www.deepinstinct.com Open in urlscan Pro
3.70.101.28 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework
Submission: On April 24 via api (April 24th 2024, 10:52:13 am UTC) from IL — Scanned from IL

Summary HTTP 112 Redirects Links 40 Behaviour Indicators

Summary

This website contacted 40 IPs in 4 countries across 33 domains to perform 112 HTTP transactions. The main IP is 3.70.101.28, located in Frankfurt am Main, Germany and belongs to AMAZON-02, US. The main domain is www.deepinstinct.com. The Cisco Umbrella rank of the primary domain is 488596.
TLS certificate: Issued by R3 on April 18th 2024. Valid for: 3 months.

This is the only time www.deepinstinct.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
43	3.70.101.28 3.70.101.28	16509 (AMAZON-02) (AMAZON-02)
1	142.250.186.174 142.250.186.174	15169 (GOOGLE) (GOOGLE)
5	23.200.36.197 23.200.36.197	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
4	151.101.66.137 151.101.66.137	54113 (FASTLY) (FASTLY)
3	142.250.185.232 142.250.185.232	15169 (GOOGLE) (GOOGLE)
1	23.200.36.209 23.200.36.209	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
3	172.217.18.14 172.217.18.14	15169 (GOOGLE) (GOOGLE)
1	18.66.102.53 18.66.102.53	16509 (AMAZON-02) (AMAZON-02)
1	18.245.46.44 18.245.46.44	16509 (AMAZON-02) (AMAZON-02)
1	104.16.141.209 104.16.141.209	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	23.200.38.43 23.200.38.43	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	146.75.120.157 146.75.120.157	54113 (FASTLY) (FASTLY)
3	157.240.253.1 157.240.253.1	32934 (FACEBOOK) (FACEBOOK)
3	13.107.21.237 13.107.21.237	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
4	152.195.15.58 152.195.15.58	15133 (EDGECAST) (EDGECAST)
1	104.18.36.196 104.18.36.196	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	104.18.17.5 104.18.17.5	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	142.250.185.162 142.250.185.162	15169 (GOOGLE) (GOOGLE)
1	142.250.185.238 142.250.185.238	15169 (GOOGLE) (GOOGLE)
2	74.125.206.155 74.125.206.155	15169 (GOOGLE) (GOOGLE)
3	142.250.186.163 142.250.186.163	15169 (GOOGLE) (GOOGLE)
2	34.111.208.231 34.111.208.231	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1	13.33.187.92 13.33.187.92	16509 (AMAZON-02) (AMAZON-02)
1	172.64.153.27 172.64.153.27	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	104.17.175.201 104.17.175.201	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	104.18.140.17 104.18.140.17	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	104.17.128.172 104.17.128.172	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	34.96.71.22 34.96.71.22	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1	18.66.102.85 18.66.102.85	16509 (AMAZON-02) (AMAZON-02)
2	104.244.42.133 104.244.42.133	13414 (TWITTER) (TWITTER)
2	104.244.42.131 104.244.42.131	13414 (TWITTER) (TWITTER)
3	151.101.129.167 151.101.129.167	54113 (FASTLY) (FASTLY)
1	143.204.98.63 143.204.98.63	16509 (AMAZON-02) (AMAZON-02)
2	216.58.206.68 216.58.206.68	15169 (GOOGLE) (GOOGLE)
3 5	13.107.42.14 13.107.42.14	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
2	157.240.253.35 157.240.253.35	32934 (FACEBOOK) (FACEBOOK)
1	104.16.118.116 104.16.118.116	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	52.6.115.117 52.6.115.117	14618 (AMAZON-AES) (AMAZON-AES)
1	169.48.219.66 169.48.219.66	36351 (SOFTLAYER) (SOFTLAYER)
112	40

43 3.70.101.28 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-3-70-101-28.eu-central-1.compute.amazonaws.com

www.deepinstinct.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.186.174 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s08-in-f14.1e100.net

www.googleoptimize.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 23.200.36.197 (Mexico)

ASN20940 (AKAMAI-ASN1, NL)
PTR: a23-200-36-197.deploy.static.akamaitechnologies.com

use.typekit.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 151.101.66.137 (United States)

ASN54113 (FASTLY, US)

images.contentstack.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 142.250.185.232 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s53-in-f8.1e100.net

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 23.200.36.209 (Mexico)

ASN20940 (AKAMAI-ASN1, NL)
PTR: a23-200-36-209.deploy.static.akamaitechnologies.com

p.typekit.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 172.217.18.14 (United States)

ASN15169 (GOOGLE, US)
PTR: fra02s19-in-f14.1e100.net

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.66.102.53 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-66-102-53.fra56.r.cloudfront.net

static.hotjar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.245.46.44 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-245-46-44.fra56.r.cloudfront.net

tag.demandbase.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.16.141.209 (None, )

ASN13335 (CLOUDFLARENET, US)

js.hs-scripts.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 23.200.38.43 (Mexico)

ASN20940 (AKAMAI-ASN1, NL)
PTR: a23-200-38-43.deploy.static.akamaitechnologies.com

snap.licdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 146.75.120.157 (Frankfurt am Main, Germany)

ASN54113 (FASTLY, US)

static.ads-twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 157.240.253.1 (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)
PTR: xx-fbcdn-shv-02-fra5.fbcdn.net

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 13.107.21.237 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

bat.bing.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 152.195.15.58 (United States)

ASN15133 (EDGECAST, US)

cdn.bizible.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
cdn.bizibly.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.18.36.196 (None, )

ASN13335 (CLOUDFLARENET, US)

trk.techtarget.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.18.17.5 (None, )

ASN13335 (CLOUDFLARENET, US)

js.qualified.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.185.162 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s51-in-f2.1e100.net

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.185.238 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s53-in-f14.1e100.net

analytics.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 74.125.206.155 (United States)

ASN15169 (GOOGLE, US)
PTR: wk-in-f155.1e100.net

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 142.250.186.163 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s08-in-f3.1e100.net

www.google.co.il	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 34.111.208.231 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 231.208.111.34.bc.googleusercontent.com

ibc-flow.techtarget.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.33.187.92 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-33-187-92.fra60.r.cloudfront.net

script.hotjar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 172.64.153.27 (San Francisco, United States)

ASN13335 (CLOUDFLARENET, US)

js.hs-banner.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.17.175.201 (None, )

ASN13335 (CLOUDFLARENET, US)

js.hs-analytics.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.18.140.17 (None, )

ASN13335 (CLOUDFLARENET, US)

js.hsleadflows.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.17.128.172 (None, )

ASN13335 (CLOUDFLARENET, US)

js.hsadspixel.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.96.71.22 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 22.71.96.34.bc.googleusercontent.com

s.company-target.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.66.102.85 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-66-102-85.fra56.r.cloudfront.net

api.company-target.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 104.244.42.133 (United States)

ASN13414 (TWITTER, US)

t.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 104.244.42.131 (United States)

ASN13414 (TWITTER, US)

analytics.twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 151.101.129.167 (United States)

ASN54113 (FASTLY, US)

s.swiftypecdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 143.204.98.63 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-143-204-98-63.fra50.r.cloudfront.net

tag-logger.demandbase.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 216.58.206.68 (United States)

ASN15169 (GOOGLE, US)
PTR: tzfraa-aa-in-f4.1e100.net

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 13.107.42.14 (United States) 3 redirects

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

px.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
www.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 157.240.253.35 (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)
PTR: edge-star-mini-shv-02-fra5.facebook.com

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.16.118.116 (None, )

ASN13335 (CLOUDFLARENET, US)

track.hubspot.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.6.115.117 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-6-115-117.compute-1.amazonaws.com

app.qualified.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 169.48.219.66 (United States)

ASN36351 (SOFTLAYER, US)
PTR: 42.db.30a9.ip4.static.sl-reverse.com

cc.swiftype.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
43	deepinstinct.com www.deepinstinct.com — Cisco Umbrella Rank: 488596	850 KB
6	typekit.net use.typekit.net — Cisco Umbrella Rank: 463 p.typekit.net — Cisco Umbrella Rank: 574	78 KB
5	linkedin.com 3 redirects px.ads.linkedin.com — Cisco Umbrella Rank: 328 www.linkedin.com — Cisco Umbrella Rank: 613	3 KB
4	contentstack.io images.contentstack.io — Cisco Umbrella Rank: 11845	175 KB
3	swiftypecdn.com s.swiftypecdn.com — Cisco Umbrella Rank: 11932	148 KB
3	google.co.il www.google.co.il — Cisco Umbrella Rank: 27443	669 B
3	google.com analytics.google.com — Cisco Umbrella Rank: 145 www.google.com — Cisco Umbrella Rank: 2	384 B
3	doubleclick.net googleads.g.doubleclick.net — Cisco Umbrella Rank: 36 stats.g.doubleclick.net — Cisco Umbrella Rank: 84	2 KB
3	techtarget.com trk.techtarget.com — Cisco Umbrella Rank: 25821 ibc-flow.techtarget.com — Cisco Umbrella Rank: 23185	2 KB
3	bizible.com cdn.bizible.com — Cisco Umbrella Rank: 7702	26 KB
3	bing.com bat.bing.com — Cisco Umbrella Rank: 337	14 KB
3	facebook.net connect.facebook.net — Cisco Umbrella Rank: 180	74 KB
3	google-analytics.com www.google-analytics.com — Cisco Umbrella Rank: 31	21 KB
3	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 39	285 KB
2	facebook.com www.facebook.com — Cisco Umbrella Rank: 97	367 B
2	twitter.com analytics.twitter.com — Cisco Umbrella Rank: 825	633 B
2	t.co t.co — Cisco Umbrella Rank: 678	578 B
2	company-target.com s.company-target.com — Cisco Umbrella Rank: 1314 api.company-target.com — Cisco Umbrella Rank: 4071	1 KB
2	qualified.com js.qualified.com — Cisco Umbrella Rank: 19100 app.qualified.com — Cisco Umbrella Rank: 20027	167 KB
2	demandbase.com tag.demandbase.com — Cisco Umbrella Rank: 4884 tag-logger.demandbase.com — Cisco Umbrella Rank: 4914	22 KB
2	hotjar.com static.hotjar.com — Cisco Umbrella Rank: 737 script.hotjar.com — Cisco Umbrella Rank: 933	59 KB
1	swiftype.com cc.swiftype.com — Cisco Umbrella Rank: 12951	279 B
1	hubspot.com track.hubspot.com — Cisco Umbrella Rank: 2416	1 KB
1	bizibly.com cdn.bizibly.com — Cisco Umbrella Rank: 12616	181 B
1	hsadspixel.net js.hsadspixel.net — Cisco Umbrella Rank: 3146	4 KB
1	hsleadflows.net js.hsleadflows.net — Cisco Umbrella Rank: 5216	88 KB
1	hs-analytics.net js.hs-analytics.net — Cisco Umbrella Rank: 2216	21 KB
1	hs-banner.com js.hs-banner.com — Cisco Umbrella Rank: 2206	17 KB
1	ads-twitter.com static.ads-twitter.com — Cisco Umbrella Rank: 795	15 KB
1	licdn.com snap.licdn.com — Cisco Umbrella Rank: 781	17 KB
1	hs-scripts.com js.hs-scripts.com — Cisco Umbrella Rank: 2505	1 KB
1	googleoptimize.com www.googleoptimize.com — Cisco Umbrella Rank: 2698	62 KB
0	rlcdn.com Failed id.rlcdn.com Failed
112	33

	Domain	Requested by
43	www.deepinstinct.com	www.deepinstinct.com
5	use.typekit.net	www.deepinstinct.com use.typekit.net
4	px.ads.linkedin.com	2 redirects www.deepinstinct.com cdn.bizible.com
4	images.contentstack.io	www.deepinstinct.com
3	s.swiftypecdn.com	www.deepinstinct.com cdn.bizible.com s.swiftypecdn.com
3	www.google.co.il	www.deepinstinct.com
3	cdn.bizible.com	www.googletagmanager.com www.deepinstinct.com cdn.bizible.com
3	bat.bing.com	www.deepinstinct.com bat.bing.com
3	connect.facebook.net	www.deepinstinct.com connect.facebook.net
3	www.google-analytics.com	www.googletagmanager.com www.google-analytics.com www.deepinstinct.com
3	www.googletagmanager.com	www.deepinstinct.com www.googletagmanager.com
2	www.facebook.com	www.deepinstinct.com
2	www.google.com	www.deepinstinct.com
2	analytics.twitter.com	www.deepinstinct.com
2	t.co	www.deepinstinct.com
2	ibc-flow.techtarget.com	trk.techtarget.com
2	stats.g.doubleclick.net	www.googletagmanager.com cdn.bizible.com
1	cc.swiftype.com
1	app.qualified.com	js.qualified.com
1	track.hubspot.com
1	www.linkedin.com	1 redirects
1	tag-logger.demandbase.com	cdn.bizible.com
1	cdn.bizibly.com	www.deepinstinct.com
1	api.company-target.com	tag.demandbase.com
1	s.company-target.com	tag.demandbase.com
1	js.hsadspixel.net	js.hs-scripts.com
1	js.hsleadflows.net	js.hs-scripts.com
1	js.hs-analytics.net	js.hs-scripts.com
1	js.hs-banner.com	js.hs-scripts.com
1	script.hotjar.com	static.hotjar.com
1	analytics.google.com	www.googletagmanager.com
1	googleads.g.doubleclick.net	www.googletagmanager.com
1	js.qualified.com	www.googletagmanager.com
1	trk.techtarget.com	www.deepinstinct.com
1	static.ads-twitter.com	www.googletagmanager.com
1	snap.licdn.com	www.googletagmanager.com
1	js.hs-scripts.com	www.googletagmanager.com
1	tag.demandbase.com	www.deepinstinct.com
1	static.hotjar.com	www.googletagmanager.com
1	p.typekit.net	use.typekit.net
1	www.googleoptimize.com	www.deepinstinct.com
0	id.rlcdn.com Failed	www.deepinstinct.com
112	42

This site contains links to these domains. Also see Links.

Domain
portal.deepinstinct.com
info.deepinstinct.com
services.google.com
www.gov.il
amitaico.substack.com
www.securityjoes.com
xelemental.medium.com
go.crowdstrike.com
www.microsoft.com
en.wikipedia.org
www.mandiant.com
research.checkpoint.com
blog.talosintelligence.com
www.group-ib.com
symantec-enterprise-blogs.security.com
villains.fandom.com
op-c.net
www.secureworks.com
www.sentinelone.com
www.proofpoint.com
twitter.com
labs.k7computing.com
0day.bio
www.google.com
github.com
www.mafateehgroup.com
docs.tacticalrmm.com
learn.microsoft.com
www.youtube.com
www.linkedin.com
www.facebook.com

Subject Issuer	Validity	Valid
deepinstinct.com R3	`2024-04-18` - `2024-07-17`	3 months	crt.sh
*.google-analytics.com GTS CA 1C3	`2024-03-18` - `2024-06-10`	3 months	crt.sh
use.typekit.net DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2024-02-01` - `2025-03-03`	a year	crt.sh
*.contentstack.io Gandi RSA Domain Validation Secure Server CA 3	`2024-04-10` - `2025-05-04`	a year	crt.sh
*.hotjar.com Amazon ECDSA 256 M03	`2024-02-07` - `2025-03-08`	a year	crt.sh
tag.demandbase.com Go Daddy Secure Certificate Authority - G2	`2023-08-23` - `2024-09-23`	a year	crt.sh
hs-scripts.com E1	`2024-04-01` - `2024-06-30`	3 months	crt.sh
snap.licdn.com DigiCert SHA2 Secure Server CA	`2023-12-13` - `2024-12-12`	a year	crt.sh
ads-twitter.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-07-21` - `2024-07-19`	a year	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2024-02-01` - `2024-05-01`	3 months	crt.sh
www.bing.com Microsoft Azure TLS Issuing CA 05	`2024-04-24` - `2024-06-27`	2 months	crt.sh
io.bizible.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-06-01` - `2024-07-01`	a year	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2023-06-25` - `2024-06-24`	a year	crt.sh
qualified.com E1	`2024-03-11` - `2024-06-09`	3 months	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2024-03-18` - `2024-06-10`	3 months	crt.sh
*.google.com GTS CA 1C3	`2024-03-18` - `2024-06-10`	3 months	crt.sh
*.google.co.il GTS CA 1C3	`2024-03-18` - `2024-06-10`	3 months	crt.sh
ibc-flow.techtarget.com GTS CA 1D4	`2024-03-10` - `2024-06-08`	3 months	crt.sh
hs-banner.com E1	`2024-04-01` - `2024-06-30`	3 months	crt.sh
hs-analytics.net GTS CA 1P5	`2024-04-13` - `2024-07-12`	3 months	crt.sh
hsleadflows.net E1	`2024-04-05` - `2024-07-04`	3 months	crt.sh
hsadspixel.net E1	`2024-04-16` - `2024-07-15`	3 months	crt.sh
*.company-target.com R3	`2024-04-17` - `2024-07-16`	3 months	crt.sh
api.demandbase.com Go Daddy Secure Certificate Authority - G2	`2023-09-27` - `2024-09-26`	a year	crt.sh
t.co DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2024-01-07` - `2025-01-06`	a year	crt.sh
*.twitter.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-10-31` - `2024-10-29`	a year	crt.sh
s.swiftypecdn.com GlobalSign Atlas R3 DV TLS CA 2024 Q1	`2024-04-04` - `2025-05-06`	a year	crt.sh
*.demandbase.com Amazon RSA 2048 M01	`2023-07-11` - `2024-08-08`	a year	crt.sh
www.linkedin.com DigiCert SHA2 Secure Server CA	`2024-01-30` - `2024-07-30`	6 months	crt.sh
hubspot.com Cloudflare Inc ECC CA-3	`2024-01-06` - `2024-12-31`	a year	crt.sh
app.qualified.com R3	`2024-03-21` - `2024-06-19`	3 months	crt.sh
*.swiftype.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-06-21` - `2024-07-14`	a year	crt.sh

This page contains 3 frames:

Primary Page: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework
Frame ID: 0B16F546660A348622596E6DB9AA79F5
Requests: 109 HTTP requests in this frame

Frame: https://s.company-target.com/s/sync?exc=lr
Frame ID: F9F12FEF97979E57C150DDE4B61654C7
Requests: 1 HTTP requests in this frame

Frame: https://app.qualified.com/w/1/DxHYmKWTScn3buDp/messenger?uuid=92154fa5-3bc0-4989-b9cd-e9c8ad330bd9
Frame ID: A3862931F236A7D6D9CA6FCEDB98BA1A
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

DarkBeatC2: The Latest MuddyWater Attack Framework

Detected technologies

Facebook (Widgets) Expand

Overall confidence: 100%
Detected patterns

//connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

google-analytics\.com/(?:ga|urchin|analytics)\.js

Google Optimize (A/B Testing) Expand

Overall confidence: 100%
Detected patterns

googleoptimize\.com/optimize\.js

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtm\.js
googletagmanager\.com/gtag/js

Hotjar (Analytics) Expand

Overall confidence: 100%
Detected patterns

//static\.hotjar\.com/

HubSpot Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

js\.hs-analytics\.net/analytics

Linkedin Insight Tag (Analytics) Expand

Overall confidence: 100%
Detected patterns

snap\.licdn\.com/li\.lms-analytics/insight\.min\.js

Typekit (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link [^>]*href="[^"]+use\.typekit\.(?:net|com)

Page Statistics

112
Requests

97 %
HTTPS

0 %
IPv6

33
Domains

42
Subdomains

40
IPs

4
Countries

2154 kB
Transfer

6003 kB
Size

44
Cookies

40 Outgoing links

These are links going to different origins than the main page.

URL: https://portal.deepinstinct.com/
Title: Login

Search URL Search Domain Scan URL

URL: https://info.deepinstinct.com/request-a-demo
Title: Request Demo

Search URL Search Domain Scan URL

URL: https://services.google.com/fh/files/misc/tool-of-first-resort-israel-hamas-war-cyber.pdf
Title: shared

Search URL Search Domain Scan URL

URL: https://www.gov.il/en/departments/about/newabout
Title: INCD

Search URL Search Domain Scan URL

URL: https://www.gov.il/he/departments/publications/reports/alert_1721
Title: shared

Search URL Search Domain Scan URL

URL: https://amitaico.substack.com/p/the-other-pyramids
Title: Pyramid of Pain

Search URL Search Domain Scan URL

URL: https://www.securityjoes.com/post/bibi-linux-a-new-wiper-dropped-by-pro-hamas-hacktivist-group
Title: BiBi wiper

Search URL Search Domain Scan URL

URL: https://xelemental.medium.com/homeland-justice-albania-wiper-3c7e7edd43cc
Title: Homeland Justice

Search URL Search Domain Scan URL

URL: https://go.crowdstrike.com/rs/281-OBQ-266/images/GlobalThreatReport2024.pdf
Title: BanishedKitten

Search URL Search Domain Scan URL

URL: https://www.microsoft.com/en-us/security/blog/2022/09/08/microsoft-investigates-iranian-attacks-against-the-albanian-government/
Title: investigation

Search URL Search Domain Scan URL

URL: https://en.wikipedia.org/wiki/Kill_chain#Cyber
Title: Cyber Kill Chain

Search URL Search Domain Scan URL

URL: https://www.mandiant.com/resources/blog/likely-iranian-threat-actor-conducts-politically-motivated-disruptive-activity-against
Title: investigation

Search URL Search Domain Scan URL

URL: https://research.checkpoint.com/2023/from-albania-to-the-middle-east-the-scarred-manticore-is-listening/
Title: FoxShell

Search URL Search Domain Scan URL

URL: https://blog.talosintelligence.com/introducing-shrouded-snooper/
Title: ShroudedSnooper

Search URL Search Domain Scan URL

URL: https://www.microsoft.com/en-us/security/blog/2023/04/07/mercury-and-dev-1084-destructive-attack-on-hybrid-environment/
Title: DEV-1084

Search URL Search Domain Scan URL

URL: https://www.group-ib.com/blog/muddywater-infrastructure/
Title: SimpleHarm

Search URL Search Domain Scan URL

URL: https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/iran-apt-seedworm-africa-telecoms
Title: 2

Search URL Search Domain Scan URL

URL: https://villains.fandom.com/wiki/Lord_Nemesis
Title: Lord Nemesis

Search URL Search Domain Scan URL

URL: https://op-c.net/blog/lord-nemesis-strikes-supply-chain-attack-on-the-israeli-academic-sector/
Title: report

Search URL Search Domain Scan URL

URL: https://www.microsoft.com/en-us/security/blog/2022/09/07/profiling-dev-0270-phosphorus-ransomware-operations/
Title: According

Search URL Search Domain Scan URL

URL: https://www.secureworks.com/blog/cobalt-mirage-conducts-ransomware-operations-in-us
Title: Cobalt Mirage

Search URL Search Domain Scan URL

URL: https://www.sentinelone.com/labs/log4j2-in-the-wild-iranian-aligned-threat-actor-tunnelvision-actively-exploiting-vmware-horizon/
Title: TunnelVision

Search URL Search Domain Scan URL

URL: https://www.microsoft.com/en-us/security/blog/2024/01/17/new-ttps-observed-in-mint-sandstorm-campaign-targeting-high-profile-individuals-at-universities-and-research-orgs/
Title: Mint Sandstorm

Search URL Search Domain Scan URL

URL: https://www.proofpoint.com/us/blog/threat-insight/security-brief-ta450-uses-embedded-links-pdf-attachments-latest-campaign
Title: recent

Search URL Search Domain Scan URL

URL: https://twitter.com/k3yp0d/status/1770954280049975757
Title: another

Search URL Search Domain Scan URL

URL: https://twitter.com/xDarkBitx/with_replies
Title: made

Search URL Search Domain Scan URL

URL: https://labs.k7computing.com/index.php/muddywater-back-with-darkbit/

Search URL Search Domain Scan URL

URL: https://0day.bio/
Title: 0Day forums

Search URL Search Domain Scan URL

URL: https://www.google.com/search?q=%22stark-industries%22+%22malware%22
Title: known

Search URL Search Domain Scan URL

URL: https://github.com/yogeshojha/rengine
Title: reNgine

Search URL Search Domain Scan URL

URL: https://www.mafateehgroup.com/about/
Title: mafateehgroup.com

Search URL Search Domain Scan URL

URL: https://docs.tacticalrmm.com/
Title: Tactical RMM.

Search URL Search Domain Scan URL

URL: https://twitter.com/1ZRR4H/status/1772107339757232497
Title: reported

Search URL Search Domain Scan URL

URL: https://twitter.com/chux13786509/status/1768642677484949748
Title: observed

Search URL Search Domain Scan URL

URL: https://twitter.com/Intel_Ops_io/status/1772586606639132955
Title: Intel-Ops

Search URL Search Domain Scan URL

URL: https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_script_blocks?view=powershell-7.4
Title: scriptblock

Search URL Search Domain Scan URL

URL: https://www.youtube.com/channel/UCYerfisJf3hc9QOWmic1G9Q

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/company/deep-instinct

Search URL Search Domain Scan URL

URL: https://twitter.com/DeepInstinctSec

Search URL Search Domain Scan URL

URL: https://www.facebook.com/DeepInstinctInc

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 96

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=316505&time=1713955927663&li_adsId=2d08bd37-1d11-42bb-88f3-78bfb178795c&url=https%3A%2F%2Fwww.deepinstinct.com%2Fblog%2Fdarkbeatc2-the-latest-muddywater-attack-framework HTTP 302
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=316505&time=1713955927663&li_adsId=2d08bd37-1d11-42bb-88f3-78bfb178795c&url=https%3A%2F%2Fwww.deepinstinct.com%2Fblog%2Fdarkbeatc2-the-latest-muddywater-attack-framework&cookiesTest=true HTTP 302
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D316505%26time%3D1713955927663%26li_adsId%3D2d08bd37-1d11-42bb-88f3-78bfb178795c%26url%3Dhttps%253A%252F%252Fwww.deepinstinct.com%252Fblog%252Fdarkbeatc2-the-latest-muddywater-attack-framework%26cookiesTest%3Dtrue%26liSync%3Dtrue HTTP 302
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=316505&time=1713955927663&li_adsId=2d08bd37-1d11-42bb-88f3-78bfb178795c&url=https%3A%2F%2Fwww.deepinstinct.com%2Fblog%2Fdarkbeatc2-the-latest-muddywater-attack-framework&cookiesTest=true&liSync=true

112 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request darkbeatc2-the-latest-muddywater-attack-framework Show response
www.deepinstinct.com/blog/ 170 KB
27 KB 1556ms
1233ms Document
text/html 3.70.101.28
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.70.101.28 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-70-101-28.eu-central-1.compute.amazonaws.com

Software

Netlify /

Resource Hash

feadef6719ca44406d0eeb1c80724f6212e37d284782ea336576a216ad24b90b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1

Request headers

Accept-Language: he-IL,he;q=0.9;q=0.9
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Win32"

Response headers

age: 891
cache-control: public,max-age=0,must-revalidate
cache-status: "Next.js"; hit; fwd=stale "Netlify Edge"; fwd=stale
content-encoding: br
content-length: 26672
content-type: text/html; charset=utf-8
date: Wed, 24 Apr 2024 10:52:05 GMT
etag: "4ry6s43a3l3pa5-df"
netlify-vary: header=x-nextjs-data,cookie=__prerender_bypass|__next_preview_data
server: Netlify
strict-transport-security: max-age=31536000
surrogate-control: max-age=300, stale-while-revalidate=900, stale-if-error=900
vary: Accept-Encoding
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-nextjs-date: Wed, 24 Apr 2024 10:52:04 GMT
x-nf-request-id: 01HW7VQT5QXJ0BR1BWR106AVKY
x-xss-protection: 1

GET
H2 200 optimize.js Show response
www.googleoptimize.com/ 172 KB
62 KB 404ms
147ms Script
application/javascript 142.250.186.174
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleoptimize.com/optimize.js?id=OPT-P298HTJ

Requested by

Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.174 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s08-in-f14.1e100.net

Software

Google Tag Manager /

Resource Hash

7446f9bea2311ed6c06b322a9cd701db093e5985444698a11e75a998364781dd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.deepinstinct.com/
Accept-Language: he-IL,he;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 24 Apr 2024 10:52:05 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 63333
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Wed, 24 Apr 2024 10:52:05 GMT

GET
H2 200 62c9f84af6283043.css
www.deepinstinct.com/_next/static/css/ 33 KB
7 KB 155ms
154ms Stylesheet
text/css 3.70.101.28
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.deepinstinct.com/_next/static/css/62c9f84af6283043.css

Requested by

Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.70.101.28 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-70-101-28.eu-central-1.compute.amazonaws.com

Software

Netlify /

Resource Hash

8a61ba991bab87bb170f6256868d5f2f3264d28b40b8f8129e02a07a44651469

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework
Accept-Language: he-IL,he;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-nf-request-id: 01HW7VQVCHGZ0H1XFMEYR1Y33F
date: Wed, 24 Apr 2024 10:52:05 GMT
content-encoding: br
strict-transport-security: max-age=31536000
server: Netlify
age: 47988
cache-status: "Netlify Edge"; hit
etag: "12e801962e10f6d1010c18a06f69df7b-ssl-df"
vary: Accept-Encoding
content-type: text/css; charset=UTF-8
cache-control: public,max-age=0,must-revalidate
accept-ranges: bytes
content-length: 7182

GET
H2 200 b3c831d72c60daeb.css
www.deepinstinct.com/_next/static/css/ 15 KB
4 KB 184ms
183ms Stylesheet
text/css 3.70.101.28
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.deepinstinct.com/_next/static/css/b3c831d72c60daeb.css

Requested by

Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.70.101.28 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-70-101-28.eu-central-1.compute.amazonaws.com

Software

Netlify /

Resource Hash

0130b680d34de9079a7677f6954c5fded22ad91a7791e2acd86f3ed53191a1d8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework
Accept-Language: he-IL,he;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-nf-request-id: 01HW7VQVCHW3D8SV4E5627GCNS
date: Wed, 24 Apr 2024 10:52:05 GMT
content-encoding: br
strict-transport-security: max-age=31536000
server: Netlify
age: 72427
cache-status: "Netlify Edge"; hit
etag: "b612c4d93b4d750f521d7cf025d5fdd3-ssl-df"
vary: Accept-Encoding
content-type: text/css; charset=UTF-8
cache-control: public,max-age=0,must-revalidate
accept-ranges: bytes
content-length: 3542

GET
H2 200 ddca67f80ea11511.css
www.deepinstinct.com/_next/static/css/ 889 B
1021 B 154ms
154ms Stylesheet
text/css 3.70.101.28
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.deepinstinct.com/_next/static/css/ddca67f80ea11511.css

Requested by

Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.70.101.28 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-70-101-28.eu-central-1.compute.amazonaws.com

Software

Netlify /

Resource Hash

4db83b291d4b780a54c7a0e998e64ce8cf5bace8d0612dc0082b0d961f04ce04

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework
Accept-Language: he-IL,he;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-nf-request-id: 01HW7VQVCH18Q7WP39TYRK2189
date: Wed, 24 Apr 2024 10:52:05 GMT
strict-transport-security: max-age=31536000
server: Netlify
age: 72427
cache-status: "Netlify Edge"; hit
etag: "bf94acaf8c7e8837fa3d2ad39b6a0f87-ssl"
content-type: text/css; charset=UTF-8
cache-control: public,max-age=0,must-revalidate
accept-ranges: bytes
content-length: 889

GET
H2 200 5935-76bf011ee3d88f83.js Show response
www.deepinstinct.com/_next/static/chunks/ 30 KB
10 KB 195ms
188ms Script
application/javascript 3.70.101.28
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.deepinstinct.com/_next/static/chunks/5935-76bf011ee3d88f83.js

Requested by

Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.70.101.28 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-70-101-28.eu-central-1.compute.amazonaws.com

Software

Netlify /

Resource Hash

3a9972297dfa97e4f6a11cc17f5767935ffa27d7c6d92123e38fd423bd4afd9e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework
Accept-Language: he-IL,he;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-nf-request-id: 01HW7VQVX76FVNQM6HYHVWN6AX
date: Wed, 24 Apr 2024 10:52:05 GMT
content-encoding: br
strict-transport-security: max-age=31536000
server: Netlify
age: 47987
cache-status: "Netlify Edge"; hit
etag: "711c7a0bda1d2a5419580350a0ac2def-ssl-df"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
cache-control: public,max-age=0,must-revalidate
accept-ranges: bytes
content-length: 10222

GET
H2 200 7029-3230841eb82dea3f.js Show response
www.deepinstinct.com/_next/static/chunks/ 123 KB
37 KB 161ms
154ms Script
application/javascript 3.70.101.28
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.deepinstinct.com/_next/static/chunks/7029-3230841eb82dea3f.js

Requested by

Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.70.101.28 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-70-101-28.eu-central-1.compute.amazonaws.com

Software

Netlify /

Resource Hash

529f9f3aa54fc536d8b9b39f45d3d8bbfbbe067545c2c375ea3fd5f0d446ac14

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework
Accept-Language: he-IL,he;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-nf-request-id: 01HW7VQVX7HPW7M3DZW6N6BART
date: Wed, 24 Apr 2024 10:52:05 GMT
content-encoding: br
strict-transport-security: max-age=31536000
server: Netlify
age: 67543
cache-status: "Netlify Edge"; hit
etag: "163091f8d515307568ca14bd7c244cee-ssl-df"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
cache-control: public,max-age=0,must-revalidate
accept-ranges: bytes
content-length: 37451

GET
H2 200 6839.c8ee40f8e73e0e22.js Show response
www.deepinstinct.com/_next/static/chunks/ 2 KB
1 KB 363ms
357ms Script
application/javascript 3.70.101.28
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.deepinstinct.com/_next/static/chunks/6839.c8ee40f8e73e0e22.js

Requested by

Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.70.101.28 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-70-101-28.eu-central-1.compute.amazonaws.com

Software

Netlify /

Resource Hash

67a86dcd9de0e056f9b4be883e95c1587463e7b87e5390982c02e1822f9c3356

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework
Accept-Language: he-IL,he;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-nf-request-id: 01HW7VQVX70GJR08TMH44HT92G
date: Wed, 24 Apr 2024 10:52:05 GMT
content-encoding: br
strict-transport-security: max-age=31536000
server: Netlify
age: 72427
cache-status: "Netlify Edge"; hit
etag: "42b37c98d571c31326f0ce7f5b379979-ssl-df"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
cache-control: public,max-age=0,must-revalidate
accept-ranges: bytes
content-length: 1059

GET
H2 200 webpack-29002f1662bf7c0b.js Show response
www.deepinstinct.com/_next/static/chunks/ 7 KB
3 KB 352ms
345ms Script
application/javascript 3.70.101.28
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.deepinstinct.com/_next/static/chunks/webpack-29002f1662bf7c0b.js

Requested by

Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.70.101.28 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-70-101-28.eu-central-1.compute.amazonaws.com

Software

Netlify /

Resource Hash

1ed76e4688ef9d3b8245de7492c54d081dbb25796bde18fe026183bc57b13501

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework
Accept-Language: he-IL,he;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-nf-request-id: 01HW7VQVX760K8549JXN3BHETS
date: Wed, 24 Apr 2024 10:52:05 GMT
content-encoding: br
strict-transport-security: max-age=31536000
server: Netlify
age: 47987
cache-status: "Netlify Edge"; hit
etag: "08ae6cd137e5a9f44ce8da97bbdf3bdf-ssl-df"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
cache-control: public,max-age=0,must-revalidate
accept-ranges: bytes
content-length: 3379

GET
H2 200 framework-314c182fa7e2bf37.js Show response
www.deepinstinct.com/_next/static/chunks/ 138 KB
43 KB 276ms
270ms Script
application/javascript 3.70.101.28
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.deepinstinct.com/_next/static/chunks/framework-314c182fa7e2bf37.js

Requested by

Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.70.101.28 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-70-101-28.eu-central-1.compute.amazonaws.com

Software

Netlify /

Resource Hash

fff0bdb3f70b85b820a949503a24610fb007cf4582f1e67f4835a14de511d50f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework
Accept-Language: he-IL,he;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-nf-request-id: 01HW7VQVX7GZR8P74R7Z5DKCKT
date: Wed, 24 Apr 2024 10:52:05 GMT
content-encoding: br
strict-transport-security: max-age=31536000
server: Netlify
age: 47987
cache-status: "Netlify Edge"; hit
etag: "842190aeeb138e17ecbd4e80395b04db-ssl-df"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
cache-control: public,max-age=0,must-revalidate
accept-ranges: bytes
content-length: 43634

GET
H2 200 main-c5b7e6d77b82bab5.js Show response
www.deepinstinct.com/_next/static/chunks/ 124 KB
35 KB 364ms
357ms Script
application/javascript 3.70.101.28
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.deepinstinct.com/_next/static/chunks/main-c5b7e6d77b82bab5.js

Requested by

Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.70.101.28 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-70-101-28.eu-central-1.compute.amazonaws.com

Software

Netlify /

Resource Hash

c9476026edd0c62a79ca209ab6ccb1b5f2611ef3049b8d771071878003f6871e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework
Accept-Language: he-IL,he;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-nf-request-id: 01HW7VQVX80KFJK170JY9Y53W3
date: Wed, 24 Apr 2024 10:52:05 GMT
content-encoding: br
strict-transport-security: max-age=31536000
server: Netlify
age: 47987
cache-status: "Netlify Edge"; hit
etag: "f5b74e619e9eb5d06577186ed77b231a-ssl-df"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
cache-control: public,max-age=0,must-revalidate
accept-ranges: bytes
content-length: 35738

GET
H2 200 _app-88813e0d1ae2e973.js Show response
www.deepinstinct.com/_next/static/chunks/pages/ 450 B
536 B 363ms
357ms Script
application/javascript 3.70.101.28
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.deepinstinct.com/_next/static/chunks/pages/_app-88813e0d1ae2e973.js

Requested by

Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.70.101.28 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-70-101-28.eu-central-1.compute.amazonaws.com

Software

Netlify /

Resource Hash

c9a95f9262273cfe4ae43a8a0dbb61ce3d4fbcff4b54d2350258b39cd08b32e0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework
Accept-Language: he-IL,he;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-nf-request-id: 01HW7VQVX82R9BE6CRK7RN0Y93
date: Wed, 24 Apr 2024 10:52:05 GMT
strict-transport-security: max-age=31536000
server: Netlify
age: 72427
cache-status: "Netlify Edge"; hit
etag: "50537b790c14aad9a5df48742d265dfa-ssl"
content-type: application/javascript; charset=UTF-8
cache-control: public,max-age=0,must-revalidate
accept-ranges: bytes
content-length: 450

GET
H2 200 5675-5d8e1c18eb2a06a1.js Show response
www.deepinstinct.com/_next/static/chunks/ 9 KB
4 KB 386ms
380ms Script
application/javascript 3.70.101.28
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.deepinstinct.com/_next/static/chunks/5675-5d8e1c18eb2a06a1.js

Requested by

Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.70.101.28 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-70-101-28.eu-central-1.compute.amazonaws.com

Software

Netlify /

Resource Hash

d66b13d15c9f6d62412758da1d16472e96466304912f1fe178ef8d5b3b44cda0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework
Accept-Language: he-IL,he;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-nf-request-id: 01HW7VQVYZ4N5Z9XQ0MAQ96VSZ
date: Wed, 24 Apr 2024 10:52:05 GMT
content-encoding: br
strict-transport-security: max-age=31536000
server: Netlify
age: 72427
cache-status: "Netlify Edge"; hit
etag: "ae4ef7f9e1361f41374b10337ad35c3b-ssl-df"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
cache-control: public,max-age=0,must-revalidate
accept-ranges: bytes
content-length: 3724

GET
H2 200 8882-efb8f68e8ac16c1e.js Show response
www.deepinstinct.com/_next/static/chunks/ 27 KB
10 KB 388ms
384ms Script
application/javascript 3.70.101.28
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.deepinstinct.com/_next/static/chunks/8882-efb8f68e8ac16c1e.js

Requested by

Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.70.101.28 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-70-101-28.eu-central-1.compute.amazonaws.com

Software

Netlify /

Resource Hash

94c1047f45725fdfd62ad286aae8ff577b87af99f3c6ff9e271fca751398cbbc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework
Accept-Language: he-IL,he;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-nf-request-id: 01HW7VQVYZ6DGFRFABPGERX0K8
date: Wed, 24 Apr 2024 10:52:05 GMT
content-encoding: br
strict-transport-security: max-age=31536000
server: Netlify
age: 72427
cache-status: "Netlify Edge"; hit
etag: "e9c9a5087b21357b065e593c5a56f0d3-ssl-df"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
cache-control: public,max-age=0,must-revalidate
accept-ranges: bytes
content-length: 9855

GET
H2 200 1053-69c3e67c1a3e9c2f.js Show response
www.deepinstinct.com/_next/static/chunks/ 89 KB
31 KB 394ms
389ms Script
application/javascript 3.70.101.28
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.deepinstinct.com/_next/static/chunks/1053-69c3e67c1a3e9c2f.js

Requested by

Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.70.101.28 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-70-101-28.eu-central-1.compute.amazonaws.com

Software

Netlify /

Resource Hash

3c51542bd74124ed2bae5b0d8cb837dc7e567a94acaee00f4c686dfb8d272018

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework
Accept-Language: he-IL,he;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-nf-request-id: 01HW7VQVYZ5VDWJ566N3G20WX6
date: Wed, 24 Apr 2024 10:52:05 GMT
content-encoding: br
strict-transport-security: max-age=31536000
server: Netlify
age: 72427
cache-status: "Netlify Edge"; hit
etag: "78b7ac861927eedc433e1fd1aff23deb-ssl-df"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
cache-control: public,max-age=0,must-revalidate
accept-ranges: bytes
content-length: 31174

GET
H2 200 512-de9e9b45ad8341f5.js Show response
www.deepinstinct.com/_next/static/chunks/ 17 KB
6 KB 387ms
383ms Script
application/javascript 3.70.101.28
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.deepinstinct.com/_next/static/chunks/512-de9e9b45ad8341f5.js

Requested by

Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.70.101.28 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-70-101-28.eu-central-1.compute.amazonaws.com

Software

Netlify /

Resource Hash

8d3a1bf6e2df7ec1dc004f9ea76c89627a5a1d3350d2e01f833dd20ffddee5b6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework
Accept-Language: he-IL,he;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-nf-request-id: 01HW7VQVYZ7WDMFK5612MAXY0P
date: Wed, 24 Apr 2024 10:52:05 GMT
content-encoding: br
strict-transport-security: max-age=31536000
server: Netlify
age: 135663
cache-status: "Netlify Edge"; hit
etag: "f23770c964cb4a5c463e6f0d11791c33-ssl-df"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
cache-control: public,max-age=0,must-revalidate
accept-ranges: bytes
content-length: 5550

GET
H2 200 %5Bpid%5D-7f7601d838d136ca.js Show response
www.deepinstinct.com/_next/static/chunks/pages/blog/ 547 B
658 B 386ms
382ms Script
application/javascript 3.70.101.28
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.deepinstinct.com/_next/static/chunks/pages/blog/%5Bpid%5D-7f7601d838d136ca.js

Requested by

Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.70.101.28 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-70-101-28.eu-central-1.compute.amazonaws.com

Software

Netlify /

Resource Hash

1ea94e6fc8afdc8a96c72f6821974bbfe2126b9a960c469251c88f2d5dd02260

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework
Accept-Language: he-IL,he;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-nf-request-id: 01HW7VQVYZHQ7VHV56MFN76H1H
date: Wed, 24 Apr 2024 10:52:05 GMT
strict-transport-security: max-age=31536000
server: Netlify
age: 72427
cache-status: "Netlify Edge"; hit
etag: "f101ba9e2d84013ead218fe806d71a13-ssl"
content-type: application/javascript; charset=UTF-8
cache-control: public,max-age=0,must-revalidate
accept-ranges: bytes
content-length: 547

GET
H2 200 _buildManifest.js Show response
www.deepinstinct.com/_next/static/7-TyYd0Ikn4eVyBeP3eWe/ 8 KB
2 KB 385ms
382ms Script
application/javascript 3.70.101.28
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.deepinstinct.com/_next/static/7-TyYd0Ikn4eVyBeP3eWe/_buildManifest.js

Requested by

Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.70.101.28 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-70-101-28.eu-central-1.compute.amazonaws.com

Software

Netlify /

Resource Hash

3c98404a986fe5182a2b6214d370226eb15a0cb58af0a25c5e9a95239535f5ee

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework
Accept-Language: he-IL,he;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-nf-request-id: 01HW7VQVYZDK574JWA87JMBC86
date: Wed, 24 Apr 2024 10:52:05 GMT
content-encoding: br
strict-transport-security: max-age=31536000
server: Netlify
age: 72427
cache-status: "Netlify Edge"; hit
etag: "8d7e44c890b374fe3291edb4d40e58a2-ssl-df"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
cache-control: public,max-age=0,must-revalidate
accept-ranges: bytes
content-length: 1529

GET
H2 200 _ssgManifest.js Show response
www.deepinstinct.com/_next/static/7-TyYd0Ikn4eVyBeP3eWe/ 455 B
547 B 383ms
380ms Script
application/javascript 3.70.101.28
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.deepinstinct.com/_next/static/7-TyYd0Ikn4eVyBeP3eWe/_ssgManifest.js

Requested by

Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.70.101.28 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-70-101-28.eu-central-1.compute.amazonaws.com

Software

Netlify /

Resource Hash

32cc58a56e1170810316c9cb82dd82a1fb379e2b82139b5ed039063bb40e4724

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework
Accept-Language: he-IL,he;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-nf-request-id: 01HW7VQVYZP9T36NWMGFZM5CHC
date: Wed, 24 Apr 2024 10:52:05 GMT
strict-transport-security: max-age=31536000
server: Netlify
age: 72426
cache-status: "Netlify Edge"; hit
etag: "c28c1e4abeeaf5ddbabf351bc59836fa-ssl"
content-type: application/javascript; charset=UTF-8
cache-control: public,max-age=0,must-revalidate
accept-ranges: bytes
content-length: 455

GET
H2 200 zka3qml.css
use.typekit.net/ 3 KB
993 B 1041ms
536ms Stylesheet
text/css 23.200.36.197
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://use.typekit.net/zka3qml.css

Requested by

Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.200.36.197 , Mexico, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a23-200-36-197.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

9d9e8a96a73580c975860c5b2fa6488d785af4b44e2f0a0a35cbbc891c863746

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains;

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.deepinstinct.com/
Accept-Language: he-IL,he;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

strict-transport-security: max-age=31536000; includeSubDomains;
content-encoding: gzip
date: Wed, 24 Apr 2024 10:52:06 GMT
server: nginx
vary: Accept-Encoding
content-type: text/css;charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=600, stale-while-revalidate=604800
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 770

GET
H2 200 fig01-threat-actors-behind-the-attack.png
images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt79ab55a6f21afecc/660dde571e8523d4db73a039/ 64 KB
64 KB 429ms
137ms Image
image/png 151.101.66.137
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt79ab55a6f21afecc/660dde571e8523d4db73a039/fig01-threat-actors-behind-the-attack.png
Requested by: Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.66.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: contentstack /
Resource Hash: 6a231076c5c83e79bea81510940b1fdd77839f3873526b0d49485be6697d0e8f

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.deepinstinct.com/
Accept-Language: he-IL,he;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 24 Apr 2024 10:52:05 GMT
via: 1.1 varnish, 1.1 varnish
fastly-io-served-by: vpop-haf2300703
x-cache: HIT, HIT
fastly-io-info: ifsz=65512 idim=959x352 ifmt=png ofsz=65485 odim=959x352 ofmt=png
content-disposition: inline; filename=fig01-threat-actors-behind-the-attack.png
fastly-stats: io=1
content-length: 65485
x-request-id: bdc22ad351705a5892f096edccb75e2d
x-served-by: cache-sjc1000100-SJC, cache-mrs10530-MRS
x-runtime: 70ms
server: contentstack
x-timer: S1713955926.762066,VS0,VE1
x-contentstack-organization: bltdec97706489ab5de
etag: "VEnI2SRgCKF7O3N/g1JMMt8mHvFARxWKJS+kxe7JNsE"
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: content-disposition, content-type, cache-control, status, content-length
cache-control: max-age=31536000
accept-ranges: bytes
x-cache-hits: 179, 0

GET
H2 200 fig02-faketivism.png
images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltbdfb7ae1ffe166ed/660dde571d996f2393153c9e/ 95 KB
96 KB 419ms
137ms Image
image/png 151.101.66.137
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltbdfb7ae1ffe166ed/660dde571d996f2393153c9e/fig02-faketivism.png
Requested by: Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.66.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: contentstack /
Resource Hash: 8e081ea7988f4b0266528e9ec8b76799e66157ff1a989f649710d6c725a7855a

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.deepinstinct.com/
Accept-Language: he-IL,he;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 24 Apr 2024 10:52:05 GMT
via: 1.1 varnish, 1.1 varnish
fastly-io-served-by: vpop-haf2300706
x-cache: HIT, HIT
fastly-io-info: ifsz=97816 idim=886x430 ifmt=png ofsz=97214 odim=886x430 ofmt=png
content-disposition: inline; filename=fig02-faketivism.png
fastly-stats: io=1
content-length: 97214
x-request-id: 2e37da787e3e2a6e8ca7adb73c0b0a2b
x-served-by: cache-sjc10044-SJC, cache-mrs10530-MRS
x-runtime: 111ms
server: contentstack
x-timer: S1713955926.762101,VS0,VE1
x-contentstack-organization: bltdec97706489ab5de
etag: "dOM9Tlik+m9shWIGyZg+b6nO+tORUueAg4gj+nZYapU"
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: content-disposition, content-type, cache-control, status, content-length
cache-control: max-age=31536000
accept-ranges: bytes
x-cache-hits: 13, 0

GET
H2 200 fig03-current-muddywater-campign.png
www.deepinstinct.com/image/bltc0997229863d1710/660dde6bf407dd847e3167b5/ 63 KB
63 KB 417ms
409ms Image
image/png 3.70.101.28
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.deepinstinct.com/image/bltc0997229863d1710/660dde6bf407dd847e3167b5/fig03-current-muddywater-campign.png

Requested by

Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.70.101.28 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-70-101-28.eu-central-1.compute.amazonaws.com

Software

Netlify /

Resource Hash

0f701def79cf3f86b8f75e4f805436a387ff2718851060447561b89a6daae4e6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework
Accept-Language: he-IL,he;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-nf-request-id: 01HW7VQVX6Z3D6A7DD7JRJRK1W
date: Wed, 24 Apr 2024 10:52:06 GMT
strict-transport-security: max-age=31536000
via: 1.1 varnish, 1.1 varnish
x-content-type-options: nosniff
age: 1
fastly-io-served-by: vpop-haf2300711
x-cache: MISS, HIT
fastly-io-info: ifsz=74622 idim=1086x341 ifmt=png ofsz=64213 odim=1086x341 ofmt=png
content-disposition: inline; filename=fig03-current-muddywater-campign.png
fastly-stats: io=1
content-length: 64213
x-request-id: 8f80c28561388a4a21b0b01320e1ca26
x-served-by: cache-sjc10041-SJC, cache-iad-kcgs7200083-IAD
x-runtime: 97ms
netlify-vary: header=x-nextjs-data,cookie=__prerender_bypass|__next_preview_data
server: Netlify
x-timer: S1713955926.011118,VS0,VE2
x-contentstack-organization: bltdec97706489ab5de
cache-status: "Netlify Edge"; fwd=miss
etag: "v+vVzFipZI8vegdG4hRmEEU8Un0vcYa4X5FK2gUgmIc"
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: content-disposition, content-type, cache-control, status, content-length
cache-control: max-age=31536000
accept-ranges: bytes
x-cache-hits: 0, 0

GET
H2 200 fig04-uploader-information-at-kinneretacil.jfif
www.deepinstinct.com/image/blt3476f102a9f89a62/660dde57dd5b9e45fca8a154/ 22 KB
22 KB 471ms
464ms Image
image/jpeg 3.70.101.28
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.deepinstinct.com/image/blt3476f102a9f89a62/660dde57dd5b9e45fca8a154/fig04-uploader-information-at-kinneretacil.jfif

Requested by

Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.70.101.28 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-70-101-28.eu-central-1.compute.amazonaws.com

Software

Netlify /

Resource Hash

5af2bd700fd3e70bdb66c457260e13362e077c992b9a8e91ef601515c91bf3fc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework
Accept-Language: he-IL,he;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-nf-request-id: 01HW7VQVX6566RP3339N5M36ZJ
date: Wed, 24 Apr 2024 10:52:06 GMT
strict-transport-security: max-age=31536000
via: 1.1 varnish, 1.1 varnish
x-content-type-options: nosniff
age: 1
fastly-io-served-by: vpop-haf2300701
x-cache: MISS, HIT
fastly-io-info: ifsz=22606 idim=1429x292 ifmt=jpeg ofsz=22606 odim=1429x292 ofmt=jpeg
content-disposition: inline; filename=fig04-uploader-information-at-kinneretacil.jfif
fastly-stats: io=1
content-length: 22606
fastly-io-warning: Failed to shrink image
x-request-id: ef003cee43b78d5c4189393012af90f7
x-served-by: cache-sjc1000142-SJC, cache-iad-kjyo7100102-IAD
x-runtime: 44ms
netlify-vary: header=x-nextjs-data,cookie=__prerender_bypass|__next_preview_data
server: Netlify
x-timer: S1713955926.047285,VS0,VE1
x-contentstack-organization: bltdec97706489ab5de
cache-status: "Netlify Edge"; fwd=miss
etag: "wKbkTH77ViUEbiMLak1GQ7udMH+1721nLL9a+kZWHuE"
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: content-disposition, content-type, cache-control, status, content-length
cache-control: max-age=31536000
accept-ranges: bytes
x-cache-hits: 0, 0

GET
H2 200 fig05-uploader_info-salary.png
www.deepinstinct.com/image/blt5a810cdcb9775a47/660dde57c3bc8b6742dd2d72/ 16 KB
16 KB 460ms
452ms Image
image/png 3.70.101.28
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.deepinstinct.com/image/blt5a810cdcb9775a47/660dde57c3bc8b6742dd2d72/fig05-uploader_info-salary.png

Requested by

Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.70.101.28 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-70-101-28.eu-central-1.compute.amazonaws.com

Software

Netlify /

Resource Hash

fe2d748cbd7dde62aad4dd1fcf6e6a81675c7fec34601791ac4ab1d2ce6317f7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework
Accept-Language: he-IL,he;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-nf-request-id: 01HW7VQVX6ZW8JQZS1T0ZYGW70
date: Wed, 24 Apr 2024 10:52:06 GMT
strict-transport-security: max-age=31536000
via: 1.1 varnish, 1.1 varnish
x-content-type-options: nosniff
age: 1
fastly-io-served-by: vpop-haf2300714
x-cache: MISS, HIT
fastly-io-info: ifsz=16145 idim=1115x486 ifmt=png ofsz=16115 odim=1115x486 ofmt=png
content-disposition: inline; filename=fig05-uploader_info-salary.png
fastly-stats: io=1
content-length: 16115
fastly-io-warning: Failed to shrink image
x-request-id: 6fe01d74490c19f267c2ad23d4ef0af1
x-served-by: cache-sjc10042-SJC, cache-iad-kiad7000124-IAD
x-runtime: 60ms
netlify-vary: header=x-nextjs-data,cookie=__prerender_bypass|__next_preview_data
server: Netlify
x-timer: S1713955926.014916,VS0,VE1
x-contentstack-organization: bltdec97706489ab5de
cache-status: "Netlify Edge"; fwd=miss
etag: "PMiaPw5iDMnKjyE27Yu4yThV25UYkXcjvoPCbYdHF2w"
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: content-disposition, content-type, cache-control, status, content-length
cache-control: max-age=31536000
accept-ranges: bytes
x-cache-hits: 0, 0

GET
H2 200 fig06-darkbit_muddy.png
images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt8cd3b042edd84394/660dde561e8523371d73a035/ 5 KB
5 KB 182ms
179ms Image
image/png 151.101.66.137
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt8cd3b042edd84394/660dde561e8523371d73a035/fig06-darkbit_muddy.png
Requested by: Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.66.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: contentstack /
Resource Hash: ef6c6142ca7d544ac9af662547dc404225e959789e811607d8acea4f07e0d89d

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.deepinstinct.com/
Accept-Language: he-IL,he;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 24 Apr 2024 10:52:05 GMT
via: 1.1 varnish, 1.1 varnish
fastly-io-served-by: vpop-haf2300708
x-cache: HIT, HIT
fastly-io-info: ifsz=6674 idim=486x114 ifmt=png ofsz=4766 odim=486x114 ofmt=png
content-disposition: inline; filename=fig06-darkbit_muddy.png
fastly-stats: io=1
content-length: 4766
x-request-id: 60e4712a8f8dfe337406f4ea759a3cd4
x-served-by: cache-sjc1000093-SJC, cache-mrs10530-MRS
x-runtime: 58ms
server: contentstack
x-timer: S1713955926.917077,VS0,VE1
x-contentstack-organization: bltdec97706489ab5de
etag: "vmzGr3PB1WNT/Qy+VppMOcSoI5k7kl9iWEFGri9t0g4"
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: content-disposition, content-type, cache-control, status, content-length
cache-control: max-age=31536000
accept-ranges: bytes
x-cache-hits: 25, 0

GET
H2 200 fig07-freeupload.png
images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blteb808cbb731a332a/660dde6b1e85231c2473a041/ 10 KB
10 KB 177ms
174ms Image
image/png 151.101.66.137
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blteb808cbb731a332a/660dde6b1e85231c2473a041/fig07-freeupload.png
Requested by: Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.66.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: contentstack /
Resource Hash: 6006a799a37d5e75090b1631ac710ad8aeac54acf5a48b1beee8c2e52b9c9fd6

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.deepinstinct.com/
Accept-Language: he-IL,he;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 24 Apr 2024 10:52:05 GMT
via: 1.1 varnish, 1.1 varnish
fastly-io-served-by: vpop-haf2300701
x-cache: HIT, HIT
fastly-io-info: ifsz=10140 idim=1127x56 ifmt=png ofsz=10110 odim=1127x56 ofmt=png
content-disposition: inline; filename=fig07-freeupload.png
fastly-stats: io=1
content-length: 10110
fastly-io-warning: Failed to shrink image
x-served-by: cache-sjc1000121-SJC, cache-mrs10530-MRS
x-runtime: 79ms
x-request-id: 6da342a52cd0539adef7e49ac7728397
server: contentstack
x-timer: S1713955926.917002,VS0,VE1
x-contentstack-organization: bltdec97706489ab5de
etag: "CEzcrV5QqWebRUiDirfFaaWk+AJPzpKZW2GdNo1NG+Q"
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: content-disposition, content-type, cache-control, status, content-length
cache-control: max-age=31536000
accept-ranges: bytes
x-cache-hits: 136, 0

GET
H2 200 fig08-setting_powershell.png
www.deepinstinct.com/image/blt10d68a9cdc3db0f4/660dde6b04d34c5c1dbdb650/ 16 KB
17 KB 474ms
471ms Image
image/png 3.70.101.28
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.deepinstinct.com/image/blt10d68a9cdc3db0f4/660dde6b04d34c5c1dbdb650/fig08-setting_powershell.png

Requested by

Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.70.101.28 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-70-101-28.eu-central-1.compute.amazonaws.com

Software

Netlify /

Resource Hash

c8e3b35aa911b1e6364305e850e35072e75dbceb7fb3ed39b6c9fdf1d216b464

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework
Accept-Language: he-IL,he;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-nf-request-id: 01HW7VQVYZETH928ND00RW3FCT
date: Wed, 24 Apr 2024 10:52:06 GMT
strict-transport-security: max-age=31536000
via: 1.1 varnish, 1.1 varnish
x-content-type-options: nosniff
age: 1
fastly-io-served-by: vpop-haf2300704
x-cache: MISS, HIT
fastly-io-info: ifsz=31883 idim=975x393 ifmt=png ofsz=16384 odim=975x393 ofmt=png
content-disposition: inline; filename=fig08-setting_powershell.png
fastly-stats: io=1
content-length: 16384
x-request-id: 7d063db2060a9a2771322d5e35cc4f00
x-served-by: cache-sjc1000114-SJC, cache-iad-kcgs7200144-IAD
x-runtime: 68ms
netlify-vary: header=x-nextjs-data,cookie=__prerender_bypass|__next_preview_data
server: Netlify
x-timer: S1713955926.060671,VS0,VE2
x-contentstack-organization: bltdec97706489ab5de
cache-status: "Netlify Edge"; fwd=miss
etag: "tMzTzAePC2mduhoWWL08QdmnCEzhK2qRsCO7q0ncweg"
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: content-disposition, content-type, cache-control, status, content-length
cache-control: max-age=31536000
accept-ranges: bytes
x-cache-hits: 0, 0

GET
H2 200 fig09-8946172.png
www.deepinstinct.com/image/blt53a4d37b3f7a9782/660dde6bcac0bc1852c882a3/ 11 KB
12 KB 471ms
468ms Image
image/png 3.70.101.28
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.deepinstinct.com/image/blt53a4d37b3f7a9782/660dde6bcac0bc1852c882a3/fig09-8946172.png

Requested by

Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.70.101.28 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-70-101-28.eu-central-1.compute.amazonaws.com

Software

Netlify /

Resource Hash

6353083e47f984144841ad6f17cb6fd0332a4b629c2089d603f8b2bf04dcf2f8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework
Accept-Language: he-IL,he;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-nf-request-id: 01HW7VQVYZF62GGAD9D0HCC0WE
date: Wed, 24 Apr 2024 10:52:06 GMT
strict-transport-security: max-age=31536000
via: 1.1 varnish, 1.1 varnish
x-content-type-options: nosniff
age: 1
fastly-io-served-by: vpop-haf2300705
x-cache: MISS, HIT
fastly-io-info: ifsz=19931 idim=997x173 ifmt=png ofsz=11526 odim=997x173 ofmt=png
content-disposition: inline; filename=fig09-8946172.png
fastly-stats: io=1
content-length: 11526
x-request-id: ec9fc83b992e027811e55099b9a0e4ae
x-served-by: cache-sjc1000143-SJC, cache-iad-kjyo7100101-IAD
x-runtime: 56ms
netlify-vary: header=x-nextjs-data,cookie=__prerender_bypass|__next_preview_data
server: Netlify
x-timer: S1713955926.063774,VS0,VE2
x-contentstack-organization: bltdec97706489ab5de
cache-status: "Netlify Edge"; fwd=miss
etag: "udEo+45YI5JQNwd9RtBJhX29jtb6aexXu+JLlOswPTs"
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: content-disposition, content-type, cache-control, status, content-length
cache-control: max-age=31536000
accept-ranges: bytes
x-cache-hits: 0, 0

GET
H2 200 fig10-7878123.png
www.deepinstinct.com/image/bltba953ef3b04cf0c5/660dde6ba16454602c462058/ 13 KB
13 KB 660ms
658ms Image
image/png 3.70.101.28
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.deepinstinct.com/image/bltba953ef3b04cf0c5/660dde6ba16454602c462058/fig10-7878123.png

Requested by

Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.70.101.28 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-70-101-28.eu-central-1.compute.amazonaws.com

Software

Netlify /

Resource Hash

7a80c7ae20682012e0a7a06ed486183dc5d7cd45763e09221073675bc067b606

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework
Accept-Language: he-IL,he;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-nf-request-id: 01HW7VQVYZSMJ3FACSA45JANHA
date: Wed, 24 Apr 2024 10:52:06 GMT
strict-transport-security: max-age=31536000
via: 1.1 varnish, 1.1 varnish
x-content-type-options: nosniff
age: 0
fastly-io-served-by: vpop-haf2300709
x-cache: MISS, HIT
fastly-io-info: ifsz=23526 idim=977x364 ifmt=png ofsz=13011 odim=977x364 ofmt=png
content-disposition: inline; filename=fig10-7878123.png
fastly-stats: io=1
content-length: 13011
x-request-id: b98674c462cc83a8c2c22324382fa302
x-served-by: cache-sjc10047-SJC, cache-iad-kiad7000123-IAD
x-runtime: 47ms
netlify-vary: header=x-nextjs-data,cookie=__prerender_bypass|__next_preview_data
server: Netlify
x-timer: S1713955926.356719,VS0,VE1
x-contentstack-organization: bltdec97706489ab5de
cache-status: "Netlify Edge"; fwd=miss
etag: "aNLsCZiogfaK+dI13wowFMHlRypXq+Kq01w25juCPkg"
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: content-disposition, content-type, cache-control, status, content-length
cache-control: max-age=31536000
accept-ranges: bytes
x-cache-hits: 0, 0

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 299 KB
103 KB 454ms
152ms Script
application/javascript 142.250.185.232
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-52PC3MW

Requested by

Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.232 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s53-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

9f2f9720fde13fce4bc928011aaddb74522f6a9d672d1d42eda39222ed343d81

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.deepinstinct.com/
Accept-Language: he-IL,he;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 24 Apr 2024 10:52:06 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 104630
x-xss-protection: 0
last-modified: Wed, 24 Apr 2024 09:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Wed, 24 Apr 2024 10:52:06 GMT

GET
H2 200 p.css
p.typekit.net/ 5 B
172 B 764ms
251ms Stylesheet
text/css 23.200.36.209
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://p.typekit.net/p.css?s=1&k=zka3qml&ht=tk&f=10954.13454.13466.28969&a=83637106&app=typekit&e=css
Requested by: Host: use.typekit.net
URL: https://use.typekit.net/zka3qml.css
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.200.36.209 , Mexico, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a23-200-36-209.deploy.static.akamaitechnologies.com
Software: nginx /
Resource Hash: 1c0ff118a4290c99f39c90abb38703a866e47251b23cca20266c69c812ccafeb

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://use.typekit.net/
Accept-Language: he-IL,he;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 24 Apr 2024 10:52:07 GMT
last-modified: Sun, 22 Oct 2023 12:40:05 GMT
server: nginx
etag: "65351825-5"
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=604800
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
content-length: 5

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 284 KB
97 KB 148ms
147ms Script
application/javascript 142.250.185.232
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-P5MMKMDSNW&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-52PC3MW

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.232 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s53-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

ae4012d4ec0c5f4ca687526203ad35e9f1ea94479c286e533d86e1e24f9c8a19

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.deepinstinct.com/
Accept-Language: he-IL,he;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 24 Apr 2024 10:52:06 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 99384
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Wed, 24 Apr 2024 10:52:06 GMT

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 52 KB
21 KB 352ms
113ms Script
text/javascript 172.217.18.14
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-52PC3MW

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.18.14 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra02s19-in-f14.1e100.net

Software

Golfe2 /

Resource Hash

de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.deepinstinct.com/
Accept-Language: he-IL,he;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
date: Wed, 24 Apr 2024 09:48:08 GMT
last-modified: Tue, 12 Dec 2023 18:09:08 GMT
server: Golfe2
age: 3838
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 20994
expires: Wed, 24 Apr 2024 11:48:08 GMT

GET
H2 200 hotjar-1665869.js Show response
static.hotjar.com/c/ 9 KB
4 KB 374ms
142ms Script
application/javascript 18.66.102.53
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://static.hotjar.com/c/hotjar-1665869.js?sv=7

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-52PC3MW

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.66.102.53 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-66-102-53.fra56.r.cloudfront.net

Software

Resource Hash

f6735d6295b7bd837a2fa51038cbc7a6bb2e2b2b41550a7ea49619487175a48e

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.deepinstinct.com/
Accept-Language: he-IL,he;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

strict-transport-security: max-age=2592000; includeSubDomains
content-encoding: br
x-content-type-options: nosniff
date: Wed, 24 Apr 2024 10:52:06 GMT
via: 1.1 9015971351bc982a04ee209a022bb1f8.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-P2
etag: W/533e75318511bcadfbe27699181dc046
vary: Accept-Encoding
x-cache: RefreshHit from cloudfront
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
x-cache-hit: 1
cache-control: max-age=60
cross-origin-resource-policy: cross-origin
x-amz-cf-id: 2J8qn8-18b-ivxprlKu0sF88UcDwY6U5dmYdqEWd3zG4t7v0CCT0Tg==

GET
H2 200 8430ce879b38826d.min.js Show response
tag.demandbase.com/ 77 KB
22 KB 379ms
140ms Script
application/javascript 18.245.46.44
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://tag.demandbase.com/8430ce879b38826d.min.js

Requested by

Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.245.46.44 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-245-46-44.fra56.r.cloudfront.net

Software

AmazonS3 /

Resource Hash

118a0b64762282c340eb77e3234ae6d4e4ec71d140da6afa6139657c4f83bd00

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.deepinstinct.com/
Accept-Language: he-IL,he;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-amz-version-id: 7Ol_pEBx9393nVO_u3vwd1Rs.7TNHyqY
content-encoding: gzip
via: 1.1 0b328de7c6916513ee4489477445f2e2.cloudfront.net (CloudFront)
date: Wed, 24 Apr 2024 10:52:06 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
x-amz-cf-pop: FRA56-P9
age: 584
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
last-modified: Tue, 16 Apr 2024 11:34:52 GMT
server: AmazonS3
etag: W/"0beec52509383333869c12b2dc998b2c"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cache-control: public, max-age=3600
permissions-policy: accelerometer=(), camera=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), payment=(), usb=(), interest-cohort=()
x-amz-cf-id: ywccMhRyLwTVjniqs6tD6Sw96CXMASmIBDvPKBHHhsAF_alizcdMAw==

GET
H2 200 2183098.js Show response
js.hs-scripts.com/ 2 KB
1 KB 386ms
265ms Script
application/javascript 104.16.141.209
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://js.hs-scripts.com/2183098.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-52PC3MW

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.141.209 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

97a5c1081cd8d00089e641fb9bcd7f074d96dd77c89928d93aeabf665fdd752d

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.deepinstinct.com/
Accept-Language: he-IL,he;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 24 Apr 2024 10:52:06 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: EXPIRED
x-evy-trace-route-service-name: envoyset-translator
x-hubspot-correlation-id: 93600b3c-14c8-4708-991c-2f0a5c5bf6b7
x-envoy-upstream-service-time: 11
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: 93600b3c-14c8-4708-991c-2f0a5c5bf6b7
last-modified: Wed, 24 Apr 2024 10:46:50 GMT
server: cloudflare
vary: origin, Accept-Encoding
access-control-max-age: 3600
content-type: application/javascript;charset=utf-8
access-control-allow-origin: https://www.deepinstinct.com
x-evy-trace-virtual-host: all
x-evy-trace-served-by-pod: iad02/hubapi-td/envoy-proxy-5d47c8d44f-g8cqc
access-control-allow-credentials: true
cache-control: public, max-age=90
cf-ray: 87958abd8be9e3cf-TLV
expires: Wed, 24 Apr 2024 10:53:36 GMT

GET
H2 200 destination Show response
www.googletagmanager.com/gtag/ 245 KB
85 KB 152ms
152ms Script
application/javascript 142.250.185.232
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/destination?id=AW-812608847&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-52PC3MW

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.232 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s53-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

c067f327a772fd2813c9ff8173c4beb9b0048b18c614fdafa09e516c6e04e826

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.deepinstinct.com/
Accept-Language: he-IL,he;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 24 Apr 2024 10:52:06 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 87051
x-xss-protection: 0
last-modified: Wed, 24 Apr 2024 09:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Wed, 24 Apr 2024 10:52:06 GMT

GET
H2 200 insight.min.js Show response
snap.licdn.com/li.lms-analytics/ 48 KB
17 KB 755ms
249ms Script
application/javascript 23.200.38.43
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://snap.licdn.com/li.lms-analytics/insight.min.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-52PC3MW

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.200.38.43 , Mexico, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a23-200-38-43.deploy.static.akamaitechnologies.com

Software

Resource Hash

6cc4c722a50b4152194b13e7e3c8a1a5a5f23b17988f8fa85404394efc5c0984

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.deepinstinct.com/
Accept-Language: he-IL,he;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 24 Apr 2024 10:52:07 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 09 Apr 2024 07:42:51 GMT
x-cdn: AKAM
x-amz-server-side-encryption: AES256
vary: Accept-Encoding
content-type: application/javascript;charset=utf-8
cache-control: max-age=23673
accept-ranges: bytes
content-length: 17238

GET
H2 200 uwt.js Show response
static.ads-twitter.com/ 56 KB
15 KB 363ms
117ms Script
application/javascript 146.75.120.157
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://static.ads-twitter.com/uwt.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-52PC3MW
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 146.75.120.157 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 4d15ff2317e16ccd8ca1d3248fea7d91130e022369bb032824a84ad9967064df

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.deepinstinct.com/
Accept-Language: he-IL,he;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 24 Apr 2024 10:52:06 GMT
content-encoding: gzip
last-modified: Thu, 04 Apr 2024 00:26:35 GMT
x-amz-server-side-encryption: AES256
etag: "bbbcf811d8437a575d796a4c1e5d4fad+gzip+gzip"
vary: Accept-Encoding,Host
x-cache: HIT, HIT
content-type: application/javascript; charset=utf-8
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
x-tw-cdn: FT
cache-control: no-cache
accept-ranges: bytes
content-length: 15412
x-served-by: cache-iad-kcgs7200164-IAD, cache-fra-etou8220042-FRA

GET
H2 200 fbevents.js Show response
connect.facebook.net/en_US/ 218 KB
59 KB 348ms
114ms Script
application/x-javascript 157.240.253.1
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

157.240.253.1 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

xx-fbcdn-shv-02-fra5.fbcdn.net

Software

Resource Hash

01e9582655224c83e6c075f44b7eecb135e108b6ad2150bf6f78a0a77c4ad5e0

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' data: blob: facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;script-src .fbcdn.net .facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net wss://.fbcdn.net attachment.fbsbx.com blob: 'self';img-src 'self' data: blob: facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.deepinstinct.com/
Accept-Language: he-IL,he;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

content-security-policy: default-src 'self' data: blob: facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';img-src 'self' data: blob: facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script';
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; preload; includeSubDomains
date: Wed, 24 Apr 2024 10:52:06 GMT
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 57850
x-xss-protection: 0
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
x-fb-connection-quality: GOOD; q=0.7, rtt=53, rtx=0, c=12, mss=1380, tbw=2775, tp=-1, tpl=-1, uplat=1, ullat=-1
pragma: public
x-fb-debug: dRwvPZBOSH3nmkwG8oFM/MlUZEEiR5C+nKY/HQwog9hZH9qmRw9j2ZeAWkoGusEJBBka27QscO2MNyPDz7onPw==
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
cross-origin-opener-policy: same-origin-allow-popups;report-to="coop_report"
vary: Accept-Encoding
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
content-type: application/x-javascript; charset=utf-8
x-frame-options: DENY
cache-control: public, max-age=1200
permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), usb=(), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
timing-allow-origin: *
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 bat.js Show response
bat.bing.com/ 45 KB
13 KB 260ms
129ms Script
application/javascript 13.107.21.237
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://bat.bing.com/bat.js

Requested by

Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

13.107.21.237 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

823804a7807864b44093a3843788f4cd076e89cf4a6fdeb8d153ae5c2c2df721

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.deepinstinct.com/
Accept-Language: he-IL,he;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
date: Wed, 24 Apr 2024 10:52:06 GMT
last-modified: Thu, 29 Feb 2024 19:58:06 GMT
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: EECC8EB2B17B49398B2C071E2DB2C3A0 Ref B: TLV30EDGE0307 Ref C: 2024-04-24T10:52:06Z
etag: "01b4e9c496bda1:0"
vary: Accept-Encoding
x-cache: CONFIG_NOCACHE
content-type: application/javascript
cache-control: private,max-age=1800
accept-ranges: bytes
content-length: 13261

GET
H2 200 bizible.js Show response
cdn.bizible.com/scripts/ 67 KB
25 KB 468ms
111ms Script
application/x-javascript 152.195.15.58
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.bizible.com/scripts/bizible.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-52PC3MW

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

152.195.15.58 , United States, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECS (frb/67D4) /

Resource Hash

4c903880e86c99ed05c1387b955f7de1f6b97ccdd3ae9db3bf1c82cad6ac8a5a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSub

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.deepinstinct.com/
Accept-Language: he-IL,he;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 24 Apr 2024 10:52:06 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSub
last-modified: Fri, 19 Apr 2024 15:03:17 GMT
server: ECS (frb/67D4)
age: 49002
etag: "c630b1b56a92da1:0"
vary: Accept-Encoding
x-cache: HIT
content-type: application/x-javascript
cache-control: max-age=86400
accept-ranges: bytes
content-length: 25393

GET
H2 200 tracking.js Show response
trk.techtarget.com/ 3 KB
2 KB 222ms
90ms Script
text/javascript 104.18.36.196
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://trk.techtarget.com/tracking.js

Requested by

Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.36.196 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0c07b854855b0e2bd7839c3659defa45307e96e281b3c00571d09f213eb6a76e

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains; preload

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.deepinstinct.com/
Accept-Language: he-IL,he;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 24 Apr 2024 10:52:06 GMT
via: 1.1 google
content-encoding: br
cf-cache-status: HIT
cf-bgj: minify
last-modified: Tue, 13 Dec 2022 15:01:39 GMT
strict-transport-security: max-age=0; includeSubDomains; preload
age: 16527
server: cloudflare
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=1200
cf-ray: 87958abdab2be3e7-TLV
expires: Wed, 24 Apr 2024 11:12:06 GMT

GET
H2 200 qualified.js Show response
js.qualified.com/ 688 KB
167 KB 686ms
553ms Script
text/javascript 104.18.17.5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://js.qualified.com/qualified.js?token=DxHYmKWTScn3buDp

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-52PC3MW

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.17.5 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

be9814e6a9078f839720af16bf4859cc5c386ea740b72439b34b194dbd483cf3

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.deepinstinct.com/
Accept-Language: he-IL,he;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 24 Apr 2024 10:52:07 GMT
content-encoding: gzip
via: 1.1 spaces-router (2a9d893844a5)
strict-transport-security: max-age=63072000; includeSubDomains
cf-cache-status: MISS
x-content-type-options: nosniff
x-permitted-cross-domain-policies: none
x-xss-protection: 1; mode=block
x-request-id: e69a65f4-c926-d075-2520-75d538284407
pragma: no-cache
x-runtime: 0.026962
referrer-policy: strict-origin-when-cross-origin
server: cloudflare
etag: W/"be9814e6a9078f839720af16bf4859cc"
x-download-options: noopen
vary: Accept,Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: text/javascript; charset=utf-8
cache-control: public, max-age=14400
cf-ray: 87958abf0e57e3c7-TLV
expires: Wed, 24 Apr 2024 14:52:07 GMT

GET
H3 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/812608847/ 3 KB
1 KB 377ms
151ms Script
text/javascript 142.250.185.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/812608847/?random=1713955926734&cv=11&fst=1713955926734&bg=ffffff&guid=ON&async=1&gtm=45be44m0v9116635018z878451102za201&gcd=13l3l3l3l1&dma=0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.deepinstinct.com%2Fblog%2Fdarkbeatc2-the-latest-muddywater-attack-framework&hn=www.googleadservices.com&frm=0&tiba=DarkBeatC2%3A%20The%20Latest%20MuddyWater%20Attack%20Framework&npa=0&pscdl=noapi&auid=2125086103.1713955926&uaa=x86&uab=64&uafvl=Chromium%3B124.0.6367.60%7CGoogle%2520Chrome%3B124.0.6367.60%7CNot-A.Brand%3B99.0.0.0&uamb=0&uam=&uap=Win32&uapv=10.0.0&uaw=0&fdr=QA&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/destination?id=AW-812608847&l=dataLayer&cx=c

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s51-in-f2.1e100.net

Software

cafe /

Resource Hash

aee51003dabd4418d5d411c98526b3af7f28491933357c177099161b1e376bb6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.deepinstinct.com/
Accept-Language: he-IL,he;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Wed, 24 Apr 2024 10:52:07 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1465
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 collect
analytics.google.com/g/ 0
257 B 363ms
123ms Ping
text/plain 142.250.185.238
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://analytics.google.com/g/collect?v=2&tid=G-P5MMKMDSNW&gtm=45je44m0v868549395z878451102za200&_p=1713955925855&_gaz=1&gcd=13l3l3l3l1&npa=0&dma=0&cid=218287240.1713955927&ul=he-il&sr=1600x1200&uaa=x86&uab=64&uafvl=Chromium%3B124.0.6367.60%7CGoogle%2520Chrome%3B124.0.6367.60%7CNot-A.Brand%3B99.0.0.0&uamb=0&uam=&uap=Win32&uapv=10.0.0&uaw=0&pscdl=noapi&_s=1&sid=1713955926&sct=1&seg=0&dl=https%3A%2F%2Fwww.deepinstinct.com%2Fblog%2Fdarkbeatc2-the-latest-muddywater-attack-framework&dt=DarkBeatC2%3A%20The%20Latest%20MuddyWater%20Attack%20Framework&en=page_view&_fv=1&_nsi=1&_ss=1&tfd=3000
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-P5MMKMDSNW&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 142.250.185.238 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: fra16s53-in-f14.1e100.net
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.deepinstinct.com/
Accept-Language: he-IL,he;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Wed, 24 Apr 2024 10:52:07 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.deepinstinct.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 collect
stats.g.doubleclick.net/g/ 0
56 B 113ms
113ms Ping
text/plain 74.125.206.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://stats.g.doubleclick.net/g/collect?v=2&tid=G-P5MMKMDSNW&cid=218287240.1713955927&gtm=45je44m0v868549395z878451102za200&aip=1&dma=0&gcd=13l3l3l3l1&npa=0
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-P5MMKMDSNW&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 74.125.206.155 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: wk-in-f155.1e100.net
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.deepinstinct.com/
Accept-Language: he-IL,he;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Wed, 24 Apr 2024 10:52:07 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.deepinstinct.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.co.il/ads/ 42 B
408 B 389ms
141ms Image
image/gif 142.250.186.163
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.co.il/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&tid=G-P5MMKMDSNW&cid=218287240.1713955927&gtm=45je44m0v868549395z878451102za200&aip=1&dma=0&gcd=13l3l3l3l1&npa=0&z=224379197

Requested by

Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.163 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s08-in-f3.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.deepinstinct.com/
Accept-Language: he-IL,he;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Wed, 24 Apr 2024 10:52:07 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 gif.gif Show response
ibc-flow.techtarget.com/a/ 43 B
449 B 219ms
217ms XHR
image/gif 34.111.208.231
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://ibc-flow.techtarget.com/a/gif.gif?actTypeId=31&cid=16780454&r=1713955926802&ref=https%3A%2F%2Fwww.deepinstinct.com%2Fblog%2Fdarkbeatc2-the-latest-muddywater-attack-framework&version=2.4
Requested by: Host: trk.techtarget.com
URL: https://trk.techtarget.com/tracking.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.111.208.231 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 231.208.111.34.bc.googleusercontent.com
Software: nginx/1.20.2 /
Resource Hash: 2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Request headers

ibc_rate_tier: 16780454
sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.deepinstinct.com/
Accept-Language: he-IL,he;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 24 Apr 2024 10:52:07 GMT
via: 1.1 google
x-guploader-uploadid: ABPtcPr2_MSBOYRYToGDYaQJHJZKWp_xXmofMVxWpYOPuA5BliVnpUq6QGMsZcqRpA0Y0NRQwCTVD-kDUQ
x-goog-storage-class: STANDARD
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
last-modified: Thu, 08 Dec 2022 21:19:29 GMT
server: nginx/1.20.2
etag: "fc94fb0c3ed8a8f909dbc7630a0987ff"
vary: Origin
x-goog-generation: 1670534369365034
content-type: image/gif
access-control-allow-origin: *
x-goog-hash: crc32c=7uenZA==, md5=/JT7DD7YqPkJ28djCgmH/w==
cache-control: public, max-age=3600
access-control-allow-methods: GET, POST, OPTIONS
x-goog-stored-content-length: 43
accept-ranges: bytes
access-control-allow-headers: ibc_header,ibc_rate_tier,User-Agent,X-Requested-With,Cache-Control,Content-Type,Range
expires: Wed, 24 Apr 2024 11:52:07 GMT

OPTIONS
H2 200 gif.gif
ibc-flow.techtarget.com/a/ Frame 0
0 336ms
206ms Preflight
text/html 34.111.208.231
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://ibc-flow.techtarget.com/a/gif.gif?actTypeId=31&cid=16780454&r=1713955926802&ref=https%3A%2F%2Fwww.deepinstinct.com%2Fblog%2Fdarkbeatc2-the-latest-muddywater-attack-framework&version=2.4
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.111.208.231 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 231.208.111.34.bc.googleusercontent.com
Software: nginx/1.20.2 /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: ibc_rate_tier
Access-Control-Request-Method: GET
Origin: https://www.deepinstinct.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36

Response headers

access-control-allow-headers: ibc_header,ibc_rate_tier,User-Agent,X-Requested-With,Cache-Control,Content-Type,Range
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=0
content-length: 0
content-type: text/html; charset=UTF-8
date: Wed, 24 Apr 2024 10:52:07 GMT
expires: Wed, 24 Apr 2024 10:52:07 GMT
server: nginx/1.20.2
vary: Origin
via: 1.1 google
x-guploader-uploadid: ABPtcPq86jMBc9a9xaIzty5ZJbR0JafG2Kdeh_q49O2FPDwfwg_YcRTcg-sq_gBJftPnuL5oaBrAHlTxyg

GET
H2 204 17571311.js Show response
bat.bing.com/p/action/ 0
117 B 126ms
126ms Script
text/plain 13.107.21.237
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://bat.bing.com/p/action/17571311.js

Requested by

Host: bat.bing.com
URL: https://bat.bing.com/bat.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

13.107.21.237 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.deepinstinct.com/
Accept-Language: he-IL,he;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: private,max-age=1800
date: Wed, 24 Apr 2024 10:52:06 GMT
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: FC616BF6629C49C2A72214C1652243F1 Ref B: TLV30EDGE0307 Ref C: 2024-04-24T10:52:06Z
x-cache: CONFIG_NOCACHE

GET
H2 204 0
bat.bing.com/action/ 0
287 B 134ms
134ms Image
text/plain 13.107.21.237
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://bat.bing.com/action/0?ti=17571311&Ver=2&mid=1cd50b1c-90fd-4858-b63e-03c313cd8ca9&sid=b1490180022811efaa338978df00db00&vid=b1493350022811efa5bc25fd0c3bcc37&vids=1&msclkid=N&pi=918639831&lg=he-IL&sw=1600&sh=1200&sc=24&tl=DarkBeatC2%3A%20The%20Latest%20MuddyWater%20Attack%20Framework&p=https%3A%2F%2Fwww.deepinstinct.com%2Fblog%2Fdarkbeatc2-the-latest-muddywater-attack-framework&r=&evt=pageLoad&sv=1&rn=596209

Requested by

Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

13.107.21.237 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.deepinstinct.com/
Accept-Language: he-IL,he;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Wed, 24 Apr 2024 10:52:06 GMT
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 1379550E505A42D5AF7FBCDE67A159B6 Ref B: TLV30EDGE0307 Ref C: 2024-04-24T10:52:06Z
x-cache: CONFIG_NOCACHE
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 modules.588629dd3c10b20ab52d.js Show response
script.hotjar.com/ 220 KB
55 KB 365ms
134ms Script
application/javascript 13.33.187.92
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://script.hotjar.com/modules.588629dd3c10b20ab52d.js

Requested by

Host: static.hotjar.com
URL: https://static.hotjar.com/c/hotjar-1665869.js?sv=7

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.33.187.92 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-33-187-92.fra60.r.cloudfront.net

Software

Resource Hash

16cabc9d4b8ae81eed9193ec25b6d463e68290e5433069885156f7c1dc81e975

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.deepinstinct.com/
Accept-Language: he-IL,he;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 23 Apr 2024 14:47:06 GMT
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=2592000; includeSubDomains
via: 1.1 9bd2938ceb90e1a35f549d1165e84676.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P9
age: 72301
x-cache: Hit from cloudfront
cross-origin-resource-policy: cross-origin
content-length: 55620
last-modified: Tue, 23 Apr 2024 14:46:56 GMT
etag: "654dca21564b72e6f97d130ff7086658"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
accept-ranges: bytes
x-robots-tag: none
x-amz-cf-id: dKbF0OJehazXSFFtZGq-i_1rc3F4JUxcB_EfZvhm7ITTu_5rfIYD9Q==

GET
H2 200 2183098.js Show response
js.hs-banner.com/ 64 KB
17 KB 385ms
252ms Script
text/javascript 172.64.153.27
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js.hs-banner.com/2183098.js
Requested by: Host: js.hs-scripts.com
URL: https://js.hs-scripts.com/2183098.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.64.153.27 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c38430e8e8eeedf87f6a7860ee009e354dbd44f3865a62663239922b35590d7f

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.deepinstinct.com/
Accept-Language: he-IL,he;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 24 Apr 2024 10:52:07 GMT
x-amz-version-id: 3t5xtorRfw4OfG5JJC.Kjqhy62bL4qUy
content-encoding: br
cf-cache-status: REVALIDATED
x-amz-request-id: YF6E56B8QG8YQM9N
x-evy-trace-route-service-name: envoyset-translator
x-amz-server-side-encryption: AES256
x-hubspot-correlation-id: 8e3b4cd2-8e6f-4d20-ba43-48ea88e88480
x-envoy-upstream-service-time: 108
x-amz-id-2: KoEEoGmR/de5pJOsPduO0kgX9YS6p0isaTV75N/KbaAhMSpvcwWBrBxDqE3Azt3lvk8zj2qkkaY=
x-evy-trace-listener: listener_https
x-request-id: 8e3b4cd2-8e6f-4d20-ba43-48ea88e88480
x-evy-trace-route-configuration: listener_https/all
last-modified: Fri, 29 Mar 2024 16:21:55 GMT
server: cloudflare
etag: W/"4554e0b29ba73627bf46cee13e80176e"
access-control-max-age: 604800
access-control-allow-methods: GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: https://www.deepinstinct.com
x-evy-trace-virtual-host: all
access-control-expose-headers: x-last-modified-timestamp, X-HubSpot-NotFound, X-HS-User-Request, Link, Server-Timing
cache-control: max-age=300,public
access-control-allow-credentials: true
x-evy-trace-served-by-pod: iad02/analytics-js-proxy-td/envoy-proxy-6dfb9475dd-88fff
vary: origin, Accept-Encoding
timing-allow-origin: *
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Accept-Charset, Accept-Encoding, X-Override-Internal-Permissions, X-Properties-Source, X-Properties-SourceId, X-Properties-Flag, X-Hubspot-User-Id, X-Hubspot-Trace, X-Hubspot-Callee, X-Hubspot-Offset, X-Hubspot-No-Trace, X-HubSpot-Static-App-Info, X-HubSpot-Messages-Uri, X-HubSpot-Request-Source, X-HubSpot-Request-Reason, Subscription-Billing-Auth-Token, X-App-CSRF, X-Tools-CSRF, Online-Payment-Signing-UUID, X-Source, X-SourceId, X-Origin-UserId, X-Biden-Request-Source, X-HubSpot-CSRF-hubspotapi, X-Force-Cookie-Refresh, X-Force-Cookie-Refresh-No-Cache, X-HS-User-Request, X-Application-Id, X-HS-Referer, X-HubSpot-Correlation-Id
cf-ray: 87958ac02f11e3ed-TLV
expires: Wed, 24 Apr 2024 10:57:07 GMT

GET
H2 200 2183098.js Show response
js.hs-analytics.net/analytics/1713955800000/ 67 KB
21 KB 401ms
273ms Script
text/javascript 104.17.175.201
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js.hs-analytics.net/analytics/1713955800000/2183098.js
Requested by: Host: js.hs-scripts.com
URL: https://js.hs-scripts.com/2183098.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.17.175.201 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6371783e47489007d9eeb0119d3ed7c7b540a63f1bb0d1024aca81cf9c5eabfc

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.deepinstinct.com/
Accept-Language: he-IL,he;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 24 Apr 2024 10:52:07 GMT
x-amz-version-id: null
content-encoding: br
cf-cache-status: MISS
x-amz-request-id: YTAYJ87PTZ2TN4YK
x-evy-trace-route-service-name: envoyset-translator
x-amz-server-side-encryption: AES256
x-hubspot-correlation-id: 0b6eb98a-2d8a-4893-afff-b4ae4fe06a76
x-envoy-upstream-service-time: 28
x-amz-id-2: XNcj3L+ETXMETmmrXsAbL/HUWMPsHl3cOQGq8IKOkK3ONFOVIQaukjdX5IY9YhzCJTCHhOCdHTU=
x-evy-trace-listener: listener_https
x-request-id: 0b6eb98a-2d8a-4893-afff-b4ae4fe06a76
x-evy-trace-route-configuration: listener_https/all
last-modified: Thu, 18 Apr 2024 19:26:53 GMT
server: cloudflare
etag: W/"a175f3cfa46d4a6f1a9b0c395be6b91c"
vary: origin, Accept-Encoding
content-type: text/javascript
x-evy-trace-virtual-host: all
x-evy-trace-served-by-pod: iad02/analytics-js-proxy-td/envoy-proxy-6685c9958f-jg42k
cache-control: max-age=300,public
access-control-allow-credentials: false
cf-ray: 87958ac01f05e3ed-TLV
expires: Wed, 24 Apr 2024 10:57:07 GMT

GET
H2 200 leadflows.js Show response
js.hsleadflows.net/ 551 KB
88 KB 206ms
84ms Script
application/javascript 104.18.140.17
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://js.hsleadflows.net/leadflows.js

Requested by

Host: js.hs-scripts.com
URL: https://js.hs-scripts.com/2183098.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.140.17 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

efb5dc6835aeb8a8e1615ca49df1828cfaf708dc73651c5f1c651f2d2ab3907a

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.deepinstinct.com/
Origin: https://www.deepinstinct.com
Accept-Language: he-IL,he;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

content-encoding: br
x-evy-trace-route-service-name: envoyset-translator
age: 24389
x-amz-server-side-encryption: AES256
content-security-policy-report-only: frame-ancestors 'self'; report-uri https://send.hsbrowserreports.com/csp/report?resource=lead-flows-js/static-1.1338/bundle/main/lead-flows-release.js&cfRay=878caa194b7411b8-MRS
x-amz-replication-status: COMPLETED
x-evy-trace-listener: listener_https
etag: W/"d252299cef5b9176cf0435e72e0baeeb"
vary: Accept-Encoding,Origin,Access-Control-Request-Headers,Access-Control-Request-Method
access-control-allow-methods: GET
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
x-evy-trace-virtual-host: all
cache-control: s-maxage=86400, max-age=0
x-hs-target-asset: lead-flows-js/static-1.1338/bundle/main/lead-flows-release.js
date: Wed, 24 Apr 2024 10:52:07 GMT
x-amz-version-id: FzXUOelq5PzvbDhLOc3Au0ThiCBuXHAc
via: 1.1 1f1067e4f193aaabd2c24b99bcdc4e88.cloudfront.net (CloudFront)
x-content-type-options: nosniff
cf-cache-status: HIT
x-amz-cf-pop: IAD12-P3
x-hubspot-correlation-id: d4fdeb6b-6a06-4eeb-8d74-dbbaebcd4a18
x-cache: Hit from cloudfront
cache-tag: staticjsapp-lead-flows-cloudflare-web-prod,staticjsapp-prod
x-envoy-upstream-service-time: 7
x-evy-trace-route-configuration: listener_https/all
x-request-id: d4fdeb6b-6a06-4eeb-8d74-dbbaebcd4a18
last-modified: Wed, 03 Apr 2024 09:27:53 UTC
server: cloudflare
access-control-max-age: 3000
x-hs-cache-status: MISS
x-evy-trace-served-by-pod: iad02/app-td/envoy-proxy-68b7f7fbff-bsp24
cf-ray: 87958ac03f18e3d3-TLV
x-amz-cf-id: cJWabK2Q9VC_jbD52-xEe5jZOtTwZwmktJWIhtezWMYvK3XoobPgsg==

GET
H2 200 fb.js Show response
js.hsadspixel.net/ 6 KB
4 KB 218ms
83ms Script
application/javascript 104.17.128.172
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://js.hsadspixel.net/fb.js

Requested by

Host: js.hs-scripts.com
URL: https://js.hs-scripts.com/2183098.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.17.128.172 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

1c67d8ce90160a6586cfd2c2a936959738f5b1843ebdfbac4325c4d1a9b61224

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.deepinstinct.com/
Accept-Language: he-IL,he;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 24 Apr 2024 10:52:07 GMT
x-amz-version-id: H75lIw.llLd5LbqLQfJpi4qQ6NOhCtlN
via: 1.1 d0d53eedec01ac540f737b5fafb16436.cloudfront.net (CloudFront)
x-content-type-options: nosniff
cf-cache-status: HIT
x-amz-cf-pop: IAD12-P3
age: 516
x-amz-server-side-encryption: AES256
x-evy-trace-route-service-name: envoyset-translator
content-security-policy-report-only: frame-ancestors 'self'; report-uri https://send.hsbrowserreports.com/csp/report?resource=adsscriptloaderstatic/static-1.551/bundles/pixels-release.js&cfRay=879237e84a60e3d7-TLV
x-cache: Hit from cloudfront
x-hubspot-correlation-id: 639ad5b5-c16a-4b09-8b36-fba7fea4157a
cache-tag: staticjsapp-AdsScriptLoaderCloudflare-web-prod,staticjsapp-prod
content-encoding: br
x-envoy-upstream-service-time: 0
x-amz-replication-status: COMPLETED
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: 639ad5b5-c16a-4b09-8b36-fba7fea4157a
last-modified: Fri, 19 Apr 2024 14:01:51 UTC
server: cloudflare
etag: W/"65a4cdf8f8c613ea8f766101eea8e667"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
x-hs-cache-status: HIT
x-evy-trace-virtual-host: all
cache-control: max-age=600
x-evy-trace-served-by-pod: iad02/app-td/envoy-proxy-68b7f7fbff-bsp24
cf-ray: 87958ac0a9f9e3df-TLV
x-amz-cf-id: 4FNlnTtxOpbUHAFQY_z12IfTT8NWPbTq83bomM7_rCFWbXfYgI-VGg==
x-hs-target-asset: adsscriptloaderstatic/static-1.551/bundles/pixels-release.js

GET
H2 200 sync
s.company-target.com/s/ Frame F9F1 0
0 325ms
192ms Document
text/html 34.96.71.22
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://s.company-target.com/s/sync?exc=lr
Requested by: Host: tag.demandbase.com
URL: https://tag.demandbase.com/8430ce879b38826d.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.96.71.22 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 22.71.96.34.bc.googleusercontent.com
Software: /
Resource Hash

Request headers

Accept-Language: he-IL,he;q=0.9;q=0.9
Referer: https://www.deepinstinct.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Win32"

Response headers

access-control-allow-methods: GET,OPTIONS
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 634
content-type: text/html; charset=UTF-8
date: Wed, 24 Apr 2024 10:52:07 GMT
via: 1.1 google

GET 464526.gif
id.rlcdn.com/ 0
0

POST
H2 200 collect Show response
www.google-analytics.com/j/ 4 B
212 B 123ms
122ms XHR
text/plain 172.217.18.14
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j101&a=1546648708&t=pageview&_s=1&dl=https%3A%2F%2Fwww.deepinstinct.com%2Fblog%2Fdarkbeatc2-the-latest-muddywater-attack-framework&ul=he-il&de=UTF-8&dt=DarkBeatC2%3A%20The%20Latest%20MuddyWater%20Attack%20Framework&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YCDACEABBAAAACAAI~&jid=1010671662&gjid=1862451485&cid=218287240.1713955927&tid=UA-69598329-1&_gid=2009306344.1713955927&_r=1&_slc=1&gtm=45He44m0n8152PC3MWv78451102za200&gcd=13l3l3l3l1&dma=0&z=566443139

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.18.14 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra02s19-in-f14.1e100.net

Software

Golfe2 /

Resource Hash

aec60bc104db041b1512185839f18f52986df7e569e5445f740dd60f763fbca8

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
sec-ch-ua-platform: "Win32"
Referer: https://www.deepinstinct.com/
Accept-Language: he-IL,he;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Wed, 24 Apr 2024 10:52:06 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.deepinstinct.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 ip.json Show response
api.company-target.com/api/v2/ 3 KB
1 KB 438ms
196ms XHR
application/json 18.66.102.85
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://api.company-target.com/api/v2/ip.json?referrer=&page=https%3A%2F%2Fwww.deepinstinct.com%2Fblog%2Fdarkbeatc2-the-latest-muddywater-attack-framework&page_title=DarkBeatC2%3A%20The%20Latest%20MuddyWater%20Attack%20Framework
Requested by: Host: tag.demandbase.com
URL: https://tag.demandbase.com/8430ce879b38826d.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.66.102.85 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-66-102-85.fra56.r.cloudfront.net
Software: nginx /
Resource Hash: 12adce1ff8ecf597745ee698257dd38a6af8abab2d89e565b2d40893b646f28e

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
sec-ch-ua-platform: "Win32"
Referer: https://www.deepinstinct.com/
Accept-Language: he-IL,he;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

date: Wed, 24 Apr 2024 10:52:07 GMT
content-encoding: gzip
identification-source: CENTRAL
via: 1.1 3f52d342c56014599dee37446f6c9f2e.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-P2
x-cache: Miss from cloudfront
request-id: 4d2e9786-dc69-409a-bce9-ad3274cff4ba
pragma: no-cache
server: nginx
access-control-max-age: 7200
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/json;charset=utf-8
access-control-allow-origin: https://www.deepinstinct.com
access-control-expose-headers: x-amz-cf-id
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
vary: Accept-Encoding, Origin
api-version: v2
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: 6zkyWUOiYUXiExv5AjXNnszZ6xaZPgy0E6j67ZG1WmAymgzSvF2xqQ==
expires: Tue, 23 Apr 2024 10:52:07 GMT

GET
H2 200 adsct
t.co/i/ 43 B
374 B 473ms
229ms Image
image/gif 104.244.42.133
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://t.co/i/adsct?bci=3&eci=2&event_id=0e413d64-0082-4823-b6b7-c5091c72e942&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=cbc9aecc-90fd-4f0e-8392-8508c4ec6b96&tw_document_href=https%3A%2F%2Fwww.deepinstinct.com%2Fblog%2Fdarkbeatc2-the-latest-muddywater-attack-framework&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=o61n5&type=javascript&version=2.3.30

Requested by

Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.244.42.133 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.deepinstinct.com/
Accept-Language: he-IL,he;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-response-time: 111
date: Wed, 24 Apr 2024 10:52:06 GMT
strict-transport-security: max-age=0
server: tsa_o
content-type: image/gif;charset=utf-8
x-transaction-id: c00cb3f4080ce6c3
cache-control: no-cache, no-store, max-age=0
perf: 7402827104
x-connection-hash: 947f2eb98c422109a12f704fb4181699fecf2f5bfa4d0023e41b4b52d4322524
content-length: 43

GET
H2 200 adsct
analytics.twitter.com/i/ 43 B
240 B 557ms
301ms Image
image/gif 104.244.42.131
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://analytics.twitter.com/i/adsct?bci=3&eci=2&event_id=0e413d64-0082-4823-b6b7-c5091c72e942&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=cbc9aecc-90fd-4f0e-8392-8508c4ec6b96&tw_document_href=https%3A%2F%2Fwww.deepinstinct.com%2Fblog%2Fdarkbeatc2-the-latest-muddywater-attack-framework&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=o61n5&type=javascript&version=2.3.30

Requested by

Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.244.42.131 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.deepinstinct.com/
Accept-Language: he-IL,he;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-response-time: 179
date: Wed, 24 Apr 2024 10:52:07 GMT
strict-transport-security: max-age=631138519
server: tsa_o
content-type: image/gif;charset=utf-8
x-transaction-id: 09c482cf2ab523d9
cache-control: no-cache, no-store, max-age=0
perf: 7402827104
x-connection-hash: 3fdeb0986c099abf98ac12540184b7a5a391d9cda199ed2e15d117090043d715
content-length: 43

GET
H2 200 adsct
t.co/i/ 43 B
204 B 441ms
294ms Image
image/gif 104.244.42.133
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://t.co/i/adsct?bci=3&eci=2&event_id=dafde29b-d81f-4755-bceb-429e929a38f0&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=cbc9aecc-90fd-4f0e-8392-8508c4ec6b96&tw_document_href=https%3A%2F%2Fwww.deepinstinct.com%2Fblog%2Fdarkbeatc2-the-latest-muddywater-attack-framework&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=nzc8r&type=javascript&version=2.3.30

Requested by

Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.244.42.133 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.deepinstinct.com/
Accept-Language: he-IL,he;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-response-time: 174
date: Wed, 24 Apr 2024 10:52:06 GMT
strict-transport-security: max-age=0
server: tsa_o
content-type: image/gif;charset=utf-8
x-transaction-id: 2b689e052f8bfef2
cache-control: no-cache, no-store, max-age=0
perf: 7402827104
x-connection-hash: 947f2eb98c422109a12f704fb4181699fecf2f5bfa4d0023e41b4b52d4322524
content-length: 43

GET
H2 200 adsct
analytics.twitter.com/i/ 43 B
393 B 400ms
222ms Image
image/gif 104.244.42.131
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://analytics.twitter.com/i/adsct?bci=3&eci=2&event_id=dafde29b-d81f-4755-bceb-429e929a38f0&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=cbc9aecc-90fd-4f0e-8392-8508c4ec6b96&tw_document_href=https%3A%2F%2Fwww.deepinstinct.com%2Fblog%2Fdarkbeatc2-the-latest-muddywater-attack-framework&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=nzc8r&type=javascript&version=2.3.30

Requested by

Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.244.42.131 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.deepinstinct.com/
Accept-Language: he-IL,he;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-response-time: 103
date: Wed, 24 Apr 2024 10:52:06 GMT
strict-transport-security: max-age=631138519
server: tsa_o
content-type: image/gif;charset=utf-8
x-transaction-id: 87c7a260e2b9518f
cache-control: no-cache, no-store, max-age=0
perf: 7402827104
x-connection-hash: 3fdeb0986c099abf98ac12540184b7a5a391d9cda199ed2e15d117090043d715
content-length: 43

GET
H2 200 468591697375107 Show response
connect.facebook.net/signals/config/ 56 KB
12 KB 153ms
152ms Script
application/x-javascript 157.240.253.1
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/468591697375107?v=2.9.154&r=stable&domain=www.deepinstinct.com&hme=c3a545c63044e8e9102d4f32d84a1137594d024f28e801d670bc76dc5c075575&ex_m=67%2C112%2C99%2C103%2C58%2C3%2C93%2C66%2C15%2C91%2C84%2C49%2C51%2C158%2C161%2C172%2C168%2C169%2C171%2C28%2C94%2C50%2C73%2C170%2C153%2C156%2C165%2C166%2C173%2C121%2C14%2C48%2C178%2C177%2C123%2C17%2C33%2C38%2C1%2C41%2C62%2C63%2C64%2C68%2C88%2C16%2C13%2C90%2C87%2C86%2C100%2C102%2C37%2C101%2C29%2C25%2C154%2C157%2C130%2C27%2C10%2C11%2C12%2C5%2C6%2C24%2C21%2C22%2C54%2C59%2C61%2C71%2C95%2C26%2C72%2C8%2C7%2C76%2C46%2C20%2C97%2C96%2C9%2C19%2C18%2C81%2C53%2C79%2C32%2C70%2C0%2C89%2C31%2C78%2C83%2C45%2C44%2C82%2C36%2C4%2C85%2C77%2C42%2C39%2C34%2C80%2C2%2C35%2C60%2C40%2C98%2C43%2C75%2C65%2C104%2C57%2C56%2C30%2C92%2C55%2C52%2C47%2C74%2C69%2C23%2C105

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

157.240.253.1 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

xx-fbcdn-shv-02-fra5.fbcdn.net

Software

Resource Hash

5612daca21fe73f106c77cab5b0cdf820c777af49b1b0230d98e905c3df63e24

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' data: blob: ;script-src .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://.google-analytics.com .google.com;style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com: wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: .cdninstagram.com 'self' https://.google-analytics.com;img-src 'self' data: blob: * https://*.google-analytics.com;block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.deepinstinct.com/
Accept-Language: he-IL,he;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

content-security-policy: default-src 'self' data: blob: *;script-src *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://*.google-analytics.com *.google.com;style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' https://*.google-analytics.com;img-src 'self' data: blob: * https://*.google-analytics.com;block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; preload; includeSubDomains
date: Wed, 24 Apr 2024 10:52:07 GMT
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
x-xss-protection: 0
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
x-fb-connection-quality: GOOD; q=0.7, rtt=54, rtx=0, c=61, mss=1380, tbw=63199, tp=-1, tpl=-1, uplat=40, ullat=0
pragma: public
x-fb-debug: gCRTnCIGriMQsFzAt5KzpytvnLVuF+SNnXiqUzowrpAiAqIW6KOLNqZxUjyWzp7fQSE/E1uu4dwIMDoF7qyKnA==
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
cross-origin-opener-policy: same-origin-allow-popups;report-to="coop_report"
vary: Accept-Encoding
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
content-type: application/x-javascript; charset=utf-8
x-frame-options: DENY
origin-agent-cluster: ?0
cache-control: public, max-age=1200
permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), usb=(), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
timing-allow-origin: *
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 ipv
cdn.bizible.com/ 43 B
328 B 111ms
111ms Image
image/gif 152.195.15.58
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cdn.bizible.com/ipv?_biz_r=&_biz_h=-1906410348&_biz_u=c2f8104f61aa466c93445c1e70222f52&_biz_l=https%3A%2F%2Fwww.deepinstinct.com%2Fblog%2Fdarkbeatc2-the-latest-muddywater-attack-framework&_biz_t=1713955927044&_biz_i=DarkBeatC2%3A%20The%20Latest%20MuddyWater%20Attack%20Framework&_biz_n=0&rnd=252100&cdn_o=a&_biz_z=1713955927044

Requested by

Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

152.195.15.58 , United States, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECS (frb/67BA) /

Resource Hash

afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSub

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.deepinstinct.com/
Accept-Language: he-IL,he;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Wed, 24 Apr 2024 10:52:07 GMT
strict-transport-security: max-age=31536000; includeSub
last-modified: Fri, 19 Apr 2024 21:15:25 GMT
server: ECS (frb/67BA)
age: 394602
x-cache: HIT
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
content-type: image/gif
cache-control: no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: -1

GET
H2 200 u
cdn.bizibly.com/ 43 B
181 B 120ms
112ms Image
image/gif 152.195.15.58
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cdn.bizibly.com/u?_biz_u=c2f8104f61aa466c93445c1e70222f52&_biz_l=https%3A%2F%2Fwww.deepinstinct.com%2Fblog%2Fdarkbeatc2-the-latest-muddywater-attack-framework&_biz_t=1713955927047&_biz_i=DarkBeatC2%3A%20The%20Latest%20MuddyWater%20Attack%20Framework&rnd=214479&cdn_o=a&_biz_z=1713955927047

Requested by

Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

152.195.15.58 , United States, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECS (frb/6752) /

Resource Hash

afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSub

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.deepinstinct.com/
Accept-Language: he-IL,he;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Wed, 24 Apr 2024 10:52:07 GMT
strict-transport-security: max-age=31536000; includeSub
last-modified: Fri, 19 Apr 2024 21:15:25 GMT
server: ECS (frb/6752)
age: 394602
x-cache: HIT
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
content-type: image/gif
cache-control: no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: -1

POST
H2 200 collect Show response
stats.g.doubleclick.net/j/ 7 B
355 B 344ms
112ms XHR
text/plain 74.125.206.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j101&tid=UA-69598329-1&cid=218287240.1713955927&jid=1010671662&gjid=1862451485&_gid=2009306344.1713955927&_u=YCDACEAABAAAACAAI~&z=1767592052

Requested by

Host: cdn.bizible.com
URL: https://cdn.bizible.com/scripts/bizible.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.125.206.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

wk-in-f155.1e100.net

Software

Golfe2 /

Resource Hash

fda80d24f1bfe5a68b5f719a1febecfe747c79720e3a26b4b78b6a42b67b37b7

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
sec-ch-ua-platform: "Win32"
Referer: https://www.deepinstinct.com/
Accept-Language: he-IL,he;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
date: Wed, 24 Apr 2024 10:52:07 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.deepinstinct.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 7
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 l
use.typekit.net/af/04ec74/00000000000000000001205b/27/ 29 KB
29 KB 741ms
244ms Font
application/font-woff2 23.200.36.197
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://use.typekit.net/af/04ec74/00000000000000000001205b/27/l?primer=7cdcb44be4a7db8877ffa5c0007b8dd865b3bbc383831fe2ea177f62257a9191&fvd=n7&v=3
Requested by: Host: use.typekit.net
URL: https://use.typekit.net/zka3qml.css
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.200.36.197 , Mexico, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a23-200-36-197.deploy.static.akamaitechnologies.com
Software: nginx /
Resource Hash: 8d0056dcc26b8dce6be00539697962adb12475fbf9cbf7fdcbc7c81b2ae7328d

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://use.typekit.net/zka3qml.css
Origin: https://www.deepinstinct.com
Accept-Language: he-IL,he;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 24 Apr 2024 10:52:08 GMT
server: nginx
etag: "1c4557ace28950fbc49487c3a85660222d5fe232"
content-type: application/font-woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 29588

GET
H2 200 l
use.typekit.net/af/1709eb/000000000000000000010b60/27/ 24 KB
24 KB 819ms
323ms Font
application/font-woff2 23.200.36.197
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://use.typekit.net/af/1709eb/000000000000000000010b60/27/l?primer=7cdcb44be4a7db8877ffa5c0007b8dd865b3bbc383831fe2ea177f62257a9191&fvd=n7&v=3
Requested by: Host: use.typekit.net
URL: https://use.typekit.net/zka3qml.css
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.200.36.197 , Mexico, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a23-200-36-197.deploy.static.akamaitechnologies.com
Software: nginx /
Resource Hash: f94786fe65dcbc65b0099b471ae2bb89bbabd7fa7d8573dd3c4e0f5bbe555447

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://use.typekit.net/zka3qml.css
Origin: https://www.deepinstinct.com
Accept-Language: he-IL,he;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 24 Apr 2024 10:52:08 GMT
server: nginx
etag: "9bd0488a91630a3c738a4d950e0b0b7930bcb98f"
content-type: application/font-woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 24740

GET
H2 200 l
use.typekit.net/af/442215/000000000000000000010b5a/27/ 23 KB
23 KB 858ms
362ms Font
application/font-woff2 23.200.36.197
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://use.typekit.net/af/442215/000000000000000000010b5a/27/l?primer=7cdcb44be4a7db8877ffa5c0007b8dd865b3bbc383831fe2ea177f62257a9191&fvd=n4&v=3
Requested by: Host: use.typekit.net
URL: https://use.typekit.net/zka3qml.css
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.200.36.197 , Mexico, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a23-200-36-197.deploy.static.akamaitechnologies.com
Software: nginx /
Resource Hash: 8d5da73586712159bb569fbfbd370f05a258113b2591ba238ef4e7bde1db13b7

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://use.typekit.net/zka3qml.css
Origin: https://www.deepinstinct.com
Accept-Language: he-IL,he;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 24 Apr 2024 10:52:08 GMT
server: nginx
etag: "9523c64514161c03124fab238b18113d17bad9eb"
content-type: application/font-woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 23800

GET
H2 200 image
www.deepinstinct.com/_next/ 286 KB
286 KB 170ms
168ms Image
image/avif 3.70.101.28
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.deepinstinct.com/_next/image?url=https%3A%2F%2Fwww.deepinstinct.com%2Fimage%2Fblt488afd138c53fee8%2F660dc3726c4a396121e472ec%2FDI_Threat_Research_Team_Blog_930x400.png&w=1680&q=100

Requested by

Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.70.101.28 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-70-101-28.eu-central-1.compute.amazonaws.com

Software

Netlify /

Resource Hash

1a1ea29b4da0208aa78b7fa3d2b6f39179a1a5de6dfdbc80c0d4dc7443755807

Security Headers

Name	Value
Content-Security-Policy
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework
Accept-Language: he-IL,he;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-nf-request-id: 01HW7VQX6EMEPABNYFFKQ99ZMW
content-security-policy
date: Wed, 24 Apr 2024 10:52:07 GMT
x-content-type-options: nosniff
strict-transport-security: max-age=31536000
age: 1282339
cross-origin-resource-policy: cross-origin
content-length: 292898
last-modified: Tue, 09 Apr 2024 14:39:48 GMT
netlify-vary: query=url|crop|fit|fm|h|height|position|q|quality|timestamp|w|width
server: Netlify
cache-status: "Netlify Edge"; fwd=miss
vary: Accept
content-type: image/avif
access-control-allow-origin: *
cache-control: max-age=31536000
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 image
www.deepinstinct.com/_next/ 5 KB
5 KB 390ms
389ms Image
image/avif 3.70.101.28
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.deepinstinct.com/_next/image?url=https%3A%2F%2Fimages.contentstack.io%2Fv3%2Fassets%2Fblt1ec077b6b53d6b3e%2Fblt14ca71678553d70e%2F6305444727ca1b5cd53ebd62%2Fkenin-simon.png&w=64&q=75

Requested by

Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.70.101.28 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-70-101-28.eu-central-1.compute.amazonaws.com

Software

Netlify /

Resource Hash

4d69811fcdf2dcc9ff875a6dd0309585ecdf1e55f46345aa9d507f816c4bdb96

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework
Accept-Language: he-IL,he;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-nf-request-id: 01HW7VQX6FCTBY977DX3C7QAQS
content-security-policy: script-src 'none'
date: Wed, 24 Apr 2024 10:52:07 GMT
x-content-type-options: nosniff
strict-transport-security: max-age=31536000
age: 1282981
cross-origin-resource-policy: cross-origin
content-length: 4851
last-modified: Tue, 09 Apr 2024 14:29:06 GMT
netlify-vary: query=url|crop|fit|fm|h|height|position|q|quality|timestamp|w|width
server: Netlify
cache-status: "Netlify Edge"; hit
vary: Accept
content-type: image/avif
access-control-allow-origin: *
cache-control: public,max-age=31536000
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 image
www.deepinstinct.com/_next/ 5 KB
5 KB 167ms
166ms Image
image/avif 3.70.101.28
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.deepinstinct.com/_next/image?url=https%3A%2F%2Fimages.contentstack.io%2Fv3%2Fassets%2Fblt1ec077b6b53d6b3e%2Fbltfdfca743f7ac9662%2F630e2d5d8bdc107d4a01ba3f%2F800x800-blue-monogram.png&w=64&q=75

Requested by

Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.70.101.28 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-70-101-28.eu-central-1.compute.amazonaws.com

Software

Netlify /

Resource Hash

4d3e2dd099535045aef08a0eae076c90e23f526c7d683704293a9ef005ebcd6a

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework
Accept-Language: he-IL,he;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-nf-request-id: 01HW7VQX6F7FC1ZGNV9ADHD5DT
content-security-policy: script-src 'none'
date: Wed, 24 Apr 2024 10:52:07 GMT
x-content-type-options: nosniff
strict-transport-security: max-age=31536000
age: 1282980
cross-origin-resource-policy: cross-origin
content-length: 5220
last-modified: Tue, 09 Apr 2024 14:29:06 GMT
netlify-vary: query=url|crop|fit|fm|h|height|position|q|quality|timestamp|w|width
server: Netlify
cache-status: "Netlify Edge"; hit
vary: Accept
content-type: image/avif
access-control-allow-origin: *
cache-control: public,max-age=31536000
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 5518.abf70040ebe14552.js Show response
www.deepinstinct.com/_next/static/chunks/ 17 KB
7 KB 462ms
461ms Script
application/javascript 3.70.101.28
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.deepinstinct.com/_next/static/chunks/5518.abf70040ebe14552.js

Requested by

Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/_next/static/chunks/webpack-29002f1662bf7c0b.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.70.101.28 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-70-101-28.eu-central-1.compute.amazonaws.com

Software

Netlify /

Resource Hash

3ad3f48e0876d9c90167457933958b33140d66ebb2c6b42107ade20b39fe2cdd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework
Accept-Language: he-IL,he;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-nf-request-id: 01HW7VQX6TKFNF0G9JQAQG3H7K
date: Wed, 24 Apr 2024 10:52:07 GMT
content-encoding: br
strict-transport-security: max-age=31536000
server: Netlify
age: 72426
cache-status: "Netlify Edge"; hit
etag: "a1bb3610d16d40d3994a04e335eb2f7b-ssl-df"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
cache-control: public,max-age=0,must-revalidate
accept-ranges: bytes
content-length: 7381

GET
H2 200 4c213f3cb0a0d816.css
www.deepinstinct.com/_next/static/css/ 1 KB
450 B 461ms
460ms Stylesheet
text/css 3.70.101.28
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.deepinstinct.com/_next/static/css/4c213f3cb0a0d816.css

Requested by

Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/_next/static/chunks/webpack-29002f1662bf7c0b.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.70.101.28 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-70-101-28.eu-central-1.compute.amazonaws.com

Software

Netlify /

Resource Hash

4fcc2873d9a9e427999107a83f322c299063db3dd645262a3330e4ed336208fc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework
Accept-Language: he-IL,he;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-nf-request-id: 01HW7VQX6TZZY2YEHTE0GAT4SA
date: Wed, 24 Apr 2024 10:52:07 GMT
content-encoding: br
strict-transport-security: max-age=31536000
server: Netlify
age: 6339
cache-status: "Netlify Edge"; hit
etag: "6eccd5b5ee90f21ffe9daf5e31693980-ssl-df"
vary: Accept-Encoding
content-type: text/css; charset=UTF-8
cache-control: public,max-age=0,must-revalidate
accept-ranges: bytes
content-length: 298

GET
H2 200 1114.36c11ded4c40c351.js Show response
www.deepinstinct.com/_next/static/chunks/ 5 KB
2 KB 463ms
463ms Script
application/javascript 3.70.101.28
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.deepinstinct.com/_next/static/chunks/1114.36c11ded4c40c351.js

Requested by

Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/_next/static/chunks/webpack-29002f1662bf7c0b.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.70.101.28 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-70-101-28.eu-central-1.compute.amazonaws.com

Software

Netlify /

Resource Hash

140e801db59d24b4f0ba9e63042b32863068c1369989eb1e632e481f6fcf09f1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework
Accept-Language: he-IL,he;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-nf-request-id: 01HW7VQX6VGJ9NKE9P7GEQ8HC1
date: Wed, 24 Apr 2024 10:52:07 GMT
content-encoding: br
strict-transport-security: max-age=31536000
server: Netlify
age: 72425
cache-status: "Netlify Edge"; hit
etag: "be2cb73604d20aae800d9673a2b8cb00-ssl-df"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
cache-control: public,max-age=0,must-revalidate
accept-ranges: bytes
content-length: 1666

GET
H2 200 7743.1cc5d0e5cea43aba.js Show response
www.deepinstinct.com/_next/static/chunks/ 2 KB
1 KB 461ms
460ms Script
application/javascript 3.70.101.28
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.deepinstinct.com/_next/static/chunks/7743.1cc5d0e5cea43aba.js

Requested by

Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/_next/static/chunks/webpack-29002f1662bf7c0b.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.70.101.28 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-70-101-28.eu-central-1.compute.amazonaws.com

Software

Netlify /

Resource Hash

e550590605f348a6163e6f1d157578a98364ee307dd221516f9f2401363e0c20

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework
Accept-Language: he-IL,he;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-nf-request-id: 01HW7VQX6W73J2STC2THQ9XWQ3
date: Wed, 24 Apr 2024 10:52:07 GMT
content-encoding: br
strict-transport-security: max-age=31536000
server: Netlify
age: 72425
cache-status: "Netlify Edge"; hit
etag: "b01362f8cfc3944820c788efd91353e8-ssl-df"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
cache-control: public,max-age=0,must-revalidate
accept-ranges: bytes
content-length: 1158

GET
H2 200 zka3qml.css
use.typekit.net/ 3 KB
0 0ms
0ms Stylesheet
text/css 23.200.36.197
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://use.typekit.net/zka3qml.css
Requested by: Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/_next/static/chunks/main-c5b7e6d77b82bab5.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.200.36.197 , Mexico, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a23-200-36-197.deploy.static.akamaitechnologies.com
Software: nginx /
Resource Hash: 9d9e8a96a73580c975860c5b2fa6488d785af4b44e2f0a0a35cbbc891c863746

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.deepinstinct.com/
Accept-Language: he-IL,he;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 24 Apr 2024 10:52:06 GMT
content-encoding: gzip
server: nginx
vary: Accept-Encoding
content-type: text/css;charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=600, stale-while-revalidate=604800
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 770

GET
H2 200 st.js Show response
s.swiftypecdn.com/install/v2/ 416 KB
110 KB 439ms
133ms Script
text/javascript 151.101.129.167
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://s.swiftypecdn.com/install/v2/st.js
Requested by: Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.129.167 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 2d7c7930eb39d59cd8c2dc00652977da3ed72347e7cd465f7b540e10e2121c22

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.deepinstinct.com/
Accept-Language: he-IL,he;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-served-by: cache-mrs10565-MRS
date: Wed, 24 Apr 2024 10:52:07 GMT
content-encoding: gzip
via: 1.1 varnish
age: 8
x-timer: S1713955928.753483,VS0,VE1
etag: "644bc37e-1b6c6"
vary: Accept-Encoding
x-cache: HIT
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=300, public, max-age=300, public
accept-ranges: bytes
content-length: 112326
x-cache-hits: 1

GET
H2 200 xdc.js Show response
cdn.bizible.com/ 111 B
321 B 224ms
222ms Script
text/javascript 152.195.15.58
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.bizible.com/xdc.js?_biz_u=c2f8104f61aa466c93445c1e70222f52&_biz_h=-1906410348&cdn_o=a&jsVer=4.24.04.18

Requested by

Host: cdn.bizible.com
URL: https://cdn.bizible.com/scripts/bizible.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

152.195.15.58 , United States, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECS (frb/6711) /

Resource Hash

d919b65e50d2b57652640e2fe8f25ac69a26e7b22439f932073ad79ddc0abb14

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSub

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.deepinstinct.com/
Accept-Language: he-IL,he;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 24 Apr 2024 10:52:07 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSub
server: ECS (frb/6711)
etag: 7F32751C
vary: Accept-Encoding
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
content-type: text/javascript; charset=utf-8
cache-control: private, must-revalidate, max-age=21600
content-length: 215

GET
H2 200 bg9s Show response
tag-logger.demandbase.com/ 0
419 B 448ms
209ms XHR
text/html 143.204.98.63
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tag-logger.demandbase.com/bg9s?x-amz-cf-id=6zkyWUOiYUXiExv5AjXNnszZ6xaZPgy0E6j67ZG1WmAymgzSvF2xqQ==&api-version=v2
Requested by: Host: cdn.bizible.com
URL: https://cdn.bizible.com/scripts/bizible.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.98.63 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-98-63.fra50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.deepinstinct.com/
Accept-Language: he-IL,he;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-amz-version-id: 8SdDCdpJvGjkSiMFPv08XcVSgwOMVVmH
date: Wed, 24 Apr 2024 02:19:55 GMT
via: 1.1 24475cc722041223cf99f56b55432566.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA50-C1
age: 49418
x-amz-server-side-encryption: AES256
x-cache: Error from cloudfront
content-length: 0
last-modified: Tue, 07 Mar 2023 20:47:02 GMT
server: AmazonS3
etag: "d41d8cd98f00b204e9800998ecf8427e"
vary: Accept-Encoding
content-type: text/html
access-control-allow-origin: *
accept-ranges: bytes
x-amz-cf-id: GWINHRqDYfhWvtIQ0zNzTMOLnE_dnVAmBdfrtuYXftS30c93r_oqGQ==

GET
H3 200 collect
www.google-analytics.com/ 35 B
55 B 116ms
116ms Image
image/gif 172.217.18.14
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j101&a=1546648708&t=event&ni=1&_s=2&dl=https%3A%2F%2Fwww.deepinstinct.com%2Fblog%2Fdarkbeatc2-the-latest-muddywater-attack-framework&ul=he-il&de=UTF-8&dt=DarkBeatC2%3A%20The%20Latest%20MuddyWater%20Attack%20Framework&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=Demandbase&ea=API%20Resolution&el=IP%20API&_u=aDDACEABBAAAACAAI~&jid=&gjid=&cid=218287240.1713955927&tid=UA-69598329-1&_gid=2009306344.1713955927&gtm=45He44m0n8152PC3MWv78451102za200&gcd=13l3l3l3l1&dma=0&cd1=Fewbytes&cd2=Business%20Services&cd3=Management%20Consulting&cd4=SMB&cd5=3&cd6=Tel%20Aviv&cd7=IL&cd8=(Non-Company%20Visitor)&cd9=(Non-Company%20Visitor)&cd10=fewbytes.com&cd13=(Non-Company%20Visitor)&z=605489256

Requested by

Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.18.14 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra02s19-in-f14.1e100.net

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.deepinstinct.com/
Accept-Language: he-IL,he;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Tue, 23 Apr 2024 23:47:22 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 39885
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ga-audiences
www.google.com/ads/ 42 B
63 B 368ms
138ms Image
image/gif 216.58.206.68
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j101&tid=UA-69598329-1&cid=218287240.1713955927&jid=1010671662&_u=YCDACEAABAAAACAAI~&z=406600253

Requested by

Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.206.68 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

tzfraa-aa-in-f4.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.deepinstinct.com/
Accept-Language: he-IL,he;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Wed, 24 Apr 2024 10:52:07 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.co.il/ads/ 42 B
107 B 142ms
140ms Image
image/gif 142.250.186.163
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.co.il/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j101&tid=UA-69598329-1&cid=218287240.1713955927&jid=1010671662&_u=YCDACEAABAAAACAAI~&z=406600253

Requested by

Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.163 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s08-in-f3.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.deepinstinct.com/
Accept-Language: he-IL,he;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Wed, 24 Apr 2024 10:52:07 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 /
www.google.com/pagead/1p-user-list/812608847/ 42 B
64 B 348ms
125ms Image
image/gif 216.58.206.68
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/812608847/?random=1713955926734&cv=11&fst=1713952800000&bg=ffffff&guid=ON&async=1&gtm=45be44m0v9116635018z878451102za201&gcd=13l3l3l3l1&dma=0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.deepinstinct.com%2Fblog%2Fdarkbeatc2-the-latest-muddywater-attack-framework&hn=www.googleadservices.com&frm=0&tiba=DarkBeatC2%3A%20The%20Latest%20MuddyWater%20Attack%20Framework&npa=0&pscdl=noapi&auid=2125086103.1713955926&uaa=x86&uab=64&uafvl=Chromium%3B124.0.6367.60%7CGoogle%2520Chrome%3B124.0.6367.60%7CNot-A.Brand%3B99.0.0.0&uamb=0&uam=&uap=Win32&uapv=10.0.0&uaw=0&fdr=QA&rfmt=3&fmt=3&is_vtc=1&cid=CAQSGwB7FLtq9vIomKCI-rZwCudnDMfyD8IIkS0oWw&random=4151887155&rmt_tld=0&ipr=y

Requested by

Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.206.68 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

tzfraa-aa-in-f4.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.deepinstinct.com/
Accept-Language: he-IL,he;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Wed, 24 Apr 2024 10:52:07 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.co.il/pagead/1p-user-list/812608847/ 42 B
154 B 127ms
127ms Image
image/gif 142.250.186.163
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.co.il/pagead/1p-user-list/812608847/?random=1713955926734&cv=11&fst=1713952800000&bg=ffffff&guid=ON&async=1&gtm=45be44m0v9116635018z878451102za201&gcd=13l3l3l3l1&dma=0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.deepinstinct.com%2Fblog%2Fdarkbeatc2-the-latest-muddywater-attack-framework&hn=www.googleadservices.com&frm=0&tiba=DarkBeatC2%3A%20The%20Latest%20MuddyWater%20Attack%20Framework&npa=0&pscdl=noapi&auid=2125086103.1713955926&uaa=x86&uab=64&uafvl=Chromium%3B124.0.6367.60%7CGoogle%2520Chrome%3B124.0.6367.60%7CNot-A.Brand%3B99.0.0.0&uamb=0&uam=&uap=Win32&uapv=10.0.0&uaw=0&fdr=QA&rfmt=3&fmt=3&is_vtc=1&cid=CAQSGwB7FLtq9vIomKCI-rZwCudnDMfyD8IIkS0oWw&random=4151887155&rmt_tld=1&ipr=y

Requested by

Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.163 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s08-in-f3.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.deepinstinct.com/
Accept-Language: he-IL,he;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Wed, 24 Apr 2024 10:52:07 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 332937911623471 Show response
connect.facebook.net/signals/config/ 20 KB
3 KB 183ms
183ms Script
application/x-javascript 157.240.253.1
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/332937911623471?v=2.9.154&r=stable&domain=www.deepinstinct.com&hme=c3a545c63044e8e9102d4f32d84a1137594d024f28e801d670bc76dc5c075575&ex_m=67%2C112%2C99%2C103%2C58%2C3%2C93%2C66%2C15%2C91%2C84%2C49%2C51%2C158%2C161%2C172%2C168%2C169%2C171%2C28%2C94%2C50%2C73%2C170%2C153%2C156%2C165%2C166%2C173%2C121%2C14%2C48%2C178%2C177%2C123%2C17%2C33%2C38%2C1%2C41%2C62%2C63%2C64%2C68%2C88%2C16%2C13%2C90%2C87%2C86%2C100%2C102%2C37%2C101%2C29%2C25%2C154%2C157%2C130%2C27%2C10%2C11%2C12%2C5%2C6%2C24%2C21%2C22%2C54%2C59%2C61%2C71%2C95%2C26%2C72%2C8%2C7%2C76%2C46%2C20%2C97%2C96%2C9%2C19%2C18%2C81%2C53%2C79%2C32%2C70%2C0%2C89%2C31%2C78%2C83%2C45%2C44%2C82%2C36%2C4%2C85%2C77%2C42%2C39%2C34%2C80%2C2%2C35%2C60%2C40%2C98%2C43%2C75%2C65%2C104%2C57%2C56%2C30%2C92%2C55%2C52%2C47%2C74%2C69%2C23%2C105%2C184%2C183%2C185%2C190%2C191%2C192%2C188%2C180%2C122%2C150%2C179%2C181%2C113%2C144%2C135%2C139%2C119%2C174%2C216%2C106%2C217%2C152%2C110%2C133%2C126%2C114

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

QUIC, , AES_128_GCM

Server

157.240.253.1 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

xx-fbcdn-shv-02-fra5.fbcdn.net

Software

Resource Hash

b247376c3e2732c8d76dd1d9db2151db9261ad2f27b068835af63c14c17401e1

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' data: blob: ;script-src .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://.google-analytics.com .google.com;style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com: wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: .cdninstagram.com 'self' https://.google-analytics.com;img-src 'self' data: blob: * https://*.google-analytics.com;block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.deepinstinct.com/
Accept-Language: he-IL,he;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

content-security-policy: default-src 'self' data: blob: *;script-src *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://*.google-analytics.com *.google.com;style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' https://*.google-analytics.com;img-src 'self' data: blob: * https://*.google-analytics.com;block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; preload; includeSubDomains
date: Wed, 24 Apr 2024 10:52:07 GMT
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
x-xss-protection: 0
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
x-fb-connection-quality: GOOD; q=0.7, rtt=109, rtx=0, c=38, mss=1232, tbw=4325, tp=9, tpl=0, uplat=72, ullat=0
pragma: public
x-fb-debug: nLB0RH91xF7iJlYDh9Awow5/IH773dvBqJkph9Fj7h15fRXl9MwyCOGKgxKboTwR3xoqwzqUHeqZCJC7MN7hEw==
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
cross-origin-opener-policy: same-origin-allow-popups;report-to="coop_report"
vary: Accept-Encoding
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
content-type: application/x-javascript; charset=utf-8
x-frame-options: DENY
origin-agent-cluster: ?0
cache-control: public, max-age=1200
permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), usb=(), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
timing-allow-origin: *
priority: u=3,i
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
BLOB 200
OK c77cd272-aa4c-4c70-bde9-e7256330e4cd
https://www.deepinstinct.com/ 43 B
0 Image
image/gif

General

Check archive.org

Show headers Download Go to Show image

Full URL: blob:https://www.deepinstinct.com/c77cd272-aa4c-4c70-bde9-e7256330e4cd
Requested by: Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Request headers

Accept-Language: he-IL,he;q=0.9;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36

Response headers

Content-Length: 43
Content-Type: image/gif

GET
H2 200 prevention-for-storage.json Show response
www.deepinstinct.com/_next/data/7-TyYd0Ikn4eVyBeP3eWe/en/ 22 KB
7 KB 156ms
155ms Fetch
application/json 3.70.101.28
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.deepinstinct.com/_next/data/7-TyYd0Ikn4eVyBeP3eWe/en/prevention-for-storage.json?pid=prevention-for-storage

Requested by

Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/_next/static/chunks/main-c5b7e6d77b82bab5.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.70.101.28 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-70-101-28.eu-central-1.compute.amazonaws.com

Software

Netlify /

Resource Hash

3575cd73d754b670b319a5502e248f3cdee7920b2af18e206d42a6efc54d49df

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
purpose: prefetch
x-nextjs-data: 1
Accept-Language: he-IL,he;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Referer: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework
sec-ch-ua-platform: "Win32"

Response headers

x-nf-request-id: 01HW7VQXKD1AWN6PFR873D8G6Q
date: Wed, 24 Apr 2024 10:52:07 GMT
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000
x-nextjs-date: Wed, 24 Apr 2024 09:06:29 GMT
age: 6830
x-nextjs-matched-path: /en/[pid]
content-length: 6401
netlify-vary: header=x-nextjs-data,cookie=__prerender_bypass|__next_preview_data
server: Netlify
cache-status: "Netlify Edge"; hit; fwd=stale
etag: "70xc33uog9hny-df"
vary: Accept-Encoding
content-type: application/json
cache-control: public,max-age=0,must-revalidate

GET
H2 200 %5Bpid%5D-ed9134132e10b8ba.js
www.deepinstinct.com/_next/static/chunks/pages/ 0
1 KB 157ms
156ms Other
application/javascript 3.70.101.28
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.deepinstinct.com/_next/static/chunks/pages/%5Bpid%5D-ed9134132e10b8ba.js

Requested by

Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/_next/static/chunks/main-c5b7e6d77b82bab5.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.70.101.28 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-70-101-28.eu-central-1.compute.amazonaws.com

Software

Netlify /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework
Accept-Language: he-IL,he;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-nf-request-id: 01HW7VQXKFP1JDJWYSZFMPEX7R
date: Wed, 24 Apr 2024 10:52:07 GMT
content-encoding: br
strict-transport-security: max-age=31536000
server: Netlify
age: 71517
cache-status: "Netlify Edge"; hit
etag: "15d332bb735e0dafb8bc25db3451253c-ssl-df"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
cache-control: public,max-age=0,must-revalidate
accept-ranges: bytes
content-length: 1256

GET
H2 200 blog.json Show response
www.deepinstinct.com/_next/data/7-TyYd0Ikn4eVyBeP3eWe/en/ 111 KB
29 KB 535ms
534ms Fetch
application/json 3.70.101.28
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.deepinstinct.com/_next/data/7-TyYd0Ikn4eVyBeP3eWe/en/blog.json?pid=blog

Requested by

Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/_next/static/chunks/main-c5b7e6d77b82bab5.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.70.101.28 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-70-101-28.eu-central-1.compute.amazonaws.com

Software

Netlify /

Resource Hash

8b0ad567f607c61d4574b49cf17871843915be8c7e2a9621d05c8f55ff8739c5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
purpose: prefetch
x-nextjs-data: 1
Accept-Language: he-IL,he;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Referer: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework
sec-ch-ua-platform: "Win32"

Response headers

x-nf-request-id: 01HW7VQXKF4190CA16R10RHDE3
date: Wed, 24 Apr 2024 10:52:08 GMT
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000
x-nextjs-date: Wed, 24 Apr 2024 10:52:07 GMT
age: 32
x-nextjs-matched-path: /en/[pid]
content-length: 29926
netlify-vary: header=x-nextjs-data,cookie=__prerender_bypass|__next_preview_data
server: Netlify
cache-status: "Next.js"; hit, "Netlify Edge"; fwd=stale
etag: "aphoups31t2fcw-df"
vary: Accept-Encoding
content-type: application/json
cache-control: public,max-age=0,must-revalidate

GET
H2 200 1.json Show response
www.deepinstinct.com/_next/data/7-TyYd0Ikn4eVyBeP3eWe/en/author/simon-kenin/page/ 252 KB
62 KB 436ms
436ms Fetch
application/json 3.70.101.28
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.deepinstinct.com/_next/data/7-TyYd0Ikn4eVyBeP3eWe/en/author/simon-kenin/page/1.json

Requested by

Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/_next/static/chunks/main-c5b7e6d77b82bab5.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.70.101.28 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-70-101-28.eu-central-1.compute.amazonaws.com

Software

Netlify /

Resource Hash

f3e4e112b2d5e33eab4dc97800b6ea00858a4fedaf26f0fe21d5748863df3991

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
purpose: prefetch
x-nextjs-data: 1
Accept-Language: he-IL,he;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Referer: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework
sec-ch-ua-platform: "Win32"

Response headers

x-nf-request-id: 01HW7VQXKFN7VPPXYZM14RB8X1
date: Wed, 24 Apr 2024 10:52:07 GMT
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000
netlify-vary: header=x-nextjs-data|Accept-Encoding,cookie=__prerender_bypass|__next_preview_data
server: Netlify
age: 986
cache-status: "Next.js"; hit; fwd=stale, "Netlify Edge"; fwd=miss
etag: "lfd5y5u6h55hv0-df"
vary: Accept-Encoding
content-type: application/json
x-nextjs-date: Wed, 24 Apr 2024 10:52:07 GMT
cache-control: no-cache
x-nextjs-matched-path: /en/author/[uid]/page/[pid]

GET
H2 200 %5Bpid%5D-dae3acf70331eea3.js
www.deepinstinct.com/_next/static/chunks/pages/author/%5Buid%5D/page/ 0
4 KB 154ms
154ms Other
application/javascript 3.70.101.28
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.deepinstinct.com/_next/static/chunks/pages/author/%5Buid%5D/page/%5Bpid%5D-dae3acf70331eea3.js

Requested by

Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/_next/static/chunks/main-c5b7e6d77b82bab5.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.70.101.28 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-70-101-28.eu-central-1.compute.amazonaws.com

Software

Netlify /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework
Accept-Language: he-IL,he;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-nf-request-id: 01HW7VQXKH2R068PZ49BZHYMRM
date: Wed, 24 Apr 2024 10:52:07 GMT
content-encoding: br
strict-transport-security: max-age=31536000
server: Netlify
age: 71508
cache-status: "Netlify Edge"; hit
etag: "cd19cee397474a5badc0b081afba1bd1-ssl-df"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
cache-control: public,max-age=0,must-revalidate
accept-ranges: bytes
content-length: 3807

GET
H2 200 1.json Show response
www.deepinstinct.com/_next/data/7-TyYd0Ikn4eVyBeP3eWe/en/author/deep-instinct-research/page/ 251 KB
61 KB 556ms
555ms Fetch
application/json 3.70.101.28
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.deepinstinct.com/_next/data/7-TyYd0Ikn4eVyBeP3eWe/en/author/deep-instinct-research/page/1.json

Requested by

Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/_next/static/chunks/main-c5b7e6d77b82bab5.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.70.101.28 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-70-101-28.eu-central-1.compute.amazonaws.com

Software

Netlify /

Resource Hash

c1bf2f1787d4c57156e2faff7d7259eccbafd4ea70e2cfdb065448e9e9a866fc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
purpose: prefetch
x-nextjs-data: 1
Accept-Language: he-IL,he;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Referer: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework
sec-ch-ua-platform: "Win32"

Response headers

x-nf-request-id: 01HW7VQXKFVTF0VYZCZFQEQDPV
date: Wed, 24 Apr 2024 10:52:08 GMT
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000
x-nextjs-date: Wed, 24 Apr 2024 10:52:07 GMT
age: 923
x-nextjs-matched-path: /en/author/[uid]/page/[pid]
content-length: 62807
netlify-vary: header=x-nextjs-data,cookie=__prerender_bypass|__next_preview_data
server: Netlify
cache-status: "Next.js"; hit; fwd=stale, "Netlify Edge"; fwd=stale
etag: "u0xpnp7rl5hhp-df"
vary: Accept-Encoding
content-type: application/json
cache-control: no-cache

GET
H2

200

collect
px.ads.linkedin.com/
Redirect Chain

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=316505&time=1713955927663&li_adsId=2d08bd37-1d11-42bb-88f3-78bfb178795c&url=https%3A%2F%2Fwww.deepinstinct.com%2Fblog%2Fdarkbeatc2-the-latest-mudd...
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=316505&time=1713955927663&li_adsId=2d08bd37-1d11-42bb-88f3-78bfb178795c&url=https%3A%2F%2Fwww.deepinstinct.com%2Fblog%2Fdarkbeatc2-the-latest-mudd...
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D316505%26time%3D1713955927663%26li_adsId%3D2d08bd37-1d11-42bb-88f3-78bfb178795c%2...
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=316505&time=1713955927663&li_adsId=2d08bd37-1d11-42bb-88f3-78bfb178795c&url=https%3A%2F%2Fwww.deepinstinct.com%2Fblog%2Fdarkbeatc2-the-latest-mudd...

0
163 B

202ms
202ms

Image
application/javascript

13.107.42.14
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=316505&time=1713955927663&li_adsId=2d08bd37-1d11-42bb-88f3-78bfb178795c&url=https%3A%2F%2Fwww.deepinstinct.com%2Fblog%2Fdarkbeatc2-the-latest-muddywater-attack-framework&cookiesTest=true&liSync=true
Requested by: Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework
Protocol: H2
Server: 13.107.42.14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: he-IL,he;q=0.9;q=0.9
Referer: https://www.deepinstinct.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36

Response headers

date: Wed, 24 Apr 2024 10:52:08 GMT
x-li-pop: afd-prod-lva1-x
x-msedge-ref: Ref A: 0645111E188C45EDAD6D570D69410C66 Ref B: TLV30EDGE0516 Ref C: 2024-04-24T10:52:08Z
linkedin-action: 1
x-cache: CONFIG_NOCACHE
content-type: application/javascript
x-li-fabric: prod-lva1
x-li-proto: http/2
content-length: 0
x-li-uuid: AAYW1XZHna+6Bg+035nAdw==

Redirect headers

strict-transport-security: max-age=31536000
content-security-policy: frame-ancestors 'self'
x-content-type-options: nosniff
date: Wed, 24 Apr 2024 10:52:08 GMT
linkedin-action: 1
x-cache: CONFIG_NOCACHE
content-length: 0
x-li-uuid: AAYW1XZEb2SUnFbqYun4HQ==
pragma: no-cache
x-li-pop: afd-prod-lva1-x
x-msedge-ref: Ref A: 04BF27D519124146B5F8DC1859987369 Ref B: TLV30EDGE0516 Ref C: 2024-04-24T10:52:08Z
x-frame-options: sameorigin
x-li-fabric: prod-lva1
location: https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=316505&time=1713955927663&li_adsId=2d08bd37-1d11-42bb-88f3-78bfb178795c&url=https%3A%2F%2Fwww.deepinstinct.com%2Fblog%2Fdarkbeatc2-the-latest-muddywater-attack-framework&cookiesTest=true&liSync=true
cache-control: no-cache, no-store
x-li-proto: http/2
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 partners.json Show response
www.deepinstinct.com/_next/data/7-TyYd0Ikn4eVyBeP3eWe/en/ 26 KB
7 KB 369ms
368ms Fetch
application/json 3.70.101.28
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.deepinstinct.com/_next/data/7-TyYd0Ikn4eVyBeP3eWe/en/partners.json?pid=partners

Requested by

Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/_next/static/chunks/main-c5b7e6d77b82bab5.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.70.101.28 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-70-101-28.eu-central-1.compute.amazonaws.com

Software

Netlify /

Resource Hash

dd2c60ce2a0e8c99bffd15d5941f53f0b508eaeb2c66b0181d563ed23240ff15

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
purpose: prefetch
x-nextjs-data: 1
Accept-Language: he-IL,he;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Referer: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework
sec-ch-ua-platform: "Win32"

Response headers

x-nf-request-id: 01HW7VQXPN4CNHW73RACHCP5HG
date: Wed, 24 Apr 2024 10:52:07 GMT
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000
x-nextjs-date: Wed, 24 Apr 2024 10:52:07 GMT
age: 761
x-nextjs-matched-path: /en/[pid]
content-length: 6714
netlify-vary: header=x-nextjs-data,cookie=__prerender_bypass|__next_preview_data
server: Netlify
cache-status: "Next.js"; hit; fwd=stale, "Netlify Edge"; fwd=stale
etag: "iu627gl25hkq0-df"
vary: Accept-Encoding
content-type: application/json
cache-control: public,max-age=0,must-revalidate

GET
H2 200 /
www.facebook.com/tr/ 0
269 B 338ms
110ms Image
text/plain 157.240.253.35
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=468591697375107&ev=PageView&dl=https%3A%2F%2Fwww.deepinstinct.com%2Fblog%2Fdarkbeatc2-the-latest-muddywater-attack-framework&rl=&if=false&ts=1713955927777&sw=1600&sh=1200&v=2.9.154&r=stable&ec=0&o=4126&fbp=fb.1.1713955927776.356992077&ler=empty&cdl=API_unavailable&it=1713955926996&coo=false&rqm=GET

Requested by

Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

157.240.253.35 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

edge-star-mini-shv-02-fra5.facebook.com

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.deepinstinct.com/
Accept-Language: he-IL,he;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-fb-connection-quality: GOOD; q=0.7, rtt=50, rtx=0, c=10, mss=1380, tbw=2826, tp=-1, tpl=-1, uplat=1, ullat=0
strict-transport-security: max-age=31536000; includeSubDomains
date: Wed, 24 Apr 2024 10:52:08 GMT
server: proxygen-bolt
content-type: text/plain
access-control-allow-origin
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 0

GET
H2 200 /
www.facebook.com/tr/ 0
98 B 338ms
110ms Image
text/plain 157.240.253.35
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=332937911623471&ev=PageView&dl=https%3A%2F%2Fwww.deepinstinct.com%2Fblog%2Fdarkbeatc2-the-latest-muddywater-attack-framework&rl=&if=false&ts=1713955927779&sw=1600&sh=1200&v=2.9.154&r=stable&ec=0&o=4126&fbp=fb.1.1713955927776.356992077&ler=empty&cdl=API_unavailable&it=1713955926996&coo=false&rqm=GET

Requested by

Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

157.240.253.35 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

edge-star-mini-shv-02-fra5.facebook.com

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.deepinstinct.com/
Accept-Language: he-IL,he;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-fb-connection-quality: GOOD; q=0.7, rtt=50, rtx=0, c=10, mss=1380, tbw=3108, tp=-1, tpl=-1, uplat=0, ullat=0
strict-transport-security: max-age=31536000; includeSubDomains
date: Wed, 24 Apr 2024 10:52:08 GMT
server: proxygen-bolt
content-type: text/plain
access-control-allow-origin
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 0

GET
H2 200 %5Bpid%5D-ed9134132e10b8ba.js Show response
www.deepinstinct.com/_next/static/chunks/pages/ 5 KB
0 0ms
0ms Script
application/javascript 3.70.101.28
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://www.deepinstinct.com/_next/static/chunks/pages/%5Bpid%5D-ed9134132e10b8ba.js
Requested by: Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/_next/static/chunks/main-c5b7e6d77b82bab5.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.70.101.28 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-70-101-28.eu-central-1.compute.amazonaws.com
Software: Netlify /
Resource Hash: 488b5f9d2946120012efd50d989959509b06c83f9b720d0bb58edafadc71bfac

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework
Accept-Language: he-IL,he;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-nf-request-id: 01HW7VQXKFP1JDJWYSZFMPEX7R
date: Wed, 24 Apr 2024 10:52:07 GMT
content-encoding: br
server: Netlify
age: 71517
cache-status: "Netlify Edge"; hit
etag: "15d332bb735e0dafb8bc25db3451253c-ssl-df"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
cache-control: public,max-age=0,must-revalidate
accept-ranges: bytes
content-length: 1256

GET
H2 200 7e11275f8e6fc085.css Show response
www.deepinstinct.com/_next/static/css/ 14 KB
3 KB 147ms
145ms Fetch
text/css 3.70.101.28
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.deepinstinct.com/_next/static/css/7e11275f8e6fc085.css

Requested by

Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/_next/static/chunks/main-c5b7e6d77b82bab5.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.70.101.28 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-70-101-28.eu-central-1.compute.amazonaws.com

Software

Netlify /

Resource Hash

50b4811918e32d93ed527f463f88ac9d4dafd29d14b5f17ee69f623bf3aba360

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework
Accept-Language: he-IL,he;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-nf-request-id: 01HW7VQXSNKM733JTT48FV9RZG
date: Wed, 24 Apr 2024 10:52:07 GMT
content-encoding: br
strict-transport-security: max-age=31536000
server: Netlify
age: 73733
cache-status: "Netlify Edge"; hit
etag: "a08d329af0ca27ab60ede65e07cd2abf-ssl-df"
vary: Accept-Encoding
content-type: text/css; charset=UTF-8
cache-control: public,max-age=0,must-revalidate
accept-ranges: bytes
content-length: 3159

GET
H2 200 %5Bpid%5D-dae3acf70331eea3.js Show response
www.deepinstinct.com/_next/static/chunks/pages/author/%5Buid%5D/page/ 10 KB
0 1ms
1ms Script
application/javascript 3.70.101.28
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://www.deepinstinct.com/_next/static/chunks/pages/author/%5Buid%5D/page/%5Bpid%5D-dae3acf70331eea3.js
Requested by: Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/_next/static/chunks/main-c5b7e6d77b82bab5.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.70.101.28 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-70-101-28.eu-central-1.compute.amazonaws.com
Software: Netlify /
Resource Hash: ec123bd26b1064cd72ca8c52f9c5576d95587da65aa9e2efdbc2fcccf892a8f4

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework
Accept-Language: he-IL,he;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-nf-request-id: 01HW7VQXKH2R068PZ49BZHYMRM
date: Wed, 24 Apr 2024 10:52:07 GMT
content-encoding: br
server: Netlify
age: 71508
cache-status: "Netlify Edge"; hit
etag: "cd19cee397474a5badc0b081afba1bd1-ssl-df"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
cache-control: public,max-age=0,must-revalidate
accept-ranges: bytes
content-length: 3807

GET
H2 200 b5a64cbe6880b7dc.css Show response
www.deepinstinct.com/_next/static/css/ 16 KB
4 KB 147ms
146ms Fetch
text/css 3.70.101.28
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.deepinstinct.com/_next/static/css/b5a64cbe6880b7dc.css

Requested by

Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/_next/static/chunks/main-c5b7e6d77b82bab5.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.70.101.28 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-70-101-28.eu-central-1.compute.amazonaws.com

Software

Netlify /

Resource Hash

09e468b6ae3eaabab8e4f41329c722ee5ff819b477146ea02d27a7b1b49d5050

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework
Accept-Language: he-IL,he;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-nf-request-id: 01HW7VQXSPPTXKKVWGCJWHGBQ9
date: Wed, 24 Apr 2024 10:52:07 GMT
content-encoding: br
strict-transport-security: max-age=31536000
server: Netlify
age: 73733
cache-status: "Netlify Edge"; hit
etag: "a85bff580d8ffd9cf629505d2f37a034-ssl-df"
vary: Accept-Encoding
content-type: text/css; charset=UTF-8
cache-control: public,max-age=0,must-revalidate
accept-ranges: bytes
content-length: 3642

GET
H2 200 NW3rMrxBqJx71BachJFa.json Show response
s.swiftypecdn.com/install/v2/config/ 19 KB
5 KB 1000ms
730ms XHR
application/json 151.101.129.167
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://s.swiftypecdn.com/install/v2/config/NW3rMrxBqJx71BachJFa.json

Requested by

Host: cdn.bizible.com
URL: https://cdn.bizible.com/scripts/bizible.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.129.167 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

9a496e8b9da307a0d817e4104c0418c6ff0c8841c6bbb8e426a424d304ac3296

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Accept: */*
Referer: https://www.deepinstinct.com/
Accept-Language: he-IL,he;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 24 Apr 2024 10:52:08 GMT
content-encoding: gzip
x-content-type-options: nosniff
via: 1.1 varnish
x-permitted-cross-domain-policies: none
age: 0
x-cache: HIT
content-length: 4251
x-xss-protection: 1; mode=block
x-request-id: 0c823faea92e60538d31406df18e3bff
x-served-by: cache-mrs1050091-MRS
referrer-policy: strict-origin-when-cross-origin
last-modified: Tue, 16 May 2023 16:51:29 GMT
x-timer: S1713955928.353599,VS0,VE595
etag: W/"0b4dc992c692095d33a1f63f87bd38a6"
x-download-options: noopen
x-frame-options: SAMEORIGIN
access-control-max-age: 7200
access-control-allow-methods: GET, POST
content-type: application/json; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers
cache-control: max-age=300, public
access-control-allow-credentials: true
vary: Accept-Encoding, Origin
accept-ranges: bytes
x-cache-hits: 0

POST
H2 204 / Show response
px.ads.linkedin.com/wa/ 0
199 B 204ms
204ms XHR
text/plain 13.107.42.14
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://px.ads.linkedin.com/wa/
Requested by: Host: cdn.bizible.com
URL: https://cdn.bizible.com/scripts/bizible.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 13.107.42.14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Accept-Language: he-IL,he;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Accept: *
Referer: https://www.deepinstinct.com/
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 24 Apr 2024 10:52:08 GMT
x-li-pop: afd-prod-lva1-x
x-msedge-ref: Ref A: AEA5F365629441558A73EA1F0AFDA472 Ref B: TLV30EDGE0516 Ref C: 2024-04-24T10:52:08Z
linkedin-action: 1
vary: Origin
x-cache: CONFIG_NOCACHE
x-li-fabric: prod-lva1
access-control-allow-origin: https://www.deepinstinct.com
x-li-proto: http/2
access-control-allow-credentials: true
x-li-uuid: AAYW1XZLBJ6GnlqmCcxkmQ==

GET
H2 200 __ptq.gif
track.hubspot.com/ 45 B
1 KB 369ms
246ms Image
image/gif 104.16.118.116
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://track.hubspot.com/__ptq.gif?k=1&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=he-il&bfp=801040782&v=1.1&a=2183098&rcu=https%3A%2F%2Fwww.deepinstinct.com%2Fblog%2Fdarkbeatc2-the-latest-muddywater-attack-framework&pu=https%3A%2F%2Fwww.deepinstinct.com%2Fblog%2Fdarkbeatc2-the-latest-muddywater-attack-framework&t=DarkBeatC2%3A+The+Latest+MuddyWater+Attack+Framework&cts=1713955928652&vi=e5230d1c22fd96938e86c51510fe59d6&nc=true&u=160033954.e5230d1c22fd96938e86c51510fe59d6.1713955928647.1713955928647.1713955928647.1&b=160033954.1.1713955928647&pt=0&cc=15

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.118.116 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.deepinstinct.com/
Accept-Language: he-IL,he;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 24 Apr 2024 10:52:08 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-evy-trace-route-service-name: envoyset-translator
x-hubspot-correlation-id: 60b86a01-d70d-4c1b-ba78-df2b04ca9390
p3p: CP="NOI CUR ADM OUR NOR STA NID"
x-envoy-upstream-service-time: 10
content-length: 45
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: 60b86a01-d70d-4c1b-ba78-df2b04ca9390
server: cloudflare
vary: origin, Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ngMizfaxzuQk%2BuFIcKFxLn%2FzOuBMkp7eQ1dzlu9rvBTn4UZDAKefR0cjvybED860GwnD52cUjiINB8VTYrmTu9cH0gaIzBkZLlMVot8re7r4xsMH8hST9bgAKUer7sPOG2rp"}],"group":"cf-nel","max_age":604800}
content-type: image/gif
x-evy-trace-served-by-pod: iad02/analytics-tracking-td/envoy-proxy-76d96f8b5d-drvpc
x-evy-trace-virtual-host: all
cache-control: no-cache, no-store, no-transform
access-control-allow-credentials: false
cf-ray: 87958acb0986e3e3-TLV
x-robots-tag: none

GET
H2 200 favicon-32x32.png
www.deepinstinct.com/favicon/ 1 KB
1 KB 149ms
148ms Other
image/png 3.70.101.28
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.deepinstinct.com/favicon/favicon-32x32.png

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.70.101.28 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-70-101-28.eu-central-1.compute.amazonaws.com

Software

Netlify /

Resource Hash

5be8aaeb682186c135e30933672211af0127c48e96ac3cb3e2b4a9379e8b861b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework
Accept-Language: he-IL,he;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-nf-request-id: 01HW7VQYMHGVNVADJRTJF3E22Q
date: Wed, 24 Apr 2024 10:52:08 GMT
strict-transport-security: max-age=31536000
server: Netlify
age: 47096
cache-status: "Netlify Edge"; hit
etag: "6c3361589f0d0f46f3458658f29255f6-ssl"
content-type: image/png
cache-control: public,max-age=0,must-revalidate
accept-ranges: bytes
content-length: 1056

GET
H/1.1 200
OK messenger
app.qualified.com/w/1/DxHYmKWTScn3buDp/ Frame A386 0
0 700ms
237ms Document
text/html 52.6.115.117
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://app.qualified.com/w/1/DxHYmKWTScn3buDp/messenger?uuid=92154fa5-3bc0-4989-b9cd-e9c8ad330bd9

Requested by

Host: js.qualified.com
URL: https://js.qualified.com/qualified.js?token=DxHYmKWTScn3buDp

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

52.6.115.117 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-52-6-115-117.compute-1.amazonaws.com

Software

Resource Hash

Security Headers

Name	Value
Content-Security-Policy
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: he-IL,he;q=0.9;q=0.9
Referer: https://www.deepinstinct.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Win32"

Response headers

Cache-Control: max-age=0, private, must-revalidate
Content-Encoding: gzip
Content-Length: 1642
Content-Security-Policy
Content-Type: text/html; charset=utf-8
Date: Wed, 24 Apr 2024 10:52:09 GMT
Etag: W/"c0d917cea108460a081a617e244a68a5"
Link: <https://assets.qualified.com/packs/css/vendors~widget/sandboxed/messenger-94e6eccc.chunk.css>; rel=preload; as=style; nopush,<https://assets.qualified.com/packs/css/widget/sandboxed/messenger-ea37ea0f.chunk.css>; rel=preload; as=style; nopush
Referrer-Policy: strict-origin-when-cross-origin
Strict-Transport-Security: max-age=63072000; includeSubDomains
Vary: Accept-Encoding
Via: 1.1 spaces-router (2a9d893844a5)
X-Content-Type-Options: nosniff
X-Download-Options: noopen
X-Permitted-Cross-Domain-Policies: none
X-Request-Id: f3445d2d-7d9c-af1d-0441-87a70730877f
X-Runtime: 0.016861
X-Xss-Protection: 1; mode=block

GET
H2 200 new_embed-2552d8d62d9c60f59b3b11a5d083d1ebd090c72de809fc7c76fb339825302241.css
s.swiftypecdn.com/assets/ 89 KB
33 KB 132ms
131ms Stylesheet
text/css 151.101.129.167
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://s.swiftypecdn.com/assets/new_embed-2552d8d62d9c60f59b3b11a5d083d1ebd090c72de809fc7c76fb339825302241.css
Requested by: Host: s.swiftypecdn.com
URL: https://s.swiftypecdn.com/install/v2/st.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.129.167 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 2552d8d62d9c60f59b3b11a5d083d1ebd090c72de809fc7c76fb339825302241

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.deepinstinct.com/
Accept-Language: he-IL,he;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-cache-hits: 168
date: Wed, 24 Apr 2024 10:52:09 GMT
content-encoding: gzip
via: 1.1 varnish
age: 41080
x-cache: HIT
content-length: 33983
x-served-by: cache-mrs10565-MRS
x-timer: S1713955929.087000,VS0,VE0
etag: "62b9d075-84bf"
vary: Accept-Encoding
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=31536000, public
accept-ranges: bytes
expires: Wed, 23 Apr 2025 23:27:28 GMT

GET
H/1.1 200
OK cc.js
cc.swiftype.com/ 43 B
279 B 1009ms
241ms Image
image/gif 169.48.219.66
SOFTLAYER

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cc.swiftype.com/cc.js?engine_key=zPgdszsQivuSeQwTEHrm&url=https%3A%2F%2Fwww.deepinstinct.com%2Fblog%2Fdarkbeatc2-the-latest-muddywater-attack-framework
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 169.48.219.66 , United States, ASN36351 (SOFTLAYER, US),
Reverse DNS: 42.db.30a9.ip4.static.sl-reverse.com
Software: /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.deepinstinct.com/
Accept-Language: he-IL,he;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Content-Type: image/gif
Date: Wed, 24 Apr 2024 10:52:10 GMT
Cache-Control: no-cache
Last-Modified: Mon, 28 Sep 1970 06:00:00 GMT
Connection: keep-alive
Content-Length: 43
Expires: Wed, 24 Apr 2024 10:52:09 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: id.rlcdn.com
URL: https://id.rlcdn.com/464526.gif

Verdicts & Comments Add Verdict or Comment

103 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

44 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.deepinstinct.com/	1970-01-20 22:15:31	Name: _gcl_au Value: 1.1.2125086103.1713955926
.techtarget.com/	1970-01-20 20:05:57	Name: __cf_bm Value: LE8Zth9oWN5gxV6O4dqPBokjwVQmr6Iv1XabKZvtkXA-1713955926-1.0.1.1-EttbkKMWmdGMhYtecgF5s0TSZGceUYu2m6SBXMG7JrmGdJNvp_JZF50J6BTXt4jrRkI.3PNj3t7feS.CDK42iA
.deepinstinct.com/	1970-01-21 05:41:55	Name: _ga_P5MMKMDSNW Value: GS1.1.1713955926.1.0.1713955926.60.0.0
.deepinstinct.com/	1970-01-20 20:07:22	Name: _uetsid Value: b1490180022811efaa338978df00db00
.deepinstinct.com/	1970-01-21 05:27:31	Name: _uetvid Value: b1493350022811efa5bc25fd0c3bcc37
.deepinstinct.com/	1970-01-21 05:41:55	Name: _ga Value: GA1.2.218287240.1713955927
.deepinstinct.com/	1970-01-20 20:07:22	Name: _gid Value: GA1.2.2009306344.1713955927
.deepinstinct.com/	1970-01-20 20:05:55	Name: _gat_UA-69598329-1 Value: 1
.bing.com/	1970-01-21 05:27:31	Name: MUID Value: 2B141C3E17376FEF0A26085516A76E46
.deepinstinct.com/	1970-01-21 04:51:31	Name: _biz_uid Value: c2f8104f61aa466c93445c1e70222f52
.deepinstinct.com/	1970-01-21 04:51:31	Name: _biz_nA Value: 1
.doubleclick.net/	1970-01-20 20:05:56	Name: test_cookie Value: CheckForPermission
.bizible.com/	1970-01-21 04:51:31	Name: _BUID Value: c2f8104f61aa466c93445c1e70222f52
.company-target.com/	1970-01-21 05:41:55	Name: tuuid Value: f909a565-bb59-46f8-a507-93955da6b250
.company-target.com/	1970-01-21 05:41:55	Name: tuuid_lu Value: 1713955927\|ix:0\|mctv:0\|rp:0
.deepinstinct.com/	1970-01-21 04:51:31	Name: _biz_pendingA Value: %5B%5D
.bizibly.com/	1970-01-21 04:51:31	Name: _BUID Value: 216e44834db2865bc80efdabc9c1e554
.deepinstinct.com/	1970-01-21 04:51:31	Name: _hjSessionUser_1665869 Value: eyJpZCI6Ijk4YzE4MjMwLWQxN2MtNTEzNS1iOTgyLWM2MDhlOGMyYmI2ZSIsImNyZWF0ZWQiOjE3MTM5NTU5Mjc2NTYsImV4aXN0aW5nIjpmYWxzZX0=
.deepinstinct.com/	1970-01-20 20:05:57	Name: _hjSession_1665869 Value: eyJpZCI6ImIzMThjMzc0LTM2OTUtNDk0Mi05YTcxLWI5YzVhYzcwNTM5MiIsImMiOjE3MTM5NTU5Mjc2NTcsInMiOjAsInIiOjAsInNiIjowLCJzciI6MCwic2UiOjAsImZzIjoxLCJzcCI6MH0=
.t.co/	1970-01-21 05:41:55	Name: muc_ads Value: a29551c9-c53e-4d3f-9fae-67a30cae8586
.rubiconproject.com/	1970-01-21 04:51:31	Name: khaos Value: LVDP3TR0-1U-AEWB
.rubiconproject.com/	1970-01-21 04:51:31	Name: audit Value: 1\|94neqLR3gnV/DUvV7k6S4uWV2mzMmOe3w/FSmjoR19t+4SNCS7h+Yyedq6/n3pTxoGcXhMfx7JuM1KxoLazIt5mwZQnb46mpzi6pKkPY5xhDoLlduYBLkCJ5OxAcqBRaBCH9gEFiDdZS1cKDpei2DnQ0ZCX6+4svcmESKmf2cwrTmoFL5pKQsaZr5ZVxLWDe
.rubiconproject.com/	1970-01-20 22:15:31	Name: receive-cookie-deprecation Value: 1
.casalemedia.com/	1970-01-21 04:51:31	Name: CMID Value: ZijkV4sFVnQAAF7iAUmeIwAA
.casalemedia.com/	1970-01-20 22:15:31	Name: CMPS Value: 5036
.casalemedia.com/	1970-01-20 22:15:31	Name: CMPRO Value: 5036
.twitter.com/	1970-01-21 05:41:55	Name: personalization_id Value: "v1_PW+4ore+DDM86puFUtF7NA=="
.deepinstinct.com/	1970-01-21 05:41:55	Name: __q_state_DxHYmKWTScn3buDp Value: eyJ1dWlkIjoiOTIxNTRmYTUtM2JjMC00OTg5LWI5Y2QtZTljOGFkMzMwYmQ5IiwiY29va2llRG9tYWluIjoiZGVlcGluc3RpbmN0LmNvbSJ9
.deepinstinct.com/	1970-01-20 22:15:31	Name: _fbp Value: fb.1.1713955927776.356992077
.deepinstinct.com/	1970-01-21 04:51:31	Name: _biz_flagsA Value: %7B%22Version%22%3A1%2C%22ViewThrough%22%3A%221%22%2C%22XDomain%22%3A%221%22%7D
.tremorhub.com/	1970-01-21 04:51:52	Name: tvid Value: 82a41bd2b5ab492399f56b18a18a0a6a
.tremorhub.com/	1970-01-21 05:41:55	Name: tv_UIDM Value: f909a565-bb59-46f8-a507-93955da6b250
.linkedin.com/	1970-01-20 22:15:31	Name: li_sugr Value: 931df7b6-77fa-44c8-8468-d1e7590a445f
.linkedin.com/	1970-01-21 04:51:31	Name: bcookie Value: "v=2&a50d9b91-5be9-4ce7-8b78-47b5e43e6ed5"
.linkedin.com/	1970-01-20 20:07:22	Name: lidc Value: "b=VGST05:s=V:r=V:a=V:p=V:g=3060:u=1:x=1:i=1713955927:t=1714042327:v=2:sig=AQG8HVfJrx4yKrA_mTJ-yxj0QT-6b3Zu"
.linkedin.com/	1970-01-20 20:49:07	Name: UserMatchHistory Value: AQK6ee6dZKLXSgAAAY8Pu_gsH6Cxld0tHS_FTola21xbCoxbbLAjhHFswcHZ6njcR4Ia2MSqeSWw2g
.linkedin.com/	1970-01-20 20:49:07	Name: AnalyticsSyncHistory Value: AQJnmegvI7BmBgAAAY8Pu_gsaWZsUdIQqwypVpODcA_WleBvfMhBq1s2N6CDWaNSTwQ3TI2mz3Q3P6R5HmjpGg
.www.linkedin.com/	1970-01-21 04:51:31	Name: bscookie Value: "v=1&2024042410520851f13d14-0936-4234-8af1-2afa6bfed979AQGAlGLr2je0VIU5Rkq7qjLs7NNDKWhy"
.deepinstinct.com/	1970-01-21 00:25:07	Name: __hstc Value: 160033954.e5230d1c22fd96938e86c51510fe59d6.1713955928647.1713955928647.1713955928647.1
.deepinstinct.com/	1970-01-21 00:25:07	Name: hubspotutk Value: e5230d1c22fd96938e86c51510fe59d6
.deepinstinct.com/	1969-12-31 23:59:59	Name: __hssrc Value: 1
.deepinstinct.com/	1970-01-20 20:05:57	Name: __hssc Value: 160033954.1.1713955928647
.hubspot.com/	1970-01-20 20:05:57	Name: __cf_bm Value: vRf8c4Q49_FhCa5ccDpcO8flwXYAC83acLLVgha6pFA-1713955928-1.0.1.1-mu2G3dhxAfqD3koO.mIwuopGdR6QJ2k2LdkrKEq73ZQEMejV1GpxjY8Ba3Ojh.U8mb1uN2upjnSgFi2N0521pQ
.hubspot.com/	1969-12-31 23:59:59	Name: _cfuvid Value: b2.NRDstgJp.6GPyRNsWGIQ75.p1H7L_mBYDqArKpyQ-1713955928996-0.0.1.1-604800000

56 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
other	warning	URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://connect.facebook.net/signals/config/468591697375107?v=2.9.154&r=stable&domain=www.deepinstinct.com&hme=c3a545c63044e8e9102d4f32d84a1137594d024f28e801d670bc76dc5c075575&ex_m=67%2C112%2C99%2C103%2C58%2C3%2C93%2C66%2C15%2C91%2C84%2C49%2C51%2C158%2C161%2C172%2C168%2C169%2C171%2C28%2C94%2C50%2C73%2C170%2C153%2C156%2C165%2C166%2C173%2C121%2C14%2C48%2C178%2C177%2C123%2C17%2C33%2C38%2C1%2C41%2C62%2C63%2C64%2C68%2C88%2C16%2C13%2C90%2C87%2C86%2C100%2C102%2C37%2C101%2C29%2C25%2C154%2C157%2C130%2C27%2C10%2C11%2C12%2C5%2C6%2C24%2C21%2C22%2C54%2C59%2C61%2C71%2C95%2C26%2C72%2C8%2C7%2C76%2C46%2C20%2C97%2C96%2C9%2C19%2C18%2C81%2C53%2C79%2C32%2C70%2C0%2C89%2C31%2C78%2C83%2C45%2C44%2C82%2C36%2C4%2C85%2C77%2C42%2C39%2C34%2C80%2C2%2C35%2C60%2C40%2C98%2C43%2C75%2C65%2C104%2C57%2C56%2C30%2C92%2C55%2C52%2C47%2C74%2C69%2C23%2C105(Line 97) Message: Unrecognized feature: 'attribution-reporting'.
other	warning	URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework Message: Third-party cookie will be blocked. Learn more in the Issues tab.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

analytics.google.com
analytics.twitter.com
api.company-target.com
app.qualified.com
bat.bing.com
cc.swiftype.com
cdn.bizible.com
cdn.bizibly.com
connect.facebook.net
googleads.g.doubleclick.net
ibc-flow.techtarget.com
id.rlcdn.com
images.contentstack.io
js.hs-analytics.net
js.hs-banner.com
js.hs-scripts.com
js.hsadspixel.net
js.hsleadflows.net
js.qualified.com
p.typekit.net
px.ads.linkedin.com
s.company-target.com
s.swiftypecdn.com
script.hotjar.com
snap.licdn.com
static.ads-twitter.com
static.hotjar.com
stats.g.doubleclick.net
t.co
tag-logger.demandbase.com
tag.demandbase.com
track.hubspot.com
trk.techtarget.com
use.typekit.net
www.deepinstinct.com
www.facebook.com
www.google-analytics.com
www.google.co.il
www.google.com
www.googleoptimize.com
www.googletagmanager.com
www.linkedin.com
id.rlcdn.com
104.16.118.116
104.16.141.209
104.17.128.172
104.17.175.201
104.18.140.17
104.18.17.5
104.18.36.196
104.244.42.131
104.244.42.133
13.107.21.237
13.107.42.14
13.33.187.92
142.250.185.162
142.250.185.232
142.250.185.238
142.250.186.163
142.250.186.174
143.204.98.63
146.75.120.157
151.101.129.167
151.101.66.137
152.195.15.58
157.240.253.1
157.240.253.35
169.48.219.66
172.217.18.14
172.64.153.27
18.245.46.44
18.66.102.53
18.66.102.85
216.58.206.68
23.200.36.197
23.200.36.209
23.200.38.43
3.70.101.28
34.111.208.231
34.96.71.22
52.6.115.117
74.125.206.155
0130b680d34de9079a7677f6954c5fded22ad91a7791e2acd86f3ed53191a1d8
01e9582655224c83e6c075f44b7eecb135e108b6ad2150bf6f78a0a77c4ad5e0
09e468b6ae3eaabab8e4f41329c722ee5ff819b477146ea02d27a7b1b49d5050
0c07b854855b0e2bd7839c3659defa45307e96e281b3c00571d09f213eb6a76e
0f701def79cf3f86b8f75e4f805436a387ff2718851060447561b89a6daae4e6
118a0b64762282c340eb77e3234ae6d4e4ec71d140da6afa6139657c4f83bd00
12adce1ff8ecf597745ee698257dd38a6af8abab2d89e565b2d40893b646f28e
140e801db59d24b4f0ba9e63042b32863068c1369989eb1e632e481f6fcf09f1
16cabc9d4b8ae81eed9193ec25b6d463e68290e5433069885156f7c1dc81e975
1a1ea29b4da0208aa78b7fa3d2b6f39179a1a5de6dfdbc80c0d4dc7443755807
1c0ff118a4290c99f39c90abb38703a866e47251b23cca20266c69c812ccafeb
1c67d8ce90160a6586cfd2c2a936959738f5b1843ebdfbac4325c4d1a9b61224
1ea94e6fc8afdc8a96c72f6821974bbfe2126b9a960c469251c88f2d5dd02260
1ed76e4688ef9d3b8245de7492c54d081dbb25796bde18fe026183bc57b13501
2552d8d62d9c60f59b3b11a5d083d1ebd090c72de809fc7c76fb339825302241
2d7c7930eb39d59cd8c2dc00652977da3ed72347e7cd465f7b540e10e2121c22
2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363
32cc58a56e1170810316c9cb82dd82a1fb379e2b82139b5ed039063bb40e4724
3575cd73d754b670b319a5502e248f3cdee7920b2af18e206d42a6efc54d49df
3a9972297dfa97e4f6a11cc17f5767935ffa27d7c6d92123e38fd423bd4afd9e
3ad3f48e0876d9c90167457933958b33140d66ebb2c6b42107ade20b39fe2cdd
3c51542bd74124ed2bae5b0d8cb837dc7e567a94acaee00f4c686dfb8d272018
3c98404a986fe5182a2b6214d370226eb15a0cb58af0a25c5e9a95239535f5ee
488b5f9d2946120012efd50d989959509b06c83f9b720d0bb58edafadc71bfac
4c903880e86c99ed05c1387b955f7de1f6b97ccdd3ae9db3bf1c82cad6ac8a5a
4d15ff2317e16ccd8ca1d3248fea7d91130e022369bb032824a84ad9967064df
4d3e2dd099535045aef08a0eae076c90e23f526c7d683704293a9ef005ebcd6a
4d69811fcdf2dcc9ff875a6dd0309585ecdf1e55f46345aa9d507f816c4bdb96
4db83b291d4b780a54c7a0e998e64ce8cf5bace8d0612dc0082b0d961f04ce04
4fcc2873d9a9e427999107a83f322c299063db3dd645262a3330e4ed336208fc
50b4811918e32d93ed527f463f88ac9d4dafd29d14b5f17ee69f623bf3aba360
529f9f3aa54fc536d8b9b39f45d3d8bbfbbe067545c2c375ea3fd5f0d446ac14
5612daca21fe73f106c77cab5b0cdf820c777af49b1b0230d98e905c3df63e24
5af2bd700fd3e70bdb66c457260e13362e077c992b9a8e91ef601515c91bf3fc
5be8aaeb682186c135e30933672211af0127c48e96ac3cb3e2b4a9379e8b861b
6006a799a37d5e75090b1631ac710ad8aeac54acf5a48b1beee8c2e52b9c9fd6
6353083e47f984144841ad6f17cb6fd0332a4b629c2089d603f8b2bf04dcf2f8
6371783e47489007d9eeb0119d3ed7c7b540a63f1bb0d1024aca81cf9c5eabfc
67a86dcd9de0e056f9b4be883e95c1587463e7b87e5390982c02e1822f9c3356
6a231076c5c83e79bea81510940b1fdd77839f3873526b0d49485be6697d0e8f
6cc4c722a50b4152194b13e7e3c8a1a5a5f23b17988f8fa85404394efc5c0984
7446f9bea2311ed6c06b322a9cd701db093e5985444698a11e75a998364781dd
7a80c7ae20682012e0a7a06ed486183dc5d7cd45763e09221073675bc067b606
823804a7807864b44093a3843788f4cd076e89cf4a6fdeb8d153ae5c2c2df721
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
8a61ba991bab87bb170f6256868d5f2f3264d28b40b8f8129e02a07a44651469
8b0ad567f607c61d4574b49cf17871843915be8c7e2a9621d05c8f55ff8739c5
8d0056dcc26b8dce6be00539697962adb12475fbf9cbf7fdcbc7c81b2ae7328d
8d3a1bf6e2df7ec1dc004f9ea76c89627a5a1d3350d2e01f833dd20ffddee5b6
8d5da73586712159bb569fbfbd370f05a258113b2591ba238ef4e7bde1db13b7
8e081ea7988f4b0266528e9ec8b76799e66157ff1a989f649710d6c725a7855a
94c1047f45725fdfd62ad286aae8ff577b87af99f3c6ff9e271fca751398cbbc
97a5c1081cd8d00089e641fb9bcd7f074d96dd77c89928d93aeabf665fdd752d
9a496e8b9da307a0d817e4104c0418c6ff0c8841c6bbb8e426a424d304ac3296
9d9e8a96a73580c975860c5b2fa6488d785af4b44e2f0a0a35cbbc891c863746
9f2f9720fde13fce4bc928011aaddb74522f6a9d672d1d42eda39222ed343d81
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
ae4012d4ec0c5f4ca687526203ad35e9f1ea94479c286e533d86e1e24f9c8a19
aec60bc104db041b1512185839f18f52986df7e569e5445f740dd60f763fbca8
aee51003dabd4418d5d411c98526b3af7f28491933357c177099161b1e376bb6
afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277
b247376c3e2732c8d76dd1d9db2151db9261ad2f27b068835af63c14c17401e1
be9814e6a9078f839720af16bf4859cc5c386ea740b72439b34b194dbd483cf3
c067f327a772fd2813c9ff8173c4beb9b0048b18c614fdafa09e516c6e04e826
c1bf2f1787d4c57156e2faff7d7259eccbafd4ea70e2cfdb065448e9e9a866fc
c38430e8e8eeedf87f6a7860ee009e354dbd44f3865a62663239922b35590d7f
c8e3b35aa911b1e6364305e850e35072e75dbceb7fb3ed39b6c9fdf1d216b464
c9476026edd0c62a79ca209ab6ccb1b5f2611ef3049b8d771071878003f6871e
c9a95f9262273cfe4ae43a8a0dbb61ce3d4fbcff4b54d2350258b39cd08b32e0
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
d66b13d15c9f6d62412758da1d16472e96466304912f1fe178ef8d5b3b44cda0
d919b65e50d2b57652640e2fe8f25ac69a26e7b22439f932073ad79ddc0abb14
dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4
dd2c60ce2a0e8c99bffd15d5941f53f0b508eaeb2c66b0181d563ed23240ff15
de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e550590605f348a6163e6f1d157578a98364ee307dd221516f9f2401363e0c20
ec123bd26b1064cd72ca8c52f9c5576d95587da65aa9e2efdbc2fcccf892a8f4
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
ef6c6142ca7d544ac9af662547dc404225e959789e811607d8acea4f07e0d89d
efb5dc6835aeb8a8e1615ca49df1828cfaf708dc73651c5f1c651f2d2ab3907a
f3e4e112b2d5e33eab4dc97800b6ea00858a4fedaf26f0fe21d5748863df3991
f6735d6295b7bd837a2fa51038cbc7a6bb2e2b2b41550a7ea49619487175a48e
f94786fe65dcbc65b0099b471ae2bb89bbabd7fa7d8573dd3c4e0f5bbe555447
fda80d24f1bfe5a68b5f719a1febecfe747c79720e3a26b4b78b6a42b67b37b7
fe2d748cbd7dde62aad4dd1fcf6e6a81675c7fec34601791ac4ab1d2ce6317f7
feadef6719ca44406d0eeb1c80724f6212e37d284782ea336576a216ad24b90b
fff0bdb3f70b85b820a949503a24610fb007cf4582f1e67f4835a14de511d50f

www.deepinstinct.com Open in urlscan Pro 3.70.101.28 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

112 Requests

97 %HTTPS

0 %IPv6

33 Domains

42 Subdomains

40 IPs

4 Countries

2154 kBTransfer

6003 kBSize

44 Cookies

40 Outgoing links

Redirected requests

112 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

www.deepinstinct.com Open in urlscan Pro
3.70.101.28 Public Scan

Screenshot
Live screenshot

Full Image

112
Requests

97 %
HTTPS

0 %
IPv6

33
Domains

42
Subdomains

40
IPs

4
Countries

2154 kB
Transfer

6003 kB
Size

44
Cookies

112 HTTP transactions
0 data transactions