www.group-ib.com Open in urlscan Pro
3.72.181.255  Public Scan

16 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

1. https://www.group-ib.com/blog/qilin-ransomware/ Page URL
2. https://www.group-ib.com/blog/qilin-ransomware/ Page URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 103

• https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=4496601&time=1696881518978&url=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fqilin-ransomware%2F&tm=gtmv2 HTTP 302
• https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=4496601&time=1696881518978&url=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fqilin-ransomware%2F&tm=gtmv2&cookiesTest=true HTTP 302
• https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D4496601%26time%3D1696881518978%26url%3Dhttps%253A%252F%252Fwww.group-ib.com%252Fblog%252Fqilin-ransomware%252F%26tm%3Dgtmv2%26cookiesTest%3Dtrue%26liSync%3Dtrue HTTP 302
• https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=4496601&time=1696881518978&url=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fqilin-ransomware%2F&tm=gtmv2&cookiesTest=true&liSync=true HTTP 302
• https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=4496601&time=1696881518978&url=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fqilin-ransomware%2F&tm=gtmv2&cookiesTest=true&liSync=true&e_ipv6=AQKMjYiGrG5prAAAAYsWBS0nqqgQjQOrQb5WI8JHPcP_XAYRemhFBiOQXKOoXIsIWd5-NnOJRcSN2A

Request Chain 105

• https://mc.yandex.com/sync_cookie_image_check HTTP 302
• https://mc.yandex.ru/sync_cookie_image_start?redirect_domain=mc.yandex.com&token=10151.oy7oRzlmfPd-VYJhtKuJZczYuEOBC3y6K8lElRKbtrpeXDs_r68GOP3rmIvYjODe.c8ty-bTMHiH_0CpPHsRVX5KfADM%2C HTTP 302
• https://mc.yandex.com/sync_cookie_image_decide?token=10151.kzqw0iTY-3QlRwoHDMgPb8BU0vBD34XmgRqW52vllyzSPs7vKxuf-4HHCPPhl67nXHWYGqB7jzm_TI1UiuEkG8Sel72RJZW35fSNpW9sBmw%2C.1Em5bQVOKZYuliExYk-gARFLINI%2C

Request Chain 122

• https://mc.yandex.com/watch/26812653?wmode=7&page-url=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fqilin-ransomware%2F&charset=utf-8&site-info=%7B%22shareVersion%22%3A2%2C%22strategy%22%3A%22d%2Fn%2Fq%2Fr%2Fs%2Ft%22%7D&uah=chm%0A%3F0&browser-info=pv%3A1%3Avf%3A3qm6qq812ez2u52y4wzrnbv%3Afp%3A765%3Afu%3A1%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A1135%3Acn%3A1%3Adp%3A0%3Als%3A431258551813%3Ahid%3A1028384477%3Az%3A120%3Ai%3A20231009215839%3Aet%3A1696881519%3Ac%3A1%3Arn%3A836330897%3Arqn%3A1%3Au%3A1696881519625480292%3Aw%3A1600x1200%3As%3A1600x1200x24%3Ask%3A1%3Awv%3A2%3Ads%3A0%2C0%2C83%2C46%2C0%2C0%2C%2C825%2C19%2C%2C%2C%2C996%3Aco%3A0%3Acpf%3A1%3Ans%3A1696881517585%3Aadb%3A2%3Arqnl%3A1%3Ast%3A1696881519%3At%3AGain%20new-found%20insights%20into%20Qilin%20Ransomware%2C%20their%20Data%20Leak%20Site%20(DLS)%20and%20operations%20targeting%20critical%20industries%20%7C%20Group-IB%20Blog&t=gdpr(14)clc(0-0-0)rqnt(1)aw(1)ti(2) HTTP 302
• https://mc.yandex.com/watch/26812653/1?wmode=7&page-url=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fqilin-ransomware%2F&charset=utf-8&site-info=%7B%22shareVersion%22%3A2%2C%22strategy%22%3A%22d%2Fn%2Fq%2Fr%2Fs%2Ft%22%7D&uah=chm%0A%3F0&browser-info=pv%3A1%3Avf%3A3qm6qq812ez2u52y4wzrnbv%3Afp%3A765%3Afu%3A1%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A1135%3Acn%3A1%3Adp%3A0%3Als%3A431258551813%3Ahid%3A1028384477%3Az%3A120%3Ai%3A20231009215839%3Aet%3A1696881519%3Ac%3A1%3Arn%3A836330897%3Arqn%3A1%3Au%3A1696881519625480292%3Aw%3A1600x1200%3As%3A1600x1200x24%3Ask%3A1%3Awv%3A2%3Ads%3A0%2C0%2C83%2C46%2C0%2C0%2C%2C825%2C19%2C%2C%2C%2C996%3Aco%3A0%3Acpf%3A1%3Ans%3A1696881517585%3Aadb%3A2%3Arqnl%3A1%3Ast%3A1696881519%3At%3AGain%20new-found%20insights%20into%20Qilin%20Ransomware%2C%20their%20Data%20Leak%20Site%20%28DLS%29%20and%20operations%20targeting%20critical%20industries%20%7C%20Group-IB%20Blog&t=gdpr%2814%29clc%280-0-0%29rqnt%281%29aw%281%29ti%282%29&redirnss=1

Request Chain 129

• https://mc.yandex.com/sync_cookie_image_check_secondary HTTP 302
• https://mc.yandex.ru/sync_cookie_image_start_secondary?redirect_domain=mc.yandex.com&token=10151.ehBJl6LVWP0-GSeQrC9Izj9oLlgxMovK1KPkIDwM2LQAr_HRrFTDyTqD4t-kMnOZ.EVfR7EF4a-rZnBADWDoTjWW4oC0%2C HTTP 302
• https://mc.yandex.com/sync_cookie_image_decide_secondary?token=10151.SqhNqWiC6AOyC9eISrF5H3rT51ReHRvlJdwB69q4M3FTVbveMcWJglgvwnYoXldRSaFrIyzIcicsn_V1RFQoepgUCf9ATnP6Q_n5zcgT4vI%2C.3IFYzzLlmx94Im47LDASgiwyU0g%2C

137 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
15 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	403	/ Show response www.group-ib.com/blog/qilin-ransomware/	7 KB 7 KB	148ms 32ms	Document text/html	3.72.181.255 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://www.group-ib.com/blog/qilin-ransomware/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 3.72.181.255 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-3-72-181-255.eu-central-1.compute.amazonaws.com Software / Resource Hash 28be45759207b8d80bcee5058b5102eff890679da3dfeeaf6494d59e77dec893 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers cache-control no-cache, no-store, must-revalidate content-type text/html date Mon, 09 Oct 2023 19:58:35 GMT
GET H/1.1	200 OK	bt-autoinject.js Show response fhp-de-js.group-ib.com/d/	347 KB 137 KB	160ms 69ms	Script text/javascript	136.243.23.169 HETZNER-AS
General Check archive.org Show headers Download Go to Full URL https://fhp-de-js.group-ib.com/d/bt-autoinject.js Requested by Host: www.group-ib.com URL: https://www.group-ib.com/blog/qilin-ransomware/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 136.243.23.169 Falkenstein, Germany, ASN24940 (HETZNER-AS, DE), Reverse DNS static.169.23.243.136.clients.your-server.de Software nginx / Resource Hash 23c5779be5752ac8dac9a86632277f8b8dfc256130ddfe3211c50da9357ba930 Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers Date Mon, 09 Oct 2023 19:58:35 GMT Content-Encoding gzip Server nginx Transfer-Encoding chunked Vary Accept-Encoding Content-Type text/javascript; charset=UTF-8 Access-Control-Allow-Methods GET, POST, OPTIONS x-envoy-upstream-service-time 1 Access-Control-Allow-Credentials true Connection keep-alive Access-Control-Allow-Headers Accept,DNT,Keep-Alive,User-Agent,If-Modified-Since,Cache-Control,Content-Type,Origin,ETag,If-None-Match,X-Cfids,Authorization
GET DATA	200 OK	truncated /	485 B 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 0df12105d6dcd692241e8bdb1446f185d52e80a4e96979f0e56798ce1219d5b3 Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	4 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 996f38ec327c36ce238d8bc42646d1e28013444393d9552adda2c84b764f94f7 Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers Content-Type image/png
GET H2	200	idgib-w-61354c22-16cc-40a8-a871-6901f1a76e24 Show response www.group-ib.com/api/fl/	205 B 684 B	59ms 58ms	XHR application/json	3.72.181.255 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://www.group-ib.com/api/fl/idgib-w-61354c22-16cc-40a8-a871-6901f1a76e24 Requested by Host: fhp-de-js.group-ib.com URL: https://fhp-de-js.group-ib.com/d/bt-autoinject.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 3.72.181.255 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-3-72-181-255.eu-central-1.compute.amazonaws.com Software nginx / Resource Hash 928f65067e1555963efb29cc106c60851dd6165b7695ab9553ca726a90c36535 Request headers Referer https://www.group-ib.com/blog/qilin-ransomware/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 x-cfids - Response headers date Mon, 09 Oct 2023 19:58:36 GMT content-encoding gzip server nginx etag W/"1Sv6xhpw9sJ659RKDKGNsVD6NGFN3K7jkenKTRvMO64HYC/dFZNdXffVbeH5OFwmvwcxgDKExyQ6DrRhjLGYoyEpbkeGkZ4MA+dbKX6dKGKXbXUg+cKugZILe0E7t3YCfFORP68dHpvZnvimRYz0KGHR" vary Accept-Encoding content-type application/json; charset=utf-8 cache-control no-cache x-envoy-upstream-service-time 1
POST H2	200	fl www.group-ib.com/api/	665 B 985 B	170ms 164ms	XHR application/json	3.72.181.255 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://www.group-ib.com/api/fl?u=a00d6350-66c0-11ee-a8a5-2b520884db60&cfidsgib-w-61354c22-16cc-40a8-a871-6901f1a76e24=1Sv6xhpw9sJ659RKDKGNsVD6NGFN3K7jkenKTRvMO64HYC%2FdFZNdXffVbeH5OFwmvwcxgDKExyQ6DrRhjLGYoyEpbkeGkZ4MA%2BdbKX6dKGKXbXUg%2BcKugZILe0E7t3YCfFORP68dHpvZnvimRYz0KGHR Requested by Host: fhp-de-js.group-ib.com URL: https://fhp-de-js.group-ib.com/d/bt-autoinject.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 3.72.181.255 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-3-72-181-255.eu-central-1.compute.amazonaws.com Software nginx / Resource Hash Request headers Referer https://www.group-ib.com/blog/qilin-ransomware/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Content-Type text/plain;charset=UTF-8 Response headers date Mon, 09 Oct 2023 19:58:37 GMT content-encoding gzip server nginx vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS content-type application/json; charset=utf-8 access-control-allow-origin https://www.group-ib.com cache-control no-store access-control-allow-credentials true x-envoy-upstream-service-time 6 access-control-allow-headers Accept,DNT,Keep-Alive,User-Agent,If-Modified-Since,Cache-Control,Content-Type,Origin,ETag,If-None-Match,X-Cfids,Authorization
POST H2	200	fl www.group-ib.com/api/	665 B 692 B	82ms 81ms	Ping application/json	3.72.181.255 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://www.group-ib.com/api/fl?u=a00d6350-66c0-11ee-a8a5-2b520884db60&cfidsgib-w-61354c22-16cc-40a8-a871-6901f1a76e24=GUidcNPfMyCuHpIh1bhLVaZpwyVBoIOER%2F%2BvrWFRFIwmBZ3Irsqn%2B4rztuHRbrMlC72lWLmMaHjEjykpzdxHu0e2Imeqt87gZ%2BLDwNvZ436vdsh%2FiN4X2riMttK%2FdAQtMsAtSM%2Bh78I0cWYiYMx%2Fn40K6KoqmRVpp6gz Requested by Host: fhp-de-js.group-ib.com URL: https://fhp-de-js.group-ib.com/d/bt-autoinject.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 3.72.181.255 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-3-72-181-255.eu-central-1.compute.amazonaws.com Software nginx / Resource Hash Request headers Referer https://www.group-ib.com/blog/qilin-ransomware/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Content-Type text/plain;charset=UTF-8 Response headers date Mon, 09 Oct 2023 19:58:37 GMT content-encoding gzip server nginx vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS content-type application/json; charset=utf-8 access-control-allow-origin https://www.group-ib.com cache-control no-store access-control-allow-credentials true x-envoy-upstream-service-time 1 access-control-allow-headers Accept,DNT,Keep-Alive,User-Agent,If-Modified-Since,Cache-Control,Content-Type,Origin,ETag,If-None-Match,X-Cfids,Authorization
GET H2	200	Primary Request / Show response www.group-ib.com/blog/qilin-ransomware/	93 KB 20 KB	83ms 83ms	Document text/html	3.72.181.255 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://www.group-ib.com/blog/qilin-ransomware/ Requested by Host: www.group-ib.com URL: https://www.group-ib.com/blog/qilin-ransomware/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 3.72.181.255 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-3-72-181-255.eu-central-1.compute.amazonaws.com Software nginx / Resource Hash 7df6841c6478c6434e3739c2253b89af0201ff3f717ace4fc6e66efc68faab04 Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers Referer https://www.group-ib.com/blog/qilin-ransomware/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers accept-ranges bytes access-control-allow-origin https://www.group-ib.com cache-control private, max-age=3600 content-encoding gzip content-length 19877 content-security-policy frame-ancestors 'self'; content-type text/html; charset=UTF-8 date Mon, 09 Oct 2023 19:58:37 GMT etag "4ce3-60747366b6b44" last-modified Mon, 09 Oct 2023 11:51:37 GMT permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() referrer-policy strict-origin-when-cross-origin server nginx strict-transport-security max-age=31536000; includeSubDomains vary X-Forwarded-Proto,Accept-Encoding,Cookie x-content-type-options nosniff x-frame-options sameorigin x-xss-protection 1; mode=block
GET H/1.1	200 OK	bt-autoinject.js Show response fhp-de-js.group-ib.com/d/	347 KB 137 KB	86ms 85ms	Script text/javascript	136.243.23.169 HETZNER-AS
General Check archive.org Show headers Download Go to Full URL https://fhp-de-js.group-ib.com/d/bt-autoinject.js Requested by Host: www.group-ib.com URL: https://www.group-ib.com/blog/qilin-ransomware/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 136.243.23.169 Falkenstein, Germany, ASN24940 (HETZNER-AS, DE), Reverse DNS static.169.23.243.136.clients.your-server.de Software nginx / Resource Hash 23c5779be5752ac8dac9a86632277f8b8dfc256130ddfe3211c50da9357ba930 Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers Date Mon, 09 Oct 2023 19:58:37 GMT Content-Encoding gzip Server nginx Transfer-Encoding chunked Vary Accept-Encoding Content-Type text/javascript; charset=UTF-8 Access-Control-Allow-Methods GET, POST, OPTIONS x-envoy-upstream-service-time 1 Access-Control-Allow-Credentials true Connection keep-alive Access-Control-Allow-Headers Accept,DNT,Keep-Alive,User-Agent,If-Modified-Since,Cache-Control,Content-Type,Origin,ETag,If-None-Match,X-Cfids,Authorization
GET H2	200	lazyload.min.js Show response www.group-ib.com/wp-content/plugins/w3-total-cache/pub/js/	6 KB 2 KB	62ms 61ms	Script application/x-javascript	3.72.181.255 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://www.group-ib.com/wp-content/plugins/w3-total-cache/pub/js/lazyload.min.js Requested by Host: www.group-ib.com URL: https://www.group-ib.com/blog/qilin-ransomware/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 3.72.181.255 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-3-72-181-255.eu-central-1.compute.amazonaws.com Software nginx / Resource Hash 1a54a1907a6443e3c81608130bfed4546eb0ce5d0c8897e1d7a3b43d89ecc367 Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/blog/qilin-ransomware/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; content-encoding gzip x-content-type-options nosniff date Mon, 09 Oct 2023 19:58:37 GMT strict-transport-security max-age=31536000; includeSubDomains content-length 2356 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Thu, 29 Jun 2023 07:01:06 GMT server nginx etag "1883-5ff3f43abc651-gzip" vary X-Forwarded-Proto,Accept-Encoding x-frame-options sameorigin content-type application/x-javascript access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes expires Mon, 09 Oct 2023 20:28:37 GMT
GET H2	200	swiper-bundle.min.js Show response website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/js/	140 KB 39 KB	181ms 107ms	Script application/x-javascript	2600:9000:2156:f000:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/js/swiper-bundle.min.js Requested by Host: www.group-ib.com URL: https://www.group-ib.com/blog/qilin-ransomware/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:2156:f000:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash b624e1e378abe009ef0de69a698b0a3e734af47efcdbd6816d5fcb8fc64c8bfe Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; content-encoding gzip x-content-type-options nosniff date Mon, 09 Oct 2023 19:58:37 GMT via 1.1 632ee301c4920b52f2463aa9e978c57e.cloudfront.net (CloudFront) strict-transport-security max-age=31536000; includeSubDomains x-amz-cf-pop FRA50-C1 x-cache Miss from cloudfront content-length 39504 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Mon, 05 Sep 2022 07:41:14 GMT server nginx etag "22ede-5e7e9344df9f2-gzip" x-frame-options sameorigin vary Accept-Encoding content-type application/x-javascript access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id q0GGM6AECeZWQ6FJvbT0ltvu9KSX8_Ox3mCrnF18M2HeQNPdLpA5OA== expires Mon, 09 Oct 2023 20:28:37 GMT
GET H2	200	classic-themes.min.css website.cdn.group-ib.com/wp-includes/css/	217 B 1008 B	120ms 47ms	Stylesheet text/css	2600:9000:2156:f000:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://website.cdn.group-ib.com/wp-includes/css/classic-themes.min.css Requested by Host: www.group-ib.com URL: https://www.group-ib.com/blog/qilin-ransomware/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:2156:f000:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash 5a5f39391fbf5b06db84b8f9716d53de575ee97a627d2c5f12f79a991a671eb5 Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; content-encoding gzip x-content-type-options nosniff date Mon, 09 Oct 2023 19:58:37 GMT via 1.1 632ee301c4920b52f2463aa9e978c57e.cloudfront.net (CloudFront) strict-transport-security max-age=31536000; includeSubDomains x-amz-cf-pop FRA50-C1 x-cache Miss from cloudfront content-length 189 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Fri, 11 Nov 2022 11:58:50 GMT server nginx etag "d9-5ed309cf15c82-gzip" x-frame-options sameorigin vary Accept-Encoding content-type text/css access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id -wb-hHHaUevzL8Web9HnwP9FVI_XGSsUUSrzNI1RWJY5NSk2ZweJGA== expires Mon, 09 Oct 2023 20:28:37 GMT
GET H2	200	dashicons.min.css website.cdn.group-ib.com/wp-includes/css/	58 KB 36 KB	134ms 61ms	Stylesheet text/css	2600:9000:2156:f000:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://website.cdn.group-ib.com/wp-includes/css/dashicons.min.css Requested by Host: www.group-ib.com URL: https://www.group-ib.com/blog/qilin-ransomware/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:2156:f000:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash c21e5a2b32c47bc5f9d9efc97bc0e29fd081946d1d3ebffc5621cfafb1d3960e Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; content-encoding gzip x-content-type-options nosniff date Mon, 09 Oct 2023 19:58:37 GMT via 1.1 632ee301c4920b52f2463aa9e978c57e.cloudfront.net (CloudFront) strict-transport-security max-age=31536000; includeSubDomains x-amz-cf-pop FRA50-C1 x-cache Miss from cloudfront content-length 35730 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Fri, 10 Jun 2022 07:03:36 GMT server nginx etag "e688-5e112897ec200-gzip" x-frame-options sameorigin vary Accept-Encoding content-type text/css access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id yv9Zjt7htvBGkCzgCm1kpHXpq1tU00VHfOJjx-JRa1gFxEjIsJllrA== expires Mon, 09 Oct 2023 20:28:37 GMT
GET H2	200	frontend.min.css www.group-ib.com/wp-content/plugins/post-views-counter/css/	215 B 310 B	60ms 59ms	Stylesheet text/css	3.72.181.255 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://www.group-ib.com/wp-content/plugins/post-views-counter/css/frontend.min.css Requested by Host: www.group-ib.com URL: https://www.group-ib.com/blog/qilin-ransomware/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 3.72.181.255 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-3-72-181-255.eu-central-1.compute.amazonaws.com Software nginx / Resource Hash ed70c2cf61d0f24d03299ffc5896c7abd86bb858501987dc10e3afec086c01df Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/blog/qilin-ransomware/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; content-encoding gzip x-content-type-options nosniff date Mon, 09 Oct 2023 19:58:37 GMT strict-transport-security max-age=31536000; includeSubDomains content-length 160 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Wed, 26 Apr 2023 07:26:40 GMT server nginx etag "d7-5fa38293ec798-gzip" vary X-Forwarded-Proto,Accept-Encoding x-frame-options sameorigin content-type text/css access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes expires Mon, 09 Oct 2023 20:28:37 GMT
GET H2	200	jquery.min.js Show response website.cdn.group-ib.com/wp-includes/js/jquery/	88 KB 31 KB	170ms 97ms	Script application/x-javascript	2600:9000:2156:f000:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://website.cdn.group-ib.com/wp-includes/js/jquery/jquery.min.js Requested by Host: www.group-ib.com URL: https://www.group-ib.com/blog/qilin-ransomware/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:2156:f000:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash cc7403bab52ed166e24ea9324241045af370be482f5b594468f4a6ac6e7e7981 Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; content-encoding gzip x-content-type-options nosniff date Mon, 09 Oct 2023 19:58:37 GMT via 1.1 632ee301c4920b52f2463aa9e978c57e.cloudfront.net (CloudFront) strict-transport-security max-age=31536000; includeSubDomains x-amz-cf-pop FRA50-C1 x-cache Miss from cloudfront content-length 30995 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Fri, 11 Nov 2022 11:58:50 GMT server nginx etag "15e54-5ed309cf21802-gzip" x-frame-options sameorigin vary Accept-Encoding content-type application/x-javascript access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id hFhHA2JKMAdCqolBhCKQFc41xrX7NOUjMG9WGfj7XNq7MMWwyioxoA== expires Mon, 09 Oct 2023 20:28:37 GMT
GET H2	200	single-blog-post.css website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/	272 KB 39 KB	156ms 84ms	Stylesheet text/css	2600:9000:2156:f000:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-blog-post.css Requested by Host: www.group-ib.com URL: https://www.group-ib.com/blog/qilin-ransomware/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:2156:f000:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash 00f1d4b6b5497d55159aec12a7b35ad67a2a4fa6cdb1ba52788cbb7e8c32a2f8 Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; content-encoding gzip x-content-type-options nosniff date Mon, 09 Oct 2023 19:58:37 GMT via 1.1 632ee301c4920b52f2463aa9e978c57e.cloudfront.net (CloudFront) strict-transport-security max-age=31536000; includeSubDomains x-amz-cf-pop FRA50-C1 x-cache Miss from cloudfront content-length 39143 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Mon, 09 Oct 2023 19:58:32 GMT server nginx etag "43f45-6074e03c68acd-gzip" x-frame-options sameorigin vary Accept-Encoding content-type text/css access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id VJ1xMxJtb3iFq53DAHBYAoD-PLyml2N9fZsRkHeraJgo5HQcBR-V4w== expires Mon, 09 Oct 2023 20:28:37 GMT
GET H2	200	v2.js Show response js-eu1.hsforms.net/forms/	549 KB 175 KB	147ms 52ms	Script application/javascript	172.65.255.172 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://js-eu1.hsforms.net/forms/v2.js Requested by Host: www.group-ib.com URL: https://www.group-ib.com/blog/qilin-ransomware/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.65.255.172 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash a24e66d830ef814bbcc4553b662e0c2afe733f8f30fb4a86be6df577d146bec2 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers content-encoding br age 546 x-evy-trace-route-service-name envoyset-translator x-amz-server-side-encryption AES256 content-security-policy-report-only frame-ancestors 'self'; report-uri https://send.hsbrowserreports.com/csp/report?resource=forms-embed/static-1.3812/bundles/project-v2.js&cfRay=813925ba58eb5d73-FRA x-amz-replication-status COMPLETED x-evy-trace-listener listener_https etag W/"84d6c03b19ba72ee08ca8c27dee147c2" vary Accept-Encoding content-type application/javascript; charset=utf-8 access-control-allow-origin * x-evy-trace-virtual-host all cache-control s-maxage=600, max-age=300 x-hs-target-asset forms-embed/static-1.3812/bundles/project-v2.js date Mon, 09 Oct 2023 19:58:37 GMT x-amz-version-id 4b09e6_AhU37WJHx62r2StyRWH0KMlOF via 1.1 3f52d342c56014599dee37446f6c9f2e.cloudfront.net (CloudFront) x-content-type-options nosniff cf-cache-status HIT nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} strict-transport-security max-age=31536000; includeSubDomains; preload x-amz-cf-pop FRA56-P2 x-hubspot-correlation-id e23a6ffb-d2a2-4b14-aa14-2ee0f549f1d8 x-cache Hit from cloudfront cache-tag staticjsapp-forms-embed-v2-web-prod,staticjsapp-prod x-envoy-upstream-service-time 0 alt-svc h3=":443"; ma=86400 x-evy-trace-route-configuration listener_https/all x-request-id e23a6ffb-d2a2-4b14-aa14-2ee0f549f1d8 last-modified Fri, 22 Sep 2023 08:13:06 UTC server cloudflare report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=gFYGUFZq5TWzorlARC1o4P%2BQXC1vLHay1sb8MlWd61I%2BiwyFSd5JvDuw4Gz9qWxKf3DhLERGUYBU%2BVcR7OzekoQqW1b%2FZu3f7J2RmQI0kdqpOE2piiPS6osTR0%2Bhvuh6PyyadQ%3D%3D"}],"group":"cf-nel","max_age":604800} x-hs-cache-status HIT x-evy-trace-served-by-pod fra04/app-td/envoy-proxy-797758f45b-49p9l cf-ray 8139330e3f994dc6-FRA x-amz-cf-id ldUHFAm4IvVFIYrwtD7djeXS8LePWx_RH1FyrYLsoL1DLeHC9YEeCA==
GET H2	200	image6-min-3.png website.cdn.group-ib.com/wp-content/uploads/	34 KB 34 KB	340ms 327ms	Image image/png	2600:9000:2156:f000:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://website.cdn.group-ib.com/wp-content/uploads/image6-min-3.png Requested by Host: www.group-ib.com URL: https://www.group-ib.com/blog/qilin-ransomware/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:2156:f000:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash 0b1a4b4a45393316d28c5d11617fb4e0cb59187763e9784c81e59365c34b7b62 Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; date Mon, 09 Oct 2023 19:58:38 GMT x-content-type-options nosniff strict-transport-security max-age=31536000; includeSubDomains via 1.1 632ee301c4920b52f2463aa9e978c57e.cloudfront.net (CloudFront) x-amz-cf-pop FRA50-C1 x-cache Miss from cloudfront content-length 34417 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Thu, 11 May 2023 13:45:10 GMT server nginx etag "8671-5fb6b32739cd9" x-frame-options sameorigin content-type image/png access-control-allow-origin https://www.group-ib.com cache-control no-cache, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id KSOda-2eGSoXidWUMRbXyJESvqnv6weJPpVE3X-Cups_I2sZvpGMQg== expires Mon, 09 Oct 2023 19:58:37 GMT
GET H2	200	image13-min-2.png website.cdn.group-ib.com/wp-content/uploads/	61 KB 62 KB	255ms 243ms	Image image/png	2600:9000:2156:f000:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://website.cdn.group-ib.com/wp-content/uploads/image13-min-2.png Requested by Host: www.group-ib.com URL: https://www.group-ib.com/blog/qilin-ransomware/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:2156:f000:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash 08e583496d5a36568b382455df7453cb1e012c29bb27abf19bb0d830a2cd741c Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; date Mon, 09 Oct 2023 19:58:38 GMT x-content-type-options nosniff strict-transport-security max-age=31536000; includeSubDomains via 1.1 632ee301c4920b52f2463aa9e978c57e.cloudfront.net (CloudFront) x-amz-cf-pop FRA50-C1 x-cache Miss from cloudfront content-length 62479 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Thu, 11 May 2023 13:47:11 GMT server nginx etag "f40f-5fb6b39a9b7f9" x-frame-options sameorigin content-type image/png access-control-allow-origin https://www.group-ib.com cache-control no-cache, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id _QdJ6oBPNH-ua8_xq5Q2hg9DQt0I1AkUUkSdfQR8V_jzQ_NG1iDLSg== expires Mon, 09 Oct 2023 19:58:37 GMT
GET H2	200	image7-min-4.png website.cdn.group-ib.com/wp-content/uploads/	885 KB 887 KB	259ms 246ms	Image image/png	2600:9000:2156:f000:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://website.cdn.group-ib.com/wp-content/uploads/image7-min-4.png Requested by Host: www.group-ib.com URL: https://www.group-ib.com/blog/qilin-ransomware/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:2156:f000:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash afa5b6af04bd57505b0d7c973f669f3ca046715c217fb336182f11504c2daa51 Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; date Mon, 09 Oct 2023 19:58:38 GMT x-content-type-options nosniff strict-transport-security max-age=31536000; includeSubDomains via 1.1 632ee301c4920b52f2463aa9e978c57e.cloudfront.net (CloudFront) x-amz-cf-pop FRA50-C1 x-cache Miss from cloudfront content-length 906579 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Thu, 11 May 2023 13:45:39 GMT server nginx etag "dd553-5fb6b343ac2ca" x-frame-options sameorigin content-type image/png access-control-allow-origin https://www.group-ib.com cache-control no-cache, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id D1_scDrOGXboYuntYB_cmBVGF683xvmK6DyKv_5Mg1O7Uzlnsee8yQ== expires Mon, 09 Oct 2023 19:58:37 GMT
GET H2	200	image11-min-4.png website.cdn.group-ib.com/wp-content/uploads/	613 KB 614 KB	261ms 249ms	Image image/png	2600:9000:2156:f000:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://website.cdn.group-ib.com/wp-content/uploads/image11-min-4.png Requested by Host: www.group-ib.com URL: https://www.group-ib.com/blog/qilin-ransomware/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:2156:f000:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash e47d98368396fd747c791556e274e094bd4baa4321bc92a2d3a4a37b52e40950 Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; date Mon, 09 Oct 2023 19:58:38 GMT x-content-type-options nosniff strict-transport-security max-age=31536000; includeSubDomains via 1.1 632ee301c4920b52f2463aa9e978c57e.cloudfront.net (CloudFront) x-amz-cf-pop FRA50-C1 x-cache Miss from cloudfront content-length 627434 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Thu, 11 May 2023 13:46:42 GMT server nginx etag "992ea-5fb6b37f82d66" x-frame-options sameorigin content-type image/png access-control-allow-origin https://www.group-ib.com cache-control no-cache, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id UJ21Ruj0SNujg0B4sDhPnqDIxK9hWnxZkgUGLHE4IjZNUffVSkH9Eg== expires Mon, 09 Oct 2023 19:58:37 GMT
GET H2	200	image2-min-5.png website.cdn.group-ib.com/wp-content/uploads/	57 KB 58 KB	340ms 327ms	Image image/png	2600:9000:2156:f000:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://website.cdn.group-ib.com/wp-content/uploads/image2-min-5.png Requested by Host: www.group-ib.com URL: https://www.group-ib.com/blog/qilin-ransomware/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:2156:f000:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash 05ab6cdacca29f4f6d1bcb82058e126006278e644c02ec92b3cb78cffec88f6a Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; date Mon, 09 Oct 2023 19:58:38 GMT x-content-type-options nosniff strict-transport-security max-age=31536000; includeSubDomains via 1.1 632ee301c4920b52f2463aa9e978c57e.cloudfront.net (CloudFront) x-amz-cf-pop FRA50-C1 x-cache Miss from cloudfront content-length 58315 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Thu, 11 May 2023 13:43:52 GMT server nginx etag "e3cb-5fb6b2dd8831f" x-frame-options sameorigin content-type image/png access-control-allow-origin https://www.group-ib.com cache-control no-cache, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id q_uqk8OAMiqLtXIuJQ0p6HDTzyH7M3OsKpd1j8tcScFoF-uauFlbBw== expires Mon, 09 Oct 2023 19:58:37 GMT
GET H2	200	image15-min-3.png website.cdn.group-ib.com/wp-content/uploads/	59 KB 60 KB	255ms 243ms	Image image/png	2600:9000:2156:f000:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://website.cdn.group-ib.com/wp-content/uploads/image15-min-3.png Requested by Host: www.group-ib.com URL: https://www.group-ib.com/blog/qilin-ransomware/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:2156:f000:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash 959c2deadf37b6c0d15e57eee0d46cb6c0617d10b5eb0e3db850ff1797778bc1 Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; date Mon, 09 Oct 2023 19:58:38 GMT x-content-type-options nosniff strict-transport-security max-age=31536000; includeSubDomains via 1.1 632ee301c4920b52f2463aa9e978c57e.cloudfront.net (CloudFront) x-amz-cf-pop FRA50-C1 x-cache Miss from cloudfront content-length 60406 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Thu, 11 May 2023 13:47:36 GMT server nginx etag "ebf6-5fb6b3b2a8d8d" x-frame-options sameorigin content-type image/png access-control-allow-origin https://www.group-ib.com cache-control no-cache, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id -A2KHPInl4DajeTA0iT53kN7jlhdW_11WZmjHgBI85wB8ZCAFVmk-Q== expires Mon, 09 Oct 2023 19:58:37 GMT
GET H2	200	image1-min-4.png website.cdn.group-ib.com/wp-content/uploads/	13 KB 13 KB	337ms 325ms	Image image/png	2600:9000:2156:f000:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://website.cdn.group-ib.com/wp-content/uploads/image1-min-4.png Requested by Host: www.group-ib.com URL: https://www.group-ib.com/blog/qilin-ransomware/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:2156:f000:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash 55e8cd22566e74d45bdd8408261dd928f2e8df08b2fd8b1f426db45838140a74 Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; date Mon, 09 Oct 2023 19:58:38 GMT x-content-type-options nosniff strict-transport-security max-age=31536000; includeSubDomains via 1.1 632ee301c4920b52f2463aa9e978c57e.cloudfront.net (CloudFront) x-amz-cf-pop FRA50-C1 x-cache Miss from cloudfront content-length 13011 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Thu, 11 May 2023 13:43:44 GMT server nginx etag "32d3-5fb6b2d611064" x-frame-options sameorigin content-type image/png access-control-allow-origin https://www.group-ib.com cache-control no-cache, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id 8Lz7qwEOsIk5WqmrnZ7t5z5ER9xtSXEF4mB_Ap6JFe0ewQ2mvZI2-Q== expires Mon, 09 Oct 2023 19:58:37 GMT
GET H2	200	image8-min-3.png website.cdn.group-ib.com/wp-content/uploads/	24 KB 25 KB	259ms 247ms	Image image/png	2600:9000:2156:f000:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://website.cdn.group-ib.com/wp-content/uploads/image8-min-3.png Requested by Host: www.group-ib.com URL: https://www.group-ib.com/blog/qilin-ransomware/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:2156:f000:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash 828f08de39c99c1919f1616dd671422283cea69755aa5eb016feacb7aeaf8b67 Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; date Mon, 09 Oct 2023 19:58:38 GMT x-content-type-options nosniff strict-transport-security max-age=31536000; includeSubDomains via 1.1 632ee301c4920b52f2463aa9e978c57e.cloudfront.net (CloudFront) x-amz-cf-pop FRA50-C1 x-cache Miss from cloudfront content-length 24969 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Thu, 11 May 2023 13:45:46 GMT server nginx etag "6189-5fb6b349bdea8" x-frame-options sameorigin content-type image/png access-control-allow-origin https://www.group-ib.com cache-control no-cache, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id i3izvuKfkPa65x1SA0Ng-NkD0gpICUyag3iLz5Lpd57UDIklv1dERw== expires Mon, 09 Oct 2023 19:58:37 GMT
GET H2	200	image10-min-3.png website.cdn.group-ib.com/wp-content/uploads/	832 KB 834 KB	256ms 245ms	Image image/png	2600:9000:2156:f000:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://website.cdn.group-ib.com/wp-content/uploads/image10-min-3.png Requested by Host: www.group-ib.com URL: https://www.group-ib.com/blog/qilin-ransomware/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:2156:f000:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash 75a5ed669422f3c3a97096aff66b25ba9cccd5d3440f04a2820081600542ff0b Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; date Mon, 09 Oct 2023 19:58:38 GMT x-content-type-options nosniff strict-transport-security max-age=31536000; includeSubDomains via 1.1 632ee301c4920b52f2463aa9e978c57e.cloudfront.net (CloudFront) x-amz-cf-pop FRA50-C1 x-cache Miss from cloudfront content-length 852390 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Thu, 11 May 2023 13:46:24 GMT server nginx etag "d01a6-5fb6b36e1e99c" x-frame-options sameorigin content-type image/png access-control-allow-origin https://www.group-ib.com cache-control no-cache, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id BB38CsU4Z-KvbCPHec3GT50qOezlgXKXNB8yTPMqoQrCpsENHco11Q== expires Mon, 09 Oct 2023 19:58:37 GMT
GET H2	200	image9-min-3.png website.cdn.group-ib.com/wp-content/uploads/	987 KB 989 KB	297ms 285ms	Image image/png	2600:9000:2156:f000:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://website.cdn.group-ib.com/wp-content/uploads/image9-min-3.png Requested by Host: www.group-ib.com URL: https://www.group-ib.com/blog/qilin-ransomware/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:2156:f000:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash e659032ac83f42c1686fbc64b34ed2c111edb178865389db73d6094c381893f2 Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; date Mon, 09 Oct 2023 19:58:38 GMT x-content-type-options nosniff strict-transport-security max-age=31536000; includeSubDomains via 1.1 632ee301c4920b52f2463aa9e978c57e.cloudfront.net (CloudFront) x-amz-cf-pop FRA50-C1 x-cache Miss from cloudfront content-length 1011068 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Thu, 11 May 2023 13:46:06 GMT server nginx etag "f6d7c-5fb6b35d60620" x-frame-options sameorigin content-type image/png access-control-allow-origin https://www.group-ib.com cache-control no-cache, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id ElywMXp0som_Hi1ejlKflJd07u5mKWsAkBqD3HEO2m2yhGJbpSXAGg== expires Mon, 09 Oct 2023 19:58:37 GMT
GET H2	200	main.js Show response website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/js/	212 KB 46 KB	257ms 246ms	Script application/x-javascript	2600:9000:2156:f000:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/js/main.js Requested by Host: www.group-ib.com URL: https://www.group-ib.com/blog/qilin-ransomware/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:2156:f000:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash 620418e15bd4302ca68fe0c806a6a6e74a11a7cbc56004a3e052529b73092e9b Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; content-encoding gzip x-content-type-options nosniff date Mon, 09 Oct 2023 19:58:38 GMT via 1.1 632ee301c4920b52f2463aa9e978c57e.cloudfront.net (CloudFront) strict-transport-security max-age=31536000; includeSubDomains x-amz-cf-pop FRA50-C1 x-cache Miss from cloudfront content-length 45892 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Fri, 06 Oct 2023 11:14:14 GMT server nginx etag "34e47-6070a5733757d-gzip" x-frame-options sameorigin vary Accept-Encoding content-type application/x-javascript access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id _VJlKZgUCiN0bLc5HPWZjlXIq6OisgiLogseIVGBKX8eh73RMFQoCA== expires Mon, 09 Oct 2023 20:28:38 GMT
GET H2	200	fancybox.umd.js Show response website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/libs/fancybox/	103 KB 30 KB	52ms 51ms	Script application/x-javascript	2600:9000:2156:f000:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/libs/fancybox/fancybox.umd.js Requested by Host: www.group-ib.com URL: https://www.group-ib.com/blog/qilin-ransomware/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:2156:f000:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash 942e02acf640c0308f65e057a8afaed63dfaf995034cda9cfc75532a1009ec72 Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; content-encoding gzip x-content-type-options nosniff date Mon, 09 Oct 2023 19:58:37 GMT via 1.1 632ee301c4920b52f2463aa9e978c57e.cloudfront.net (CloudFront) strict-transport-security max-age=31536000; includeSubDomains x-amz-cf-pop FRA50-C1 x-cache Miss from cloudfront content-length 29634 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Mon, 05 Sep 2022 07:24:28 GMT server nginx etag "19ca6-5e7e8f85cb376-gzip" x-frame-options sameorigin vary Accept-Encoding content-type application/x-javascript access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id 6O7Z6uP03Ba6CsoUdYxCWPkXK9910xX6BrsfuhVkjswVKJUcr1-zyg== expires Mon, 09 Oct 2023 20:28:37 GMT
GET H2	200	frontend.min.js Show response www.group-ib.com/wp-content/plugins/post-views-counter/js/	1 KB 737 B	233ms 233ms	Script application/x-javascript	3.72.181.255 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://www.group-ib.com/wp-content/plugins/post-views-counter/js/frontend.min.js Requested by Host: www.group-ib.com URL: https://www.group-ib.com/blog/qilin-ransomware/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 3.72.181.255 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-3-72-181-255.eu-central-1.compute.amazonaws.com Software nginx / Resource Hash 12475fdd5d48640d7ad60670a2342f02cf560b8cd977cf8e7e624e6a22576f82 Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/blog/qilin-ransomware/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; content-encoding gzip x-content-type-options nosniff date Mon, 09 Oct 2023 19:58:38 GMT strict-transport-security max-age=31536000; includeSubDomains content-length 628 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Wed, 26 Apr 2023 07:26:40 GMT server nginx etag "484-5fa38293ec798-gzip" vary X-Forwarded-Proto,Accept-Encoding x-frame-options sameorigin content-type application/x-javascript access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes expires Mon, 09 Oct 2023 20:28:38 GMT
GET H2	200	25755956.js Show response js-eu1.hs-scripts.com/	2 KB 1 KB	193ms 70ms	Script application/javascript	172.65.208.22 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://js-eu1.hs-scripts.com/25755956.js Requested by Host: www.group-ib.com URL: https://www.group-ib.com/blog/qilin-ransomware/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.65.208.22 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 5d551560a0a3a77f33ebd57c238f27641c0250913a6c2cde2afb8be10d2239cd Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers date Mon, 09 Oct 2023 19:58:38 GMT content-encoding br x-content-type-options nosniff cf-cache-status EXPIRED x-evy-trace-route-service-name envoyset-translator x-hubspot-correlation-id 8800465a-aab4-4226-941c-25bb92c2587a x-envoy-upstream-service-time 5 x-evy-trace-route-configuration listener_https/all x-evy-trace-listener listener_https x-request-id 8800465a-aab4-4226-941c-25bb92c2587a last-modified Mon, 09 Oct 2023 19:58:05 GMT server cloudflare x-trace 2BFBF31E952613AC2820F59E50248859F468EEFEC5000000000000000000 vary origin, Accept-Encoding access-control-max-age 3600 content-type application/javascript;charset=utf-8 access-control-allow-origin https://www.group-ib.com x-evy-trace-virtual-host all cache-control public, max-age=30 access-control-allow-credentials true x-evy-trace-served-by-pod fra04/hubapi-td/envoy-proxy-86f46d6c7b-gvdlr cf-ray 813933103e24929f-FRA
GET DATA	200 OK	truncated /	488 B 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 5c81b9afcf337d7733850a865de18ef970575d4f69a37c44a93c3f6879bf73d1 Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	4 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 5e20de4bab8fc3cb535201c41e6d4b1ec95e7775c0a139736b19c6823c49907e Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers Content-Type image/png
GET H2	200	G-font-Medium.otf website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/fonts/G-font/	60 KB 35 KB	231ms 141ms	Font application/x-font-otf	2600:9000:2156:f000:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/fonts/G-font/G-font-Medium.otf Requested by Host: website.cdn.group-ib.com URL: https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-blog-post.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:2156:f000:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash 1efe16c9efbadde5e242d88a315eca3906a55669fcd4882a904fbc723306a4e4 Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers Referer https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-blog-post.css Origin https://www.group-ib.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; content-encoding gzip x-content-type-options nosniff date Mon, 09 Oct 2023 19:58:38 GMT via 1.1 9ab847fabb8c9edbd39cff57c2a2f4c0.cloudfront.net (CloudFront) strict-transport-security max-age=31536000; includeSubDomains x-amz-cf-pop FRA50-C1 x-cache Miss from cloudfront content-length 35382 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Tue, 28 Jun 2022 07:55:26 GMT server nginx etag "eed4-5e27d5c025780-gzip" x-frame-options sameorigin vary Accept-Encoding content-type application/x-font-otf access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id RoUaOQWvvzxWNXmEiU--pzODPMLMzAbBO6Tp5BUu4-rQ26T3RgWbiQ== expires Mon, 09 Oct 2023 20:28:38 GMT
GET H2	200	G-font-Regular.otf website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/fonts/G-font/	47 KB 31 KB	333ms 244ms	Font application/x-font-otf	2600:9000:2156:f000:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/fonts/G-font/G-font-Regular.otf Requested by Host: website.cdn.group-ib.com URL: https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-blog-post.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:2156:f000:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash 6cee0fb06339ba13e1f15d044e0e4904bbeeb7fbe4351e3f102b6d80b2465061 Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers Referer https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-blog-post.css Origin https://www.group-ib.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; content-encoding gzip x-content-type-options nosniff date Mon, 09 Oct 2023 19:58:38 GMT via 1.1 9ab847fabb8c9edbd39cff57c2a2f4c0.cloudfront.net (CloudFront) strict-transport-security max-age=31536000; includeSubDomains x-amz-cf-pop FRA50-C1 x-cache Miss from cloudfront content-length 30798 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Tue, 28 Jun 2022 07:55:26 GMT server nginx etag "bbf8-5e27d5c025780-gzip" x-frame-options sameorigin vary Accept-Encoding content-type application/x-font-otf access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id SS781WZraD6EKp02HcZ1uStBietWNCSd3WplXQP3UTnzefHVd7JrnQ== expires Mon, 09 Oct 2023 20:28:38 GMT
GET H2	200	idgib-w-61354c22-16cc-40a8-a871-6901f1a76e24 Show response www.group-ib.com/api/fl/	217 B 673 B	65ms 65ms	XHR application/json	3.72.181.255 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://www.group-ib.com/api/fl/idgib-w-61354c22-16cc-40a8-a871-6901f1a76e24 Requested by Host: fhp-de-js.group-ib.com URL: https://fhp-de-js.group-ib.com/d/bt-autoinject.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 3.72.181.255 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-3-72-181-255.eu-central-1.compute.amazonaws.com Software nginx / Resource Hash 09b965a7790f8a42ad2d0b803419a56dbd9f0e2c112add9865a6bb9c293960db Request headers X-GIB-GSSCgib-w-61354c22-16cc-40a8-a871-6901f1a76e24 UjBiyatr2vjakJQ80VXVDdhfeyftfcyEEN6hKm765KWZxsjQv6AYhbJqYCsr/VvghwVZbjmb7Raq27Si5TZPDcJnCBJtuHgr9+LJ50oPAnIDlOJBOskVLfpsbOvk9n5lMfWcMlb/AlgvrW8LJ5A4n+GLMK15Lt0A4lI9yhP6vS5yGgST08XOvrV+5SCySgFGtnggmWip7MIRYQt8gv1COzsJTVEUHIvdo4JtwV6P/P70t17m8Os5HxkC08r+JA== Referer https://www.group-ib.com/blog/qilin-ransomware/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 X-GIB-FGSSCgib-w-61354c22-16cc-40a8-a871-6901f1a76e24 6tag64f793782d15a076d65fb0104f783188c0d1 x-cfids GUidcNPfMyCuHpIh1bhLVaZpwyVBoIOER/+vrWFRFIwmBZ3Irsqn+4rztuHRbrMlC72lWLmMaHjEjykpzdxHu0e2Imeqt87gZ+LDwNvZ436vdsh/iN4X2riMttK/dAQtMsAtSM+h78I0cWYiYMx/n40K6KoqmRVpp6gz Response headers date Mon, 09 Oct 2023 19:58:38 GMT content-encoding gzip server nginx etag W/"b5W6NEggc5c7ydX8iJwdBZYxs8I7o46wxvt1QwbGCBYqJOjSbd/kqWTducHNW5jBSl4P5l6dg7iGVruY7NK+2Rr7232x+P5HNvNMaJpGa6MIH5GbdNnJeDSK+zK0hfkqydkmc5Q+ue6d+I+1XMn/MGOf4pVFEGQDLDx0" vary Accept-Encoding content-type application/json; charset=utf-8 cache-control no-cache x-envoy-upstream-service-time 0
GET H/1.1	200 OK	json Show response forms-eu1.hsforms.com/embed/v3/form/25755956/044e7558-8073-478a-ad3c-5807dd76840f/	9 KB 3 KB	245ms 81ms	XHR application/json	172.65.232.43 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://forms-eu1.hsforms.com/embed/v3/form/25755956/044e7558-8073-478a-ad3c-5807dd76840f/json?hs_static_app=forms-embed&hs_static_app_version=1.3812&X-HubSpot-Static-App-Info=forms-embed-1.3812 Requested by Host: fhp-de-js.group-ib.com URL: https://fhp-de-js.group-ib.com/d/bt-autoinject.js Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 172.65.232.43 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 688dea0769f6c4bb93dfaaaa2da19f0000b4212cf88cf9a470863737ad0d54c5 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Accept application/json, text/plain, */* Referer https://www.group-ib.com/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers X-Origin-Hublet eu1 Date Mon, 09 Oct 2023 19:58:38 GMT Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff CF-Cache-Status DYNAMIC Content-Encoding br x-evy-trace-route-service-name envoyset-translator X-HubSpot-Correlation-Id e936aa4e-f290-47c1-8240-54d7525c0ffe Transfer-Encoding chunked x-envoy-upstream-service-time 7 Connection keep-alive alt-svc h3=":443"; ma=86400 x-evy-trace-route-configuration listener_https/all x-evy-trace-listener listener_https x-request-id e936aa4e-f290-47c1-8240-54d7525c0ffe Server cloudflare X-Trace 2BF54F73BD6F2FF8F1721F3D443BEEC3C5E273902F000000000000000000 Vary origin Access-Control-Allow-Methods OPTIONS, GET Content-Type application/json;charset=utf-8 Access-Control-Allow-Origin https://www.group-ib.com x-evy-trace-virtual-host all Access-Control-Expose-Headers X-Origin-Hublet Access-Control-Max-Age 180 Access-Control-Allow-Credentials false Cache-Control max-age=0, no-cache, no-store X-Robots-Tag none Access-Control-Allow-Headers * CF-RAY 813933118b8b3653-FRA x-evy-trace-served-by-pod fra04/star-hubspot-td/envoy-proxy-5cdd94655b-2886x
GET H2	200	cross.svg website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/main-nav/	342 B 1 KB	489ms 488ms	Image image/svg+xml	2600:9000:2156:f000:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/main-nav/cross.svg Requested by Host: website.cdn.group-ib.com URL: https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-blog-post.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:2156:f000:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash dfb059f8aa219769088fd6c85d85aae789f1e72bfe3d314748f1f3ccfffffb1c Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-blog-post.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; content-encoding gzip x-content-type-options nosniff date Mon, 09 Oct 2023 19:58:38 GMT via 1.1 632ee301c4920b52f2463aa9e978c57e.cloudfront.net (CloudFront) strict-transport-security max-age=31536000; includeSubDomains x-amz-cf-pop FRA50-C1 x-cache Miss from cloudfront content-length 207 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Tue, 28 Jun 2022 07:55:26 GMT server nginx etag "156-5e27d5c025780-gzip" x-frame-options sameorigin vary Accept-Encoding content-type image/svg+xml access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id Si-a2maTR-dLCAB4qdhP_1CA2PE6ybxjBsuDqmSVOPFfm54hfY8OVw== expires Mon, 09 Oct 2023 20:28:38 GMT
GET H/1.1	200 OK	json Show response forms-eu1.hsforms.com/embed/v3/form/25755956/4dbceae1-75ae-423a-9c12-dee8f1ca3345/	112 KB 30 KB	646ms 534ms	XHR application/json	172.65.232.43 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://forms-eu1.hsforms.com/embed/v3/form/25755956/4dbceae1-75ae-423a-9c12-dee8f1ca3345/json?hs_static_app=forms-embed&hs_static_app_version=1.3812&X-HubSpot-Static-App-Info=forms-embed-1.3812 Requested by Host: fhp-de-js.group-ib.com URL: https://fhp-de-js.group-ib.com/d/bt-autoinject.js Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 172.65.232.43 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 628996367d7349592c79c86db1a8a0e1b559c259eab8c721070f71e2b5cc4c9e Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Accept application/json, text/plain, */* Referer https://www.group-ib.com/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers X-Origin-Hublet eu1 Date Mon, 09 Oct 2023 19:58:38 GMT Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff CF-Cache-Status DYNAMIC Content-Encoding br x-evy-trace-route-service-name envoyset-translator X-HubSpot-Correlation-Id 3de6a7a0-ad2e-4aea-b51a-539a15f566f3 Transfer-Encoding chunked x-envoy-upstream-service-time 18 Connection keep-alive alt-svc h3=":443"; ma=86400 x-evy-trace-route-configuration listener_https/all x-evy-trace-listener listener_https x-request-id 3de6a7a0-ad2e-4aea-b51a-539a15f566f3 Server cloudflare X-Trace 2BF5AA2F64F12149743B829797FC7AC573FF5E602C000000000000000000 Vary origin Access-Control-Allow-Methods OPTIONS, GET Content-Type application/json;charset=utf-8 Access-Control-Allow-Origin https://www.group-ib.com x-evy-trace-virtual-host all Access-Control-Expose-Headers X-Origin-Hublet Access-Control-Max-Age 180 Access-Control-Allow-Credentials false Cache-Control max-age=0, no-cache, no-store X-Robots-Tag none Access-Control-Allow-Headers * CF-RAY 813933118d922c5b-FRA x-evy-trace-served-by-pod fra04/star-hubspot-td/envoy-proxy-5cdd94655b-hn9qf
GET H/1.1	200 OK	json Show response forms-eu1.hsforms.com/embed/v3/form/25755956/5a995f05-701c-48e3-b25a-d1548ba3c0b3/	104 KB 29 KB	198ms 92ms	XHR application/json	172.65.232.43 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://forms-eu1.hsforms.com/embed/v3/form/25755956/5a995f05-701c-48e3-b25a-d1548ba3c0b3/json?hs_static_app=forms-embed&hs_static_app_version=1.3812&X-HubSpot-Static-App-Info=forms-embed-1.3812 Requested by Host: fhp-de-js.group-ib.com URL: https://fhp-de-js.group-ib.com/d/bt-autoinject.js Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 172.65.232.43 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 57f15916ecbb064c877ded2e26ed78abd4807e455775c0ff0e5a0d6b80ea2e72 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Accept application/json, text/plain, */* Referer https://www.group-ib.com/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers X-Origin-Hublet eu1 Date Mon, 09 Oct 2023 19:58:38 GMT Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff CF-Cache-Status DYNAMIC Content-Encoding br x-evy-trace-route-service-name envoyset-translator X-HubSpot-Correlation-Id b8a09679-88b1-4636-a0dc-2291f44d5a82 Transfer-Encoding chunked x-envoy-upstream-service-time 16 Connection keep-alive alt-svc h3=":443"; ma=86400 x-evy-trace-route-configuration listener_https/all x-evy-trace-listener listener_https x-request-id b8a09679-88b1-4636-a0dc-2291f44d5a82 Server cloudflare X-Trace 2BD01450322920AAB0564EFBB3B9CD2E5F6025EA87000000000000000000 Vary origin Access-Control-Allow-Methods OPTIONS, GET Content-Type application/json;charset=utf-8 Access-Control-Allow-Origin https://www.group-ib.com x-evy-trace-virtual-host all Access-Control-Expose-Headers X-Origin-Hublet Access-Control-Max-Age 180 Access-Control-Allow-Credentials false Cache-Control max-age=0, no-cache, no-store X-Robots-Tag none Access-Control-Allow-Headers * CF-RAY 813933119ef69a35-FRA x-evy-trace-served-by-pod fra04/star-hubspot-td/envoy-proxy-5cdd94655b-qj67h
GET DATA	200 OK	truncated /	64 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 01caf20e667c8e300960582162f912d9405e9895c32cff1a9ee95511fd509a2c Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	68 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 1f464ef7c0b366ff00e2f023cb6b48112306212648e451ddf16be40c2b99d639 Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	68 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 5cbf73ad777849d62a8ad7046a68af552271d5c6e627ce02e756af9e4bb9aac3 Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	69 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash b25fcb20525a52136101cc5c49a5dd6671f0c9de3e4cc0911cc1bbd4f3610a8a Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers Content-Type image/svg+xml
GET H2	200	dropdown_before.svg website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/main-nav/	154 B 971 B	452ms 395ms	Image image/svg+xml	2600:9000:2156:f000:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/main-nav/dropdown_before.svg Requested by Host: website.cdn.group-ib.com URL: https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-blog-post.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:2156:f000:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash 574ab1a3d7b47add5d43a927f62c87698264f63572acd70b42081dd4a1dc5ced Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-blog-post.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; content-encoding gzip x-content-type-options nosniff date Mon, 09 Oct 2023 19:58:38 GMT via 1.1 632ee301c4920b52f2463aa9e978c57e.cloudfront.net (CloudFront) strict-transport-security max-age=31536000; includeSubDomains x-amz-cf-pop FRA50-C1 x-cache Miss from cloudfront content-length 150 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Tue, 28 Jun 2022 07:55:26 GMT server nginx etag "9a-5e27d5c025780-gzip" x-frame-options sameorigin vary Accept-Encoding content-type image/svg+xml access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id Y_7OTeqft1GPK5axvHsSF3OFzvog0AaK4RE_N3ge_OKoVJw0jhdlzg== expires Mon, 09 Oct 2023 20:28:38 GMT
GET H2	200	link-arrow.svg website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/	409 B 1 KB	450ms 394ms	Image image/svg+xml	2600:9000:2156:f000:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/link-arrow.svg Requested by Host: website.cdn.group-ib.com URL: https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-blog-post.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:2156:f000:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash e91c5731358570d3e4cd684118251d243fc799059648b152403dcd775ceba632 Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-blog-post.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; content-encoding gzip x-content-type-options nosniff date Mon, 09 Oct 2023 19:58:38 GMT via 1.1 632ee301c4920b52f2463aa9e978c57e.cloudfront.net (CloudFront) strict-transport-security max-age=31536000; includeSubDomains x-amz-cf-pop FRA50-C1 x-cache Miss from cloudfront content-length 267 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Tue, 28 Jun 2022 07:55:26 GMT server nginx etag "199-5e27d5c025780-gzip" x-frame-options sameorigin vary Accept-Encoding content-type image/svg+xml access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id _m4e2tDbfTY0jtQos0kn81J8EDXYDkPyTHdPx_j4orz2g91HpM2mng== expires Mon, 09 Oct 2023 20:28:38 GMT
GET H2	200	Close.svg www.group-ib.com/wp-content/themes/gib-theme/assets/images/	227 B 264 B	184ms 132ms	Image image/svg+xml	3.72.181.255 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://www.group-ib.com/wp-content/themes/gib-theme/assets/images/Close.svg Requested by Host: website.cdn.group-ib.com URL: https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-blog-post.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 3.72.181.255 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-3-72-181-255.eu-central-1.compute.amazonaws.com Software nginx / Resource Hash 31d1c5bd0cd38e6e6b8eb944944df273044e826c7d3daacbe602caead3068c7a Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://website.cdn.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; content-encoding gzip x-content-type-options nosniff date Mon, 09 Oct 2023 19:58:38 GMT strict-transport-security max-age=31536000; includeSubDomains content-length 180 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Tue, 29 Nov 2022 12:14:21 GMT server nginx etag "e3-5ee9aed8bc981-gzip" vary Accept-Encoding x-frame-options sameorigin content-type image/svg+xml access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes expires Mon, 09 Oct 2023 20:28:38 GMT
GET H2	200	file_copy.svg www.group-ib.com/wp-content/themes/gib-theme/assets/images/	668 B 457 B	183ms 131ms	Image image/svg+xml	3.72.181.255 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://www.group-ib.com/wp-content/themes/gib-theme/assets/images/file_copy.svg Requested by Host: website.cdn.group-ib.com URL: https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-blog-post.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 3.72.181.255 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-3-72-181-255.eu-central-1.compute.amazonaws.com Software nginx / Resource Hash f367bbc4429fc9fb0a93045245aef519a000ab275549645cddecb3f953e0a05f Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://website.cdn.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; content-encoding gzip x-content-type-options nosniff date Mon, 09 Oct 2023 19:58:38 GMT strict-transport-security max-age=31536000; includeSubDomains content-length 352 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Mon, 28 Nov 2022 13:01:55 GMT server nginx etag "29c-5ee8779d1a6cb-gzip" vary Accept-Encoding x-frame-options sameorigin content-type image/svg+xml access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes expires Mon, 09 Oct 2023 20:28:38 GMT
GET H2	200	success.svg www.group-ib.com/wp-content/themes/gib-theme/assets/images/	386 B 340 B	183ms 132ms	Image image/svg+xml	3.72.181.255 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://www.group-ib.com/wp-content/themes/gib-theme/assets/images/success.svg Requested by Host: website.cdn.group-ib.com URL: https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-blog-post.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 3.72.181.255 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-3-72-181-255.eu-central-1.compute.amazonaws.com Software nginx / Resource Hash fa4859289ded4c674dcee233811758743116b1d7ce4e9f0c0e7e259391504c43 Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://website.cdn.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; content-encoding gzip x-content-type-options nosniff date Mon, 09 Oct 2023 19:58:38 GMT strict-transport-security max-age=31536000; includeSubDomains content-length 254 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Tue, 29 Nov 2022 11:07:05 GMT server nginx etag "182-5ee99fd05f106-gzip" vary Accept-Encoding x-frame-options sameorigin content-type image/svg+xml access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes expires Mon, 09 Oct 2023 20:28:38 GMT
GET H2	200	list-dot.svg www.group-ib.com/wp-content/themes/gib-theme/assets/images/	313 B 302 B	182ms 131ms	Image image/svg+xml	3.72.181.255 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://www.group-ib.com/wp-content/themes/gib-theme/assets/images/list-dot.svg Requested by Host: website.cdn.group-ib.com URL: https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-blog-post.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 3.72.181.255 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-3-72-181-255.eu-central-1.compute.amazonaws.com Software nginx / Resource Hash 6b0775723ccade5ca3170fcc6a321c5b4768a5dc2b7c83b8b8b595407a2f0018 Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://website.cdn.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; content-encoding gzip x-content-type-options nosniff date Mon, 09 Oct 2023 19:58:38 GMT strict-transport-security max-age=31536000; includeSubDomains content-length 205 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Thu, 08 Sep 2022 12:02:57 GMT server nginx etag "139-5e82935d2238c-gzip" vary Accept-Encoding x-frame-options sameorigin content-type image/svg+xml access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes expires Mon, 09 Oct 2023 20:28:38 GMT
GET H2	200	Dropdown-right.svg website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/	503 B 1 KB	448ms 397ms	Image image/svg+xml	2600:9000:2156:f000:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/Dropdown-right.svg Requested by Host: website.cdn.group-ib.com URL: https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-blog-post.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:2156:f000:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash 4d4a484a100e469b6e3dcf880a37755086e246cc291bab46e3edd4529e3d5d6a Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-blog-post.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; content-encoding gzip x-content-type-options nosniff date Mon, 09 Oct 2023 19:58:38 GMT via 1.1 632ee301c4920b52f2463aa9e978c57e.cloudfront.net (CloudFront) strict-transport-security max-age=31536000; includeSubDomains x-amz-cf-pop FRA50-C1 x-cache Miss from cloudfront content-length 307 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Fri, 16 Dec 2022 09:56:36 GMT server nginx etag "1f7-5efeefc3ee1d1-gzip" x-frame-options sameorigin vary Accept-Encoding content-type image/svg+xml access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id gbzA_K97mzbrT89-LX62Up6OMaP5v2N_epniELkOBcBz7AcrNXRasw== expires Mon, 09 Oct 2023 20:28:38 GMT
GET H2	200	G-font-Bold.otf website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/fonts/G-font/	49 KB 32 KB	263ms 212ms	Font application/x-font-otf	2600:9000:2156:f000:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/fonts/G-font/G-font-Bold.otf Requested by Host: website.cdn.group-ib.com URL: https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-blog-post.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:2156:f000:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash 8d15a221986226efe4f742f390f46f9d5ae8b2008a6edd40e10ff121ef9cca9b Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers Referer https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-blog-post.css Origin https://www.group-ib.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; content-encoding gzip x-content-type-options nosniff date Mon, 09 Oct 2023 19:58:38 GMT via 1.1 9ab847fabb8c9edbd39cff57c2a2f4c0.cloudfront.net (CloudFront) strict-transport-security max-age=31536000; includeSubDomains x-amz-cf-pop FRA50-C1 x-cache Miss from cloudfront content-length 31918 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Tue, 28 Jun 2022 07:55:26 GMT server nginx etag "c320-5e27d5c025780-gzip" x-frame-options sameorigin vary Accept-Encoding content-type application/x-font-otf access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id d9tVU8RyHkeTh1p0O1QVSPsTXOkk_zg0y2kgaO1fGQTkUxaN7Os0kw== expires Mon, 09 Oct 2023 20:28:38 GMT
GET DATA	200 OK	truncated /	69 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash bb31779e4aafb15bd6d2f98bc5135e22a2e87fc6ba5ce6cc002071847197d871 Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	69 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 1bc97ab97c454eb6eaa9bb5231a82873db49fa808ac7cc2c817c0ab30e2e6d97 Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	69 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 7ef15497723396d53eda0f122044ef7d55126cd1db59a34ed489556eb009f388 Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	69 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash d88d276708d71a163df1d2bd46c74e08d2078afb30978e2e093ea9526e4fe3bf Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	69 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash fc7f2240b944527ad71d2ae9fdf14082a161940ed95ca0b23aad905a462b854e Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	70 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash fe90b806ab1036e0df096e4831ff97c706c27cdcf49ec9b25b95d26790417e79 Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	68 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 34e0bb5c5ed1184e6452cf7562faf332af1a26e95e50e035ff0a9f7065e6df9e Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers Content-Type image/svg+xml
GET H/1.1	200 OK	json Show response forms-eu1.hsforms.com/embed/v3/form/25755956/55a22738-d5a5-43f9-9c1c-fa4c1a6eb349/	8 KB 3 KB	94ms 92ms	XHR application/json	172.65.232.43 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://forms-eu1.hsforms.com/embed/v3/form/25755956/55a22738-d5a5-43f9-9c1c-fa4c1a6eb349/json?hs_static_app=forms-embed&hs_static_app_version=1.3812&X-HubSpot-Static-App-Info=forms-embed-1.3812 Requested by Host: fhp-de-js.group-ib.com URL: https://fhp-de-js.group-ib.com/d/bt-autoinject.js Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 172.65.232.43 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash b67fdc72929a910add9d56c28827f1c95aa3df980dfc4ef4be79df07e0da7bbb Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Accept application/json, text/plain, */* Referer https://www.group-ib.com/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers X-Origin-Hublet eu1 Date Mon, 09 Oct 2023 19:58:38 GMT Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff CF-Cache-Status DYNAMIC Content-Encoding br x-evy-trace-route-service-name envoyset-translator X-HubSpot-Correlation-Id de72b519-a377-44ce-b94b-aa1f185451d5 Transfer-Encoding chunked x-envoy-upstream-service-time 7 Connection keep-alive alt-svc h3=":443"; ma=86400 x-evy-trace-route-configuration listener_https/all x-evy-trace-listener listener_https x-request-id de72b519-a377-44ce-b94b-aa1f185451d5 Server cloudflare X-Trace 2B1A10D9CD61AC5C233BF8CC48091F9ABE22B26186000000000000000000 Vary origin Access-Control-Allow-Methods OPTIONS, GET Content-Type application/json;charset=utf-8 Access-Control-Allow-Origin https://www.group-ib.com x-evy-trace-virtual-host all Access-Control-Expose-Headers X-Origin-Hublet Access-Control-Max-Age 180 Access-Control-Allow-Credentials false Cache-Control max-age=0, no-cache, no-store X-Robots-Tag none Access-Control-Allow-Headers * CF-RAY 813933125c973653-FRA x-evy-trace-served-by-pod fra04/star-hubspot-td/envoy-proxy-5cdd94655b-qj67h
GET H2	200	gtm.js Show response www.googletagmanager.com/	277 KB 89 KB	289ms 68ms	Script application/javascript	2a00:1450:4001:806::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtm.js?id=GTM-PW7265 Requested by Host: www.group-ib.com URL: https://www.group-ib.com/blog/qilin-ransomware/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:806::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash e77b7d3d0f176cb32b74db4abb3598d48d6b1f692697da99ef3f828c66070049 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers date Mon, 09 Oct 2023 19:58:38 GMT content-encoding br strict-transport-security max-age=31536000; includeSubDomains cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 91200 x-xss-protection 0 last-modified Mon, 09 Oct 2023 19:01:19 GMT server Google Tag Manager vary Accept-Encoding content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true access-control-allow-headers Cache-Control expires Mon, 09 Oct 2023 19:58:38 GMT
GET H2	200	insight.min.js Show response website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/js/	8 KB 4 KB	263ms 262ms	Script application/x-javascript	2600:9000:2156:f000:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/js/insight.min.js Requested by Host: www.group-ib.com URL: https://www.group-ib.com/blog/qilin-ransomware/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:2156:f000:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash 14f2ec002b176e0dee403cb7dd4ef2274a1353080e1e3e4084678770f4c15b9c Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; content-encoding gzip x-content-type-options nosniff date Mon, 09 Oct 2023 19:58:38 GMT via 1.1 632ee301c4920b52f2463aa9e978c57e.cloudfront.net (CloudFront) strict-transport-security max-age=31536000; includeSubDomains x-amz-cf-pop FRA50-C1 x-cache Miss from cloudfront content-length 3085 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Fri, 15 Jul 2022 14:12:57 GMT server nginx etag "1e5a-5e3d89d6a8c40-gzip" x-frame-options sameorigin vary Accept-Encoding content-type application/x-javascript access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id c0VRxKUfbQrx6VwF0wirupFzCCRyOLAwRHtqvrG-8AgbrVnWSX65Gg== expires Mon, 09 Oct 2023 20:28:38 GMT
GET H/1.1	200 OK	json Show response forms-eu1.hsforms.com/embed/v3/form/25755956/eb903dab-0ef3-43b5-bdeb-71372e6ad0f0/	7 KB 3 KB	137ms 76ms	XHR application/json	172.65.232.43 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://forms-eu1.hsforms.com/embed/v3/form/25755956/eb903dab-0ef3-43b5-bdeb-71372e6ad0f0/json?hs_static_app=forms-embed&hs_static_app_version=1.3812&X-HubSpot-Static-App-Info=forms-embed-1.3812 Requested by Host: fhp-de-js.group-ib.com URL: https://fhp-de-js.group-ib.com/d/bt-autoinject.js Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 172.65.232.43 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash c40c28c18e731c4d64ff7412ac31653272e7350316e18a3d8fb57f1a60385e2d Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Accept application/json, text/plain, */* Referer https://www.group-ib.com/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers X-Origin-Hublet eu1 Date Mon, 09 Oct 2023 19:58:38 GMT Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff CF-Cache-Status DYNAMIC Content-Encoding br x-evy-trace-route-service-name envoyset-translator X-HubSpot-Correlation-Id ff348c34-5778-4a63-9a92-6e40bda93001 Transfer-Encoding chunked x-envoy-upstream-service-time 6 Connection keep-alive alt-svc h3=":443"; ma=86400 x-evy-trace-route-configuration listener_https/all x-evy-trace-listener listener_https x-request-id ff348c34-5778-4a63-9a92-6e40bda93001 Server cloudflare X-Trace 2B9EA0E4910024BECD36EFC7A0F41E9C00CE75693F000000000000000000 Vary origin Access-Control-Allow-Methods OPTIONS, GET Content-Type application/json;charset=utf-8 Access-Control-Allow-Origin https://www.group-ib.com x-evy-trace-virtual-host all Access-Control-Expose-Headers X-Origin-Hublet Access-Control-Max-Age 180 Access-Control-Allow-Credentials false Cache-Control max-age=0, no-cache, no-store X-Robots-Tag none Access-Control-Allow-Headers * CF-RAY 81393312dd513653-FRA x-evy-trace-served-by-pod fra04/star-hubspot-td/envoy-proxy-5cdd94655b-qj67h
GET H2	200	collectedforms.js Show response js-eu1.hscollectedforms.net/	69 KB 25 KB	175ms 57ms	Script application/javascript	172.65.192.122 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://js-eu1.hscollectedforms.net/collectedforms.js Requested by Host: js-eu1.hs-scripts.com URL: https://js-eu1.hs-scripts.com/25755956.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.65.192.122 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash d1b5aca028dd8447199f3c06601e38f5b8aba3b29be5ccd2de504a561fed2558 Security Headers Name Value X-Content-Type-Options nosniff Request headers Referer https://www.group-ib.com/ Origin https://www.group-ib.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers content-encoding br age 23 x-evy-trace-route-service-name envoyset-translator x-amz-server-side-encryption AES256 content-security-policy-report-only frame-ancestors 'self'; report-uri https://send.hsbrowserreports.com/csp/report?resource=collected-forms-embed-js/static-1.425/bundles/project.js&cfRay=8139327fb96e917a-FRA x-amz-replication-status COMPLETED x-evy-trace-listener listener_https etag W/"526bb173ed1384afadfc2b0eb6b0846e" vary Accept-Encoding,Origin,Access-Control-Request-Headers,Access-Control-Request-Method access-control-allow-methods GET content-type application/javascript; charset=utf-8 access-control-allow-origin * x-evy-trace-virtual-host all cache-control s-maxage=600, max-age=300 x-hs-target-asset collected-forms-embed-js/static-1.425/bundles/project.js date Mon, 09 Oct 2023 19:58:38 GMT x-amz-version-id 99Y.E0UsJAdqqpubte3vKq3r2MOVQh4K via 1.1 93b8205e2f07a7099af2e6fd126d9658.cloudfront.net (CloudFront) x-content-type-options nosniff cf-cache-status HIT x-amz-cf-pop FRA56-P2 x-hubspot-correlation-id 242b2169-6454-45e0-93b0-9168a87448c1 x-cache Hit from cloudfront cache-tag staticjsapp-collected-forms-embed-js-web-prod,staticjsapp-prod x-envoy-upstream-service-time 9 x-evy-trace-route-configuration listener_https/all x-request-id 242b2169-6454-45e0-93b0-9168a87448c1 last-modified Fri, 22 Sep 2023 08:42:59 UTC server cloudflare access-control-max-age 3000 x-hs-cache-status MISS x-evy-trace-served-by-pod fra04/app-td/envoy-proxy-797758f45b-8q8m9 cf-ray 8139331359dc9bca-FRA x-amz-cf-id xvnp_Q_4yDetgoc-vUmZ56eNllWY9zBF3eLQ_ZQ42Sj-H88-tzQHIA==
GET H2	200	web-interactives-embed.js Show response js-eu1.hubspot.com/	75 KB 23 KB	195ms 76ms	Script application/javascript	172.65.236.181 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://js-eu1.hubspot.com/web-interactives-embed.js Requested by Host: js-eu1.hs-scripts.com URL: https://js-eu1.hs-scripts.com/25755956.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.65.236.181 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash abb73112c646c0cfca5313dce411270cee90340454a51c3ee1218834774ddd5c Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer https://www.group-ib.com/ Origin https://www.group-ib.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers content-encoding br x-evy-trace-route-service-name envoyset-translator x-amz-server-side-encryption AES256 content-security-policy-report-only frame-ancestors 'self'; report-uri https://send.hsbrowserreports.com/csp/report?resource=web-interactives-embed/static-2.579/bundles/project.js&cfRay=813933135e9e2bb6-FRA x-amz-replication-status COMPLETED x-evy-trace-listener listener_https etag W/"61cf09f2840246c03b083d2b2aaedbaf" vary Accept-Encoding content-type application/javascript; charset=utf-8 access-control-allow-origin * x-evy-trace-virtual-host all cache-control max-age=600 x-hs-target-asset web-interactives-embed/static-2.579/bundles/project.js date Mon, 09 Oct 2023 19:58:38 GMT x-amz-version-id ZH1lXdEo36sSD12T68pVuRktbLMj6Y_H via 1.1 c387974a86541bbcc6c5141a85eeaf36.cloudfront.net (CloudFront) x-content-type-options nosniff cf-cache-status EXPIRED nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} strict-transport-security max-age=31536000; includeSubDomains; preload x-amz-cf-pop FRA56-P2 x-hubspot-correlation-id 50706ed7-b88f-4424-b4ee-3227ebcd9f7e x-cache RefreshHit from cloudfront cache-tag staticjsapp-web-interactives-embed-web-prod,staticjsapp-prod x-envoy-upstream-service-time 2 x-evy-trace-route-configuration listener_https/all x-request-id 50706ed7-b88f-4424-b4ee-3227ebcd9f7e last-modified Wed, 04 Oct 2023 10:21:17 UTC server cloudflare report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=pW3TmKEUdeGOqpDQ8F2ALW02%2FTRx%2BOYh0088P7miNrYvtEeiQ%2BgB6xfSFfAIGf3KSg%2BTljLzPSLfBpRWu78x%2FjmW0%2BDQY6Bsja%2BSGYg%2BdfQyv5jEVo5jv6t2JBjHE%2FKStjS4Mg%3D%3D"}],"group":"cf-nel","max_age":604800} x-hs-cache-status HIT x-evy-trace-served-by-pod fra04/app-td/envoy-proxy-797758f45b-8q8m9 cf-ray 813933135e9e2bb6-FRA x-amz-cf-id _SDvmoufJd1lB32xLxDuGEu5o49O-NeUrLYyeEOYeo2fphuE6jW98w==
GET H2	200	25755956.js Show response js-eu1.hs-analytics.net/analytics/1696881300000/	66 KB 21 KB	177ms 63ms	Script text/javascript	172.65.238.60 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://js-eu1.hs-analytics.net/analytics/1696881300000/25755956.js Requested by Host: js-eu1.hs-scripts.com URL: https://js-eu1.hs-scripts.com/25755956.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.65.238.60 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash fb6d4b072a3600313d26823a5904a0d86b638e99bbbb7f28df4d01f9fc54c1bf Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers date Mon, 09 Oct 2023 19:58:38 GMT content-encoding br cf-cache-status HIT x-amz-request-id RC70TNCXAP3NG6Y7 x-evy-trace-route-service-name envoyset-translator x-amz-server-side-encryption AES256 x-hubspot-correlation-id ffb89193-bb7d-46a7-a3d6-8a131570091c age 32 x-envoy-upstream-service-time 18 x-amz-id-2 qAvnFAVEGiYf1D5z7j9ugBiVrp41CtQaH1OeMG4UE9omYcMQCYCLYMFqDR7QJOJCI6IgqbrZU8E= x-evy-trace-listener listener_https x-request-id ffb89193-bb7d-46a7-a3d6-8a131570091c x-evy-trace-route-configuration listener_https/all last-modified Fri, 15 Sep 2023 18:22:56 GMT server cloudflare etag W/"bddf65f21de48f070df8e8508c7a77e6" vary origin, Accept-Encoding content-type text/javascript x-evy-trace-virtual-host all x-evy-trace-served-by-pod fra04/analytics-js-proxy-td/envoy-proxy-6bfd96c9d5-gdvn9 cache-control max-age=300,public access-control-allow-credentials false cf-ray 813933133f47691b-FRA expires Mon, 09 Oct 2023 20:03:06 GMT
GET H2	200	banner.js Show response js-eu1.hs-banner.com/v2/25755956/	66 KB 20 KB	184ms 62ms	Script text/javascript	172.65.202.201 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://js-eu1.hs-banner.com/v2/25755956/banner.js Requested by Host: js-eu1.hs-scripts.com URL: https://js-eu1.hs-scripts.com/25755956.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.65.202.201 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 5c8b6e88e89d0fc9b71504a53a33bf69617ede9a9cd91bf04525d79aff01cbfe Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers date Mon, 09 Oct 2023 19:58:38 GMT x-amz-version-id CQwoOhSt2urxB0aJ.DfTh_RkrgGWOAsX content-encoding br cf-cache-status HIT x-amz-request-id R7YXPYRA549V91TN x-evy-trace-route-service-name envoyset-translator x-amz-server-side-encryption AES256 x-hubspot-correlation-id 73274e58-3980-4a4d-b1b6-82c9a4656328 age 16 x-envoy-upstream-service-time 32 x-amz-id-2 fUyudRhUC/E9v+6tVozBWPr6FKzCsLaC2hIJXaaDGrDOEERS9JSlBDA8Ifislcy8DixHbSPurUM= x-evy-trace-listener listener_https x-request-id 73274e58-3980-4a4d-b1b6-82c9a4656328 x-evy-trace-route-configuration listener_https/all last-modified Tue, 26 Sep 2023 20:22:59 GMT server cloudflare etag W/"5937aa4e9e159cd166607b689fc7762f" access-control-max-age 604800 access-control-allow-methods GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD content-type text/javascript; charset=UTF-8 access-control-allow-origin https://www.group-ib.com x-evy-trace-virtual-host all access-control-expose-headers x-last-modified-timestamp, X-HubSpot-NotFound, X-HS-User-Request, Link, Server-Timing cache-control max-age=300,public access-control-allow-credentials true x-evy-trace-served-by-pod fra04/analytics-js-proxy-td/envoy-proxy-55f7b4ccdf-wgfm8 vary origin, Accept-Encoding timing-allow-origin * access-control-allow-headers Origin, X-Requested-With, Content-Type, Accept, Accept-Charset, Accept-Encoding, X-Override-Internal-Permissions, X-Properties-Source, X-Properties-SourceId, X-Properties-Flag, X-Hubspot-User-Id, X-Hubspot-Trace, X-Hubspot-Callee, X-Hubspot-Offset, X-Hubspot-No-Trace, X-HubSpot-Static-App-Info, X-HubSpot-Messages-Uri, X-HubSpot-Request-Source, X-HubSpot-Request-Reason, Subscription-Billing-Auth-Token, X-App-CSRF, X-Tools-CSRF, Online-Payment-Signing-UUID, X-Source, X-SourceId, X-Origin-UserId, X-Biden-Request-Source, X-HubSpot-CSRF-hubspotapi, X-Force-Cookie-Refresh, X-Force-Cookie-Refresh-No-Cache, X-HS-User-Request, X-Application-Id, X-HS-Referer, X-HubSpot-Correlation-Id cf-ray 813933135aa99b80-FRA expires Mon, 09 Oct 2023 20:03:22 GMT
GET H2	200	fb.js Show response js-eu1.hsadspixel.net/	6 KB 4 KB	163ms 48ms	Script application/javascript	172.65.219.229 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://js-eu1.hsadspixel.net/fb.js Requested by Host: js-eu1.hs-scripts.com URL: https://js-eu1.hs-scripts.com/25755956.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.65.219.229 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash e1e4e3cba3eeeb3ad74ae67c1f42012ebb51d8497482e5c01d404579d49c6b04 Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers date Mon, 09 Oct 2023 19:58:38 GMT x-amz-version-id MiORZOji2P27E5f3usS102mv5dcg0lYn via 1.1 83f1b8f73f37458f38e2ee1fc0b9e68c.cloudfront.net (CloudFront) x-content-type-options nosniff cf-cache-status HIT x-amz-cf-pop FRA56-P2 age 572 x-amz-server-side-encryption AES256 x-evy-trace-route-service-name envoyset-translator content-security-policy-report-only frame-ancestors 'self'; report-uri https://send.hsbrowserreports.com/csp/report?resource=adsscriptloaderstatic/static-1.485/bundles/pixels-release.js&cfRay=8139251b5f271d8e-FRA x-cache Hit from cloudfront x-hubspot-correlation-id 279e1f2d-eb72-4f61-8e8a-f48ff58104fb cache-tag staticjsapp-AdsScriptLoaderCloudflare-web-prod,staticjsapp-prod content-encoding br x-envoy-upstream-service-time 0 x-amz-replication-status COMPLETED x-evy-trace-route-configuration listener_https/all x-evy-trace-listener listener_https x-request-id 279e1f2d-eb72-4f61-8e8a-f48ff58104fb last-modified Tue, 19 Sep 2023 08:21:28 UTC server cloudflare etag W/"1bce211846e6a6691aa314979e0a21fb" vary Accept-Encoding content-type application/javascript; charset=utf-8 x-hs-cache-status HIT x-evy-trace-virtual-host all cache-control max-age=600 x-evy-trace-served-by-pod fra04/app-td/envoy-proxy-797758f45b-8q8m9 cf-ray 8139331339f91daa-FRA x-amz-cf-id PKk7rcZusL0nlkjm8qsXpGjmL6EOGkjloMMvJfPIGYGPcBNeXTw4lg== x-hs-target-asset adsscriptloaderstatic/static-1.485/bundles/pixels-release.js
GET H2	200	main-logo.svg www.group-ib.com/wp-content/themes/gib-theme/assets/images/	3 KB 2 KB	101ms 94ms	Image image/svg+xml	3.72.181.255 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://www.group-ib.com/wp-content/themes/gib-theme/assets/images/main-logo.svg Requested by Host: www.group-ib.com URL: https://www.group-ib.com/blog/qilin-ransomware/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 3.72.181.255 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-3-72-181-255.eu-central-1.compute.amazonaws.com Software nginx / Resource Hash 589c9a6a159cf2ecc8555bc4457827f21002eaec9a24e3bc54401ed0b4d30ac8 Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/blog/qilin-ransomware/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; content-encoding gzip x-content-type-options nosniff date Mon, 09 Oct 2023 19:58:38 GMT strict-transport-security max-age=31536000; includeSubDomains content-length 1527 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Mon, 30 Jan 2023 11:16:06 GMT server nginx etag "d82-5f379576be685-gzip" vary Accept-Encoding x-frame-options sameorigin content-type image/svg+xml access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes expires Mon, 09 Oct 2023 20:28:38 GMT
GET H2	200	ti.png website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/main-nav/	6 KB 7 KB	198ms 190ms	Image image/png	2600:9000:2156:f000:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/main-nav/ti.png Requested by Host: www.group-ib.com URL: https://www.group-ib.com/blog/qilin-ransomware/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:2156:f000:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash f0e3a799744c0c67782742af2c13b85f769b58abd04800a04853d26f60cf7314 Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; date Mon, 09 Oct 2023 19:58:38 GMT x-content-type-options nosniff strict-transport-security max-age=31536000; includeSubDomains via 1.1 632ee301c4920b52f2463aa9e978c57e.cloudfront.net (CloudFront) x-amz-cf-pop FRA50-C1 x-cache Miss from cloudfront content-length 5919 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Tue, 28 Jun 2022 07:55:26 GMT server nginx etag "171f-5e27d5c025780" x-frame-options sameorigin content-type image/png access-control-allow-origin https://www.group-ib.com cache-control no-cache, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id YzTMwaDnkxu4Q0uZLry4EcbRYDff9uyz7S4Ip4n84G6yN-4_M60GGA== expires Mon, 09 Oct 2023 19:58:37 GMT
GET H2	200	asm.png website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/main-nav/	6 KB 7 KB	203ms 196ms	Image image/png	2600:9000:2156:f000:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/main-nav/asm.png Requested by Host: www.group-ib.com URL: https://www.group-ib.com/blog/qilin-ransomware/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:2156:f000:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash 997d49d316b533985208f14602a1ff15a76bf6a567afbb6b6980629ca8d78bab Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; date Mon, 09 Oct 2023 19:58:38 GMT x-content-type-options nosniff strict-transport-security max-age=31536000; includeSubDomains via 1.1 632ee301c4920b52f2463aa9e978c57e.cloudfront.net (CloudFront) x-amz-cf-pop FRA50-C1 x-cache Miss from cloudfront content-length 5941 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Tue, 28 Jun 2022 07:55:26 GMT server nginx etag "1735-5e27d5c025780" x-frame-options sameorigin content-type image/png access-control-allow-origin https://www.group-ib.com cache-control no-cache, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id v9873W8KqL0rN0q3zcIjpR49FR6XQsMiEUbXjFDhkDjGWHf66NpuUQ== expires Mon, 09 Oct 2023 19:58:37 GMT
GET H2	200	fp.png website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/main-nav/	8 KB 8 KB	188ms 181ms	Image image/png	2600:9000:2156:f000:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/main-nav/fp.png Requested by Host: www.group-ib.com URL: https://www.group-ib.com/blog/qilin-ransomware/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:2156:f000:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash 15534f98c260c3c3caaedf53335d912010b2de1731477a9fd4dbea89fb4995d9 Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; date Mon, 09 Oct 2023 19:58:38 GMT x-content-type-options nosniff strict-transport-security max-age=31536000; includeSubDomains via 1.1 632ee301c4920b52f2463aa9e978c57e.cloudfront.net (CloudFront) x-amz-cf-pop FRA50-C1 x-cache Miss from cloudfront content-length 7844 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Tue, 28 Jun 2022 07:55:26 GMT server nginx etag "1ea4-5e27d5c025780" x-frame-options sameorigin content-type image/png access-control-allow-origin https://www.group-ib.com cache-control no-cache, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id LKPF3jxN3OhfLMEwWEeesSVI9JurShbj3ydjht8DoUEjt2A1YDlwHw== expires Mon, 09 Oct 2023 19:58:37 GMT
GET H2	200	drp.png website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/main-nav/	5 KB 6 KB	196ms 188ms	Image image/png	2600:9000:2156:f000:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/main-nav/drp.png Requested by Host: www.group-ib.com URL: https://www.group-ib.com/blog/qilin-ransomware/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:2156:f000:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash a300a894e169169882504968fae71958a87e0a4322e2aee1b6b0bbd63fd9621f Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; date Mon, 09 Oct 2023 19:58:38 GMT x-content-type-options nosniff strict-transport-security max-age=31536000; includeSubDomains via 1.1 632ee301c4920b52f2463aa9e978c57e.cloudfront.net (CloudFront) x-amz-cf-pop FRA50-C1 x-cache Miss from cloudfront content-length 5398 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Tue, 28 Jun 2022 07:55:26 GMT server nginx etag "1516-5e27d5c025780" x-frame-options sameorigin content-type image/png access-control-allow-origin https://www.group-ib.com cache-control no-cache, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id JONAR_m9re7XXiuh35b00nxcbP29gzApP2ca19E0DG-iwtQ2S84DSA== expires Mon, 09 Oct 2023 19:58:37 GMT
GET H2	200	mxdr.png website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/main-nav/	6 KB 7 KB	202ms 195ms	Image image/png	2600:9000:2156:f000:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/main-nav/mxdr.png Requested by Host: www.group-ib.com URL: https://www.group-ib.com/blog/qilin-ransomware/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:2156:f000:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash 2be8ce2b065360537771ed230d5d72cbd84758ec127ffa035e6d260ed14af5b0 Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; date Mon, 09 Oct 2023 19:58:38 GMT x-content-type-options nosniff strict-transport-security max-age=31536000; includeSubDomains via 1.1 632ee301c4920b52f2463aa9e978c57e.cloudfront.net (CloudFront) x-amz-cf-pop FRA50-C1 x-cache Miss from cloudfront content-length 6506 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Tue, 28 Jun 2022 07:55:26 GMT server nginx etag "196a-5e27d5c025780" x-frame-options sameorigin content-type image/png access-control-allow-origin https://www.group-ib.com cache-control no-cache, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id r1gIqAPpqwpIC3m2-h0yJ7Xf-Di_Dz6pIto1XJ-KmKPFgZBp39gD1Q== expires Mon, 09 Oct 2023 19:58:37 GMT
GET H2	200	bep.png website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/main-nav/	6 KB 7 KB	242ms 235ms	Image image/png	2600:9000:2156:f000:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/main-nav/bep.png Requested by Host: www.group-ib.com URL: https://www.group-ib.com/blog/qilin-ransomware/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:2156:f000:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash 7574ba97d4ee7e81bd60873a52a31ff13359f246d0ac492ef2dabf96233a99e6 Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; date Mon, 09 Oct 2023 19:58:38 GMT x-content-type-options nosniff strict-transport-security max-age=31536000; includeSubDomains via 1.1 632ee301c4920b52f2463aa9e978c57e.cloudfront.net (CloudFront) x-amz-cf-pop FRA50-C1 x-cache Miss from cloudfront content-length 6362 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Tue, 28 Jun 2022 07:55:26 GMT server nginx etag "18da-5e27d5c025780" x-frame-options sameorigin content-type image/png access-control-allow-origin https://www.group-ib.com cache-control no-cache, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id UmehvohZCVbJvzBq84x-CrY57_VAk3eF0Oe1Yf5c_BmrepMB1A3SvQ== expires Mon, 09 Oct 2023 19:58:37 GMT
GET H2	200	share-black.svg www.group-ib.com/wp-content/themes/gib-theme/assets/images/	1 KB 857 B	103ms 96ms	Image image/svg+xml	3.72.181.255 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://www.group-ib.com/wp-content/themes/gib-theme/assets/images/share-black.svg Requested by Host: www.group-ib.com URL: https://www.group-ib.com/blog/qilin-ransomware/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 3.72.181.255 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-3-72-181-255.eu-central-1.compute.amazonaws.com Software nginx / Resource Hash 3689e488f5478e26f0347353ad608ccd66e4d62992021c51d9db93f89d43c880 Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/blog/qilin-ransomware/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; content-encoding gzip x-content-type-options nosniff date Mon, 09 Oct 2023 19:58:38 GMT strict-transport-security max-age=31536000; includeSubDomains content-length 500 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Tue, 22 Nov 2022 11:16:45 GMT server nginx etag "468-5ee0d4eb0feca-gzip" vary Accept-Encoding x-frame-options sameorigin content-type image/svg+xml access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes expires Mon, 09 Oct 2023 20:28:38 GMT
GET H2	200	wb_sunny-black.svg www.group-ib.com/wp-content/themes/gib-theme/assets/images/	724 B 528 B	101ms 94ms	Image image/svg+xml	3.72.181.255 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://www.group-ib.com/wp-content/themes/gib-theme/assets/images/wb_sunny-black.svg Requested by Host: www.group-ib.com URL: https://www.group-ib.com/blog/qilin-ransomware/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 3.72.181.255 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-3-72-181-255.eu-central-1.compute.amazonaws.com Software nginx / Resource Hash cc5dcea4d483d798630d7fe0846a1b784618aa3d4f86bdfa655083d81750322a Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/blog/qilin-ransomware/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; content-encoding gzip x-content-type-options nosniff date Mon, 09 Oct 2023 19:58:38 GMT strict-transport-security max-age=31536000; includeSubDomains content-length 385 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Tue, 22 Nov 2022 11:16:45 GMT server nginx etag "2d4-5ee0d4eb0feca-gzip" vary Accept-Encoding x-frame-options sameorigin content-type image/svg+xml access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes expires Mon, 09 Oct 2023 20:28:38 GMT
GET H2	200	moon.svg www.group-ib.com/wp-content/themes/gib-theme/assets/images/	627 B 447 B	100ms 93ms	Image image/svg+xml	3.72.181.255 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://www.group-ib.com/wp-content/themes/gib-theme/assets/images/moon.svg Requested by Host: www.group-ib.com URL: https://www.group-ib.com/blog/qilin-ransomware/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 3.72.181.255 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-3-72-181-255.eu-central-1.compute.amazonaws.com Software nginx / Resource Hash dedf6c9294a8b9e4b13b1575641071e45c8e61235bd154d19103fd2893ccd708 Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/blog/qilin-ransomware/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; content-encoding gzip x-content-type-options nosniff date Mon, 09 Oct 2023 19:58:38 GMT strict-transport-security max-age=31536000; includeSubDomains content-length 361 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Thu, 24 Nov 2022 12:37:03 GMT server nginx etag "273-5ee36a9860213-gzip" vary Accept-Encoding x-frame-options sameorigin content-type image/svg+xml access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes expires Mon, 09 Oct 2023 20:28:38 GMT
GET H2	200	6-1-1-e1686147809733.png website.cdn.group-ib.com/wp-content/uploads/	396 KB 397 KB	186ms 181ms	Image image/png	2600:9000:2156:f000:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://website.cdn.group-ib.com/wp-content/uploads/6-1-1-e1686147809733.png Requested by Host: www.group-ib.com URL: https://www.group-ib.com/blog/qilin-ransomware/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:2156:f000:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash 5a0ff04e4ae497c8ded994a33ddcfef8a96a05a81c20a803acc3fbed2672178a Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; date Mon, 09 Oct 2023 19:58:38 GMT x-content-type-options nosniff strict-transport-security max-age=31536000; includeSubDomains via 1.1 632ee301c4920b52f2463aa9e978c57e.cloudfront.net (CloudFront) x-amz-cf-pop FRA50-C1 x-cache Miss from cloudfront content-length 405297 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Wed, 07 Jun 2023 14:23:30 GMT server nginx etag "62f31-5fd8ae1478a1a" x-frame-options sameorigin content-type image/png access-control-allow-origin https://www.group-ib.com cache-control no-cache, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id AA27-CYq6Q2qmc1t7Uw1f7FIwSE4pIfg3uBZz17s5EoUdKPqoDV1og== expires Mon, 09 Oct 2023 19:58:37 GMT
GET H2	200	kichatov-1.png website.cdn.group-ib.com/wp-content/uploads/	47 KB 47 KB	192ms 188ms	Image image/png	2600:9000:2156:f000:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://website.cdn.group-ib.com/wp-content/uploads/kichatov-1.png Requested by Host: www.group-ib.com URL: https://www.group-ib.com/blog/qilin-ransomware/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:2156:f000:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash 02d3ea34b61a9e493310b79fb63d8013157cd68d842857c56240fcb588ac09e9 Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; date Mon, 09 Oct 2023 19:58:38 GMT x-content-type-options nosniff strict-transport-security max-age=31536000; includeSubDomains via 1.1 632ee301c4920b52f2463aa9e978c57e.cloudfront.net (CloudFront) x-amz-cf-pop FRA50-C1 x-cache Miss from cloudfront content-length 47672 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Mon, 15 May 2023 09:55:12 GMT server nginx etag "ba38-5fbb8736a7d25" x-frame-options sameorigin content-type image/png access-control-allow-origin https://www.group-ib.com cache-control no-cache, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id -mK7_dL9C-901NPgL86XbReuPO2UmWDw0vtUHXW7fe3rnZREnpt61g== expires Mon, 09 Oct 2023 19:58:37 GMT
GET H2	200	golddigger-small.webp website.cdn.group-ib.com/wp-content/uploads/	135 KB 136 KB	200ms 196ms	Image image/webp	2600:9000:2156:f000:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://website.cdn.group-ib.com/wp-content/uploads/golddigger-small.webp Requested by Host: www.group-ib.com URL: https://www.group-ib.com/blog/qilin-ransomware/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:2156:f000:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash 8d460b9d04a32da38152692c6c64a68c47e201b70bd12778719e49c252983302 Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; date Mon, 09 Oct 2023 19:58:38 GMT x-content-type-options nosniff strict-transport-security max-age=31536000; includeSubDomains via 1.1 632ee301c4920b52f2463aa9e978c57e.cloudfront.net (CloudFront) x-amz-cf-pop FRA50-C1 x-cache Miss from cloudfront content-length 138350 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Wed, 04 Oct 2023 12:20:27 GMT server nginx etag "21c6e-606e308535bfb" x-frame-options sameorigin content-type image/webp access-control-allow-origin https://www.group-ib.com cache-control no-cache, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id PofsNtVfhtwEWmrCl-_IJCLWVYRAIgRtv-hDOw868PoB1nyIljNKkg== expires Mon, 09 Oct 2023 19:58:37 GMT
GET H2	200	shadowsyndicate-1.webp website.cdn.group-ib.com/wp-content/uploads/	99 KB 100 KB	188ms 186ms	Image image/webp	2600:9000:2156:f000:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://website.cdn.group-ib.com/wp-content/uploads/shadowsyndicate-1.webp Requested by Host: www.group-ib.com URL: https://www.group-ib.com/blog/qilin-ransomware/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:2156:f000:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash 20184944941b898c9a0a0458b179da80e1d9b0cb08d4e65bc770cd18e9090119 Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; date Mon, 09 Oct 2023 19:58:38 GMT x-content-type-options nosniff strict-transport-security max-age=31536000; includeSubDomains via 1.1 632ee301c4920b52f2463aa9e978c57e.cloudfront.net (CloudFront) x-amz-cf-pop FRA50-C1 x-cache Miss from cloudfront content-length 101402 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Fri, 22 Sep 2023 11:28:06 GMT server nginx etag "18c1a-605f0e6ffefc3" x-frame-options sameorigin content-type image/webp access-control-allow-origin https://www.group-ib.com cache-control no-cache, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id 7rzaEsiTytVsHFBinNnR_RAgSaU2-yth5IoQ73F2EZGF4OzbQxCZig== expires Mon, 09 Oct 2023 19:58:37 GMT
GET H2	200	mxdr-small.webp website.cdn.group-ib.com/wp-content/uploads/	81 KB 82 KB	195ms 192ms	Image image/webp	2600:9000:2156:f000:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://website.cdn.group-ib.com/wp-content/uploads/mxdr-small.webp Requested by Host: www.group-ib.com URL: https://www.group-ib.com/blog/qilin-ransomware/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:2156:f000:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash 16abaf4115dc05b0e69251bb1bf81c1c17705d96400c4f661970c0590f233978 Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; date Mon, 09 Oct 2023 19:58:38 GMT x-content-type-options nosniff strict-transport-security max-age=31536000; includeSubDomains via 1.1 632ee301c4920b52f2463aa9e978c57e.cloudfront.net (CloudFront) x-amz-cf-pop FRA50-C1 x-cache Miss from cloudfront content-length 83164 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Tue, 19 Sep 2023 06:50:43 GMT server nginx etag "144dc-605b0ad86d5a4" x-frame-options sameorigin content-type image/webp access-control-allow-origin https://www.group-ib.com cache-control no-cache, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id zKnwJ6iMq6w2m3iYFAhpssqen0j7b2wAdhmiOjqrzfpse9QUlYJo6g== expires Mon, 09 Oct 2023 19:58:37 GMT
GET H2	200	tag.js Show response mc.yandex.ru/metrika/	202 KB 70 KB	351ms 145ms	Script application/javascript	2a02:6b8::1:119 GLOBAL_DC
General Check archive.org Show headers Download Go to Full URL https://mc.yandex.ru/metrika/tag.js Requested by Host: website.cdn.group-ib.com URL: https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/js/main.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:6b8::1:119 Ulyanovsk, Russian Federation, ASN208722 (GLOBAL_DC, FI), Reverse DNS Software / Resource Hash e9597987b6f5f6a1e2c0a9bb76f9728ad3bda5548c3b1341dac1e7708c18ee7e Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers date Mon, 09 Oct 2023 19:58:38 GMT content-encoding br strict-transport-security max-age=31536000 last-modified Fri, 06 Oct 2023 14:28:02 GMT accept-ch Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA etag "651fef42-11470" content-type application/javascript access-control-allow-origin * cache-control max-age=3600 timing-allow-origin * content-length 70768 expires Mon, 09 Oct 2023 20:58:38 GMT
GET H/1.1	200 OK	counters.gif forms.hsforms.com/embed/v3/	35 B 1015 B	286ms 182ms	Image image/gif	2606:4700::6812:c07d CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://forms.hsforms.com/embed/v3/counters.gif?key=forms-embed-v2-DEFINITION_SUCCESS&count=1 Requested by Host: www.group-ib.com URL: https://www.group-ib.com/blog/qilin-ransomware/ Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:c07d , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers Date Mon, 09 Oct 2023 19:58:38 GMT Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff CF-Cache-Status DYNAMIC x-evy-trace-route-service-name envoyset-translator X-HubSpot-Correlation-Id 808f0f0e-6135-46bb-9c36-fe0afac0404a x-envoy-upstream-service-time 2 Connection keep-alive alt-svc h3=":443"; ma=86400 Content-Length 35 x-evy-trace-route-configuration listener_https/all x-evy-trace-listener listener_https x-request-id 808f0f0e-6135-46bb-9c36-fe0afac0404a Server cloudflare X-Trace 2B6807A3D880E99790E2813C5EB296FA5DDC5130EE000000000000000000 Vary origin Content-Type image/gif x-evy-trace-virtual-host all x-evy-trace-served-by-pod iad02/star-hubspot-td/envoy-proxy-79986f96f-t2vvv Access-Control-Expose-Headers X-Origin-Hublet Cache-Control max-age=0, no-cache, no-store Access-Control-Allow-Credentials false X-Robots-Tag none CF-RAY 8139331409c7912e-FRA
POST		admin-ajax.php www.group-ib.com/wp-admin/	0 0
GET H2	200	twitter-64.svg website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/socials/	1 KB 1 KB	166ms 163ms	Image image/svg+xml	2600:9000:2156:f000:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/socials/twitter-64.svg Requested by Host: website.cdn.group-ib.com URL: https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-blog-post.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:2156:f000:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash ae9dad69229703dfa3b6d226c4c7d692e2f2809bf2475f22612824c2f7602efc Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-blog-post.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; content-encoding gzip x-content-type-options nosniff date Mon, 09 Oct 2023 19:58:38 GMT via 1.1 632ee301c4920b52f2463aa9e978c57e.cloudfront.net (CloudFront) strict-transport-security max-age=31536000; includeSubDomains x-amz-cf-pop FRA50-C1 x-cache Miss from cloudfront content-length 554 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Tue, 29 Nov 2022 07:39:21 GMT server nginx etag "426-5ee9716179e8a-gzip" x-frame-options sameorigin vary Accept-Encoding content-type image/svg+xml access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id 9xma07d428wzSX-RzV7yfE8WLW2Phhayb43uXxnq1SLrifinxU7g9A== expires Mon, 09 Oct 2023 20:28:38 GMT
GET H2	200	twitter-lbg.svg website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/socials/	2 KB 2 KB	120ms 117ms	Image image/svg+xml	2600:9000:2156:f000:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/socials/twitter-lbg.svg Requested by Host: website.cdn.group-ib.com URL: https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-blog-post.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:2156:f000:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash 294fdc878aa8c42b19edc18d385880ad886397846aca640c305f3eb53a965e13 Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-blog-post.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; content-encoding gzip x-content-type-options nosniff date Mon, 09 Oct 2023 19:58:38 GMT via 1.1 632ee301c4920b52f2463aa9e978c57e.cloudfront.net (CloudFront) strict-transport-security max-age=31536000; includeSubDomains x-amz-cf-pop FRA50-C1 x-cache Miss from cloudfront content-length 742 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Tue, 29 Nov 2022 07:39:21 GMT server nginx etag "8f2-5ee9716179e8a-gzip" x-frame-options sameorigin vary Accept-Encoding content-type image/svg+xml access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id YyvXMAvKiD4DHssB5Wr4liEthv2TOwCRiSR2vAHSIUB5RFVQ3wHZ1Q== expires Mon, 09 Oct 2023 20:28:38 GMT
GET H2	200	linkedin-64.svg website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/socials/	919 B 1 KB	163ms 161ms	Image image/svg+xml	2600:9000:2156:f000:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/socials/linkedin-64.svg Requested by Host: website.cdn.group-ib.com URL: https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-blog-post.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:2156:f000:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash f4991587d5312981e74087707ed399bd3820d83f773e7773c013ce00d6835f28 Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-blog-post.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; content-encoding gzip x-content-type-options nosniff date Mon, 09 Oct 2023 19:58:38 GMT via 1.1 632ee301c4920b52f2463aa9e978c57e.cloudfront.net (CloudFront) strict-transport-security max-age=31536000; includeSubDomains x-amz-cf-pop FRA50-C1 x-cache Miss from cloudfront content-length 470 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Tue, 29 Nov 2022 07:39:21 GMT server nginx etag "397-5ee9716179e8a-gzip" x-frame-options sameorigin vary Accept-Encoding content-type image/svg+xml access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id cmeNjWim0EodDSXPhQDB2dE0zMXjevbUWqR7ZeewNXKvmzB3ije71A== expires Mon, 09 Oct 2023 20:28:38 GMT
GET H2	200	linkedin-lbg.svg website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/socials/	2 KB 1 KB	167ms 165ms	Image image/svg+xml	2600:9000:2156:f000:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/socials/linkedin-lbg.svg Requested by Host: website.cdn.group-ib.com URL: https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-blog-post.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:2156:f000:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash c33709a20ca4cd516d65b07a79c1d75445892fcb6d8c6f3871a47ab38d85e075 Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-blog-post.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; content-encoding gzip x-content-type-options nosniff date Mon, 09 Oct 2023 19:58:38 GMT via 1.1 632ee301c4920b52f2463aa9e978c57e.cloudfront.net (CloudFront) strict-transport-security max-age=31536000; includeSubDomains x-amz-cf-pop FRA50-C1 x-cache Miss from cloudfront content-length 639 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Tue, 29 Nov 2022 07:39:21 GMT server nginx etag "7ca-5ee9716179e8a-gzip" x-frame-options sameorigin vary Accept-Encoding content-type image/svg+xml access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id Wb2CKUJVUdfyWdztuWHAE0HyDWKMYBUn8kIfPifSq1hVBwxh2YIlBg== expires Mon, 09 Oct 2023 20:28:38 GMT
GET H2	200	telegram-64.svg website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/socials/	1 KB 2 KB	115ms 113ms	Image image/svg+xml	2600:9000:2156:f000:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/socials/telegram-64.svg Requested by Host: website.cdn.group-ib.com URL: https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-blog-post.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:2156:f000:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash cdc4d10b6b74ad79b55333b9882e854f054ee8b9953c6203dc46c68dc74eb0fb Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-blog-post.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; content-encoding gzip x-content-type-options nosniff date Mon, 09 Oct 2023 19:58:38 GMT via 1.1 632ee301c4920b52f2463aa9e978c57e.cloudfront.net (CloudFront) strict-transport-security max-age=31536000; includeSubDomains x-amz-cf-pop FRA50-C1 x-cache Miss from cloudfront content-length 787 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Tue, 29 Nov 2022 07:39:21 GMT server nginx etag "5fc-5ee9716179e8a-gzip" x-frame-options sameorigin vary Accept-Encoding content-type image/svg+xml access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id azm46uPEJLpyw_ZLkqUU65BFJA7vs8g6uMsx5jl4thSR-Bx5wMh_kA== expires Mon, 09 Oct 2023 20:28:38 GMT
GET H2	200	telegram-lbg.svg website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/socials/	3 KB 2 KB	121ms 119ms	Image image/svg+xml	2600:9000:2156:f000:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/socials/telegram-lbg.svg Requested by Host: website.cdn.group-ib.com URL: https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-blog-post.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:2156:f000:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash ac57c7130d61697977d2ed1796c27eefed8249083472716e474e5604b20636aa Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-blog-post.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; content-encoding gzip x-content-type-options nosniff date Mon, 09 Oct 2023 19:58:38 GMT via 1.1 632ee301c4920b52f2463aa9e978c57e.cloudfront.net (CloudFront) strict-transport-security max-age=31536000; includeSubDomains x-amz-cf-pop FRA50-C1 x-cache Miss from cloudfront content-length 949 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Tue, 29 Nov 2022 07:39:21 GMT server nginx etag "bf1-5ee9716179e8a-gzip" x-frame-options sameorigin vary Accept-Encoding content-type image/svg+xml access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id g9W_GSP9ozcUQOeEetcdAybdva1EWq77K9Yrhbv2MVNDBik_rgiesQ== expires Mon, 09 Oct 2023 20:28:38 GMT
GET H/1.1	200 OK	counters.gif forms-eu1.hsforms.com/embed/v3/	35 B 1016 B	185ms 77ms	Image image/gif	172.65.232.43 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://forms-eu1.hsforms.com/embed/v3/counters.gif?key=forms-embed-v2-RENDER_SUCCESS&count=1 Requested by Host: www.group-ib.com URL: https://www.group-ib.com/blog/qilin-ransomware/ Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 172.65.232.43 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers Date Mon, 09 Oct 2023 19:58:38 GMT Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff CF-Cache-Status DYNAMIC x-evy-trace-route-service-name envoyset-translator X-HubSpot-Correlation-Id aacd0b7d-b486-4422-b722-0a81e9087f5f x-envoy-upstream-service-time 1 Connection keep-alive alt-svc h3=":443"; ma=86400 Content-Length 35 x-evy-trace-route-configuration listener_https/all x-evy-trace-listener listener_https x-request-id aacd0b7d-b486-4422-b722-0a81e9087f5f Server cloudflare X-Trace 2B36B45E0774D6AE332878AC2A6EA460136F39FCA2000000000000000000 Vary origin Content-Type image/gif x-evy-trace-virtual-host all x-evy-trace-served-by-pod fra04/star-hubspot-td/envoy-proxy-5cdd94655b-2886x Access-Control-Expose-Headers X-Origin-Hublet Cache-Control max-age=0, no-cache, no-store Access-Control-Allow-Credentials false X-Robots-Tag none CF-RAY 813933158bae1c01-FRA
GET H2	200	combinedConfigs Show response cta-eu1.hubspot.com/web-interactives/public/v1/embed/	207 B 1 KB	196ms 82ms	Fetch application/json	172.65.198.159 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cta-eu1.hubspot.com/web-interactives/public/v1/embed/combinedConfigs?portalId=25755956&currentUrl=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fqilin-ransomware%2F&referrer=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fqilin-ransomware%2F Requested by Host: fhp-de-js.group-ib.com URL: https://fhp-de-js.group-ib.com/d/bt-autoinject.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.65.198.159 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 4e1f5dae1f231a3e6c42993418f2c2b7670e62db5b3ffee9afe0afa6657504f5 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers date Mon, 09 Oct 2023 19:58:39 GMT strict-transport-security max-age=31536000; includeSubDomains; preload x-content-type-options nosniff cf-cache-status DYNAMIC nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} x-evy-trace-route-service-name envoyset-translator x-hubspot-correlation-id 04b3e1ee-5cb6-4308-8a8e-4e56421af0b1 content-encoding br x-envoy-upstream-service-time 7 x-evy-trace-route-configuration listener_https/all x-evy-trace-listener listener_https x-request-id 04b3e1ee-5cb6-4308-8a8e-4e56421af0b1 server cloudflare vary origin access-control-allow-methods OPTIONS, GET content-type application/json;charset=utf-8 access-control-allow-origin https://www.group-ib.com x-evy-trace-virtual-host all access-control-max-age 180 access-control-allow-credentials true cache-control max-age=0, no-cache, no-store report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ICC3mOH%2FTHLkCxM0Vx%2BzwjR0ZjyTFbycwc1VUIunmlHb0ZXWYx%2BsCckpRYCVi7u2B24ApeDw3QHQiMpwUs1t8UshHU5YpxmN5D%2BQE8O3jgV%2FY677Fjmtc9Y840%2F8RDqSYBHrgw8%3D"}],"group":"cf-nel","max_age":604800} x-robots-tag noindex, follow access-control-allow-headers Accept, Accept-Charset, Accept-Encoding, Accept-Language, Content-Type, Host, Origin, Referer, User-Agent cf-ray 813933160f1765b2-FRA x-evy-trace-served-by-pod fra04/star-hubspot-td/envoy-proxy-5cdd94655b-fwv45
GET H2	200	json Show response api-eu1.hubapi.com/hs-script-loader-public/v1/config/pixels-and-events/	250 B 1 KB	185ms 88ms	XHR application/json	2a06:98c1:3200::90:2 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://api-eu1.hubapi.com/hs-script-loader-public/v1/config/pixels-and-events/json?portalId=25755956 Requested by Host: fhp-de-js.group-ib.com URL: https://fhp-de-js.group-ib.com/d/bt-autoinject.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a06:98c1:3200::90:2 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 1aa462865a143f6b053d5d1594aea3e38d36ebad2a23a7fcfdd84ba7a7a1fddb Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers date Mon, 09 Oct 2023 19:58:39 GMT strict-transport-security max-age=31536000; includeSubDomains; preload x-content-type-options nosniff cf-cache-status DYNAMIC nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} x-evy-trace-route-service-name envoyset-translator x-hubspot-correlation-id 0c9c4485-2c1c-44d3-936d-b52ff60fa73e content-encoding br x-envoy-upstream-service-time 3 x-evy-trace-route-configuration listener_https/all x-evy-trace-listener listener_https x-request-id 0c9c4485-2c1c-44d3-936d-b52ff60fa73e server cloudflare x-trace 2BD85480A53383AAF44C277152152FC0E6531ABD82000000000000000000 vary origin access-control-allow-methods GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD content-type application/json;charset=utf-8 access-control-allow-origin https://www.group-ib.com x-evy-trace-virtual-host all access-control-max-age 180 access-control-allow-credentials false x-evy-trace-served-by-pod fra04/hubapi-td/envoy-proxy-86f46d6c7b-dn7wv report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=rOpBPxIH%2BOnS4KeoSPyNIuF%2BQjEi4wk2qnlKzF9bz8ZZ0UftiKKuGCUadwxn0xaC0AwceQFaHp51fWKcAuzMv0yZF1uC61QUSnJXvVokf7WP%2FLqe%2Be%2B%2FX01F0qINs738Ls2Wd4JkpiE6Kp%2F0vTHCXw%3D%3D"}],"group":"cf-nel","max_age":604800} cf-ray 81393315fba62c77-FRA access-control-allow-headers *
GET H2	200	collect px.ads.linkedin.com/	0 532 B	286ms 145ms	Image application/javascript	2620:1ec:21::14 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Show image Full URL https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=&time=1696881518934&url=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fqilin-ransomware%2F Requested by Host: www.group-ib.com URL: https://www.group-ib.com/blog/qilin-ransomware/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2620:1ec:21::14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers date Mon, 09 Oct 2023 19:58:38 GMT x-li-pop afd-prod-lva1-x x-msedge-ref Ref A: 85EBB5CB77774E48ACBA0AD3475A920E Ref B: FRAEDGE1320 Ref C: 2023-10-09T19:58:39Z linkedin-action 1 x-cache CONFIG_NOCACHE content-type application/javascript x-li-fabric prod-lva1 x-li-proto http/2 content-length 0 x-li-uuid AAYHTgQsoKxcYIVLmC7h2w==
GET H2	200	json Show response forms-eu1.hscollectedforms.net/collected-forms/v1/config/	116 B 412 B	64ms 62ms	XHR application/json	172.65.192.122 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://forms-eu1.hscollectedforms.net/collected-forms/v1/config/json?portalId=25755956&utk= Requested by Host: fhp-de-js.group-ib.com URL: https://fhp-de-js.group-ib.com/d/bt-autoinject.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.65.192.122 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 43f22362329b9705cf8629061fb5b1d1a38f1cc2bc9fd46728f73e5cd9eb77cf Security Headers Name Value X-Content-Type-Options nosniff Request headers Accept application/json, text/plain, */* Referer https://www.group-ib.com/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers date Mon, 09 Oct 2023 19:58:38 GMT content-encoding br x-content-type-options nosniff cf-cache-status DYNAMIC x-evy-trace-route-service-name envoyset-translator x-hubspot-correlation-id 249a503a-319e-4d15-808c-3554505058b7 x-envoy-upstream-service-time 3 x-evy-trace-route-configuration listener_https/all x-evy-trace-listener listener_https x-request-id 249a503a-319e-4d15-808c-3554505058b7 server cloudflare vary Accept-Encoding access-control-allow-methods GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD content-type application/json;charset=utf-8 access-control-allow-origin https://www.group-ib.com x-evy-trace-virtual-host all cache-control max-age=0 x-evy-trace-served-by-pod fra04/app-td/envoy-proxy-797758f45b-49p9l access-control-max-age 180 x-robots-tag none access-control-allow-headers * cf-ray 813933159ca19bca-FRA
GET H/1.1	200 OK	counters.gif forms.hsforms.com/embed/v3/	35 B 1016 B	193ms 193ms	Image image/gif	2606:4700::6812:c07d CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://forms.hsforms.com/embed/v3/counters.gif?key=forms-embed-v2-DEFINITION_SUCCESS&count=1 Requested by Host: js-eu1.hsforms.net URL: https://js-eu1.hsforms.net/forms/v2.js Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:c07d , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers Date Mon, 09 Oct 2023 19:58:39 GMT Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff CF-Cache-Status DYNAMIC x-evy-trace-route-service-name envoyset-translator X-HubSpot-Correlation-Id 6805889c-2149-4dd4-b3e8-5f144de71265 x-envoy-upstream-service-time 30 Connection keep-alive alt-svc h3=":443"; ma=86400 Content-Length 35 x-evy-trace-route-configuration listener_https/all x-evy-trace-listener listener_https x-request-id 6805889c-2149-4dd4-b3e8-5f144de71265 Server cloudflare X-Trace 2BB258D1943EF931F1320DC48A999A5710025637C0000000000000000000 Vary origin Content-Type image/gif x-evy-trace-virtual-host all x-evy-trace-served-by-pod iad02/star-hubspot-td/envoy-proxy-79986f96f-r55k7 Access-Control-Expose-Headers X-Origin-Hublet Cache-Control max-age=0, no-cache, no-store Access-Control-Allow-Credentials false X-Robots-Tag none CF-RAY 813933159c3e912e-FRA
GET H2	200	6si.min.js Show response j.6sc.co/	60 KB 16 KB	499ms 48ms	Script application/javascript	92.123.27.11
General Check archive.org Show headers Download Go to Full URL https://j.6sc.co/6si.min.js Requested by Host: www.group-ib.com URL: https://www.group-ib.com/blog/qilin-ransomware/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 92.123.27.11 -, , ASN (), Reverse DNS Software nginx/1.14.0 (Ubuntu) / Resource Hash a09fe9b9f8deb402e85425e864ed0d7bd28a382f8e4b5e5ad1a6bb3ad3030ce3 Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers pragma no-cache date Mon, 09 Oct 2023 19:58:39 GMT content-encoding gzip x-content-type-options nosniff last-modified Mon, 09 Oct 2023 17:32:21 GMT server nginx/1.14.0 (Ubuntu) etag "65243925-f02a" vary Accept-Encoding content-type application/javascript cache-control private, no-cache, proxy-revalidate accept-ranges bytes content-length 16343 expires Mon, 09 Oct 2023 19:58:39 GMT
GET H2	200	/ Show response googleads.g.doubleclick.net/pagead/viewthroughconversion/10897073384/	3 KB 2 KB	170ms 63ms	Script text/javascript	2a00:1450:4001:82a::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://googleads.g.doubleclick.net/pagead/viewthroughconversion/10897073384/?random=1696881518972&cv=11&fst=1696881518972&bg=ffffff&guid=ON&async=1&gtm=45He3a40&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fqilin-ransomware%2F&ref=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fqilin-ransomware%2F&hn=www.googleadservices.com&frm=0&tiba=Gain%20new-found%20insights%20into%20Qilin%20Ransomware%2C%20their%20Data%20Leak%20Site%20(DLS)%20and%20operations%20targeting%20critical%20industries%20%7C%20Group-IB%20Blog&auid=767509692.1696881519&uamb=0&uaw=0&rfmt=3&fmt=4 Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-PW7265 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash 73ccf26f0e6a194b263add4dbcba96705381ef3946efd6f1b749d0bc65e9068f Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers pragma no-cache date Mon, 09 Oct 2023 19:58:39 GMT content-encoding br x-content-type-options nosniff server cafe content-type text/javascript; charset=UTF-8 p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" cache-control no-cache, must-revalidate cross-origin-resource-policy cross-origin content-disposition attachment; filename="f.txt" timing-allow-origin * alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 1415 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	NeverBounce.js Show response cdn.neverbounce.com/widget/dist/	96 KB 29 KB	191ms 61ms	Script application/javascript	13.32.99.91 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://cdn.neverbounce.com/widget/dist/NeverBounce.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-PW7265 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 13.32.99.91 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-13-32-99-91.fra60.r.cloudfront.net Software AmazonS3 / Resource Hash c99d11cb4960d6e1918ed55d5bcbb316d38b51098e2efc1201904d7274d3273e Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers date Mon, 09 Oct 2023 16:32:17 GMT content-encoding gzip via 1.1 0c792defeeaa18965559ad74895ea56a.cloudfront.net (CloudFront) last-modified Mon, 02 Mar 2020 18:37:33 GMT server AmazonS3 x-amz-cf-pop FRA60-P3 age 12383 etag W/"c1e06621030dfcba15b88abbcaa546eb" vary Accept-Encoding x-cache Hit from cloudfront content-type application/javascript x-amz-cf-id yPIUPApl3U4gRfdbWCzWHXmbjipz1EGfiEZAeWD7LurKWIuCaT5EWA==
GET H2	200	63e267f61a03d71ea3df5fe7 Show response ws.zoominfo.com/pixel/	3 KB 2 KB	338ms 235ms	Script text/javascript	2606:4700::6810:890f CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://ws.zoominfo.com/pixel/63e267f61a03d71ea3df5fe7 Requested by Host: www.group-ib.com URL: https://www.group-ib.com/blog/qilin-ransomware/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6810:890f , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Express Resource Hash ada31fc588a3a696bebf9bcd5efcbcf9ff026c41d08c6a5e214d880fbb14ca2c Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/blog/qilin-ransomware/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers date Mon, 09 Oct 2023 19:58:39 GMT content-encoding gzip x-content-type-options nosniff cf-cache-status DYNAMIC via 1.1 google server cloudflare x-powered-by Express vary Accept-Encoding content-type text/javascript access-control-allow-origin * access-control-allow-credentials true cf-ray 813933166e14bb74-FRA access-control-allow-headers Content-Type,cf-ipcountry,service-version,x-appengine-user-ip,x-forwarded-for, x-ws-collect-type,requestFromZITag,unifiedScriptVerified,_zitok,_vtok alt-svc h3=":443"; ma=86400
GET H2	200	fbevents.js Show response connect.facebook.net/en_US/	198 KB 53 KB	138ms 38ms	Script application/x-javascript	2a03:2880:f083:9:face:b00c:0:3 FACEBOOK
General Check archive.org Show headers Download Go to Full URL https://connect.facebook.net/en_US/fbevents.js Requested by Host: www.group-ib.com URL: https://www.group-ib.com/blog/qilin-ransomware/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a03:2880:f083:9:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US), Reverse DNS Software / Resource Hash 805270b078cde87b61bb57c8bd44f8b58b0d128f5a8efdd4395470b45b291d65 Security Headers Name Value Content-Security-Policy default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script'; Strict-Transport-Security max-age=31536000; preload; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers content-security-policy default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script'; content-encoding gzip x-content-type-options nosniff strict-transport-security max-age=31536000; preload; includeSubDomains date Mon, 09 Oct 2023 19:58:39 GMT document-policy force-load-at-top cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400 content-length 53356 x-xss-protection 0 pragma public x-fb-debug puGKfO0jP1lh9VDhTrCcCdSL/6hLVCap2f3I3nG8k9VVwg26C3iHxpGq6lDEYgP1ruFhVzyOsC0Wzta541AeXg== cross-origin-opener-policy same-origin-allow-popups vary Accept-Encoding x-frame-options DENY content-type application/x-javascript; charset=utf-8 cache-control public, max-age=1200 permissions-policy accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(), gyroscope=(), hid=(), idle-detection=(), magnetometer=(), microphone=(), midi=(), payment=(), screen-wake-lock=(), serial=(), usb=() timing-allow-origin * expires Sat, 01 Jan 2000 00:00:00 GMT
GET H2	200	js Show response www.googletagmanager.com/gtag/	288 KB 94 KB	63ms 62ms	Script application/javascript	2a00:1450:4001:806::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtag/js?id=G-QMES53K3Y2&l=dataLayer&cx=c Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-PW7265 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:806::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash dc8eceab8e2d1faf4e8590fc34bc8ede6f6c5ff57402c05f310b23d8bf998285 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers date Mon, 09 Oct 2023 19:58:39 GMT content-encoding br strict-transport-security max-age=31536000; includeSubDomains server Google Tag Manager vary Accept-Encoding content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true cross-origin-resource-policy cross-origin access-control-allow-headers Cache-Control content-length 96191 x-xss-protection 0 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 expires Mon, 09 Oct 2023 19:58:39 GMT
GET H2	200	collect px4.ads.linkedin.com/ Redirect Chain https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=4496601&time=1696881518978&url=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fqilin-ransomware%2F&tm=gtmv2 https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=4496601&time=1696881518978&url=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fqilin-ransomware%2F&tm=gtmv2&cookiesTest=true https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D4496601%26time%3D1696881518978%26url%3Dhttps%253A%252F%252Fwww.group-ib.com%252Fb... https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=4496601&time=1696881518978&url=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fqilin-ransomware%2F&tm=gtmv2&cookiesTest=true&liSync=true https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=4496601&time=1696881518978&url=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fqilin-ransomware%2F&tm=gtmv2&cookiesTest=true&liSync=true&e_ipv6=AQKMjYiGr...	0 265 B	334ms 219ms	Image application/javascript	13.107.42.14
General Check archive.org Show headers Download Go to Show image Full URL https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=4496601&time=1696881518978&url=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fqilin-ransomware%2F&tm=gtmv2&cookiesTest=true&liSync=true&e_ipv6=AQKMjYiGrG5prAAAAYsWBS0nqqgQjQOrQb5WI8JHPcP_XAYRemhFBiOQXKOoXIsIWd5-NnOJRcSN2A Requested by Host: www.group-ib.com URL: https://www.group-ib.com/blog/qilin-ransomware/ Protocol H2 Server 13.107.42.14 -, , ASN (), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers date Mon, 09 Oct 2023 19:58:39 GMT x-li-pop afd-prod-lor1-x x-msedge-ref Ref A: 34045DF47EA441A89026B91FDA0DD31B Ref B: FRAEDGE1812 Ref C: 2023-10-09T19:58:40Z linkedin-action 1 x-cache CONFIG_NOCACHE content-type application/javascript x-li-fabric prod-lor1 x-li-proto http/2 content-length 0 x-li-uuid AAYHTgQ9Xak/bRe1O6PxFg== Redirect headers date Mon, 09 Oct 2023 19:58:39 GMT x-li-pop afd-prod-lor1-x x-msedge-ref Ref A: 2103FA0A9A9C4A0685D17C3449C37CE4 Ref B: FRAEDGE1320 Ref C: 2023-10-09T19:58:39Z linkedin-action 1 x-cache CONFIG_NOCACHE x-li-fabric prod-lor1 location https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=4496601&time=1696881518978&url=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fqilin-ransomware%2F&tm=gtmv2&cookiesTest=true&liSync=true&e_ipv6=AQKMjYiGrG5prAAAAYsWBS0nqqgQjQOrQb5WI8JHPcP_XAYRemhFBiOQXKOoXIsIWd5-NnOJRcSN2A x-li-proto http/2 content-length 0 x-li-uuid AAYHTgQ4S2EZ9BwVwM2yJg==
GET H/1.1	200 OK	counters.gif forms-eu1.hsforms.com/embed/v3/	35 B 1016 B	364ms 63ms	Image image/gif	172.65.232.43 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://forms-eu1.hsforms.com/embed/v3/counters.gif?key=collected-forms-embed-js-form-bind&count=5 Requested by Host: www.group-ib.com URL: https://www.group-ib.com/blog/qilin-ransomware/ Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 172.65.232.43 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers Date Mon, 09 Oct 2023 19:58:39 GMT Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff CF-Cache-Status DYNAMIC x-evy-trace-route-service-name envoyset-translator X-HubSpot-Correlation-Id 6200b223-45ad-4efc-bed7-e73f050de707 x-envoy-upstream-service-time 1 Connection keep-alive alt-svc h3=":443"; ma=86400 Content-Length 35 x-evy-trace-route-configuration listener_https/all x-evy-trace-listener listener_https x-request-id 6200b223-45ad-4efc-bed7-e73f050de707 Server cloudflare X-Trace 2BF4F23408B5CEEABE65450CA24C13C9AE30E1160C000000000000000000 Vary origin Content-Type image/gif x-evy-trace-virtual-host all x-evy-trace-served-by-pod fra04/star-hubspot-td/envoy-proxy-5cdd94655b-2886x Access-Control-Expose-Headers X-Origin-Hublet Cache-Control max-age=0, no-cache, no-store Access-Control-Allow-Credentials false X-Robots-Tag none CF-RAY 81393317eeda1c01-FRA
GET H2	200	sync_cookie_image_decide mc.yandex.com/ Redirect Chain https://mc.yandex.com/sync_cookie_image_check https://mc.yandex.ru/sync_cookie_image_start?redirect_domain=mc.yandex.com&token=10151.oy7oRzlmfPd-VYJhtKuJZczYuEOBC3y6K8lElRKbtrpeXDs_r68GOP3rmIvYjODe.c8ty-bTMHiH_0CpPHsRVX5KfADM%2C https://mc.yandex.com/sync_cookie_image_decide?token=10151.kzqw0iTY-3QlRwoHDMgPb8BU0vBD34XmgRqW52vllyzSPs7vKxuf-4HHCPPhl67nXHWYGqB7jzm_TI1UiuEkG8Sel72RJZW35fSNpW9sBmw%2C.1Em5bQVOKZYuliExYk-gARFLINI%2C	43 B 67 B	81ms 81ms	Image image/gif	2a02:6b8::1:119 GLOBAL_DC
General Check archive.org Show headers Download Go to Show image Full URL https://mc.yandex.com/sync_cookie_image_decide?token=10151.kzqw0iTY-3QlRwoHDMgPb8BU0vBD34XmgRqW52vllyzSPs7vKxuf-4HHCPPhl67nXHWYGqB7jzm_TI1UiuEkG8Sel72RJZW35fSNpW9sBmw%2C.1Em5bQVOKZYuliExYk-gARFLINI%2C Requested by Host: www.group-ib.com URL: https://www.group-ib.com/blog/qilin-ransomware/ Protocol H2 Server 2a02:6b8::1:119 Ulyanovsk, Russian Federation, ASN208722 (GLOBAL_DC, FI), Reverse DNS Software / Resource Hash 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87 Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers date Mon, 09 Oct 2023 19:58:39 GMT strict-transport-security max-age=31536000 content-length 43 x-xss-protection 1; mode=block content-type image/gif Redirect headers location https://mc.yandex.com/sync_cookie_image_decide?token=10151.kzqw0iTY-3QlRwoHDMgPb8BU0vBD34XmgRqW52vllyzSPs7vKxuf-4HHCPPhl67nXHWYGqB7jzm_TI1UiuEkG8Sel72RJZW35fSNpW9sBmw%2C.1Em5bQVOKZYuliExYk-gARFLINI%2C date Mon, 09 Oct 2023 19:58:39 GMT strict-transport-security max-age=31536000 x-xss-protection 1; mode=block
GET H2	200	advert.gif mc.yandex.com/metrika/	43 B 185 B	83ms 81ms	Image image/gif	2a02:6b8::1:119 GLOBAL_DC
General Check archive.org Show headers Download Go to Show image Full URL https://mc.yandex.com/metrika/advert.gif Requested by Host: www.group-ib.com URL: https://www.group-ib.com/blog/qilin-ransomware/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:6b8::1:119 Ulyanovsk, Russian Federation, ASN208722 (GLOBAL_DC, FI), Reverse DNS Software / Resource Hash 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers date Mon, 09 Oct 2023 19:58:39 GMT strict-transport-security max-age=31536000 last-modified Fri, 06 Oct 2023 14:26:04 GMT accept-ch Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA etag "651feecc-2b" content-type image/gif access-control-allow-origin * cache-control max-age=3600 accept-ranges bytes timing-allow-origin * content-length 43 expires Mon, 09 Oct 2023 20:58:39 GMT
POST H2	204	collect region1.analytics.google.com/g/	0 255 B	303ms 37ms	Ping text/plain	2001:4860:4802:32::36
General Check archive.org Show headers Download Go to Full URL https://region1.analytics.google.com/g/collect?v=2&tid=G-QMES53K3Y2&gtm=45je3a40&_p=1559040215&_gaz=1&cid=380805639.1696881519&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_s=1&dl=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fqilin-ransomware%2F&sid=1696881519&sct=1&seg=0&dr=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fqilin-ransomware%2F&dt=Gain%20new-found%20insights%20into%20Qilin%20Ransomware%2C%20their%20Data%20Leak%20Site%20(DLS)%20and%20operations%20targeting%20critical%20industries%20%7C%20Group-IB%20Blog&en=page_view&_fv=1&_nsi=1&_ss=1 Requested by Host: fhp-de-js.group-ib.com URL: https://fhp-de-js.group-ib.com/d/bt-autoinject.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2001:4860:4802:32::36 -, , ASN (), Reverse DNS Software Golfe2 / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers pragma no-cache date Mon, 09 Oct 2023 19:58:39 GMT server Golfe2 content-type text/plain access-control-allow-origin https://www.group-ib.com cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 0 expires Fri, 01 Jan 1990 00:00:00 GMT
POST H2	204	collect stats.g.doubleclick.net/g/	0 246 B	302ms 36ms	Ping text/plain	2a00:1450:400c:c0b::9c
General Check archive.org Show headers Download Go to Full URL https://stats.g.doubleclick.net/g/collect?v=2&tid=G-QMES53K3Y2&cid=380805639.1696881519&gtm=45je3a40&aip=1 Requested by Host: fhp-de-js.group-ib.com URL: https://fhp-de-js.group-ib.com/d/bt-autoinject.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:400c:c0b::9c -, , ASN (), Reverse DNS Software Golfe2 / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers pragma no-cache date Mon, 09 Oct 2023 19:58:39 GMT server Golfe2 content-type text/plain access-control-allow-origin https://www.group-ib.com cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	ga-audiences www.google.de/ads/	42 B 107 B	318ms 61ms	Image image/gif	2a00:1450:4001:811::2003
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.de/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&tid=G-QMES53K3Y2&cid=380805639.1696881519&gtm=45je3a40&aip=1&z=1814081868 Requested by Host: www.group-ib.com URL: https://www.group-ib.com/blog/qilin-ransomware/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:811::2003 -, , ASN (), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers pragma no-cache date Mon, 09 Oct 2023 19:58:39 GMT x-content-type-options nosniff server cafe content-type image/gif p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin timing-allow-origin * alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H3	200	js Show response www.googletagmanager.com/gtag/	227 KB 79 KB	57ms 56ms	Script application/javascript	2a00:1450:4001:806::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtag/js?id=AW-10882981508 Requested by Host: js-eu1.hsadspixel.net URL: https://js-eu1.hsadspixel.net/fb.js Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:806::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash e9cacf84be3bf4857378c5a10268a0be228d3d91a267abe99119344f348a2266 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers date Mon, 09 Oct 2023 19:58:39 GMT content-encoding br strict-transport-security max-age=31536000; includeSubDomains cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 80754 x-xss-protection 0 last-modified Mon, 09 Oct 2023 18:55:08 GMT server Google Tag Manager vary Accept-Encoding content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true access-control-allow-headers Cache-Control expires Mon, 09 Oct 2023 19:58:39 GMT
GET H3	200	js Show response www.googletagmanager.com/gtag/	227 KB 79 KB	58ms 56ms	Script application/javascript	2a00:1450:4001:806::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtag/js?id=AW-10882981508&l=dataLayer&cx=c Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-PW7265 Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:806::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash 0d1a8c438beefa903ffadd66846bd7037c80a67196ca7fca065326534f41d86f Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers date Mon, 09 Oct 2023 19:58:39 GMT content-encoding br strict-transport-security max-age=31536000; includeSubDomains cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 80710 x-xss-protection 0 last-modified Mon, 09 Oct 2023 18:55:08 GMT server Google Tag Manager vary Accept-Encoding content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true access-control-allow-headers Cache-Control expires Mon, 09 Oct 2023 19:58:39 GMT
GET H/1.1	200 OK	counters.gif perf-eu1.hsforms.com/embed/v3/	35 B 1 KB	305ms 70ms	Image image/gif	172.65.232.43 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://perf-eu1.hsforms.com/embed/v3/counters.gif?key=config-loaded-success&value=1 Requested by Host: www.group-ib.com URL: https://www.group-ib.com/blog/qilin-ransomware/ Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 172.65.232.43 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers Date Mon, 09 Oct 2023 19:58:39 GMT Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff CF-Cache-Status MISS x-evy-trace-route-service-name envoyset-translator X-HubSpot-Correlation-Id 282b684a-8ef9-4700-bdc9-eae8bae35285 x-envoy-upstream-service-time 1 Connection keep-alive alt-svc h3=":443"; ma=86400 Content-Length 35 x-evy-trace-route-configuration listener_https/all x-evy-trace-listener listener_https x-request-id 282b684a-8ef9-4700-bdc9-eae8bae35285 Last-Modified Mon, 09 Oct 2023 19:58:39 GMT Server cloudflare X-Trace 2BBDD3711B9D3609722ABBA65D9C0F9FF10574C3B4000000000000000000 Vary origin, Accept-Encoding Content-Type image/gif x-evy-trace-virtual-host all x-evy-trace-served-by-pod fra04/star-hubspot-td/envoy-proxy-5cdd94655b-qj67h Access-Control-Expose-Headers X-Origin-Hublet Cache-Control max-age=0, no-cache, no-store Access-Control-Allow-Credentials false Accept-Ranges bytes X-Robots-Tag none CF-RAY 8139331879599bb9-FRA
GET H2	200	/ www.google.com/pagead/1p-user-list/10897073384/	42 B 455 B	241ms 41ms	Image image/gif	2a00:1450:4001:827::2004
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.com/pagead/1p-user-list/10897073384/?random=1696881518972&cv=11&fst=1696878000000&bg=ffffff&guid=ON&async=1&gtm=45He3a40&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fqilin-ransomware%2F&ref=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fqilin-ransomware%2F&frm=0&tiba=Gain%20new-found%20insights%20into%20Qilin%20Ransomware%2C%20their%20Data%20Leak%20Site%20(DLS)%20and%20operations%20targeting%20critical%20industries%20%7C%20Group-IB%20Blog&fmt=3&is_vtc=1&random=2092762574&rmt_tld=0&ipr=y Requested by Host: www.group-ib.com URL: https://www.group-ib.com/blog/qilin-ransomware/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:827::2004 -, , ASN (), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value Content-Security-Policy script-src 'none'; object-src 'none' X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers pragma no-cache date Mon, 09 Oct 2023 19:58:39 GMT content-security-policy script-src 'none'; object-src 'none' x-content-type-options nosniff server cafe content-type image/gif p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin timing-allow-origin * alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	/ www.google.de/pagead/1p-user-list/10897073384/	42 B 455 B	240ms 40ms	Image image/gif	2a00:1450:4001:811::2003
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.de/pagead/1p-user-list/10897073384/?random=1696881518972&cv=11&fst=1696878000000&bg=ffffff&guid=ON&async=1&gtm=45He3a40&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fqilin-ransomware%2F&ref=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fqilin-ransomware%2F&frm=0&tiba=Gain%20new-found%20insights%20into%20Qilin%20Ransomware%2C%20their%20Data%20Leak%20Site%20(DLS)%20and%20operations%20targeting%20critical%20industries%20%7C%20Group-IB%20Blog&fmt=3&is_vtc=1&random=2092762574&rmt_tld=1&ipr=y Requested by Host: www.group-ib.com URL: https://www.group-ib.com/blog/qilin-ransomware/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:811::2003 -, , ASN (), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value Content-Security-Policy script-src 'none'; object-src 'none' X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers pragma no-cache date Mon, 09 Oct 2023 19:58:39 GMT content-security-policy script-src 'none'; object-src 'none' x-content-type-options nosniff server cafe content-type image/gif p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin timing-allow-origin * alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	notify Show response api.neverbounce.com/v4/poe/	63 B 282 B	491ms 169ms	Script application/javascript	18.206.50.43
General Check archive.org Show headers Download Go to Full URL https://api.neverbounce.com/v4/poe/notify?key=public_feedec8c69cd171b06421bb96273f04d&event=form.load&callback=__neverbounce_393685 Requested by Host: cdn.neverbounce.com URL: https://cdn.neverbounce.com/widget/dist/NeverBounce.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 18.206.50.43 -, , ASN (), Reverse DNS Software nginx / Resource Hash 7a520c4fe10536da46163ad2c68afe1a07f185f3a4d4f652468904dbc8059bb7 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers date Mon, 09 Oct 2023 19:58:39 GMT content-encoding gzip strict-transport-security max-age=31536000; includeSubDomains server nginx vary Accept-Encoding content-type application/javascript cache-control no-cache, private x-ua-compatible IE=Edge
GET H2	200	notify Show response api.neverbounce.com/v4/poe/	62 B 282 B	446ms 165ms	Script application/javascript	18.206.50.43
General Check archive.org Show headers Download Go to Full URL https://api.neverbounce.com/v4/poe/notify?key=public_feedec8c69cd171b06421bb96273f04d&event=form.load&callback=__neverbounce_633626 Requested by Host: cdn.neverbounce.com URL: https://cdn.neverbounce.com/widget/dist/NeverBounce.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 18.206.50.43 -, , ASN (), Reverse DNS Software nginx / Resource Hash 9a4c163238fff6c84a3b3824a1c5d74578a732192eead9ebf7a0a2518b380e28 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers date Mon, 09 Oct 2023 19:58:39 GMT content-encoding gzip strict-transport-security max-age=31536000; includeSubDomains server nginx vary Accept-Encoding content-type application/javascript cache-control no-cache, private x-ua-compatible IE=Edge
GET H2	200	notify Show response api.neverbounce.com/v4/poe/	63 B 282 B	486ms 301ms	Script application/javascript	18.206.50.43
General Check archive.org Show headers Download Go to Full URL https://api.neverbounce.com/v4/poe/notify?key=public_feedec8c69cd171b06421bb96273f04d&event=form.load&callback=__neverbounce_784207 Requested by Host: cdn.neverbounce.com URL: https://cdn.neverbounce.com/widget/dist/NeverBounce.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 18.206.50.43 -, , ASN (), Reverse DNS Software nginx / Resource Hash 781009c633758f02b731f7ea52abb90e032aaced98536d73abb617da95e271a4 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers date Mon, 09 Oct 2023 19:58:39 GMT content-encoding gzip strict-transport-security max-age=31536000; includeSubDomains server nginx vary Accept-Encoding content-type application/javascript cache-control no-cache, private x-ua-compatible IE=Edge
GET H2	200	notify Show response api.neverbounce.com/v4/poe/	63 B 282 B	350ms 167ms	Script application/javascript	18.206.50.43
General Check archive.org Show headers Download Go to Full URL https://api.neverbounce.com/v4/poe/notify?key=public_feedec8c69cd171b06421bb96273f04d&event=form.load&callback=__neverbounce_149473 Requested by Host: cdn.neverbounce.com URL: https://cdn.neverbounce.com/widget/dist/NeverBounce.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 18.206.50.43 -, , ASN (), Reverse DNS Software nginx / Resource Hash 9ad508f8eaed1cda1652a5e74d8f5c979fda7297b5d6be2a25f7e26cdbe8f456 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers date Mon, 09 Oct 2023 19:58:39 GMT content-encoding gzip strict-transport-security max-age=31536000; includeSubDomains server nginx vary Accept-Encoding content-type application/javascript cache-control no-cache, private x-ua-compatible IE=Edge
GET H2	200	notify Show response api.neverbounce.com/v4/poe/	63 B 282 B	362ms 182ms	Script application/javascript	18.206.50.43
General Check archive.org Show headers Download Go to Full URL https://api.neverbounce.com/v4/poe/notify?key=public_feedec8c69cd171b06421bb96273f04d&event=form.load&callback=__neverbounce_711431 Requested by Host: cdn.neverbounce.com URL: https://cdn.neverbounce.com/widget/dist/NeverBounce.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 18.206.50.43 -, , ASN (), Reverse DNS Software nginx / Resource Hash 24094a2ad9d2c5314a306eecb064543816c51b7434fe31e7d4ef6d7afd4d03e8 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers date Mon, 09 Oct 2023 19:58:39 GMT content-encoding gzip strict-transport-security max-age=31536000; includeSubDomains server nginx vary Accept-Encoding content-type application/javascript cache-control no-cache, private x-ua-compatible IE=Edge
GET H2	200	649324202964935 Show response connect.facebook.net/signals/config/	140 KB 36 KB	50ms 46ms	Script application/x-javascript	2a03:2880:f083:9:face:b00c:0:3 FACEBOOK
General Check archive.org Show headers Download Go to Full URL https://connect.facebook.net/signals/config/649324202964935?v=2.9.132&r=stable&domain=www.group-ib.com Requested by Host: connect.facebook.net URL: https://connect.facebook.net/en_US/fbevents.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a03:2880:f083:9:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US), Reverse DNS Software / Resource Hash 498b017ece9703782ce3ddccf9a5f6662e93910e8ae08fcfeeba2a1c5078f361 Security Headers Name Value Content-Security-Policy default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script'; Strict-Transport-Security max-age=31536000; preload; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers content-security-policy default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script'; content-encoding gzip x-content-type-options nosniff strict-transport-security max-age=31536000; preload; includeSubDomains date Mon, 09 Oct 2023 19:58:39 GMT document-policy force-load-at-top cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400 content-length 36553 x-xss-protection 0 pragma public x-fb-debug Y5SdDivzCpEW47Dny8zkwi413OjNw04MJf47DUTq+mkqCdT/ht1Xzep+e+9A8voFp+p+anNHOTtl4cPrWOf5DA== cross-origin-opener-policy same-origin-allow-popups vary Accept-Encoding x-frame-options DENY content-type application/x-javascript; charset=utf-8 cache-control public, max-age=1200 permissions-policy accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(), gyroscope=(), hid=(), idle-detection=(), magnetometer=(), microphone=(), midi=(), payment=(), screen-wake-lock=(), serial=(), usb=() timing-allow-origin * expires Sat, 01 Jan 2000 00:00:00 GMT
POST H2	200	fl Show response www.group-ib.com/api/	665 B 965 B	155ms 154ms	XHR application/json	3.72.181.255 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://www.group-ib.com/api/fl?u=a00d6350-66c0-11ee-a8a5-2b520884db60&cfidsgib-w-61354c22-16cc-40a8-a871-6901f1a76e24=b5W6NEggc5c7ydX8iJwdBZYxs8I7o46wxvt1QwbGCBYqJOjSbd%2FkqWTducHNW5jBSl4P5l6dg7iGVruY7NK%2B2Rr7232x%2BP5HNvNMaJpGa6MIH5GbdNnJeDSK%2BzK0hfkqydkmc5Q%2Bue6d%2BI%2B1XMn%2FMGOf4pVFEGQDLDx0 Requested by Host: fhp-de-js.group-ib.com URL: https://fhp-de-js.group-ib.com/d/bt-autoinject.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 3.72.181.255 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-3-72-181-255.eu-central-1.compute.amazonaws.com Software nginx / Resource Hash b46ddad9da0521a896e133cae57846875feb26416620e1acf13aee52b9586cef Request headers X-GIB-GSSCgib-w-61354c22-16cc-40a8-a871-6901f1a76e24 UjBiyatr2vjakJQ80VXVDdhfeyftfcyEEN6hKm765KWZxsjQv6AYhbJqYCsr/VvghwVZbjmb7Raq27Si5TZPDcJnCBJtuHgr9+LJ50oPAnIDlOJBOskVLfpsbOvk9n5lMfWcMlb/AlgvrW8LJ5A4n+GLMK15Lt0A4lI9yhP6vS5yGgST08XOvrV+5SCySgFGtnggmWip7MIRYQt8gv1COzsJTVEUHIvdo4JtwV6P/P70t17m8Os5HxkC08r+JA== Referer https://www.group-ib.com/blog/qilin-ransomware/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 X-GIB-FGSSCgib-w-61354c22-16cc-40a8-a871-6901f1a76e24 fVB1eb57294d06254345cf73f981e10001a4b37c Content-Type text/plain;charset=UTF-8 Response headers date Mon, 09 Oct 2023 19:58:39 GMT content-encoding gzip server nginx vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS content-type application/json; charset=utf-8 access-control-allow-origin https://www.group-ib.com cache-control no-store access-control-allow-credentials true x-envoy-upstream-service-time 2 access-control-allow-headers Accept,DNT,Keep-Alive,User-Agent,If-Modified-Since,Cache-Control,Content-Type,Origin,ETag,If-None-Match,X-Cfids,Authorization
GET H2	200	1 Show response mc.yandex.com/watch/26812653/ Redirect Chain https://mc.yandex.com/watch/26812653?wmode=7&page-url=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fqilin-ransomware%2F&charset=utf-8&site-info=%7B%22shareVersion%22%3A2%2C%22strategy%22%3A%22d%2Fn%2Fq%2... https://mc.yandex.com/watch/26812653/1?wmode=7&page-url=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fqilin-ransomware%2F&charset=utf-8&site-info=%7B%22shareVersion%22%3A2%2C%22strategy%22%3A%22d%2Fn%2Fq...	435 B 549 B	74ms 74ms	XHR application/json	2a02:6b8::1:119 GLOBAL_DC
General Check archive.org Show headers Download Go to Full URL https://mc.yandex.com/watch/26812653/1?wmode=7&page-url=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fqilin-ransomware%2F&charset=utf-8&site-info=%7B%22shareVersion%22%3A2%2C%22strategy%22%3A%22d%2Fn%2Fq%2Fr%2Fs%2Ft%22%7D&uah=chm%0A%3F0&browser-info=pv%3A1%3Avf%3A3qm6qq812ez2u52y4wzrnbv%3Afp%3A765%3Afu%3A1%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A1135%3Acn%3A1%3Adp%3A0%3Als%3A431258551813%3Ahid%3A1028384477%3Az%3A120%3Ai%3A20231009215839%3Aet%3A1696881519%3Ac%3A1%3Arn%3A836330897%3Arqn%3A1%3Au%3A1696881519625480292%3Aw%3A1600x1200%3As%3A1600x1200x24%3Ask%3A1%3Awv%3A2%3Ads%3A0%2C0%2C83%2C46%2C0%2C0%2C%2C825%2C19%2C%2C%2C%2C996%3Aco%3A0%3Acpf%3A1%3Ans%3A1696881517585%3Aadb%3A2%3Arqnl%3A1%3Ast%3A1696881519%3At%3AGain%20new-found%20insights%20into%20Qilin%20Ransomware%2C%20their%20Data%20Leak%20Site%20%28DLS%29%20and%20operations%20targeting%20critical%20industries%20%7C%20Group-IB%20Blog&t=gdpr%2814%29clc%280-0-0%29rqnt%281%29aw%281%29ti%282%29&redirnss=1 Requested by Host: www.group-ib.com URL: https://www.group-ib.com/blog/qilin-ransomware/ Protocol H2 Server 2a02:6b8::1:119 Ulyanovsk, Russian Federation, ASN208722 (GLOBAL_DC, FI), Reverse DNS Software / Resource Hash 99fb036ec8469e9046a7209ad328792cc6c2fefb53a8b1a1253eedf6e222fe14 Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers pragma no-cache date Mon, 09 Oct 2023 19:58:39 GMT strict-transport-security max-age=31536000 x-content-type-options nosniff last-modified Mon, 09-Oct-2023 19:58:39 GMT accept-ch Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA content-type application/json; charset=utf-8 access-control-allow-origin https://www.group-ib.com cache-control private, no-cache, no-store, must-revalidate, max-age=0 access-control-allow-credentials true content-length 435 x-xss-protection 1; mode=block expires Mon, 09-Oct-2023 19:58:39 GMT Redirect headers pragma no-cache date Mon, 09 Oct 2023 19:58:39 GMT strict-transport-security max-age=31536000 last-modified Mon, 09-Oct-2023 19:58:39 GMT accept-ch Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA location /watch/26812653/1?wmode=7&page-url=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fqilin-ransomware%2F&charset=utf-8&site-info=%7B%22shareVersion%22%3A2%2C%22strategy%22%3A%22d%2Fn%2Fq%2Fr%2Fs%2Ft%22%7D&uah=chm%0A%3F0&browser-info=pv%3A1%3Avf%3A3qm6qq812ez2u52y4wzrnbv%3Afp%3A765%3Afu%3A1%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A1135%3Acn%3A1%3Adp%3A0%3Als%3A431258551813%3Ahid%3A1028384477%3Az%3A120%3Ai%3A20231009215839%3Aet%3A1696881519%3Ac%3A1%3Arn%3A836330897%3Arqn%3A1%3Au%3A1696881519625480292%3Aw%3A1600x1200%3As%3A1600x1200x24%3Ask%3A1%3Awv%3A2%3Ads%3A0%2C0%2C83%2C46%2C0%2C0%2C%2C825%2C19%2C%2C%2C%2C996%3Aco%3A0%3Acpf%3A1%3Ans%3A1696881517585%3Aadb%3A2%3Arqnl%3A1%3Ast%3A1696881519%3At%3AGain%20new-found%20insights%20into%20Qilin%20Ransomware%2C%20their%20Data%20Leak%20Site%20%28DLS%29%20and%20operations%20targeting%20critical%20industries%20%7C%20Group-IB%20Blog&t=gdpr%2814%29clc%280-0-0%29rqnt%281%29aw%281%29ti%282%29&redirnss=1 access-control-allow-origin https://www.group-ib.com cache-control private, no-cache, no-store, must-revalidate, max-age=0 access-control-allow-credentials true x-xss-protection 1; mode=block expires Mon, 09-Oct-2023 19:58:39 GMT
GET H2	200	/ www.facebook.com/tr/	0 185 B	137ms 63ms	Image text/plain	2a03:2880:f177:83:face:b00c:0:25de
General Check archive.org Show headers Download Go to Show image Full URL https://www.facebook.com/tr/?id=649324202964935&ev=PageView&dl=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fqilin-ransomware%2F&rl=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fqilin-ransomware%2F&if=false&ts=1696881519497&sw=1600&sh=1200&v=2.9.132&r=stable&ec=0&o=30&fbp=fb.1.1696881519495.2014502562&cs_est=true&it=1696881519265&coo=false&exp=a1&rqm=GET Requested by Host: www.group-ib.com URL: https://www.group-ib.com/blog/qilin-ransomware/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a03:2880:f177:83:face:b00c:0:25de -, , ASN (), Reverse DNS Software proxygen-bolt / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers strict-transport-security max-age=31536000; includeSubDomains date Mon, 09 Oct 2023 19:58:39 GMT server proxygen-bolt content-type text/plain access-control-allow-origin access-control-allow-credentials true cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400 content-length 0
GET H2	200	/ Show response googleads.g.doubleclick.net/pagead/viewthroughconversion/10882981508/	3 KB 2 KB	58ms 57ms	Script text/javascript	2a00:1450:4001:82a::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://googleads.g.doubleclick.net/pagead/viewthroughconversion/10882981508/?random=1696881519521&cv=11&fst=1696881519521&bg=ffffff&guid=ON&async=1&gtm=45be3a40&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fqilin-ransomware%2F&ref=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fqilin-ransomware%2F&hn=www.googleadservices.com&frm=0&tiba=Gain%20new-found%20insights%20into%20Qilin%20Ransomware%2C%20their%20Data%20Leak%20Site%20(DLS)%20and%20operations%20targeting%20critical%20industries%20%7C%20Group-IB%20Blog&did=dZTQ1Zm&gdid=dZTQ1Zm&auid=767509692.1696881519&uamb=0&uaw=0&data=event%3Dgtag.config&rfmt=3&fmt=4 Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtag/js?id=AW-10882981508 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash 70e4ecc057bc64feb9eed40d7c9c32cbc623dbaeb99732cade39680e32054ebf Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers pragma no-cache date Mon, 09 Oct 2023 19:58:39 GMT content-encoding br x-content-type-options nosniff server cafe content-type text/javascript; charset=UTF-8 p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" cache-control no-cache, must-revalidate cross-origin-resource-policy cross-origin content-disposition attachment; filename="f.txt" timing-allow-origin * alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 1431 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	/ Show response c.6sc.co/	7 B 194 B	87ms 78ms	XHR text/html	92.123.27.11
General Check archive.org Show headers Download Go to Full URL https://c.6sc.co/ Requested by Host: fhp-de-js.group-ib.com URL: https://fhp-de-js.group-ib.com/d/bt-autoinject.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 92.123.27.11 -, , ASN (), Reverse DNS Software / Resource Hash fe04a9dc88d3f3be8d4f6bc63a9a80f45a4c6d8460e7551dab849457c091920a Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers date Mon, 09 Oct 2023 19:58:39 GMT access-control-max-age 86400 access-control-allow-methods GET,POST content-type text/html access-control-allow-origin https://www.group-ib.com access-control-allow-credentials true access-control-allow-headers * content-length 7
GET H2	200	/ Show response ipv6.6sc.co/	24 B 317 B	166ms 39ms	XHR text/html	2a02:26f0:ab00::214:8e41
General Check archive.org Show headers Download Go to Full URL https://ipv6.6sc.co/ Requested by Host: fhp-de-js.group-ib.com URL: https://fhp-de-js.group-ib.com/d/bt-autoinject.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:ab00::214:8e41 -, , ASN (), Reverse DNS Software / Resource Hash b7bab399e87338ff7e75ac15e592a194fce5a9bce2b7e899f6510af38c5c4177 Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers pragma no-cache date Mon, 09 Oct 2023 19:58:39 GMT vary Origin content-type text/html access-control-allow-origin https://www.group-ib.com cache-control max-age=0, no-cache, no-store 6si-ipv6 2001:1b60:2:240:3247::10 server-timing cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="1696881519610_34901565_158262832_24_959_40_90_219";dur=1 content-length 24 expires Mon, 09 Oct 2023 19:58:39 GMT
GET H2	200	img.gif b.6sc.co/v1/beacon/	43 B 485 B	399ms 396ms	Image image/gif	92.123.27.11
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=e84d9c08a990af8592952e7ac9a983ad&svisitor=null&visitor=8ac6acd3-c44d-4ef2-8843-3835910dd745&session=120a30aa-cec9-4e5c-81a7-8fc2560fcf2f&event=a_pageload&q=%7B%22pageLoadTime%22%3A%22Mon%2C%2009%20Oct%202023%2019%3A58%3A39%20GMT%22%7D&isIframe=false&m=%7B%22description%22%3A%22All%20you%20need%20to%20know%20about%20Qilin%20ransomware%20and%20its%20operations%20targeting%20critical%20sectors.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Gain%20new-found%20insights%20into%20Qilin%20Ransomware%2C%20their%20Data%20Leak%20Site%20(DLS)%20and%20operations%20targeting%20critical%20industries%20%7C%20Group-IB%20Blog%22%7D&cb=&r=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fqilin-ransomware%2F&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fqilin-ransomware%2F&pageViewId=28e41306-8cea-4180-811a-c7b1a0e5dec3&v=1.1.7 Requested by Host: www.group-ib.com URL: https://www.group-ib.com/blog/qilin-ransomware/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 92.123.27.11 -, , ASN (), Reverse DNS Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers date Mon, 09 Oct 2023 19:58:39 GMT x-content-type-options nosniff content-length 43 pragma no-cache last-modified Sat, 18 Feb 2023 01:45:17 GMT server nginx/1.14.0 (Ubuntu) etag "63f02dad-2b" access-control-max-age 86400 access-control-allow-methods GET,POST content-type image/gif access-control-allow-origin cache-control private, no-cache, no-cache=Set-Cookie, proxy-revalidate access-control-allow-credentials true accept-ranges bytes access-control-allow-headers * expires Wed, 19 Apr 2000 11:43:00 GMT
GET H2	200	img.gif b.6sc.co/v1/beacon/	43 B 485 B	398ms 395ms	Image image/gif	92.123.27.11
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=e84d9c08a990af8592952e7ac9a983ad&svisitor=null&visitor=8ac6acd3-c44d-4ef2-8843-3835910dd745&session=120a30aa-cec9-4e5c-81a7-8fc2560fcf2f&event=ni%3AasyncSettingsAudit&q=%7B%22settings%22%3A%22%5B%7B%5C%22name%5C%22%3A%5C%22enableEventTracking%5C%22%2C%5C%22value%5C%22%3A%5C%22true%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Mon%2C%2009%20Oct%202023%2019%3A58%3A39%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setToken%5C%22%2C%5C%22value%5C%22%3A%5C%22e84d9c08a990af8592952e7ac9a983ad%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Mon%2C%2009%20Oct%202023%2019%3A58%3A39%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setEndpoint%5C%22%2C%5C%22value%5C%22%3A%5C%22b.6sc.co%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Mon%2C%2009%20Oct%202023%2019%3A58%3A39%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%5D%22%7D&isIframe=false&m=%7B%22description%22%3A%22All%20you%20need%20to%20know%20about%20Qilin%20ransomware%20and%20its%20operations%20targeting%20critical%20sectors.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Gain%20new-found%20insights%20into%20Qilin%20Ransomware%2C%20their%20Data%20Leak%20Site%20(DLS)%20and%20operations%20targeting%20critical%20industries%20%7C%20Group-IB%20Blog%22%7D&cb=&r=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fqilin-ransomware%2F&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fqilin-ransomware%2F&pageViewId=28e41306-8cea-4180-811a-c7b1a0e5dec3&v=1.1.7 Requested by Host: www.group-ib.com URL: https://www.group-ib.com/blog/qilin-ransomware/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 92.123.27.11 -, , ASN (), Reverse DNS Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers date Mon, 09 Oct 2023 19:58:39 GMT x-content-type-options nosniff content-length 43 pragma no-cache last-modified Sat, 05 Jun 2021 07:56:05 GMT server nginx/1.14.0 (Ubuntu) etag "60bb2e15-2b" access-control-max-age 86400 access-control-allow-methods GET,POST content-type image/gif access-control-allow-origin cache-control private, no-cache, no-cache=Set-Cookie, proxy-revalidate access-control-allow-credentials true accept-ranges bytes access-control-allow-headers * expires Wed, 19 Apr 2000 11:43:00 GMT
GET H2	200	sync_cookie_image_decide_secondary mc.yandex.com/ Redirect Chain https://mc.yandex.com/sync_cookie_image_check_secondary https://mc.yandex.ru/sync_cookie_image_start_secondary?redirect_domain=mc.yandex.com&token=10151.ehBJl6LVWP0-GSeQrC9Izj9oLlgxMovK1KPkIDwM2LQAr_HRrFTDyTqD4t-kMnOZ.EVfR7EF4a-rZnBADWDoTjWW4oC0%2C https://mc.yandex.com/sync_cookie_image_decide_secondary?token=10151.SqhNqWiC6AOyC9eISrF5H3rT51ReHRvlJdwB69q4M3FTVbveMcWJglgvwnYoXldRSaFrIyzIcicsn_V1RFQoepgUCf9ATnP6Q_n5zcgT4vI%2C.3IFYzzLlmx94Im47L...	43 B 79 B	82ms 80ms	Image image/gif	2a02:6b8::1:119 GLOBAL_DC
General Check archive.org Show headers Download Go to Show image Full URL https://mc.yandex.com/sync_cookie_image_decide_secondary?token=10151.SqhNqWiC6AOyC9eISrF5H3rT51ReHRvlJdwB69q4M3FTVbveMcWJglgvwnYoXldRSaFrIyzIcicsn_V1RFQoepgUCf9ATnP6Q_n5zcgT4vI%2C.3IFYzzLlmx94Im47LDASgiwyU0g%2C Requested by Host: www.group-ib.com URL: https://www.group-ib.com/blog/qilin-ransomware/ Protocol H2 Server 2a02:6b8::1:119 Ulyanovsk, Russian Federation, ASN208722 (GLOBAL_DC, FI), Reverse DNS Software / Resource Hash 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87 Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers date Mon, 09 Oct 2023 19:58:39 GMT strict-transport-security max-age=31536000 content-length 43 x-xss-protection 1; mode=block content-type image/gif Redirect headers location https://mc.yandex.com/sync_cookie_image_decide_secondary?token=10151.SqhNqWiC6AOyC9eISrF5H3rT51ReHRvlJdwB69q4M3FTVbveMcWJglgvwnYoXldRSaFrIyzIcicsn_V1RFQoepgUCf9ATnP6Q_n5zcgT4vI%2C.3IFYzzLlmx94Im47LDASgiwyU0g%2C date Mon, 09 Oct 2023 19:58:39 GMT strict-transport-security max-age=31536000 x-xss-protection 1; mode=block
GET H2	200	/ www.google.com/pagead/1p-user-list/10882981508/	42 B 108 B	53ms 52ms	Image image/gif	2a00:1450:4001:827::2004
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.com/pagead/1p-user-list/10882981508/?random=1696881519521&cv=11&fst=1696878000000&bg=ffffff&guid=ON&async=1&gtm=45be3a40&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fqilin-ransomware%2F&ref=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fqilin-ransomware%2F&frm=0&tiba=Gain%20new-found%20insights%20into%20Qilin%20Ransomware%2C%20their%20Data%20Leak%20Site%20(DLS)%20and%20operations%20targeting%20critical%20industries%20%7C%20Group-IB%20Blog&data=event%3Dgtag.config&fmt=3&is_vtc=1&random=2227807068&rmt_tld=0&ipr=y Requested by Host: www.group-ib.com URL: https://www.group-ib.com/blog/qilin-ransomware/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:827::2004 -, , ASN (), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value Content-Security-Policy script-src 'none'; object-src 'none' X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers pragma no-cache date Mon, 09 Oct 2023 19:58:39 GMT content-security-policy script-src 'none'; object-src 'none' x-content-type-options nosniff server cafe content-type image/gif p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin timing-allow-origin * alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	/ www.google.de/pagead/1p-user-list/10882981508/	42 B 108 B	52ms 51ms	Image image/gif	2a00:1450:4001:811::2003
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.de/pagead/1p-user-list/10882981508/?random=1696881519521&cv=11&fst=1696878000000&bg=ffffff&guid=ON&async=1&gtm=45be3a40&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fqilin-ransomware%2F&ref=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fqilin-ransomware%2F&frm=0&tiba=Gain%20new-found%20insights%20into%20Qilin%20Ransomware%2C%20their%20Data%20Leak%20Site%20(DLS)%20and%20operations%20targeting%20critical%20industries%20%7C%20Group-IB%20Blog&data=event%3Dgtag.config&fmt=3&is_vtc=1&random=2227807068&rmt_tld=1&ipr=y Requested by Host: www.group-ib.com URL: https://www.group-ib.com/blog/qilin-ransomware/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:811::2003 -, , ASN (), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value Content-Security-Policy script-src 'none'; object-src 'none' X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers pragma no-cache date Mon, 09 Oct 2023 19:58:39 GMT content-security-policy script-src 'none'; object-src 'none' x-content-type-options nosniff server cafe content-type image/gif p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin timing-allow-origin * alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	img.gif b.6sc.co/v1/beacon/	43 B 485 B	352ms 350ms	Image image/gif	92.123.27.11
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=e84d9c08a990af8592952e7ac9a983ad&svisitor=null&visitor=8ac6acd3-c44d-4ef2-8843-3835910dd745&session=120a30aa-cec9-4e5c-81a7-8fc2560fcf2f&event=ipv6&q=%7B%22address%22%3A%222001%3A1b60%3A2%3A240%3A3247%3A%3A10%22%7D&isIframe=false&m=%7B%22description%22%3A%22All%20you%20need%20to%20know%20about%20Qilin%20ransomware%20and%20its%20operations%20targeting%20critical%20sectors.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Gain%20new-found%20insights%20into%20Qilin%20Ransomware%2C%20their%20Data%20Leak%20Site%20(DLS)%20and%20operations%20targeting%20critical%20industries%20%7C%20Group-IB%20Blog%22%7D&cb=&r=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fqilin-ransomware%2F&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fqilin-ransomware%2F&pageViewId=28e41306-8cea-4180-811a-c7b1a0e5dec3&v=1.1.7 Requested by Host: www.group-ib.com URL: https://www.group-ib.com/blog/qilin-ransomware/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 92.123.27.11 -, , ASN (), Reverse DNS Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers date Mon, 09 Oct 2023 19:58:40 GMT x-content-type-options nosniff content-length 43 pragma no-cache last-modified Sat, 18 Feb 2023 01:45:17 GMT server nginx/1.14.0 (Ubuntu) etag "63f02dad-2b" access-control-max-age 86400 access-control-allow-methods GET,POST content-type image/gif access-control-allow-origin cache-control private, no-cache, no-cache=Set-Cookie, proxy-revalidate access-control-allow-credentials true accept-ranges bytes access-control-allow-headers * expires Wed, 19 Apr 2000 11:43:00 GMT
POST H2	200	1 Show response mc.yandex.com/watch/26812653/	43 B 74 B	91ms 89ms	XHR image/gif	2a02:6b8::1:119 GLOBAL_DC
General Check archive.org Show headers Download Go to Full URL https://mc.yandex.com/watch/26812653/1?page-url=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fqilin-ransomware%2F&charset=utf-8&hittoken=1696881519_99c53f7d14cd9603935f70b2ae5de8ee720af9338ac6c46bf3396d2a62ab28e6&browser-info=pa%3A1%3Aar%3A1%3Avf%3A3qm6qq812ez2u52y4wzrnbv%3Afu%3A1%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A1135%3Acn%3A1%3Adp%3A1%3Als%3A431258551813%3Ahid%3A1028384477%3Az%3A120%3Ai%3A20231009215839%3Aet%3A1696881520%3Ac%3A1%3Arn%3A823444616%3Arqn%3A2%3Au%3A1696881519625480292%3Aw%3A1600x1200%3As%3A1600x1200x24%3Ask%3A1%3Awv%3A2%3Aco%3A0%3Acpf%3A1%3Ans%3A1696881517585%3Aadb%3A2%3Arqnl%3A1%3Ast%3A1696881520&t=gdpr(14)mc(p-3)clc(0-0-0)rqnt(2)lt(28000)aw(1)ti(2) Requested by Host: fhp-de-js.group-ib.com URL: https://fhp-de-js.group-ib.com/d/bt-autoinject.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:6b8::1:119 Ulyanovsk, Russian Federation, ASN208722 (GLOBAL_DC, FI), Reverse DNS Software / Resource Hash 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87 Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Xss-Protection 1; mode=block Request headers Referer https://www.group-ib.com/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Content-Type application/x-www-form-urlencoded Response headers pragma no-cache date Mon, 09 Oct 2023 19:58:39 GMT strict-transport-security max-age=31536000 last-modified Mon, 09-Oct-2023 19:58:39 GMT accept-ch Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA content-type image/gif access-control-allow-origin https://www.group-ib.com cache-control private, no-cache, no-store, must-revalidate, max-age=0 access-control-allow-credentials true content-length 43 x-xss-protection 1; mode=block expires Mon, 09-Oct-2023 19:58:39 GMT
POST H2	200	1 Show response mc.yandex.com/watch/26812653/	43 B 74 B	81ms 80ms	XHR image/gif	2a02:6b8::1:119 GLOBAL_DC
General Check archive.org Show headers Download Go to Full URL https://mc.yandex.com/watch/26812653/1?page-url=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fqilin-ransomware%2F&charset=utf-8&hittoken=1696881519_99c53f7d14cd9603935f70b2ae5de8ee720af9338ac6c46bf3396d2a62ab28e6&browser-info=pa%3A1%3Aar%3A1%3Avf%3A3qm6qq812ez2u52y4wzrnbv%3Afu%3A1%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A1135%3Acn%3A1%3Adp%3A1%3Als%3A431258551813%3Ahid%3A1028384477%3Az%3A120%3Ai%3A20231009215839%3Aet%3A1696881520%3Ac%3A1%3Arn%3A638477079%3Arqn%3A3%3Au%3A1696881519625480292%3Aw%3A1600x1200%3As%3A1600x1200x24%3Ask%3A1%3Awv%3A2%3Aco%3A0%3Acpf%3A1%3Ans%3A1696881517585%3Aadb%3A2%3Arqnl%3A1%3Ast%3A1696881520&t=gdpr(14)mc(p-3)clc(0-0-0)rqnt(3)lt(28000)aw(1)ti(2) Requested by Host: fhp-de-js.group-ib.com URL: https://fhp-de-js.group-ib.com/d/bt-autoinject.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:6b8::1:119 Ulyanovsk, Russian Federation, ASN208722 (GLOBAL_DC, FI), Reverse DNS Software / Resource Hash 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87 Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Xss-Protection 1; mode=block Request headers Referer https://www.group-ib.com/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Content-Type application/x-www-form-urlencoded Response headers pragma no-cache date Mon, 09 Oct 2023 19:58:39 GMT strict-transport-security max-age=31536000 last-modified Mon, 09-Oct-2023 19:58:39 GMT accept-ch Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA content-type image/gif access-control-allow-origin https://www.group-ib.com cache-control private, no-cache, no-store, must-revalidate, max-age=0 access-control-allow-credentials true content-length 43 x-xss-protection 1; mode=block expires Mon, 09-Oct-2023 19:58:39 GMT
POST H2	200	1 Show response mc.yandex.com/watch/26812653/	43 B 74 B	84ms 83ms	XHR image/gif	2a02:6b8::1:119 GLOBAL_DC
General Check archive.org Show headers Download Go to Full URL https://mc.yandex.com/watch/26812653/1?page-url=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fqilin-ransomware%2F&charset=utf-8&hittoken=1696881519_99c53f7d14cd9603935f70b2ae5de8ee720af9338ac6c46bf3396d2a62ab28e6&browser-info=pa%3A1%3Aar%3A1%3Avf%3A3qm6qq812ez2u52y4wzrnbv%3Afu%3A1%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A1135%3Acn%3A1%3Adp%3A1%3Als%3A431258551813%3Ahid%3A1028384477%3Az%3A120%3Ai%3A20231009215839%3Aet%3A1696881520%3Ac%3A1%3Arn%3A402651477%3Arqn%3A4%3Au%3A1696881519625480292%3Aw%3A1600x1200%3As%3A1600x1200x24%3Ask%3A1%3Awv%3A2%3Aco%3A0%3Acpf%3A1%3Ans%3A1696881517585%3Aadb%3A2%3Arqnl%3A1%3Ast%3A1696881520&t=gdpr(14)mc(p-3)clc(0-0-0)rqnt(4)lt(28000)aw(1)ti(2) Requested by Host: fhp-de-js.group-ib.com URL: https://fhp-de-js.group-ib.com/d/bt-autoinject.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:6b8::1:119 Ulyanovsk, Russian Federation, ASN208722 (GLOBAL_DC, FI), Reverse DNS Software / Resource Hash 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87 Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Xss-Protection 1; mode=block Request headers Referer https://www.group-ib.com/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Content-Type application/x-www-form-urlencoded Response headers pragma no-cache date Mon, 09 Oct 2023 19:58:39 GMT strict-transport-security max-age=31536000 last-modified Mon, 09-Oct-2023 19:58:39 GMT accept-ch Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA content-type image/gif access-control-allow-origin https://www.group-ib.com cache-control private, no-cache, no-store, must-revalidate, max-age=0 access-control-allow-credentials true content-length 43 x-xss-protection 1; mode=block expires Mon, 09-Oct-2023 19:58:39 GMT
POST H2	200	fl Show response www.group-ib.com/api/	665 B 778 B	80ms 80ms	XHR application/json	3.72.181.255 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://www.group-ib.com/api/fl?u=a00d6350-66c0-11ee-a8a5-2b520884db60&cfidsgib-w-61354c22-16cc-40a8-a871-6901f1a76e24=oK6IiSvBCiioQiCuCmH22uAZ3QuCeDC%2BE03CKvzpz4XV6cu%2Fu2Isu69Q82aBSg9t5fcOJ51MkMZ0zzUNl%2Fk34IuQZkfOOXYbXs6nLz9nrzzBQnWSStl5ZN3EX7NqJC4gMlSFtSiafCfOmRYCHRk583pbX4ybWHTJpLdX Requested by Host: fhp-de-js.group-ib.com URL: https://fhp-de-js.group-ib.com/d/bt-autoinject.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 3.72.181.255 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-3-72-181-255.eu-central-1.compute.amazonaws.com Software nginx / Resource Hash 1fc865a5977fb8dc7ee5be4d5333338cc2a82ce2030c00a34a07e2370e3cc0ca Request headers X-GIB-GSSCgib-w-61354c22-16cc-40a8-a871-6901f1a76e24 7DuMmRmg+XauA9M7lzHvORjoNUCzX5sc97r0zFYVUIlqoSxkZKav7/c/upe9Ss+0Hm0zEHPk8X4Khy5sgY0kvG/piXyR1Pk/7V6gbBBNCOuvrPt8zOF0gYBjc9nCRiwdu0aUnc3z8rUe8Jcmd78YBliEDY9WeVbgRzOZ3iIjqW4m02hY/kySPL/S+N8iuhZAL8Q6SKlC/2yEX7PmBuNN3hYudeRgrH7EQi9B/xjIeNidiLuHPsrYi3w9Y6mT9A== Referer https://www.group-ib.com/blog/qilin-ransomware/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 X-GIB-FGSSCgib-w-61354c22-16cc-40a8-a871-6901f1a76e24 03Gb3681a82c6f01bcd0ffd8d81ad97db6abd2ca Content-Type text/plain;charset=UTF-8 Response headers date Mon, 09 Oct 2023 19:58:40 GMT content-encoding gzip server nginx vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS content-type application/json; charset=utf-8 access-control-allow-origin https://www.group-ib.com cache-control no-store access-control-allow-credentials true x-envoy-upstream-service-time 2 access-control-allow-headers Accept,DNT,Keep-Alive,User-Agent,If-Modified-Since,Cache-Control,Content-Type,Origin,ETag,If-None-Match,X-Cfids,Authorization
GET H3	200	709834390277869 Show response connect.facebook.net/signals/config/	136 KB 35 KB	33ms 33ms	Script application/x-javascript	2a03:2880:f083:9:face:b00c:0:3 FACEBOOK
General Check archive.org Show headers Download Go to Full URL https://connect.facebook.net/signals/config/709834390277869?v=2.9.132&r=stable&domain=www.group-ib.com Requested by Host: connect.facebook.net URL: https://connect.facebook.net/en_US/fbevents.js Protocol H3 Security QUIC, , AES_128_GCM Server 2a03:2880:f083:9:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US), Reverse DNS Software / Resource Hash 3bf4716b9a9b0cee122660c8189893373f590b7db5a82a3373525269f0e98eae Security Headers Name Value Content-Security-Policy default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script'; Strict-Transport-Security max-age=31536000; preload; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers content-security-policy default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script'; content-encoding gzip x-content-type-options nosniff strict-transport-security max-age=31536000; preload; includeSubDomains date Mon, 09 Oct 2023 19:58:40 GMT document-policy force-load-at-top cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400 content-length 36049 x-xss-protection 0 pragma public x-fb-debug 3es/IOZqTMqO2f2Pli19FOFQ2rSpWCNJ+f9Mpuezto4X5DusQl9CLu5dzuLfltVpodCNlF4WrWHvw+Hi3ACyWw== cross-origin-opener-policy same-origin-allow-popups vary Accept-Encoding x-frame-options DENY content-type application/x-javascript; charset=utf-8 origin-agent-cluster ?0 cache-control public, max-age=1200 permissions-policy accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(), gyroscope=(), hid=(), idle-detection=(), magnetometer=(), microphone=(), midi=(), payment=(), screen-wake-lock=(), serial=(), usb=() timing-allow-origin * priority u=3,i expires Sat, 01 Jan 2000 00:00:00 GMT
GET H2	200	__ptq.gif track-eu1.hubspot.com/	45 B 634 B	174ms 83ms	Image image/gif	172.65.240.166
General Check archive.org Show headers Download Go to Show image Full URL https://track-eu1.hubspot.com/__ptq.gif?k=1&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=en-us&bfp=3335903367&v=1.1&a=25755956&rcu=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fqilin-ransomware%2F&r=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fqilin-ransomware%2F&pu=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fqilin-ransomware%2F&t=Gain+new-found+insights+into+Qilin+Ransomware%2C+their+Data+Leak+Site+(DLS)+and+operations+targeting+critical+industries+%7C+Group-IB+Blog&cts=1696881520362&vi=e70f20f9a40cbbd2905c7af15d2c48a4&nc=true&u=84897990.e70f20f9a40cbbd2905c7af15d2c48a4.1696881520359.1696881520359.1696881520359.1&b=84897990.1.1696881520359&cc=15 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.65.240.166 -, , ASN (), Reverse DNS Software cloudflare / Resource Hash dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers date Mon, 09 Oct 2023 19:58:40 GMT strict-transport-security max-age=31536000; includeSubDomains; preload x-content-type-options nosniff cf-cache-status MISS nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} x-evy-trace-route-service-name envoyset-translator x-hubspot-correlation-id 718487e1-f583-42c9-8ddb-44960ddc5edc p3p CP="NOI CUR ADM OUR NOR STA NID" x-envoy-upstream-service-time 2 content-length 45 x-evy-trace-route-configuration listener_https/all x-evy-trace-listener listener_https x-request-id 718487e1-f583-42c9-8ddb-44960ddc5edc last-modified Mon, 09 Oct 2023 19:58:40 GMT server cloudflare vary origin, Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=bzrBNplzzei%2B9v7PoAJRiCGz%2BVO1BL6JWQv6za0r8Dtmh4XP5DEazkZf3Oneka8pD9T3jB2CWBQ3mHdUsJeGeK5OO%2FdXL2yxb%2B9rduVbdMCT87iBVlR2JMNvrA82w2AWA%2FCiCD1GcQ%3D%3D"}],"group":"cf-nel","max_age":604800} content-type image/gif x-evy-trace-served-by-pod fra04/analytics-tracking-td/envoy-proxy-74554d9fd-lf9gg x-evy-trace-virtual-host all cache-control no-cache, no-store, no-transform access-control-allow-credentials false accept-ranges bytes cf-ray 8139331f0ad637fc-FRA x-robots-tag none
GET H2	200	__ptq.gif track-eu1.hubspot.com/	45 B 637 B	154ms 107ms	Image image/gif	172.65.240.166
General Check archive.org Show headers Download Go to Show image Full URL https://track-eu1.hubspot.com/__ptq.gif?k=15&fi=044e7558-8073-478a-ad3c-5807dd76840f&fci=2c69f985-d02c-41a9-97c9-6736d75f024d&ft=0&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=en-us&bfp=3335903367&v=1.1&a=25755956&rcu=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fqilin-ransomware%2F&r=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fqilin-ransomware%2F&pu=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fqilin-ransomware%2F&t=Gain+new-found+insights+into+Qilin+Ransomware%2C+their+Data+Leak+Site+(DLS)+and+operations+targeting+critical+industries+%7C+Group-IB+Blog&cts=1696881520363&vi=e70f20f9a40cbbd2905c7af15d2c48a4&nc=true&u=84897990.e70f20f9a40cbbd2905c7af15d2c48a4.1696881520359.1696881520359.1696881520359.1&b=84897990.1.1696881520359&cc=15 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.65.240.166 -, , ASN (), Reverse DNS Software cloudflare / Resource Hash dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers date Mon, 09 Oct 2023 19:58:40 GMT strict-transport-security max-age=31536000; includeSubDomains; preload x-content-type-options nosniff cf-cache-status MISS nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} x-evy-trace-route-service-name envoyset-translator x-hubspot-correlation-id 6460edc0-5d60-4250-85fd-9a8fd35c6c28 p3p CP="NOI CUR ADM OUR NOR STA NID" x-envoy-upstream-service-time 2 content-length 45 x-evy-trace-route-configuration listener_https/all x-evy-trace-listener listener_https x-request-id 6460edc0-5d60-4250-85fd-9a8fd35c6c28 last-modified Mon, 09 Oct 2023 19:58:40 GMT server cloudflare vary origin, Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=4p5QFpJhrXy8ZsBnFqJRhLPCffRU26fnUgWUdcI3wJj26gq645XByWYabSm70IZ18VEuk9JNQyDW5EXIAcI%2BGmmjIv9Msf1Yd%2F%2BGzsVBTSBwY9h%2BV3%2Fh1KV0wkNKb0AQ43jytJBNbQ%3D%3D"}],"group":"cf-nel","max_age":604800} content-type image/gif x-evy-trace-served-by-pod fra04/analytics-tracking-td/envoy-proxy-74554d9fd-xz7cd x-evy-trace-virtual-host all cache-control no-cache, no-store, no-transform access-control-allow-credentials false accept-ranges bytes cf-ray 8139331f0aec37fc-FRA x-robots-tag none
GET H2	200	__ptq.gif track-eu1.hubspot.com/	45 B 592 B	179ms 133ms	Image image/gif	172.65.240.166
General Check archive.org Show headers Download Go to Show image Full URL https://track-eu1.hubspot.com/__ptq.gif?k=15&fi=55a22738-d5a5-43f9-9c1c-fa4c1a6eb349&fci=19236f30-9c32-4f3a-b71f-32870158af43&ft=0&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=en-us&bfp=3335903367&v=1.1&a=25755956&rcu=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fqilin-ransomware%2F&r=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fqilin-ransomware%2F&pu=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fqilin-ransomware%2F&t=Gain+new-found+insights+into+Qilin+Ransomware%2C+their+Data+Leak+Site+(DLS)+and+operations+targeting+critical+industries+%7C+Group-IB+Blog&cts=1696881520365&vi=e70f20f9a40cbbd2905c7af15d2c48a4&nc=true&u=84897990.e70f20f9a40cbbd2905c7af15d2c48a4.1696881520359.1696881520359.1696881520359.1&b=84897990.1.1696881520359&cc=15 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.65.240.166 -, , ASN (), Reverse DNS Software cloudflare / Resource Hash dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers date Mon, 09 Oct 2023 19:58:40 GMT strict-transport-security max-age=31536000; includeSubDomains; preload x-content-type-options nosniff cf-cache-status MISS nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} x-evy-trace-route-service-name envoyset-translator x-hubspot-correlation-id aaabc285-9d71-4f31-aa15-47cf93fdf22e p3p CP="NOI CUR ADM OUR NOR STA NID" x-envoy-upstream-service-time 5 content-length 45 x-evy-trace-route-configuration listener_https/all x-evy-trace-listener listener_https x-request-id aaabc285-9d71-4f31-aa15-47cf93fdf22e last-modified Mon, 09 Oct 2023 19:58:40 GMT server cloudflare vary origin, Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=GU7sFaC7mV3VJqKrJg%2F%2FhOGzA%2Fjma%2Bu3dX1MpdY1YrhFwvsze5p8xxa2tRmZOwlLotb5isdpFcJX6pWQXRS3qgrh5AB8L%2BLbSTYVQN6E8BWbFkv5YxsNW3lKpmOAaXhkz72hQofuvg%3D%3D"}],"group":"cf-nel","max_age":604800} content-type image/gif x-evy-trace-served-by-pod fra04/analytics-tracking-td/envoy-proxy-74554d9fd-f4fv2 x-evy-trace-virtual-host all cache-control no-cache, no-store, no-transform access-control-allow-credentials false accept-ranges bytes cf-ray 8139331f0ae837fc-FRA x-robots-tag none
GET H2	200	__ptq.gif track-eu1.hubspot.com/	45 B 1 KB	126ms 80ms	Image image/gif	172.65.240.166
General Check archive.org Show headers Download Go to Show image Full URL https://track-eu1.hubspot.com/__ptq.gif?k=15&fi=5a995f05-701c-48e3-b25a-d1548ba3c0b3&fci=21f9c00a-45ea-41aa-89dd-d6cd4a2faef8&ft=0&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=en-us&bfp=3335903367&v=1.1&a=25755956&rcu=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fqilin-ransomware%2F&r=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fqilin-ransomware%2F&pu=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fqilin-ransomware%2F&t=Gain+new-found+insights+into+Qilin+Ransomware%2C+their+Data+Leak+Site+(DLS)+and+operations+targeting+critical+industries+%7C+Group-IB+Blog&cts=1696881520366&vi=e70f20f9a40cbbd2905c7af15d2c48a4&nc=true&u=84897990.e70f20f9a40cbbd2905c7af15d2c48a4.1696881520359.1696881520359.1696881520359.1&b=84897990.1.1696881520359&cc=15 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.65.240.166 -, , ASN (), Reverse DNS Software cloudflare / Resource Hash dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers date Mon, 09 Oct 2023 19:58:40 GMT strict-transport-security max-age=31536000; includeSubDomains; preload x-content-type-options nosniff cf-cache-status MISS nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} x-evy-trace-route-service-name envoyset-translator x-hubspot-correlation-id 03ca6035-5d4e-450d-b371-a7b55107764b p3p CP="NOI CUR ADM OUR NOR STA NID" x-envoy-upstream-service-time 2 content-length 45 x-evy-trace-route-configuration listener_https/all x-evy-trace-listener listener_https x-request-id 03ca6035-5d4e-450d-b371-a7b55107764b last-modified Mon, 09 Oct 2023 19:58:40 GMT server cloudflare vary origin, Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ut8%2ByR%2FYLJh%2FMmtewUtPPfOFldpHr0FwGqhKKcI0%2BvYWJrMZNGo5IF%2FFW0tXy8Bz4c%2FpZM05oTvUE%2FJ9Q9XpNY7XZ15Pghzp7%2BSBr0yjMJsC%2F6hsqxZ2hUJJ6uEnPx5kzld8VgfcSw%3D%3D"}],"group":"cf-nel","max_age":604800} content-type image/gif x-evy-trace-served-by-pod fra04/analytics-tracking-td/envoy-proxy-74554d9fd-f4fv2 x-evy-trace-virtual-host all cache-control no-cache, no-store, no-transform access-control-allow-credentials false accept-ranges bytes cf-ray 8139331f0ae537fc-FRA x-robots-tag none
GET H2	200	__ptq.gif track-eu1.hubspot.com/	45 B 1 KB	147ms 101ms	Image image/gif	172.65.240.166
General Check archive.org Show headers Download Go to Show image Full URL https://track-eu1.hubspot.com/__ptq.gif?k=15&fi=eb903dab-0ef3-43b5-bdeb-71372e6ad0f0&fci=e54cb119-6c72-43f7-831c-66a3ecce098b&ft=0&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=en-us&bfp=3335903367&v=1.1&a=25755956&rcu=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fqilin-ransomware%2F&r=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fqilin-ransomware%2F&pu=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fqilin-ransomware%2F&t=Gain+new-found+insights+into+Qilin+Ransomware%2C+their+Data+Leak+Site+(DLS)+and+operations+targeting+critical+industries+%7C+Group-IB+Blog&cts=1696881520367&vi=e70f20f9a40cbbd2905c7af15d2c48a4&nc=true&u=84897990.e70f20f9a40cbbd2905c7af15d2c48a4.1696881520359.1696881520359.1696881520359.1&b=84897990.1.1696881520359&cc=15 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.65.240.166 -, , ASN (), Reverse DNS Software cloudflare / Resource Hash dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers date Mon, 09 Oct 2023 19:58:40 GMT strict-transport-security max-age=31536000; includeSubDomains; preload x-content-type-options nosniff cf-cache-status MISS nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} x-evy-trace-route-service-name envoyset-translator x-hubspot-correlation-id 4c6792af-bb00-4330-ac6c-5292dadbe625 p3p CP="NOI CUR ADM OUR NOR STA NID" x-envoy-upstream-service-time 8 content-length 45 x-evy-trace-route-configuration listener_https/all x-evy-trace-listener listener_https x-request-id 4c6792af-bb00-4330-ac6c-5292dadbe625 last-modified Mon, 09 Oct 2023 19:58:40 GMT server cloudflare vary origin, Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=tI%2BVBfx45y5ABywFXXz9AJvs3aXJsEKKpnIkdPCmrCaa05qAFBnurpqSWeom0iG%2F5Jjq8lECISVgRWioFXB%2F3yr%2FhPXTYoggxYnTTEkDBG8O8mv%2BvZX5VlFgCZGrdOa2xrcoFPn00w%3D%3D"}],"group":"cf-nel","max_age":604800} content-type image/gif x-evy-trace-served-by-pod fra04/analytics-tracking-td/envoy-proxy-74554d9fd-9spmc x-evy-trace-virtual-host all cache-control no-cache, no-store, no-transform access-control-allow-credentials false accept-ranges bytes cf-ray 8139331f0adb37fc-FRA x-robots-tag none
GET H2	200	__ptq.gif track-eu1.hubspot.com/	45 B 636 B	138ms 94ms	Image image/gif	172.65.240.166
General Check archive.org Show headers Download Go to Show image Full URL https://track-eu1.hubspot.com/__ptq.gif?k=17&fi=5a995f05-701c-48e3-b25a-d1548ba3c0b3&fci=21f9c00a-45ea-41aa-89dd-d6cd4a2faef8&ft=0&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=en-us&bfp=3335903367&v=1.1&a=25755956&rcu=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fqilin-ransomware%2F&r=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fqilin-ransomware%2F&pu=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fqilin-ransomware%2F&t=Gain+new-found+insights+into+Qilin+Ransomware%2C+their+Data+Leak+Site+(DLS)+and+operations+targeting+critical+industries+%7C+Group-IB+Blog&cts=1696881520372&vi=e70f20f9a40cbbd2905c7af15d2c48a4&nc=true&u=84897990.e70f20f9a40cbbd2905c7af15d2c48a4.1696881520359.1696881520359.1696881520359.1&b=84897990.1.1696881520359&cc=15 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.65.240.166 -, , ASN (), Reverse DNS Software cloudflare / Resource Hash dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers date Mon, 09 Oct 2023 19:58:40 GMT strict-transport-security max-age=31536000; includeSubDomains; preload x-content-type-options nosniff cf-cache-status MISS nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} x-evy-trace-route-service-name envoyset-translator x-hubspot-correlation-id 6e43b8fa-6f37-44f0-b380-e8ea9454217b p3p CP="NOI CUR ADM OUR NOR STA NID" x-envoy-upstream-service-time 2 content-length 45 x-evy-trace-route-configuration listener_https/all x-evy-trace-listener listener_https x-request-id 6e43b8fa-6f37-44f0-b380-e8ea9454217b last-modified Mon, 09 Oct 2023 19:58:40 GMT server cloudflare vary origin, Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=RbYDXzCeAhe7jS73WDUZWo%2Bgot0I841LCmQ9ZEgD%2Br0CKK8zaYGCY0V0MEExI1PPmi%2BciVpqYPVPIzlZ2dD%2B2iTxkH1yzkB27YQ6W33kwkbCFEtRYziGbD%2Fiqmt5Qq9SvohFe%2FlPFg%3D%3D"}],"group":"cf-nel","max_age":604800} content-type image/gif x-evy-trace-served-by-pod fra04/analytics-tracking-td/envoy-proxy-74554d9fd-2ffwm x-evy-trace-virtual-host all cache-control no-cache, no-store, no-transform access-control-allow-credentials false accept-ranges bytes cf-ray 8139331f0aef37fc-FRA x-robots-tag none
GET H2	200	__ptq.gif track-eu1.hubspot.com/	45 B 631 B	94ms 94ms	Image image/gif	172.65.240.166
General Check archive.org Show headers Download Go to Show image Full URL https://track-eu1.hubspot.com/__ptq.gif?k=17&fi=044e7558-8073-478a-ad3c-5807dd76840f&fci=2c69f985-d02c-41a9-97c9-6736d75f024d&ft=0&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=en-us&bfp=3335903367&v=1.1&a=25755956&rcu=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fqilin-ransomware%2F&r=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fqilin-ransomware%2F&pu=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fqilin-ransomware%2F&t=Gain+new-found+insights+into+Qilin+Ransomware%2C+their+Data+Leak+Site+(DLS)+and+operations+targeting+critical+industries+%7C+Group-IB+Blog&cts=1696881520373&vi=e70f20f9a40cbbd2905c7af15d2c48a4&nc=true&u=84897990.e70f20f9a40cbbd2905c7af15d2c48a4.1696881520359.1696881520359.1696881520359.1&b=84897990.1.1696881520359&cc=15 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.65.240.166 -, , ASN (), Reverse DNS Software cloudflare / Resource Hash dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers date Mon, 09 Oct 2023 19:58:40 GMT strict-transport-security max-age=31536000; includeSubDomains; preload x-content-type-options nosniff cf-cache-status MISS nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} x-evy-trace-route-service-name envoyset-translator x-hubspot-correlation-id e300ee57-82d1-46b1-9cf1-0d3050a01c3b p3p CP="NOI CUR ADM OUR NOR STA NID" x-envoy-upstream-service-time 3 content-length 45 x-evy-trace-route-configuration listener_https/all x-evy-trace-listener listener_https x-request-id e300ee57-82d1-46b1-9cf1-0d3050a01c3b last-modified Mon, 09 Oct 2023 19:58:40 GMT server cloudflare vary origin, Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=21BiaK2bkztq%2BB6vs7u%2FGsIUIqklTOiUHmL1%2FFXxKzIwXpr14jMIuwtwD5ubWRMb0eVDv1oEJqO4apYbghF4CD8fB2KRyV2CK5c91vnCKMyghGJEPlOj39NSvePcG34rDx3cYdfcpQ%3D%3D"}],"group":"cf-nel","max_age":604800} content-type image/gif x-evy-trace-served-by-pod fra04/analytics-tracking-td/envoy-proxy-74554d9fd-wfdxk x-evy-trace-virtual-host all cache-control no-cache, no-store, no-transform access-control-allow-credentials false accept-ranges bytes cf-ray 8139331f4b3b37fc-FRA x-robots-tag none
GET H2	200	__ptq.gif track-eu1.hubspot.com/	45 B 640 B	97ms 97ms	Image image/gif	172.65.240.166
General Check archive.org Show headers Download Go to Show image Full URL https://track-eu1.hubspot.com/__ptq.gif?k=15&fi=4dbceae1-75ae-423a-9c12-dee8f1ca3345&fci=1315cf4e-7481-4188-be7f-a44f9206fbaa&ft=0&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=en-us&bfp=3335903367&v=1.1&a=25755956&rcu=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fqilin-ransomware%2F&r=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fqilin-ransomware%2F&pu=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fqilin-ransomware%2F&t=Gain+new-found+insights+into+Qilin+Ransomware%2C+their+Data+Leak+Site+(DLS)+and+operations+targeting+critical+industries+%7C+Group-IB+Blog&cts=1696881520375&vi=e70f20f9a40cbbd2905c7af15d2c48a4&nc=true&u=84897990.e70f20f9a40cbbd2905c7af15d2c48a4.1696881520359.1696881520359.1696881520359.1&b=84897990.1.1696881520359&cc=15 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.65.240.166 -, , ASN (), Reverse DNS Software cloudflare / Resource Hash dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers date Mon, 09 Oct 2023 19:58:40 GMT strict-transport-security max-age=31536000; includeSubDomains; preload x-content-type-options nosniff cf-cache-status MISS nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} x-evy-trace-route-service-name envoyset-translator x-hubspot-correlation-id c7e61672-cc65-4693-8c0b-db20a89c7f8c p3p CP="NOI CUR ADM OUR NOR STA NID" x-envoy-upstream-service-time 2 content-length 45 x-evy-trace-route-configuration listener_https/all x-evy-trace-listener listener_https x-request-id c7e61672-cc65-4693-8c0b-db20a89c7f8c last-modified Mon, 09 Oct 2023 19:58:40 GMT server cloudflare vary origin, Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=18ts59pj8u6Gk22MsxGwBy8MJoFaUQx%2BmXdCUG%2FGUMJH90JlKnZpvEPhJcWLCRdK%2FuHHGF1BddYS1GY%2BkmUdCou%2BZK4%2B%2Bf6lb0MDp9oUwyVETzrpG7Tznkuz%2Fx7mrBn7RYAhGrj2Hw%3D%3D"}],"group":"cf-nel","max_age":604800} content-type image/gif x-evy-trace-served-by-pod fra04/analytics-tracking-td/envoy-proxy-74554d9fd-7vcxx x-evy-trace-virtual-host all cache-control no-cache, no-store, no-transform access-control-allow-credentials false accept-ranges bytes cf-ray 8139331f4b4037fc-FRA x-robots-tag none
GET H2	200	__ptq.gif track-eu1.hubspot.com/	45 B 1 KB	95ms 95ms	Image image/gif	172.65.240.166
General Check archive.org Show headers Download Go to Show image Full URL https://track-eu1.hubspot.com/__ptq.gif?k=17&fi=4dbceae1-75ae-423a-9c12-dee8f1ca3345&fci=1315cf4e-7481-4188-be7f-a44f9206fbaa&ft=0&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=en-us&bfp=3335903367&v=1.1&a=25755956&rcu=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fqilin-ransomware%2F&r=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fqilin-ransomware%2F&pu=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fqilin-ransomware%2F&t=Gain+new-found+insights+into+Qilin+Ransomware%2C+their+Data+Leak+Site+(DLS)+and+operations+targeting+critical+industries+%7C+Group-IB+Blog&cts=1696881520376&vi=e70f20f9a40cbbd2905c7af15d2c48a4&nc=true&u=84897990.e70f20f9a40cbbd2905c7af15d2c48a4.1696881520359.1696881520359.1696881520359.1&b=84897990.1.1696881520359&cc=15 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.65.240.166 -, , ASN (), Reverse DNS Software cloudflare / Resource Hash dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers date Mon, 09 Oct 2023 19:58:40 GMT strict-transport-security max-age=31536000; includeSubDomains; preload x-content-type-options nosniff cf-cache-status MISS nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} x-evy-trace-route-service-name envoyset-translator x-hubspot-correlation-id 1564c8a8-40f9-4f3e-9d50-3850c1fce016 p3p CP="NOI CUR ADM OUR NOR STA NID" x-envoy-upstream-service-time 2 content-length 45 x-evy-trace-route-configuration listener_https/all x-evy-trace-listener listener_https x-request-id 1564c8a8-40f9-4f3e-9d50-3850c1fce016 last-modified Mon, 09 Oct 2023 19:58:40 GMT server cloudflare vary origin, Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=DQrRUQU%2Fef7pjk2HXJgNjp9hNuoP01KSWHaLWtTyFJjkiGfyRLXGd2yQRL25gswsmoG5l5lp9kaezZ6tgbDURDgaiiN466dmobF5NFkoGYFzqdXptwai9JhHpnstwvkz4KLaO8FUwQ%3D%3D"}],"group":"cf-nel","max_age":604800} content-type image/gif x-evy-trace-served-by-pod fra04/analytics-tracking-td/envoy-proxy-74554d9fd-f4fv2 x-evy-trace-virtual-host all cache-control no-cache, no-store, no-transform access-control-allow-credentials false accept-ranges bytes cf-ray 8139331f4b4337fc-FRA x-robots-tag none
GET H2	200	facebook-64.svg website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/socials/	627 B 1 KB	72ms 71ms	Image image/svg+xml	2600:9000:2156:f000:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/socials/facebook-64.svg Requested by Host: website.cdn.group-ib.com URL: https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-blog-post.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:2156:f000:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash f006e8bbfa4f0537780571436b5bed50ff10ff28759924c53b67732ec5af28ba Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-blog-post.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; content-encoding gzip x-content-type-options nosniff date Mon, 09 Oct 2023 19:58:40 GMT via 1.1 632ee301c4920b52f2463aa9e978c57e.cloudfront.net (CloudFront) strict-transport-security max-age=31536000; includeSubDomains x-amz-cf-pop FRA50-C1 x-cache Miss from cloudfront content-length 376 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Tue, 29 Nov 2022 07:39:21 GMT server nginx etag "273-5ee9716178eea-gzip" x-frame-options sameorigin vary Accept-Encoding content-type image/svg+xml access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id e1eEBGo-AeR4n_gxrmY-ALohVQMTRTRn8XTGtxJF_Hv_DHh1ZtMwwA== expires Mon, 09 Oct 2023 20:28:40 GMT
GET H2	200	facebook-lbg.svg website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/socials/	1 KB 1 KB	72ms 72ms	Image image/svg+xml	2600:9000:2156:f000:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/socials/facebook-lbg.svg Requested by Host: website.cdn.group-ib.com URL: https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-blog-post.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:2156:f000:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash 1e0e607b314623cf3e5ba71869ca47d1549556369988daa5e8a1bf56559c2973 Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-blog-post.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; content-encoding gzip x-content-type-options nosniff date Mon, 09 Oct 2023 19:58:40 GMT via 1.1 632ee301c4920b52f2463aa9e978c57e.cloudfront.net (CloudFront) strict-transport-security max-age=31536000; includeSubDomains x-amz-cf-pop FRA50-C1 x-cache Miss from cloudfront content-length 522 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Tue, 29 Nov 2022 07:39:21 GMT server nginx etag "4f0-5ee9716178eea-gzip" x-frame-options sameorigin vary Accept-Encoding content-type image/svg+xml access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id KeNkoIMb9OH55OxIt8fKnnGGcXHGl6b9ajHiqVq5EiXLqo3rDrxstA== expires Mon, 09 Oct 2023 20:28:40 GMT
GET H2	200	/ www.facebook.com/tr/	0 54 B	27ms 27ms	Image text/plain	2a03:2880:f177:83:face:b00c:0:25de
General Check archive.org Show headers Download Go to Show image Full URL https://www.facebook.com/tr/?id=709834390277869&ev=PageView&dl=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fqilin-ransomware%2F&rl=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fqilin-ransomware%2F&if=false&ts=1696881520475&sw=1600&sh=1200&ud[external_id]=e70f20f9a40cbbd2905c7af15d2c48a4&v=2.9.132&r=stable&ec=0&o=30&fbp=fb.1.1696881519495.2014502562&cs_est=true&it=1696881519265&coo=false&exp=a1&rqm=GET Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a03:2880:f177:83:face:b00c:0:25de -, , ASN (), Reverse DNS Software proxygen-bolt / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers strict-transport-security max-age=31536000; includeSubDomains date Mon, 09 Oct 2023 19:58:40 GMT server proxygen-bolt content-type text/plain access-control-allow-origin access-control-allow-credentials true cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400 content-length 0
GET H2	200	img.gif b.6sc.co/v1/beacon/	43 B 485 B	271ms 270ms	Image image/gif	92.123.27.11
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=e84d9c08a990af8592952e7ac9a983ad&svisitor=null&visitor=8ac6acd3-c44d-4ef2-8843-3835910dd745&session=120a30aa-cec9-4e5c-81a7-8fc2560fcf2f&event=active_time_track&q=%7B%22currentTime%22%3A%22Mon%2C%2009%20Oct%202023%2019%3A58%3A40%20GMT%22%2C%22lastTrackTime%22%3A%22Mon%2C%2009%20Oct%202023%2019%3A58%3A39%20GMT%22%2C%22timeSpent%22%3A%221003%22%2C%22totalTimeSpent%22%3A%221003%22%7D&isIframe=false&m=%7B%22description%22%3A%22All%20you%20need%20to%20know%20about%20Qilin%20ransomware%20and%20its%20operations%20targeting%20critical%20sectors.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Gain%20new-found%20insights%20into%20Qilin%20Ransomware%2C%20their%20Data%20Leak%20Site%20(DLS)%20and%20operations%20targeting%20critical%20industries%20%7C%20Group-IB%20Blog%22%7D&cb=&r=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fqilin-ransomware%2F&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fqilin-ransomware%2F&pageViewId=28e41306-8cea-4180-811a-c7b1a0e5dec3&v=1.1.7 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 92.123.27.11 -, , ASN (), Reverse DNS Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers date Mon, 09 Oct 2023 19:58:40 GMT x-content-type-options nosniff content-length 43 pragma no-cache last-modified Sat, 05 Jun 2021 07:56:05 GMT server nginx/1.14.0 (Ubuntu) etag "60bb2e15-2b" access-control-max-age 86400 access-control-allow-methods GET,POST content-type image/gif access-control-allow-origin cache-control private, no-cache, no-cache=Set-Cookie, proxy-revalidate access-control-allow-credentials true accept-ranges bytes access-control-allow-headers * expires Wed, 19 Apr 2000 11:43:00 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain

www.group-ib.com

URL

https://www.group-ib.com/wp-admin/admin-ajax.php