new-tradecraft-to-live-off-land-a-22379&pageViewId=cf6ed08c-aff2-4d14-81f7-d216b016f600
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.17.100.184 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a2-17-100-184.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.bankinfosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 27 Jun 2023 02:10:42 GMT
x-content-type-options
nosniff
content-length
43
pragma
no-cache
last-modified
Sat, 18 Feb 2023 01:45:17 GMT
server
nginx/1.14.0 (Ubuntu)
etag
"63f02dad-2b"
access-control-max-age
86400
access-control-allow-methods
GET,POST
content-type
image/gif
access-control-allow-origin
cache-control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials
true
accept-ranges
bytes
access-control-allow-headers
*
expires
Wed, 19 Apr 2000 11:43:00 GMT
img.gif
b.6sc.co/v1/beacon/
43 B
485 B
Image
General
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=8cde4267f2ac828e1ae5d1fbcd5ef992&svisitor=null&visitor=04c7f47b-0a02-4084-868c-8579f4a04d2f&session=a5cdfbdc-5a43-4db1-88be-632d70cb33b7&event=active_time_track&q=%7B%22currentTime%22%3A%22Tue%2C%2027%20Jun%202023%2002%3A10%3A43%20GMT%22%2C%22lastTrackTime%22%3A%22Tue%2C%2027%20Jun%202023%2002%3A10%3A42%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%223006%22%7D&isIframe=false&m=%7B%22description%22%3A%22A%20Chinese%20state%20hacker%20is%20using%20novel%20tradecraft%20to%20gain%20initial%20access%20to%20victim%20systems%2C%20according%20to%20CrowdStrike.%20Targeted%20organizations%20include%20those%20in%20the%22%2C%22keywords%22%3A%22Crowdstrike%2C%20Microsoft%2C%20China%2C%20hacker%2C%20Zoho%22%2C%22title%22%3A%22Chinese%20APT%20Group%20Uses%20New%20Tradecraft%20to%20Live%20Off%20the%20Land%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.bankinfosecurity.com%2Fchinese-apt-group-uses-new-tradecraft-to-live-off-land-a-22379&pageViewId=cf6ed08c-aff2-4d14-81f7-d216b016f600
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.17.100.184 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a2-17-100-184.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.bankinfosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 27 Jun 2023 02:10:43 GMT
x-content-type-options
nosniff
content-length
43
pragma
no-cache
last-modified
Sat, 05 Jun 2021 07:56:05 GMT
server
nginx/1.14.0 (Ubuntu)
etag
"60bb2e15-2b"
access-control-max-age
86400
access-control-allow-methods
GET,POST
content-type
image/gif
access-control-allow-origin
cache-control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials
true
accept-ranges
bytes
access-control-allow-headers
*
expires
Wed, 19 Apr 2000 11:43:00 GMT
img.gif
b.6sc.co/v1/beacon/
43 B
485 B
Image
General
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=8cde4267f2ac828e1ae5d1fbcd5ef992&svisitor=null&visitor=04c7f47b-0a02-4084-868c-8579f4a04d2f&session=a5cdfbdc-5a43-4db1-88be-632d70cb33b7&event=active_time_track&q=%7B%22currentTime%22%3A%22Tue%2C%2027%20Jun%202023%2002%3A10%3A44%20GMT%22%2C%22lastTrackTime%22%3A%22Tue%2C%2027%20Jun%202023%2002%3A10%3A43%20GMT%22%2C%22timeSpent%22%3A%221002%22%2C%22totalTimeSpent%22%3A%224008%22%7D&isIframe=false&m=%7B%22description%22%3A%22A%20Chinese%20state%20hacker%20is%20using%20novel%20tradecraft%20to%20gain%20initial%20access%20to%20victim%20systems%2C%20according%20to%20CrowdStrike.%20Targeted%20organizations%20include%20those%20in%20the%22%2C%22keywords%22%3A%22Crowdstrike%2C%20Microsoft%2C%20China%2C%20hacker%2C%20Zoho%22%2C%22title%22%3A%22Chinese%20APT%20Group%20Uses%20New%20Tradecraft%20to%20Live%20Off%20the%20Land%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.bankinfosecurity.com%2Fchinese-apt-group-uses-new-tradecraft-to-live-off-land-a-22379&pageViewId=cf6ed08c-aff2-4d14-81f7-d216b016f600
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.17.100.184 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a2-17-100-184.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.bankinfosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 27 Jun 2023 02:10:44 GMT
x-content-type-options
nosniff
content-length
43
pragma
no-cache
last-modified
Sat, 18 Feb 2023 02:04:22 GMT
server
nginx/1.14.0 (Ubuntu)
etag
"63f03226-2b"
access-control-max-age
86400
access-control-allow-methods
GET,POST
content-type
image/gif
access-control-allow-origin
cache-control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials
true
accept-ranges
bytes
access-control-allow-headers
*
expires
Wed, 19 Apr 2000 11:43:00 GMT
collect
region1.google-analytics.com/g/
0
54 B
Ping
General
Full URL
https://region1.google-analytics.com/g/collect?v=2&tid=G-2RK1HGW2E4&gtm=45je36q0&_p=755552529&cid=793751499.1687831841&ul=en-us&sr=1600x1200&ir=1&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_eu=kA&ngs=1&_s=2&sid=1687831840&sct=1&seg=0&dl=https%3A%2F%2Fwww.bankinfosecurity.com%2Fchinese-apt-group-uses-new-tradecraft-to-live-off-land-a-22379&dt=Chinese%20APT%20Group%20Uses%20New%20Tradecraft%20to%20Live%20Off%20the%20Land&en=impression&ep.event_category=dailyemailupdates&ep.event_label=&_et=35
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-2RK1HGW2E4&l=dataLayer&cx=c
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:4860:4802:34::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.bankinfosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 27 Jun 2023 02:10:45 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://www.bankinfosecurity.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
img.gif
b.6sc.co/v1/beacon/
43 B
484 B
Image
General
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=8cde4267f2ac828e1ae5d1fbcd5ef992&svisitor=null&visitor=04c7f47b-0a02-4084-868c-8579f4a04d2f&session=a5cdfbdc-5a43-4db1-88be-632d70cb33b7&event=active_time_track&q=%7B%22currentTime%22%3A%22Tue%2C%2027%20Jun%202023%2002%3A10%3A45%20GMT%22%2C%22lastTrackTime%22%3A%22Tue%2C%2027%20Jun%202023%2002%3A10%3A44%20GMT%22%2C%22timeSpent%22%3A%221000%22%2C%22totalTimeSpent%22%3A%225008%22%7D&isIframe=false&m=%7B%22description%22%3A%22A%20Chinese%20state%20hacker%20is%20using%20novel%20tradecraft%20to%20gain%20initial%20access%20to%20victim%20systems%2C%20according%20to%20CrowdStrike.%20Targeted%20organizations%20include%20those%20in%20the%22%2C%22keywords%22%3A%22Crowdstrike%2C%20Microsoft%2C%20China%2C%20hacker%2C%20Zoho%22%2C%22title%22%3A%22Chinese%20APT%20Group%20Uses%20New%20Tradecraft%20to%20Live%20Off%20the%20Land%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.bankinfosecurity.com%2Fchinese-apt-group-uses-new-tradecraft-to-live-off-land-a-22379&pageViewId=cf6ed08c-aff2-4d14-81f7-d216b016f600
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.17.100.184 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a2-17-100-184.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.bankinfosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 27 Jun 2023 02:10:45 GMT
x-content-type-options
nosniff
content-length
43
pragma
no-cache
last-modified
Tue, 05 Oct 2021 22:17:52 GMT
server
nginx/1.14.0 (Ubuntu)
etag
"615ccf10-2b"
access-control-max-age
86400
access-control-allow-methods
GET,POST
content-type
image/gif
access-control-allow-origin
cache-control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials
true
accept-ranges
bytes
access-control-allow-headers
*
expires
Wed, 19 Apr 2000 11:43:00 GMT
collect
region1.google-analytics.com/g/
0
17 B
Ping
General
Full URL
https://region1.google-analytics.com/g/collect?v=2&tid=G-XJ8Q4QGGRH&gtm=45je36q0&_p=755552529&cid=793751499.1687831841&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_s=2&sid=1687831840&sct=1&seg=0&dl=https%3A%2F%2Fwww.bankinfosecurity.com%2Fchinese-apt-group-uses-new-tradecraft-to-live-off-land-a-22379&dt=Chinese%20APT%20Group%20Uses%20New%20Tradecraft%20to%20Live%20Off%20the%20Land&en=6sense&ep.asset_type=article22379&ep.asset_categories=420%2C409%2C93%2C524%2C515%2C431%2C467%2C476&ep.asset_keywords_1=Crowdstrike%2C%20Microsoft%2C%20China%2C%20hacker%2C%20Zoho&ep.asset_keywords_2=&ep.asset_keywords_3=&ep.asset_keywords_4=&ep.asset_keywords_5=&ep.asset_keywords_6=&ep.asset_keywords_7=&ep.asset_keywords_8=&ep.asset_keywords_9=&ep.asset_keywords_10=&_et=401&up.company_name_6s=&up.confidence_6s=Low&up.naics_6s=&up.domain_6s=
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-XJ8Q4QGGRH&l=dataLayer&cx=c
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2001:4860:4802:34::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.bankinfosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 27 Jun 2023 02:10:45 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://www.bankinfosecurity.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Verdicts & Comments Add Verdict or Comment

204 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| 1 object| 2 object| 3 object| 4 object| 5 object| 6 object| 7 object| 8 object| 9 object| 10 object| 11 object| 12 boolean| credentialless object| onbeforetoggle object| onscrollend function| $ function| jQuery object| jQuery19103814751040478732 object| mejs function| MediaElement object| HtmlMediaElement function| onYouTubePlayerAPIReady function| DefaultPlayer function| MediaElementPlayer number| mce-data-1h3t9s0u1 object| tinyMCE object| tinymce function| des function| des_createKeys function| stringToHex function| hexToString function| readCookie function| disqus_config object| googletag object| top_banner_display object| ensBootstraps object| Bootstrapper object| dataLayer function| importScript function| cleanExistingScript function| refreshJavascript string| base_url string| base_url_auto string| ssl_base string| services_url string| includes_url object| video_intro object| audio_data boolean| rsa_page boolean| ceo_page boolean| interview_page boolean| article_page boolean| is_gatedasset number| videoAskLoginTime number| videoStart boolean| identified_user object| identified_user_data object| gaKeywords string| gaCategories number| videoGA4EventTime1 number| videoGA4EventTime3 boolean| display_videologin string| current_page string| session_id boolean| user_is_acq object| login_reload_pages object| scrollTopPages string| popup_to_open string| marketo_contact_identification_ajax object| all_states object| all_countries_with_states string| webinar_auto_click_register string| webinar_auto_click_register_slot string| __family__ boolean| exclude_pre_roll object| user_email number| ENTER_KEY object| article_video_caption_id object| highlight number| show_subtitles_speakers string| caption_speakers string| register_source boolean| player_is_running boolean| videoGA4Event1Saved boolean| videoGA4Event2Saved boolean| videoGA4Event3Saved boolean| interviewGA4Event1Saved boolean| interviewGA4Event2Saved undefined| opened_modal undefined| do_hashchange function| closeCookieTerms function| uncheckGroupInputs function| submitFormPopup function| setMembershipPrices function| updatePriceBox function| forgotPassword function| generateHash2w function| login function| register function| pagination function| scrollTO function| showAlert function| assetPrequalSubmit function| addToBriefcase function| toggleDdlsByValue function| populateStates function| registerFormShowErrors function| recordLead function| initAudio function| initVideos function| initVideoScrolling function| resizeVideoPlayer function| removePlayerFromSidebar function| togglePrePostTime function| jumpSlide function| initVideoEvents function| URLToObj function| timedPopUpCount function| initAutoPopups function| initAJAXpopups function| checkClassicPopupPrequalErrors function| submitPopupAction function| saveToMyJobs function| initEmailSubscriptionsValidation function| emailSubscriptionsUncheckAll function| showPopupOnDemand function| sendAssetEmail function| displayChallengeText function| runStrikesOnMKTLeadIdentification object| st object| __stdos__ boolean| tpcCookiesEnableCheckingDone boolean| tpcCookiesEnabledStatus function| __sharethis__docReady object| __sharethis__ object| ua_fields function| mediaMetadataNavigation number| width function| isMobile boolean| isDesktop function| addClassToMenuItem function| addClassToDropDown function| removeClassFromMenuItem function| removeClassFromDropDown function| clearDropDowns function| showDropDown function| hideDropDown function| showDropDown2 function| hideDropDown2 string| disqus_shortname string| disqus_url string| GoogleAnalyticsObject function| ga object| _ml function| CE_READY string| _bizo_data_partner_id string| _linkedin_partner_id object| _linkedin_data_partner_ids function| lintrk object| _6si number| top_banner_display_interval object| jQBrowser boolean| pp_alreadyInitialized boolean| doresize object| scroll_pos string| url boolean| hashtag object| google_tag_manager object| google_tag_data function| processEpsilonData string| epsilonName boolean| enabled function| callback number| version object| ggeac object| google_js_reporting_queue object| DISQUS object| gaplugins object| gaGlobal object| gaData function| onYouTubeIframeAPIReady boolean| notifications function| mktoMunchkinFunction object| Munchkin function| mktoMunchkin boolean| _already_called_lintrk object| MunchkinTracker undefined| google_measure_js_timing function| processGoogleToken object| googleToken object| googleIMState number| google_unique_id boolean| CE_USER_SCRIPT object| CE2 string| CE_USER_SITE_DATA_URL string| CE_USER_DATA_URL boolean| _storagePopulated string| CE_USER_COMMON_SCRIPT_URL undefined| CE_USER_THIRDPARTY_SCRIPT_URL object| GoogleGcLKhOms function| showSearch function| hideSearch object| google_image_requests

24 Cookies

Domain/Path Name / Value
www.bankinfosecurity.com/ Name: PHPSESSID
Value: 0hfc9v8psjj7k0a8hj0agc2nbu
www.bankinfosecurity.com/ Name: _advert
Value: false
www.bankinfosecurity.com/ Name: visitorip
Value: 37.58.58.245
.bankinfosecurity.com/ Name: _gid
Value: GA1.2.176277998.1687831841
.bankinfosecurity.com/ Name: _gat
Value: 1
.bankinfosecurity.com/ Name: _gat_newTracker
Value: 1
.bankinfosecurity.com/ Name: _ga
Value: GA1.1.793751499.1687831841
.bankinfosecurity.com/ Name: _ga_2RK1HGW2E4
Value: GS1.1.1687831840.1.0.1687831840.0.0.0
www.bankinfosecurity.com/ Name: _gd_visitor
Value: 04c7f47b-0a02-4084-868c-8579f4a04d2f
www.bankinfosecurity.com/ Name: _gd_session
Value: a5cdfbdc-5a43-4db1-88be-632d70cb33b7
.bankinfosecurity.com/ Name: _mkto_trk
Value: id:051-ZXI-237&token:_mch-bankinfosecurity.com-1687831840658-76648
www.bankinfosecurity.com/ Name: ln_or
Value: eyIyMzMwOTMwLDc0OSI6ImQifQ%3D%3D
.linkedin.com/ Name: li_sugr
Value: c5ef43c1-bfa4-49fa-9b98-8dc0503a31fb
.linkedin.com/ Name: bcookie
Value: "v=2&945f21e5-3192-4e30-8d56-43be0a960d7b"
.linkedin.com/ Name: lidc
Value: "b=VGST08:s=V:r=V:a=V:p=V:g=2617:u=1:x=1:i=1687831840:t=1687918240:v=2:sig=AQFi-wlG5Uo2YknrlDjtOUSgJ73AgSY_"
.bankinfosecurity.com/ Name: __gads
Value: ID=6058ec636eb19fc4:T=1687831840:RT=1687831840:S=ALNI_Maz0IFkzHuwGKE0z10GhqjTnJyHjg
.bankinfosecurity.com/ Name: __gpi
Value: UID=00000c3487ff5e9f:T=1687831840:RT=1687831840:S=ALNI_MbxGh7Pe8kdrxgWwvTbOFI-dy4FdQ
.linkedin.com/ Name: UserMatchHistory
Value: AQIqWIj1P02ijAAAAYj6nghYg1cGAN9wtp192iItInL3qOPFFfjtHTfK0UKCyg9vTb2Zh-Z3s_GvlA
.linkedin.com/ Name: AnalyticsSyncHistory
Value: AQLH_qYKaCNwbgAAAYj6nghY4XjVoLbvg3MIZKg3WGxjtZy08pK2EmYmVMFpAOCEhhCacyU19alahcNpFgxDTw
.6sc.co/ Name: 6suuid
Value: b4641102a063010020459a64a503000008c4b000
.bankinfosecurity.com/ Name: _ga_XJ8Q4QGGRH
Value: GS1.1.1687831840.1.0.1687831840.0.0.0
.doubleclick.net/ Name: IDE
Value: AHWqTUngf2X1PvI3t-YmtbgPS8W0y5RJmsNJEyxONP6cbGfxB2kBYAOU3RYigVl4elA
.www.linkedin.com/ Name: bscookie
Value: "v=1&20230627021041d258045a-5ddc-43c1-87e0-2fef839d4dccAQGQGufx3uQfuCIvddgE1OPzIwNMnQ7N"
.linkedin.com/ Name: li_gc
Value: MTswOzE2ODc4MzE4NDE7MjswMjGlVyjhYvBe7kEOzukSwS/tZk3uZLYNPB3FWMVQ2CnMkA==

1 Console Messages

Source Level URL
Text
network error URL: https://www.bankinfosecurity.com/javascripts-responsive/vendor/modernizr.js?s=1687831838.6541
Message:
Failed to load resource: the server responded with a status of 404 (Not Found)

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Strict-Transport-Security max-age=63072000

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

0267f973c7f511eda6a4-193e28812cee85d6e20ea22afb83e185.ssl.cf1.rackcdn.com
051-zxi-237.mktoresp.com
130e178e8f8ba617604b-8aedd782b7d22cfe0d1146da69a52436.ssl.cf1.rackcdn.com
21aaef15263171502b5a-3fc6a64a094676b060fa7dc8c4490be9.ssl.cf1.rackcdn.com
4a7efb2d53317100f611-1d7064c4f7b6de25658a4199efb34975.ssl.cf1.rackcdn.com
4e406dee87576dea2e9dda2919145c30.safeframe.googlesyndication.com
6d63d49ccb7c52435540-5070aa97eaa2b8df4eb5a91600e69901.ssl.cf1.rackcdn.com
752b069ec945bee67d86-1021436e05aad7b2347bf3096cc7e309.ssl.cf1.rackcdn.com
75d03c5f1bfbbbb9cc13-369a671ebb934b49b239e372822005c5.ssl.cf1.rackcdn.com
adservice.google.com
b.6sc.co
bankinfosecurity.disqus.com
buttons-config.sharethis.com
c.6sc.co
c.disquscdn.com
cdn.linkedin.oribi.io
dbac8a2e962120c65098-4d6abce208e5e17c2085b466b98c2083.ssl.cf1.rackcdn.com
disqus.com
dnn506yrbagrg.cloudfront.net
epsilon.6sense.com
f5bd7c2823d8d0533dcb-62d55445ed2ff88556926faa498f48fa.ssl.cf1.rackcdn.com
fa94d5c47256403c613d-7164cafcaac68bfd3318486ab257f999.ssl.cf1.rackcdn.com
fonts.googleapis.com
fonts.gstatic.com
in.ml314.com
ipv6.6sc.co
j.6sc.co
l.sharethis.com
ml314.com
munchkin.marketo.net
nexus.ensighten.com
pagead2.googlesyndication.com
pbs.twimg.com
platform-api.sharethis.com
platform-cdn.sharethis.com
px.ads.linkedin.com
px4.ads.linkedin.com
referrer.disqus.com
region1.google-analytics.com
script.crazyegg.com
securepubads.g.doubleclick.net
sjs.bizographics.com
snap.licdn.com
stats.g.doubleclick.net
tpc.googlesyndication.com
worker.ismgcorp.com
www.bankinfosecurity.com
www.google-analytics.com
www.google.com
www.google.de
www.googletagmanager.com
www.googletagservices.com
www.linkedin.com
104.130.251.6
13.107.42.14
13.32.23.57
13.32.99.34
151.101.0.134
184.30.16.143
192.28.147.68
199.232.192.134
199.232.196.134
2.17.100.184
2001:4860:4802:34::36
23.206.100.200
2600:9000:2057:600:1d:85c3:6640:93a1
2600:9000:26da:200:c:abe:f440:93a1
2600:9000:26db:8800:6:8656:f5c0:93a1
2600:9000:26db:fc00:2:53b2:240:93a1
2606:2800:134:1a0d:1429:742:782:b6
2606:4700::6813:9408
2620:1ec:21::14
2a00:1450:4001:803::2001
2a00:1450:4001:806::2002
2a00:1450:4001:806::2003
2a00:1450:4001:80f::2002
2a00:1450:4001:811::200e
2a00:1450:4001:828::200a
2a00:1450:4001:829::2008
2a00:1450:4001:82a::2001
2a00:1450:4001:82a::2002
2a00:1450:4001:82a::2004
2a00:1450:4001:830::2002
2a00:1450:4001:831::2003
2a00:1450:400c:c0c::9d
2a02:26f0:3100::1735:28a8
2a02:26f0:3100::1735:28c0
2a02:26f0:ab00::214:8e70
34.111.234.236
35.158.33.255
50.56.167.254
52.20.71.154
54.93.166.220
65.9.66.72
00ad09aae591af794f681fd401c5025da35b44c131e20ad263b854164a8c6e85
00f307d7a013d85e23132a122a7caaa908d6736512adf6f4c1b59788bf3dd98b
0284b9bfe4f14587be4717e5cd330029477c991add2232945c5a7e15b7d0699b
02b4c1e0e73903f2145529f409eebc12aa3a2d82ea394efa3ef087cf8f1b4ba5
02c252c05ac201f6546a542fdd0b40545de727710fd8544f807bb35cbaf89f32
046f0918fc9faeb5cce32d33a94180b8032db60619642eac71db41bcb3bff6e0
04d304d7ee49ac157f146382a46f02a666279bd7f29074f50e863b88f2affae9
0589c5845288117448d7aa710af60618b151d78efd1a2653f89a0b57f7eb3de8
068753b8f09b32ad8a3283199c7252090d0076a56924df724dda72828ae31b95
09bbed0d4841d1b1b5df95504ef8e54d487ec069ef30a3166888201e0477d82e
0fd28fece9ebd606b8b071460ebd3fc2ed7bc7a66ef91c8834f11dfacab4a849
121b58c4179ff5a0d261fbb85e38a5a4b0b90afad8e3b2bca573d86faf8e75ee
123e7ddaacd2b7b4bb165ab3c29869973933e5f4debaae247da11522fe85398a
12dd40a3b07049494f1146a175b1d67611b5a7699bbf0bafcb2fd1eae96f5aad
15433c147fa5773cc659a2c0fb85d95fab7b0e381721090c9d8209410cdd4b93
15e30b5370b0dfa91752f324a330ea998ebfaf0b7a8ffe749d77582014e3f517
19ff6bce34e148f91cac2fb048d8473da48ee3090392d85cbb4ae31f51bb0e8c
1a0bbdba57f90a60fef89419fc940d8eae55c5b0d12ecbadde2beaef32ab2d90
1edbdbe7dd4c59e2fef20ef8dc4615a18d116fdf43daf018dce46a93e6cb153e
1f02740954f421a1ce6ad2064a644c1ac65b592f3f3fbf12fc36e39b01869868
20d983725a28705f154c9a1440a19573a34e1c8b779866452d556aa36c6cfa57
2268b1d927116d04d3e2ef05e2c553ed82a3a8865530a2d764cae005854cb208
23f95a90d6e6ba09a92bd4eae99823b0a6b0137a9abe10e3c050c062fb15efe4
2410eb6ce15c2386b260ac6366e9b22bb3fe19fb0f7bca727df233e6ee39b2b7
247d04c4d14c60a79c16245a74a792a662f9e7adf784d68edd4520a35ec90251
256a489beea4a14eca458f6e5436758f1fcb8dd34034d3c36dd21b22a5841f3b
26c05d915c6b49300b3b12ea85263fb1a65fcf2c62b03f1c45121f5bd43af993
2825e209bff20491277f30470767ae04daff595b611fc6cbdc524edf5c4cb382
28db89fed8f9941c0121e95646258a71bf8b7d949c4ea6f68c74e480a0137309
2f086e760d4621d65cd9ca4236cb101dc36828332b20d34e7911fa56c55dcdfb
2f788a262f282b360828f84ee2608aa7ca117831001057c8096bd72f29944795
3059f92e36a564c5cbcedc195f764e3c55c8cf919c84129c5f202870e7026b61
3086c49956d51c2cba2562ba86a083aedf01d66f41c264f158f5d4f6e632c3eb
3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5
3270642c89180c12db93775e2a774b6dadd9bd98cffc963075c85afd2c17b6e4
32c90e971a59e9629d1b986e9069fed8bec61a425f331c71efc3d1dbc2352e91
33daca130e3db5535cd4b1392f26485c692d5e48ad36185abe0b0401131b2776
35ea875420833eea83b7015a613753400af890484415c3341e0c3b6a595412a5
3642c7e774562f7483d7b0de93dd1759fc6928e85eebd7e62ddae72e9d46c9cb
39520329caed7b6cd60a945da725e448a17fdd7a19975c94ee724a97d4da2b5e
3969009089521bedcd44b2659dd05fc845ea94193d12e5db9a02db6ed3c63adc
3fc0011d4c74f735c60aa294e781136521de6772c720bc30d7e409cfb047b153
3fede2d0c0a8c93b0c5d0ab0c38289a5743bb88720255b8298c520d2e3d90939
4027b2655fb5d5fc650c12508adfe326ace67de2433edabc35e47850f5480ae8
4179815331b1b050e45da1ccf1d1a8cb50904e1cbb92228b32d55d545d4aaf7c
41a8990d122f143d451739e4b1f703abbbe64adfa7083efc81af5dbd97ea8c71
41b8e7c8b87cdf96b7a159a5fe9112e0000df2d69ef144700fdec01a306cf834
42c9d1df23e2f7d82d90b2bd6bab3b5398e81889cb9bde1d4a530acc663c9c63
441132f48c606bab601058cec5283d3268d69356c7124b04476d42207db99163
4546d13ea9bae9935dcd23f61d215a528120a53479bf51e372de3420029ed535
467b38388a35d30f0361f72edd912b6ee3aa04228029fead621acbe6474e8d45
468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99
4aec96eddab69454e554bb60664da2e5043c363ebef6921644f619523e7274d7
4c4491dcfa94cb46fb73742fc2caf49a1cd59027304af1830c7dc6ce1889857c
4c73802f936c2994c43d3af01b39ed725c31070279faea523dcec3154587dcda
4c92262ff23b2116bad93fc1e36f1a597dc713ad8b3cd03d56f8e49bec4cb186
4dbc45bd7ed8caf2aeeae8de34e519d874987d5285c79b5b4a93a1d670a929c4
4e2db1bef009e01901b4083a153f1607301428277a76f508e659dc2849cefa04
4e7304371ef9bcaea396e8928a9647f8306c296b9195c8763848d70c7f6f1390
50971142cb40342d5737ebd327d6b41ee85394a1d8fd1519b3e09a2fa5ffc214
5133e2e1a213ca44a8adb1f42f103a2d2e495849dfa4d42bf67c04fcc962e577
51c9dd2b116b821c23f948bfcada14fb1dc71eb9f3840ed020357a0e83572e4d
5206536707c84baa892d3c3231b351985ee828cb8b9c0bd8db42cd3363995fc4
527205f9c4921a3189f09da7644db4bb07f0563bbea45a99447e7661c2762219
55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3
5983be7036fc26270495fd1a318795ac3538b9e8e8a34dff25685a3e4fbe3858
5a1ba6ff6db12f791bbbfc4da3cb389e06f0cd53eede09ef3eb3ceb074089ef1
5a5c61d64361c9a4f8de2a6ef550bb2229334d178f577f59c4639ae932c90ad2
5abf860184508569d93b93fe5f3218dceff6e80842c84ca0b9048224e7c53a21
5d762593b646a2242421a80e7ea121628902af967f264bddae7a43a13821c7ab
5f4b11370823a700240b0bd482f10f6fcbb6dd59119841824c1f973dc2405bc7
6139cf28f27e43ef93d80278423db91715a6c3b6c0a155c4f7386dcf578de617
61779c74768b5eb298860ceb7d7cf06f2b228fdc53df72b530490a792a5b8a59
61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb
63a825f068607162b35a5133415c146f7865b3436a8a67d96ed3c547ec8e58b6
63b42989e8929ddac473f263487c093f5bf5cbbc0afa9af052b5277007d34170
6457a0e63ae355f0e5d1fd81a701c169f4fe3aab8ec7d6702bbab00fe9df03b5
65186d014d673005637f3a8e9f19632396369033161adb87fd3051f986413523
688bce9fb39e5f6d65058eaa253c7d39523a966d578ae1e382b4f7e5b3a8a519
68cc280ce370c6f1f51a4fc5950103fc38df80a429552c549add04ebd8bd3a23
69278fe35261286939e10f3832f461f9bf6addf267ffe0134e26be3d313dbd7d
693beca9d72ac0a0060cbad1887e2944d4490472f8045a8efaa239f196419542
69ad576fdc01cae1e0f0773d85546889f60bd73dfd9325cc755c3c29ba7f420d
6ae8a9d4457102eb3d8a5c78db6afa290388979669531ac8bbf8b22e6e20230f
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
6be97ca17228a69c406231d89c003194c3dfba7401eaa9fe9e9ed0ef1c18dc38
6caf904d3dfc096ae3b4e40aed43181686bdf1bac4722b3dd2a775ab6d2a9992
6d523c0cca92419aa80dbf8b5fa0bd26227241048b977ea90cfd9517c12689da
6ec9288103b5919c36e28909faf04364cdf19cf7687e234663d0d9daab65a3c0
7038c44fa2093af9acc4caf329b2255290992ca1395f1fadd7cffa2b0cf67af8
72fa757c7c54440cb310386a9671755ee9f201e116dc8627dfb30c357ebc7e73
74245b5aae3834ddb8901e2eee520902bf193c895566c73dde9bb06d66b63f6c
75b8b5c6f7ce4f8b37c96f68b4162c06e050685d10485f75852cd0cb4aa0261f
768a132cf00c824b9b9a4a3d12e388adcc331006b6df73754799ba3dc2b9c48f
768d97ec0916217ae82c70aeda3a61b9b0dab344edc4a3240a4f7cd94af00307
77c36fad51d04a56e55d1d454094c4312c3b11443f42b456c3f5082d66696be1
77dae683f322fee272645ec8bf91c9299fe571556138c282f6d7e8cf88a2b2d2
78984eab4c0c22f67e60da3ce2b8cdfeb6846b060abfc9b72683992266763379
78cf63898c91ce3b95e37bc53e07adba5c2ee705ff28c2dd1dd784173c264ad1
7b1eaaaf180a13c29b6dddc3b0ae23333b4397e0f3c065b4c86da2f2530a5f89
7baaef85b1c6761ac939c7dc62d8cdd899f179113d7a1f55925dc82c15bba0b7
7c7818c25a18e8a38553fcbcbc2ad0b5e964103a7d2e494f82815e3f70bf3fc5
7c93346d4f681a0be90d1dfc19346382a4700f1810f41caa54415688dee1777f
7d0bada0d9b66aa1ca8eb906bb9736ca96e3859e9c05287a8f0cf5ffa9ff8760
7e201f2a13c1277de84732ca1228c8af49f797edf512456560f1970a9e69853d
7e76e206743f8dd0f4356c42f27c2073f04ac56c69857646808d6b9c72ecab96
7e78a118484984c2c91bb17193121067664b3cccd7a37f4e4cef0713bdfd2aa1
7feb9afd2b66cb0776368af51a4e74d22787d4cbe836e1d6490fc1badbd46d5e
7ff5b98c09ec9d2af43d4108160ea0455f91f415f83031cc79fbe24a3a765bb8
81f66fb840c902b62f902bc4e27a6e3dee001d2f8babf5e767f78f16136ff0b7
8291a8de09d9f934302b3c47f1a0ed3d56c712c241c6876b2a014275caca6a38
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80
86e361ef0e3c927e1dce9d2d2ea6c3ca7d6f09bc5157dd93218609ca38689bb1
87ca2d8adbd10be0e5e89784dbb7aa8bb67f77247471f437e6af535009955f8c
886cbcafd4491d4e1f178b55099ad1ca892a88f7cd68f9e04604d370e0a5baeb
89f4889eebc36f4ad79abb20ba84c4e8b0dac9bce1c0dfbe779ac8d5022572bd
8bc7f122cae9e9efd75cd58076d06fb057d8f50abf07ffc1716e17d87682b9cf
8e7e5fbc9637d3993c3b658a7683b81bcc6fbeb841021d868d0795c0f4be1bed
9186ad0839410bf3d20f3c5b242b36027562baac85ffb8cba18b50b6e4d7945d
93d460a5e1ac912ca45ff1393c39d2a4d1c1648e0fca69006a3314bb1ef6f574
93f466f6b1a81c848140e51c839a5372034ab22182601e86dd86947ad3a7fe94
958741625f5a4684c6cbb693f04970ca3372fa881e5fd95b036d91eeea71e27b
9714221c828961b20f45a782c3281c0596f6652cfe1299bee18097f98e8fb7b3
97e5d742b8ab51088f7168580fdfaffe91ce99d5c16dfde19b12e3d6259262b2
97fede359991df79883efa68e75db4c07d30dd92107a4b8c1e9147b4c159f2f4
9b2dc2a6592abd91e0dee577ef85461138e643d96bf3f3756f7c6d856d8d5e8b
9c0eece4e399b03e88bde7d9d6fdbb5149681bd096e6ab23fc0accab35fb460d
9c8bb391a723e088d163b560afa73f709c42a69df5647c4fefce9d16e4226895
9f258869b4e9dc3a2fb475fd02b669a7e6141203738801307f9c5de64f0713e7
a2d9c309c9e6ba6279dc21f67b04f9b0525d2a72cf3a879501b11f6a0f0558bf
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
a55ff643a6e62f28b827480adc9f6cc30810bce85dc3925e44790b2620419f63
a657bedd3bc0c106f7cfa5fe6556a0b7e175870d33bd7da9ef67ffcffbafda69
a952a44375a3d8c869e96f85505fcbae076f4226021f08676a1b4627152252d0
ab618c26a11027f879b5e9a4b28120545ba14270a5da6d33e623f9a2b8b8d38d
ac65146dbd1c7f71965e57e0ec033fdcdb1260865e282d86568bca6a7aa283f2
ae3c472ff47a96820c1acdf9574b231a88f62a006b84d320eb313af40f32f2db
aec60bc104db041b1512185839f18f52986df7e569e5445f740dd60f763fbca8
aed1d71b7280c09f06dc1f8e87795f9d89f7a1a8ab1af32ff8c92037ddeed6ee
afbab9bb4c188af9906f69d3e8d9bf91e24e98418d46185eadcc304b35905f06
b019538234514166ec7665359d097403358f8a4c991901983922fb4d56989f1e
b174c56cc02f8e22768cc85936d770e6ad391322a817e294f908062d0581b20c
b48e375595153df77fb7e7c5cc839ab093064ba54ce5fbea202855d99819c963
b54c7e7ce2ef254781ac3a5dba2ebbd664016990bf5543879d48e6f1a5eb4167
bbbd7bccd313fafa0275f24bb6c30268a0f26f668894cf2ac68a664d95a962f6
bbe0aa82dca8a36f677fb17025c3baa011d355bd7cb42d4aacea1b0265855d6e
bfadafc237c8d28e9b6b3ba53dd00cb08baf1b9c43b53205b0f908dfff2e0bdc
c0fbcd0d8bbe84a1383a64557ab76db8d7fd1c2825db2e180a51dc8fbfc544e8
c15d7c72b50d4cad5e7a1fcbd75c78ded4c75eaf3ec382783a1903f88e6db1cf
c284dcb06ef882b1b45e11e0a16baa223b4117eca94e243c8e725c4ce3f909b3
c3b29b4092d0bca93f4110dc0aa8b879436c0c0c6f0e9cd8b4d3ceb8457244c7
c70242480ad0a0ecc7c305d659f1fdb3a9cb1eb480927b46f8bd62d33ed0f8b2
cb8c2b19fd9b56c41db14bd71b5c0616c1ba4e99b08c8e75084cf695f74b7120
cdd152da46fe3cee3e804d967f5dead6756bfb9698b157766bbbdc0ab5ce9b0c
ce962b78a26656883501635849e98206497e3b18620d8e33b2e1f804e0397cf1
cee7e1ef5403dfeacb53955ea835cda536b946e35f9f343d1ac0078a74149baf
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
d0e4a6372d6fb5ffe9505dbe9e94aee8f1b9b96ec8e5e20684cce8b4c5a88fa7
d0ed4f397601c0435a8b870a821ac197137e78eb4874ae1dc3ec9f2ec64a1d44
d18e6e1e3eb133e23f96fd76d22a94821fb034eb542885bbdc89fb7a5c67ec65
d23fd6a13b657ba55789f4a8b098f72d86e253917a83af15a2e4e6ed23a9e5c9
d3189a856ca159c541b0e2eeace2c9b5a9f6611fd6433d827828375a07e4c958
d8b70e292d312ceb95a91962382d246c54ef08ccb92adb4e0f7f96a426f6d922
db0424fb67fb52e7e538490240cc7fb9c05aa076333a4968f3dee30b825dabf9
db2467e2e1faf8e14680a182109a1ee5ff2e221c138109eec3cff7daae01453a
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
dd4805f260848c27bc7e43fc3a7c828986da4f0611a7926b23b08ac7f3af0086
de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd
de97f31631e402844be35c90f749425cb168ebdcf3dfcb6e9b5ff3f8bdbc1d28
e26475b29b6c6ad70a6cc7156eed3a0e3d1e9f9900c9108fc67554b29f077c07
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e4dc8f9167d1856456fef1e09e3281cc2c9d192de855ff75d32939a46f1b4108
e51831d751ef667b1f703a47bb05802b681e6a30816f5cce0d56c3552a4eaa31
e5483067555ac512d12aad7462badacb64ed7e7fa704bf321b9234ddd3be87b9
e5f642d2f033427623818296e1b6cfccbdd3ce10dd8aadda10bdfef52a5f31f7
e6a8f5b2b6a5b8dfbf571c7fe00eb4209571fa1bac6dabfd7679319568e6efad
e988625f007b2e96b5f5796e7ae0619f5348c319851ddffc668c216ff5583a70
e9946aa96be85eba684cf6ab11e5c07594281d2981749345302a992b5c11d3cd
e9b6e5d6207dea3753f55720cef88d4c6a60758ffacb7808ec6081b2a63bbc5e
ea3325c2094d82033ce9583d4180194fb82729dfae65b62925831a88a6838d7c
eb9ec684a7198fded61e248eaff2d28d0c9f8a15dfee8d9afff66aa6ff200461
eccabf5cc7613433c3ddc71ff34391ae850d304d3aceb5666868c4947134f3b5
eefc2533a82b69fab9b19b9e316bb606e70d17d61b57f9ea841b26c59624bc20
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
ef70188b0511b29572b69e473e8ad0d8b88b5e37e854b88c42c777c3c8ed6fdb
f122b139d8c6ba64f1c708876df711b40c32536f251fa3ea5fcbb10fd24abf3d
f2a341fc815d45c21da726d4c843c2c5d3e1f333465347c3c75d040d556df4e5
f31fd1d112cb45538d3e7b306ca3effb82f67b60c39f28010e1e11078410e34f
f410f7fa29905bee85ed053ca8a9a8fa39dbca90e00a06ae5d5ae2cab2e3daa4
f48f38f3d39171eb79fd3264f9c2e5d99e1703dfec1b687e0b2d6ebab21d05c1
f5aebdfea35d1e7656ef4acc5db1f243209755ae3300943ef8fc6280f363c860
f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615
fa974a608349f8186bcb66723f030b7213b95f7bf41f18c8cdfe76d5696d19f9
fc54c09a7a71615ec35a22ed20afa4034588986ed88c3fc184b2c0bc637c33fb
fcbcf165908dd18a9e49f7ff27810176db8e9f63b4352213741664245224f8aa
fe04a9dc88d3f3be8d4f6bc63a9a80f45a4c6d8460e7551dab849457c091920a
feb6a4829cc0a55f2fed1d3aaceb83b52e6823f15c649c5ef1c14a7e86e4988b