www.mandiant.com Open in urlscan Pro
2606:4700:300b::a29f:f17d Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://pages.mandiant.com/NTY1LVBFSS05NTIAAAGGvNlzn-wDYZs6D7NBs3dT3fhZh_68-ftf8G9A8b8WRKCql9C8QKz2aWa1rbstQV9P__WJVcU=
Effective URL:
https://www.mandiant.com/resources/remediation-and-hardening-strategies-microsoft-365-defend-against-apt29-v13?utm_source...
Submission: On September 08 via api (September 8th 2022, 4:36:01 pm UTC) from IE — Scanned from DE

Summary HTTP 96 Redirects Links 16 Behaviour Indicators

Summary

This website contacted 25 IPs in 4 countries across 16 domains to perform 96 HTTP transactions. The main IP is 2606:4700:300b::a29f:f17d, located in United States and belongs to CLOUDFLARENET, US. The main domain is www.mandiant.com. The Cisco Umbrella rank of the primary domain is 566799.
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on May 3rd 2022. Valid for: a year.

This is the only time www.mandiant.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1	104.17.74.206 104.17.74.206	13335 (CLOUDFLAR...) (CLOUDFLARENET)
29	2606:4700:300... 2606:4700:300b::a29f:f17d	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700::68... 2606:4700::6811:190e	13335 (CLOUDFLAR...) (CLOUDFLARENET)
10	2606:4700::68... 2606:4700::6810:9440	13335 (CLOUDFLAR...) (CLOUDFLARENET)
7	104.17.73.206 104.17.73.206	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	99.86.240.68 99.86.240.68	16509 (AMAZON-02) (AMAZON-02)
7	2a00:1450:400... 2a00:1450:4001:80f::2004	15169 (GOOGLE) (GOOGLE)
3	2606:4700:10:... 2606:4700:10::ac43:2794	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700:440... 2606:4700:4400::6812:2962	13335 (CLOUDFLAR...) (CLOUDFLARENET)
10	2a00:1450:400... 2a00:1450:4001:803::2003	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:80b::2008	15169 (GOOGLE) (GOOGLE)
4	2a00:1450:400... 2a00:1450:4001:809::200e	15169 (GOOGLE) (GOOGLE)
2	2606:4700:10:... 2606:4700:10::ac43:2be9	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	2001:4860:480... 2001:4860:4802:32::36	15169 (GOOGLE) (GOOGLE)
1	2a04:4e42:400... 2a04:4e42:400::485	54113 (FASTLY) (FASTLY)
1	2a00:1450:400... 2a00:1450:4001:812::200a	15169 (GOOGLE) (GOOGLE)
1	2600:9000:223... 2600:9000:223e:4e00:1b:45dc:7080:93a1	16509 (AMAZON-02) (AMAZON-02)
1	52.222.206.178 52.222.206.178	16509 (AMAZON-02) (AMAZON-02)
2	2a00:1450:400... 2a00:1450:4001:801::2003	15169 (GOOGLE) (GOOGLE)
2	54.71.80.26 54.71.80.26	16509 (AMAZON-02) (AMAZON-02)
1	151.101.66.137 151.101.66.137	54113 (FASTLY) (FASTLY)
1	2.22.89.193 2.22.89.193	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	162.247.241.14 162.247.241.14	23467 (NEWRELIC-...) (NEWRELIC-AS-1)
2	3.211.46.194 3.211.46.194	14618 (AMAZON-AES) (AMAZON-AES)
96	25

1 104.17.74.206 (None, )

ASN13335 (CLOUDFLARENET, US)

pages.mandiant.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

29 2606:4700:300b::a29f:f17d (United States)

ASN13335 (CLOUDFLARENET, US)

www.mandiant.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6811:190e (United States)

ASN13335 (CLOUDFLARENET, US)

cdnjs.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 2606:4700::6810:9440 (United States)

ASN13335 (CLOUDFLARENET, US)

cdn.cookielaw.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 104.17.73.206 (None, )

ASN13335 (CLOUDFLARENET, US)

www2.mandiant.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 99.86.240.68 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-99-86-240-68.vie50.r.cloudfront.net

cdn-0.d41.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 2a00:1450:4001:80f::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2606:4700:10::ac43:2794 (United States)

ASN13335 (CLOUDFLARENET, US)

static.addtoany.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:4400::6812:2962 (United States)

ASN13335 (CLOUDFLARENET, US)

geolocation.onetrust.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 2a00:1450:4001:803::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:80b::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:809::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700:10::ac43:2be9 (United States)

ASN13335 (CLOUDFLARENET, US)

my.hellobar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2001:4860:4802:32::36 (United States)

ASN15169 (GOOGLE, US)

region1.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a04:4e42:400::485 (United States)

ASN54113 (FASTLY, US)

cdn.jsdelivr.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:812::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:223e:4e00:1b:45dc:7080:93a1 (United States)

ASN16509 (AMAZON-02, US)

hi.hellobar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.222.206.178 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-52-222-206-178.fra56.r.cloudfront.net

cdn.amplitude.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:801::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 54.71.80.26 (Boardman, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-54-71-80-26.us-west-2.compute.amazonaws.com

api.amplitude.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.66.137 (United States)

ASN54113 (FASTLY, US)

js-agent.newrelic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2.22.89.193 (Vienna, Austria)

ASN20940 (AKAMAI-ASN1, NL)
PTR: a2-22-89-193.deploy.static.akamaitechnologies.com

ff.d41.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 162.247.241.14 (United States)

ASN23467 (NEWRELIC-AS-1, US)

bam.nr-data.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 3.211.46.194 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-3-211-46-194.compute-1.amazonaws.com

vff4596.d41.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
37	mandiant.com pages.mandiant.com www.mandiant.com — Cisco Umbrella Rank: 566799 www2.mandiant.com	946 KB
12	gstatic.com www.gstatic.com fonts.gstatic.com	916 KB
10	cookielaw.org cdn.cookielaw.org — Cisco Umbrella Rank: 730	143 KB
7	google.com www.google.com — Cisco Umbrella Rank: 19	48 KB
6	google-analytics.com www.google-analytics.com — Cisco Umbrella Rank: 94 region1.google-analytics.com — Cisco Umbrella Rank: 2119	20 KB
5	d41.co cdn-0.d41.co — Cisco Umbrella Rank: 44043 ff.d41.co — Cisco Umbrella Rank: 323044 vff4596.d41.co	347 KB
3	amplitude.com cdn.amplitude.com — Cisco Umbrella Rank: 4999 api.amplitude.com — Cisco Umbrella Rank: 1719	26 KB
3	hellobar.com my.hellobar.com — Cisco Umbrella Rank: 27960 hi.hellobar.com — Cisco Umbrella Rank: 88504	79 KB
3	addtoany.com static.addtoany.com — Cisco Umbrella Rank: 5404	28 KB
2	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 141	175 KB
1	nr-data.net bam.nr-data.net — Cisco Umbrella Rank: 423	616 B
1	newrelic.com js-agent.newrelic.com — Cisco Umbrella Rank: 768	14 KB
1	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 120	858 B
1	jsdelivr.net cdn.jsdelivr.net — Cisco Umbrella Rank: 493	2 KB
1	onetrust.com geolocation.onetrust.com — Cisco Umbrella Rank: 1040	359 B
1	cloudflare.com cdnjs.cloudflare.com — Cisco Umbrella Rank: 355	5 KB
96	16

	Domain	Requested by
29	www.mandiant.com	pages.mandiant.com www.mandiant.com
10	www.gstatic.com	www.google.com www.gstatic.com
10	cdn.cookielaw.org	www.mandiant.com cdn.cookielaw.org
7	www.google.com	www.mandiant.com www.gstatic.com www.google.com
7	www2.mandiant.com	www.mandiant.com www2.mandiant.com
4	www.google-analytics.com	www.googletagmanager.com www.mandiant.com
3	static.addtoany.com	www.mandiant.com static.addtoany.com
2	vff4596.d41.co	cdn-0.d41.co
2	api.amplitude.com	cdn.amplitude.com
2	fonts.gstatic.com	fonts.googleapis.com www.google.com
2	region1.google-analytics.com	www.googletagmanager.com
2	my.hellobar.com	www.googletagmanager.com my.hellobar.com
2	www.googletagmanager.com	www.mandiant.com www.googletagmanager.com
2	cdn-0.d41.co	www.mandiant.com cdn-0.d41.co
1	bam.nr-data.net	js-agent.newrelic.com
1	ff.d41.co	cdn-0.d41.co
1	js-agent.newrelic.com	www.mandiant.com
1	cdn.amplitude.com	cdn.jsdelivr.net
1	hi.hellobar.com	www.mandiant.com
1	fonts.googleapis.com	my.hellobar.com
1	cdn.jsdelivr.net	www.googletagmanager.com
1	geolocation.onetrust.com	cdn.cookielaw.org
1	cdnjs.cloudflare.com	www.mandiant.com
1	pages.mandiant.com
96	24

This site contains links to these domains. Also see Links.

Domain
investors.mandiant.com
login.mandiant.com
www.mandiant.fr
www.mandiant.de
www.mandiant.jp
www.mandiant.kr
www.mandiant.es
www.mandiant.it
www.facebook.com
twitter.com
www.youtube.com
www.linkedin.com
partners.fireeye.com
cookiepedia.co.uk
www.onetrust.com

Subject Issuer	Validity	Valid
pages.mandiant.com Cloudflare Inc ECC CA-3	`2022-01-13` - `2023-01-12`	a year	crt.sh
mandiant.com Cloudflare Inc ECC CA-3	`2022-05-03` - `2023-05-02`	a year	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2022-08-03` - `2023-08-02`	a year	crt.sh
cookielaw.org Cloudflare Inc ECC CA-3	`2022-05-01` - `2023-05-01`	a year	crt.sh
www2.mandiant.com Cloudflare Inc ECC CA-3	`2022-01-13` - `2023-01-12`	a year	crt.sh
*.d41.co DigiCert TLS RSA SHA256 2020 CA1	`2022-02-01` - `2023-03-04`	a year	crt.sh
www.google.com GTS CA 1C3	`2022-08-22` - `2022-11-14`	3 months	crt.sh
onetrust.com Cloudflare Inc ECC CA-3	`2022-01-12` - `2023-01-12`	a year	crt.sh
*.gstatic.com GTS CA 1C3	`2022-08-22` - `2022-11-14`	3 months	crt.sh
*.google-analytics.com GTS CA 1C3	`2022-08-22` - `2022-11-14`	3 months	crt.sh
jsdelivr.net GlobalSign Atlas R3 DV TLS CA 2022 Q1	`2022-03-21` - `2023-04-22`	a year	crt.sh
*.google.com GTS CA 1C3	`2022-08-22` - `2022-11-14`	3 months	crt.sh
upload.video.google.com GTS CA 1C3	`2022-08-15` - `2022-11-07`	3 months	crt.sh
*.hellobar.com Amazon	`2021-11-15` - `2022-12-13`	a year	crt.sh
cdn.amplitude.com Amazon	`2021-12-17` - `2023-01-14`	a year	crt.sh
*.amplitude.com COMODO RSA Domain Validation Secure Server CA	`2022-01-28` - `2023-02-28`	a year	crt.sh
js-agent.newrelic.com GlobalSign Atlas R3 DV TLS CA 2022 Q2	`2022-07-10` - `2023-08-11`	a year	crt.sh
apps02.dnb.com DigiCert ECC Secure Server CA	`2022-02-20` - `2023-02-22`	a year	crt.sh
*.nr-data.net DigiCert TLS RSA SHA256 2020 CA1	`2022-01-10` - `2023-02-10`	a year	crt.sh

This page contains 10 frames:

Primary Page: https://www.mandiant.com/resources/remediation-and-hardening-strategies-microsoft-365-defend-against-apt29-v13?utm_source=newsletter&utm_medium=email&utm_campaign=threat_intelligence&utm_content=all&utm_term=en&cid=global&mkt_tok=NTY1LVBFSS05NTIAAAGGvNlzn0jgaUADPeckarP9ryGyW8FymW2g6eWg1XVwVBbl60tKrgiSQKdwVqQqaI8C0VvT1IsNg0j0L-kqO_ozuVvIL8ODVs6b40IVTjo
Frame ID: 8F4AF6FF44D6D15ED92C6175FE6B4AF6
Requests: 73 HTTP requests in this frame

Frame: https://static.addtoany.com/menu/sm.23.html
Frame ID: CF441ED7FBF41CFD68829CAA9A128BF7
Requests: 1 HTTP requests in this frame

Frame: https://www2.mandiant.com/index.php/form/XDFrame
Frame ID: F9AE29528F02000CCD8012B08296F6BB
Requests: 2 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LdhgBgUAAAAAILakhHCM8iL5pygGB4jLnJbJFfq&co=aHR0cHM6Ly93d3cubWFuZGlhbnQuY29tOjQ0Mw..&hl=de&v=duyHVVR9Brf6N2GewjkPRfsA&size=normal&cb=r26u3lmkmztr
Frame ID: 0D4749CA0843B189AFFBF54B4CB412F7
Requests: 1 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LdhgBgUAAAAAILakhHCM8iL5pygGB4jLnJbJFfq&co=aHR0cHM6Ly93d3cubWFuZGlhbnQuY29tOjQ0Mw..&hl=de&v=duyHVVR9Brf6N2GewjkPRfsA&size=compact&cb=dlf6ccdnmjv
Frame ID: 2C8869318FC67185FE61E146ED0EEF72
Requests: 1 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LdhgBgUAAAAAILakhHCM8iL5pygGB4jLnJbJFfq&co=aHR0cHM6Ly93d3cubWFuZGlhbnQuY29tOjQ0Mw..&hl=de&v=duyHVVR9Brf6N2GewjkPRfsA&size=normal&cb=r26u3lmkmztr
Frame ID: E44B123C92BA0D5B2DD2FC4FA8DE2DB3
Requests: 8 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LdhgBgUAAAAAILakhHCM8iL5pygGB4jLnJbJFfq&co=aHR0cHM6Ly93d3cubWFuZGlhbnQuY29tOjQ0Mw..&hl=de&v=duyHVVR9Brf6N2GewjkPRfsA&size=compact&cb=dlf6ccdnmjv
Frame ID: 048998F26B374B9DFBD00C0766279654
Requests: 4 HTTP requests in this frame

Frame: https://fonts.googleapis.com/css2?family=Lato
Frame ID: 4B29EA6F3CA1DD70A03DA2634F16F39C
Requests: 3 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/bframe?hl=de&v=duyHVVR9Brf6N2GewjkPRfsA&k=6LdhgBgUAAAAAILakhHCM8iL5pygGB4jLnJbJFfq
Frame ID: 8F689083DC1108238B00858AF97330AC
Requests: 3 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/bframe?hl=de&v=duyHVVR9Brf6N2GewjkPRfsA&k=6LdhgBgUAAAAAILakhHCM8iL5pygGB4jLnJbJFfq
Frame ID: 5A785EB59F1B805A54426331C2718D88
Requests: 3 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Remediation and Hardening Strategies for Microsoft 365 to Defend Against APT29 (v1.3) | MandiantBack ButtonSearch IconFilter Icon

Page URL History Show full URLs

https://pages.mandiant.com/NTY1LVBFSS05NTIAAAGGvNlzn-wDYZs6D7NBs3dT3fhZh_68-ftf8G9A8b8WRKCql9C8QKz2aWa1... Page URL
https://www.mandiant.com/resources/remediation-and-hardening-strategies-microsoft-365-defend-against-... Page URL

Detected technologies

AddToAny (Widgets) Expand

Overall confidence: 100%
Detected patterns

addtoany\.com/menu/page\.js

Amplitude (Analytics) Expand

Overall confidence: 100%
Detected patterns

cdn\.amplitude\.com

Font Awesome (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

google-analytics\.com/(?:ga|urchin|analytics)\.js

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtm\.js
googletagmanager\.com/gtag/js

OneTrust (Cookie compliance) Expand

Overall confidence: 100%
Detected patterns

cdn\.cookielaw\.org
otSDKStub\.js

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

jsDelivr (CDN) Expand

Overall confidence: 100%
Detected patterns

//cdn\.jsdelivr\.net/

reCAPTCHA (Captchas) Expand

Overall confidence: 100%
Detected patterns

/recaptcha/api\.js

Page Statistics

96
Requests

98 %
HTTPS

63 %
IPv6

16
Domains

24
Subdomains

25
IPs

4
Countries

2752 kB
Transfer

6440 kB
Size

11
Cookies

16 Outgoing links

These are links going to different origins than the main page.

URL: https://investors.mandiant.com/home/default.aspx
Title: Investor Relations Financial and shareholder information

Search URL Search Domain Scan URL

URL: https://login.mandiant.com/
Title: Sign in to Advantage

Search URL Search Domain Scan URL

URL: https://www.mandiant.fr/
Title: Français

Search URL Search Domain Scan URL

URL: https://www.mandiant.de/
Title: Deutsch

Search URL Search Domain Scan URL

URL: https://www.mandiant.jp/
Title: 日本

Search URL Search Domain Scan URL

URL: https://www.mandiant.kr/
Title: 한국어

Search URL Search Domain Scan URL

URL: https://www.mandiant.es/
Title: Español

Search URL Search Domain Scan URL

URL: https://www.mandiant.it/
Title: Italian

Search URL Search Domain Scan URL

URL: https://investors.mandiant.com/
Title: Investor Relations

Search URL Search Domain Scan URL

URL: https://www.facebook.com/Mandiant

Search URL Search Domain Scan URL

URL: https://twitter.com/Mandiant

Search URL Search Domain Scan URL

URL: https://www.youtube.com/channel/UCexu0DP7VKdDByusuTA53FQ

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/company/mandiant/

Search URL Search Domain Scan URL

URL: https://partners.fireeye.com/English/
Title: Partner Portal

Search URL Search Domain Scan URL

URL: https://cookiepedia.co.uk/giving-consent-to-cookies
Title: More information

Search URL Search Domain Scan URL

URL: https://www.onetrust.com/products/cookie-consent/

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://pages.mandiant.com/NTY1LVBFSS05NTIAAAGGvNlzn-wDYZs6D7NBs3dT3fhZh_68-ftf8G9A8b8WRKCql9C8QKz2aWa1rbstQV9P__WJVcU= Page URL
https://www.mandiant.com/resources/remediation-and-hardening-strategies-microsoft-365-defend-against-apt29-v13?utm_source=newsletter&utm_medium=email&utm_campaign=threat_intelligence&utm_content=all&utm_term=en&cid=global&mkt_tok=NTY1LVBFSS05NTIAAAGGvNlzn0jgaUADPeckarP9ryGyW8FymW2g6eWg1XVwVBbl60tKrgiSQKdwVqQqaI8C0VvT1IsNg0j0L-kqO_ozuVvIL8ODVs6b40IVTjo Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

96 HTTP transactions
4 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 302 NTY1LVBFSS05NTIAAAGGvNlzn-wDYZs6D7NBs3dT3fhZh_68-ftf8G9A8b8WRKCql9C8QKz2aWa1rbstQV9P__WJVcU=
pages.mandiant.com/ 706 B
1 KB 352ms
225ms Document
text/html 104.17.74.206
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://pages.mandiant.com/NTY1LVBFSS05NTIAAAGGvNlzn-wDYZs6D7NBs3dT3fhZh_68-ftf8G9A8b8WRKCql9C8QKz2aWa1rbstQV9P__WJVcU=

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

104.17.74.206 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	default-src 'self'; img-src 'self';script-src 'self' 'sha256-CdkPGEVo0YuFk6HnE42qVWK5LhR59a6Ncz8XHGLzVbQ=';object-src 'none';form-action:'none';frame-src:'none'
X-Frame-Options	SAMEORIGIN

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: private, no-cache, no-store, max-age=0
cf-cache-status: DYNAMIC
cf-ray: 747919659cf9928f-FRA
content-security-policy: default-src 'self'; img-src 'self';script-src 'self' 'sha256-CdkPGEVo0YuFk6HnE42qVWK5LhR59a6Ncz8XHGLzVbQ=';object-src 'none';form-action:'none';frame-src:'none'
content-type: text/html;charset=UTF-8
date: Thu, 08 Sep 2022 16:35:46 GMT
referrer-policy: strict-origin
server: cloudflare
x-frame-options: SAMEORIGIN
x-request-id: 847d8a76873a57b2

GET
H2 200 Primary Request remediation-and-hardening-strategies-microsoft-365-defend-against-apt29-v13 Show response
www.mandiant.com/resources/ 118 KB
25 KB 900ms
854ms Document
text/html 2606:4700:300b::a29f:f17d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.mandiant.com/resources/remediation-and-hardening-strategies-microsoft-365-defend-against-apt29-v13?utm_source=newsletter&utm_medium=email&utm_campaign=threat_intelligence&utm_content=all&utm_term=en&cid=global&mkt_tok=NTY1LVBFSS05NTIAAAGGvNlzn0jgaUADPeckarP9ryGyW8FymW2g6eWg1XVwVBbl60tKrgiSQKdwVqQqaI8C0VvT1IsNg0j0L-kqO_ozuVvIL8ODVs6b40IVTjo

Requested by

Host: pages.mandiant.com
URL: https://pages.mandiant.com/NTY1LVBFSS05NTIAAAGGvNlzn-wDYZs6D7NBs3dT3fhZh_68-ftf8G9A8b8WRKCql9C8QKz2aWa1rbstQV9P__WJVcU=

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:300b::a29f:f17d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

81aef51db61703a8c1679c5ace0b7858b463b1b8554935df6efc4e631a98eaeb

Security Headers

Name	Value
Content-Security-Policy	report-uri /report-csp-violation
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://pages.mandiant.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 0
cache-control: max-age=2764800, public, stale-if-error=3600, stale-while-revalidate=3600
cf-cache-status: DYNAMIC
cf-ray: 747919675b839c0c-FRA
content-encoding: gzip
content-language: en
content-security-policy: report-uri /report-csp-violation
content-type: text/html; charset=UTF-8
date: Thu, 08 Sep 2022 16:35:47 GMT
etag: "1662654946"
expect-ct: max-age=86400
expires: Sun, 19 Nov 1978 05:00:00 GMT
last-modified: Thu, 08 Sep 2022 16:35:46 GMT
permissions-policy: interest-cohort=()
referrer-policy: strict-origin
server: cloudflare
strict-transport-security: max-age=31536000; includeSubDomains; preload
surrogate-control: max-age=86400
vary: Cookie,Accept-Encoding
via: varnish
x-ah-environment: prod
x-cache: MISS
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-request-id: v-4a6cf550-2f94-11ed-b52f-170edc9fbfc6
x-ua-compatible: IE=edge
x-xss-protection: 1; mode=block

GET
H2 200 google_tag.script.js Show response
www.mandiant.com/sites/default/files/google_tag/google_tag_manager/ 348 B
426 B 78ms
75ms Script
application/javascript 2606:4700:300b::a29f:f17d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.mandiant.com/sites/default/files/google_tag/google_tag_manager/google_tag.script.js?rhvyfu

Requested by

Host: www.mandiant.com
URL: https://www.mandiant.com/resources/remediation-and-hardening-strategies-microsoft-365-defend-against-apt29-v13?utm_source=newsletter&utm_medium=email&utm_campaign=threat_intelligence&utm_content=all&utm_term=en&cid=global&mkt_tok=NTY1LVBFSS05NTIAAAGGvNlzn0jgaUADPeckarP9ryGyW8FymW2g6eWg1XVwVBbl60tKrgiSQKdwVqQqaI8C0VvT1IsNg0j0L-kqO_ozuVvIL8ODVs6b40IVTjo

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:300b::a29f:f17d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7b7eb2b28fbf8ad29058540ee28e8b49701e0e47351ff25d3b688fcef9b2a88a

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.mandiant.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Thu, 08 Sep 2022 16:35:47 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
age: 23610
x-cache: HIT
x-cache-hits: 30
x-ah-environment: prod
content-length: 280
x-request-id: v-075be6f4-2f5d-11ed-b28a-f73e09848771
last-modified: Thu, 08 Sep 2022 09:59:59 GMT
server: cloudflare
vary: Accept-Encoding
content-type: application/javascript
via: varnish
cache-control: public, max-age=1209600
accept-ranges: bytes
cf-ray: 7479196d9e8b9c0c-FRA
expires: Thu, 22 Sep 2022 16:35:47 GMT

GET
H2 200 css_AMa9Ay_2VJp74A1R3f42zIWSZRJHTuHZnzLrg5DliQo.css
www.mandiant.com/sites/default/files/css/ 11 KB
3 KB 62ms
59ms Stylesheet
text/css 2606:4700:300b::a29f:f17d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.mandiant.com/sites/default/files/css/css_AMa9Ay_2VJp74A1R3f42zIWSZRJHTuHZnzLrg5DliQo.css

Requested by

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:300b::a29f:f17d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

00c6bd032ff6549a7be00d51ddfe36cc85926512474ee1d99f32eb8390e5890a

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.mandiant.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Thu, 08 Sep 2022 16:35:47 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
age: 1148306
x-cache: HIT
x-cache-hits: 25
x-ah-environment: prod
content-length: 2869
x-request-id: v-e5dfa974-23dc-11ed-99e9-035dc976d046
last-modified: Mon, 15 Aug 2022 16:05:44 GMT
server: cloudflare
vary: Accept-Encoding
content-type: text/css
via: varnish
cache-control: public, max-age=1209600
accept-ranges: bytes
cf-ray: 7479196d9e979c0c-FRA
expires: Thu, 22 Sep 2022 16:35:47 GMT

GET
H2 200 font-awesome.min.css
cdnjs.cloudflare.com/ajax/libs/font-awesome/4.3.0/css/ 23 KB
5 KB 37ms
16ms Stylesheet
text/css 2606:4700::6811:190e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/font-awesome/4.3.0/css/font-awesome.min.css

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:190e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

541ac58217a8ade1a5e292a65a0661dc9db7a49ae13654943817a4fbc6761afd

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.mandiant.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Thu, 08 Sep 2022 16:35:47 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 9232235
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 4364
timing-allow-origin: *
last-modified: Mon, 04 May 2020 16:10:07 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb03e5f-5cbb"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15780000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=NmCkX7RYFC0y4Gi18prUMSY70p%2BPjyiYSKWa2TgTqGanq8iRceyNZ6hVReeEqCYhloZDg1yGSoGb%2Ft2ls7I33rAF65wJmcvDmdB00Kqdb1oai54D7k0%2FQZK%2BIRY2HHNLq5opCgrfl%2F1EbQj%2Fd2d3LgrT"}],"group":"cf-nel","max_age":604800}
content-type: text/css; charset=utf-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=30672000
accept-ranges: bytes
cf-ray: 7479196dbfbc6910-FRA
expires: Tue, 29 Aug 2023 16:35:47 GMT

GET
H2 200 css_GAicnP3bYJUEFa6ZPlbx0Cf9Uz7etRie94Rc-zPmnxI.css
www.mandiant.com/sites/default/files/css/ 143 KB
21 KB 78ms
76ms Stylesheet
text/css 2606:4700:300b::a29f:f17d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.mandiant.com/sites/default/files/css/css_GAicnP3bYJUEFa6ZPlbx0Cf9Uz7etRie94Rc-zPmnxI.css

Requested by

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:300b::a29f:f17d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

18089c9cfddb60950415ae993e56f1d027fd533edeb5189ef7845cfb33e69f12

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.mandiant.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Thu, 08 Sep 2022 16:35:47 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
age: 34160
x-cache: HIT
x-cache-hits: 24
x-ah-environment: prod
content-length: 21738
x-request-id: v-2ec0fd92-23dc-11ed-9c32-1399e56c1307
last-modified: Mon, 22 Aug 2022 09:29:18 GMT
server: cloudflare
vary: Accept-Encoding
content-type: text/css
via: varnish
cache-control: public, max-age=1209600
accept-ranges: bytes
cf-ray: 7479196d9e9a9c0c-FRA
expires: Thu, 22 Sep 2022 16:35:47 GMT

GET
H2 200 css_an_ivdO65UWTk2OlEaxarp82vfi_hLA8AdfPyAitrQs.css
www.mandiant.com/sites/default/files/css/ 410 KB
46 KB 48ms
45ms Stylesheet
text/css 2606:4700:300b::a29f:f17d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.mandiant.com/sites/default/files/css/css_an_ivdO65UWTk2OlEaxarp82vfi_hLA8AdfPyAitrQs.css

Requested by

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:300b::a29f:f17d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6a7fe2bdd3bae545939363a511ac5aae9f36bdf8bf84b03c01d7cfc808adad0b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.mandiant.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Thu, 08 Sep 2022 16:35:47 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
age: 531871
x-cache: HIT
x-cache-hits: 22
x-ah-environment: prod
content-length: 47135
x-request-id: v-b0f3cbc2-2abd-11ed-9523-6bdc33b8d0d2
last-modified: Fri, 02 Sep 2022 12:49:31 GMT
server: cloudflare
vary: Accept-Encoding
content-type: text/css
via: varnish
cache-control: public, max-age=1209600
accept-ranges: bytes
cf-ray: 7479196d9e9e9c0c-FRA
expires: Thu, 22 Sep 2022 16:35:47 GMT

GET
H2 200 otSDKStub.js Show response
cdn.cookielaw.org/scripttemplates/ 21 KB
8 KB 39ms
18ms Script
application/javascript 2606:4700::6810:9440
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/otSDKStub.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:9440 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

bbc4456bca95006683a8f081d0d2ed645eef5b14c62eca12c70f7e1cec26c1a0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.mandiant.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Thu, 08 Sep 2022 16:35:47 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
content-md5: 7BKk7WQU1Z9EDMZmf1T6Vg==
age: 10000
vary: Accept-Encoding
content-length: 7151
x-ms-lease-status: unlocked
last-modified: Thu, 08 Sep 2022 06:34:46 GMT
server: cloudflare
etag: 0x8DA916439418414
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/javascript
access-control-allow-origin: *
x-ms-request-id: e946677d-f01e-000c-4151-c33617000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: max-age=14400
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 7479196dbcd66967-FRA

GET
H2 200 forms2.min.js Show response
www2.mandiant.com/js/forms2/js/ 208 KB
69 KB 279ms
17ms Script
application/x-javascript 104.17.73.206
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www2.mandiant.com/js/forms2/js/forms2.min.js

Requested by

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

104.17.73.206 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b3fb9332b030dc33a418be1bcd7282c9052c287fb923bd36295cb3d01db9a861

Security Headers

Name	Value
Strict-Transport-Security	max-age=63113904
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.mandiant.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Thu, 08 Sep 2022 16:35:47 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
last-modified: Sat, 27 Aug 2022 03:51:24 GMT
server: cloudflare
age: 3477
etag: "2d603a0-33e56-5e730f1cff1e9"
strict-transport-security: max-age=63113904
content-type: application/x-javascript; charset=utf-8
cache-control: public, max-age=14400
cf-ray: 7479196f3d719164-FRA
vary: Accept-Encoding
expires: Thu, 08 Sep 2022 20:35:47 GMT

GET
H/1.1 200
OK ff-3.min.js Show response
cdn-0.d41.co/tags/ 271 KB
271 KB 79ms
23ms Script
application/javascript 99.86.240.68
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn-0.d41.co/tags/ff-3.min.js
Requested by: Host: www.mandiant.com
URL: https://www.mandiant.com/resources/remediation-and-hardening-strategies-microsoft-365-defend-against-apt29-v13?utm_source=newsletter&utm_medium=email&utm_campaign=threat_intelligence&utm_content=all&utm_term=en&cid=global&mkt_tok=NTY1LVBFSS05NTIAAAGGvNlzn0jgaUADPeckarP9ryGyW8FymW2g6eWg1XVwVBbl60tKrgiSQKdwVqQqaI8C0VvT1IsNg0j0L-kqO_ozuVvIL8ODVs6b40IVTjo
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.240.68 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-240-68.vie50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: e7bab450e59999517ef38a5b8bb176f3ca0c89126090906e3ab4f5da945a5f59

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.mandiant.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

Date: Thu, 08 Sep 2022 16:34:18 GMT
Via: 1.1 a01b7aca64c6d4b437b814f64422d6c8.cloudfront.net (CloudFront)
Last-Modified: Tue, 19 Jul 2022 15:03:58 GMT
Server: AmazonS3
Age: 105
ETag: "16b84a831f04e0e0110f159196edd36c"
X-Cache: Hit from cloudfront
Content-Type: application/javascript
Connection: keep-alive
X-Amz-Cf-Pop: VIE50-C1
Accept-Ranges: bytes
Content-Length: 277054
X-Amz-Cf-Id: GwwsjEs-9CiJAU1LaIWnV27YJ7TdonjiTPBP4NupKVoSI8k7xIem3A==

GET
H2 200 js_XBcwvZgni4Dy492wJEdbHHCn_qVkg5CqNNIp9ePdPqk.js Show response
www.mandiant.com/sites/default/files/js/ 102 KB
35 KB 54ms
52ms Script
text/javascript 2606:4700:300b::a29f:f17d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.mandiant.com/sites/default/files/js/js_XBcwvZgni4Dy492wJEdbHHCn_qVkg5CqNNIp9ePdPqk.js

Requested by

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:300b::a29f:f17d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5c1730bd98278b80f2e3ddb024475b1c70a7fea5648390aa34d229f5e3dd3ea9

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.mandiant.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Thu, 08 Sep 2022 16:35:47 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
age: 1154064
x-cache: HIT
x-cache-hits: 18
x-ah-environment: prod
content-length: 35296
x-request-id: v-53bd08ec-0f10-11ed-ae60-b375e4569778
last-modified: Fri, 29 Jul 2022 07:30:19 GMT
server: cloudflare
vary: Accept-Encoding
content-type: text/javascript
via: varnish
cache-control: public, max-age=1209600
accept-ranges: bytes
cf-ray: 7479196d9ea39c0c-FRA
expires: Thu, 22 Sep 2022 16:35:47 GMT

GET
H2 200 api.js Show response
www.google.com/recaptcha/ 910 B
995 B 71ms
24ms Script
text/javascript 2a00:1450:4001:80f::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api.js?onload=CaptchaCallback&render=explicit

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

b07cb957eaf8435eda0630d67e6dbe47848e292ef839465a63b7e6ab792834b9

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.mandiant.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Thu, 08 Sep 2022 16:35:47 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: GSE
x-frame-options: SAMEORIGIN
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=300
cross-origin-resource-policy: cross-origin
content-security-policy: frame-ancestors 'self'
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 582
x-xss-protection: 1; mode=block
expires: Thu, 08 Sep 2022 16:35:47 GMT

GET
H2 200 page.js Show response
static.addtoany.com/menu/ 3 KB
2 KB 54ms
20ms Script
application/javascript 2606:4700:10::ac43:2794
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://static.addtoany.com/menu/page.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::ac43:2794 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b964f75cb8c613e484743bf4daaac6efc65c74156fca95cd76ca15d742555d1d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.mandiant.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Thu, 08 Sep 2022 16:35:47 GMT
via: e4s
x-content-type-options: nosniff
cf-cache-status: HIT
age: 142732
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Sat, 03 Sep 2022 00:56:47 GMT
server: cloudflare
etag: W/"ba7-5e7bb5238fa5f"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=172800
cf-ray: 7479196e5cd29a3b-FRA
cf-bgj: minify

GET
H2 200 js_Rivtu_17dHyti4SnnaehZXqwd_N-Jmxmo_YA5Kl-bMM.js Show response
www.mandiant.com/sites/default/files/js/ 223 KB
68 KB 65ms
64ms Script
text/javascript 2606:4700:300b::a29f:f17d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.mandiant.com/sites/default/files/js/js_Rivtu_17dHyti4SnnaehZXqwd_N-Jmxmo_YA5Kl-bMM.js

Requested by

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:300b::a29f:f17d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

462bedbbfd7b747cad8b84a79da7a1657ab077f37e266c66a3f600e4a97e6cc3

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.mandiant.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Thu, 08 Sep 2022 16:35:47 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
age: 537672
x-cache: HIT
x-cache-hits: 26
x-ah-environment: prod
content-length: 69074
x-request-id: v-d7ff91e2-1faf-11ed-8fd8-b7cb51e715dc
last-modified: Fri, 19 Aug 2022 11:12:39 GMT
server: cloudflare
vary: Accept-Encoding
content-type: text/javascript
via: varnish
cache-control: public, max-age=1209600
accept-ranges: bytes
cf-ray: 7479196d9ea89c0c-FRA
expires: Thu, 22 Sep 2022 16:35:47 GMT

GET
H2 200 fontloader.built.js Show response
www.mandiant.com/themes/custom/mandiant_theme/gnorm/build/scripts/ 7 KB
2 KB 43ms
43ms Script
application/javascript 2606:4700:300b::a29f:f17d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.mandiant.com/themes/custom/mandiant_theme/gnorm/build/scripts/fontloader.built.js

Requested by

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:300b::a29f:f17d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0b617a1a9d405a304eae1f3337639a1be619633a047ccac0a61d70cf2d2032e4

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.mandiant.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Thu, 08 Sep 2022 16:35:47 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
age: 867940
x-cache: HIT
x-cache-hits: 60
x-ah-environment: prod
content-length: 2334
x-request-id: v-f91bd6ba-9fe9-11ec-9201-fbace669d786
last-modified: Wed, 09 Mar 2022 18:16:48 GMT
server: cloudflare
vary: Accept-Encoding
content-type: application/javascript
via: varnish
cache-control: public, max-age=1209600
accept-ranges: bytes
cf-ray: 7479196e2fde9c0c-FRA
expires: Thu, 22 Sep 2022 16:35:47 GMT

GET
H2 200 d5aa2996-6b9f-48a7-8d3d-c0b1aec63c6d.json Show response
cdn.cookielaw.org/consent/d5aa2996-6b9f-48a7-8d3d-c0b1aec63c6d/ 4 KB
2 KB 32ms
16ms XHR
application/x-javascript 2606:4700::6810:9440
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/consent/d5aa2996-6b9f-48a7-8d3d-c0b1aec63c6d/d5aa2996-6b9f-48a7-8d3d-c0b1aec63c6d.json

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:9440 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2cde386ff9fa8a2542805e34ca86981ae2891d3db7b20955179309c4b0488c98

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.mandiant.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Thu, 08 Sep 2022 16:35:47 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
content-md5: kKV+3HkwgMF12vkrCRTuhQ==
age: 11777
vary: Accept-Encoding
content-length: 1653
x-ms-lease-status: unlocked
last-modified: Wed, 24 Aug 2022 17:44:56 GMT
server: cloudflare
etag: 0x8DA85F85BE6FC83
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/x-javascript
access-control-allow-origin: *
x-ms-request-id: c9ad4154-e01e-0031-23f3-b78331000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=14400
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 7479196e38c56910-FRA
expires: Thu, 08 Sep 2022 20:35:47 GMT

GET
H2 200 menu-drop-down.svg
www.mandiant.com/themes/custom/mandiant_theme/gnorm/build/images/ 207 B
286 B 51ms
51ms Image
image/svg+xml 2606:4700:300b::a29f:f17d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.mandiant.com/themes/custom/mandiant_theme/gnorm/build/images/menu-drop-down.svg

Requested by

Host: www.mandiant.com
URL: https://www.mandiant.com/sites/default/files/css/css_an_ivdO65UWTk2OlEaxarp82vfi_hLA8AdfPyAitrQs.css

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:300b::a29f:f17d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3c4f02f1f6a5e491336064c0d0bdcd6914d5794a431a359c1f684cec8ed77f7

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.mandiant.com/sites/default/files/css/css_an_ivdO65UWTk2OlEaxarp82vfi_hLA8AdfPyAitrQs.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Thu, 08 Sep 2022 16:35:47 GMT
via: varnish
x-content-type-options: nosniff
cf-cache-status: HIT
age: 851860
x-cache: HIT
x-cache-hits: 2
x-ah-environment: prod
content-encoding: gzip
x-request-id: v-dc097da2-b9ca-11ec-9324-d7c8a02897d4
last-modified: Mon, 11 Apr 2022 19:08:38 GMT
server: cloudflare
vary: Accept-Encoding
content-type: image/svg+xml
cache-control: public, max-age=1209600
cf-ray: 7479196e48159c0c-FRA
expires: Thu, 22 Sep 2022 16:35:47 GMT

GET
H2 200 see-what.svg
www.mandiant.com/themes/custom/mandiant_theme/gnorm/build/images/ 740 B
558 B 52ms
50ms Image
image/svg+xml 2606:4700:300b::a29f:f17d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.mandiant.com/themes/custom/mandiant_theme/gnorm/build/images/see-what.svg

Requested by

Host: www.mandiant.com
URL: https://www.mandiant.com/sites/default/files/css/css_an_ivdO65UWTk2OlEaxarp82vfi_hLA8AdfPyAitrQs.css

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:300b::a29f:f17d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

22d544d04a6282b544aa3fbc8e024e41f00902673fe34f774092c02d4e7d6712

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.mandiant.com/sites/default/files/css/css_an_ivdO65UWTk2OlEaxarp82vfi_hLA8AdfPyAitrQs.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Thu, 08 Sep 2022 16:35:47 GMT
via: varnish
x-content-type-options: nosniff
cf-cache-status: HIT
age: 846443
x-cache: HIT
x-cache-hits: 17
x-ah-environment: prod
content-encoding: gzip
x-request-id: v-2c406f2e-b9cb-11ec-9f58-2ff3b2a3ba46
last-modified: Mon, 11 Apr 2022 19:08:38 GMT
server: cloudflare
vary: Accept-Encoding
content-type: image/svg+xml
cache-control: public, max-age=1209600
cf-ray: 7479196e58259c0c-FRA
expires: Thu, 22 Sep 2022 16:35:47 GMT

GET
H2 200 incident-response.svg
www.mandiant.com/themes/custom/mandiant_theme/gnorm/build/images/ 777 B
513 B 62ms
59ms Image
image/svg+xml 2606:4700:300b::a29f:f17d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.mandiant.com/themes/custom/mandiant_theme/gnorm/build/images/incident-response.svg

Requested by

Host: www.mandiant.com
URL: https://www.mandiant.com/sites/default/files/css/css_an_ivdO65UWTk2OlEaxarp82vfi_hLA8AdfPyAitrQs.css

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:300b::a29f:f17d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

860f45e645e33a50a9a34186d5c0558df4198829fe98679a4a6e1e754fca1aeb

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.mandiant.com/sites/default/files/css/css_an_ivdO65UWTk2OlEaxarp82vfi_hLA8AdfPyAitrQs.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Thu, 08 Sep 2022 16:35:47 GMT
via: varnish
x-content-type-options: nosniff
cf-cache-status: HIT
age: 846443
x-cache: HIT
x-cache-hits: 53
x-ah-environment: prod
content-encoding: gzip
x-request-id: v-d1d8292a-bd9c-11ec-a5b4-9b21e0468049
last-modified: Mon, 11 Apr 2022 19:08:38 GMT
server: cloudflare
vary: Accept-Encoding
content-type: image/svg+xml
cache-control: public, max-age=1209600
cf-ray: 7479196e582e9c0c-FRA
expires: Thu, 22 Sep 2022 16:35:47 GMT

GET
H2 200 incident.svg
www.mandiant.com/themes/custom/mandiant_theme/gnorm/build/images/ 1023 B
594 B 66ms
63ms Image
image/svg+xml 2606:4700:300b::a29f:f17d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.mandiant.com/themes/custom/mandiant_theme/gnorm/build/images/incident.svg

Requested by

Host: www.mandiant.com
URL: https://www.mandiant.com/sites/default/files/css/css_an_ivdO65UWTk2OlEaxarp82vfi_hLA8AdfPyAitrQs.css

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:300b::a29f:f17d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0d1049d86e454e70f1d3e650f3ec7dc009ebef2f7ec2e9f44b74cb290ed9e4d6

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.mandiant.com/sites/default/files/css/css_an_ivdO65UWTk2OlEaxarp82vfi_hLA8AdfPyAitrQs.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Thu, 08 Sep 2022 16:35:47 GMT
via: varnish
x-content-type-options: nosniff
cf-cache-status: HIT
age: 741643
x-cache: HIT
x-cache-hits: 31
x-ah-environment: prod
content-encoding: gzip
x-request-id: v-8700fb64-9409-11ec-865b-874f1a2e648b
last-modified: Thu, 03 Feb 2022 17:26:36 GMT
server: cloudflare
vary: Accept-Encoding
content-type: image/svg+xml
cache-control: public, max-age=1209600
cf-ray: 7479196e58449c0c-FRA
expires: Thu, 22 Sep 2022 16:35:47 GMT

GET
H2 200 contact-sales.svg
www.mandiant.com/themes/custom/mandiant_theme/gnorm/build/images/ 613 B
477 B 60ms
57ms Image
image/svg+xml 2606:4700:300b::a29f:f17d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.mandiant.com/themes/custom/mandiant_theme/gnorm/build/images/contact-sales.svg

Requested by

Host: www.mandiant.com
URL: https://www.mandiant.com/sites/default/files/css/css_an_ivdO65UWTk2OlEaxarp82vfi_hLA8AdfPyAitrQs.css

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:300b::a29f:f17d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

887dea1b760d630afcbae650e3259dc18ef1a7fe3137ab715a56005a69f921b0

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.mandiant.com/sites/default/files/css/css_an_ivdO65UWTk2OlEaxarp82vfi_hLA8AdfPyAitrQs.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Thu, 08 Sep 2022 16:35:47 GMT
via: varnish
x-content-type-options: nosniff
cf-cache-status: HIT
age: 846443
x-cache: HIT
x-cache-hits: 60
x-ah-environment: prod
content-encoding: gzip
x-request-id: v-d1d4f7b4-bd9c-11ec-bfbb-1b89a9c65fe6
last-modified: Mon, 11 Apr 2022 19:08:38 GMT
server: cloudflare
vary: Accept-Encoding
content-type: image/svg+xml
cache-control: public, max-age=1209600
cf-ray: 7479196e58479c0c-FRA
expires: Thu, 22 Sep 2022 16:35:47 GMT

GET
H2 200 contact.svg
www.mandiant.com/themes/custom/mandiant_theme/gnorm/build/images/ 716 B
579 B 49ms
47ms Image
image/svg+xml 2606:4700:300b::a29f:f17d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.mandiant.com/themes/custom/mandiant_theme/gnorm/build/images/contact.svg

Requested by

Host: www.mandiant.com
URL: https://www.mandiant.com/sites/default/files/css/css_an_ivdO65UWTk2OlEaxarp82vfi_hLA8AdfPyAitrQs.css

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:300b::a29f:f17d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

9ca72eec4efadc4587d29f2216ccd9cd54309463c74a5a3029b3dca9485f995a

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.mandiant.com/sites/default/files/css/css_an_ivdO65UWTk2OlEaxarp82vfi_hLA8AdfPyAitrQs.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Thu, 08 Sep 2022 16:35:47 GMT
via: varnish
x-content-type-options: nosniff
cf-cache-status: HIT
age: 866523
x-cache: HIT
x-cache-hits: 21
x-ah-environment: prod
content-encoding: gzip
x-request-id: v-870927da-9409-11ec-9507-c3cc6aed761f
last-modified: Thu, 03 Feb 2022 17:26:36 GMT
server: cloudflare
vary: Accept-Encoding
content-type: image/svg+xml
cache-control: public, max-age=1209600
cf-ray: 7479196e58499c0c-FRA
expires: Thu, 22 Sep 2022 16:35:47 GMT

GET
H2 200 support.svg
www.mandiant.com/themes/custom/mandiant_theme/gnorm/build/images/ 4 KB
2 KB 72ms
70ms Image
image/svg+xml 2606:4700:300b::a29f:f17d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.mandiant.com/themes/custom/mandiant_theme/gnorm/build/images/support.svg

Requested by

Host: www.mandiant.com
URL: https://www.mandiant.com/sites/default/files/css/css_an_ivdO65UWTk2OlEaxarp82vfi_hLA8AdfPyAitrQs.css

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:300b::a29f:f17d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c82aa23b61483cc87f28ec6c4492a28c46dcb38bf471fd4a6ca40984ee6fb59e

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.mandiant.com/sites/default/files/css/css_an_ivdO65UWTk2OlEaxarp82vfi_hLA8AdfPyAitrQs.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Thu, 08 Sep 2022 16:35:47 GMT
via: varnish
x-content-type-options: nosniff
cf-cache-status: HIT
age: 788049
x-cache: HIT
x-cache-hits: 18
x-ah-environment: prod
content-encoding: gzip
x-request-id: v-88d4dd10-ab16-11ec-bd0b-a7b3143f3bef
last-modified: Thu, 03 Feb 2022 17:26:36 GMT
server: cloudflare
vary: Accept-Encoding
content-type: image/svg+xml
cache-control: public, max-age=1209600
cf-ray: 7479196e584b9c0c-FRA
expires: Thu, 22 Sep 2022 16:35:47 GMT

GET
H2 200 sign-in.svg
www.mandiant.com/themes/custom/mandiant_theme/gnorm/build/images/ 630 B
425 B 50ms
48ms Image
image/svg+xml 2606:4700:300b::a29f:f17d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.mandiant.com/themes/custom/mandiant_theme/gnorm/build/images/sign-in.svg

Requested by

Host: www.mandiant.com
URL: https://www.mandiant.com/sites/default/files/css/css_an_ivdO65UWTk2OlEaxarp82vfi_hLA8AdfPyAitrQs.css

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:300b::a29f:f17d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

bf204863b72594d7da599f0ad2cfb43573b91d2ef348983d8890f64ba9858d1e

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.mandiant.com/sites/default/files/css/css_an_ivdO65UWTk2OlEaxarp82vfi_hLA8AdfPyAitrQs.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Thu, 08 Sep 2022 16:35:47 GMT
via: varnish
x-content-type-options: nosniff
cf-cache-status: HIT
age: 846443
x-cache: HIT
x-cache-hits: 36
x-ah-environment: prod
content-encoding: gzip
x-request-id: v-62382e52-ed54-11ec-b0b1-c3059b790828
last-modified: Mon, 11 Apr 2022 19:08:38 GMT
server: cloudflare
vary: Accept-Encoding
content-type: image/svg+xml
cache-control: public, max-age=1209600
cf-ray: 7479196e584e9c0c-FRA
expires: Thu, 22 Sep 2022 16:35:47 GMT

GET
H2 200 menu-arrow-white.svg
www.mandiant.com/themes/custom/mandiant_theme/gnorm/build/images/ 752 B
531 B 42ms
40ms Image
image/svg+xml 2606:4700:300b::a29f:f17d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.mandiant.com/themes/custom/mandiant_theme/gnorm/build/images/menu-arrow-white.svg

Requested by

Host: www.mandiant.com
URL: https://www.mandiant.com/sites/default/files/css/css_an_ivdO65UWTk2OlEaxarp82vfi_hLA8AdfPyAitrQs.css

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:300b::a29f:f17d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

9f41b6056bfd2eb59371fabdc40b3970f02458ee463aa92385fe214fb00aebae

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.mandiant.com/sites/default/files/css/css_an_ivdO65UWTk2OlEaxarp82vfi_hLA8AdfPyAitrQs.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Thu, 08 Sep 2022 16:35:47 GMT
via: varnish
x-content-type-options: nosniff
cf-cache-status: HIT
age: 851859
x-cache: HIT
x-cache-hits: 35
x-ah-environment: prod
content-encoding: gzip
x-request-id: v-d1d67b8e-bd9c-11ec-bf09-ef036d0ca4b7
last-modified: Mon, 11 Apr 2022 19:08:38 GMT
server: cloudflare
vary: Accept-Encoding
content-type: image/svg+xml
cache-control: public, max-age=1209600
cf-ray: 7479196e584f9c0c-FRA
expires: Thu, 22 Sep 2022 16:35:47 GMT

GET
H2 200 advantage-arrow.svg
www.mandiant.com/themes/custom/mandiant_theme/gnorm/build/images/ 203 B
295 B 59ms
58ms Image
image/svg+xml 2606:4700:300b::a29f:f17d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.mandiant.com/themes/custom/mandiant_theme/gnorm/build/images/advantage-arrow.svg

Requested by

Host: www.mandiant.com
URL: https://www.mandiant.com/sites/default/files/css/css_an_ivdO65UWTk2OlEaxarp82vfi_hLA8AdfPyAitrQs.css

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:300b::a29f:f17d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f16edf69b3b38abc839a83da5041cb4b2ed08b54017faa471b4e2da1cc8393c1

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.mandiant.com/sites/default/files/css/css_an_ivdO65UWTk2OlEaxarp82vfi_hLA8AdfPyAitrQs.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Thu, 08 Sep 2022 16:35:47 GMT
via: varnish
x-content-type-options: nosniff
cf-cache-status: HIT
age: 859197
x-cache: HIT
x-cache-hits: 12
x-ah-environment: prod
content-encoding: gzip
x-request-id: v-c012a092-aaf7-11ec-84b7-670d1f0629fd
last-modified: Thu, 03 Feb 2022 17:26:36 GMT
server: cloudflare
vary: Accept-Encoding
content-type: image/svg+xml
cache-control: public, max-age=1209600
cf-ray: 7479196e58519c0c-FRA
expires: Thu, 22 Sep 2022 16:35:47 GMT

GET
H2 200 gray-circle.png
www.mandiant.com/themes/custom/mandiant_theme/gnorm/build/images/backgrounds/ 9 KB
9 KB 60ms
59ms Image
image/png 2606:4700:300b::a29f:f17d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.mandiant.com/themes/custom/mandiant_theme/gnorm/build/images/backgrounds/gray-circle.png

Requested by

Host: www.mandiant.com
URL: https://www.mandiant.com/sites/default/files/css/css_an_ivdO65UWTk2OlEaxarp82vfi_hLA8AdfPyAitrQs.css

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:300b::a29f:f17d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

cfbbb6a8bb9482b6bddbba133d70d9ac28fea886ede20ecdaf3110d5c70dba6c

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.mandiant.com/sites/default/files/css/css_an_ivdO65UWTk2OlEaxarp82vfi_hLA8AdfPyAitrQs.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Thu, 08 Sep 2022 16:35:47 GMT
via: varnish
x-content-type-options: nosniff
cf-cache-status: HIT
age: 650074
x-cache: HIT
x-cache-hits: 35
x-ah-environment: prod
content-length: 8943
x-request-id: v-397b6016-f9c9-11ec-a4fa-4ba350d1bb26
last-modified: Wed, 02 Feb 2022 10:21:59 GMT
server: cloudflare
vary: Accept-Encoding
content-type: image/png
cache-control: public, max-age=1209600
accept-ranges: bytes
cf-ray: 7479196e58539c0c-FRA
expires: Thu, 22 Sep 2022 16:35:47 GMT

GET
H2 200 MaterialIcons-Outlined.woff2
www.mandiant.com/themes/custom/mandiant_theme/gnorm/build/fonts/material-icons/ 148 KB
148 KB 56ms
56ms Font
text/plain 2606:4700:300b::a29f:f17d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.mandiant.com/themes/custom/mandiant_theme/gnorm/build/fonts/material-icons/MaterialIcons-Outlined.woff2

Requested by

Host: www.mandiant.com
URL: https://www.mandiant.com/sites/default/files/css/css_an_ivdO65UWTk2OlEaxarp82vfi_hLA8AdfPyAitrQs.css

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:300b::a29f:f17d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6b9c3158d7700a96a2fc4de59adc0c4724338c900d14b9447653c52d50df1621

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.mandiant.com/sites/default/files/css/css_an_ivdO65UWTk2OlEaxarp82vfi_hLA8AdfPyAitrQs.css
Origin: https://www.mandiant.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Thu, 08 Sep 2022 16:35:47 GMT
via: varnish
x-content-type-options: nosniff
cf-cache-status: HIT
age: 851709
x-cache: HIT
x-cache-hits: 171
x-ah-environment: prod
content-length: 151244
x-request-id: v-4b8b4d74-bd5c-11ec-af68-7f592ecdd231
last-modified: Mon, 11 Apr 2022 19:08:38 GMT
server: cloudflare
vary: Accept-Encoding
cache-control: public, max-age=1209600
accept-ranges: bytes
cf-ray: 7479196e58569c0c-FRA
expires: Thu, 22 Sep 2022 16:35:47 GMT

GET
H2 200 location Show response
geolocation.onetrust.com/cookieconsentpub/v1/geo/ 153 B
359 B 58ms
38ms XHR
application/json 2606:4700:4400::6812:2962
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://geolocation.onetrust.com/cookieconsentpub/v1/geo/location

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::6812:2962 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6fba5ed9a21a948a1edf9f018055a8ed911df83da750fcb24177e2a3c539a085

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept: application/json
Referer: https://www.mandiant.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Thu, 08 Sep 2022 16:35:47 GMT
content-encoding: gzip
server: cloudflare
vary: Accept-Encoding
access-control-allow-methods: GET, OPTIONS
content-type: application/json
access-control-allow-origin: *
strict-transport-security: max-age=31536000; includeSubDomains; preload
cf-ray: 7479196ea935692b-FRA
access-control-allow-headers: Content-Type

GET
H2 200 Barlow-Regular.woff2
www.mandiant.com/themes/custom/mandiant_theme/gnorm/build/fonts/barlow/ 55 KB
55 KB 54ms
53ms Font
text/plain 2606:4700:300b::a29f:f17d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.mandiant.com/themes/custom/mandiant_theme/gnorm/build/fonts/barlow/Barlow-Regular.woff2

Requested by

Host: www.mandiant.com
URL: https://www.mandiant.com/sites/default/files/css/css_an_ivdO65UWTk2OlEaxarp82vfi_hLA8AdfPyAitrQs.css

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:300b::a29f:f17d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f269cafacd48c650b7c76973b7192a4593125d9b957bfa3b57a89e835ec0df1f

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.mandiant.com/sites/default/files/css/css_an_ivdO65UWTk2OlEaxarp82vfi_hLA8AdfPyAitrQs.css
Origin: https://www.mandiant.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Thu, 08 Sep 2022 16:35:47 GMT
via: varnish
x-content-type-options: nosniff
cf-cache-status: HIT
age: 872199
x-cache: HIT
x-cache-hits: 147
x-ah-environment: prod
content-length: 56020
x-request-id: v-da31088a-9407-11ec-bda4-8f82cbf110fd
last-modified: Wed, 02 Feb 2022 10:21:59 GMT
server: cloudflare
vary: Accept-Encoding
cache-control: public, max-age=1209600
accept-ranges: bytes
cf-ray: 7479196e88a39c0c-FRA
expires: Thu, 22 Sep 2022 16:35:47 GMT

GET
H2 200 PTMono-Regular.woff2
www.mandiant.com/themes/custom/mandiant_theme/gnorm/build/fonts/mono/ 71 KB
71 KB 56ms
55ms Font
text/plain 2606:4700:300b::a29f:f17d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.mandiant.com/themes/custom/mandiant_theme/gnorm/build/fonts/mono/PTMono-Regular.woff2

Requested by

Host: www.mandiant.com
URL: https://www.mandiant.com/sites/default/files/css/css_an_ivdO65UWTk2OlEaxarp82vfi_hLA8AdfPyAitrQs.css

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:300b::a29f:f17d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

dfaed587b938cc953c5008f257ed1e661e9d2e2f907bd5b520fc4b9348985a88

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.mandiant.com/sites/default/files/css/css_an_ivdO65UWTk2OlEaxarp82vfi_hLA8AdfPyAitrQs.css
Origin: https://www.mandiant.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Thu, 08 Sep 2022 16:35:47 GMT
via: varnish
x-content-type-options: nosniff
cf-cache-status: HIT
age: 864435
x-cache: HIT
x-cache-hits: 120
x-ah-environment: prod
content-length: 72380
x-request-id: v-51583b4e-aae3-11ec-b911-87939b0c8a84
last-modified: Wed, 02 Feb 2022 10:21:59 GMT
server: cloudflare
vary: Accept-Encoding
cache-control: public, max-age=1209600
accept-ranges: bytes
cf-ray: 7479196e88a69c0c-FRA
expires: Thu, 22 Sep 2022 16:35:47 GMT

GET
H2 200 otBannerSdk.js Show response
cdn.cookielaw.org/scripttemplates/6.39.0/ 372 KB
89 KB 13ms
13ms Script
application/javascript 2606:4700::6810:9440
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/6.39.0/otBannerSdk.js

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:9440 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e0ba033e6cb25fa6e20186d6d8113cc3821028b7891c93eebe671b75f6eebc3f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.mandiant.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Thu, 08 Sep 2022 16:35:47 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
content-md5: Zp/CcrZmK7hQ2S6c/t9Tpw==
age: 2685
vary: Accept-Encoding
content-length: 90454
x-ms-lease-status: unlocked
last-modified: Fri, 26 Aug 2022 16:31:04 GMT
server: cloudflare
etag: 0x8DA87805EB35DE2
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/javascript
access-control-allow-origin: *
x-ms-request-id: a98cb099-e01e-0171-4a83-b9ec8a000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: max-age=14400
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 7479196eeed06967-FRA

GET
H2 200 en.json Show response
cdn.cookielaw.org/consent/d5aa2996-6b9f-48a7-8d3d-c0b1aec63c6d/2b72da7f-5a1d-40aa-80f2-f34199b4516d/ 28 KB
7 KB 14ms
14ms Fetch
application/x-javascript 2606:4700::6810:9440
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/consent/d5aa2996-6b9f-48a7-8d3d-c0b1aec63c6d/2b72da7f-5a1d-40aa-80f2-f34199b4516d/en.json

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/6.39.0/otBannerSdk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:9440 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

4c10ba944a22db97145f142b93216d96358e5232295b636f6b423c3a063c393b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.mandiant.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Thu, 08 Sep 2022 16:35:47 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
content-md5: GMh7tbtmVPnm3mcfNQ5MtA==
age: 7694
vary: Accept-Encoding
content-length: 7424
x-ms-lease-status: unlocked
last-modified: Wed, 24 Aug 2022 17:45:01 GMT
server: cloudflare
etag: 0x8DA85F85EDA03CB
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/x-javascript
access-control-allow-origin: *
x-ms-request-id: 925ac980-801e-008b-4df3-b76338000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=14400
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 7479196f1a226910-FRA
expires: Thu, 08 Sep 2022 20:35:47 GMT

GET
H2 200 Barlow-Bold.woff2
www.mandiant.com/themes/custom/mandiant_theme/gnorm/build/fonts/barlow/ 56 KB
56 KB 57ms
55ms Font
text/plain 2606:4700:300b::a29f:f17d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.mandiant.com/themes/custom/mandiant_theme/gnorm/build/fonts/barlow/Barlow-Bold.woff2

Requested by

Host: www.mandiant.com
URL: https://www.mandiant.com/sites/default/files/css/css_an_ivdO65UWTk2OlEaxarp82vfi_hLA8AdfPyAitrQs.css

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:300b::a29f:f17d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

9ec192b1be13b5eb7d11e7c8a0f1466ef236e4ba88182bb4cec76a2c7919464e

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.mandiant.com/sites/default/files/css/css_an_ivdO65UWTk2OlEaxarp82vfi_hLA8AdfPyAitrQs.css
Origin: https://www.mandiant.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Thu, 08 Sep 2022 16:35:47 GMT
via: varnish
x-content-type-options: nosniff
cf-cache-status: HIT
age: 194602
x-cache: HIT
x-cache-hits: 9
x-ah-environment: prod
content-length: 57572
x-request-id: v-2cced76e-8811-11ec-827b-bb9843233355
last-modified: Wed, 02 Feb 2022 10:21:59 GMT
server: cloudflare
vary: Accept-Encoding
cache-control: public, max-age=1209600
accept-ranges: bytes
cf-ray: 7479196f39c79c0c-FRA
expires: Thu, 22 Sep 2022 16:35:47 GMT

GET
H2 200 Barlow-SemiBold.woff2
www.mandiant.com/themes/custom/mandiant_theme/gnorm/build/fonts/barlow/ 56 KB
57 KB 51ms
50ms Font
text/plain 2606:4700:300b::a29f:f17d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.mandiant.com/themes/custom/mandiant_theme/gnorm/build/fonts/barlow/Barlow-SemiBold.woff2

Requested by

Host: www.mandiant.com
URL: https://www.mandiant.com/sites/default/files/css/css_an_ivdO65UWTk2OlEaxarp82vfi_hLA8AdfPyAitrQs.css

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:300b::a29f:f17d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

1bb508d41bf1d0c5d56340c7df789b6589350a5f967e1fa937bee5c148d0cb0d

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.mandiant.com/sites/default/files/css/css_an_ivdO65UWTk2OlEaxarp82vfi_hLA8AdfPyAitrQs.css
Origin: https://www.mandiant.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Thu, 08 Sep 2022 16:35:47 GMT
via: varnish
x-content-type-options: nosniff
cf-cache-status: HIT
age: 852692
x-cache: HIT
x-cache-hits: 180
x-ah-environment: prod
content-length: 57764
x-request-id: v-4b828a54-bd5c-11ec-a3a5-0bf0e671acf1
last-modified: Wed, 02 Feb 2022 10:21:59 GMT
server: cloudflare
vary: Accept-Encoding
cache-control: public, max-age=1209600
accept-ranges: bytes
cf-ray: 7479196f39cb9c0c-FRA
expires: Thu, 22 Sep 2022 16:35:47 GMT

GET
H2 200 Barlow-Medium.woff2
www.mandiant.com/themes/custom/mandiant_theme/gnorm/build/fonts/barlow/ 55 KB
55 KB 35ms
35ms Font
text/plain 2606:4700:300b::a29f:f17d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.mandiant.com/themes/custom/mandiant_theme/gnorm/build/fonts/barlow/Barlow-Medium.woff2

Requested by

Host: www.mandiant.com
URL: https://www.mandiant.com/sites/default/files/css/css_an_ivdO65UWTk2OlEaxarp82vfi_hLA8AdfPyAitrQs.css

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:300b::a29f:f17d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

fe3bfdac05de97234a1a81c7f09c87f14708cf7bd9a341a63e68613c3c6e40d6

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.mandiant.com/sites/default/files/css/css_an_ivdO65UWTk2OlEaxarp82vfi_hLA8AdfPyAitrQs.css
Origin: https://www.mandiant.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Thu, 08 Sep 2022 16:35:47 GMT
via: varnish
x-content-type-options: nosniff
cf-cache-status: HIT
age: 718695
x-cache: HIT
x-cache-hits: 129
x-ah-environment: prod
content-length: 55968
x-request-id: v-9e47b6b8-b6b0-11ec-9718-e3ef8598e229
last-modified: Wed, 02 Feb 2022 10:21:59 GMT
server: cloudflare
vary: Accept-Encoding
cache-control: public, max-age=1209600
accept-ranges: bytes
cf-ray: 7479196f39cc9c0c-FRA
expires: Thu, 22 Sep 2022 16:35:47 GMT

GET
H2 200 otFlat.json Show response
cdn.cookielaw.org/scripttemplates/6.39.0/assets/ 13 KB
3 KB 18ms
18ms Fetch
application/json 2606:4700::6810:9440
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/6.39.0/assets/otFlat.json

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/6.39.0/otBannerSdk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:9440 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

14e4d1596c6b58896dfce1fc1ec45372bab4d2259ba82828fa3f96cc4f859fc4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.mandiant.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Thu, 08 Sep 2022 16:35:47 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
content-md5: Xx897lTVYGjMQiwuGCrzDA==
age: 499
vary: Accept-Encoding
content-length: 3007
x-ms-lease-status: unlocked
last-modified: Fri, 26 Aug 2022 16:30:55 GMT
server: cloudflare
etag: 0x8DA87805972EF22
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/json
access-control-allow-origin: *
x-ms-request-id: 8f85a62b-501e-0045-6089-b90577000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: max-age=14400
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 747919705c026910-FRA

GET
H2 200 otPcCenter.json Show response
cdn.cookielaw.org/scripttemplates/6.39.0/assets/v2/ 62 KB
13 KB 15ms
14ms Fetch
application/json 2606:4700::6810:9440
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/6.39.0/assets/v2/otPcCenter.json

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/6.39.0/otBannerSdk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:9440 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

331852fd9912583b03043c973d33d23b2711924f3731bd8bcd31b7000a6d4a60

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.mandiant.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Thu, 08 Sep 2022 16:35:47 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
content-md5: 444ho/eGhWdN7ej7RCW2zw==
age: 11773
vary: Accept-Encoding
content-length: 13253
x-ms-lease-status: unlocked
last-modified: Fri, 26 Aug 2022 16:30:57 GMT
server: cloudflare
etag: 0x8DA87805AD77A2D
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/json
access-control-allow-origin: *
x-ms-request-id: 609766f7-c01e-00a5-6e88-b9e3ff000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: max-age=14400
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 747919705c056910-FRA

GET
H2 200 otCookieSettingsButton.json Show response
cdn.cookielaw.org/scripttemplates/6.39.0/assets/ 5 KB
2 KB 19ms
19ms Fetch
application/json 2606:4700::6810:9440
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/6.39.0/assets/otCookieSettingsButton.json

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/6.39.0/otBannerSdk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:9440 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a09d0f89e99cf5a081315ff701187632005dabd23f3ca116a75790003faa7e8f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.mandiant.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Thu, 08 Sep 2022 16:35:47 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
content-md5: ssl6Phwu9+sah2W05EtyUQ==
age: 11773
vary: Accept-Encoding
content-length: 1767
x-ms-lease-status: unlocked
last-modified: Fri, 26 Aug 2022 16:30:57 GMT
server: cloudflare
etag: 0x8DA87805A8DD1F0
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/json
access-control-allow-origin: *
x-ms-request-id: 30180b6f-501e-012c-6388-b91c8e000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: max-age=14400
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 747919705c086910-FRA

GET
H2 200 otCommonStyles.css Show response
cdn.cookielaw.org/scripttemplates/6.39.0/assets/ 22 KB
5 KB 16ms
16ms Fetch
text/css 2606:4700::6810:9440
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/6.39.0/assets/otCommonStyles.css

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/6.39.0/otBannerSdk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:9440 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

fb6bcf7d9261064812fe1b4d2b59b8c8ca52b7d0c522746ba9cec2dc01b3a7d4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.mandiant.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Thu, 08 Sep 2022 16:35:47 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
content-md5: B55i3ZY9miZIaUrwjufy0w==
age: 11773
vary: Accept-Encoding
x-ms-lease-status: unlocked
last-modified: Fri, 26 Aug 2022 16:31:09 GMT
server: cloudflare
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/css
access-control-allow-origin: *
x-ms-request-id: 3019f9d6-501e-012c-4089-b91c8e000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: max-age=14400
x-ms-version: 2009-09-19
cf-ray: 747919705c096910-FRA

GET
H2 200 getForm Show response
www2.mandiant.com/index.php/form/ 28 KB
6 KB 344ms
343ms Script
application/javascript 104.17.73.206
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www2.mandiant.com/index.php/form/getForm?munchkinId=565-PEI-952&form=1016&url=https%3A%2F%2Fwww.mandiant.com%2Fresources%2Fremediation-and-hardening-strategies-microsoft-365-defend-against-apt29-v13&callback=jQuery11240020126727454927273_1662654955083&_=1662654955084
Requested by: Host: www2.mandiant.com
URL: https://www2.mandiant.com/js/forms2/js/forms2.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 104.17.73.206 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 284fd9124834b2f8325d11267bfccd673bfa1d6fa8d1f0bb23b77d061c090e29

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.mandiant.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Thu, 08 Sep 2022 16:35:48 GMT
content-encoding: gzip
vary: Accept-Encoding
server: cloudflare
cf-ray: 747919706f6e9164-FRA
cached: true
content-type: application/javascript; charset=utf-8

GET
H2 200 974.bundle.js Show response
www.mandiant.com/themes/custom/mandiant_theme/gnorm/build/scripts/ 11 KB
3 KB 56ms
56ms Script
application/javascript 2606:4700:300b::a29f:f17d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.mandiant.com/themes/custom/mandiant_theme/gnorm/build/scripts/974.bundle.js?6fa3d5

Requested by

Host: www.mandiant.com
URL: https://www.mandiant.com/sites/default/files/js/js_Rivtu_17dHyti4SnnaehZXqwd_N-Jmxmo_YA5Kl-bMM.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:300b::a29f:f17d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

98d7c4fe1604e08c228b1c8756ccfed58659528670ee420520d157e3787b9f6a

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.mandiant.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Thu, 08 Sep 2022 16:35:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
age: 777240
x-cache: HIT
x-cache-hits: 44
x-ah-environment: prod
content-length: 3374
x-request-id: v-6e037e90-d07a-11ec-9af4-6f1cf76df6ea
last-modified: Tue, 10 May 2022 16:00:59 GMT
server: cloudflare
vary: Accept-Encoding
content-type: application/javascript
via: varnish
cache-control: public, max-age=1209600
accept-ranges: bytes
cf-ray: 74791970ccfe9c0c-FRA
expires: Thu, 22 Sep 2022 16:35:48 GMT

GET
H2 200 404.bundle.js Show response
www.mandiant.com/themes/custom/mandiant_theme/gnorm/build/scripts/ 406 B
371 B 62ms
62ms Script
application/javascript 2606:4700:300b::a29f:f17d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.mandiant.com/themes/custom/mandiant_theme/gnorm/build/scripts/404.bundle.js?2c5f80

Requested by

Host: www.mandiant.com
URL: https://www.mandiant.com/sites/default/files/js/js_Rivtu_17dHyti4SnnaehZXqwd_N-Jmxmo_YA5Kl-bMM.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:300b::a29f:f17d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b2cb383a30bee467e40ecebb49e4229b1b57efcc2c7632c921cd170a75c74d24

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.mandiant.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Thu, 08 Sep 2022 16:35:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
age: 71416
x-cache: MISS
x-ah-environment: prod
content-length: 263
x-request-id: v-1811ed5e-b5e6-11ec-8d8b-1ba7b97d0f47
last-modified: Wed, 02 Feb 2022 10:21:59 GMT
server: cloudflare
vary: Accept-Encoding
content-type: application/javascript
via: varnish
cache-control: public, max-age=1209600
accept-ranges: bytes
cf-ray: 74791970cd029c0c-FRA
expires: Thu, 22 Sep 2022 16:35:48 GMT

GET
H2 200 396.bundle.js Show response
www.mandiant.com/themes/custom/mandiant_theme/gnorm/build/scripts/ 1 KB
703 B 57ms
56ms Script
application/javascript 2606:4700:300b::a29f:f17d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.mandiant.com/themes/custom/mandiant_theme/gnorm/build/scripts/396.bundle.js?d2a36f

Requested by

Host: www.mandiant.com
URL: https://www.mandiant.com/sites/default/files/js/js_Rivtu_17dHyti4SnnaehZXqwd_N-Jmxmo_YA5Kl-bMM.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:300b::a29f:f17d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

85812e1f30e98e63c3ea17a4a7bea7cc0c26b8edef9c48d0af517fecd45210c7

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.mandiant.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Thu, 08 Sep 2022 16:35:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
age: 851954
x-cache: HIT
x-cache-hits: 4
x-ah-environment: prod
content-length: 519
x-request-id: v-dc75ed0c-b9ca-11ec-ba53-2b236d1ce77c
last-modified: Mon, 11 Apr 2022 19:08:38 GMT
server: cloudflare
vary: Accept-Encoding
content-type: application/javascript
via: varnish
cache-control: public, max-age=1209600
accept-ranges: bytes
cf-ray: 74791970cd049c0c-FRA
expires: Thu, 22 Sep 2022 16:35:48 GMT

GET
H2 200 recaptcha__de.js Show response
www.gstatic.com/recaptcha/releases/duyHVVR9Brf6N2GewjkPRfsA/ 392 KB
157 KB 355ms
13ms Script
text/javascript 2a00:1450:4001:803::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/recaptcha/releases/duyHVVR9Brf6N2GewjkPRfsA/recaptcha__de.js

Requested by

Host: www.google.com
URL: https://www.google.com/recaptcha/api.js?onload=CaptchaCallback&render=explicit

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:803::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cbea10abc6a4fb6c6db32f7ff91d4e53f496579268f4f28e4e15f14c76cdd088

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.mandiant.com/
Origin: https://www.mandiant.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Thu, 08 Sep 2022 16:05:07 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1841
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 159560
x-xss-protection: 0
last-modified: Fri, 02 Sep 2022 18:40:58 GMT
server: sffe
cross-origin-opener-policy: same-origin-allow-popups; report-to="recaptcha"
vary: Accept-Encoding
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Fri, 08 Sep 2023 16:05:07 GMT

GET
H2 200 core.e18d3993.js Show response
static.addtoany.com/menu/modules/ 70 KB
25 KB 34ms
17ms Script
application/javascript 2606:4700:10::ac43:2794
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://static.addtoany.com/menu/modules/core.e18d3993.js

Requested by

Host: static.addtoany.com
URL: https://static.addtoany.com/menu/page.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::ac43:2794 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

36925e7859abeeb8681d694d702e00b1fbba6f37ac49b11e8f863ed24507ca6a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.mandiant.com/
Origin: https://www.mandiant.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Thu, 08 Sep 2022 16:35:47 GMT
via: e1s
x-content-type-options: nosniff
cf-cache-status: HIT
age: 486403
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Sat, 03 Sep 2022 00:56:46 GMT
server: cloudflare
etag: W/"11891-5e7bb52267bff"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: max-age=315360000, immutable
cf-ray: 74791970edc76904-FRA
cf-bgj: minify

GET
H2 200 footer-bg-transparent.png
www.mandiant.com/themes/custom/mandiant_theme/gnorm/build/images/ 134 KB
134 KB 56ms
55ms Image
image/png 2606:4700:300b::a29f:f17d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.mandiant.com/themes/custom/mandiant_theme/gnorm/build/images/footer-bg-transparent.png

Requested by

Host: www.mandiant.com
URL: https://www.mandiant.com/sites/default/files/css/css_an_ivdO65UWTk2OlEaxarp82vfi_hLA8AdfPyAitrQs.css

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:300b::a29f:f17d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0f2e61cd1a10aebb0eae1a2f6914784a4d9be90a46b1c67700311d0f66d3e379

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.mandiant.com/sites/default/files/css/css_an_ivdO65UWTk2OlEaxarp82vfi_hLA8AdfPyAitrQs.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Thu, 08 Sep 2022 16:35:48 GMT
via: varnish
x-content-type-options: nosniff
cf-cache-status: HIT
age: 1109346
x-cache: HIT
x-cache-hits: 37
x-ah-environment: prod
content-length: 136986
x-request-id: v-e43b31cc-ee78-11ec-8e3f-9f1b143ea5cf
last-modified: Fri, 03 Jun 2022 20:04:29 GMT
server: cloudflare
vary: Accept-Encoding
content-type: image/png
cache-control: public, max-age=1209600
accept-ranges: bytes
cf-ray: 74791970cd189c0c-FRA
expires: Thu, 22 Sep 2022 16:35:48 GMT

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 374 KB
101 KB 381ms
51ms Script
application/javascript 2a00:1450:4001:80b::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-T72STLD

Requested by

Host: www.mandiant.com
URL: https://www.mandiant.com/sites/default/files/google_tag/google_tag_manager/google_tag.script.js?rhvyfu

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

ec604e9e30666db4d3c932f9507a95321b9e6f27ff4054f6e1ae29f1a501233c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.mandiant.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Thu, 08 Sep 2022 16:35:48 GMT
content-encoding: br
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 103308
x-xss-protection: 0
last-modified: Thu, 08 Sep 2022 16:04:19 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Thu, 08 Sep 2022 16:35:48 GMT

GET
H2 200 sm.23.html Show response
static.addtoany.com/menu/ Frame CF44 741 B
636 B 26ms
25ms Document
text/html 2606:4700:10::ac43:2794
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://static.addtoany.com/menu/sm.23.html

Requested by

Host: static.addtoany.com
URL: https://static.addtoany.com/menu/page.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::ac43:2794 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

4ca130786a2d2531241f8b8c7aaad6a4e27271f51b417b9c23f51bfb0c65c080

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.mandiant.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 207323
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control: max-age=315360000, immutable
cf-cache-status: HIT
cf-ray: 74791972dd059a3b-FRA
content-encoding: br
content-type: text/html; charset=utf-8
date: Thu, 08 Sep 2022 16:35:48 GMT
etag: W/"2e5-5cc9e128a4c38"
last-modified: Wed, 22 Sep 2021 23:42:51 GMT
p3p: CP="ALL DSP COR CURa ADMa DEVa TAIa PSAa PSDa OUR IND UNI COM NAV INT"
server: cloudflare
strict-transport-security: max-age=31536000; includeSubDomains; preload
vary: Accept-Encoding
via: e4s
x-content-type-options: nosniff

GET
DATA 200
OK truncated
/ 817 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: db311174b0e3c340727b63c055cfb5b317808e909503e1bda11cc58af444f12b

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H2 200 ot_logo.png
cdn.cookielaw.org/logos/static/ 13 KB
13 KB 18ms
18ms Image
image/png 2606:4700::6810:9440
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cdn.cookielaw.org/logos/static/ot_logo.png

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:9440 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

61e7a7943f7444e87b2af6295044b34292a537a23dd3d9436886e3a2ccf620ca

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.mandiant.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Thu, 08 Sep 2022 16:35:48 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
content-md5: 8WyO+79CLtcTX81zrcTfgg==
age: 9988
vary: Accept-Encoding
content-length: 13077
x-ms-lease-status: unlocked
last-modified: Thu, 08 Sep 2022 06:34:54 GMT
server: cloudflare
etag: 0x8DA91643DDC3BAC
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: image/png
access-control-allow-origin: *
x-ms-request-id: ed77b3ab-901e-0157-326a-c3773e000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: max-age=14400
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 747919739e516967-FRA

GET
H2 200 poweredBy_ot_logo.svg
cdn.cookielaw.org/logos/static/ 3 KB
2 KB 23ms
23ms Image
image/svg+xml 2606:4700::6810:9440
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cdn.cookielaw.org/logos/static/poweredBy_ot_logo.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:9440 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

49b9b4996d1ff0a8e3de643a0c623255bf631f298f2799b949c29de93926ee7a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.mandiant.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Thu, 08 Sep 2022 16:35:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
content-md5: LpuayL42jB78xRllx0vkOw==
age: 7270
vary: Accept-Encoding
x-ms-lease-status: unlocked
last-modified: Thu, 08 Sep 2022 06:34:54 GMT
server: cloudflare
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: image/svg+xml
access-control-allow-origin: *
x-ms-request-id: 75c8ecde-f01e-0121-4852-c3f382000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: max-age=14400
x-ms-version: 2009-09-19
cf-ray: 747919739e546967-FRA

GET
H2 200 forms2.css
www2.mandiant.com/js/forms2/css/ 13 KB
3 KB 24ms
24ms Stylesheet
text/css 104.17.73.206
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www2.mandiant.com/js/forms2/css/forms2.css

Requested by

Host: www2.mandiant.com
URL: https://www2.mandiant.com/js/forms2/js/forms2.min.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

104.17.73.206 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

256e42104f48a5fa80b031da12dc56acde224fba3f9810f8f8192b39136d365a

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.mandiant.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Thu, 08 Sep 2022 16:35:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
last-modified: Tue, 16 Aug 2022 18:54:37 GMT
server: cloudflare
age: 3477
etag: "2d80536-3437-5e66047a81540"
vary: Accept-Encoding
content-type: text/css
cache-control: public, max-age=14400
accept-ranges: bytes
cf-ray: 747919739d229164-FRA
content-length: 2623
expires: Thu, 08 Sep 2022 20:35:48 GMT

GET
H2 200 forms2-theme-simple.css
www2.mandiant.com/js/forms2/css/ 826 B
593 B 22ms
22ms Stylesheet
text/css 104.17.73.206
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www2.mandiant.com/js/forms2/css/forms2-theme-simple.css

Requested by

Host: www2.mandiant.com
URL: https://www2.mandiant.com/js/forms2/js/forms2.min.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

104.17.73.206 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

14c8c62dc692fd8faa04434e3fed25e7c23d596b732f9db88f6e9f9ff5dfa61c

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.mandiant.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Thu, 08 Sep 2022 16:35:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
last-modified: Tue, 16 Aug 2022 18:54:37 GMT
server: cloudflare
age: 3478
etag: "2d80533-33a-5e66047a81540"
vary: Accept-Encoding
content-type: text/css
cache-control: public, max-age=14400
accept-ranges: bytes
cf-ray: 747919739d249164-FRA
content-length: 242
expires: Thu, 08 Sep 2022 20:35:48 GMT

GET
H2 200 getKnownLead Show response
www2.mandiant.com/index.php/form/ 203 B
570 B 439ms
438ms Script
application/javascript 104.17.73.206
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www2.mandiant.com/index.php/form/getKnownLead?form=1016&lpId=&munchkinId=565-PEI-952&filledFields=true&mkt_tok=NTY1LVBFSS05NTIAAAGGvNlzn0jgaUADPeckarP9ryGyW8FymW2g6eWg1XVwVBbl60tKrgiSQKdwVqQqaI8C0VvT1IsNg0j0L-kqO_ozuVvIL8ODVs6b40IVTjo&callback=jQuery11240020126727454927273_1662654955083&_=1662654955085

Requested by

Host: www2.mandiant.com
URL: https://www2.mandiant.com/js/forms2/js/forms2.min.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

104.17.73.206 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

58fa444d11a5c62f8ed07c5c0903933a3678fa8a8c8347160103a9416a9ae191

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.mandiant.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Thu, 08 Sep 2022 16:35:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
server: cloudflare
cf-ray: 74791973ad279164-FRA
content-type: application/javascript; charset=utf-8

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 49 KB
20 KB 82ms
20ms Script
text/javascript 2a00:1450:4001:809::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-T72STLD

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

a1925038db769477ab74b4df34350c35688a795bb718727b0f4292a4a78a6210

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.mandiant.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 13 Apr 2022 21:02:38 GMT
server: Golfe2
age: 5628
date: Thu, 08 Sep 2022 15:02:00 GMT
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 20006
expires: Thu, 08 Sep 2022 17:02:00 GMT

GET
H2 200 9733b1e1169991b694a1ddb4dc45463acc83618f.js Show response
my.hellobar.com/ 28 KB
6 KB 300ms
247ms Script
text/javascript 2606:4700:10::ac43:2be9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://my.hellobar.com/9733b1e1169991b694a1ddb4dc45463acc83618f.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-T72STLD
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::ac43:2be9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d342feac235fe9a18504e5b6e5ef98c7b7e0ea60cc7bc0176fd47b5cea2ff2dd

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.mandiant.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Thu, 08 Sep 2022 16:35:48 GMT
content-encoding: br
cf-cache-status: REVALIDATED
last-modified: Thu, 08 Sep 2022 14:49:26 GMT
server: cloudflare
x-amz-request-id: AJMEMG6K9GNAKX08
etag: W/"8c5c5c578e74747503855ddeda34f28f"
vary: Accept-Encoding
content-type: text/javascript
cache-control: max-age=86400, must-revalidate, proxy-revalidate, s-maxage=10
cf-ray: 74791974bbae5b68-FRA
x-amz-id-2: bvyrm5CxrNWIgVqEny8khCfG8T3EPhSvNTn273Ej2CBkrAc63n9ib7QM7Cj/reviZVHGcvqfNE8=
cf-bgj: minify

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 212 KB
73 KB 59ms
31ms Script
application/javascript 2a00:1450:4001:80b::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-X6642ZTDJ7&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-T72STLD

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

2eb59661110bf387b0b9e1a92d4fe59ce1d84879dba3ac474a73680c81bf4273

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.mandiant.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Thu, 08 Sep 2022 16:35:48 GMT
content-encoding: br
server: Google Tag Manager
access-control-allow-headers: Cache-Control
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; includeSubDomains
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 75095
x-xss-protection: 0
expires: Thu, 08 Sep 2022 16:35:48 GMT

GET
H3 200 collect
www.google-analytics.com/ 35 B
55 B 41ms
13ms Image
image/gif 2a00:1450:4001:809::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j96&a=1715937013&t=pageview&_s=1&dl=https%3A%2F%2Fwww.mandiant.com%2Fresources%2Fremediation-and-hardening-strategies-microsoft-365-defend-against-apt29-v13%3Futm_source%3Dnewsletter%26utm_medium%3Demail%26utm_campaign%3Dthreat_intelligence%26utm_content%3Dall%26utm_term%3Den%26cid%3Dglobal%26mkt_tok%3DNTY1LVBFSS05NTIAAAGGvNlzn0jgaUADPeckarP9ryGyW8FymW2g6eWg1XVwVBbl60tKrgiSQKdwVqQqaI8C0VvT1IsNg0j0L-kqO_ozuVvIL8ODVs6b40IVTjo&dr=https%3A%2F%2Fpages.mandiant.com%2F&ul=en-us&de=UTF-8&dt=Remediation%20and%20Hardening%20Strategies%20for%20Microsoft%20365%20to%20Defend%20Against%20APT29%20(v1.3)%20%7C%20Mandiant&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YGAAgAAB~&cid=747046914.1662654956&tid=UA-203244293-1&_gid=812853582.1662654956&gtm=2wg8v0T72STLD&cg1=white%20paper&cg2=resources&cd2=Pageview&cd3=1662654955750.1n9ch1i8&cd4=2022-09-08T16%3A35%3A55.750%2B00%3A00&cd5=https%3A%2F%2Fpages.mandiant.com%2F&cd14=global&cd15=null&cd16=null&gcs=G100&cd1=747046914.1662654956&z=1567186400

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.mandiant.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 07 Sep 2022 21:31:57 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 68631
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

POST
H2 204 collect
region1.google-analytics.com/g/ 0
348 B 53ms
21ms Ping
text/plain 2001:4860:4802:32::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://region1.google-analytics.com/g/collect?v=2&tid=G-X6642ZTDJ7&gtm=2oe8v0&_p=1715937013&gcs=G100&cid=747046914.1662654956&ul=en-us&sr=1600x1200&_z=ccd.v9B&_s=1&sid=1662654955&sct=1&seg=0&dl=https%3A%2F%2Fwww.mandiant.com%2Fresources%2Fremediation-and-hardening-strategies-microsoft-365-defend-against-apt29-v13%3Futm_source%3Dnewsletter%26utm_medium%3Demail%26utm_campaign%3Dthreat_intelligence%26utm_content%3Dall%26utm_term%3Den%26cid%3Dglobal%26mkt_tok%3DNTY1LVBFSS05NTIAAAGGvNlzn0jgaUADPeckarP9ryGyW8FymW2g6eWg1XVwVBbl60tKrgiSQKdwVqQqaI8C0VvT1IsNg0j0L-kqO_ozuVvIL8ODVs6b40IVTjo&dr=https%3A%2F%2Fpages.mandiant.com%2F&dt=Remediation%20and%20Hardening%20Strategies%20for%20Microsoft%20365%20to%20Defend%20Against%20APT29%20(v1.3)%20%7C%20Mandiant&en=page_view&_fv=1&_ss=1
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-X6642ZTDJ7&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:32::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.mandiant.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 08 Sep 2022 16:35:48 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.mandiant.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 modules.js Show response
my.hellobar.com/ 254 KB
73 KB 27ms
27ms Script
text/javascript 2606:4700:10::ac43:2be9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://my.hellobar.com/modules.js
Requested by: Host: my.hellobar.com
URL: https://my.hellobar.com/9733b1e1169991b694a1ddb4dc45463acc83618f.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::ac43:2be9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2e08feab1a7c8daf3e743919af0aa076e41fb8ff6a40f57c9fbd411fd396aea1

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.mandiant.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Thu, 08 Sep 2022 16:35:48 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Mon, 29 Aug 2022 14:39:44 GMT
server: cloudflare
age: 3704
etag: W/"8704758136c399b13e9aaa9af4c148b7"
vary: Accept-Encoding
content-type: text/javascript
cache-control: max-age=14400
cf-polished: origSize=259983
cf-ray: 747919764d635b68-FRA
x-amz-request-id: S5WJ95AP5PKQ36ZB
x-amz-id-2: qzhyI0pV9P+q0VqVmkcZLBftNxToDGMkBAE4G7uOYCPJDkcq1VV+O9A+Oy4p9rGQOqxpp3gG1CM=
cf-bgj: minify

GET
H2 200 XDFrame Show response
www2.mandiant.com/index.php/form/ Frame F9AE 2 KB
964 B 143ms
142ms Document
text/html 104.17.73.206
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www2.mandiant.com/index.php/form/XDFrame

Requested by

Host: www2.mandiant.com
URL: https://www2.mandiant.com/js/forms2/js/forms2.min.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

104.17.73.206 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

13a35f6809ebd06635401be41681b52dd7f36d45fd6624e75ab5ce909419d427

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.mandiant.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: max-age=3600
cf-cache-status: DYNAMIC
cf-ray: 74791976fb779164-FRA
content-encoding: gzip
content-type: text/html; charset=utf-8
date: Thu, 08 Sep 2022 16:35:49 GMT
server: cloudflare
vary: Accept-Encoding
x-content-type-options: nosniff

GET
H2 200 index.js Show response
cdn.jsdelivr.net/npm/@amplitude/amplitude-js-gtm@2.0.2/dist/ 3 KB
2 KB 41ms
7ms Script
application/javascript 2a04:4e42:400::485
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/npm/@amplitude/amplitude-js-gtm@2.0.2/dist/index.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-T72STLD

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:4e42:400::485 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

853f77de90385806427ff0cd0ac797795adbd82c800c26381f7e55537e736587

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.mandiant.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
age: 3847961
x-jsd-version: 2.0.2
x-cache: HIT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 1301
etag: W/"b22-n2o9T9k7cye7ujWQ0K/tCJdFJAM"
x-served-by: cache-fra19149-FRA
x-jsd-version-type: version
date: Thu, 08 Sep 2022 16:35:48 GMT
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=31536000, s-maxage=31536000, immutable
accept-ranges: bytes
timing-allow-origin: *

GET anchor
www.google.com/recaptcha/api2/ Frame 0D47 0
0

GET anchor
www.google.com/recaptcha/api2/ Frame 2C88 0
0

GET
H3 200 anchor Show response
www.google.com/recaptcha/api2/ Frame E44B 43 KB
22 KB 60ms
40ms Document
text/html 2a00:1450:4001:80f::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LdhgBgUAAAAAILakhHCM8iL5pygGB4jLnJbJFfq&co=aHR0cHM6Ly93d3cubWFuZGlhbnQuY29tOjQ0Mw..&hl=de&v=duyHVVR9Brf6N2GewjkPRfsA&size=normal&cb=r26u3lmkmztr

Requested by

Host: www.mandiant.com
URL: https://www.mandiant.com/sites/default/files/js/js_XBcwvZgni4Dy492wJEdbHHCn_qVkg5CqNNIp9ePdPqk.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

1c5adf6a6caf57816242bb03499debdfba1e829f21adfec24a2402989313426a

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-WFV52YYMFZWQJDIfLvejLw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.mandiant.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: no-cache, no-store, max-age=0, must-revalidate
content-encoding: gzip
content-length: 22722
content-security-policy: script-src 'report-sample' 'nonce-WFV52YYMFZWQJDIfLvejLw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Thu, 08 Sep 2022 16:35:49 GMT
expires: Mon, 01 Jan 1990 00:00:00 GMT
pragma: no-cache
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server: GSE
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

GET
H3 200 anchor Show response
www.google.com/recaptcha/api2/ Frame 0489 43 KB
22 KB 57ms
38ms Document
text/html 2a00:1450:4001:80f::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LdhgBgUAAAAAILakhHCM8iL5pygGB4jLnJbJFfq&co=aHR0cHM6Ly93d3cubWFuZGlhbnQuY29tOjQ0Mw..&hl=de&v=duyHVVR9Brf6N2GewjkPRfsA&size=compact&cb=dlf6ccdnmjv

Requested by

Host: www.mandiant.com
URL: https://www.mandiant.com/sites/default/files/js/js_XBcwvZgni4Dy492wJEdbHHCn_qVkg5CqNNIp9ePdPqk.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

0ee46c9dbbd635715a927765ea65b9fa2b2669b54926a20678ccfa84108818c6

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-W9KivtD0pJWGua4PlOqy7Q' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.mandiant.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: no-cache, no-store, max-age=0, must-revalidate
content-encoding: gzip
content-length: 22771
content-security-policy: script-src 'report-sample' 'nonce-W9KivtD0pJWGua4PlOqy7Q' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Thu, 08 Sep 2022 16:35:49 GMT
expires: Mon, 01 Jan 1990 00:00:00 GMT
pragma: no-cache
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server: GSE
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

GET
H2 200 css2
fonts.googleapis.com/ Frame 4B29 664 B
858 B 96ms
23ms Stylesheet
text/css 2a00:1450:4001:812::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Lato

Requested by

Host: my.hellobar.com
URL: https://my.hellobar.com/modules.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

5a9f9b8fdda3dc64dc104281767edc8ce0798cd76bfc307c17a7c7b4db115c86

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.mandiant.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Thu, 08 Sep 2022 16:03:32 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
date: Thu, 08 Sep 2022 16:35:49 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Thu, 08 Sep 2022 16:35:49 GMT

GET
H2 200 aE7qpcvvh88DUiSVsqoOTjycOUZhwZpR6-IZxOmpIS
hi.hellobar.com/v/r4nk6hVxdyjpXyOffkeoS9-_vyzZSS/ 35 B
386 B 623ms
551ms Image
image/gif 2600:9000:223e:4e00:1b:45dc:7080:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hi.hellobar.com/v/r4nk6hVxdyjpXyOffkeoS9-_vyzZSS/aE7qpcvvh88DUiSVsqoOTjycOUZhwZpR6-IZxOmpIS?t=1662654956&v=06effd6e-2e4b-4f66-d843-d1658597eae3&f=i&s=11939c7c732ab0f580077397339b981b0b4056cbba4ce9a64125b76d518d78b5120fb4ceef0ab749b541672c81904974a95571b267f30a6dd4ec2f92c149df29
Requested by: Host: www.mandiant.com
URL: https://www.mandiant.com/resources/remediation-and-hardening-strategies-microsoft-365-defend-against-apt29-v13?utm_source=newsletter&utm_medium=email&utm_campaign=threat_intelligence&utm_content=all&utm_term=en&cid=global&mkt_tok=NTY1LVBFSS05NTIAAAGGvNlzn0jgaUADPeckarP9ryGyW8FymW2g6eWg1XVwVBbl60tKrgiSQKdwVqQqaI8C0VvT1IsNg0j0L-kqO_ozuVvIL8ODVs6b40IVTjo
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:223e:4e00:1b:45dc:7080:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.mandiant.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Wed, 07 Sep 2022 19:08:53 GMT
via: 1.1 71c4b07776e0b6812900664940c9d7a6.cloudfront.net (CloudFront)
last-modified: Tue, 10 Apr 2018 13:15:02 GMT
server: AmazonS3
age: 77216
etag: "c2196de8ba412c60c22ab491af7b1409"
x-cache: Error from cloudfront
content-type: image/gif
x-amz-cf-pop: FRA56-P4
accept-ranges: bytes
alt-svc: h3=":443"; ma=86400
content-length: 35
x-amz-cf-id: rvTFm8oKLhE9KXu9nLxoQ3-iYMW069B7CfcFIK1wNQH0egmjqQyX9Q==

GET
DATA 200
OK truncated
/ Frame 4B29 1 KB
1 KB Font
application/x-font-ttf

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 74d1f7e06069feded1f0c7c2c8a35b5c5194f66ff98d7b4309446effd0495728

Request headers

Referer
Origin: https://www.mandiant.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

Content-Type: application/x-font-ttf;charset=utf-8

GET
H3 200 styles__ltr.css
www.gstatic.com/recaptcha/releases/duyHVVR9Brf6N2GewjkPRfsA/ Frame 0489 52 KB
24 KB 53ms
24ms Stylesheet
text/css 2a00:1450:4001:803::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/recaptcha/releases/duyHVVR9Brf6N2GewjkPRfsA/styles__ltr.css

Requested by

Host: www.google.com
URL: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LdhgBgUAAAAAILakhHCM8iL5pygGB4jLnJbJFfq&co=aHR0cHM6Ly93d3cubWFuZGlhbnQuY29tOjQ0Mw..&hl=de&v=duyHVVR9Brf6N2GewjkPRfsA&size=compact&cb=dlf6ccdnmjv

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

caf2650aa985d277b2dd131a6261888bc64e6c9bc15e5564bfb9b380bcf82a10

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Thu, 08 Sep 2022 15:28:46 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 4023
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 24251
x-xss-protection: 0
last-modified: Fri, 02 Sep 2022 18:40:58 GMT
server: sffe
cross-origin-opener-policy: same-origin-allow-popups; report-to="recaptcha"
vary: Accept-Encoding
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type: text/css
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Fri, 08 Sep 2023 15:28:46 GMT

GET
H3 200 recaptcha__de.js Show response
www.gstatic.com/recaptcha/releases/duyHVVR9Brf6N2GewjkPRfsA/ Frame 0489 392 KB
156 KB 65ms
36ms Script
text/javascript 2a00:1450:4001:803::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/recaptcha/releases/duyHVVR9Brf6N2GewjkPRfsA/recaptcha__de.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cbea10abc6a4fb6c6db32f7ff91d4e53f496579268f4f28e4e15f14c76cdd088

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Thu, 08 Sep 2022 16:05:07 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1842
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 159560
x-xss-protection: 0
last-modified: Fri, 02 Sep 2022 18:40:58 GMT
server: sffe
cross-origin-opener-policy: same-origin-allow-popups; report-to="recaptcha"
vary: Accept-Encoding
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Fri, 08 Sep 2023 16:05:07 GMT

GET
H2 200 amplitude-8.18.1-min.gz.js Show response
cdn.amplitude.com/libs/ 92 KB
25 KB 62ms
9ms Script
application/javascript 52.222.206.178
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.amplitude.com/libs/amplitude-8.18.1-min.gz.js
Requested by: Host: cdn.jsdelivr.net
URL: https://cdn.jsdelivr.net/npm/@amplitude/amplitude-js-gtm@2.0.2/dist/index.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.222.206.178 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-222-206-178.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: bc639c48fbda7a7d1edd028852cd024851965e1e80c9a43f460687ce92ffd991

Request headers

Referer: https://www.mandiant.com/
Origin: https://www.mandiant.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Tue, 31 May 2022 18:33:31 GMT
content-encoding: gzip
vary: Origin,Access-Control-Request-Headers,Access-Control-Request-Method
age: 8632939
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 25443
access-control-allow-origin: *
last-modified: Wed, 06 Apr 2022 01:05:30 GMT
server: AmazonS3
etag: "c3ec696faef16420de280b85d83e117f"
access-control-max-age: 3000
access-control-allow-methods: GET, HEAD
x-amz-version-id: II_SYzym81QVleeRt9SdBWN0SkU4nVoj
via: 1.1 4360596ad590d8363ce70eb7bf282e42.cloudfront.net (CloudFront)
cache-control: max-age=31536000
x-amz-cf-pop: FRA56-P3
accept-ranges: bytes
content-type: application/javascript
x-amz-cf-id: _yMFWdZmPoW1YiPkiFjX9dX1Djbs1ONgIYE6T_vTizS5MyY7ivntmw==

GET
H3 200 styles__ltr.css
www.gstatic.com/recaptcha/releases/duyHVVR9Brf6N2GewjkPRfsA/ Frame E44B 52 KB
24 KB 38ms
22ms Stylesheet
text/css 2a00:1450:4001:803::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/recaptcha/releases/duyHVVR9Brf6N2GewjkPRfsA/styles__ltr.css

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

caf2650aa985d277b2dd131a6261888bc64e6c9bc15e5564bfb9b380bcf82a10

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Thu, 08 Sep 2022 15:28:46 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 4023
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 24251
x-xss-protection: 0
last-modified: Fri, 02 Sep 2022 18:40:58 GMT
server: sffe
cross-origin-opener-policy: same-origin-allow-popups; report-to="recaptcha"
vary: Accept-Encoding
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type: text/css
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Fri, 08 Sep 2023 15:28:46 GMT

GET
H3 200 recaptcha__de.js Show response
www.gstatic.com/recaptcha/releases/duyHVVR9Brf6N2GewjkPRfsA/ Frame E44B 392 KB
156 KB 64ms
47ms Script
text/javascript 2a00:1450:4001:803::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/recaptcha/releases/duyHVVR9Brf6N2GewjkPRfsA/recaptcha__de.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cbea10abc6a4fb6c6db32f7ff91d4e53f496579268f4f28e4e15f14c76cdd088

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Thu, 08 Sep 2022 16:05:07 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1842
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 159560
x-xss-protection: 0
last-modified: Fri, 02 Sep 2022 18:40:58 GMT
server: sffe
cross-origin-opener-policy: same-origin-allow-popups; report-to="recaptcha"
vary: Accept-Encoding
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Fri, 08 Sep 2023 16:05:07 GMT

GET
H2 200 forms2.min.js Show response
www2.mandiant.com/js/forms2/js/ Frame F9AE 208 KB
69 KB 30ms
29ms Script
application/x-javascript 104.17.73.206
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www2.mandiant.com/js/forms2/js/forms2.min.js

Requested by

Host: www2.mandiant.com
URL: https://www2.mandiant.com/index.php/form/XDFrame

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

104.17.73.206 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b3fb9332b030dc33a418be1bcd7282c9052c287fb923bd36295cb3d01db9a861

Security Headers

Name	Value
Strict-Transport-Security	max-age=63113904
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www2.mandiant.com/index.php/form/XDFrame
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Thu, 08 Sep 2022 16:35:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
last-modified: Sat, 27 Aug 2022 03:51:24 GMT
server: cloudflare
age: 3479
etag: "2d603a0-33e56-5e730f1cff1e9"
strict-transport-security: max-age=63113904
content-type: application/x-javascript; charset=utf-8
cache-control: public, max-age=14400
cf-ray: 747919784d969164-FRA
vary: Accept-Encoding
expires: Thu, 08 Sep 2022 20:35:49 GMT

GET
H2 200 S6uyw4BMUTPHjx4wXg.woff2
fonts.gstatic.com/s/lato/v23/ Frame 4B29 23 KB
24 KB 59ms
16ms Font
font/woff2 2a00:1450:4001:801::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/lato/v23/S6uyw4BMUTPHjx4wXg.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Lato

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:801::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

918b7dc3e2e2d015c16ce08b57bcb64d2253bafc1707658f361e72865498e537

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://www.mandiant.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Tue, 06 Sep 2022 17:08:09 GMT
x-content-type-options: nosniff
age: 170860
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 23580
x-xss-protection: 0
last-modified: Tue, 26 Apr 2022 15:48:56 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 06 Sep 2023 17:08:09 GMT

POST
H2 200 / Show response
api.amplitude.com/ 7 B
205 B 180ms
179ms XHR
text/html 54.71.80.26
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://api.amplitude.com/

Requested by

Host: cdn.amplitude.com
URL: https://cdn.amplitude.com/libs/amplitude-8.18.1-min.gz.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.71.80.26 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-54-71-80-26.us-west-2.compute.amazonaws.com

Software

Resource Hash

aee408847d35e44e99430f0979c3357b85fe8dbb4535a494301198adbee85f27

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000

Request headers

Referer: https://www.mandiant.com/
Cross-Origin-Resource-Policy: cross-origin
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8

Response headers

access-control-allow-origin: *
date: Thu, 08 Sep 2022 16:35:49 GMT
trace-id: Root=1-631a19e5-4fd915b6428cbd552fa9cc9d
content-length: 7
strict-transport-security: max-age=15768000
access-control-allow-methods: GET, POST
content-type: text/html;charset=utf-8

OPTIONS
H2 200 /
api.amplitude.com/ Frame 0
0 559ms
174ms Preflight 54.71.80.26
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://api.amplitude.com/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.71.80.26 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-54-71-80-26.us-west-2.compute.amazonaws.com

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000

Request headers

Accept: */*
Access-Control-Request-Headers: cross-origin-resource-policy
Access-Control-Request-Method: POST
Origin: https://www.mandiant.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

access-control-allow-headers: cross-origin-resource-policy
access-control-allow-methods: GET, POST
access-control-allow-origin: *
content-length: 0
date: Thu, 08 Sep 2022 16:35:49 GMT
strict-transport-security: max-age=15768000

GET
DATA 200
OK truncated
/ Frame E44B 14 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 0964d141519db34adc6aa127a33dbc6761cda1e56b584ea402082d99c44afb9e

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ Frame E44B 2 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 43ef4025567f7a15859b5252b6ccc1efe2ff8c7331b1aefbea7ce88eb5084d27

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 logo_48.png
www.gstatic.com/recaptcha/api2/ Frame E44B 2 KB
2 KB 13ms
13ms Image
image/png 2a00:1450:4001:803::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.gstatic.com/recaptcha/api2/logo_48.png

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/duyHVVR9Brf6N2GewjkPRfsA/styles__ltr.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1b9efb22c938500971aac2b2130a475fa23684dd69e43103894968df83145b8a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.gstatic.com/recaptcha/releases/duyHVVR9Brf6N2GewjkPRfsA/styles__ltr.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Thu, 01 Sep 2022 19:40:09 GMT
x-content-type-options: nosniff
age: 593740
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2228
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin-allow-popups; report-to="recaptcha"
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type: image/png
cache-control: public, max-age=604800
accept-ranges: bytes
expires: Thu, 08 Sep 2022 19:40:09 GMT

GET
H3 200 KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v18/ Frame E44B 15 KB
15 KB 43ms
13ms Font
font/woff2 2a00:1450:4001:801::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v18/KFOmCnqEu92Fr1Mu4mxK.woff2

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3e253b66056519aa065b00a453bac37ac5ed8f3e6fe7b542e93a9dcdcc11d0bc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.google.com/
Origin: https://www.google.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Tue, 06 Sep 2022 11:18:05 GMT
x-content-type-options: nosniff
age: 191864
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15344
x-xss-protection: 0
last-modified: Mon, 16 Oct 2017 17:32:55 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Wed, 06 Sep 2023 11:18:05 GMT

GET
H3 200 webworker.js
www.google.com/recaptcha/api2/ Frame 0489 102 B
134 B 24ms
24ms Other
text/javascript 2a00:1450:4001:80f::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/webworker.js?hl=de&v=duyHVVR9Brf6N2GewjkPRfsA

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

3444cd05f786fc062fcb5c164604566935c9c5b25706eeab6189b3a0f37d058d

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LdhgBgUAAAAAILakhHCM8iL5pygGB4jLnJbJFfq&co=aHR0cHM6Ly93d3cubWFuZGlhbnQuY29tOjQ0Mw..&hl=de&v=duyHVVR9Brf6N2GewjkPRfsA&size=compact&cb=dlf6ccdnmjv
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Thu, 08 Sep 2022 16:35:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: GSE
cross-origin-embedder-policy: require-corp
x-frame-options: SAMEORIGIN
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=300
content-security-policy: frame-ancestors 'self'
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 112
x-xss-protection: 1; mode=block
expires: Thu, 08 Sep 2022 16:35:49 GMT

GET
H3 200 webworker.js
www.google.com/recaptcha/api2/ Frame E44B 102 B
134 B 26ms
25ms Other
text/javascript 2a00:1450:4001:80f::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/webworker.js?hl=de&v=duyHVVR9Brf6N2GewjkPRfsA

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

3444cd05f786fc062fcb5c164604566935c9c5b25706eeab6189b3a0f37d058d

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LdhgBgUAAAAAILakhHCM8iL5pygGB4jLnJbJFfq&co=aHR0cHM6Ly93d3cubWFuZGlhbnQuY29tOjQ0Mw..&hl=de&v=duyHVVR9Brf6N2GewjkPRfsA&size=normal&cb=r26u3lmkmztr
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Thu, 08 Sep 2022 16:35:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: GSE
cross-origin-embedder-policy: require-corp
x-frame-options: SAMEORIGIN
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=300
content-security-policy: frame-ancestors 'self'
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 112
x-xss-protection: 1; mode=block
expires: Thu, 08 Sep 2022 16:35:49 GMT

GET
H3 200 bframe Show response
www.google.com/recaptcha/api2/ Frame 8F68 7 KB
1 KB 28ms
27ms Document
text/html 2a00:1450:4001:80f::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/bframe?hl=de&v=duyHVVR9Brf6N2GewjkPRfsA&k=6LdhgBgUAAAAAILakhHCM8iL5pygGB4jLnJbJFfq

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/duyHVVR9Brf6N2GewjkPRfsA/recaptcha__de.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

87aa5de3d10ef71ae9c736a0590d85f55fbafa00c297581696deed464664aea8

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-ScKcRycKVf7JkCZKI8I3nw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.mandiant.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: no-cache, no-store, max-age=0, must-revalidate
content-encoding: gzip
content-length: 1114
content-security-policy: script-src 'report-sample' 'nonce-ScKcRycKVf7JkCZKI8I3nw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Thu, 08 Sep 2022 16:35:49 GMT
expires: Mon, 01 Jan 1990 00:00:00 GMT
pragma: no-cache
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server: GSE
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

GET
H3 200 bframe Show response
www.google.com/recaptcha/api2/ Frame 5A78 7 KB
1 KB 27ms
26ms Document
text/html 2a00:1450:4001:80f::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/bframe?hl=de&v=duyHVVR9Brf6N2GewjkPRfsA&k=6LdhgBgUAAAAAILakhHCM8iL5pygGB4jLnJbJFfq

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/duyHVVR9Brf6N2GewjkPRfsA/recaptcha__de.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

172b1f78bd8c49f8108c0e1d4e4a3fe5ee635653d4827d12d6914f6e4be4edc8

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-sOe9TyRTpB3x9K_leAK9lg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.mandiant.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: no-cache, no-store, max-age=0, must-revalidate
content-encoding: gzip
content-length: 1113
content-security-policy: script-src 'report-sample' 'nonce-sOe9TyRTpB3x9K_leAK9lg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Thu, 08 Sep 2022 16:35:49 GMT
expires: Mon, 01 Jan 1990 00:00:00 GMT
pragma: no-cache
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server: GSE
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

GET
H3 200 styles__ltr.css
www.gstatic.com/recaptcha/releases/duyHVVR9Brf6N2GewjkPRfsA/ Frame 8F68 52 KB
24 KB 16ms
13ms Stylesheet
text/css 2a00:1450:4001:803::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/recaptcha/releases/duyHVVR9Brf6N2GewjkPRfsA/styles__ltr.css

Requested by

Host: www.google.com
URL: https://www.google.com/recaptcha/api2/bframe?hl=de&v=duyHVVR9Brf6N2GewjkPRfsA&k=6LdhgBgUAAAAAILakhHCM8iL5pygGB4jLnJbJFfq

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

caf2650aa985d277b2dd131a6261888bc64e6c9bc15e5564bfb9b380bcf82a10

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Thu, 08 Sep 2022 15:28:46 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 4023
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 24251
x-xss-protection: 0
last-modified: Fri, 02 Sep 2022 18:40:58 GMT
server: sffe
cross-origin-opener-policy: same-origin-allow-popups; report-to="recaptcha"
vary: Accept-Encoding
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type: text/css
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Fri, 08 Sep 2023 15:28:46 GMT

GET
H3 200 recaptcha__de.js Show response
www.gstatic.com/recaptcha/releases/duyHVVR9Brf6N2GewjkPRfsA/ Frame 8F68 392 KB
156 KB 17ms
15ms Script
text/javascript 2a00:1450:4001:803::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/recaptcha/releases/duyHVVR9Brf6N2GewjkPRfsA/recaptcha__de.js

Requested by

Host: www.google.com
URL: https://www.google.com/recaptcha/api2/bframe?hl=de&v=duyHVVR9Brf6N2GewjkPRfsA&k=6LdhgBgUAAAAAILakhHCM8iL5pygGB4jLnJbJFfq

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cbea10abc6a4fb6c6db32f7ff91d4e53f496579268f4f28e4e15f14c76cdd088

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Thu, 08 Sep 2022 16:05:07 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1842
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 159560
x-xss-protection: 0
last-modified: Fri, 02 Sep 2022 18:40:58 GMT
server: sffe
cross-origin-opener-policy: same-origin-allow-popups; report-to="recaptcha"
vary: Accept-Encoding
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Fri, 08 Sep 2023 16:05:07 GMT

GET
H3 200 styles__ltr.css
www.gstatic.com/recaptcha/releases/duyHVVR9Brf6N2GewjkPRfsA/ Frame 5A78 52 KB
24 KB 23ms
22ms Stylesheet
text/css 2a00:1450:4001:803::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/recaptcha/releases/duyHVVR9Brf6N2GewjkPRfsA/styles__ltr.css

Requested by

Host: www.google.com
URL: https://www.google.com/recaptcha/api2/bframe?hl=de&v=duyHVVR9Brf6N2GewjkPRfsA&k=6LdhgBgUAAAAAILakhHCM8iL5pygGB4jLnJbJFfq

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

caf2650aa985d277b2dd131a6261888bc64e6c9bc15e5564bfb9b380bcf82a10

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Thu, 08 Sep 2022 15:28:46 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 4023
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 24251
x-xss-protection: 0
last-modified: Fri, 02 Sep 2022 18:40:58 GMT
server: sffe
cross-origin-opener-policy: same-origin-allow-popups; report-to="recaptcha"
vary: Accept-Encoding
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type: text/css
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Fri, 08 Sep 2023 15:28:46 GMT

GET
H3 200 recaptcha__de.js Show response
www.gstatic.com/recaptcha/releases/duyHVVR9Brf6N2GewjkPRfsA/ Frame 5A78 392 KB
156 KB 24ms
23ms Script
text/javascript 2a00:1450:4001:803::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/recaptcha/releases/duyHVVR9Brf6N2GewjkPRfsA/recaptcha__de.js

Requested by

Host: www.google.com
URL: https://www.google.com/recaptcha/api2/bframe?hl=de&v=duyHVVR9Brf6N2GewjkPRfsA&k=6LdhgBgUAAAAAILakhHCM8iL5pygGB4jLnJbJFfq

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cbea10abc6a4fb6c6db32f7ff91d4e53f496579268f4f28e4e15f14c76cdd088

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Thu, 08 Sep 2022 16:05:07 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1842
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 159560
x-xss-protection: 0
last-modified: Fri, 02 Sep 2022 18:40:58 GMT
server: sffe
cross-origin-opener-policy: same-origin-allow-popups; report-to="recaptcha"
vary: Accept-Encoding
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Fri, 08 Sep 2023 16:05:07 GMT

GET
H2 200 nr-1216.min.js Show response
js-agent.newrelic.com/ 38 KB
14 KB 35ms
7ms Script
application/javascript 151.101.66.137
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://js-agent.newrelic.com/nr-1216.min.js
Requested by: Host: www.mandiant.com
URL: https://www.mandiant.com/resources/remediation-and-hardening-strategies-microsoft-365-defend-against-apt29-v13?utm_source=newsletter&utm_medium=email&utm_campaign=threat_intelligence&utm_content=all&utm_term=en&cid=global&mkt_tok=NTY1LVBFSS05NTIAAAGGvNlzn0jgaUADPeckarP9ryGyW8FymW2g6eWg1XVwVBbl60tKrgiSQKdwVqQqaI8C0VvT1IsNg0j0L-kqO_ozuVvIL8ODVs6b40IVTjo
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.66.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 6f973e7d75a7e6f6e59708f19631c8890034db5debb4d04f189deb53c114e708

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.mandiant.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

x-amz-version-id: mHHzJIqOizHibcYt0xqAszRr0gQRiNYy
content-encoding: gzip
etag: "9f533d8cd24b2c5e3b4dc886ecbd43e8"
x-amz-request-id: KBVH2PMAKMG74HWE
x-cache: HIT
cross-origin-resource-policy: cross-origin
content-length: 14391
x-amz-id-2: c40g0/PEOypibNZhpK4f4SlPZCSnAXuxKGtJ+LI/kKMS0hiuLcfL6ykVCP/ylzTky574I1FuVPM=
x-served-by: cache-fra19122-FRA
last-modified: Thu, 14 Apr 2022 16:45:57 GMT
server: AmazonS3
x-timer: S1662654950.768527,VS0,VE0
date: Thu, 08 Sep 2022 16:35:49 GMT
vary: Accept-Encoding
content-type: application/javascript
via: 1.1 varnish
cache-control: public, max-age=7200, stale-if-error=604800
accept-ranges: bytes
x-cache-hits: 2152

GET
H2 200 init Show response
ff.d41.co/v1/ 46 B
820 B 706ms
581ms Fetch
application/json 2.22.89.193
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://ff.d41.co/v1/init?req=vff4596

Requested by

Host: cdn-0.d41.co
URL: https://cdn-0.d41.co/tags/ff-3.min.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.22.89.193 Vienna, Austria, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a2-22-89-193.deploy.static.akamaitechnologies.com

Software

Resource Hash

9453dce18bd894b83c8d961c9ef7eb8ec8f21e9f432d22e330a8c79852bd4747

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000 ; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.mandiant.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 08 Sep 2022 16:35:50 GMT
referrer-policy: no-referrer-when-downgrade
expect-ct: max-age=30, report-uri="https://a54b4ab95d40a8b116fae47033b75682.report-uri.com/r/d/ct/reportOnly"
x-frame-options: SAMEORIGIN
content-type: application/json
access-control-allow-origin: *
x-xss-protection: 1
cache-control: no-cache, no-store, max-age=0
strict-transport-security: max-age=15768000 ; includeSubDomains
content-length: 46
x-content-type-options: nosniff
expires: 0

GET
H3 200 collect
www.google-analytics.com/ 35 B
55 B 13ms
13ms Image
image/gif 2a00:1450:4001:809::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j96&a=1715937013&t=event&ni=1&_s=1&dl=https%3A%2F%2Fwww.mandiant.com%2Fresources%2Fremediation-and-hardening-strategies-microsoft-365-defend-against-apt29-v13%3Futm_source%3Dnewsletter%26utm_medium%3Demail%26utm_campaign%3Dthreat_intelligence%26utm_content%3Dall%26utm_term%3Den%26cid%3Dglobal%26mkt_tok%3DNTY1LVBFSS05NTIAAAGGvNlzn0jgaUADPeckarP9ryGyW8FymW2g6eWg1XVwVBbl60tKrgiSQKdwVqQqaI8C0VvT1IsNg0j0L-kqO_ozuVvIL8ODVs6b40IVTjo&dr=https%3A%2F%2Fpages.mandiant.com%2F&ul=en-us&de=UTF-8&dt=Remediation%20and%20Hardening%20Strategies%20for%20Microsoft%20365%20to%20Defend%20Against%20APT29%20(v1.3)%20%7C%20Mandiant&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=Resource%20Type&ea=white%20paper&el=Remediation%20and%20Hardening%20Strategies%20for%20Microsoft%20365%20to%20Defend%20Against%20APT29%20(v1.3)&_u=aHgAgAAB~&cid=747046914.1662654956&tid=UA-203244293-1&_gid=1617555743.1662654957&gtm=2wg8v0T72STLD&cg1=white%20paper&cg2=resources&cd3=1662654956966.6wb9a803&cd4=2022-09-08T16%3A35%3A56.966%2B00%3A00&cd5=https%3A%2F%2Fpages.mandiant.com%2F&cd6=1016&cd14=global&cd15=null&cd16=null&gcs=G100&cd1=747046914.1662654956&z=313225880

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.mandiant.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 07 Sep 2022 21:31:57 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 68632
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 200 collect
www.google-analytics.com/ 35 B
55 B 13ms
13ms Image
image/gif 2a00:1450:4001:809::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j96&a=1715937013&t=event&ni=1&_s=1&dl=https%3A%2F%2Fwww.mandiant.com%2Fresources%2Fremediation-and-hardening-strategies-microsoft-365-defend-against-apt29-v13%3Futm_source%3Dnewsletter%26utm_medium%3Demail%26utm_campaign%3Dthreat_intelligence%26utm_content%3Dall%26utm_term%3Den%26cid%3Dglobal%26mkt_tok%3DNTY1LVBFSS05NTIAAAGGvNlzn0jgaUADPeckarP9ryGyW8FymW2g6eWg1XVwVBbl60tKrgiSQKdwVqQqaI8C0VvT1IsNg0j0L-kqO_ozuVvIL8ODVs6b40IVTjo&dr=https%3A%2F%2Fpages.mandiant.com%2F&ul=en-us&de=UTF-8&dt=Remediation%20and%20Hardening%20Strategies%20for%20Microsoft%20365%20to%20Defend%20Against%20APT29%20(v1.3)%20%7C%20Mandiant&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=page%20scroll&ea=25%25&el=%2Fresources%2Fremediation-and-hardening-strategies-microsoft-365-defend-against-apt29-v13&_u=aHgAgAAB~&cid=747046914.1662654956&tid=UA-203244293-1&_gid=1205893966.1662654957&gtm=2wg8v0T72STLD&cg1=white%20paper&cg2=resources&cd2=Event&cd3=1662654956975.tydyaylj&cd4=2022-09-08T16%3A35%3A56.975%2B00%3A00&cd5=https%3A%2F%2Fpages.mandiant.com%2F&cd6=1016&cd14=global&cd15=null&cd16=null&gcs=G100&cd1=747046914.1662654956&z=117466828

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.mandiant.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 07 Sep 2022 21:31:57 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 68632
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK NRJS-890ead692fb1e944fb6 Show response
bam.nr-data.net/1/ 49 B
616 B 181ms
148ms Script
text/javascript 162.247.241.14
NEWRELIC-AS-1

General

Check archive.org

Show headers Download Go to

Full URL: https://bam.nr-data.net/1/NRJS-890ead692fb1e944fb6?a=1404479750&v=1216.487a282&to=YlRVYERZV0ZSWhINX1sedldCUVZbHEwID15aRlk%3D&rst=3372&ck=1&ref=https://www.mandiant.com/resources/remediation-and-hardening-strategies-microsoft-365-defend-against-apt29-v13&ap=289&be=1061&fe=3325&dc=1562&perf=%7B%22timing%22:%7B%22of%22:1662654953635,%22n%22:0,%22f%22:1,%22dn%22:1,%22dne%22:16,%22c%22:16,%22s%22:23,%22ce%22:46,%22rq%22:47,%22rp%22:901,%22rpe%22:902,%22dl%22:1037,%22di%22:1561,%22ds%22:1562,%22de%22:1576,%22dc%22:3325,%22l%22:3325,%22le%22:3329%7D,%22navigation%22:%7B%7D%7D&fp=1257&fcp=1257&at=ThNWFgxDREg%3D&jsonp=NREUM.setToken
Requested by: Host: js-agent.newrelic.com
URL: https://js-agent.newrelic.com/nr-1216.min.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 162.247.241.14 , United States, ASN23467 (NEWRELIC-AS-1, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b91234b576455d66e12dd661a2539eb2418a831078ecef9ebc7f4bbd4e580d9c

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.mandiant.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

Date: Thu, 08 Sep 2022 16:35:49 GMT
Content-Encoding: gzip
CF-Cache-Status: DYNAMIC
Server: cloudflare
Vary: Accept-Encoding
access-control-allow-methods: GET, POST, PUT, HEAD, OPTIONS
Content-Type: text/javascript
Access-Control-Allow-Origin: *
Transfer-Encoding: chunked
Cross-Origin-Resource-Policy: cross-origin
Connection: keep-alive
access-control-allow-credentials: true
CF-Ray: 7479197c6bdf6939-FRA

GET
H/1.1 204
No Content /
vff4596.d41.co/sync/ 0
0 489ms
106ms Fetch 3.211.46.194
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://vff4596.d41.co/sync/

Requested by

Host: cdn-0.d41.co
URL: https://cdn-0.d41.co/tags/ff-3.min.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

3.211.46.194 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-3-211-46-194.compute-1.amazonaws.com

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.mandiant.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 08 Sep 2022 16:35:50 GMT
Referrer-Policy: no-referrer-when-downgrade
Expect-CT: max-age=30, report-uri="https://a54b4ab95d40a8b116fae47033b75682.report-uri.com/r/d/ct/reportOnly"
X-Frame-Options: SAMEORIGIN
Connection: keep-alive
access-control-allow-origin: https://www.mandiant.com
Cache-control: no-store
access-control-allow-credentials: true
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-XSS-Protection: 1; mode=block

GET
H/1.1 200
OK dnb_coretag_v4.min.js Show response
cdn-0.d41.co/tags/ 74 KB
75 KB 21ms
20ms Script
application/javascript 99.86.240.68
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn-0.d41.co/tags/dnb_coretag_v4.min.js
Requested by: Host: cdn-0.d41.co
URL: https://cdn-0.d41.co/tags/ff-3.min.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.240.68 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-240-68.vie50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 52c766d175703482411d165b1339220aac1167e3315b792928eb51de6d6b3183

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.mandiant.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

Date: Thu, 08 Sep 2022 16:31:27 GMT
Via: 1.1 a01b7aca64c6d4b437b814f64422d6c8.cloudfront.net (CloudFront)
Last-Modified: Thu, 18 Nov 2021 14:57:32 GMT
Server: AmazonS3
Age: 298
ETag: "c5b0d60b7c887bcae6d8897835a15d14"
X-Cache: Hit from cloudfront
Content-Type: application/javascript
Connection: keep-alive
X-Amz-Cf-Pop: VIE50-C1
Accept-Ranges: bytes
Content-Length: 76079
X-Amz-Cf-Id: jIG_Y3Y5EtWeq_6MILkR7pt3et4H5bI3X-5QK2qVFmITMK8tOtwfbQ==

GET
H/1.1 200
OK api Show response
vff4596.d41.co/ 55 B
607 B 420ms
115ms Fetch
application/json 3.211.46.194
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://vff4596.d41.co/api?req=vff4596&form=json

Requested by

Host: cdn-0.d41.co
URL: https://cdn-0.d41.co/tags/dnb_coretag_v4.min.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

3.211.46.194 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-3-211-46-194.compute-1.amazonaws.com

Software

Resource Hash

5a66b400ed3590731f8335b4bd05758241ff8a9641da75a262e7112ffe0aff57

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.mandiant.com/resources/remediation-and-hardening-strategies-microsoft-365-defend-against-apt29-v13?utm_source=newsletter&utm_medium=email&utm_campaign=threat_intelligence&utm_content=all&utm_term=en&cid=global&mkt_tok=NTY1LVBFSS05NTIAAAGGvNlzn0jgaUADPeckarP9ryGyW8FymW2g6eWg1XVwVBbl60tKrgiSQKdwVqQqaI8C0VvT1IsNg0j0L-kqO_ozuVvIL8ODVs6b40IVTjo
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 08 Sep 2022 16:35:51 GMT
Referrer-Policy: no-referrer-when-downgrade
Expect-CT: max-age=30, report-uri="https://a54b4ab95d40a8b116fae47033b75682.report-uri.com/r/d/ct/reportOnly"
X-Frame-Options: SAMEORIGIN
Connection: keep-alive
Content-Type: application/json
access-control-allow-origin: https://www.mandiant.com
Cache-control: no-store
access-control-allow-credentials: true
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Length: 55
X-XSS-Protection: 1; mode=block

POST
H3 204 collect
region1.google-analytics.com/g/ 0
17 B 50ms
18ms Ping
text/plain 2001:4860:4802:32::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://region1.google-analytics.com/g/collect?v=2&tid=G-X6642ZTDJ7&gtm=2oe8v0&_p=1715937013&gcs=G100&cid=747046914.1662654956&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_z=ccd.v9B&sid=1662654955&sct=1&seg=0&dl=https%3A%2F%2Fwww.mandiant.com%2Fresources%2Fremediation-and-hardening-strategies-microsoft-365-defend-against-apt29-v13%3Futm_source%3Dnewsletter%26utm_medium%3Demail%26utm_campaign%3Dthreat_intelligence%26utm_content%3Dall%26utm_term%3Den%26cid%3Dglobal%26mkt_tok%3DNTY1LVBFSS05NTIAAAGGvNlzn0jgaUADPeckarP9ryGyW8FymW2g6eWg1XVwVBbl60tKrgiSQKdwVqQqaI8C0VvT1IsNg0j0L-kqO_ozuVvIL8ODVs6b40IVTjo&dr=https%3A%2F%2Fpages.mandiant.com%2F&dt=Remediation%20and%20Hardening%20Strategies%20for%20Microsoft%20365%20to%20Defend%20Against%20APT29%20(v1.3)%20%7C%20Mandiant&_s=2
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-X6642ZTDJ7&l=dataLayer&cx=c
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2001:4860:4802:32::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.mandiant.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Thu, 08 Sep 2022 16:35:54 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.mandiant.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: www.google.com
URL: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LdhgBgUAAAAAILakhHCM8iL5pygGB4jLnJbJFfq&co=aHR0cHM6Ly93d3cubWFuZGlhbnQuY29tOjQ0Mw..&hl=de&v=duyHVVR9Brf6N2GewjkPRfsA&size=normal&cb=r26u3lmkmztr

Domain: www.google.com
URL: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LdhgBgUAAAAAILakhHCM8iL5pygGB4jLnJbJFfq&co=aHR0cHM6Ly93d3cubWFuZGlhbnQuY29tOjQ0Mw..&hl=de&v=duyHVVR9Brf6N2GewjkPRfsA&size=compact&cb=dlf6ccdnmjv

Verdicts & Comments Add Verdict or Comment

81 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

11 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.pages.mandiant.com/	1970-01-20 05:50:56	Name: __cf_bm Value: hFhMdEgENJE2pF5YBA_ITRyyEUy8nx5I417jbMbte7U-1662654946-0-Aa2/YyEm5hiCJx5GCHVkIENrP3RdpcKWDXhQthlq5XOORIOzgqonDnDU+MvtKi//9gaBqR26bRD+f7f7DfQ/gvs=
.mandiant.com/	1970-01-20 05:50:56	Name: __cf_bm Value: GFmjbN_n7E.6dkG01fRiOwr7w_5ywNMNFnsDDZYJq_E-1662654947-0-AWslSpU6kjtSgmJ/WmhWGrRA3vzDokOc2tMhVgeR84XJE48J/LkposNkc5QZym0sUB2xxROao4moOFAa67/+qJA=
www.mandiant.com/	1969-12-31 23:59:59	Name: utm_source Value: newsletter
www.mandiant.com/	1969-12-31 23:59:59	Name: utm_medium Value: email
www.mandiant.com/	1969-12-31 23:59:59	Name: utm_campaign Value: threat_intelligence
www.mandiant.com/	1969-12-31 23:59:59	Name: utm_content Value: all
.www.mandiant.com/	1970-01-20 14:36:30	Name: OptanonConsent Value: isGpcEnabled=0&datestamp=Thu+Sep+08+2022+16%3A35%3A55+GMT%2B0000+(GMT)&version=6.39.0&isIABGlobal=false&hosts=&landingPath=https%3A%2F%2Fwww.mandiant.com%2Fresources%2Fremediation-and-hardening-strategies-microsoft-365-defend-against-apt29-v13%3Futm_source%3Dnewsletter%26utm_medium%3Demail%26utm_campaign%3Dthreat_intelligence%26utm_content%3Dall%26utm_term%3Den%26cid%3Dglobal%26mkt_tok%3DNTY1LVBFSS05NTIAAAGGvNlzn0jgaUADPeckarP9ryGyW8FymW2g6eWg1XVwVBbl60tKrgiSQKdwVqQqaI8C0VvT1IsNg0j0L-kqO_ozuVvIL8ODVs6b40IVTjo&groups=C0001%3A1%2CC0002%3A0%2CC0004%3A0
www2.mandiant.com/	1969-12-31 23:59:59	Name: BIGipServerab24web-nginx-app_https Value: !U64QTg2KCj26EZbn/+ZT2Dlakae2C+0tg/2+tjOMPfdf/zHBWBf1jrFAuBEfxXSaxof/0qMo7eCe+fM=
.www2.mandiant.com/	1970-01-20 05:50:56	Name: __cf_bm Value: JEgi1MQiEho_A_daB3xOxtM06GIVUpGp32aaSK.mvKI-1662654949-0-AX5DolXQgy9BPnapjPYdupz+dCNqlvtQLskcbOvn/9q0DCf/4TzlWIYx8ZUmtpbD8Dtjo4Psp/oW/lBpwQhRToc=
.mandiant.com/	1970-01-20 14:36:30	Name: amp_00f43d Value: NdxK-jBDdlkwk9_GAf6qHr...1gcevagud.1gcevaguf.1.0.1
.nr-data.net/	1969-12-31 23:59:59	Name: JSESSIONID Value: 34f4f51b0ad97288

3 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
security	error	URL: https://pages.mandiant.com/NTY1LVBFSS05NTIAAAGGvNlzn-wDYZs6D7NBs3dT3fhZh_68-ftf8G9A8b8WRKCql9C8QKz2aWa1rbstQV9P__WJVcU= Message: The Content-Security-Policy directive name 'form-action:'none'' contains one or more invalid characters. Only ASCII alphanumeric characters or dashes '-' are allowed in directive names.
security	error	URL: https://pages.mandiant.com/NTY1LVBFSS05NTIAAAGGvNlzn-wDYZs6D7NBs3dT3fhZh_68-ftf8G9A8b8WRKCql9C8QKz2aWa1rbstQV9P__WJVcU= Message: The Content-Security-Policy directive name 'frame-src:'none'' contains one or more invalid characters. Only ASCII alphanumeric characters or dashes '-' are allowed in directive names.
security	warning	Message: Error with Permissions-Policy header: Origin trial controlled feature not enabled: 'interest-cohort'.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	default-src 'self'; img-src 'self';script-src 'self' 'sha256-CdkPGEVo0YuFk6HnE42qVWK5LhR59a6Ncz8XHGLzVbQ=';object-src 'none';form-action:'none';frame-src:'none'
X-Frame-Options	SAMEORIGIN

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

api.amplitude.com
bam.nr-data.net
cdn-0.d41.co
cdn.amplitude.com
cdn.cookielaw.org
cdn.jsdelivr.net
cdnjs.cloudflare.com
ff.d41.co
fonts.googleapis.com
fonts.gstatic.com
geolocation.onetrust.com
hi.hellobar.com
js-agent.newrelic.com
my.hellobar.com
pages.mandiant.com
region1.google-analytics.com
static.addtoany.com
vff4596.d41.co
www.google-analytics.com
www.google.com
www.googletagmanager.com
www.gstatic.com
www.mandiant.com
www2.mandiant.com
www.google.com
104.17.73.206
104.17.74.206
151.101.66.137
162.247.241.14
2.22.89.193
2001:4860:4802:32::36
2600:9000:223e:4e00:1b:45dc:7080:93a1
2606:4700:10::ac43:2794
2606:4700:10::ac43:2be9
2606:4700:300b::a29f:f17d
2606:4700:4400::6812:2962
2606:4700::6810:9440
2606:4700::6811:190e
2a00:1450:4001:801::2003
2a00:1450:4001:803::2003
2a00:1450:4001:809::200e
2a00:1450:4001:80b::2008
2a00:1450:4001:80f::2004
2a00:1450:4001:812::200a
2a04:4e42:400::485
3.211.46.194
52.222.206.178
54.71.80.26
99.86.240.68
00c6bd032ff6549a7be00d51ddfe36cc85926512474ee1d99f32eb8390e5890a
0964d141519db34adc6aa127a33dbc6761cda1e56b584ea402082d99c44afb9e
0b617a1a9d405a304eae1f3337639a1be619633a047ccac0a61d70cf2d2032e4
0d1049d86e454e70f1d3e650f3ec7dc009ebef2f7ec2e9f44b74cb290ed9e4d6
0ee46c9dbbd635715a927765ea65b9fa2b2669b54926a20678ccfa84108818c6
0f2e61cd1a10aebb0eae1a2f6914784a4d9be90a46b1c67700311d0f66d3e379
13a35f6809ebd06635401be41681b52dd7f36d45fd6624e75ab5ce909419d427
14c8c62dc692fd8faa04434e3fed25e7c23d596b732f9db88f6e9f9ff5dfa61c
14e4d1596c6b58896dfce1fc1ec45372bab4d2259ba82828fa3f96cc4f859fc4
172b1f78bd8c49f8108c0e1d4e4a3fe5ee635653d4827d12d6914f6e4be4edc8
18089c9cfddb60950415ae993e56f1d027fd533edeb5189ef7845cfb33e69f12
1b9efb22c938500971aac2b2130a475fa23684dd69e43103894968df83145b8a
1bb508d41bf1d0c5d56340c7df789b6589350a5f967e1fa937bee5c148d0cb0d
1c5adf6a6caf57816242bb03499debdfba1e829f21adfec24a2402989313426a
22d544d04a6282b544aa3fbc8e024e41f00902673fe34f774092c02d4e7d6712
256e42104f48a5fa80b031da12dc56acde224fba3f9810f8f8192b39136d365a
284fd9124834b2f8325d11267bfccd673bfa1d6fa8d1f0bb23b77d061c090e29
2cde386ff9fa8a2542805e34ca86981ae2891d3db7b20955179309c4b0488c98
2e08feab1a7c8daf3e743919af0aa076e41fb8ff6a40f57c9fbd411fd396aea1
2eb59661110bf387b0b9e1a92d4fe59ce1d84879dba3ac474a73680c81bf4273
331852fd9912583b03043c973d33d23b2711924f3731bd8bcd31b7000a6d4a60
3444cd05f786fc062fcb5c164604566935c9c5b25706eeab6189b3a0f37d058d
36925e7859abeeb8681d694d702e00b1fbba6f37ac49b11e8f863ed24507ca6a
3e253b66056519aa065b00a453bac37ac5ed8f3e6fe7b542e93a9dcdcc11d0bc
43ef4025567f7a15859b5252b6ccc1efe2ff8c7331b1aefbea7ce88eb5084d27
462bedbbfd7b747cad8b84a79da7a1657ab077f37e266c66a3f600e4a97e6cc3
49b9b4996d1ff0a8e3de643a0c623255bf631f298f2799b949c29de93926ee7a
4c10ba944a22db97145f142b93216d96358e5232295b636f6b423c3a063c393b
4ca130786a2d2531241f8b8c7aaad6a4e27271f51b417b9c23f51bfb0c65c080
52c766d175703482411d165b1339220aac1167e3315b792928eb51de6d6b3183
541ac58217a8ade1a5e292a65a0661dc9db7a49ae13654943817a4fbc6761afd
58fa444d11a5c62f8ed07c5c0903933a3678fa8a8c8347160103a9416a9ae191
5a66b400ed3590731f8335b4bd05758241ff8a9641da75a262e7112ffe0aff57
5a9f9b8fdda3dc64dc104281767edc8ce0798cd76bfc307c17a7c7b4db115c86
5c1730bd98278b80f2e3ddb024475b1c70a7fea5648390aa34d229f5e3dd3ea9
61e7a7943f7444e87b2af6295044b34292a537a23dd3d9436886e3a2ccf620ca
6a7fe2bdd3bae545939363a511ac5aae9f36bdf8bf84b03c01d7cfc808adad0b
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992
6b9c3158d7700a96a2fc4de59adc0c4724338c900d14b9447653c52d50df1621
6f973e7d75a7e6f6e59708f19631c8890034db5debb4d04f189deb53c114e708
6fba5ed9a21a948a1edf9f018055a8ed911df83da750fcb24177e2a3c539a085
74d1f7e06069feded1f0c7c2c8a35b5c5194f66ff98d7b4309446effd0495728
7b7eb2b28fbf8ad29058540ee28e8b49701e0e47351ff25d3b688fcef9b2a88a
81aef51db61703a8c1679c5ace0b7858b463b1b8554935df6efc4e631a98eaeb
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
853f77de90385806427ff0cd0ac797795adbd82c800c26381f7e55537e736587
85812e1f30e98e63c3ea17a4a7bea7cc0c26b8edef9c48d0af517fecd45210c7
860f45e645e33a50a9a34186d5c0558df4198829fe98679a4a6e1e754fca1aeb
87aa5de3d10ef71ae9c736a0590d85f55fbafa00c297581696deed464664aea8
887dea1b760d630afcbae650e3259dc18ef1a7fe3137ab715a56005a69f921b0
918b7dc3e2e2d015c16ce08b57bcb64d2253bafc1707658f361e72865498e537
9453dce18bd894b83c8d961c9ef7eb8ec8f21e9f432d22e330a8c79852bd4747
98d7c4fe1604e08c228b1c8756ccfed58659528670ee420520d157e3787b9f6a
9ca72eec4efadc4587d29f2216ccd9cd54309463c74a5a3029b3dca9485f995a
9ec192b1be13b5eb7d11e7c8a0f1466ef236e4ba88182bb4cec76a2c7919464e
9f41b6056bfd2eb59371fabdc40b3970f02458ee463aa92385fe214fb00aebae
a09d0f89e99cf5a081315ff701187632005dabd23f3ca116a75790003faa7e8f
a1925038db769477ab74b4df34350c35688a795bb718727b0f4292a4a78a6210
aee408847d35e44e99430f0979c3357b85fe8dbb4535a494301198adbee85f27
b07cb957eaf8435eda0630d67e6dbe47848e292ef839465a63b7e6ab792834b9
b2cb383a30bee467e40ecebb49e4229b1b57efcc2c7632c921cd170a75c74d24
b3fb9332b030dc33a418be1bcd7282c9052c287fb923bd36295cb3d01db9a861
b91234b576455d66e12dd661a2539eb2418a831078ecef9ebc7f4bbd4e580d9c
b964f75cb8c613e484743bf4daaac6efc65c74156fca95cd76ca15d742555d1d
bbc4456bca95006683a8f081d0d2ed645eef5b14c62eca12c70f7e1cec26c1a0
bc639c48fbda7a7d1edd028852cd024851965e1e80c9a43f460687ce92ffd991
bf204863b72594d7da599f0ad2cfb43573b91d2ef348983d8890f64ba9858d1e
c82aa23b61483cc87f28ec6c4492a28c46dcb38bf471fd4a6ca40984ee6fb59e
caf2650aa985d277b2dd131a6261888bc64e6c9bc15e5564bfb9b380bcf82a10
cbea10abc6a4fb6c6db32f7ff91d4e53f496579268f4f28e4e15f14c76cdd088
cfbbb6a8bb9482b6bddbba133d70d9ac28fea886ede20ecdaf3110d5c70dba6c
d342feac235fe9a18504e5b6e5ef98c7b7e0ea60cc7bc0176fd47b5cea2ff2dd
db311174b0e3c340727b63c055cfb5b317808e909503e1bda11cc58af444f12b
dfaed587b938cc953c5008f257ed1e661e9d2e2f907bd5b520fc4b9348985a88
e0ba033e6cb25fa6e20186d6d8113cc3821028b7891c93eebe671b75f6eebc3f
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e3c4f02f1f6a5e491336064c0d0bdcd6914d5794a431a359c1f684cec8ed77f7
e7bab450e59999517ef38a5b8bb176f3ca0c89126090906e3ab4f5da945a5f59
ec604e9e30666db4d3c932f9507a95321b9e6f27ff4054f6e1ae29f1a501233c
f16edf69b3b38abc839a83da5041cb4b2ed08b54017faa471b4e2da1cc8393c1
f269cafacd48c650b7c76973b7192a4593125d9b957bfa3b57a89e835ec0df1f
fb6bcf7d9261064812fe1b4d2b59b8c8ca52b7d0c522746ba9cec2dc01b3a7d4
fe3bfdac05de97234a1a81c7f09c87f14708cf7bd9a341a63e68613c3c6e40d6

www.mandiant.com Open in urlscan Pro 2606:4700:300b::a29f:f17d Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

96 Requests

98 %HTTPS

63 %IPv6

16 Domains

24 Subdomains

25 IPs

4 Countries

2752 kBTransfer

6440 kBSize

11 Cookies

16 Outgoing links

Page URL History

Redirected requests

96 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 4 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

www.mandiant.com Open in urlscan Pro
2606:4700:300b::a29f:f17d Public Scan

Screenshot
Live screenshot

Full Image

96
Requests

98 %
HTTPS

63 %
IPv6

16
Domains

24
Subdomains

25
IPs

4
Countries

2752 kB
Transfer

6440 kB
Size

11
Cookies

96 HTTP transactions
4 data transactions