www.group-ib.com Open in urlscan Pro
3.72.181.255 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://www.group-ib.com/blog/mysterious-team-bangladesh/
Submission: On December 04 via api (December 4th 2023, 5:50:56 pm UTC) from US — Scanned from DE

Summary HTTP 138 Redirects Links 21 Behaviour Indicators

Summary

This website contacted 35 IPs in 4 countries across 25 domains to perform 138 HTTP transactions. The main IP is 3.72.181.255, located in Frankfurt am Main, Germany and belongs to AMAZON-02, US. The main domain is www.group-ib.com.
TLS certificate: Issued by Sectigo RSA Domain Validation Secure ... on June 26th 2023. Valid for: a year.

This is the only time www.group-ib.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
20	3.72.181.255 3.72.181.255	16509 (AMAZON-02) (AMAZON-02)
2	195.201.183.123 195.201.183.123	24940 (HETZNER-AS) (HETZNER-AS)
42	2600:9000:248... 2600:9000:2487:4000:9:7af6:1700:93a1	16509 (AMAZON-02) (AMAZON-02)
1	172.65.255.172 172.65.255.172	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	172.65.208.22 172.65.208.22	13335 (CLOUDFLAR...) (CLOUDFLARENET)
8	172.65.232.43 172.65.232.43	13335 (CLOUDFLAR...) (CLOUDFLARENET)
4	2a00:1450:400... 2a00:1450:4001:80f::2008	15169 (GOOGLE) (GOOGLE)
4 11	2a02:6b8::1:119 2a02:6b8::1:119	208722 (GLOBAL_DC) (GLOBAL_DC)
1	2606:4700::68... 2606:4700::6811:cff9	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	172.65.202.201 172.65.202.201	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	172.65.192.122 172.65.192.122	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	172.65.236.181 172.65.236.181	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	172.65.238.60 172.65.238.60	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	172.65.219.229 172.65.219.229	13335 (CLOUDFLAR...) (CLOUDFLARENET)
4 5	2620:1ec:21::14 2620:1ec:21::14	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
6	2.17.100.193 2.17.100.193	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
2	2a00:1450:400... 2a00:1450:4001:801::2002	15169 (GOOGLE) (GOOGLE)
1	2a04:4e42:400... 2a04:4e42:400::396	54113 (FASTLY) (FASTLY)
1	108.157.229.98 108.157.229.98	16509 (AMAZON-02) (AMAZON-02)
1	2606:4700::68... 2606:4700::6810:890f	13335 (CLOUDFLAR...) (CLOUDFLARENET)
3	2a03:2880:f08... 2a03:2880:f084:d:face:b00c:0:3	32934 (FACEBOOK) (FACEBOOK)
3	2606:4700:440... 2606:4700:4400::6812:2b1f	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	13.107.42.14 13.107.42.14	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	172.65.198.159 172.65.198.159	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a06:98c1:320... 2a06:98c1:3200::90:0	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2001:4860:480... 2001:4860:4802:34::36	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:400c:c00::9a	15169 (GOOGLE) (GOOGLE)
3	2a00:1450:400... 2a00:1450:4001:803::2003	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:831::2004	15169 (GOOGLE) (GOOGLE)
1	151.101.193.140 151.101.193.140	54113 (FASTLY) (FASTLY)
1	2a02:26f0:480... 2a02:26f0:480:21::217:d11c	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
5	54.162.203.31 54.162.203.31	14618 (AMAZON-AES) (AMAZON-AES)
2	2a03:2880:f17... 2a03:2880:f177:185:face:b00c:0:25de	32934 (FACEBOOK) (FACEBOOK)
9	172.65.240.166 172.65.240.166	() ()
138	35

20 3.72.181.255 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-3-72-181-255.eu-central-1.compute.amazonaws.com

www.group-ib.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 195.201.183.123 (Gunzenhausen, Germany)

ASN24940 (HETZNER-AS, DE)
PTR: static.123.183.201.195.clients.your-server.de

fhp-de-js.group-ib.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

42 2600:9000:2487:4000:9:7af6:1700:93a1 (United States)

ASN16509 (AMAZON-02, US)

website.cdn.group-ib.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 172.65.255.172 (United States)

ASN13335 (CLOUDFLARENET, US)

js-eu1.hsforms.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 172.65.208.22 (United States)

ASN13335 (CLOUDFLARENET, US)

js-eu1.hs-scripts.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 172.65.232.43 (United States)

ASN13335 (CLOUDFLARENET, US)

forms-eu1.hsforms.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
perf-eu1.hsforms.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:80f::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

11 2a02:6b8::1:119 (Moscow, Russian Federation) 4 redirects

ASN208722 (GLOBAL_DC, FI)

mc.yandex.ru	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
mc.yandex.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6811:cff9 (United States)

ASN13335 (CLOUDFLARENET, US)

forms.hsforms.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 172.65.202.201 (United States)

ASN13335 (CLOUDFLARENET, US)

js-eu1.hs-banner.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 172.65.192.122 (United States)

ASN13335 (CLOUDFLARENET, US)

js-eu1.hscollectedforms.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
forms-eu1.hscollectedforms.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 172.65.236.181 (United States)

ASN13335 (CLOUDFLARENET, US)

js-eu1.hubspot.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 172.65.238.60 (United States)

ASN13335 (CLOUDFLARENET, US)

js-eu1.hs-analytics.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 172.65.219.229 (United States)

ASN13335 (CLOUDFLARENET, US)

js-eu1.hsadspixel.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2620:1ec:21::14 (United States) 4 redirects

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

px.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
www.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2.17.100.193 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)
PTR: a2-17-100-193.deploy.static.akamaitechnologies.com

j.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
c.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
b.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:801::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a04:4e42:400::396 (United States)

ASN54113 (FASTLY, US)

www.redditstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 108.157.229.98 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-108-157-229-98.arn56.r.cloudfront.net

cdn.neverbounce.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6810:890f (United States)

ASN13335 (CLOUDFLARENET, US)

ws.zoominfo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a03:2880:f084:d:face:b00c:0:3 (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2606:4700:4400::6812:2b1f (United States)

ASN13335 (CLOUDFLARENET, US)

tracking.g2crowd.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.107.42.14 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

px4.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 172.65.198.159 (United States)

ASN13335 (CLOUDFLARENET, US)

cta-eu1.hubspot.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a06:98c1:3200::90:0 (United States)

ASN13335 (CLOUDFLARENET, US)

api-eu1.hubapi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2001:4860:4802:34::36 (United States)

ASN15169 (GOOGLE, US)

region1.analytics.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:400c:c00::9a (Brussels, Belgium)

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:803::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:831::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.193.140 (United States)

ASN54113 (FASTLY, US)

alb.reddit.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:26f0:480:21::217:d11c (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)

ipv6.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 54.162.203.31 (United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-162-203-31.compute-1.amazonaws.com

api.neverbounce.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f177:185:face:b00c:0:25de (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 172.65.240.166 (None, )

ASN- ()

track-eu1.hubspot.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
64	group-ib.com www.group-ib.com fhp-de-js.group-ib.com — Cisco Umbrella Rank: 405486 website.cdn.group-ib.com	1 MB
11	hubspot.com js-eu1.hubspot.com — Cisco Umbrella Rank: 28974 cta-eu1.hubspot.com — Cisco Umbrella Rank: 28543 track-eu1.hubspot.com	33 KB
9	hsforms.com forms-eu1.hsforms.com — Cisco Umbrella Rank: 29802 forms.hsforms.com — Cisco Umbrella Rank: 4435 perf-eu1.hsforms.com — Cisco Umbrella Rank: 29084	71 KB
8	yandex.com 3 redirects mc.yandex.com — Cisco Umbrella Rank: 8902	3 KB
7	6sc.co j.6sc.co — Cisco Umbrella Rank: 5657 c.6sc.co — Cisco Umbrella Rank: 8715 ipv6.6sc.co — Cisco Umbrella Rank: 5852 b.6sc.co — Cisco Umbrella Rank: 3994	20 KB
6	neverbounce.com cdn.neverbounce.com — Cisco Umbrella Rank: 61110 api.neverbounce.com — Cisco Umbrella Rank: 142730	31 KB
6	linkedin.com 4 redirects px.ads.linkedin.com — Cisco Umbrella Rank: 327 www.linkedin.com — Cisco Umbrella Rank: 629 px4.ads.linkedin.com — Cisco Umbrella Rank: 6419	6 KB
4	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 36	345 KB
3	google.de www.google.de — Cisco Umbrella Rank: 6765	670 B
3	google.com region1.analytics.google.com — Cisco Umbrella Rank: 2693 www.google.com — Cisco Umbrella Rank: 2	809 B
3	g2crowd.com tracking.g2crowd.com — Cisco Umbrella Rank: 8744	3 KB
3	facebook.net connect.facebook.net — Cisco Umbrella Rank: 168	127 KB
3	doubleclick.net googleads.g.doubleclick.net — Cisco Umbrella Rank: 33 stats.g.doubleclick.net — Cisco Umbrella Rank: 75	4 KB
3	yandex.ru 1 redirects mc.yandex.ru — Cisco Umbrella Rank: 4182	71 KB
2	facebook.com www.facebook.com — Cisco Umbrella Rank: 98	239 B
2	hscollectedforms.net js-eu1.hscollectedforms.net — Cisco Umbrella Rank: 27654 forms-eu1.hscollectedforms.net — Cisco Umbrella Rank: 28279	26 KB
1	reddit.com alb.reddit.com — Cisco Umbrella Rank: 1387	637 B
1	hubapi.com api-eu1.hubapi.com — Cisco Umbrella Rank: 24856	1 KB
1	zoominfo.com ws.zoominfo.com — Cisco Umbrella Rank: 4490	2 KB
1	redditstatic.com www.redditstatic.com — Cisco Umbrella Rank: 1266	8 KB
1	hsadspixel.net js-eu1.hsadspixel.net — Cisco Umbrella Rank: 23532	4 KB
1	hs-analytics.net js-eu1.hs-analytics.net — Cisco Umbrella Rank: 15614	21 KB
1	hs-banner.com js-eu1.hs-banner.com — Cisco Umbrella Rank: 15405	20 KB
1	hs-scripts.com js-eu1.hs-scripts.com — Cisco Umbrella Rank: 14564	1 KB
1	hsforms.net js-eu1.hsforms.net — Cisco Umbrella Rank: 56780	179 KB
138	25

	Domain	Requested by
42	website.cdn.group-ib.com	www.group-ib.com website.cdn.group-ib.com
20	www.group-ib.com	fhp-de-js.group-ib.com www.group-ib.com website.cdn.group-ib.com
9	track-eu1.hubspot.com
8	mc.yandex.com	3 redirects www.group-ib.com fhp-de-js.group-ib.com
7	forms-eu1.hsforms.com	fhp-de-js.group-ib.com www.group-ib.com
5	api.neverbounce.com	cdn.neverbounce.com
4	b.6sc.co	www.group-ib.com
4	px.ads.linkedin.com	3 redirects www.group-ib.com
4	www.googletagmanager.com	www.group-ib.com www.googletagmanager.com js-eu1.hsadspixel.net
3	www.google.de	www.group-ib.com
3	tracking.g2crowd.com	www.group-ib.com
3	connect.facebook.net	www.group-ib.com connect.facebook.net
3	mc.yandex.ru	1 redirects website.cdn.group-ib.com www.group-ib.com
2	www.facebook.com	www.group-ib.com
2	www.google.com	www.group-ib.com
2	googleads.g.doubleclick.net	www.googletagmanager.com
2	fhp-de-js.group-ib.com	www.group-ib.com
1	ipv6.6sc.co	fhp-de-js.group-ib.com
1	c.6sc.co	fhp-de-js.group-ib.com
1	alb.reddit.com	www.group-ib.com
1	perf-eu1.hsforms.com	www.group-ib.com
1	stats.g.doubleclick.net	fhp-de-js.group-ib.com
1	region1.analytics.google.com	fhp-de-js.group-ib.com
1	api-eu1.hubapi.com	fhp-de-js.group-ib.com
1	forms-eu1.hscollectedforms.net	fhp-de-js.group-ib.com
1	cta-eu1.hubspot.com	fhp-de-js.group-ib.com
1	px4.ads.linkedin.com	www.group-ib.com
1	www.linkedin.com	1 redirects
1	ws.zoominfo.com	www.group-ib.com
1	cdn.neverbounce.com	www.googletagmanager.com
1	www.redditstatic.com	www.googletagmanager.com
1	j.6sc.co	www.group-ib.com
1	js-eu1.hsadspixel.net	js-eu1.hs-scripts.com
1	js-eu1.hs-analytics.net	js-eu1.hs-scripts.com
1	js-eu1.hubspot.com	js-eu1.hs-scripts.com
1	js-eu1.hscollectedforms.net	js-eu1.hs-scripts.com
1	js-eu1.hs-banner.com	js-eu1.hs-scripts.com
1	forms.hsforms.com	www.group-ib.com
1	js-eu1.hs-scripts.com	www.group-ib.com
1	js-eu1.hsforms.net	www.group-ib.com
138	40

This site contains links to these domains. Also see Links.

Domain
trebuchet.gibthf.com
github.com
sso.group-ib.com
twitter.com
www.linkedin.com
t.me
en.everybodywiki.com
www.dhakatribune.com
www.niiconsulting.com
www.cloudsek.com
cloudsek.com
www.pinterest.com
instagram.com
www.facebook.com
group-ib.medium.com

Subject Issuer	Validity	Valid
www.group-ib.com Sectigo RSA Domain Validation Secure Server CA	`2023-06-26` - `2024-06-28`	a year	crt.sh
*.group-ib.com Sectigo RSA Domain Validation Secure Server CA	`2023-06-30` - `2024-07-04`	a year	crt.sh
website.cdn.group-ib.com Amazon RSA 2048 M02	`2023-08-01` - `2024-08-30`	a year	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2023-05-16` - `2024-05-15`	a year	crt.sh
*.google-analytics.com GTS CA 1C3	`2023-10-23` - `2024-01-15`	3 months	crt.sh
mc.yandex.ru GlobalSign ECC OV SSL CA 2018	`2023-08-14` - `2024-01-24`	5 months	crt.sh
hubspot.com Cloudflare Inc ECC CA-3	`2023-02-05` - `2024-02-05`	a year	crt.sh
www.linkedin.com DigiCert SHA2 Secure Server CA	`2023-11-03` - `2024-05-03`	6 months	crt.sh
6sc.co R3	`2023-11-03` - `2024-02-01`	3 months	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2023-10-23` - `2024-01-15`	3 months	crt.sh
www.redditstatic.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-08-25` - `2024-02-21`	6 months	crt.sh
neverbounce.com Amazon RSA 2048 M02	`2023-02-13` - `2024-03-12`	a year	crt.sh
zoominfo.com Cloudflare Inc ECC CA-3	`2023-04-04` - `2024-04-03`	a year	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2023-09-13` - `2023-12-12`	3 months	crt.sh
hubapi.com Cloudflare Inc ECC CA-3	`2023-04-07` - `2024-04-06`	a year	crt.sh
www.google.de GTS CA 1C3	`2023-10-23` - `2024-01-15`	3 months	crt.sh
www.google.com GTS CA 1C3	`2023-10-23` - `2024-01-15`	3 months	crt.sh
*.reddit.com DigiCert TLS RSA SHA256 2020 CA1	`2023-09-01` - `2024-02-28`	6 months	crt.sh

This page contains 1 frames:

Primary Page: https://www.group-ib.com/blog/mysterious-team-bangladesh/
Frame ID: 44F236A7AFB2942E82BE49C3DF3C64D4
Requests: 160 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Demystifying Mysterious Team Bangladesh | Group-IB Blog

Page URL History Show full URLs

https://www.group-ib.com/blog/mysterious-team-bangladesh/ Page URL
https://www.group-ib.com/blog/mysterious-team-bangladesh/ Page URL

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

<link rel=["']stylesheet["'] [^>]+/wp-(?:content|includes)/
/wp-(?:content|includes)/

Ruby on Rails (Web Frameworks) Expand

Overall confidence: 75%
Detected patterns

Facebook (Widgets) Expand

Overall confidence: 100%
Detected patterns

//connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtm\.js
googletagmanager\.com/gtag/js

Yandex.Metrika (Analytics) Expand

Overall confidence: 100%
Detected patterns

mc\.yandex\.ru/metrika/(?:tag|watch)\.js

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

138
Requests

98 %
HTTPS

50 %
IPv6

25
Domains

40
Subdomains

35
IPs

4
Countries

2506 kB
Transfer

5737 kB
Size

46
Cookies

21 Outgoing links

These are links going to different origins than the main page.

URL: https://trebuchet.gibthf.com/?tab=email
Title: Email Security Assessment

Search URL Search Domain Scan URL

URL: https://trebuchet.gibthf.com/?tab=network
Title: Network Protection Assessment

Search URL Search Domain Scan URL

URL: https://github.com/Group-IB/cloud_sherlock
Title: Cloud Recon Tool

Search URL Search Domain Scan URL

URL: https://sso.group-ib.com/
Title: Sign in

Search URL Search Domain Scan URL

URL: https://twitter.com/intent/tweet?text=Demystifying%20Mysterious%20Team%20Bangladesh%20%7C%20Group-IB%20Blog&url=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fmysterious-team-bangladesh%2F&utm_source=share2
Title: Twitter

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fmysterious-team-bangladesh%2F&title=Demystifying%20Mysterious%20Team%20Bangladesh%20%7C%20Group-IB%20Blog&utm_source=share2
Title: LinkedIn

Search URL Search Domain Scan URL

URL: https://t.me/share/url?url=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fmysterious-team-bangladesh%2F&text=Demystifying%20Mysterious%20Team%20Bangladesh%20%7C%20Group-IB%20Blog&utm_source=share2
Title: Telegram

Search URL Search Domain Scan URL

URL: https://en.everybodywiki.com/Mysterious_Team_Bangladesh
Title: EverybodyWiki page

Search URL Search Domain Scan URL

URL: https://t.me/MysteriousTeam0
Title: Telegram channel

Search URL Search Domain Scan URL

URL: https://www.dhakatribune.com/bangladesh/303291/bangladesh-protests-sweden-quran-burning-as
Title: campaign

Search URL Search Domain Scan URL

URL: https://www.niiconsulting.com/Security_Advisories/Security%20Advisry%20Digest%20March%2023.pdf
Title: report

Search URL Search Domain Scan URL

URL: https://github.com/SkySG404/HttpFlood
Title: utility

Search URL Search Domain Scan URL

URL: https://www.cloudsek.com/threatintelligence/techniques-tactics-procedures-ttps-employed-by-hacktivist-group-dragonforce-malaysia
Title: report

Search URL Search Domain Scan URL

URL: https://cloudsek.com/threatintelligence/mysterious-team-bangladesh-targets-multiple-uae-government-websites-with-ddos-attacks-under-opuae-campaign#strongAppendixstronghttps://cloudsek.com/threatintelligence/mysterious-team-bangladesh-targets-multiple-uae-government-websites-with-ddos-attacks-under-opuae-campaign#strongAppendixstrong
Title: report

Search URL Search Domain Scan URL

URL: https://www.pinterest.com/jisan417/
Title: https://www.pinterest.com/jisan417/

Search URL Search Domain Scan URL

URL: https://twitter.com/GroupIB

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/organization/1382013/

Search URL Search Domain Scan URL

URL: https://instagram.com/groupibhq/

Search URL Search Domain Scan URL

URL: https://www.facebook.com/groupibHQ

Search URL Search Domain Scan URL

URL: https://t.me/Group_IB

Search URL Search Domain Scan URL

URL: https://group-ib.medium.com/

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://www.group-ib.com/blog/mysterious-team-bangladesh/ Page URL
https://www.group-ib.com/blog/mysterious-team-bangladesh/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 108

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=4496601&time=1701712254424&url=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fmysterious-team-bangladesh%2F&tm=gtmv2 HTTP 302
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=4496601&time=1701712254424&url=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fmysterious-team-bangladesh%2F&tm=gtmv2&cookiesTest=true HTTP 302
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D4496601%26time%3D1701712254424%26url%3Dhttps%253A%252F%252Fwww.group-ib.com%252Fblog%252Fmysterious-team-bangladesh%252F%26tm%3Dgtmv2%26cookiesTest%3Dtrue%26liSync%3Dtrue HTTP 302
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=4496601&time=1701712254424&url=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fmysterious-team-bangladesh%2F&tm=gtmv2&cookiesTest=true&liSync=true HTTP 302
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=4496601&time=1701712254424&url=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fmysterious-team-bangladesh%2F&tm=gtmv2&cookiesTest=true&liSync=true&e_ipv6=AQL99fq3Fhm8MgAAAYw19FlsgMePO_1NjwNOVfulwE3LbCXEDEP8rxRD1kdpnSqD0X_R-1g

Request Chain 118

https://mc.yandex.com/sync_cookie_image_check HTTP 302
https://mc.yandex.ru/sync_cookie_image_start?redirect_domain=mc.yandex.com&token=10207.Wa2_AhfpcgUjBPepgnSCMXAARjQHtAFKWmTv11Rckir7zXEeDcdxPdMv7wjh52Q9.JGoIlPHd6bbgrod-CfbqEatvUtA%2C HTTP 302
https://mc.yandex.com/sync_cookie_image_decide?token=10207.NT3pzKP472NtlUyoWc9cInPjZhu_ydXMrW9RDj2HBU1aQ2ML-Z570BlcmCAYZ9xiCwTZT41PRFkfb2YAExWQaktq5Lt5D6inn2_j4dZldJEINYAA3H6IfLmFUHuPixM-2uBrRSH5v4imwyaScefqka7tRq3TpV7cff4SJLOFXHA9yCAoZ9yUNBJJHrMCmq26rRSrbGlW5Nxue0pn5DeDcBsDP6M2TqCU2n6sqU21Ezc%2C.a3ugUtorPOo6ADUD2lqpnioBGAU%2C HTTP 302
https://mc.yandex.ru/sync_cookie_image_finish?redirect_domain=mc.yandex.com&token=10207.QKeIpecQa_S-QKhdt8JF6n2_f1k0zg8MIpA9axFqsRuH8Awkr0O9mpldTU040XT15nFhv2yz8vbd_u3A39wtOVua_HpIH6_2qn8jcEJv8FmKT4Ncdybh1tshr-YlUae_79BUHjwlzT9qQJSbK7S2G5UT0vgzqUtsQJhZ8p9PKsO2pn0tEgu5o1wPJX8ftoK8UK9HuB-J6MPCbz3QotGHcQ%2C%2C.EKI6e3HZtT_uWhYmb3GdSVloOjE%2C

Request Chain 140

https://mc.yandex.com/watch/26812653?wmode=7&page-url=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fmysterious-team-bangladesh%2F&charset=utf-8&site-info=%7B%22shareVersion%22%3A2%2C%22strategy%22%3A%22d%2Fn%2Fq%2Fr%2Fs%2Ft%22%7D&uah=chm%0A%3F0&browser-info=pv%3A1%3Avf%3Atuwae7cfavzq29du94ga6zf%3Afp%3A734%3Afu%3A1%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A1180%3Acn%3A1%3Adp%3A0%3Als%3A50131285524%3Ahid%3A851661035%3Az%3A60%3Ai%3A20231204185054%3Aet%3A1701712255%3Ac%3A1%3Arn%3A670515984%3Arqn%3A1%3Au%3A170171225517422594%3Aw%3A1600x1200%3As%3A1600x1200x24%3Ask%3A1%3Awv%3A2%3Ads%3A0%2C0%2C59%2C40%2C0%2C0%2C%2C707%2C2%2C%2C%2C%2C820%3Aco%3A0%3Acpf%3A1%3Ans%3A1701712253364%3Agi%3AR0ExLjEuMTE3MDMwMzQ5Ni4xNzAxNzEyMjU1%3Aadb%3A2%3Arqnl%3A1%3Ast%3A1701712255%3At%3ADemystifying%20Mysterious%20Team%20Bangladesh%20%7C%20Group-IB%20Blog&t=gdpr(14)clc(0-0-0)rqnt(1)aw(1)ti(1) HTTP 302
https://mc.yandex.com/watch/26812653/1?wmode=7&page-url=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fmysterious-team-bangladesh%2F&charset=utf-8&site-info=%7B%22shareVersion%22%3A2%2C%22strategy%22%3A%22d%2Fn%2Fq%2Fr%2Fs%2Ft%22%7D&uah=chm%0A%3F0&browser-info=pv%3A1%3Avf%3Atuwae7cfavzq29du94ga6zf%3Afp%3A734%3Afu%3A1%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A1180%3Acn%3A1%3Adp%3A0%3Als%3A50131285524%3Ahid%3A851661035%3Az%3A60%3Ai%3A20231204185054%3Aet%3A1701712255%3Ac%3A1%3Arn%3A670515984%3Arqn%3A1%3Au%3A170171225517422594%3Aw%3A1600x1200%3As%3A1600x1200x24%3Ask%3A1%3Awv%3A2%3Ads%3A0%2C0%2C59%2C40%2C0%2C0%2C%2C707%2C2%2C%2C%2C%2C820%3Aco%3A0%3Acpf%3A1%3Ans%3A1701712253364%3Agi%3AR0ExLjEuMTE3MDMwMzQ5Ni4xNzAxNzEyMjU1%3Aadb%3A2%3Arqnl%3A1%3Ast%3A1701712255%3At%3ADemystifying%20Mysterious%20Team%20Bangladesh%20%7C%20Group-IB%20Blog&t=gdpr%2814%29clc%280-0-0%29rqnt%281%29aw%281%29ti%281%29

138 HTTP transactions
22 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 403 / Show response
www.group-ib.com/blog/mysterious-team-bangladesh/ 7 KB
7 KB 195ms
39ms Document
text/html 3.72.181.255
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://www.group-ib.com/blog/mysterious-team-bangladesh/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.72.181.255 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-72-181-255.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: df7b54b910cea4c4c5f726482df5312a7d0e87bdef8c08e051836497b7e04c1f

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: no-cache, no-store, must-revalidate
content-type: text/html
date: Mon, 04 Dec 2023 17:50:51 GMT

GET
H/1.1 200
OK bt-autoinject.js Show response
fhp-de-js.group-ib.com/d/ 343 KB
135 KB 201ms
81ms Script
text/javascript 195.201.183.123
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://fhp-de-js.group-ib.com/d/bt-autoinject.js
Requested by: Host: www.group-ib.com
URL: https://www.group-ib.com/blog/mysterious-team-bangladesh/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 195.201.183.123 Gunzenhausen, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.123.183.201.195.clients.your-server.de
Software: nginx /
Resource Hash: 90feab54b3acd83fa6182b1099d882d4aa602ec61b8bcdfec8c3c8f413df5fe0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Date: Mon, 04 Dec 2023 17:50:51 GMT
Content-Encoding: gzip
Server: nginx
Transfer-Encoding: chunked
Vary: Accept-Encoding
Content-Type: text/javascript; charset=UTF-8
Access-Control-Allow-Methods: GET, POST, OPTIONS
x-envoy-upstream-service-time: 0
Access-Control-Allow-Credentials: true
Connection: keep-alive
Access-Control-Allow-Headers: Accept,DNT,Keep-Alive,User-Agent,If-Modified-Since,Cache-Control,Content-Type,Origin,ETag,If-None-Match,X-Cfids,Authorization

GET
DATA 200
OK truncated
/ 487 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 65d89845e7e63b000a7b7f82db7276f8272b086cc65722d3c1c802dfa59eea01

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 4 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: d7065620e6207c720686e1668df607d41ed2f0a381f6c62be957493abad1e96d

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 idgib-w-61354c22-16cc-40a8-a871-6901f1a76e24 Show response
www.group-ib.com/api/fl/ 205 B
676 B 48ms
48ms XHR
application/json 3.72.181.255
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://www.group-ib.com/api/fl/idgib-w-61354c22-16cc-40a8-a871-6901f1a76e24
Requested by: Host: fhp-de-js.group-ib.com
URL: https://fhp-de-js.group-ib.com/d/bt-autoinject.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.72.181.255 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-72-181-255.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 682b24f82f5ba230148a58710a4adf84b5b24a5fc86eabd0c9e2582aca5e2be9

Request headers

Referer: https://www.group-ib.com/blog/mysterious-team-bangladesh/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
x-cfids: -

Response headers

date: Mon, 04 Dec 2023 17:50:52 GMT
content-encoding: gzip
server: nginx
etag: W/"2Y4mdxC7n9s4C2BXoEJHajwbLsCH+jFCsplvUyOpFkC+5A16MnVnggtLCne2KexksXjFO6xoczf+p5YxAm4JUmje6+GJg0y5vwLcEIEr+RhGjbXoFJnLS8mCSVg1ItxOHuTGJtogHIQyenjStbo1Pwgj"
vary: Accept-Encoding
content-type: application/json; charset=utf-8
cache-control: no-cache
x-envoy-upstream-service-time: 1

POST
H2 200 fl Show response
www.group-ib.com/api/ 669 B
975 B 95ms
94ms XHR
application/json 3.72.181.255
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://www.group-ib.com/api/fl?u=0085cb90-831e-11ee-9493-816cec585ffa&cfidsgib-w-61354c22-16cc-40a8-a871-6901f1a76e24=2Y4mdxC7n9s4C2BXoEJHajwbLsCH%2BjFCsplvUyOpFkC%2B5A16MnVnggtLCne2KexksXjFO6xoczf%2Bp5YxAm4JUmje6%2BGJg0y5vwLcEIEr%2BRhGjbXoFJnLS8mCSVg1ItxOHuTGJtogHIQyenjStbo1Pwgj
Requested by: Host: fhp-de-js.group-ib.com
URL: https://fhp-de-js.group-ib.com/d/bt-autoinject.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.72.181.255 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-72-181-255.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: aea508e3736bff7b4e81a79a6c3db2740b482f88b9d10404e8fc85b7f9066239

Request headers

Referer: https://www.group-ib.com/blog/mysterious-team-bangladesh/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

date: Mon, 04 Dec 2023 17:50:53 GMT
content-encoding: gzip
server: nginx
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/json; charset=utf-8
access-control-allow-origin: https://www.group-ib.com
cache-control: no-store
access-control-allow-credentials: true
x-envoy-upstream-service-time: 3
access-control-allow-headers: Accept,DNT,Keep-Alive,User-Agent,If-Modified-Since,Cache-Control,Content-Type,Origin,ETag,If-None-Match,X-Cfids,Authorization

GET
H2 200 Primary Request / Show response
www.group-ib.com/blog/mysterious-team-bangladesh/ 80 KB
19 KB 60ms
60ms Document
text/html 3.72.181.255
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.group-ib.com/blog/mysterious-team-bangladesh/

Requested by

Host: www.group-ib.com
URL: https://www.group-ib.com/blog/mysterious-team-bangladesh/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.72.181.255 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-72-181-255.eu-central-1.compute.amazonaws.com

Software

nginx /

Resource Hash

7174bc56bf6ac9fa4e7dff3195a91124f95b6992775b2814a001084a614104a8

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self';
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.group-ib.com/blog/mysterious-team-bangladesh/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: https://www.group-ib.com
cache-control: private, max-age=3600
content-encoding: gzip
content-length: 19266
content-security-policy: frame-ancestors 'self';
content-type: text/html; charset=UTF-8
date: Mon, 04 Dec 2023 17:50:53 GMT
etag: "4a66-60bb2858b1219"
last-modified: Mon, 04 Dec 2023 17:33:52 GMT
permissions-policy: accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=()
referrer-policy: strict-origin-when-cross-origin
server: nginx
strict-transport-security: max-age=31536000; includeSubDomains
vary: X-Forwarded-Proto,Accept-Encoding,Cookie
x-content-type-options: nosniff
x-frame-options: sameorigin
x-xss-protection: 1; mode=block

POST
H2 200 fl
www.group-ib.com/api/ 685 B
700 B 49ms
48ms Ping
application/json 3.72.181.255
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://www.group-ib.com/api/fl?u=0085cb90-831e-11ee-9493-816cec585ffa&cfidsgib-w-61354c22-16cc-40a8-a871-6901f1a76e24=1g2HkmwimHJsN8FA48%2FPLmgNpWZJ6EclkiUuG6Tqs3UYLpVX%2BEBGxdinowf0PAMJwuOnCi%2FEq2S%2FlwT1Gv1ZOXjL8J0QBaNcD31e9MTzxV8J22XeSpMaxwvpDPMW22k0ZR39VGaF7wB7yFIeUUSsgqSgnm54DQSwzqjv
Requested by: Host: fhp-de-js.group-ib.com
URL: https://fhp-de-js.group-ib.com/d/bt-autoinject.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.72.181.255 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-72-181-255.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash

Request headers

Referer: https://www.group-ib.com/blog/mysterious-team-bangladesh/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

date: Mon, 04 Dec 2023 17:50:53 GMT
content-encoding: gzip
server: nginx
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/json; charset=utf-8
access-control-allow-origin: https://www.group-ib.com
cache-control: no-store
access-control-allow-credentials: true
x-envoy-upstream-service-time: 2
access-control-allow-headers: Accept,DNT,Keep-Alive,User-Agent,If-Modified-Since,Cache-Control,Content-Type,Origin,ETag,If-None-Match,X-Cfids,Authorization

GET
H/1.1 200
OK bt-autoinject.js Show response
fhp-de-js.group-ib.com/d/ 343 KB
135 KB 81ms
79ms Script
text/javascript 195.201.183.123
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://fhp-de-js.group-ib.com/d/bt-autoinject.js
Requested by: Host: www.group-ib.com
URL: https://www.group-ib.com/blog/mysterious-team-bangladesh/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 195.201.183.123 Gunzenhausen, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.123.183.201.195.clients.your-server.de
Software: nginx /
Resource Hash: 90feab54b3acd83fa6182b1099d882d4aa602ec61b8bcdfec8c3c8f413df5fe0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Date: Mon, 04 Dec 2023 17:50:53 GMT
Content-Encoding: gzip
Server: nginx
Transfer-Encoding: chunked
Vary: Accept-Encoding
Content-Type: text/javascript; charset=UTF-8
Access-Control-Allow-Methods: GET, POST, OPTIONS
x-envoy-upstream-service-time: 0
Access-Control-Allow-Credentials: true
Connection: keep-alive
Access-Control-Allow-Headers: Accept,DNT,Keep-Alive,User-Agent,If-Modified-Since,Cache-Control,Content-Type,Origin,ETag,If-None-Match,X-Cfids,Authorization

GET
H2 200 lazyload.min.js Show response
www.group-ib.com/wp-content/plugins/w3-total-cache/pub/js/ 6 KB
2 KB 50ms
49ms Script
application/javascript 3.72.181.255
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.group-ib.com/wp-content/plugins/w3-total-cache/pub/js/lazyload.min.js?x18492

Requested by

Host: www.group-ib.com
URL: https://www.group-ib.com/blog/mysterious-team-bangladesh/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.72.181.255 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-72-181-255.eu-central-1.compute.amazonaws.com

Software

nginx /

Resource Hash

1a54a1907a6443e3c81608130bfed4546eb0ce5d0c8897e1d7a3b43d89ecc367

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self';
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.group-ib.com/blog/mysterious-team-bangladesh/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

content-security-policy: frame-ancestors 'self';
content-encoding: gzip
x-content-type-options: nosniff
date: Mon, 04 Dec 2023 17:50:53 GMT
strict-transport-security: max-age=31536000; includeSubDomains
content-length: 2356
x-xss-protection: 1; mode=block
referrer-policy: strict-origin-when-cross-origin
last-modified: Wed, 08 Nov 2023 14:26:03 GMT
server: nginx
etag: "1883-609a4ddf5c0f8-gzip"
vary: X-Forwarded-Proto,Accept-Encoding
x-frame-options: sameorigin
content-type: application/javascript
access-control-allow-origin: https://www.group-ib.com
cache-control: private, max-age=3600
permissions-policy: accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=()
accept-ranges: bytes

GET
H2 200 swiper-bundle.min.js Show response
website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/js/ 140 KB
39 KB 341ms
121ms Script
application/javascript 2600:9000:2487:4000:9:7af6:1700:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/js/swiper-bundle.min.js?x18492

Requested by

Host: www.group-ib.com
URL: https://www.group-ib.com/blog/mysterious-team-bangladesh/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2487:4000:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

b624e1e378abe009ef0de69a698b0a3e734af47efcdbd6816d5fcb8fc64c8bfe

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self';
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

content-security-policy: frame-ancestors 'self';
content-encoding: gzip
x-content-type-options: nosniff
date: Mon, 04 Dec 2023 17:50:53 GMT
via: 1.1 a3ffeedc8ed545612c2465ea4fb13fbe.cloudfront.net (CloudFront)
strict-transport-security: max-age=31536000; includeSubDomains
x-amz-cf-pop: LHR61-P3
x-cache: Miss from cloudfront
content-length: 39504
x-xss-protection: 1; mode=block
referrer-policy: strict-origin-when-cross-origin
last-modified: Mon, 05 Sep 2022 07:41:14 GMT
server: nginx
etag: "22ede-5e7e9344df9f2-gzip"
x-frame-options: sameorigin
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: https://www.group-ib.com
cache-control: private, max-age=3600
permissions-policy: accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=()
accept-ranges: bytes
x-amz-cf-id: 3bCzORpWYgDsgSQ8XlMaFpYKnui6ocdX4g1nvtL4KW3kFhDf0Vb3HQ==

GET
H2 200 classic-themes.min.css
website.cdn.group-ib.com/wp-includes/css/ 217 B
956 B 475ms
255ms Stylesheet
text/css 2600:9000:2487:4000:9:7af6:1700:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://website.cdn.group-ib.com/wp-includes/css/classic-themes.min.css?x18492

Requested by

Host: www.group-ib.com
URL: https://www.group-ib.com/blog/mysterious-team-bangladesh/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2487:4000:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

5a5f39391fbf5b06db84b8f9716d53de575ee97a627d2c5f12f79a991a671eb5

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self';
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

content-security-policy: frame-ancestors 'self';
content-encoding: gzip
x-content-type-options: nosniff
date: Mon, 04 Dec 2023 17:50:53 GMT
via: 1.1 a3ffeedc8ed545612c2465ea4fb13fbe.cloudfront.net (CloudFront)
strict-transport-security: max-age=31536000; includeSubDomains
x-amz-cf-pop: LHR61-P3
x-cache: Miss from cloudfront
content-length: 189
x-xss-protection: 1; mode=block
referrer-policy: strict-origin-when-cross-origin
last-modified: Fri, 11 Nov 2022 11:58:50 GMT
server: nginx
etag: "d9-5ed309cf15c82-gzip"
x-frame-options: sameorigin
vary: Accept-Encoding
content-type: text/css
access-control-allow-origin: https://www.group-ib.com
cache-control: private, max-age=3600
permissions-policy: accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=()
accept-ranges: bytes
x-amz-cf-id: Sof8h2hTGBpZmOYDNQiqstA_G_H2Ow7TYJ7ZNXxa_jKbT3BVZKsetA==

GET
H2 200 dashicons.min.css
website.cdn.group-ib.com/wp-includes/css/ 58 KB
36 KB 386ms
165ms Stylesheet
text/css 2600:9000:2487:4000:9:7af6:1700:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://website.cdn.group-ib.com/wp-includes/css/dashicons.min.css?x18492

Requested by

Host: www.group-ib.com
URL: https://www.group-ib.com/blog/mysterious-team-bangladesh/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2487:4000:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

c21e5a2b32c47bc5f9d9efc97bc0e29fd081946d1d3ebffc5621cfafb1d3960e

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self';
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

content-security-policy: frame-ancestors 'self';
content-encoding: gzip
x-content-type-options: nosniff
date: Mon, 04 Dec 2023 17:50:53 GMT
via: 1.1 a3ffeedc8ed545612c2465ea4fb13fbe.cloudfront.net (CloudFront)
strict-transport-security: max-age=31536000; includeSubDomains
x-amz-cf-pop: LHR61-P3
x-cache: Miss from cloudfront
content-length: 35730
x-xss-protection: 1; mode=block
referrer-policy: strict-origin-when-cross-origin
last-modified: Fri, 10 Jun 2022 07:03:36 GMT
server: nginx
etag: "e688-5e112897ec200-gzip"
x-frame-options: sameorigin
vary: Accept-Encoding
content-type: text/css
access-control-allow-origin: https://www.group-ib.com
cache-control: private, max-age=3600
permissions-policy: accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=()
accept-ranges: bytes
x-amz-cf-id: 7kWu2xBkjUU_R9-WJ_0DlhNWYCGIgJqXbFqrsVXemtTADrMiYV0rBA==

GET
H2 200 frontend.min.css
www.group-ib.com/wp-content/plugins/post-views-counter/css/ 217 B
274 B 49ms
48ms Stylesheet
text/css 3.72.181.255
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.group-ib.com/wp-content/plugins/post-views-counter/css/frontend.min.css?x18492

Requested by

Host: www.group-ib.com
URL: https://www.group-ib.com/blog/mysterious-team-bangladesh/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.72.181.255 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-72-181-255.eu-central-1.compute.amazonaws.com

Software

nginx /

Resource Hash

cc2a604a1e6f73444e8db5d749a64c62899943e68ad07feeee39050b4fdb32cb

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self';
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.group-ib.com/blog/mysterious-team-bangladesh/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

content-security-policy: frame-ancestors 'self';
content-encoding: gzip
x-content-type-options: nosniff
date: Mon, 04 Dec 2023 17:50:53 GMT
strict-transport-security: max-age=31536000; includeSubDomains
content-length: 158
x-xss-protection: 1; mode=block
referrer-policy: strict-origin-when-cross-origin
last-modified: Mon, 30 Oct 2023 14:47:57 GMT
server: nginx
etag: "d9-608f01fb0af1e-gzip"
vary: X-Forwarded-Proto,Accept-Encoding
x-frame-options: sameorigin
content-type: text/css
access-control-allow-origin: https://www.group-ib.com
cache-control: private, max-age=3600
permissions-policy: accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=()
accept-ranges: bytes

GET
H2 200 jquery.min.js Show response
website.cdn.group-ib.com/wp-includes/js/jquery/ 88 KB
31 KB 386ms
166ms Script
application/javascript 2600:9000:2487:4000:9:7af6:1700:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://website.cdn.group-ib.com/wp-includes/js/jquery/jquery.min.js?x18492

Requested by

Host: www.group-ib.com
URL: https://www.group-ib.com/blog/mysterious-team-bangladesh/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2487:4000:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

cc7403bab52ed166e24ea9324241045af370be482f5b594468f4a6ac6e7e7981

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self';
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

content-security-policy: frame-ancestors 'self';
content-encoding: gzip
x-content-type-options: nosniff
date: Mon, 04 Dec 2023 17:50:53 GMT
via: 1.1 a3ffeedc8ed545612c2465ea4fb13fbe.cloudfront.net (CloudFront)
strict-transport-security: max-age=31536000; includeSubDomains
x-amz-cf-pop: LHR61-P3
x-cache: Miss from cloudfront
content-length: 30995
x-xss-protection: 1; mode=block
referrer-policy: strict-origin-when-cross-origin
last-modified: Fri, 11 Nov 2022 11:58:50 GMT
server: nginx
etag: "15e54-5ed309cf21802-gzip"
x-frame-options: sameorigin
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: https://www.group-ib.com
cache-control: private, max-age=3600
permissions-policy: accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=()
accept-ranges: bytes
x-amz-cf-id: 2w6nlTJYawBnnpgZkPRMO50Yxb18PWDIJOBkkHXDVebiEhGAncYwqw==

GET
H2 200 single-blog-post.css
website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/ 275 KB
39 KB 506ms
286ms Stylesheet
text/css 2600:9000:2487:4000:9:7af6:1700:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-blog-post.css?x18492

Requested by

Host: www.group-ib.com
URL: https://www.group-ib.com/blog/mysterious-team-bangladesh/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2487:4000:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

5f35bb1f4e0fc7973cc41739788026b73188f412019fed3f200c5c45f1692ec7

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self';
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

content-security-policy: frame-ancestors 'self';
content-encoding: gzip
x-content-type-options: nosniff
date: Mon, 04 Dec 2023 17:50:53 GMT
via: 1.1 a3ffeedc8ed545612c2465ea4fb13fbe.cloudfront.net (CloudFront)
strict-transport-security: max-age=31536000; includeSubDomains
x-amz-cf-pop: LHR61-P3
x-cache: Miss from cloudfront
content-length: 39311
x-xss-protection: 1; mode=block
referrer-policy: strict-origin-when-cross-origin
last-modified: Mon, 04 Dec 2023 17:48:54 GMT
server: nginx
etag: "44a89-60bb2bb44686a-gzip"
x-frame-options: sameorigin
vary: Accept-Encoding
content-type: text/css
access-control-allow-origin: https://www.group-ib.com
cache-control: private, max-age=3600
permissions-policy: accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=()
accept-ranges: bytes
x-amz-cf-id: zTg9BDF9gxqIpBMy6SmGSu8q92ZK0TZ0fwJ5DroyX1VbbePZMhjAfA==

GET
H2 200 v2.js Show response
js-eu1.hsforms.net/forms/ 560 KB
179 KB 202ms
103ms Script
application/javascript 172.65.255.172
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://js-eu1.hsforms.net/forms/v2.js?x18492

Requested by

Host: www.group-ib.com
URL: https://www.group-ib.com/blog/mysterious-team-bangladesh/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.65.255.172 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

30830f557fdc6a64c686abee404481eebe0d174d0884ac8b14d9d6dfbb8ec91e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

content-encoding: br
x-evy-trace-route-service-name: envoyset-translator
x-amz-server-side-encryption: AES256
content-security-policy-report-only: frame-ancestors 'self'; report-uri https://send.hsbrowserreports.com/csp/report?resource=forms-embed/static-1.4186/bundles/project-v2.js&cfRay=82d3e68cad142675-WAW
x-amz-replication-status: COMPLETED
x-evy-trace-listener: listener_https
etag: W/"4408cec6977683fe4c624d7d832d7039"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
x-evy-trace-virtual-host: all
cache-control: s-maxage=600, max-age=300
x-hs-target-asset: forms-embed/static-1.4186/bundles/project-v2.js
date: Mon, 04 Dec 2023 17:50:53 GMT
x-amz-version-id: u_iKfrwyeMduzB4EqH7hUODQsRTuYJmt
via: 1.1 8e8e6ea60de74421f0058675cbcf9cb0.cloudfront.net (CloudFront)
x-content-type-options: nosniff
cf-cache-status: EXPIRED
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-amz-cf-pop: FRA60-P6
x-hubspot-correlation-id: 4d7e8466-7eb2-4f1c-8d5c-fd8d9a65afae
x-cache: Hit from cloudfront
cache-tag: staticjsapp-forms-embed-v2-web-prod,staticjsapp-prod
x-envoy-upstream-service-time: 3
alt-svc: h3=":443"; ma=86400
x-evy-trace-route-configuration: listener_https/all
x-request-id: 4d7e8466-7eb2-4f1c-8d5c-fd8d9a65afae
last-modified: Thu, 23 Nov 2023 14:18:22 UTC
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=RsEnd8C7Gc9%2FXCthjNq%2FgRKLPTLJ8fU1FEPHFEFZAR0Zzm52fp%2Bj1GxFtTKFraJgHboBJVJLlnpJvsKjmo38rd0OI0dlGUYIvSI%2B5AUO8f3%2FpuABvrsaisrfshSRWIAcdoi7qA%3D%3D"}],"group":"cf-nel","max_age":604800}
x-hs-cache-status: HIT
x-evy-trace-served-by-pod: fra04/app-td/envoy-proxy-7b8bd784bd-l92zw
cf-ray: 8305e4f0c98e58e4-TXL
x-amz-cf-id: RiiqIVtTo1rBfnut-rZYpeq8AUTfYuf2-4crSSRo66s01MsFBqkwsA==

GET
H2 200 image4-2.webp
website.cdn.group-ib.com/wp-content/uploads/ 65 KB
66 KB 474ms
254ms Image
image/webp 2600:9000:2487:4000:9:7af6:1700:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://website.cdn.group-ib.com/wp-content/uploads/image4-2.webp

Requested by

Host: www.group-ib.com
URL: https://www.group-ib.com/blog/mysterious-team-bangladesh/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2487:4000:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

8c8b7b664c258c761c5a5c1784ac1a9ff00396d0d5b34b346eca913f489b64b7

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self';
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

content-security-policy: frame-ancestors 'self';
date: Mon, 04 Dec 2023 17:50:53 GMT
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 a3ffeedc8ed545612c2465ea4fb13fbe.cloudfront.net (CloudFront)
x-amz-cf-pop: LHR61-P3
x-cache: Miss from cloudfront
content-length: 66294
x-xss-protection: 1; mode=block
referrer-policy: strict-origin-when-cross-origin
last-modified: Tue, 01 Aug 2023 11:43:52 GMT
server: nginx
etag: "102f6-601db0faa40e3"
x-frame-options: sameorigin
content-type: image/webp
access-control-allow-origin: https://www.group-ib.com
cache-control: no-cache, private, max-age=3600
permissions-policy: accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=()
accept-ranges: bytes
x-amz-cf-id: R9dVpkurV30Nmudq3-NczzT25a9nAUtqJPTYV9gzfCuYvND2n6CnsA==
expires: Mon, 04 Dec 2023 17:50:52 GMT

GET
H2 200 image8-2.webp
website.cdn.group-ib.com/wp-content/uploads/ 48 KB
49 KB 198ms
198ms Image
image/webp 2600:9000:2487:4000:9:7af6:1700:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://website.cdn.group-ib.com/wp-content/uploads/image8-2.webp

Requested by

Host: www.group-ib.com
URL: https://www.group-ib.com/blog/mysterious-team-bangladesh/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2487:4000:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

df02c5aa47c0a509fe7df969c1d41208d13ae97ba1c3e009693dff207ad8f447

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self';
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

content-security-policy: frame-ancestors 'self';
date: Mon, 04 Dec 2023 17:50:53 GMT
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 a3ffeedc8ed545612c2465ea4fb13fbe.cloudfront.net (CloudFront)
x-amz-cf-pop: LHR61-P3
x-cache: Miss from cloudfront
content-length: 49318
x-xss-protection: 1; mode=block
referrer-policy: strict-origin-when-cross-origin
last-modified: Tue, 01 Aug 2023 11:44:15 GMT
server: nginx
etag: "c0a6-601db1107afd5"
x-frame-options: sameorigin
content-type: image/webp
access-control-allow-origin: https://www.group-ib.com
cache-control: no-cache, private, max-age=3600
permissions-policy: accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=()
accept-ranges: bytes
x-amz-cf-id: spnbPbFAtI9T0LZBrrQ0_uMHbF4w1wEam63EtxQLrfI-3bFt-bAS7g==
expires: Mon, 04 Dec 2023 17:50:52 GMT

GET
H2 200 image17.webp
website.cdn.group-ib.com/wp-content/uploads/ 16 KB
17 KB 209ms
207ms Image
image/webp 2600:9000:2487:4000:9:7af6:1700:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://website.cdn.group-ib.com/wp-content/uploads/image17.webp

Requested by

Host: www.group-ib.com
URL: https://www.group-ib.com/blog/mysterious-team-bangladesh/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2487:4000:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

8fff8b978d9d60df3ff3d0ec43f85146cf783cc24dbd1797bed8f1c276e4223a

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self';
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

content-security-policy: frame-ancestors 'self';
date: Mon, 04 Dec 2023 17:50:54 GMT
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 a3ffeedc8ed545612c2465ea4fb13fbe.cloudfront.net (CloudFront)
x-amz-cf-pop: LHR61-P3
x-cache: Miss from cloudfront
content-length: 16862
x-xss-protection: 1; mode=block
referrer-policy: strict-origin-when-cross-origin
last-modified: Tue, 01 Aug 2023 11:42:25 GMT
server: nginx
etag: "41de-601db0a814dc7"
x-frame-options: sameorigin
content-type: image/webp
access-control-allow-origin: https://www.group-ib.com
cache-control: no-cache, private, max-age=3600
permissions-policy: accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=()
accept-ranges: bytes
x-amz-cf-id: 1PBIuy3KtE1fPGmlvLnWuOjIP6YYkW5KSTrEqMAVfklUHZyOE84Izw==
expires: Mon, 04 Dec 2023 17:50:53 GMT

GET
H2 200 image21-1.webp
website.cdn.group-ib.com/wp-content/uploads/ 12 KB
13 KB 114ms
112ms Image
image/webp 2600:9000:2487:4000:9:7af6:1700:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://website.cdn.group-ib.com/wp-content/uploads/image21-1.webp

Requested by

Host: www.group-ib.com
URL: https://www.group-ib.com/blog/mysterious-team-bangladesh/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2487:4000:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

96368853b51da6b74ecf4891933f261eda9a682bf1b19f14486729c1eaebb7f0

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self';
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

content-security-policy: frame-ancestors 'self';
date: Mon, 04 Dec 2023 17:50:54 GMT
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 a3ffeedc8ed545612c2465ea4fb13fbe.cloudfront.net (CloudFront)
x-amz-cf-pop: LHR61-P3
x-cache: Miss from cloudfront
content-length: 12208
x-xss-protection: 1; mode=block
referrer-policy: strict-origin-when-cross-origin
last-modified: Tue, 01 Aug 2023 11:42:49 GMT
server: nginx
etag: "2fb0-601db0be43afe"
x-frame-options: sameorigin
content-type: image/webp
access-control-allow-origin: https://www.group-ib.com
cache-control: no-cache, private, max-age=3600
permissions-policy: accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=()
accept-ranges: bytes
x-amz-cf-id: gc_dr6rCOxbP5ZevIKfbDr98So5DDkuzrJy5BGvPDJc-8DmCJL9hNA==
expires: Mon, 04 Dec 2023 17:50:53 GMT

GET
H2 200 image19-1-e1690891183670.webp
website.cdn.group-ib.com/wp-content/uploads/ 12 KB
12 KB 110ms
108ms Image
image/webp 2600:9000:2487:4000:9:7af6:1700:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://website.cdn.group-ib.com/wp-content/uploads/image19-1-e1690891183670.webp

Requested by

Host: www.group-ib.com
URL: https://www.group-ib.com/blog/mysterious-team-bangladesh/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2487:4000:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

00d13c8807288c2692bc56236b98893a0744399a724fc005fe93cfb32f0b871b

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self';
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

content-security-policy: frame-ancestors 'self';
date: Mon, 04 Dec 2023 17:50:53 GMT
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 a3ffeedc8ed545612c2465ea4fb13fbe.cloudfront.net (CloudFront)
x-amz-cf-pop: LHR61-P3
x-cache: Miss from cloudfront
content-length: 11964
x-xss-protection: 1; mode=block
referrer-policy: strict-origin-when-cross-origin
last-modified: Tue, 01 Aug 2023 11:59:43 GMT
server: nginx
etag: "2ebc-601db485cc50f"
x-frame-options: sameorigin
content-type: image/webp
access-control-allow-origin: https://www.group-ib.com
cache-control: no-cache, private, max-age=3600
permissions-policy: accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=()
accept-ranges: bytes
x-amz-cf-id: mpFienHu7RueaZbzg_rOPqJZv51VGhAnHCf1GbaDGL4LKjAsiz8GPw==
expires: Mon, 04 Dec 2023 17:50:52 GMT

GET
H2 200 image28.webp
website.cdn.group-ib.com/wp-content/uploads/ 18 KB
18 KB 151ms
150ms Image
image/webp 2600:9000:2487:4000:9:7af6:1700:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://website.cdn.group-ib.com/wp-content/uploads/image28.webp

Requested by

Host: www.group-ib.com
URL: https://www.group-ib.com/blog/mysterious-team-bangladesh/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2487:4000:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

f0898f4b2195e614d43d308d8ae23875e2703f8a746b2564dabf36752f4d1e02

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self';
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

content-security-policy: frame-ancestors 'self';
date: Mon, 04 Dec 2023 17:50:54 GMT
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 a3ffeedc8ed545612c2465ea4fb13fbe.cloudfront.net (CloudFront)
x-amz-cf-pop: LHR61-P3
x-cache: Miss from cloudfront
content-length: 18016
x-xss-protection: 1; mode=block
referrer-policy: strict-origin-when-cross-origin
last-modified: Tue, 01 Aug 2023 11:43:29 GMT
server: nginx
etag: "4660-601db0e44c367"
x-frame-options: sameorigin
content-type: image/webp
access-control-allow-origin: https://www.group-ib.com
cache-control: no-cache, private, max-age=3600
permissions-policy: accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=()
accept-ranges: bytes
x-amz-cf-id: TFFWhkCsYcJ6HwscSaVMR_5jGjTk8bHgCAwwSbDVm519rsZvEKgldw==
expires: Mon, 04 Dec 2023 17:50:53 GMT

GET
H2 200 image13-2.webp
website.cdn.group-ib.com/wp-content/uploads/ 24 KB
25 KB 100ms
99ms Image
image/webp 2600:9000:2487:4000:9:7af6:1700:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://website.cdn.group-ib.com/wp-content/uploads/image13-2.webp

Requested by

Host: www.group-ib.com
URL: https://www.group-ib.com/blog/mysterious-team-bangladesh/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2487:4000:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

47e3192c90563ef33fef195245191abd056342cd9f08f70716cbb1669eeb811c

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self';
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

content-security-policy: frame-ancestors 'self';
date: Mon, 04 Dec 2023 17:50:53 GMT
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 a3ffeedc8ed545612c2465ea4fb13fbe.cloudfront.net (CloudFront)
x-amz-cf-pop: LHR61-P3
x-cache: Miss from cloudfront
content-length: 24464
x-xss-protection: 1; mode=block
referrer-policy: strict-origin-when-cross-origin
last-modified: Tue, 01 Aug 2023 11:42:03 GMT
server: nginx
etag: "5f90-601db092f3924"
x-frame-options: sameorigin
content-type: image/webp
access-control-allow-origin: https://www.group-ib.com
cache-control: no-cache, private, max-age=3600
permissions-policy: accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=()
accept-ranges: bytes
x-amz-cf-id: oQUvT_vi_-HDPQZFfupqvtEMZTTpH5viMdfdfjzwE7CO04DtnpwwUA==
expires: Mon, 04 Dec 2023 17:50:52 GMT

GET
H2 200 image6-3.webp
website.cdn.group-ib.com/wp-content/uploads/ 17 KB
18 KB 165ms
165ms Image
image/webp 2600:9000:2487:4000:9:7af6:1700:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://website.cdn.group-ib.com/wp-content/uploads/image6-3.webp

Requested by

Host: www.group-ib.com
URL: https://www.group-ib.com/blog/mysterious-team-bangladesh/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2487:4000:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

6dc2f225059a4c3de1118e821d95f90427737f19f31f44b61300c61430c951d5

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self';
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

content-security-policy: frame-ancestors 'self';
date: Mon, 04 Dec 2023 17:50:54 GMT
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 a3ffeedc8ed545612c2465ea4fb13fbe.cloudfront.net (CloudFront)
x-amz-cf-pop: LHR61-P3
x-cache: Miss from cloudfront
content-length: 17526
x-xss-protection: 1; mode=block
referrer-policy: strict-origin-when-cross-origin
last-modified: Tue, 01 Aug 2023 11:44:04 GMT
server: nginx
etag: "4476-601db105c5b91"
x-frame-options: sameorigin
content-type: image/webp
access-control-allow-origin: https://www.group-ib.com
cache-control: no-cache, private, max-age=3600
permissions-policy: accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=()
accept-ranges: bytes
x-amz-cf-id: hpWjSJmrjSi_RakLO-O_ys2CfC8YPP3lBKOXuLaXbRPiDQG8ubICLQ==
expires: Mon, 04 Dec 2023 17:50:53 GMT

GET
H2 200 main.js Show response
website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/js/ 212 KB
46 KB 87ms
87ms Script
application/javascript 2600:9000:2487:4000:9:7af6:1700:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/js/main.js?x18492

Requested by

Host: www.group-ib.com
URL: https://www.group-ib.com/blog/mysterious-team-bangladesh/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2487:4000:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

620418e15bd4302ca68fe0c806a6a6e74a11a7cbc56004a3e052529b73092e9b

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self';
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

content-security-policy: frame-ancestors 'self';
content-encoding: gzip
x-content-type-options: nosniff
date: Mon, 04 Dec 2023 17:50:53 GMT
via: 1.1 a3ffeedc8ed545612c2465ea4fb13fbe.cloudfront.net (CloudFront)
strict-transport-security: max-age=31536000; includeSubDomains
x-amz-cf-pop: LHR61-P3
x-cache: Miss from cloudfront
content-length: 45892
x-xss-protection: 1; mode=block
referrer-policy: strict-origin-when-cross-origin
last-modified: Fri, 06 Oct 2023 11:14:14 GMT
server: nginx
etag: "34e47-6070a5733757d-gzip"
x-frame-options: sameorigin
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: https://www.group-ib.com
cache-control: private, max-age=3600
permissions-policy: accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=()
accept-ranges: bytes
x-amz-cf-id: fOjGX8nB8JAr0w6mi6dP7_r_g8uNHXSDLL1OUYSObtwNsvH3LzQ7dg==

GET
H2 200 fancybox.umd.js Show response
website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/libs/fancybox/ 103 KB
30 KB 192ms
190ms Script
application/javascript 2600:9000:2487:4000:9:7af6:1700:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/libs/fancybox/fancybox.umd.js?x18492

Requested by

Host: www.group-ib.com
URL: https://www.group-ib.com/blog/mysterious-team-bangladesh/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2487:4000:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

942e02acf640c0308f65e057a8afaed63dfaf995034cda9cfc75532a1009ec72

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self';
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

content-security-policy: frame-ancestors 'self';
content-encoding: gzip
x-content-type-options: nosniff
date: Mon, 04 Dec 2023 17:50:54 GMT
via: 1.1 a3ffeedc8ed545612c2465ea4fb13fbe.cloudfront.net (CloudFront)
strict-transport-security: max-age=31536000; includeSubDomains
x-amz-cf-pop: LHR61-P3
x-cache: Miss from cloudfront
content-length: 29634
x-xss-protection: 1; mode=block
referrer-policy: strict-origin-when-cross-origin
last-modified: Mon, 05 Sep 2022 07:24:28 GMT
server: nginx
etag: "19ca6-5e7e8f85cb376-gzip"
x-frame-options: sameorigin
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: https://www.group-ib.com
cache-control: private, max-age=3600
permissions-policy: accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=()
accept-ranges: bytes
x-amz-cf-id: jMvImYMWa4wHCeSMIQVAbatsLLyNdoADXcIM5IqctDc7WpesXqbCig==

GET
H2 200 frontend.min.js Show response
www.group-ib.com/wp-content/plugins/post-views-counter-pro/js/ 3 KB
1 KB 48ms
47ms Script
application/javascript 3.72.181.255
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.group-ib.com/wp-content/plugins/post-views-counter-pro/js/frontend.min.js?x18492

Requested by

Host: www.group-ib.com
URL: https://www.group-ib.com/blog/mysterious-team-bangladesh/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.72.181.255 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-72-181-255.eu-central-1.compute.amazonaws.com

Software

nginx /

Resource Hash

c75ce78367d99e641567420678abf3731c7bd570cdaa84457d6eebc47f00d76c

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self';
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.group-ib.com/blog/mysterious-team-bangladesh/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

content-security-policy: frame-ancestors 'self';
content-encoding: gzip
x-content-type-options: nosniff
date: Mon, 04 Dec 2023 17:50:53 GMT
strict-transport-security: max-age=31536000; includeSubDomains
content-length: 1338
x-xss-protection: 1; mode=block
referrer-policy: strict-origin-when-cross-origin
last-modified: Tue, 31 Oct 2023 13:34:29 GMT
server: nginx
etag: "ae8-6090336cbb5a7-gzip"
vary: X-Forwarded-Proto,Accept-Encoding
x-frame-options: sameorigin
content-type: application/javascript
access-control-allow-origin: https://www.group-ib.com
cache-control: private, max-age=3600
permissions-policy: accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=()
accept-ranges: bytes

GET
H2 200 25755956.js Show response
js-eu1.hs-scripts.com/ 2 KB
1 KB 229ms
150ms Script
application/javascript 172.65.208.22
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://js-eu1.hs-scripts.com/25755956.js?x18492

Requested by

Host: www.group-ib.com
URL: https://www.group-ib.com/blog/mysterious-team-bangladesh/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.65.208.22 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0c4056a2669d5cd532e6e904e2c46452a38844d259f6565ae91a9315bdb94229

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 17:50:54 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: EXPIRED
x-evy-trace-route-service-name: envoyset-translator
x-hubspot-correlation-id: 6c261fa5-2930-46bc-bdf0-2025327259d0
x-envoy-upstream-service-time: 18
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: 6c261fa5-2930-46bc-bdf0-2025327259d0
last-modified: Mon, 04 Dec 2023 17:22:06 GMT
server: cloudflare
x-trace: 2B8A041ED6DA1CEBCB779B123F36FF64384A415FF7000000000000000000
vary: origin, Accept-Encoding
access-control-max-age: 3600
content-type: application/javascript;charset=utf-8
access-control-allow-origin: https://www.group-ib.com
x-evy-trace-virtual-host: all
cache-control: public, max-age=30
access-control-allow-credentials: true
x-evy-trace-served-by-pod: fra04/hubapi-td/envoy-proxy-75bd7484f7-qjn96
cf-ray: 8305e4f3bb1d2685-TXL

GET
DATA 200
OK truncated
/ 489 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 2d619b14c6524d5cbcad2673c8041f6eb5ef8ebe893526542d58528e8246e195

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 4 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: befef8a5a15a38f99844ae6a725e5c17903ea089796293e12b83b85cfc476a85

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 idgib-w-61354c22-16cc-40a8-a871-6901f1a76e24 Show response
www.group-ib.com/api/fl/ 217 B
607 B 46ms
46ms XHR
application/json 3.72.181.255
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://www.group-ib.com/api/fl/idgib-w-61354c22-16cc-40a8-a871-6901f1a76e24
Requested by: Host: fhp-de-js.group-ib.com
URL: https://fhp-de-js.group-ib.com/d/bt-autoinject.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.72.181.255 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-72-181-255.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: d2db3491183b7f753f2a731fbd662fd7ac8e1fd7376d734c1cddaae0ea7df0a2

Request headers

X-GIB-GSSCgib-w-61354c22-16cc-40a8-a871-6901f1a76e24: sxsI3tU+aBRp197QqKkn36zIuMiLlU5uM3+dep24LxE8Jh38uUb9LN5xIKHFN0SWEQ3ljslFywQGsCwPyXlu20z9j4yRmrYXFpFw1WCf9kNjeTd86auGCaKAV7sKVrc8AjuLsETzM4sWbdePNDEX0BANLuCA3jRjj4iEDIUjYApxD4XXGiTd+zj+7/N+F1Pp7PtEEP866TPCJFOU91Sgfd3Hqvd/eJ+LXrbXzWCEm9x4ltsP0BEUVT5iVMxhSpzhbQ==
Referer: https://www.group-ib.com/blog/mysterious-team-bangladesh/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
X-GIB-FGSSCgib-w-61354c22-16cc-40a8-a871-6901f1a76e24: ZkZCb79d2f49469688154c6a797991214b435240
x-cfids: 1g2HkmwimHJsN8FA48/PLmgNpWZJ6EclkiUuG6Tqs3UYLpVX+EBGxdinowf0PAMJwuOnCi/Eq2S/lwT1Gv1ZOXjL8J0QBaNcD31e9MTzxV8J22XeSpMaxwvpDPMW22k0ZR39VGaF7wB7yFIeUUSsgqSgnm54DQSwzqjv

Response headers

date: Mon, 04 Dec 2023 17:50:53 GMT
content-encoding: gzip
server: nginx
etag: W/"gWbxlrLDMmBymE94zP/4WgS7CpNy6cvHwYiz13qqviR6V42ky1L62Ma3imrd2ApNEcWa3eQ9KnxmiJAdu6e6Mw+Jlpa+Lw5RrNM25W6nu5t3jOz4Pmt3A5JENoesWvIjynaHm/2dLJHZLAKiqBGRnlashT5J67qwXVgJ"
vary: Accept-Encoding
content-type: application/json; charset=utf-8
cache-control: no-cache
x-envoy-upstream-service-time: 0

GET
H2 200 G-font-Medium.otf
website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/fonts/G-font/ 60 KB
35 KB 155ms
66ms Font
font/otf 2600:9000:2487:4000:9:7af6:1700:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/fonts/G-font/G-font-Medium.otf

Requested by

Host: website.cdn.group-ib.com
URL: https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-blog-post.css?x18492

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2487:4000:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

1efe16c9efbadde5e242d88a315eca3906a55669fcd4882a904fbc723306a4e4

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self';
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

Referer: https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-blog-post.css?x18492
Origin: https://www.group-ib.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

content-security-policy: frame-ancestors 'self';
date: Mon, 04 Dec 2023 17:50:54 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 849d578ca949358328a9c41e066f78ac.cloudfront.net (CloudFront)
x-content-type-options: nosniff
x-amz-cf-pop: LHR61-P3
x-cache: Miss from cloudfront
x-xss-protection: 1; mode=block
referrer-policy: strict-origin-when-cross-origin
last-modified: Mon, 27 Nov 2023 11:44:59 GMT
server: nginx
etag: W/"eed4-60b20d4ef6694"
x-frame-options: sameorigin
vary: Accept-Encoding
content-type: font/otf
access-control-allow-origin: https://www.group-ib.com
cache-control: private, max-age=3600
permissions-policy: accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=()
x-amz-cf-id: mErgE6NkkiOwtHlPAdA6noT2zIAEPNuSKtclO2u_1RXfV32Pq2YhnQ==

GET
H2 200 G-font-Regular.otf
website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/fonts/G-font/ 47 KB
30 KB 199ms
110ms Font
font/otf 2600:9000:2487:4000:9:7af6:1700:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/fonts/G-font/G-font-Regular.otf

Requested by

Host: website.cdn.group-ib.com
URL: https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-blog-post.css?x18492

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2487:4000:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

6cee0fb06339ba13e1f15d044e0e4904bbeeb7fbe4351e3f102b6d80b2465061

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self';
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

Referer: https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-blog-post.css?x18492
Origin: https://www.group-ib.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

content-security-policy: frame-ancestors 'self';
date: Mon, 04 Dec 2023 17:50:54 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 849d578ca949358328a9c41e066f78ac.cloudfront.net (CloudFront)
x-content-type-options: nosniff
x-amz-cf-pop: LHR61-P3
x-cache: Miss from cloudfront
x-xss-protection: 1; mode=block
referrer-policy: strict-origin-when-cross-origin
last-modified: Mon, 27 Nov 2023 11:44:59 GMT
server: nginx
etag: W/"bbf8-60b20d4ef6694"
x-frame-options: sameorigin
vary: Accept-Encoding
content-type: font/otf
access-control-allow-origin: https://www.group-ib.com
cache-control: private, max-age=3600
permissions-policy: accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=()
x-amz-cf-id: fvigKy1I78-jDY15yb3iyk591owByGGzo4MtGrX0-VZhMgzkObl5Tw==

GET
H/1.1 200
OK json Show response
forms-eu1.hsforms.com/embed/v3/form/25755956/044e7558-8073-478a-ad3c-5807dd76840f/ 9 KB
3 KB 173ms
93ms XHR
application/json 172.65.232.43
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://forms-eu1.hsforms.com/embed/v3/form/25755956/044e7558-8073-478a-ad3c-5807dd76840f/json?hs_static_app=forms-embed&hs_static_app_version=1.4186&X-HubSpot-Static-App-Info=forms-embed-1.4186

Requested by

Host: fhp-de-js.group-ib.com
URL: https://fhp-de-js.group-ib.com/d/bt-autoinject.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

172.65.232.43 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

dff2f83a4ddce2feedb348da5cb714cfeba192924120b7beab2d393b762dfbe8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept: application/json, text/plain, */*
Referer: https://www.group-ib.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

X-Origin-Hublet: eu1
Date: Mon, 04 Dec 2023 17:50:54 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
X-Content-Type-Options: nosniff
CF-Cache-Status: DYNAMIC
Content-Encoding: br
x-evy-trace-route-service-name: envoyset-translator
X-HubSpot-Correlation-Id: 3092af6f-8c38-46aa-b408-a3a72aa57588
Transfer-Encoding: chunked
x-envoy-upstream-service-time: 18
Connection: keep-alive
alt-svc: h3=":443"; ma=86400
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: 3092af6f-8c38-46aa-b408-a3a72aa57588
Server: cloudflare
X-Trace: 2B81399786A2CA89BDF8105173F98767FD02F40D0A000000000000000000
Vary: origin
Access-Control-Allow-Methods: OPTIONS, GET
Content-Type: application/json;charset=utf-8
Access-Control-Allow-Origin: https://www.group-ib.com
x-evy-trace-virtual-host: all
Access-Control-Expose-Headers: X-Origin-Hublet
Access-Control-Max-Age: 180
Access-Control-Allow-Credentials: false
Cache-Control: max-age=0, no-cache, no-store
X-Robots-Tag: none
Access-Control-Allow-Headers: *
CF-RAY: 8305e4f45c8faca4-TXL
x-evy-trace-served-by-pod: fra04/star-hubspot-td/envoy-proxy-7b5f5fb655-w5lj6

GET
H2 200 cross.svg
website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/main-nav/ 342 B
981 B 79ms
77ms Image
image/svg+xml 2600:9000:2487:4000:9:7af6:1700:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/main-nav/cross.svg

Requested by

Host: website.cdn.group-ib.com
URL: https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-blog-post.css?x18492

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2487:4000:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

dfb059f8aa219769088fd6c85d85aae789f1e72bfe3d314748f1f3ccfffffb1c

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self';
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-blog-post.css?x18492
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

content-security-policy: frame-ancestors 'self';
content-encoding: gzip
x-content-type-options: nosniff
date: Mon, 04 Dec 2023 17:50:54 GMT
via: 1.1 a3ffeedc8ed545612c2465ea4fb13fbe.cloudfront.net (CloudFront)
strict-transport-security: max-age=31536000; includeSubDomains
x-amz-cf-pop: LHR61-P3
x-cache: Miss from cloudfront
content-length: 207
x-xss-protection: 1; mode=block
referrer-policy: strict-origin-when-cross-origin
last-modified: Tue, 28 Jun 2022 07:55:26 GMT
server: nginx
etag: "156-5e27d5c025780-gzip"
x-frame-options: sameorigin
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: https://www.group-ib.com
cache-control: private, max-age=3600
permissions-policy: accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=()
accept-ranges: bytes
x-amz-cf-id: XHFtsDQ2R15890XHl1vvT82xZOzPQhXMvB_QKVBNXkydk3nBF5IozQ==

GET
H/1.1 200
OK json Show response
forms-eu1.hsforms.com/embed/v3/form/25755956/4dbceae1-75ae-423a-9c12-dee8f1ca3345/ 112 KB
30 KB 185ms
122ms XHR
application/json 172.65.232.43
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://forms-eu1.hsforms.com/embed/v3/form/25755956/4dbceae1-75ae-423a-9c12-dee8f1ca3345/json?hs_static_app=forms-embed&hs_static_app_version=1.4186&X-HubSpot-Static-App-Info=forms-embed-1.4186

Requested by

Host: fhp-de-js.group-ib.com
URL: https://fhp-de-js.group-ib.com/d/bt-autoinject.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

172.65.232.43 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ca4c33d7f44a36a0924572e19d6ba0fab648b9fa185bcdf0320e876e87e277dc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept: application/json, text/plain, */*
Referer: https://www.group-ib.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

X-Origin-Hublet: eu1
Date: Mon, 04 Dec 2023 17:50:54 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
X-Content-Type-Options: nosniff
CF-Cache-Status: DYNAMIC
Content-Encoding: br
x-evy-trace-route-service-name: envoyset-translator
X-HubSpot-Correlation-Id: 18ca6d62-d5ee-4798-8f3f-5d0a8ae0dbcc
Transfer-Encoding: chunked
x-envoy-upstream-service-time: 29
Connection: keep-alive
alt-svc: h3=":443"; ma=86400
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: 18ca6d62-d5ee-4798-8f3f-5d0a8ae0dbcc
Server: cloudflare
X-Trace: 2B4BAA29444B57C89EDE42CD3C7025FB9E6296B6D0000000000000000000
Vary: origin
Access-Control-Allow-Methods: OPTIONS, GET
Content-Type: application/json;charset=utf-8
Access-Control-Allow-Origin: https://www.group-ib.com
x-evy-trace-virtual-host: all
Access-Control-Expose-Headers: X-Origin-Hublet
Access-Control-Max-Age: 180
Access-Control-Allow-Credentials: false
Cache-Control: max-age=0, no-cache, no-store
X-Robots-Tag: none
Access-Control-Allow-Headers: *
CF-RAY: 8305e4f45e7e58de-TXL
x-evy-trace-served-by-pod: fra04/star-hubspot-td/envoy-proxy-7b5f5fb655-hfvq9

GET
H/1.1 200
OK json Show response
forms-eu1.hsforms.com/embed/v3/form/25755956/5a995f05-701c-48e3-b25a-d1548ba3c0b3/ 105 KB
29 KB 176ms
107ms XHR
application/json 172.65.232.43
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://forms-eu1.hsforms.com/embed/v3/form/25755956/5a995f05-701c-48e3-b25a-d1548ba3c0b3/json?hs_static_app=forms-embed&hs_static_app_version=1.4186&X-HubSpot-Static-App-Info=forms-embed-1.4186

Requested by

Host: fhp-de-js.group-ib.com
URL: https://fhp-de-js.group-ib.com/d/bt-autoinject.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

172.65.232.43 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

53b07966bbc49b19a64977259e275e0d85766865dc21e8bdc3ad1fe2c6c22f2f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept: application/json, text/plain, */*
Referer: https://www.group-ib.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

X-Origin-Hublet: eu1
Date: Mon, 04 Dec 2023 17:50:54 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
X-Content-Type-Options: nosniff
CF-Cache-Status: DYNAMIC
Content-Encoding: br
x-evy-trace-route-service-name: envoyset-translator
X-HubSpot-Correlation-Id: 472af712-033b-4a8f-a5ae-27384b687107
Transfer-Encoding: chunked
x-envoy-upstream-service-time: 36
Connection: keep-alive
alt-svc: h3=":443"; ma=86400
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: 472af712-033b-4a8f-a5ae-27384b687107
Server: cloudflare
X-Trace: 2B63AC8C58CA58000C12EF03B07D5CF19B51581E9F000000000000000000
Vary: origin
Access-Control-Allow-Methods: OPTIONS, GET
Content-Type: application/json;charset=utf-8
Access-Control-Allow-Origin: https://www.group-ib.com
x-evy-trace-virtual-host: all
Access-Control-Expose-Headers: X-Origin-Hublet
Access-Control-Max-Age: 180
Access-Control-Allow-Credentials: false
Cache-Control: max-age=0, no-cache, no-store
X-Robots-Tag: none
Access-Control-Allow-Headers: *
CF-RAY: 8305e4f46870aca9-TXL
x-evy-trace-served-by-pod: fra04/star-hubspot-td/envoy-proxy-7b5f5fb655-vx2fr

GET
DATA 200
OK truncated
/ 64 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 01caf20e667c8e300960582162f912d9405e9895c32cff1a9ee95511fd509a2c

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 69 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 81cc2a3a0c0b6e8335f5f3143390b8b6f036dc573e73d3f4b5742482f0bdca73

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 68 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: d4357e3108552252e742cec0e5da24814f9d62d6b37a71dc1307b5aec7daa2cf

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 68 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 48baf5d65c15a221cdcd9149090cd58551a785af39c67e25b0952ff8e8e7a891

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 68 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 17475478a6f14ff8a7cf296a2ff4507c254ce064e13a2ec83b8d8670f5ed3f57

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H2 200 dropdown_before.svg
website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/main-nav/ 154 B
921 B 71ms
71ms Image
image/svg+xml 2600:9000:2487:4000:9:7af6:1700:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/main-nav/dropdown_before.svg

Requested by

Host: website.cdn.group-ib.com
URL: https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-blog-post.css?x18492

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2487:4000:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

574ab1a3d7b47add5d43a927f62c87698264f63572acd70b42081dd4a1dc5ced

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self';
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-blog-post.css?x18492
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

content-security-policy: frame-ancestors 'self';
content-encoding: gzip
x-content-type-options: nosniff
date: Mon, 04 Dec 2023 17:50:54 GMT
via: 1.1 a3ffeedc8ed545612c2465ea4fb13fbe.cloudfront.net (CloudFront)
strict-transport-security: max-age=31536000; includeSubDomains
x-amz-cf-pop: LHR61-P3
x-cache: Miss from cloudfront
content-length: 150
x-xss-protection: 1; mode=block
referrer-policy: strict-origin-when-cross-origin
last-modified: Tue, 28 Jun 2022 07:55:26 GMT
server: nginx
etag: "9a-5e27d5c025780-gzip"
x-frame-options: sameorigin
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: https://www.group-ib.com
cache-control: private, max-age=3600
permissions-policy: accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=()
accept-ranges: bytes
x-amz-cf-id: 26yO5QMXfemAiwzGa02GH_iCIGA1eQRrxs6-7TMD5UHilrwke7Nqhw==

GET
H2 200 link-arrow.svg
website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/ 409 B
1 KB 70ms
70ms Image
image/svg+xml 2600:9000:2487:4000:9:7af6:1700:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/link-arrow.svg

Requested by

Host: website.cdn.group-ib.com
URL: https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-blog-post.css?x18492

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2487:4000:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

e91c5731358570d3e4cd684118251d243fc799059648b152403dcd775ceba632

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self';
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-blog-post.css?x18492
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

content-security-policy: frame-ancestors 'self';
content-encoding: gzip
x-content-type-options: nosniff
date: Mon, 04 Dec 2023 17:50:54 GMT
via: 1.1 a3ffeedc8ed545612c2465ea4fb13fbe.cloudfront.net (CloudFront)
strict-transport-security: max-age=31536000; includeSubDomains
x-amz-cf-pop: LHR61-P3
x-cache: Miss from cloudfront
content-length: 267
x-xss-protection: 1; mode=block
referrer-policy: strict-origin-when-cross-origin
last-modified: Tue, 28 Jun 2022 07:55:26 GMT
server: nginx
etag: "199-5e27d5c025780-gzip"
x-frame-options: sameorigin
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: https://www.group-ib.com
cache-control: private, max-age=3600
permissions-policy: accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=()
accept-ranges: bytes
x-amz-cf-id: ubXUjikOk8r69_KNU7XZPV_UtmZGzItif9xZnzrxBXm2dFA3oXG-_A==

GET
H2 200 Close.svg
www.group-ib.com/wp-content/themes/gib-theme/assets/images/ 227 B
309 B 49ms
49ms Image
image/svg+xml 3.72.181.255
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.group-ib.com/wp-content/themes/gib-theme/assets/images/Close.svg

Requested by

Host: website.cdn.group-ib.com
URL: https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-blog-post.css?x18492

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.72.181.255 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-72-181-255.eu-central-1.compute.amazonaws.com

Software

nginx /

Resource Hash

31d1c5bd0cd38e6e6b8eb944944df273044e826c7d3daacbe602caead3068c7a

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self';
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://website.cdn.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

content-security-policy: frame-ancestors 'self';
content-encoding: gzip
x-content-type-options: nosniff
date: Mon, 04 Dec 2023 17:50:54 GMT
strict-transport-security: max-age=31536000; includeSubDomains
content-length: 180
x-xss-protection: 1; mode=block
referrer-policy: strict-origin-when-cross-origin
last-modified: Tue, 29 Nov 2022 12:14:21 GMT
server: nginx
etag: "e3-5ee9aed8bc981-gzip"
vary: Accept-Encoding
x-frame-options: sameorigin
content-type: image/svg+xml
access-control-allow-origin: https://www.group-ib.com
cache-control: private, max-age=3600
permissions-policy: accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=()
accept-ranges: bytes

GET
H2 200 file_copy.svg
www.group-ib.com/wp-content/themes/gib-theme/assets/images/ 668 B
436 B 52ms
52ms Image
image/svg+xml 3.72.181.255
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.group-ib.com/wp-content/themes/gib-theme/assets/images/file_copy.svg

Requested by

Host: website.cdn.group-ib.com
URL: https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-blog-post.css?x18492

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.72.181.255 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-72-181-255.eu-central-1.compute.amazonaws.com

Software

nginx /

Resource Hash

f367bbc4429fc9fb0a93045245aef519a000ab275549645cddecb3f953e0a05f

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self';
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://website.cdn.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

content-security-policy: frame-ancestors 'self';
content-encoding: gzip
x-content-type-options: nosniff
date: Mon, 04 Dec 2023 17:50:54 GMT
strict-transport-security: max-age=31536000; includeSubDomains
content-length: 352
x-xss-protection: 1; mode=block
referrer-policy: strict-origin-when-cross-origin
last-modified: Mon, 28 Nov 2022 13:01:55 GMT
server: nginx
etag: "29c-5ee8779d1a6cb-gzip"
vary: Accept-Encoding
x-frame-options: sameorigin
content-type: image/svg+xml
access-control-allow-origin: https://www.group-ib.com
cache-control: private, max-age=3600
permissions-policy: accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=()
accept-ranges: bytes

GET
H2 200 success.svg
www.group-ib.com/wp-content/themes/gib-theme/assets/images/ 386 B
357 B 53ms
53ms Image
image/svg+xml 3.72.181.255
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.group-ib.com/wp-content/themes/gib-theme/assets/images/success.svg

Requested by

Host: website.cdn.group-ib.com
URL: https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-blog-post.css?x18492

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.72.181.255 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-72-181-255.eu-central-1.compute.amazonaws.com

Software

nginx /

Resource Hash

fa4859289ded4c674dcee233811758743116b1d7ce4e9f0c0e7e259391504c43

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self';
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://website.cdn.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

content-security-policy: frame-ancestors 'self';
content-encoding: gzip
x-content-type-options: nosniff
date: Mon, 04 Dec 2023 17:50:54 GMT
strict-transport-security: max-age=31536000; includeSubDomains
content-length: 254
x-xss-protection: 1; mode=block
referrer-policy: strict-origin-when-cross-origin
last-modified: Tue, 29 Nov 2022 11:07:05 GMT
server: nginx
etag: "182-5ee99fd05f106-gzip"
vary: Accept-Encoding
x-frame-options: sameorigin
content-type: image/svg+xml
access-control-allow-origin: https://www.group-ib.com
cache-control: private, max-age=3600
permissions-policy: accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=()
accept-ranges: bytes

GET
H2 200 list-dot.svg
www.group-ib.com/wp-content/themes/gib-theme/assets/images/ 313 B
288 B 58ms
58ms Image
image/svg+xml 3.72.181.255
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.group-ib.com/wp-content/themes/gib-theme/assets/images/list-dot.svg

Requested by

Host: website.cdn.group-ib.com
URL: https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-blog-post.css?x18492

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.72.181.255 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-72-181-255.eu-central-1.compute.amazonaws.com

Software

nginx /

Resource Hash

6b0775723ccade5ca3170fcc6a321c5b4768a5dc2b7c83b8b8b595407a2f0018

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self';
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://website.cdn.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

content-security-policy: frame-ancestors 'self';
content-encoding: gzip
x-content-type-options: nosniff
date: Mon, 04 Dec 2023 17:50:54 GMT
strict-transport-security: max-age=31536000; includeSubDomains
content-length: 205
x-xss-protection: 1; mode=block
referrer-policy: strict-origin-when-cross-origin
last-modified: Thu, 08 Sep 2022 12:02:57 GMT
server: nginx
etag: "139-5e82935d2238c-gzip"
vary: Accept-Encoding
x-frame-options: sameorigin
content-type: image/svg+xml
access-control-allow-origin: https://www.group-ib.com
cache-control: private, max-age=3600
permissions-policy: accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=()
accept-ranges: bytes

GET
H2 200 Dropdown-right.svg
website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/ 503 B
1 KB 128ms
128ms Image
image/svg+xml 2600:9000:2487:4000:9:7af6:1700:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/Dropdown-right.svg

Requested by

Host: website.cdn.group-ib.com
URL: https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-blog-post.css?x18492

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2487:4000:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

4d4a484a100e469b6e3dcf880a37755086e246cc291bab46e3edd4529e3d5d6a

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self';
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-blog-post.css?x18492
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

content-security-policy: frame-ancestors 'self';
content-encoding: gzip
x-content-type-options: nosniff
date: Mon, 04 Dec 2023 17:50:54 GMT
via: 1.1 a3ffeedc8ed545612c2465ea4fb13fbe.cloudfront.net (CloudFront)
strict-transport-security: max-age=31536000; includeSubDomains
x-amz-cf-pop: LHR61-P3
x-cache: Miss from cloudfront
content-length: 307
x-xss-protection: 1; mode=block
referrer-policy: strict-origin-when-cross-origin
last-modified: Fri, 16 Dec 2022 09:56:36 GMT
server: nginx
etag: "1f7-5efeefc3ee1d1-gzip"
x-frame-options: sameorigin
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: https://www.group-ib.com
cache-control: private, max-age=3600
permissions-policy: accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=()
accept-ranges: bytes
x-amz-cf-id: xToBYWvdPDq_T9Y0onx6QnIxGA6N90q95NJLIv6_FY2pGTsjMSDdig==

GET
H2 200 G-font-Bold.otf
website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/fonts/G-font/ 49 KB
32 KB 176ms
127ms Font
font/otf 2600:9000:2487:4000:9:7af6:1700:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/fonts/G-font/G-font-Bold.otf

Requested by

Host: website.cdn.group-ib.com
URL: https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-blog-post.css?x18492

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2487:4000:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

8d15a221986226efe4f742f390f46f9d5ae8b2008a6edd40e10ff121ef9cca9b

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self';
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

Referer: https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-blog-post.css?x18492
Origin: https://www.group-ib.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

content-security-policy: frame-ancestors 'self';
date: Mon, 04 Dec 2023 17:50:54 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 849d578ca949358328a9c41e066f78ac.cloudfront.net (CloudFront)
x-content-type-options: nosniff
x-amz-cf-pop: LHR61-P3
x-cache: Miss from cloudfront
x-xss-protection: 1; mode=block
referrer-policy: strict-origin-when-cross-origin
last-modified: Mon, 27 Nov 2023 11:44:59 GMT
server: nginx
etag: W/"c320-60b20d4ef6694"
x-frame-options: sameorigin
vary: Accept-Encoding
content-type: font/otf
access-control-allow-origin: https://www.group-ib.com
cache-control: private, max-age=3600
permissions-policy: accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=()
x-amz-cf-id: lamsQ-PxFf4AYrGOCdQhSc2N0UTDmtiXid8ExtrSik2lmcQ-aEfIEg==

GET
DATA 200
OK truncated
/ 68 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: b0bdc2fc526a2fb0150c8d5bb3c13ce44ef44dbb7a8f2812e2859e601cb36353

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 68 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 2317091fa39eb021798470df7544a3c65cad27a26f4097fb84595ea217d6040f

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 68 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 4fb71bac54726b1d6ba366ee11128ba2c43cd9cc61608d49cffb20cd770d1dee

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 69 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 4a3364f1379b22a90bbb962717bf5c2e73f63a219addd359ea38bbab61ecbafc

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 68 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: f69ebc1daa2d65ffb37e5307186bdd49d3c7db42c9f22907d806b5dd23e6adfb

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 70 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 91256c71cebff7c9fa1cc53bfd63fe2357134222ada4b66c4cc3287adb128d38

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 69 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 666538cc669aa83b9921af035741028caa6de399a9cb7283d2c514bdbea2e92c

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 68 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 38a0301e05d7c69fdf4fdf9158f5572e8e5d500a30f63f676b1176738ca0db02

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 69 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 6d1e71087c4c474c09a5e9dcdefaa5a4c3d03bb88bf039961aea3933b47581ee

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 68 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 7c1b4f874eb7f4887530d3061220ac294798671b8ae41d8329984af40edaaecf

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 68 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: c0374631e7bf6589252aea40a9c76b6e85e8e33d063ea0f936249f6086c110f4

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 68 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: f451000610c622d410bcd703921782183ac287271cb9856eb5cd49a714e33703

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 68 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 34e0bb5c5ed1184e6452cf7562faf332af1a26e95e50e035ff0a9f7065e6df9e

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H/1.1 200
OK json Show response
forms-eu1.hsforms.com/embed/v3/form/25755956/55a22738-d5a5-43f9-9c1c-fa4c1a6eb349/ 8 KB
3 KB 154ms
95ms XHR
application/json 172.65.232.43
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://forms-eu1.hsforms.com/embed/v3/form/25755956/55a22738-d5a5-43f9-9c1c-fa4c1a6eb349/json?hs_static_app=forms-embed&hs_static_app_version=1.4186&X-HubSpot-Static-App-Info=forms-embed-1.4186

Requested by

Host: fhp-de-js.group-ib.com
URL: https://fhp-de-js.group-ib.com/d/bt-autoinject.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

172.65.232.43 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

88029c742d2ab5d7f101ef05c78a6d72ee7c0dda17d1edfc2303b23e201e9fcc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept: application/json, text/plain, */*
Referer: https://www.group-ib.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

X-Origin-Hublet: eu1
Date: Mon, 04 Dec 2023 17:50:54 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
X-Content-Type-Options: nosniff
CF-Cache-Status: DYNAMIC
Content-Encoding: br
x-evy-trace-route-service-name: envoyset-translator
X-HubSpot-Correlation-Id: 78ca8c58-03ce-4ace-8a91-8398305b4caf
Transfer-Encoding: chunked
x-envoy-upstream-service-time: 13
Connection: keep-alive
alt-svc: h3=":443"; ma=86400
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: 78ca8c58-03ce-4ace-8a91-8398305b4caf
Server: cloudflare
X-Trace: 2B83323A9A0644FEB2E84967FCC99BBCF1DFFB5ECE000000000000000000
Vary: origin
Access-Control-Allow-Methods: OPTIONS, GET
Content-Type: application/json;charset=utf-8
Access-Control-Allow-Origin: https://www.group-ib.com
x-evy-trace-virtual-host: all
Access-Control-Expose-Headers: X-Origin-Hublet
Access-Control-Max-Age: 180
Access-Control-Allow-Credentials: false
Cache-Control: max-age=0, no-cache, no-store
X-Robots-Tag: none
Access-Control-Allow-Headers: *
CF-RAY: 8305e4f49982aca7-TXL
x-evy-trace-served-by-pod: fra04/star-hubspot-td/envoy-proxy-7b5f5fb655-vx2fr

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 295 KB
93 KB 145ms
58ms Script
application/javascript 2a00:1450:4001:80f::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-PW7265

Requested by

Host: www.group-ib.com
URL: https://www.group-ib.com/blog/mysterious-team-bangladesh/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

28ed7b6ae56298df10f217060a8dafdcd00064e32f66346a3e5ab6917ca22b0a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 17:50:54 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 94832
x-xss-protection: 0
last-modified: Mon, 04 Dec 2023 15:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Mon, 04 Dec 2023 17:50:54 GMT

GET
H2 200 insight.min.js Show response
website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/js/ 8 KB
4 KB 65ms
65ms Script
application/javascript 2600:9000:2487:4000:9:7af6:1700:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/js/insight.min.js?x18492

Requested by

Host: www.group-ib.com
URL: https://www.group-ib.com/blog/mysterious-team-bangladesh/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2487:4000:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

14f2ec002b176e0dee403cb7dd4ef2274a1353080e1e3e4084678770f4c15b9c

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self';
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

content-security-policy: frame-ancestors 'self';
content-encoding: gzip
x-content-type-options: nosniff
date: Mon, 04 Dec 2023 17:50:54 GMT
via: 1.1 a3ffeedc8ed545612c2465ea4fb13fbe.cloudfront.net (CloudFront)
strict-transport-security: max-age=31536000; includeSubDomains
x-amz-cf-pop: LHR61-P3
x-cache: Miss from cloudfront
content-length: 3085
x-xss-protection: 1; mode=block
referrer-policy: strict-origin-when-cross-origin
last-modified: Fri, 15 Jul 2022 14:12:57 GMT
server: nginx
etag: "1e5a-5e3d89d6a8c40-gzip"
x-frame-options: sameorigin
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: https://www.group-ib.com
cache-control: private, max-age=3600
permissions-policy: accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=()
accept-ranges: bytes
x-amz-cf-id: oEhSLowDNQGLl0gyujcOtmI8an7a0Lmb4w7ANPEqJM70WW7Yr54pvw==

GET
H/1.1 200
OK json Show response
forms-eu1.hsforms.com/embed/v3/form/25755956/eb903dab-0ef3-43b5-bdeb-71372e6ad0f0/ 7 KB
3 KB 134ms
85ms XHR
application/json 172.65.232.43
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://forms-eu1.hsforms.com/embed/v3/form/25755956/eb903dab-0ef3-43b5-bdeb-71372e6ad0f0/json?hs_static_app=forms-embed&hs_static_app_version=1.4186&X-HubSpot-Static-App-Info=forms-embed-1.4186

Requested by

Host: fhp-de-js.group-ib.com
URL: https://fhp-de-js.group-ib.com/d/bt-autoinject.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

172.65.232.43 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

3c154eacd32e19affe40478340a9782ade87041dd5ccab6c1ae385180b20e6f3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept: application/json, text/plain, */*
Referer: https://www.group-ib.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

X-Origin-Hublet: eu1
Date: Mon, 04 Dec 2023 17:50:54 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
X-Content-Type-Options: nosniff
CF-Cache-Status: DYNAMIC
Content-Encoding: br
x-evy-trace-route-service-name: envoyset-translator
X-HubSpot-Correlation-Id: 3cc066e1-ffcb-419a-851d-f169fa55ae3f
Transfer-Encoding: chunked
x-envoy-upstream-service-time: 12
Connection: keep-alive
alt-svc: h3=":443"; ma=86400
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: 3cc066e1-ffcb-419a-851d-f169fa55ae3f
Server: cloudflare
X-Trace: 2B7F19184E8EB6F0868E3851489F330F606DEE055C000000000000000000
Vary: origin
Access-Control-Allow-Methods: OPTIONS, GET
Content-Type: application/json;charset=utf-8
Access-Control-Allow-Origin: https://www.group-ib.com
x-evy-trace-virtual-host: all
Access-Control-Expose-Headers: X-Origin-Hublet
Access-Control-Max-Age: 180
Access-Control-Allow-Credentials: false
Cache-Control: max-age=0, no-cache, no-store
X-Robots-Tag: none
Access-Control-Allow-Headers: *
CF-RAY: 8305e4f4ee3eaca4-TXL
x-evy-trace-served-by-pod: fra04/star-hubspot-td/envoy-proxy-7b5f5fb655-6xgzb

GET
H2 200 tag.js Show response
mc.yandex.ru/metrika/ 200 KB
70 KB 309ms
154ms Script
application/javascript 2a02:6b8::1:119
GLOBAL_DC

General

Check archive.org

Show headers Download Go to

Full URL

https://mc.yandex.ru/metrika/tag.js

Requested by

Host: website.cdn.group-ib.com
URL: https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/js/main.js?x18492

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:6b8::1:119 Moscow, Russian Federation, ASN208722 (GLOBAL_DC, FI),

Reverse DNS

Software

Resource Hash

579ff09d0cfe834581eb571dc5c49e854639c28af3c199857914d7cea9ba732b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 17:50:54 GMT
content-encoding: br
strict-transport-security: max-age=31536000
last-modified: Mon, 04 Dec 2023 12:19:38 GMT
accept-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
etag: "656dc3da-1139b"
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=3600
timing-allow-origin: *
content-length: 70555
expires: Mon, 04 Dec 2023 18:50:54 GMT

POST
H2 200 ajax.php Show response
www.group-ib.com/wp-content/plugins/post-views-counter-pro/includes/ 307 B
345 B 81ms
81ms Fetch
text/html 3.72.181.255
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.group-ib.com/wp-content/plugins/post-views-counter-pro/includes/ajax.php

Requested by

Host: fhp-de-js.group-ib.com
URL: https://fhp-de-js.group-ib.com/d/bt-autoinject.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.72.181.255 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-72-181-255.eu-central-1.compute.amazonaws.com

Software

nginx /

Resource Hash

5fddb6a44c754d81312b6a1d27b50b42b46677174b49172c9bef600066b5ca99

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self';
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff, nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.group-ib.com/blog/mysterious-team-bangladesh/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=utf-8

Response headers

content-security-policy: frame-ancestors 'self';
content-encoding: gzip
x-content-type-options: nosniff, nosniff
date: Mon, 04 Dec 2023 17:50:54 GMT
strict-transport-security: max-age=31536000; includeSubDomains
content-length: 237
x-xss-protection: 1; mode=block
referrer-policy: strict-origin-when-cross-origin
server: nginx
vary: X-Forwarded-Proto,Accept-Encoding
x-frame-options: sameorigin
content-type: text/html; charset=UTF-8
access-control-allow-origin: https://www.group-ib.com
cache-control: no-cache, must-revalidate, max-age=0, private, max-age=3600
permissions-policy: accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=()
x-robots-tag: noindex
expires: Wed, 11 Jan 1984 05:00:00 GMT

GET
H2 200 twitter-64.svg
website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/socials/ 1 KB
1 KB 66ms
66ms Image
image/svg+xml 2600:9000:2487:4000:9:7af6:1700:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/socials/twitter-64.svg

Requested by

Host: website.cdn.group-ib.com
URL: https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-blog-post.css?x18492

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2487:4000:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

ae9dad69229703dfa3b6d226c4c7d692e2f2809bf2475f22612824c2f7602efc

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self';
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-blog-post.css?x18492
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

content-security-policy: frame-ancestors 'self';
content-encoding: gzip
x-content-type-options: nosniff
date: Mon, 04 Dec 2023 17:50:54 GMT
via: 1.1 a3ffeedc8ed545612c2465ea4fb13fbe.cloudfront.net (CloudFront)
strict-transport-security: max-age=31536000; includeSubDomains
x-amz-cf-pop: LHR61-P3
x-cache: Miss from cloudfront
content-length: 554
x-xss-protection: 1; mode=block
referrer-policy: strict-origin-when-cross-origin
last-modified: Tue, 29 Nov 2022 07:39:21 GMT
server: nginx
etag: "426-5ee9716179e8a-gzip"
x-frame-options: sameorigin
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: https://www.group-ib.com
cache-control: private, max-age=3600
permissions-policy: accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=()
accept-ranges: bytes
x-amz-cf-id: faNTntiKKSz4iEzDacqn7HTLdfCIpJpcrMa_7Zuv-mGyuv6TDU-bww==

GET
H2 200 twitter-lbg.svg
website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/socials/ 2 KB
1 KB 115ms
115ms Image
image/svg+xml 2600:9000:2487:4000:9:7af6:1700:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/socials/twitter-lbg.svg

Requested by

Host: website.cdn.group-ib.com
URL: https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-blog-post.css?x18492

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2487:4000:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

294fdc878aa8c42b19edc18d385880ad886397846aca640c305f3eb53a965e13

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self';
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-blog-post.css?x18492
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

content-security-policy: frame-ancestors 'self';
content-encoding: gzip
x-content-type-options: nosniff
date: Mon, 04 Dec 2023 17:50:54 GMT
via: 1.1 a3ffeedc8ed545612c2465ea4fb13fbe.cloudfront.net (CloudFront)
strict-transport-security: max-age=31536000; includeSubDomains
x-amz-cf-pop: LHR61-P3
x-cache: Miss from cloudfront
content-length: 742
x-xss-protection: 1; mode=block
referrer-policy: strict-origin-when-cross-origin
last-modified: Tue, 29 Nov 2022 07:39:21 GMT
server: nginx
etag: "8f2-5ee9716179e8a-gzip"
x-frame-options: sameorigin
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: https://www.group-ib.com
cache-control: private, max-age=3600
permissions-policy: accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=()
accept-ranges: bytes
x-amz-cf-id: KpEpK2sMgXlOKlw54-0LbsPCl51J41JTe-FBBEgAjP3sT2tsz6BsYQ==

GET
H2 200 linkedin-64.svg
website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/socials/ 919 B
1 KB 123ms
122ms Image
image/svg+xml 2600:9000:2487:4000:9:7af6:1700:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/socials/linkedin-64.svg

Requested by

Host: website.cdn.group-ib.com
URL: https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-blog-post.css?x18492

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2487:4000:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

f4991587d5312981e74087707ed399bd3820d83f773e7773c013ce00d6835f28

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self';
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-blog-post.css?x18492
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

content-security-policy: frame-ancestors 'self';
content-encoding: gzip
x-content-type-options: nosniff
date: Mon, 04 Dec 2023 17:50:54 GMT
via: 1.1 a3ffeedc8ed545612c2465ea4fb13fbe.cloudfront.net (CloudFront)
strict-transport-security: max-age=31536000; includeSubDomains
x-amz-cf-pop: LHR61-P3
x-cache: Miss from cloudfront
content-length: 470
x-xss-protection: 1; mode=block
referrer-policy: strict-origin-when-cross-origin
last-modified: Tue, 29 Nov 2022 07:39:21 GMT
server: nginx
etag: "397-5ee9716179e8a-gzip"
x-frame-options: sameorigin
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: https://www.group-ib.com
cache-control: private, max-age=3600
permissions-policy: accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=()
accept-ranges: bytes
x-amz-cf-id: uP6yyWqU4oqeKIMAtAnzP0_G4tqZZkiIq5azd7HhfaQaUQHNpScHWw==

GET
H2 200 linkedin-lbg.svg
website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/socials/ 2 KB
1 KB 102ms
102ms Image
image/svg+xml 2600:9000:2487:4000:9:7af6:1700:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/socials/linkedin-lbg.svg

Requested by

Host: website.cdn.group-ib.com
URL: https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-blog-post.css?x18492

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2487:4000:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

c33709a20ca4cd516d65b07a79c1d75445892fcb6d8c6f3871a47ab38d85e075

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self';
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-blog-post.css?x18492
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

content-security-policy: frame-ancestors 'self';
content-encoding: gzip
x-content-type-options: nosniff
date: Mon, 04 Dec 2023 17:50:54 GMT
via: 1.1 a3ffeedc8ed545612c2465ea4fb13fbe.cloudfront.net (CloudFront)
strict-transport-security: max-age=31536000; includeSubDomains
x-amz-cf-pop: LHR61-P3
x-cache: Miss from cloudfront
content-length: 639
x-xss-protection: 1; mode=block
referrer-policy: strict-origin-when-cross-origin
last-modified: Tue, 29 Nov 2022 07:39:21 GMT
server: nginx
etag: "7ca-5ee9716179e8a-gzip"
x-frame-options: sameorigin
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: https://www.group-ib.com
cache-control: private, max-age=3600
permissions-policy: accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=()
accept-ranges: bytes
x-amz-cf-id: nljY0sd9Djd93MFAwRLL4VhJsaL6H7sUfWPZmEZb1aL1aiH7YeNCag==

GET
H2 200 telegram-64.svg
website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/socials/ 1 KB
2 KB 67ms
67ms Image
image/svg+xml 2600:9000:2487:4000:9:7af6:1700:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/socials/telegram-64.svg

Requested by

Host: website.cdn.group-ib.com
URL: https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-blog-post.css?x18492

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2487:4000:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

cdc4d10b6b74ad79b55333b9882e854f054ee8b9953c6203dc46c68dc74eb0fb

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self';
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-blog-post.css?x18492
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

content-security-policy: frame-ancestors 'self';
content-encoding: gzip
x-content-type-options: nosniff
date: Mon, 04 Dec 2023 17:50:54 GMT
via: 1.1 a3ffeedc8ed545612c2465ea4fb13fbe.cloudfront.net (CloudFront)
strict-transport-security: max-age=31536000; includeSubDomains
x-amz-cf-pop: LHR61-P3
x-cache: Miss from cloudfront
content-length: 787
x-xss-protection: 1; mode=block
referrer-policy: strict-origin-when-cross-origin
last-modified: Tue, 29 Nov 2022 07:39:21 GMT
server: nginx
etag: "5fc-5ee9716179e8a-gzip"
x-frame-options: sameorigin
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: https://www.group-ib.com
cache-control: private, max-age=3600
permissions-policy: accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=()
accept-ranges: bytes
x-amz-cf-id: aqBMHHU7WEMe_ahVf8tUjZaJ9EkCosMZgU1h-C42QkQEVUsDY2LuIQ==

GET
H2 200 telegram-lbg.svg
website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/socials/ 3 KB
2 KB 65ms
64ms Image
image/svg+xml 2600:9000:2487:4000:9:7af6:1700:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/socials/telegram-lbg.svg

Requested by

Host: website.cdn.group-ib.com
URL: https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-blog-post.css?x18492

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2487:4000:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

ac57c7130d61697977d2ed1796c27eefed8249083472716e474e5604b20636aa

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self';
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-blog-post.css?x18492
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

content-security-policy: frame-ancestors 'self';
content-encoding: gzip
x-content-type-options: nosniff
date: Mon, 04 Dec 2023 17:50:54 GMT
via: 1.1 a3ffeedc8ed545612c2465ea4fb13fbe.cloudfront.net (CloudFront)
strict-transport-security: max-age=31536000; includeSubDomains
x-amz-cf-pop: LHR61-P3
x-cache: Miss from cloudfront
content-length: 949
x-xss-protection: 1; mode=block
referrer-policy: strict-origin-when-cross-origin
last-modified: Tue, 29 Nov 2022 07:39:21 GMT
server: nginx
etag: "bf1-5ee9716179e8a-gzip"
x-frame-options: sameorigin
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: https://www.group-ib.com
cache-control: private, max-age=3600
permissions-policy: accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=()
accept-ranges: bytes
x-amz-cf-id: 0Dv_yOEHKaeH7x5MSf-iXgbdASZV6oUQJ-KmXML2S1oc1kaALhFoCQ==

GET
H2 200 main-logo.svg
www.group-ib.com/wp-content/themes/gib-theme/assets/images/ 4 KB
2 KB 56ms
52ms Image
image/svg+xml 3.72.181.255
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.group-ib.com/wp-content/themes/gib-theme/assets/images/main-logo.svg?x18492

Requested by

Host: www.group-ib.com
URL: https://www.group-ib.com/blog/mysterious-team-bangladesh/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.72.181.255 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-72-181-255.eu-central-1.compute.amazonaws.com

Software

nginx /

Resource Hash

fffe17f6fe0ca9bf2e69d087a687c9d2340f67d742a70a810a57ef3c7d17cefe

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self';
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.group-ib.com/blog/mysterious-team-bangladesh/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

content-security-policy: frame-ancestors 'self';
content-encoding: gzip
x-content-type-options: nosniff
date: Mon, 04 Dec 2023 17:50:54 GMT
strict-transport-security: max-age=31536000; includeSubDomains
content-length: 2025
x-xss-protection: 1; mode=block
referrer-policy: strict-origin-when-cross-origin
last-modified: Thu, 02 Nov 2023 07:29:29 GMT
server: nginx
etag: "116f-6092659219013-gzip"
vary: Accept-Encoding
x-frame-options: sameorigin
content-type: image/svg+xml
access-control-allow-origin: https://www.group-ib.com
cache-control: private, max-age=3600
permissions-policy: accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=()
accept-ranges: bytes

GET
H2 200 ti.png
website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/main-nav/ 6 KB
7 KB 69ms
66ms Image
image/png 2600:9000:2487:4000:9:7af6:1700:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/main-nav/ti.png?x18492

Requested by

Host: www.group-ib.com
URL: https://www.group-ib.com/blog/mysterious-team-bangladesh/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2487:4000:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

f0e3a799744c0c67782742af2c13b85f769b58abd04800a04853d26f60cf7314

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self';
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

content-security-policy: frame-ancestors 'self';
date: Mon, 04 Dec 2023 17:50:54 GMT
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 a3ffeedc8ed545612c2465ea4fb13fbe.cloudfront.net (CloudFront)
x-amz-cf-pop: LHR61-P3
x-cache: Miss from cloudfront
content-length: 5919
x-xss-protection: 1; mode=block
referrer-policy: strict-origin-when-cross-origin
last-modified: Tue, 28 Jun 2022 07:55:26 GMT
server: nginx
etag: "171f-5e27d5c025780"
x-frame-options: sameorigin
content-type: image/png
access-control-allow-origin: https://www.group-ib.com
cache-control: no-cache, private, max-age=3600
permissions-policy: accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=()
accept-ranges: bytes
x-amz-cf-id: pQM6W2Qsms9RQ8N2sp5CM8P-z3ek4HUylEPTT_SIzyOtgyPlD6-c_g==
expires: Mon, 04 Dec 2023 17:50:53 GMT

GET
H2 200 asm.png
website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/main-nav/ 6 KB
7 KB 67ms
64ms Image
image/png 2600:9000:2487:4000:9:7af6:1700:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/main-nav/asm.png?x18492

Requested by

Host: www.group-ib.com
URL: https://www.group-ib.com/blog/mysterious-team-bangladesh/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2487:4000:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

997d49d316b533985208f14602a1ff15a76bf6a567afbb6b6980629ca8d78bab

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self';
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

content-security-policy: frame-ancestors 'self';
date: Mon, 04 Dec 2023 17:50:54 GMT
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 a3ffeedc8ed545612c2465ea4fb13fbe.cloudfront.net (CloudFront)
x-amz-cf-pop: LHR61-P3
x-cache: Miss from cloudfront
content-length: 5941
x-xss-protection: 1; mode=block
referrer-policy: strict-origin-when-cross-origin
last-modified: Tue, 28 Jun 2022 07:55:26 GMT
server: nginx
etag: "1735-5e27d5c025780"
x-frame-options: sameorigin
content-type: image/png
access-control-allow-origin: https://www.group-ib.com
cache-control: no-cache, private, max-age=3600
permissions-policy: accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=()
accept-ranges: bytes
x-amz-cf-id: lcFFB0MbWXrYuUJoavYovaR_F7sQCZqk3KgMlYYOXWYUutEoBejbdA==
expires: Mon, 04 Dec 2023 17:50:53 GMT

GET
H2 200 fp.png
website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/main-nav/ 8 KB
8 KB 72ms
69ms Image
image/png 2600:9000:2487:4000:9:7af6:1700:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/main-nav/fp.png?x18492

Requested by

Host: www.group-ib.com
URL: https://www.group-ib.com/blog/mysterious-team-bangladesh/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2487:4000:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

15534f98c260c3c3caaedf53335d912010b2de1731477a9fd4dbea89fb4995d9

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self';
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

content-security-policy: frame-ancestors 'self';
date: Mon, 04 Dec 2023 17:50:54 GMT
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 a3ffeedc8ed545612c2465ea4fb13fbe.cloudfront.net (CloudFront)
x-amz-cf-pop: LHR61-P3
x-cache: Miss from cloudfront
content-length: 7844
x-xss-protection: 1; mode=block
referrer-policy: strict-origin-when-cross-origin
last-modified: Tue, 28 Jun 2022 07:55:26 GMT
server: nginx
etag: "1ea4-5e27d5c025780"
x-frame-options: sameorigin
content-type: image/png
access-control-allow-origin: https://www.group-ib.com
cache-control: no-cache, private, max-age=3600
permissions-policy: accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=()
accept-ranges: bytes
x-amz-cf-id: awUjCGMs9-d13CODPh1FfxJFvWUeEeTI1IH5mTfWIsBjJFT2PkHHlg==
expires: Mon, 04 Dec 2023 17:50:53 GMT

GET
H2 200 drp.png
website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/main-nav/ 5 KB
6 KB 97ms
94ms Image
image/png 2600:9000:2487:4000:9:7af6:1700:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/main-nav/drp.png?x18492

Requested by

Host: www.group-ib.com
URL: https://www.group-ib.com/blog/mysterious-team-bangladesh/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2487:4000:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

a300a894e169169882504968fae71958a87e0a4322e2aee1b6b0bbd63fd9621f

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self';
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

content-security-policy: frame-ancestors 'self';
date: Mon, 04 Dec 2023 17:50:54 GMT
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 a3ffeedc8ed545612c2465ea4fb13fbe.cloudfront.net (CloudFront)
x-amz-cf-pop: LHR61-P3
x-cache: Miss from cloudfront
content-length: 5398
x-xss-protection: 1; mode=block
referrer-policy: strict-origin-when-cross-origin
last-modified: Tue, 28 Jun 2022 07:55:26 GMT
server: nginx
etag: "1516-5e27d5c025780"
x-frame-options: sameorigin
content-type: image/png
access-control-allow-origin: https://www.group-ib.com
cache-control: no-cache, private, max-age=3600
permissions-policy: accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=()
accept-ranges: bytes
x-amz-cf-id: INQRt7KS_LiqSvBddTEDZ7SlITbbOrtOEs1eB1ZoSqPsgXa4rXREdg==
expires: Mon, 04 Dec 2023 17:50:53 GMT

GET
H2 200 mxdr.png
website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/main-nav/ 6 KB
7 KB 70ms
67ms Image
image/png 2600:9000:2487:4000:9:7af6:1700:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/main-nav/mxdr.png?x18492

Requested by

Host: www.group-ib.com
URL: https://www.group-ib.com/blog/mysterious-team-bangladesh/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2487:4000:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

2be8ce2b065360537771ed230d5d72cbd84758ec127ffa035e6d260ed14af5b0

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self';
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

content-security-policy: frame-ancestors 'self';
date: Mon, 04 Dec 2023 17:50:54 GMT
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 a3ffeedc8ed545612c2465ea4fb13fbe.cloudfront.net (CloudFront)
x-amz-cf-pop: LHR61-P3
x-cache: Miss from cloudfront
content-length: 6506
x-xss-protection: 1; mode=block
referrer-policy: strict-origin-when-cross-origin
last-modified: Tue, 28 Jun 2022 07:55:26 GMT
server: nginx
etag: "196a-5e27d5c025780"
x-frame-options: sameorigin
content-type: image/png
access-control-allow-origin: https://www.group-ib.com
cache-control: no-cache, private, max-age=3600
permissions-policy: accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=()
accept-ranges: bytes
x-amz-cf-id: 2kLcYlKgGmgFk2GaP9UPJkpr60Y7FTiRAHeoQzb2REKcbsf9-nE2Wg==
expires: Mon, 04 Dec 2023 17:50:53 GMT

GET
H2 200 bep.png
website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/main-nav/ 6 KB
7 KB 74ms
71ms Image
image/png 2600:9000:2487:4000:9:7af6:1700:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/main-nav/bep.png?x18492

Requested by

Host: www.group-ib.com
URL: https://www.group-ib.com/blog/mysterious-team-bangladesh/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2487:4000:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

7574ba97d4ee7e81bd60873a52a31ff13359f246d0ac492ef2dabf96233a99e6

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self';
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

content-security-policy: frame-ancestors 'self';
date: Mon, 04 Dec 2023 17:50:54 GMT
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 a3ffeedc8ed545612c2465ea4fb13fbe.cloudfront.net (CloudFront)
x-amz-cf-pop: LHR61-P3
x-cache: Miss from cloudfront
content-length: 6362
x-xss-protection: 1; mode=block
referrer-policy: strict-origin-when-cross-origin
last-modified: Tue, 28 Jun 2022 07:55:26 GMT
server: nginx
etag: "18da-5e27d5c025780"
x-frame-options: sameorigin
content-type: image/png
access-control-allow-origin: https://www.group-ib.com
cache-control: no-cache, private, max-age=3600
permissions-policy: accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=()
accept-ranges: bytes
x-amz-cf-id: 9CR6iNdfWSo3Oi8P88TvocFw6xPtNGN5vtu-Ewtw2YGe8WKxE2XiYA==
expires: Mon, 04 Dec 2023 17:50:53 GMT

GET
H2 200 share-black.svg
www.group-ib.com/wp-content/themes/gib-theme/assets/images/ 1 KB
582 B 54ms
51ms Image
image/svg+xml 3.72.181.255
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.group-ib.com/wp-content/themes/gib-theme/assets/images/share-black.svg?x18492

Requested by

Host: www.group-ib.com
URL: https://www.group-ib.com/blog/mysterious-team-bangladesh/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.72.181.255 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-72-181-255.eu-central-1.compute.amazonaws.com

Software

nginx /

Resource Hash

3689e488f5478e26f0347353ad608ccd66e4d62992021c51d9db93f89d43c880

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self';
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.group-ib.com/blog/mysterious-team-bangladesh/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

content-security-policy: frame-ancestors 'self';
content-encoding: gzip
x-content-type-options: nosniff
date: Mon, 04 Dec 2023 17:50:54 GMT
strict-transport-security: max-age=31536000; includeSubDomains
content-length: 500
x-xss-protection: 1; mode=block
referrer-policy: strict-origin-when-cross-origin
last-modified: Tue, 22 Nov 2022 11:16:45 GMT
server: nginx
etag: "468-5ee0d4eb0feca-gzip"
vary: Accept-Encoding
x-frame-options: sameorigin
content-type: image/svg+xml
access-control-allow-origin: https://www.group-ib.com
cache-control: private, max-age=3600
permissions-policy: accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=()
accept-ranges: bytes

GET
H2 200 wb_sunny-black.svg
www.group-ib.com/wp-content/themes/gib-theme/assets/images/ 724 B
674 B 55ms
53ms Image
image/svg+xml 3.72.181.255
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.group-ib.com/wp-content/themes/gib-theme/assets/images/wb_sunny-black.svg?x18492

Requested by

Host: www.group-ib.com
URL: https://www.group-ib.com/blog/mysterious-team-bangladesh/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.72.181.255 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-72-181-255.eu-central-1.compute.amazonaws.com

Software

nginx /

Resource Hash

cc5dcea4d483d798630d7fe0846a1b784618aa3d4f86bdfa655083d81750322a

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self';
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.group-ib.com/blog/mysterious-team-bangladesh/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

content-security-policy: frame-ancestors 'self';
content-encoding: gzip
x-content-type-options: nosniff
date: Mon, 04 Dec 2023 17:50:54 GMT
strict-transport-security: max-age=31536000; includeSubDomains
content-length: 385
x-xss-protection: 1; mode=block
referrer-policy: strict-origin-when-cross-origin
last-modified: Tue, 22 Nov 2022 11:16:45 GMT
server: nginx
etag: "2d4-5ee0d4eb0feca-gzip"
vary: Accept-Encoding
x-frame-options: sameorigin
content-type: image/svg+xml
access-control-allow-origin: https://www.group-ib.com
cache-control: private, max-age=3600
permissions-policy: accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=()
accept-ranges: bytes

GET
H2 200 moon.svg
www.group-ib.com/wp-content/themes/gib-theme/assets/images/ 627 B
445 B 52ms
50ms Image
image/svg+xml 3.72.181.255
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.group-ib.com/wp-content/themes/gib-theme/assets/images/moon.svg?x18492

Requested by

Host: www.group-ib.com
URL: https://www.group-ib.com/blog/mysterious-team-bangladesh/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.72.181.255 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-72-181-255.eu-central-1.compute.amazonaws.com

Software

nginx /

Resource Hash

dedf6c9294a8b9e4b13b1575641071e45c8e61235bd154d19103fd2893ccd708

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self';
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.group-ib.com/blog/mysterious-team-bangladesh/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

content-security-policy: frame-ancestors 'self';
content-encoding: gzip
x-content-type-options: nosniff
date: Mon, 04 Dec 2023 17:50:54 GMT
strict-transport-security: max-age=31536000; includeSubDomains
content-length: 361
x-xss-protection: 1; mode=block
referrer-policy: strict-origin-when-cross-origin
last-modified: Thu, 24 Nov 2022 12:37:03 GMT
server: nginx
etag: "273-5ee36a9860213-gzip"
vary: Accept-Encoding
x-frame-options: sameorigin
content-type: image/svg+xml
access-control-allow-origin: https://www.group-ib.com
cache-control: private, max-age=3600
permissions-policy: accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=()
accept-ranges: bytes

GET
H2 200 bangladesh.webp
website.cdn.group-ib.com/wp-content/uploads/ 277 KB
278 KB 118ms
116ms Image
image/webp 2600:9000:2487:4000:9:7af6:1700:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://website.cdn.group-ib.com/wp-content/uploads/bangladesh.webp

Requested by

Host: www.group-ib.com
URL: https://www.group-ib.com/blog/mysterious-team-bangladesh/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2487:4000:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

7803c89039a7bd4ce3ee7c5446d068655c595c27ae8032b33e058c1d69b951bc

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self';
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

content-security-policy: frame-ancestors 'self';
date: Mon, 04 Dec 2023 17:50:54 GMT
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 a3ffeedc8ed545612c2465ea4fb13fbe.cloudfront.net (CloudFront)
x-amz-cf-pop: LHR61-P3
x-cache: Miss from cloudfront
content-length: 283510
x-xss-protection: 1; mode=block
referrer-policy: strict-origin-when-cross-origin
last-modified: Tue, 01 Aug 2023 11:33:07 GMT
server: nginx
etag: "45376-601dae935b156"
x-frame-options: sameorigin
content-type: image/webp
access-control-allow-origin: https://www.group-ib.com
cache-control: no-cache, private, max-age=3600
permissions-policy: accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=()
accept-ranges: bytes
x-amz-cf-id: tWUW_96YBW0roIiIt2dWcc-5Wx-2g2ZqrE7z3bzmz2z3IAtI01oKFg==
expires: Mon, 04 Dec 2023 17:50:53 GMT

GET
H2 200 GIB-round-white.png
website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/ 3 KB
4 KB 139ms
138ms Image
image/png 2600:9000:2487:4000:9:7af6:1700:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/GIB-round-white.png?x18492

Requested by

Host: www.group-ib.com
URL: https://www.group-ib.com/blog/mysterious-team-bangladesh/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2487:4000:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

3b63b449bde0f2c40eb23801ac24bd82666bd3a766c77b953ff75e6f3e257460

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self';
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

content-security-policy: frame-ancestors 'self';
date: Mon, 04 Dec 2023 17:50:54 GMT
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 a3ffeedc8ed545612c2465ea4fb13fbe.cloudfront.net (CloudFront)
x-amz-cf-pop: LHR61-P3
x-cache: Miss from cloudfront
content-length: 2866
x-xss-protection: 1; mode=block
referrer-policy: strict-origin-when-cross-origin
last-modified: Thu, 08 Dec 2022 15:23:27 GMT
server: nginx
etag: "b32-5ef529e6e43ce"
x-frame-options: sameorigin
content-type: image/png
access-control-allow-origin: https://www.group-ib.com
cache-control: no-cache, private, max-age=3600
permissions-policy: accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=()
accept-ranges: bytes
x-amz-cf-id: _Kj7LVz964wrSfu5ccz1i4I9xx2Gp90Dm8vLzvixlkd8Sm7jvYD-xg==
expires: Mon, 04 Dec 2023 17:50:53 GMT

GET
H2 200 hunting-rituals_red.jpg
website.cdn.group-ib.com/wp-content/uploads/ 127 KB
128 KB 103ms
103ms Image
image/jpeg 2600:9000:2487:4000:9:7af6:1700:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://website.cdn.group-ib.com/wp-content/uploads/hunting-rituals_red.jpg

Requested by

Host: www.group-ib.com
URL: https://www.group-ib.com/blog/mysterious-team-bangladesh/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2487:4000:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

a8db2c5feaeae215fc02c7a068b7c1f624adf29f5344f1ed90e5eaac466f6517

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self';
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

content-security-policy: frame-ancestors 'self';
date: Mon, 04 Dec 2023 17:50:54 GMT
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 a3ffeedc8ed545612c2465ea4fb13fbe.cloudfront.net (CloudFront)
x-amz-cf-pop: LHR61-P3
x-cache: Miss from cloudfront
content-length: 129927
x-xss-protection: 1; mode=block
referrer-policy: strict-origin-when-cross-origin
last-modified: Wed, 16 Aug 2023 12:43:11 GMT
server: nginx
etag: "1fb87-60309a367a354"
x-frame-options: sameorigin
content-type: image/jpeg
access-control-allow-origin: https://www.group-ib.com
cache-control: no-cache, private, max-age=3600
permissions-policy: accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=()
accept-ranges: bytes
x-amz-cf-id: 3bTdoNIpVk45BMOw-3_Mj_Xv5r3R_hQ4vKhZox2MicdMllUvm6StTw==
expires: Mon, 04 Dec 2023 17:50:53 GMT

GET
H2 200 cover-farnetwork-1.webp
website.cdn.group-ib.com/wp-content/uploads/ 81 KB
82 KB 106ms
105ms Image
image/webp 2600:9000:2487:4000:9:7af6:1700:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://website.cdn.group-ib.com/wp-content/uploads/cover-farnetwork-1.webp

Requested by

Host: www.group-ib.com
URL: https://www.group-ib.com/blog/mysterious-team-bangladesh/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2487:4000:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

26d28830df1e9958b86a59aca1a51fb51f06392698f90fd02d1341294b32d998

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self';
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

content-security-policy: frame-ancestors 'self';
date: Mon, 04 Dec 2023 17:50:54 GMT
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 a3ffeedc8ed545612c2465ea4fb13fbe.cloudfront.net (CloudFront)
x-amz-cf-pop: LHR61-P3
x-cache: Miss from cloudfront
content-length: 82776
x-xss-protection: 1; mode=block
referrer-policy: strict-origin-when-cross-origin
last-modified: Thu, 02 Nov 2023 11:07:22 GMT
server: nginx
etag: "14358-6092964645bc4"
x-frame-options: sameorigin
content-type: image/webp
access-control-allow-origin: https://www.group-ib.com
cache-control: no-cache, private, max-age=3600
permissions-policy: accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=()
accept-ranges: bytes
x-amz-cf-id: -lfWEAdTgEWZ5eoIZH2XRuVeWguaCLN0DnWVkPCT2u4Bu_tjRfCsAg==
expires: Mon, 04 Dec 2023 17:50:53 GMT

GET
H2 200 insiders-gambit-2.jpg
website.cdn.group-ib.com/wp-content/uploads/ 136 KB
137 KB 97ms
96ms Image
image/jpeg 2600:9000:2487:4000:9:7af6:1700:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://website.cdn.group-ib.com/wp-content/uploads/insiders-gambit-2.jpg

Requested by

Host: www.group-ib.com
URL: https://www.group-ib.com/blog/mysterious-team-bangladesh/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2487:4000:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

d5e95d6adf11e4a630265f96a786ee7278a3bc6244e0d66a89f71fb337f6a73a

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self';
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

content-security-policy: frame-ancestors 'self';
date: Mon, 04 Dec 2023 17:50:54 GMT
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 a3ffeedc8ed545612c2465ea4fb13fbe.cloudfront.net (CloudFront)
x-amz-cf-pop: LHR61-P3
x-cache: Miss from cloudfront
content-length: 139409
x-xss-protection: 1; mode=block
referrer-policy: strict-origin-when-cross-origin
last-modified: Mon, 23 Oct 2023 11:40:32 GMT
server: nginx
etag: "22091-60860b090fbca"
x-frame-options: sameorigin
content-type: image/jpeg
access-control-allow-origin: https://www.group-ib.com
cache-control: no-cache, private, max-age=3600
permissions-policy: accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=()
accept-ranges: bytes
x-amz-cf-id: 0ACsKOoOA83t8nfZADPDz0uyqFQSYMTkg7X4apjyHsBL86lY2wKiNg==
expires: Mon, 04 Dec 2023 17:50:53 GMT

GET
H/1.1 200
OK counters.gif
forms.hsforms.com/embed/v3/ 35 B
1016 B 256ms
174ms Image
image/gif 2606:4700::6811:cff9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://forms.hsforms.com/embed/v3/counters.gif?key=forms-embed-v2-DEFINITION_SUCCESS&count=1

Requested by

Host: www.group-ib.com
URL: https://www.group-ib.com/blog/mysterious-team-bangladesh/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:cff9 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Date: Mon, 04 Dec 2023 17:50:54 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
X-Content-Type-Options: nosniff
CF-Cache-Status: DYNAMIC
x-evy-trace-route-service-name: envoyset-translator
X-HubSpot-Correlation-Id: fc9ca3ea-e0ce-47bf-b9e1-bbaf41815fb6
x-envoy-upstream-service-time: 20
Connection: keep-alive
alt-svc: h3=":443"; ma=86400
Content-Length: 35
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: fc9ca3ea-e0ce-47bf-b9e1-bbaf41815fb6
Server: cloudflare
X-Trace: 2B95F673A7D08DB15FE6BD3A0FE20DA2CCAF30816D000000000000000000
Vary: origin
Content-Type: image/gif
x-evy-trace-virtual-host: all
x-evy-trace-served-by-pod: iad02/star-hubspot-td/envoy-proxy-fc678f645-mmr2z
Access-Control-Expose-Headers: X-Origin-Hublet
Cache-Control: max-age=0, no-cache, no-store
Access-Control-Allow-Credentials: false
X-Robots-Tag: none
CF-RAY: 8305e4f598673a54-FRA

GET
H2 200 banner.js Show response
js-eu1.hs-banner.com/v2/25755956/ 66 KB
20 KB 218ms
139ms Script
text/javascript 172.65.202.201
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js-eu1.hs-banner.com/v2/25755956/banner.js
Requested by: Host: js-eu1.hs-scripts.com
URL: https://js-eu1.hs-scripts.com/25755956.js?x18492
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.65.202.201 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c84eae5b234d8595c0318241296fe36e8a29f6f9077176a2b3f1c553b7ef823b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 17:50:54 GMT
x-amz-version-id: k.vw21NpSh7kRqhHX0xaReU0fWn_9Gg5
content-encoding: br
cf-cache-status: REVALIDATED
x-amz-request-id: CNHC54E4B2VPJ6BF
x-evy-trace-route-service-name: envoyset-translator
x-amz-server-side-encryption: AES256
x-hubspot-correlation-id: 78e880eb-dce4-44c0-b54b-bacaf32be647
x-envoy-upstream-service-time: 47
x-amz-id-2: SVmHzovAMCqrLM5PdLoxiUTA2KYm+NstZAeCJ2zDWorDCMWS7zd6aQAyeLBjRQisMTNwMeykjUQ=
x-evy-trace-listener: listener_https
x-request-id: 78e880eb-dce4-44c0-b54b-bacaf32be647
x-evy-trace-route-configuration: listener_https/all
last-modified: Wed, 18 Oct 2023 17:20:52 GMT
server: cloudflare
etag: W/"0fe58bfdba164c72145bf56fb55fa2bb"
access-control-max-age: 604800
access-control-allow-methods: GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: https://www.facct.ru
x-evy-trace-virtual-host: all
access-control-expose-headers: x-last-modified-timestamp, X-HubSpot-NotFound, X-HS-User-Request, Link, Server-Timing
cache-control: max-age=300,public
access-control-allow-credentials: true
x-evy-trace-served-by-pod: fra04/analytics-js-proxy-td/envoy-proxy-7cfbc6c7f8-bfklt
vary: origin, Accept-Encoding
timing-allow-origin: *
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Accept-Charset, Accept-Encoding, X-Override-Internal-Permissions, X-Properties-Source, X-Properties-SourceId, X-Properties-Flag, X-Hubspot-User-Id, X-Hubspot-Trace, X-Hubspot-Callee, X-Hubspot-Offset, X-Hubspot-No-Trace, X-HubSpot-Static-App-Info, X-HubSpot-Messages-Uri, X-HubSpot-Request-Source, X-HubSpot-Request-Reason, Subscription-Billing-Auth-Token, X-App-CSRF, X-Tools-CSRF, Online-Payment-Signing-UUID, X-Source, X-SourceId, X-Origin-UserId, X-Biden-Request-Source, X-HubSpot-CSRF-hubspotapi, X-Force-Cookie-Refresh, X-Force-Cookie-Refresh-No-Cache, X-HS-User-Request, X-Application-Id, X-HS-Referer, X-HubSpot-Correlation-Id
cf-ray: 8305e4f59b2a4541-TXL
expires: Mon, 04 Dec 2023 17:55:54 GMT

GET
H2 200 collectedforms.js Show response
js-eu1.hscollectedforms.net/ 69 KB
25 KB 167ms
88ms Script
application/javascript 172.65.192.122
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://js-eu1.hscollectedforms.net/collectedforms.js

Requested by

Host: js-eu1.hs-scripts.com
URL: https://js-eu1.hs-scripts.com/25755956.js?x18492

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.65.192.122 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0ad17c7d661733bbf1cfe9bc6e85033bfed43c87c94cb72ba02f484adf1593c0

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.group-ib.com/
Origin: https://www.group-ib.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 17:50:54 GMT
x-amz-version-id: qOShuUL.zI.RMIWwukZE0taADNX_1wuf
via: 1.1 75f70026bed8fa7e14f645c02f074728.cloudfront.net (CloudFront)
x-content-type-options: nosniff
cf-cache-status: EXPIRED
x-amz-cf-pop: FRA60-P6
x-evy-trace-route-service-name: envoyset-translator
x-amz-server-side-encryption: AES256
x-hubspot-correlation-id: ce50190b-72fa-42e7-86a6-f6a181bfac8a
content-security-policy-report-only: frame-ancestors 'self'; report-uri https://send.hsbrowserreports.com/csp/report?resource=collected-forms-embed-js/static-1.444/bundles/project.js&cfRay=83043d5dae2baca9-WAW
x-cache: Hit from cloudfront
cache-tag: staticjsapp-collected-forms-embed-js-web-prod,staticjsapp-prod
content-encoding: br
x-envoy-upstream-service-time: 1
x-amz-replication-status: COMPLETED
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: ce50190b-72fa-42e7-86a6-f6a181bfac8a
last-modified: Mon, 04 Dec 2023 12:10:50 UTC
server: cloudflare
etag: W/"109b7665e389a0b17fbf732bf7a02089"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
x-evy-trace-virtual-host: all
x-hs-cache-status: HIT
cache-control: s-maxage=600, max-age=300
x-evy-trace-served-by-pod: fra04/app-td/envoy-proxy-9bbd8cb6-756sw
cf-ray: 8305e4f59a0e58de-TXL
x-amz-cf-id: z9ucgxruIoZZi1ckxerzg_B24T51wU8DhJg6eyu109juIeOrqdsaXA==
x-hs-target-asset: collected-forms-embed-js/static-1.444/bundles/project.js

GET
H2 200 web-interactives-embed.js Show response
js-eu1.hubspot.com/ 78 KB
23 KB 172ms
100ms Script
application/javascript 172.65.236.181
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://js-eu1.hubspot.com/web-interactives-embed.js

Requested by

Host: js-eu1.hs-scripts.com
URL: https://js-eu1.hs-scripts.com/25755956.js?x18492

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.65.236.181 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c83ca0c69da08f97b59cbfcf7f63529d115f5e6b54d32c52ac70399bde8dbcae

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.group-ib.com/
Origin: https://www.group-ib.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

content-encoding: br
x-evy-trace-route-service-name: envoyset-translator
x-amz-server-side-encryption: AES256
content-security-policy-report-only: frame-ancestors 'self'; report-uri https://send.hsbrowserreports.com/csp/report?resource=web-interactives-embed/static-2.719/bundles/project.js&cfRay=82ec646b787d5902-WAW
x-amz-replication-status: COMPLETED
x-evy-trace-listener: listener_https
etag: W/"585fb54e67e3532b09a76730f9f0f909"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
x-evy-trace-virtual-host: all
cache-control: max-age=600
x-hs-target-asset: web-interactives-embed/static-2.719/bundles/project.js
date: Mon, 04 Dec 2023 17:50:54 GMT
x-amz-version-id: gaY0JDKLLOuBnBR0KxTER8neWANVupuj
via: 1.1 218c6128df18321f9758e53ccc351448.cloudfront.net (CloudFront)
x-content-type-options: nosniff
cf-cache-status: EXPIRED
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-amz-cf-pop: FRA60-P6
x-hubspot-correlation-id: 67e83692-9071-4d3d-aa21-35731943dcd7
x-cache: Hit from cloudfront
cache-tag: staticjsapp-web-interactives-embed-web-prod,staticjsapp-prod
x-envoy-upstream-service-time: 2
x-evy-trace-route-configuration: listener_https/all
x-request-id: 67e83692-9071-4d3d-aa21-35731943dcd7
last-modified: Fri, 01 Dec 2023 13:22:48 UTC
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=h7SKdxnABgnWYmPERgKCWlvbc3OnNeHwcT3QFhQChRNYE4KwAqnssjbo%2BWsFL8LM8vw%2FMtuL%2B%2FyQxVfgtR0yD1gA0k9RaB4EWrmtNRKbuYbefFccqY0XyUM8GSIrBkDVtG6YUw%3D%3D"}],"group":"cf-nel","max_age":604800}
x-hs-cache-status: HIT
x-evy-trace-served-by-pod: fra04/app-td/envoy-proxy-7b8bd784bd-l92zw
cf-ray: 8305e4f58d9d44fe-TXL
x-amz-cf-id: p24nShIoRyLEwb37sJ9bKLt2vERRC7_yaY_AhKX6tujeK2WLXTbBLA==

GET
H2 200 25755956.js Show response
js-eu1.hs-analytics.net/analytics/1701712200000/ 66 KB
21 KB 196ms
117ms Script
text/javascript 172.65.238.60
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js-eu1.hs-analytics.net/analytics/1701712200000/25755956.js
Requested by: Host: js-eu1.hs-scripts.com
URL: https://js-eu1.hs-scripts.com/25755956.js?x18492
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.65.238.60 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f5adb3b6debbbee4c4a326c9a32a24c7d6c4a6f99d78a8604bc0d635d1b04f20

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 17:50:54 GMT
content-encoding: br
cf-cache-status: MISS
x-amz-request-id: 7YP8HHZNWVVB2JD9
x-evy-trace-route-service-name: envoyset-translator
x-amz-server-side-encryption: AES256
x-hubspot-correlation-id: 701a64f0-c276-4d9c-80d3-276db5811cba
x-envoy-upstream-service-time: 18
x-amz-id-2: T4o9Fn8n6xUetd8DdKaoFiQm4StL8ztArjssUXLlTCX8HdwDNPGsG5ZhLinUOwFPqKqNsu+ak5c=
x-evy-trace-listener: listener_https
x-request-id: 701a64f0-c276-4d9c-80d3-276db5811cba
x-evy-trace-route-configuration: listener_https/all
last-modified: Wed, 15 Nov 2023 17:23:01 GMT
server: cloudflare
etag: W/"56b300e73e9fcf76e46547446fd25cff"
vary: origin, Accept-Encoding
content-type: text/javascript
x-evy-trace-virtual-host: all
x-evy-trace-served-by-pod: fra04/analytics-js-proxy-td/envoy-proxy-54d97ddf9c-sl4dv
cache-control: max-age=300,public
access-control-allow-credentials: false
cf-ray: 8305e4f59ee02685-TXL
expires: Mon, 04 Dec 2023 17:55:54 GMT

GET
H2 200 fb.js Show response
js-eu1.hsadspixel.net/ 6 KB
4 KB 183ms
105ms Script
application/javascript 172.65.219.229
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://js-eu1.hsadspixel.net/fb.js

Requested by

Host: js-eu1.hs-scripts.com
URL: https://js-eu1.hs-scripts.com/25755956.js?x18492

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.65.219.229 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

df998f2ab79818d229edfab989eb187dd3d94f0f40377fde4f5f97e08b691ecf

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 17:50:54 GMT
x-amz-version-id: XlFw32Cnxu8ZjnNH.SH7ungVy3g8LtQG
via: 1.1 cba0902b20d884568adf673bab9438e6.cloudfront.net (CloudFront)
x-content-type-options: nosniff
cf-cache-status: HIT
x-amz-cf-pop: FRA60-P6
x-evy-trace-route-service-name: envoyset-translator
x-amz-server-side-encryption: AES256
x-hubspot-correlation-id: 82ad7d56-c350-4d5c-ad10-05c45ce8c223
content-security-policy-report-only: frame-ancestors 'self'; report-uri https://send.hsbrowserreports.com/csp/report?resource=adsscriptloaderstatic/static-1.501/bundles/pixels-release.js&cfRay=8304be088cb5bfc1-WAW
x-cache: Hit from cloudfront
cache-tag: staticjsapp-AdsScriptLoaderCloudflare-web-prod,staticjsapp-prod
content-encoding: br
age: 60
x-envoy-upstream-service-time: 59
x-amz-replication-status: COMPLETED
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: 82ad7d56-c350-4d5c-ad10-05c45ce8c223
last-modified: Mon, 04 Dec 2023 14:19:28 UTC
server: cloudflare
etag: W/"ed930579444c6c7c0292363361667508"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
x-hs-cache-status: HIT
x-evy-trace-virtual-host: all
cache-control: max-age=600
x-evy-trace-served-by-pod: fra04/app-td/envoy-proxy-9bbd8cb6-sxtv5
cf-ray: 8305e4f59f8f58ea-TXL
x-amz-cf-id: Xx8RCs73JofNyI1o1Xpkm5j4u87qtEXOwu-hYE1xAPJhKzAtnUz42g==
x-hs-target-asset: adsscriptloaderstatic/static-1.501/bundles/pixels-release.js

GET
H/1.1 200
OK counters.gif
forms-eu1.hsforms.com/embed/v3/ 35 B
1016 B 155ms
93ms Image
image/gif 172.65.232.43
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://forms-eu1.hsforms.com/embed/v3/counters.gif?key=forms-embed-v2-RENDER_SUCCESS&count=1

Requested by

Host: www.group-ib.com
URL: https://www.group-ib.com/blog/mysterious-team-bangladesh/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

172.65.232.43 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Date: Mon, 04 Dec 2023 17:50:54 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
X-Content-Type-Options: nosniff
CF-Cache-Status: DYNAMIC
x-evy-trace-route-service-name: envoyset-translator
X-HubSpot-Correlation-Id: 27fcf10d-a3c1-497c-a5d8-3af2fe020c94
x-envoy-upstream-service-time: 5
Connection: keep-alive
alt-svc: h3=":443"; ma=86400
Content-Length: 35
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: 27fcf10d-a3c1-497c-a5d8-3af2fe020c94
Server: cloudflare
X-Trace: 2BB7CBDA37572FFD6FF1EB27B6DF0D0CF4EAE9A5D0000000000000000000
Vary: origin
Content-Type: image/gif
x-evy-trace-virtual-host: all
x-evy-trace-served-by-pod: fra04/star-hubspot-td/envoy-proxy-7b5f5fb655-hfvq9
Access-Control-Expose-Headers: X-Origin-Hublet
Cache-Control: max-age=0, no-cache, no-store
Access-Control-Allow-Credentials: false
X-Robots-Tag: none
CF-RAY: 8305e4f5fefc4480-TXL

GET
H2 200 collect
px.ads.linkedin.com/ 0
771 B 328ms
237ms Image
application/javascript 2620:1ec:21::14
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=&time=1701712254339&url=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fmysterious-team-bangladesh%2F
Requested by: Host: www.group-ib.com
URL: https://www.group-ib.com/blog/mysterious-team-bangladesh/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:21::14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 17:50:54 GMT
nel: {"report_to":"network-errors","max_age":1296000,"success_fraction":0.00066,"failure_fraction":1,"include_subdomains":true}
x-li-pop: afd-prod-ltx1-x
x-msedge-ref: Ref A: 6E06A57A9C744ADDA2801AD0805FE206 Ref B: DUS30EDGE0309 Ref C: 2023-12-04T17:50:54Z
linkedin-action: 1
report-to: {"group":"network-errors","max_age":2592000,"endpoints":[{"url":"https://www.linkedin.com/li/rep"}],"include_subdomains":true}
content-type: application/javascript
x-li-source-fabric: prod-ltx1
x-cache: CONFIG_NOCACHE
x-li-fabric: prod-lor1
x-li-proto: http/2
content-length: 0
x-li-uuid: AAYLssJwyl+dFgbdsXZ1Ew==

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 290 KB
94 KB 60ms
59ms Script
application/javascript 2a00:1450:4001:80f::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-QMES53K3Y2&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-PW7265

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

a0db55df25ae4e15827fed2bf02fea97c9d8523056ab61f44f728be9b3bf5e29

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 17:50:54 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 96445
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Mon, 04 Dec 2023 17:50:54 GMT

GET
H2 200 6si.min.js Show response
j.6sc.co/ 63 KB
17 KB 169ms
40ms Script
application/javascript 2.17.100.193
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://j.6sc.co/6si.min.js

Requested by

Host: www.group-ib.com
URL: https://www.group-ib.com/blog/mysterious-team-bangladesh/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.17.100.193 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a2-17-100-193.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

a9e9d5d62bdbbe46fee9a3a0ba4c2d7fe5a6f4b53c10df3ac7d34796ffb7c96b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 04 Dec 2023 17:50:54 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 29 Nov 2023 18:58:50 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "656789ea-fdc2"
vary: Accept-Encoding
content-type: application/javascript
cache-control: private, no-cache, proxy-revalidate
accept-ranges: bytes
content-length: 17428
expires: Mon, 04 Dec 2023 17:50:54 GMT

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/10897073384/ 3 KB
2 KB 139ms
51ms Script
text/javascript 2a00:1450:4001:801::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/10897073384/?random=1701712254421&cv=11&fst=1701712254421&bg=ffffff&guid=ON&async=1&gtm=45He3bt0v72040694&gcd=11l1l1l1l1&dma_cps=sypham&dma=1&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fmysterious-team-bangladesh%2F&ref=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fmysterious-team-bangladesh%2F&hn=www.googleadservices.com&frm=0&tiba=Demystifying%20Mysterious%20Team%20Bangladesh%20%7C%20Group-IB%20Blog&auid=976693889.1701712254&uamb=0&uaw=0&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-PW7265

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8a828fd4ff75ed429a819ed9f9341336ecccfc91f77e7527df0aa217077c1a89

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 04 Dec 2023 17:50:54 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1299
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 pixel.js Show response
www.redditstatic.com/ads/ 23 KB
8 KB 191ms
57ms Script
application/javascript 2a04:4e42:400::396
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://www.redditstatic.com/ads/pixel.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-PW7265
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:4e42:400::396 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: snooserv /
Resource Hash: e803e774c7b59fe74f71ed93acaa875cf9a99947ff8ed7615cd0c93c1667250f

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 17:50:54 GMT
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish
last-modified: Thu, 15 Jun 2023 20:49:59 GMT
server: snooserv
nel: {"report_to": "w3-reporting-nel", "max_age": 14400, "include_subdomains": false, "success_fraction": 0.02, "failure_fraction": 0.02}
etag: "4a205643a240cb95fa82289d62b5af7e"
x-amz-server-side-encryption: AES256
vary: Accept-Encoding,Origin
report-to: {"group": "w3-reporting-nel", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-nel.reddit.com/reports" }]}, {"group": "w3-reporting", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting.reddit.com/reports" }]}, {"group": "w3-reporting-csp", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-csp.reddit.com/reports" }]}
content-type: application/javascript
cache-control: public, max-age=60
accept-ranges: bytes
content-length: 7409

GET
H2 200 NeverBounce.js Show response
cdn.neverbounce.com/widget/dist/ 96 KB
29 KB 226ms
54ms Script
application/javascript 108.157.229.98
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.neverbounce.com/widget/dist/NeverBounce.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-PW7265
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.157.229.98 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-157-229-98.arn56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: c99d11cb4960d6e1918ed55d5bcbb316d38b51098e2efc1201904d7274d3273e

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 05:22:28 GMT
content-encoding: gzip
via: 1.1 17c1b187a3afe016510e55151109cc30.cloudfront.net (CloudFront)
last-modified: Mon, 02 Mar 2020 18:37:33 GMT
server: AmazonS3
x-amz-cf-pop: ARN56-P2
age: 44908
etag: W/"c1e06621030dfcba15b88abbcaa546eb"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
x-amz-cf-id: 9ERI-vZJs-IwhUXcM9TEIPIC0zR21QznZJAekrm85IHFv6OOVhboaQ==

GET
H2 200 63e267f61a03d71ea3df5fe7 Show response
ws.zoominfo.com/pixel/ 3 KB
2 KB 418ms
329ms Script
text/javascript 2606:4700::6810:890f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://ws.zoominfo.com/pixel/63e267f61a03d71ea3df5fe7

Requested by

Host: www.group-ib.com
URL: https://www.group-ib.com/blog/mysterious-team-bangladesh/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:890f , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / Express

Resource Hash

b2c1528354197e8e8e777aae7bda28307c08983050b4f002e566b0266e765ab0

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.group-ib.com/blog/mysterious-team-bangladesh/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 17:50:54 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
via: 1.1 google
server: cloudflare
x-powered-by: Express
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
access-control-allow-credentials: true
cf-ray: 8305e4f6d8ff368c-FRA
access-control-allow-headers: Content-Type,cf-ipcountry,service-version,x-appengine-user-ip,x-forwarded-for, x-ws-collect-type,requestFromZITag,unifiedScriptVerified,_zitok,_vtok,visited-url
alt-svc: h3=":443"; ma=86400

GET
H2 200 fbevents.js Show response
connect.facebook.net/en_US/ 202 KB
54 KB 119ms
40ms Script
application/x-javascript 2a03:2880:f084:d:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Host: www.group-ib.com
URL: https://www.group-ib.com/blog/mysterious-team-bangladesh/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f084:d:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

3e136e77083bfc6ef14ffc5abd19da89a82bf12fc0cda3c603e01582b93303c8

Security Headers

Name	Value
Content-Security-Policy	default-src facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com data: blob: 'self';script-src .fbcdn.net .facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

permissions-policy-report-only: autoplay=(), clipboard-read=(), clipboard-write=(), display-capture=(), document-domain=(), encrypted-media=(), fullscreen=(), gamepad=(), keyboard-map=(), otp-credentials=(), picture-in-picture=(), xr-spatial-tracking=()
content-security-policy: default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script';
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; preload; includeSubDomains
date: Mon, 04 Dec 2023 17:50:54 GMT
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 54273
x-xss-protection: 0
reporting-endpoints
pragma: public
x-fb-debug: 2Rbi58awnxKB/3SZwexJUc6bHLSUu+0lla98vpiDWMB0jB5yQqhtROH5PCshO5VH4TzBY5b3jdWBLUK7ZyN/Qg==
cross-origin-opener-policy: same-origin-allow-popups
vary: Accept-Encoding
x-frame-options: DENY
content-type: application/x-javascript; charset=utf-8
origin-agent-cluster: ?0
cache-control: public, max-age=1200
permissions-policy: accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), payment=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), usb=(), window-management=()
timing-allow-origin: *
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 1010045.js Show response
tracking.g2crowd.com/attribution_tracking/conversions/ 958 B
2 KB 257ms
155ms Script
text/javascript 2606:4700:4400::6812:2b1f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://tracking.g2crowd.com/attribution_tracking/conversions/1010045.js?p=https://www.group-ib.com/blog/mysterious-team-bangladesh/&e=

Requested by

Host: www.group-ib.com
URL: https://www.group-ib.com/blog/mysterious-team-bangladesh/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::6812:2b1f , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d4c9ffda6ca556f36f402f6d1131a4f3f567505320a9f60151023d4a8bbdb458

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' .g2crowd.com .g2.com; connect-src 'self' .g2crowd.com .g2.com; font-src 'self' .g2crowd.com .g2.com; form-action 'self' .g2crowd.com .g2.com; frame-src 'self' .g2crowd.com .g2.com; img-src 'self' .g2crowd.com .g2.com; manifest-src 'self' .g2crowd.com .g2.com; media-src 'self' .g2crowd.com .g2.com; object-src 'self' .g2crowd.com .g2.com; script-src 'self' .g2crowd.com .g2.com; style-src 'self' .g2crowd.com .g2.com; worker-src 'self' .g2crowd.com .g2.com
Strict-Transport-Security	max-age=604800
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 17:50:54 GMT
strict-transport-security: max-age=604800
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
content-encoding: br
x-permitted-cross-domain-policies: none
content-security-policy: default-src 'self' *.g2crowd.com *.g2.com; connect-src 'self' *.g2crowd.com *.g2.com; font-src 'self' *.g2crowd.com *.g2.com; form-action 'self' *.g2crowd.com *.g2.com; frame-src 'self' *.g2crowd.com *.g2.com; img-src 'self' *.g2crowd.com *.g2.com; manifest-src 'self' *.g2crowd.com *.g2.com; media-src 'self' *.g2crowd.com *.g2.com; object-src 'self' *.g2crowd.com *.g2.com; script-src 'self' *.g2crowd.com *.g2.com; style-src 'self' *.g2crowd.com *.g2.com; worker-src 'self' *.g2crowd.com *.g2.com
x-xss-protection: 1; mode=block
x-request-id: e75df84b-8412-4d5f-b658-ff06543651f5
x-runtime: 0.003348
referrer-policy: strict-origin-when-cross-origin
server: cloudflare
etag: W/"d4c9ffda6ca556f36f402f6d1131a4f3"
x-download-options: noopen
x-frame-options: SAMEORIGIN
vary: Origin
content-type: text/javascript; charset=utf-8
cache-control: max-age=600, public
cf-ray: 8305e4f728c6910d-FRA

GET
H2 200 1010056.js Show response
tracking.g2crowd.com/attribution_tracking/conversions/ 958 B
954 B 227ms
157ms Script
text/javascript 2606:4700:4400::6812:2b1f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://tracking.g2crowd.com/attribution_tracking/conversions/1010056.js?p=https://www.group-ib.com/blog/mysterious-team-bangladesh/&e=

Requested by

Host: www.group-ib.com
URL: https://www.group-ib.com/blog/mysterious-team-bangladesh/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::6812:2b1f , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

085d5ab7549bcb7c4e86df292e05e2e579ec6ce11e052357110484554cdb12c1

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' .g2crowd.com .g2.com; connect-src 'self' .g2crowd.com .g2.com; font-src 'self' .g2crowd.com .g2.com; form-action 'self' .g2crowd.com .g2.com; frame-src 'self' .g2crowd.com .g2.com; img-src 'self' .g2crowd.com .g2.com; manifest-src 'self' .g2crowd.com .g2.com; media-src 'self' .g2crowd.com .g2.com; object-src 'self' .g2crowd.com .g2.com; script-src 'self' .g2crowd.com .g2.com; style-src 'self' .g2crowd.com .g2.com; worker-src 'self' .g2crowd.com .g2.com
Strict-Transport-Security	max-age=604800
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 17:50:54 GMT
strict-transport-security: max-age=604800
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
content-encoding: br
x-permitted-cross-domain-policies: none
content-security-policy: default-src 'self' *.g2crowd.com *.g2.com; connect-src 'self' *.g2crowd.com *.g2.com; font-src 'self' *.g2crowd.com *.g2.com; form-action 'self' *.g2crowd.com *.g2.com; frame-src 'self' *.g2crowd.com *.g2.com; img-src 'self' *.g2crowd.com *.g2.com; manifest-src 'self' *.g2crowd.com *.g2.com; media-src 'self' *.g2crowd.com *.g2.com; object-src 'self' *.g2crowd.com *.g2.com; script-src 'self' *.g2crowd.com *.g2.com; style-src 'self' *.g2crowd.com *.g2.com; worker-src 'self' *.g2crowd.com *.g2.com
x-xss-protection: 1; mode=block
x-request-id: 4fd62b70-dc90-42a8-a260-f4b43faadab6
x-runtime: 0.003044
referrer-policy: strict-origin-when-cross-origin
server: cloudflare
etag: W/"085d5ab7549bcb7c4e86df292e05e2e5"
x-download-options: noopen
x-frame-options: SAMEORIGIN
vary: Origin
content-type: text/javascript; charset=utf-8
cache-control: max-age=600, public
cf-ray: 8305e4f728d0910d-FRA

GET
H2 200 1010057.js Show response
tracking.g2crowd.com/attribution_tracking/conversions/ 958 B
925 B 158ms
156ms Script
text/javascript 2606:4700:4400::6812:2b1f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://tracking.g2crowd.com/attribution_tracking/conversions/1010057.js?p=https://www.group-ib.com/blog/mysterious-team-bangladesh/&e=

Requested by

Host: www.group-ib.com
URL: https://www.group-ib.com/blog/mysterious-team-bangladesh/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::6812:2b1f , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

1d26a8b07287923bfa829132476a39ef18a3d54142a095bead617044f2255eab

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' .g2crowd.com .g2.com; connect-src 'self' .g2crowd.com .g2.com; font-src 'self' .g2crowd.com .g2.com; form-action 'self' .g2crowd.com .g2.com; frame-src 'self' .g2crowd.com .g2.com; img-src 'self' .g2crowd.com .g2.com; manifest-src 'self' .g2crowd.com .g2.com; media-src 'self' .g2crowd.com .g2.com; object-src 'self' .g2crowd.com .g2.com; script-src 'self' .g2crowd.com .g2.com; style-src 'self' .g2crowd.com .g2.com; worker-src 'self' .g2crowd.com .g2.com
Strict-Transport-Security	max-age=604800
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 17:50:54 GMT
strict-transport-security: max-age=604800
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
content-encoding: br
x-permitted-cross-domain-policies: none
content-security-policy: default-src 'self' *.g2crowd.com *.g2.com; connect-src 'self' *.g2crowd.com *.g2.com; font-src 'self' *.g2crowd.com *.g2.com; form-action 'self' *.g2crowd.com *.g2.com; frame-src 'self' *.g2crowd.com *.g2.com; img-src 'self' *.g2crowd.com *.g2.com; manifest-src 'self' *.g2crowd.com *.g2.com; media-src 'self' *.g2crowd.com *.g2.com; object-src 'self' *.g2crowd.com *.g2.com; script-src 'self' *.g2crowd.com *.g2.com; style-src 'self' *.g2crowd.com *.g2.com; worker-src 'self' *.g2crowd.com *.g2.com
x-xss-protection: 1; mode=block
x-request-id: 3d3f063d-c0cf-434a-8de8-66510ae5bb96
x-runtime: 0.005343
referrer-policy: strict-origin-when-cross-origin
server: cloudflare
etag: W/"1d26a8b07287923bfa829132476a39ef"
x-download-options: noopen
x-frame-options: SAMEORIGIN
vary: Origin
content-type: text/javascript; charset=utf-8
cache-control: max-age=600, public
cf-ray: 8305e4f728cb910d-FRA

GET
H2

200

collect
px4.ads.linkedin.com/
Redirect Chain

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=4496601&time=1701712254424&url=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fmysterious-team-bangladesh%2F&tm=gtmv2
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=4496601&time=1701712254424&url=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fmysterious-team-bangladesh%2F&tm=gtmv2&cookiesTest=true
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D4496601%26time%3D1701712254424%26url%3Dhttps%253A%252F%252Fwww.group-ib.com%252Fb...
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=4496601&time=1701712254424&url=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fmysterious-team-bangladesh%2F&tm=gtmv2&cookiesTest=true&liSync=true
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=4496601&time=1701712254424&url=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fmysterious-team-bangladesh%2F&tm=gtmv2&cookiesTest=true&liSync=true&e_ipv6...

0
483 B

308ms
213ms

Image
application/javascript

13.107.42.14
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=4496601&time=1701712254424&url=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fmysterious-team-bangladesh%2F&tm=gtmv2&cookiesTest=true&liSync=true&e_ipv6=AQL99fq3Fhm8MgAAAYw19FlsgMePO_1NjwNOVfulwE3LbCXEDEP8rxRD1kdpnSqD0X_R-1g
Requested by: Host: www.group-ib.com
URL: https://www.group-ib.com/blog/mysterious-team-bangladesh/
Protocol: H2
Server: 13.107.42.14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 17:50:55 GMT
nel: {"report_to":"network-errors","max_age":1296000,"success_fraction":0.00066,"failure_fraction":1,"include_subdomains":true}
x-li-pop: afd-prod-lor1-x
x-msedge-ref: Ref A: BC99621582E044F2895BB7D6BF9F50D1 Ref B: DUS30EDGE0420 Ref C: 2023-12-04T17:50:55Z
linkedin-action: 1
report-to: {"group":"network-errors","max_age":2592000,"endpoints":[{"url":"https://www.linkedin.com/li/rep"}],"include_subdomains":true}
content-type: application/javascript
x-li-fabric: prod-lor1
x-cache: CONFIG_NOCACHE
x-li-proto: http/2
content-length: 0
x-li-uuid: AAYLssKB5LxM0r+mgdoPUg==

Redirect headers

date: Mon, 04 Dec 2023 17:50:54 GMT
nel: {"report_to":"network-errors","max_age":1296000,"success_fraction":0.00066,"failure_fraction":1,"include_subdomains":true}
x-li-pop: afd-prod-lor1-x
x-msedge-ref: Ref A: 833F41B6D15E46328CEC9EFA4D24B51E Ref B: DUS30EDGE0309 Ref C: 2023-12-04T17:50:55Z
linkedin-action: 1
report-to: {"group":"network-errors","max_age":2592000,"endpoints":[{"url":"https://www.linkedin.com/li/rep"}],"include_subdomains":true}
x-li-fabric: prod-lor1
location: https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=4496601&time=1701712254424&url=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fmysterious-team-bangladesh%2F&tm=gtmv2&cookiesTest=true&liSync=true&e_ipv6=AQL99fq3Fhm8MgAAAYw19FlsgMePO_1NjwNOVfulwE3LbCXEDEP8rxRD1kdpnSqD0X_R-1g
x-cache: CONFIG_NOCACHE
x-li-proto: http/2
content-length: 0
x-li-uuid: AAYLssJ9MCAUDOtQqoU38g==

GET
H2 200 combinedConfigs Show response
cta-eu1.hubspot.com/web-interactives/public/v1/embed/ 369 B
1 KB 145ms
79ms Fetch
application/json 172.65.198.159
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cta-eu1.hubspot.com/web-interactives/public/v1/embed/combinedConfigs?portalId=25755956&currentUrl=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fmysterious-team-bangladesh%2F&referrer=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fmysterious-team-bangladesh%2F

Requested by

Host: fhp-de-js.group-ib.com
URL: https://fhp-de-js.group-ib.com/d/bt-autoinject.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.65.198.159 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

14103b64df9857f9f7ad1f02efaafba97ce4772e8d8b448857de69c3537c338d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 17:50:54 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-evy-trace-route-service-name: envoyset-translator
x-hubspot-correlation-id: a97d1797-7ee1-4cf4-96bb-ab4b8565a128
content-encoding: br
x-envoy-upstream-service-time: 13
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: a97d1797-7ee1-4cf4-96bb-ab4b8565a128
server: cloudflare
vary: origin
access-control-allow-methods: OPTIONS, GET
content-type: application/json;charset=utf-8
access-control-allow-origin: https://www.group-ib.com
x-evy-trace-virtual-host: all
access-control-max-age: 180
access-control-allow-credentials: true
cache-control: max-age=0, no-cache, no-store
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=lGaDIa8h0EcODc2Kpg2XPRm0MhgsjdoiFpvjyDob1g0ZcSZNstknvYSX2ddx4vaB1UIGvM5R%2BvuvKvS2SJIsMNdJEx%2BdFUE7dD5k2mqXwbM78ZhFmQOQOJ0gjnF%2BFxTes2CKBz0%3D"}],"group":"cf-nel","max_age":604800}
x-robots-tag: noindex, follow
access-control-allow-headers: Accept, Accept-Charset, Accept-Encoding, Accept-Language, Content-Type, Host, Origin, Referer, User-Agent
cf-ray: 8305e4f6ca7e44f2-TXL
x-evy-trace-served-by-pod: fra04/star-hubspot-td/envoy-proxy-7b5f5fb655-vx2fr

GET
H2 200 json Show response
forms-eu1.hscollectedforms.net/collected-forms/v1/config/ 116 B
433 B 69ms
61ms XHR
application/json 172.65.192.122
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://forms-eu1.hscollectedforms.net/collected-forms/v1/config/json?portalId=25755956&utk=

Requested by

Host: fhp-de-js.group-ib.com
URL: https://fhp-de-js.group-ib.com/d/bt-autoinject.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.65.192.122 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

43f22362329b9705cf8629061fb5b1d1a38f1cc2bc9fd46728f73e5cd9eb77cf

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept: application/json, text/plain, */*
Referer: https://www.group-ib.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 17:50:54 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
x-evy-trace-route-service-name: envoyset-translator
x-hubspot-correlation-id: d9aa9185-58f0-41ed-a8d0-04f6131841ef
x-envoy-upstream-service-time: 9
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: d9aa9185-58f0-41ed-a8d0-04f6131841ef
server: cloudflare
vary: Accept-Encoding
access-control-allow-methods: GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD
content-type: application/json;charset=utf-8
access-control-allow-origin: https://www.group-ib.com
x-evy-trace-virtual-host: all
cache-control: max-age=0
x-evy-trace-served-by-pod: fra04/app-td/envoy-proxy-9bbd8cb6-sxtv5
access-control-max-age: 180
x-robots-tag: none
access-control-allow-headers: *
cf-ray: 8305e4f68c3f58de-TXL

GET
H2 200 json Show response
api-eu1.hubapi.com/hs-script-loader-public/v1/config/pixels-and-events/ 250 B
1 KB 150ms
68ms XHR
application/json 2a06:98c1:3200::90:0
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://api-eu1.hubapi.com/hs-script-loader-public/v1/config/pixels-and-events/json?portalId=25755956

Requested by

Host: fhp-de-js.group-ib.com
URL: https://fhp-de-js.group-ib.com/d/bt-autoinject.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a06:98c1:3200::90:0 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

1aa462865a143f6b053d5d1594aea3e38d36ebad2a23a7fcfdd84ba7a7a1fddb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 17:50:54 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-evy-trace-route-service-name: envoyset-translator
x-hubspot-correlation-id: 6d69af99-d134-440c-b843-e177d0165b97
content-encoding: br
x-envoy-upstream-service-time: 12
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: 6d69af99-d134-440c-b843-e177d0165b97
server: cloudflare
x-trace: 2B22D69CDA8ACCB91D33716424C4D16A989D363557000000000000000000
vary: origin
access-control-allow-methods: GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD
content-type: application/json;charset=utf-8
access-control-allow-origin: https://www.group-ib.com
x-evy-trace-virtual-host: all
access-control-max-age: 180
access-control-allow-credentials: false
x-evy-trace-served-by-pod: fra04/hubapi-td/envoy-proxy-75bd7484f7-z68c2
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=DJOmO3WNhqXppbWa4CUdZ%2FxzHPCF0D31B6WWMxcaM6BFxUoB6o%2B%2F5Grg6lR5lSuz30zbP4i9dQ0EhTA%2FiCBV9vLtttQOrF%2BoUpd2ID6KnwUODLmrzYzWmYJLMNd%2FTF4h6UnKsdSWazCFLLM7a%2BqrgA%3D%3D"}],"group":"cf-nel","max_age":604800}
cf-ray: 8305e4f71de190f2-FRA
access-control-allow-headers: *

POST
H2 204 collect
region1.analytics.google.com/g/ 0
246 B 134ms
48ms Ping
text/plain 2001:4860:4802:34::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://region1.analytics.google.com/g/collect?v=2&tid=G-QMES53K3Y2&gtm=45je3bt0v9101996448z872040694&_p=1701712254164&_gaz=1&gcd=11l1l1l1l1&dma_cps=sypham&dma=1&cid=1170303496.1701712255&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_s=1&dl=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fmysterious-team-bangladesh%2F&sid=1701712254&sct=1&seg=0&dr=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fmysterious-team-bangladesh%2F&dt=Demystifying%20Mysterious%20Team%20Bangladesh%20%7C%20Group-IB%20Blog&en=page_view&_fv=1&_nsi=1&_ss=1&tfd=1164
Requested by: Host: fhp-de-js.group-ib.com
URL: https://fhp-de-js.group-ib.com/d/bt-autoinject.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:34::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 04 Dec 2023 17:50:54 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.group-ib.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 collect
stats.g.doubleclick.net/g/ 0
255 B 148ms
47ms Ping
text/plain 2a00:1450:400c:c00::9a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://stats.g.doubleclick.net/g/collect?v=2&tid=G-QMES53K3Y2&cid=1170303496.1701712255&gtm=45je3bt0v9101996448z872040694&aip=1&dma=1&dma_cps=sypham&gcd=11l1l1l1l1
Requested by: Host: fhp-de-js.group-ib.com
URL: https://fhp-de-js.group-ib.com/d/bt-autoinject.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:400c:c00::9a Brussels, Belgium, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 04 Dec 2023 17:50:55 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.group-ib.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.de/ads/ 42 B
107 B 150ms
64ms Image
image/gif 2a00:1450:4001:803::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&tid=G-QMES53K3Y2&cid=1170303496.1701712255&gtm=45je3bt0v9101996448z872040694&aip=1&dma=1&dma_cps=sypham&gcd=11l1l1l1l1&z=1390744605

Requested by

Host: www.group-ib.com
URL: https://www.group-ib.com/blog/mysterious-team-bangladesh/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:803::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 04 Dec 2023 17:50:54 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK counters.gif
forms-eu1.hsforms.com/embed/v3/ 35 B
1016 B 375ms
75ms Image
image/gif 172.65.232.43
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://forms-eu1.hsforms.com/embed/v3/counters.gif?key=collected-forms-embed-js-form-bind&count=5

Requested by

Host: www.group-ib.com
URL: https://www.group-ib.com/blog/mysterious-team-bangladesh/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

172.65.232.43 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Date: Mon, 04 Dec 2023 17:50:54 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
X-Content-Type-Options: nosniff
CF-Cache-Status: DYNAMIC
x-evy-trace-route-service-name: envoyset-translator
X-HubSpot-Correlation-Id: fc357e18-22ce-4213-a385-a6c10920a5df
x-envoy-upstream-service-time: 2
Connection: keep-alive
alt-svc: h3=":443"; ma=86400
Content-Length: 35
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: fc357e18-22ce-4213-a385-a6c10920a5df
Server: cloudflare
X-Trace: 2BCFC03EFDAF645F67324EE5A72BA005FE31C0A137000000000000000000
Vary: origin
Content-Type: image/gif
x-evy-trace-virtual-host: all
x-evy-trace-served-by-pod: fra04/star-hubspot-td/envoy-proxy-7b5f5fb655-w5lj6
Access-Control-Expose-Headers: X-Origin-Hublet
Cache-Control: max-age=0, no-cache, no-store
Access-Control-Allow-Credentials: false
X-Robots-Tag: none
CF-RAY: 8305e4f8dccc4480-TXL

GET
H2 200 /
www.google.com/pagead/1p-user-list/10897073384/ 42 B
455 B 137ms
51ms Image
image/gif 2a00:1450:4001:831::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/10897073384/?random=1701712254421&cv=11&fst=1701709200000&bg=ffffff&guid=ON&async=1&gtm=45He3bt0v72040694&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fmysterious-team-bangladesh%2F&ref=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fmysterious-team-bangladesh%2F&frm=0&tiba=Demystifying%20Mysterious%20Team%20Bangladesh%20%7C%20Group-IB%20Blog&fmt=3&is_vtc=1&cid=CAQSGwDICaaNVzR3KmR44b96bV65aU4V1AybsI1YBg&random=3354763456&rmt_tld=0&ipr=y

Requested by

Host: www.group-ib.com
URL: https://www.group-ib.com/blog/mysterious-team-bangladesh/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 04 Dec 2023 17:50:54 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.de/pagead/1p-user-list/10897073384/ 42 B
455 B 75ms
52ms Image
image/gif 2a00:1450:4001:803::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/10897073384/?random=1701712254421&cv=11&fst=1701709200000&bg=ffffff&guid=ON&async=1&gtm=45He3bt0v72040694&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fmysterious-team-bangladesh%2F&ref=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fmysterious-team-bangladesh%2F&frm=0&tiba=Demystifying%20Mysterious%20Team%20Bangladesh%20%7C%20Group-IB%20Blog&fmt=3&is_vtc=1&cid=CAQSGwDICaaNVzR3KmR44b96bV65aU4V1AybsI1YBg&random=3354763456&rmt_tld=1&ipr=y

Requested by

Host: www.group-ib.com
URL: https://www.group-ib.com/blog/mysterious-team-bangladesh/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:803::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 04 Dec 2023 17:50:54 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

sync_cookie_image_finish
mc.yandex.ru/
Redirect Chain

https://mc.yandex.com/sync_cookie_image_check
https://mc.yandex.ru/sync_cookie_image_start?redirect_domain=mc.yandex.com&token=10207.Wa2_AhfpcgUjBPepgnSCMXAARjQHtAFKWmTv11Rckir7zXEeDcdxPdMv7wjh52Q9.JGoIlPHd6bbgrod-CfbqEatvUtA%2C
https://mc.yandex.com/sync_cookie_image_decide?token=10207.NT3pzKP472NtlUyoWc9cInPjZhu_ydXMrW9RDj2HBU1aQ2ML-Z570BlcmCAYZ9xiCwTZT41PRFkfb2YAExWQaktq5Lt5D6inn2_j4dZldJEINYAA3H6IfLmFUHuPixM-2uBrRSH5v4...
https://mc.yandex.ru/sync_cookie_image_finish?redirect_domain=mc.yandex.com&token=10207.QKeIpecQa_S-QKhdt8JF6n2_f1k0zg8MIpA9axFqsRuH8Awkr0O9mpldTU040XT15nFhv2yz8vbd_u3A39wtOVua_HpIH6_2qn8jcEJv8FmKT...

43 B
609 B

490ms
490ms

Image
image/gif

2a02:6b8::1:119
GLOBAL_DC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://mc.yandex.ru/sync_cookie_image_finish?redirect_domain=mc.yandex.com&token=10207.QKeIpecQa_S-QKhdt8JF6n2_f1k0zg8MIpA9axFqsRuH8Awkr0O9mpldTU040XT15nFhv2yz8vbd_u3A39wtOVua_HpIH6_2qn8jcEJv8FmKT4Ncdybh1tshr-YlUae_79BUHjwlzT9qQJSbK7S2G5UT0vgzqUtsQJhZ8p9PKsO2pn0tEgu5o1wPJX8ftoK8UK9HuB-J6MPCbz3QotGHcQ%2C%2C.EKI6e3HZtT_uWhYmb3GdSVloOjE%2C

Requested by

Host: www.group-ib.com
URL: https://www.group-ib.com/blog/mysterious-team-bangladesh/

Protocol

Server

2a02:6b8::1:119 Moscow, Russian Federation, ASN208722 (GLOBAL_DC, FI),

Reverse DNS

Software

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 17:50:55 GMT
strict-transport-security: max-age=31536000
content-length: 43
x-xss-protection: 1; mode=block
content-type: image/gif

Redirect headers

location: https://mc.yandex.ru/sync_cookie_image_finish?redirect_domain=mc.yandex.com&token=10207.QKeIpecQa_S-QKhdt8JF6n2_f1k0zg8MIpA9axFqsRuH8Awkr0O9mpldTU040XT15nFhv2yz8vbd_u3A39wtOVua_HpIH6_2qn8jcEJv8FmKT4Ncdybh1tshr-YlUae_79BUHjwlzT9qQJSbK7S2G5UT0vgzqUtsQJhZ8p9PKsO2pn0tEgu5o1wPJX8ftoK8UK9HuB-J6MPCbz3QotGHcQ%2C%2C.EKI6e3HZtT_uWhYmb3GdSVloOjE%2C
date: Mon, 04 Dec 2023 17:50:54 GMT
strict-transport-security: max-age=31536000
x-xss-protection: 1; mode=block

GET
H2 200 advert.gif
mc.yandex.com/metrika/ 43 B
476 B 77ms
77ms Image
image/gif 2a02:6b8::1:119
GLOBAL_DC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://mc.yandex.com/metrika/advert.gif

Requested by

Host: www.group-ib.com
URL: https://www.group-ib.com/blog/mysterious-team-bangladesh/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:6b8::1:119 Moscow, Russian Federation, ASN208722 (GLOBAL_DC, FI),

Reverse DNS

Software

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 17:50:54 GMT
strict-transport-security: max-age=31536000
last-modified: Mon, 04 Dec 2023 12:19:38 GMT
accept-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
etag: "656dc3da-2b"
content-type: image/gif
access-control-allow-origin: *
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 43
expires: Mon, 04 Dec 2023 18:50:54 GMT

GET
H/1.1 200
OK counters.gif
perf-eu1.hsforms.com/embed/v3/ 35 B
1 KB 178ms
105ms Image
image/gif 172.65.232.43
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://perf-eu1.hsforms.com/embed/v3/counters.gif?key=config-loaded-success&value=1

Requested by

Host: www.group-ib.com
URL: https://www.group-ib.com/blog/mysterious-team-bangladesh/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

172.65.232.43 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Date: Mon, 04 Dec 2023 17:50:54 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
X-Content-Type-Options: nosniff
CF-Cache-Status: MISS
x-evy-trace-route-service-name: envoyset-translator
X-HubSpot-Correlation-Id: c9f6dd71-0eb4-420d-a8f2-e9afebf117a1
x-envoy-upstream-service-time: 4
Connection: keep-alive
alt-svc: h3=":443"; ma=86400
Content-Length: 35
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: c9f6dd71-0eb4-420d-a8f2-e9afebf117a1
Last-Modified: Mon, 04 Dec 2023 17:50:54 GMT
Server: cloudflare
X-Trace: 2B160B9D007DE0B55E19BB7DAD5215F2602E28201C000000000000000000
Vary: origin, Accept-Encoding
Content-Type: image/gif
x-evy-trace-virtual-host: all
x-evy-trace-served-by-pod: fra04/star-hubspot-td/envoy-proxy-7b5f5fb655-hfvq9
Access-Control-Expose-Headers: X-Origin-Hublet
Cache-Control: max-age=0, no-cache, no-store
Access-Control-Allow-Credentials: false
Accept-Ranges: bytes
X-Robots-Tag: none
CF-RAY: 8305e4f83b06aca7-TXL

GET
H2 200 rp.gif
alb.reddit.com/ 42 B
637 B 138ms
39ms Image
image/gif 151.101.193.140
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://alb.reddit.com/rp.gif?ts=1701712254621&id=a2_du2owjr6f67j&event=PageVisit&m.itemCount=undefined&m.value=&m.valueDecimal=undefined&m.currency=undefined&m.transactionId=&m.customEventName=&m.products=&m.conversionId=&uuid=38c9c39b-84de-45fa-9b1d-ecaab6d231df&aaid=&em=&external_id=&idfa=&integration=gtm&opt_out=0&sh=1600&sw=1200&v=rdt_f5bd31b2
Requested by: Host: www.group-ib.com
URL: https://www.group-ib.com/blog/mysterious-team-bangladesh/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.193.140 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: Varnish /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 17:50:54 GMT
via: 1.1 varnish
nel: {"report_to": "w3-reporting-nel", "max_age": 14400, "include_subdomains": false, "success_fraction": 0.3, "failure_fraction": 0.3}
server: Varnish
report-to: {"group": "w3-reporting-nel", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-nel.reddit.com/reports" }]}, {"group": "w3-reporting", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting.reddit.com/reports" }]}, {"group": "w3-reporting-csp", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-csp.reddit.com/reports" }]}
content-type: image/gif
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
content-length: 42
retry-after: 0

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 228 KB
79 KB 53ms
53ms Script
application/javascript 2a00:1450:4001:80f::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-10882981508

Requested by

Host: js-eu1.hsadspixel.net
URL: https://js-eu1.hsadspixel.net/fb.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

3b89c7709eff11ca263bf5a2ffeadefd1c12262d87f390d7d4fab229c20bd2d4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 17:50:54 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 80796
x-xss-protection: 0
last-modified: Mon, 04 Dec 2023 15:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Mon, 04 Dec 2023 17:50:54 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 228 KB
79 KB 53ms
53ms Script
application/javascript 2a00:1450:4001:80f::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-10882981508&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-PW7265

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

8c38ffa74ea0e988e8790a28ba10abce98189330ddaa9e307263b574153557de

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 17:50:54 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 80931
x-xss-protection: 0
last-modified: Mon, 04 Dec 2023 15:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Mon, 04 Dec 2023 17:50:54 GMT

GET
H2 200 / Show response
c.6sc.co/ 7 B
194 B 66ms
39ms XHR
text/html 2.17.100.193
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://c.6sc.co/
Requested by: Host: fhp-de-js.group-ib.com
URL: https://fhp-de-js.group-ib.com/d/bt-autoinject.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2.17.100.193 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a2-17-100-193.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: fe04a9dc88d3f3be8d4f6bc63a9a80f45a4c6d8460e7551dab849457c091920a

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 17:50:54 GMT
access-control-max-age: 86400
access-control-allow-methods: GET,POST
content-type: text/html
access-control-allow-origin: https://www.group-ib.com
access-control-allow-credentials: true
access-control-allow-headers: *
content-length: 7

GET
H2 200 / Show response
ipv6.6sc.co/ 19 B
310 B 173ms
40ms XHR
text/html 2a02:26f0:480:21::217:d11c
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://ipv6.6sc.co/
Requested by: Host: fhp-de-js.group-ib.com
URL: https://fhp-de-js.group-ib.com/d/bt-autoinject.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:480:21::217:d11c Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: /
Resource Hash: d5792801335f11b32a948d51b64bb655b16f8767f5837f2be4c406715994752f

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 04 Dec 2023 17:50:54 GMT
vary: Origin
content-type: text/html
access-control-allow-origin: https://www.group-ib.com
cache-control: max-age=0, no-cache, no-store
6si-ipv6: 2a01:4a0:1338:92::7
server-timing: cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="1701712254724_389993820_1168410671_19_758_38_78_219";dur=1
content-length: 19
expires: Mon, 04 Dec 2023 17:50:54 GMT

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
485 B 235ms
227ms Image
image/gif 2.17.100.193
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=e84d9c08a990af8592952e7ac9a983ad&svisitor=null&visitor=0c7d16f5-9eeb-4bee-8e53-71fc47d33801&session=9da7d173-35fd-4609-849d-30d4718c495f&event=a_pageload&q=%7B%22pageLoadTime%22%3A%22Mon%2C%2004%20Dec%202023%2017%3A50%3A54%20GMT%22%7D&isIframe=false&m=%7B%22description%22%3A%22Analysis%20of%20a%20highly%20active%20hacktivist%20group%20with%20global%20reach%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Demystifying%20Mysterious%20Team%20Bangladesh%20%7C%20Group-IB%20Blog%22%7D&cb=&r=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fmysterious-team-bangladesh%2F&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fmysterious-team-bangladesh%2F&pageViewId=fff47296-c36d-4664-8ae6-472dfcf47fd2&v=1.1.12

Requested by

Host: www.group-ib.com
URL: https://www.group-ib.com/blog/mysterious-team-bangladesh/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.17.100.193 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a2-17-100-193.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 17:50:54 GMT
x-content-type-options: nosniff
content-length: 43
pragma: no-cache
last-modified: Sat, 18 Feb 2023 02:04:22 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "63f03226-2b"
access-control-max-age: 86400
access-control-allow-methods: GET,POST
content-type: image/gif
access-control-allow-origin
cache-control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: *
expires: Wed, 19 Apr 2000 11:43:00 GMT

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
484 B 221ms
219ms Image
image/gif 2.17.100.193
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=e84d9c08a990af8592952e7ac9a983ad&svisitor=null&visitor=0c7d16f5-9eeb-4bee-8e53-71fc47d33801&session=9da7d173-35fd-4609-849d-30d4718c495f&event=ni%3AasyncSettingsAudit&q=%7B%22settings%22%3A%22%5B%7B%5C%22name%5C%22%3A%5C%22enableEventTracking%5C%22%2C%5C%22value%5C%22%3A%5C%22true%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Mon%2C%2004%20Dec%202023%2017%3A50%3A54%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setToken%5C%22%2C%5C%22value%5C%22%3A%5C%22e84d9c08a990af8592952e7ac9a983ad%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Mon%2C%2004%20Dec%202023%2017%3A50%3A54%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setEndpoint%5C%22%2C%5C%22value%5C%22%3A%5C%22b.6sc.co%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Mon%2C%2004%20Dec%202023%2017%3A50%3A54%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%5D%22%7D&isIframe=false&m=%7B%22description%22%3A%22Analysis%20of%20a%20highly%20active%20hacktivist%20group%20with%20global%20reach%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Demystifying%20Mysterious%20Team%20Bangladesh%20%7C%20Group-IB%20Blog%22%7D&cb=&r=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fmysterious-team-bangladesh%2F&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fmysterious-team-bangladesh%2F&pageViewId=fff47296-c36d-4664-8ae6-472dfcf47fd2&v=1.1.12

Requested by

Host: www.group-ib.com
URL: https://www.group-ib.com/blog/mysterious-team-bangladesh/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.17.100.193 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a2-17-100-193.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 17:50:54 GMT
x-content-type-options: nosniff
content-length: 43
pragma: no-cache
last-modified: Sat, 18 Feb 2023 00:49:36 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "63f020a0-2b"
access-control-max-age: 86400
access-control-allow-methods: GET,POST
content-type: image/gif
access-control-allow-origin
cache-control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: *
expires: Wed, 19 Apr 2000 11:43:00 GMT

GET
H2 200 649324202964935 Show response
connect.facebook.net/signals/config/ 143 KB
37 KB 174ms
173ms Script
application/x-javascript 2a03:2880:f084:d:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/649324202964935?v=2.9.138&r=stable&domain=www.group-ib.com

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f084:d:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

0a014f28d198eaf2dbc55fd97dcde352e47f6519bccd6f2570e3d8f1874ab5bf

Security Headers

Name	Value
Content-Security-Policy	default-src facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com data: blob: 'self';script-src .fbcdn.net .facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

permissions-policy-report-only: autoplay=(), clipboard-read=(), clipboard-write=(), display-capture=(), document-domain=(), encrypted-media=(), fullscreen=(), gamepad=(), keyboard-map=(), otp-credentials=(), picture-in-picture=(), xr-spatial-tracking=()
content-security-policy: default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script';
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; preload; includeSubDomains
date: Mon, 04 Dec 2023 17:50:54 GMT
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
x-xss-protection: 0
reporting-endpoints
pragma: public
x-fb-debug: Rr+zbAmOxxr4vFJvetG0yAYUt9bH0KADBeoM1yi3RQt3Cmo6zFk/UBJjAtYm4EJak43QyoNF0r6tqGaExAYLxw==
cross-origin-opener-policy: same-origin-allow-popups
vary: Accept-Encoding
x-frame-options: DENY
content-type: application/x-javascript; charset=utf-8
origin-agent-cluster: ?0
cache-control: public, max-age=1200
permissions-policy: accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), payment=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), usb=(), window-management=()
timing-allow-origin: *
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 notify Show response
api.neverbounce.com/v4/poe/ 63 B
282 B 520ms
233ms Script
application/javascript 54.162.203.31
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://api.neverbounce.com/v4/poe/notify?key=public_feedec8c69cd171b06421bb96273f04d&event=form.load&callback=__neverbounce_934110

Requested by

Host: cdn.neverbounce.com
URL: https://cdn.neverbounce.com/widget/dist/NeverBounce.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.162.203.31 , United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-54-162-203-31.compute-1.amazonaws.com

Software

nginx /

Resource Hash

e081385f59556e1cdd1140baf274cacc7ebb87fd4e5824e442123dd94f277728

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 17:50:55 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
server: nginx
vary: Accept-Encoding
content-type: application/javascript
cache-control: no-cache, private
x-ua-compatible: IE=Edge

GET
H2 200 notify Show response
api.neverbounce.com/v4/poe/ 63 B
282 B 429ms
142ms Script
application/javascript 54.162.203.31
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://api.neverbounce.com/v4/poe/notify?key=public_feedec8c69cd171b06421bb96273f04d&event=form.load&callback=__neverbounce_886592

Requested by

Host: cdn.neverbounce.com
URL: https://cdn.neverbounce.com/widget/dist/NeverBounce.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.162.203.31 , United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-54-162-203-31.compute-1.amazonaws.com

Software

nginx /

Resource Hash

42489ab0f577fc0c843c768c547a6e38de1b2f757cab60e40afc39191d987012

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 17:50:55 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
server: nginx
vary: Accept-Encoding
content-type: application/javascript
cache-control: no-cache, private
x-ua-compatible: IE=Edge

GET
H2 200 notify Show response
api.neverbounce.com/v4/poe/ 63 B
282 B 414ms
141ms Script
application/javascript 54.162.203.31
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://api.neverbounce.com/v4/poe/notify?key=public_feedec8c69cd171b06421bb96273f04d&event=form.load&callback=__neverbounce_196395

Requested by

Host: cdn.neverbounce.com
URL: https://cdn.neverbounce.com/widget/dist/NeverBounce.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.162.203.31 , United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-54-162-203-31.compute-1.amazonaws.com

Software

nginx /

Resource Hash

26072689d9b79057ae71910b8718c5e69165fc90dcafadb3cd332fe89c963d0f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 17:50:55 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
server: nginx
vary: Accept-Encoding
content-type: application/javascript
cache-control: no-cache, private
x-ua-compatible: IE=Edge

GET
H2 200 notify Show response
api.neverbounce.com/v4/poe/ 63 B
282 B 400ms
145ms Script
application/javascript 54.162.203.31
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://api.neverbounce.com/v4/poe/notify?key=public_feedec8c69cd171b06421bb96273f04d&event=form.load&callback=__neverbounce_538465

Requested by

Host: cdn.neverbounce.com
URL: https://cdn.neverbounce.com/widget/dist/NeverBounce.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.162.203.31 , United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-54-162-203-31.compute-1.amazonaws.com

Software

nginx /

Resource Hash

c5c67648fffd349f954ede67a063af9dc8fdd50c87e04d68adcc832761627167

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 17:50:55 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
server: nginx
vary: Accept-Encoding
content-type: application/javascript
cache-control: no-cache, private
x-ua-compatible: IE=Edge

GET
H2 200 notify Show response
api.neverbounce.com/v4/poe/ 63 B
283 B 299ms
133ms Script
application/javascript 54.162.203.31
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://api.neverbounce.com/v4/poe/notify?key=public_feedec8c69cd171b06421bb96273f04d&event=form.load&callback=__neverbounce_351829

Requested by

Host: cdn.neverbounce.com
URL: https://cdn.neverbounce.com/widget/dist/NeverBounce.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.162.203.31 , United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-54-162-203-31.compute-1.amazonaws.com

Software

nginx /

Resource Hash

cdb4fe28f69f85faeb237ff5f558b7b0b38c82d1c6af730e8c2a7d7ba2292613

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 17:50:55 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
server: nginx
vary: Accept-Encoding
content-type: application/javascript
cache-control: no-cache, private
x-ua-compatible: IE=Edge

POST
H2 200 fl Show response
www.group-ib.com/api/ 685 B
972 B 130ms
130ms XHR
application/json 3.72.181.255
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://www.group-ib.com/api/fl?u=0085cb90-831e-11ee-9493-816cec585ffa&cfidsgib-w-61354c22-16cc-40a8-a871-6901f1a76e24=gWbxlrLDMmBymE94zP%2F4WgS7CpNy6cvHwYiz13qqviR6V42ky1L62Ma3imrd2ApNEcWa3eQ9KnxmiJAdu6e6Mw%2BJlpa%2BLw5RrNM25W6nu5t3jOz4Pmt3A5JENoesWvIjynaHm%2F2dLJHZLAKiqBGRnlashT5J67qwXVgJ
Requested by: Host: fhp-de-js.group-ib.com
URL: https://fhp-de-js.group-ib.com/d/bt-autoinject.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.72.181.255 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-72-181-255.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: c2c98193ecfdb61233be8d5f0fd21d8e6a105c9dbe0f26ac48b49d2015bf78c6

Request headers

X-GIB-GSSCgib-w-61354c22-16cc-40a8-a871-6901f1a76e24: sxsI3tU+aBRp197QqKkn36zIuMiLlU5uM3+dep24LxE8Jh38uUb9LN5xIKHFN0SWEQ3ljslFywQGsCwPyXlu20z9j4yRmrYXFpFw1WCf9kNjeTd86auGCaKAV7sKVrc8AjuLsETzM4sWbdePNDEX0BANLuCA3jRjj4iEDIUjYApxD4XXGiTd+zj+7/N+F1Pp7PtEEP866TPCJFOU91Sgfd3Hqvd/eJ+LXrbXzWCEm9x4ltsP0BEUVT5iVMxhSpzhbQ==
Referer: https://www.group-ib.com/blog/mysterious-team-bangladesh/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
X-GIB-FGSSCgib-w-61354c22-16cc-40a8-a871-6901f1a76e24: jzrf7dce698902a070b5e2a3a0744d4bd5364060
Content-Type: text/plain;charset=UTF-8

Response headers

date: Mon, 04 Dec 2023 17:50:54 GMT
content-encoding: gzip
server: nginx
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/json; charset=utf-8
access-control-allow-origin: https://www.group-ib.com
cache-control: no-store
access-control-allow-credentials: true
x-envoy-upstream-service-time: 4
access-control-allow-headers: Accept,DNT,Keep-Alive,User-Agent,If-Modified-Since,Cache-Control,Content-Type,Origin,ETag,If-None-Match,X-Cfids,Authorization

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/10882981508/ 3 KB
2 KB 52ms
52ms Script
text/javascript 2a00:1450:4001:801::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/10882981508/?random=1701712254778&cv=11&fst=1701712254778&bg=ffffff&guid=ON&async=1&gtm=45be3bt0&gcd=11l1l1l1l1&dma_cps=sypham&dma=1&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fmysterious-team-bangladesh%2F&ref=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fmysterious-team-bangladesh%2F&hn=www.googleadservices.com&frm=0&tiba=Demystifying%20Mysterious%20Team%20Bangladesh%20%7C%20Group-IB%20Blog&did=dZTQ1Zm&gdid=dZTQ1Zm&auid=976693889.1701712254&uamb=0&uaw=0&data=event%3Dgtag.config&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-10882981508

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

36052f59be8e5a3e17205937fd21871fb3126b984f23db6eabe6f9339c7fe58c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 04 Dec 2023 17:50:54 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1320
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
484 B 229ms
229ms Image
image/gif 2.17.100.193
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=e84d9c08a990af8592952e7ac9a983ad&svisitor=null&visitor=0c7d16f5-9eeb-4bee-8e53-71fc47d33801&session=9da7d173-35fd-4609-849d-30d4718c495f&event=ipv6&q=%7B%22address%22%3A%222a01%3A4a0%3A1338%3A92%3A%3A7%22%7D&isIframe=false&m=%7B%22description%22%3A%22Analysis%20of%20a%20highly%20active%20hacktivist%20group%20with%20global%20reach%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Demystifying%20Mysterious%20Team%20Bangladesh%20%7C%20Group-IB%20Blog%22%7D&cb=&r=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fmysterious-team-bangladesh%2F&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fmysterious-team-bangladesh%2F&pageViewId=fff47296-c36d-4664-8ae6-472dfcf47fd2&v=1.1.12

Requested by

Host: www.group-ib.com
URL: https://www.group-ib.com/blog/mysterious-team-bangladesh/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.17.100.193 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a2-17-100-193.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 17:50:55 GMT
x-content-type-options: nosniff
content-length: 43
pragma: no-cache
last-modified: Fri, 21 Feb 2020 18:57:20 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "5e502810-2b"
access-control-max-age: 86400
access-control-allow-methods: GET,POST
content-type: image/gif
access-control-allow-origin
cache-control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: *
expires: Wed, 19 Apr 2000 11:43:00 GMT

GET
H2 200 /
www.google.com/pagead/1p-user-list/10882981508/ 42 B
108 B 52ms
51ms Image
image/gif 2a00:1450:4001:831::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/10882981508/?random=1701712254778&cv=11&fst=1701709200000&bg=ffffff&guid=ON&async=1&gtm=45be3bt0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fmysterious-team-bangladesh%2F&ref=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fmysterious-team-bangladesh%2F&frm=0&tiba=Demystifying%20Mysterious%20Team%20Bangladesh%20%7C%20Group-IB%20Blog&data=event%3Dgtag.config&fmt=3&is_vtc=1&cid=CAQSKQDICaaNF6hEsC6vY0FfYvyfLI1LmWBCkhC-0aC9Mfh543f5LN2vl9NF&random=399711802&rmt_tld=0&ipr=y

Requested by

Host: www.group-ib.com
URL: https://www.group-ib.com/blog/mysterious-team-bangladesh/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 04 Dec 2023 17:50:54 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.de/pagead/1p-user-list/10882981508/ 42 B
108 B 52ms
52ms Image
image/gif 2a00:1450:4001:803::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/10882981508/?random=1701712254778&cv=11&fst=1701709200000&bg=ffffff&guid=ON&async=1&gtm=45be3bt0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fmysterious-team-bangladesh%2F&ref=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fmysterious-team-bangladesh%2F&frm=0&tiba=Demystifying%20Mysterious%20Team%20Bangladesh%20%7C%20Group-IB%20Blog&data=event%3Dgtag.config&fmt=3&is_vtc=1&cid=CAQSKQDICaaNF6hEsC6vY0FfYvyfLI1LmWBCkhC-0aC9Mfh543f5LN2vl9NF&random=399711802&rmt_tld=1&ipr=y

Requested by

Host: www.group-ib.com
URL: https://www.group-ib.com/blog/mysterious-team-bangladesh/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:803::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 04 Dec 2023 17:50:54 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.facebook.com/tr/ 0
185 B 120ms
39ms Image
text/plain 2a03:2880:f177:185:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=649324202964935&ev=PageView&dl=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fmysterious-team-bangladesh%2F&rl=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fmysterious-team-bangladesh%2F&if=false&ts=1701712254854&sw=1600&sh=1200&v=2.9.138&r=stable&ec=0&o=4126&fbp=fb.1.1701712254853.1974125246&cs_est=true&it=1701712254658&coo=false&rqm=GET

Requested by

Host: www.group-ib.com
URL: https://www.group-ib.com/blog/mysterious-team-bangladesh/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f177:185:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
date: Mon, 04 Dec 2023 17:50:55 GMT
server: proxygen-bolt
content-type: text/plain
access-control-allow-origin
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 0

GET
H2

200

1 Show response
mc.yandex.com/watch/26812653/
Redirect Chain

https://mc.yandex.com/watch/26812653?wmode=7&page-url=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fmysterious-team-bangladesh%2F&charset=utf-8&site-info=%7B%22shareVersion%22%3A2%2C%22strategy%22%3A%22d...
https://mc.yandex.com/watch/26812653/1?wmode=7&page-url=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fmysterious-team-bangladesh%2F&charset=utf-8&site-info=%7B%22shareVersion%22%3A2%2C%22strategy%22%3A%2...

427 B
519 B

80ms
80ms

Fetch
application/json

2a02:6b8::1:119
GLOBAL_DC

General

Check archive.org

Show headers Download Go to

Full URL

https://mc.yandex.com/watch/26812653/1?wmode=7&page-url=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fmysterious-team-bangladesh%2F&charset=utf-8&site-info=%7B%22shareVersion%22%3A2%2C%22strategy%22%3A%22d%2Fn%2Fq%2Fr%2Fs%2Ft%22%7D&uah=chm%0A%3F0&browser-info=pv%3A1%3Avf%3Atuwae7cfavzq29du94ga6zf%3Afp%3A734%3Afu%3A1%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A1180%3Acn%3A1%3Adp%3A0%3Als%3A50131285524%3Ahid%3A851661035%3Az%3A60%3Ai%3A20231204185054%3Aet%3A1701712255%3Ac%3A1%3Arn%3A670515984%3Arqn%3A1%3Au%3A170171225517422594%3Aw%3A1600x1200%3As%3A1600x1200x24%3Ask%3A1%3Awv%3A2%3Ads%3A0%2C0%2C59%2C40%2C0%2C0%2C%2C707%2C2%2C%2C%2C%2C820%3Aco%3A0%3Acpf%3A1%3Ans%3A1701712253364%3Agi%3AR0ExLjEuMTE3MDMwMzQ5Ni4xNzAxNzEyMjU1%3Aadb%3A2%3Arqnl%3A1%3Ast%3A1701712255%3At%3ADemystifying%20Mysterious%20Team%20Bangladesh%20%7C%20Group-IB%20Blog&t=gdpr%2814%29clc%280-0-0%29rqnt%281%29aw%281%29ti%281%29

Requested by

Host: www.group-ib.com
URL: https://www.group-ib.com/blog/mysterious-team-bangladesh/

Protocol

Server

2a02:6b8::1:119 Moscow, Russian Federation, ASN208722 (GLOBAL_DC, FI),

Reverse DNS

Software

Resource Hash

1d77c70aaafb858b17e26f0064114d407897297f4706605988ee12320817e191

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 04 Dec 2023 17:50:55 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
last-modified: Mon, 04-Dec-2023 17:50:55 GMT
accept-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
content-type: application/json; charset=utf-8
access-control-allow-origin: https://www.group-ib.com
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 427
x-xss-protection: 1; mode=block
expires: Mon, 04-Dec-2023 17:50:55 GMT

Redirect headers

pragma: no-cache
date: Mon, 04 Dec 2023 17:50:55 GMT
strict-transport-security: max-age=31536000
last-modified: Mon, 04-Dec-2023 17:50:55 GMT
accept-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
location: /watch/26812653/1?wmode=7&page-url=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fmysterious-team-bangladesh%2F&charset=utf-8&site-info=%7B%22shareVersion%22%3A2%2C%22strategy%22%3A%22d%2Fn%2Fq%2Fr%2Fs%2Ft%22%7D&uah=chm%0A%3F0&browser-info=pv%3A1%3Avf%3Atuwae7cfavzq29du94ga6zf%3Afp%3A734%3Afu%3A1%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A1180%3Acn%3A1%3Adp%3A0%3Als%3A50131285524%3Ahid%3A851661035%3Az%3A60%3Ai%3A20231204185054%3Aet%3A1701712255%3Ac%3A1%3Arn%3A670515984%3Arqn%3A1%3Au%3A170171225517422594%3Aw%3A1600x1200%3As%3A1600x1200x24%3Ask%3A1%3Awv%3A2%3Ads%3A0%2C0%2C59%2C40%2C0%2C0%2C%2C707%2C2%2C%2C%2C%2C820%3Aco%3A0%3Acpf%3A1%3Ans%3A1701712253364%3Agi%3AR0ExLjEuMTE3MDMwMzQ5Ni4xNzAxNzEyMjU1%3Aadb%3A2%3Arqnl%3A1%3Ast%3A1701712255%3At%3ADemystifying%20Mysterious%20Team%20Bangladesh%20%7C%20Group-IB%20Blog&t=gdpr%2814%29clc%280-0-0%29rqnt%281%29aw%281%29ti%281%29
access-control-allow-origin: https://www.group-ib.com
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
x-xss-protection: 1; mode=block
expires: Mon, 04-Dec-2023 17:50:55 GMT

POST
H2 200 1
mc.yandex.com/watch/26812653/ 43 B
0 220ms
220ms Fetch
image/gif 2a02:6b8::1:119
GLOBAL_DC

General

Check archive.org

Show headers Download Go to

Full URL

https://mc.yandex.com/watch/26812653/1?page-url=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fmysterious-team-bangladesh%2F&charset=utf-8&uah=chm%0A%3F0&hittoken=1701712255_421d55599be9dd72901d83bed91616bf6b912eda0fdeb599f791f84cd24c86a1&browser-info=pa%3A1%3Aar%3A1%3Avf%3Atuwae7cfavzq29du94ga6zf%3Afu%3A1%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A1180%3Acn%3A1%3Adp%3A1%3Als%3A50131285524%3Ahid%3A851661035%3Az%3A60%3Ai%3A20231204185055%3Aet%3A1701712256%3Ac%3A1%3Arn%3A810587919%3Arqn%3A2%3Au%3A170171225517422594%3Aw%3A1600x1200%3As%3A1600x1200x24%3Ask%3A1%3Awv%3A2%3Aco%3A0%3Acpf%3A1%3Ans%3A1701712253364%3Agi%3AR0ExLjEuMTE3MDMwMzQ5Ni4xNzAxNzEyMjU1%3Aadb%3A2%3Arqnl%3A1%3Ast%3A1701712256&t=gdpr(14)mc(p-3)clc(0-0-0)rqnt(2)aw(1)ti(1)

Requested by

Host: fhp-de-js.group-ib.com
URL: https://fhp-de-js.group-ib.com/d/bt-autoinject.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:6b8::1:119 Moscow, Russian Federation, ASN208722 (GLOBAL_DC, FI),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.group-ib.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

pragma: no-cache
date: Mon, 04 Dec 2023 17:50:55 GMT
strict-transport-security: max-age=31536000
last-modified: Mon, 04-Dec-2023 17:50:55 GMT
accept-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
content-type: image/gif
access-control-allow-origin: https://www.group-ib.com
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 43
x-xss-protection: 1; mode=block
expires: Mon, 04-Dec-2023 17:50:55 GMT

POST
H2 200 1
mc.yandex.com/watch/26812653/ 43 B
0 84ms
83ms Fetch
image/gif 2a02:6b8::1:119
GLOBAL_DC

General

Check archive.org

Show headers Download Go to

Full URL

https://mc.yandex.com/watch/26812653/1?page-url=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fmysterious-team-bangladesh%2F&charset=utf-8&uah=chm%0A%3F0&hittoken=1701712255_421d55599be9dd72901d83bed91616bf6b912eda0fdeb599f791f84cd24c86a1&browser-info=pa%3A1%3Aar%3A1%3Avf%3Atuwae7cfavzq29du94ga6zf%3Afu%3A1%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A1180%3Acn%3A1%3Adp%3A1%3Als%3A50131285524%3Ahid%3A851661035%3Az%3A60%3Ai%3A20231204185055%3Aet%3A1701712256%3Ac%3A1%3Arn%3A810754633%3Arqn%3A3%3Au%3A170171225517422594%3Aw%3A1600x1200%3As%3A1600x1200x24%3Ask%3A1%3Awv%3A2%3Aco%3A0%3Acpf%3A1%3Ans%3A1701712253364%3Agi%3AR0ExLjEuMTE3MDMwMzQ5Ni4xNzAxNzEyMjU1%3Aadb%3A2%3Arqnl%3A1%3Ast%3A1701712256&t=gdpr(14)mc(p-3)clc(0-0-0)rqnt(3)aw(1)ti(1)

Requested by

Host: fhp-de-js.group-ib.com
URL: https://fhp-de-js.group-ib.com/d/bt-autoinject.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:6b8::1:119 Moscow, Russian Federation, ASN208722 (GLOBAL_DC, FI),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.group-ib.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

pragma: no-cache
date: Mon, 04 Dec 2023 17:50:55 GMT
strict-transport-security: max-age=31536000
last-modified: Mon, 04-Dec-2023 17:50:55 GMT
accept-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
content-type: image/gif
access-control-allow-origin: https://www.group-ib.com
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 43
x-xss-protection: 1; mode=block
expires: Mon, 04-Dec-2023 17:50:55 GMT

POST
H2 200 1
mc.yandex.com/watch/26812653/ 43 B
0 82ms
81ms Fetch
image/gif 2a02:6b8::1:119
GLOBAL_DC

General

Check archive.org

Show headers Download Go to

Full URL

https://mc.yandex.com/watch/26812653/1?page-url=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fmysterious-team-bangladesh%2F&charset=utf-8&uah=chm%0A%3F0&hittoken=1701712255_421d55599be9dd72901d83bed91616bf6b912eda0fdeb599f791f84cd24c86a1&browser-info=pa%3A1%3Aar%3A1%3Avf%3Atuwae7cfavzq29du94ga6zf%3Afu%3A1%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A1180%3Acn%3A1%3Adp%3A1%3Als%3A50131285524%3Ahid%3A851661035%3Az%3A60%3Ai%3A20231204185055%3Aet%3A1701712256%3Ac%3A1%3Arn%3A481655928%3Arqn%3A4%3Au%3A170171225517422594%3Aw%3A1600x1200%3As%3A1600x1200x24%3Ask%3A1%3Awv%3A2%3Aco%3A0%3Acpf%3A1%3Ans%3A1701712253364%3Agi%3AR0ExLjEuMTE3MDMwMzQ5Ni4xNzAxNzEyMjU1%3Aadb%3A2%3Arqnl%3A1%3Ast%3A1701712256&t=gdpr(14)mc(p-3)clc(0-0-0)rqnt(4)aw(1)ti(1)

Requested by

Host: fhp-de-js.group-ib.com
URL: https://fhp-de-js.group-ib.com/d/bt-autoinject.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:6b8::1:119 Moscow, Russian Federation, ASN208722 (GLOBAL_DC, FI),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.group-ib.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

pragma: no-cache
date: Mon, 04 Dec 2023 17:50:55 GMT
strict-transport-security: max-age=31536000
last-modified: Mon, 04-Dec-2023 17:50:55 GMT
accept-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
content-type: image/gif
access-control-allow-origin: https://www.group-ib.com
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 43
x-xss-protection: 1; mode=block
expires: Mon, 04-Dec-2023 17:50:55 GMT

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
484 B 239ms
238ms Image
image/gif 2.17.100.193
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=e84d9c08a990af8592952e7ac9a983ad&svisitor=null&visitor=0c7d16f5-9eeb-4bee-8e53-71fc47d33801&session=9da7d173-35fd-4609-849d-30d4718c495f&event=active_time_track&q=%7B%22currentTime%22%3A%22Mon%2C%2004%20Dec%202023%2017%3A50%3A55%20GMT%22%2C%22lastTrackTime%22%3A%22Mon%2C%2004%20Dec%202023%2017%3A50%3A54%20GMT%22%2C%22timeSpent%22%3A%221002%22%2C%22totalTimeSpent%22%3A%221002%22%7D&isIframe=false&m=%7B%22description%22%3A%22Analysis%20of%20a%20highly%20active%20hacktivist%20group%20with%20global%20reach%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Demystifying%20Mysterious%20Team%20Bangladesh%20%7C%20Group-IB%20Blog%22%7D&cb=&r=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fmysterious-team-bangladesh%2F&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fmysterious-team-bangladesh%2F&pageViewId=fff47296-c36d-4664-8ae6-472dfcf47fd2&v=1.1.12

Requested by

Host: www.group-ib.com
URL: https://www.group-ib.com/blog/mysterious-team-bangladesh/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.17.100.193 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a2-17-100-193.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 17:50:55 GMT
x-content-type-options: nosniff
content-length: 43
pragma: no-cache
last-modified: Sat, 18 Feb 2023 00:49:36 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "63f020a0-2b"
access-control-max-age: 86400
access-control-allow-methods: GET,POST
content-type: image/gif
access-control-allow-origin
cache-control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: *
expires: Wed, 19 Apr 2000 11:43:00 GMT

POST
H2 200 fl Show response
www.group-ib.com/api/ 685 B
781 B 89ms
89ms XHR
application/json 3.72.181.255
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://www.group-ib.com/api/fl?u=0085cb90-831e-11ee-9493-816cec585ffa&cfidsgib-w-61354c22-16cc-40a8-a871-6901f1a76e24=VXdOQye8NBZ33uzGqjR9ywE%2BCNBeTNKcDtQHu9t8gcF6ikFnhyi7G%2BL4mcqoIGGngq%2BqqM1lLg%2FAEnNf74WXCCWkVqVpPhyg%2BtWPKTzC9%2B5dSFXMAioDTM5ehDZfme6oPFYYJT38oUG3x0mNn7nSeTKP95qQTYHYr5rO
Requested by: Host: fhp-de-js.group-ib.com
URL: https://fhp-de-js.group-ib.com/d/bt-autoinject.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.72.181.255 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-72-181-255.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 9796a93d50d319dfc65834b445458b00a7ebb95e1cedf5bc8d230e26e7b77447

Request headers

X-GIB-GSSCgib-w-61354c22-16cc-40a8-a871-6901f1a76e24: laPTxBzL6vWQbOYqwPeLuOShJ045LYjv3kZTziTkpqPOjGgQBrVc04E3YJBWMjPR6tvvAqdjj9jIOj8UJ1Yym2MKRsirzeamyINwJpW2cvSKS7VSpCdTpbC3y8/FJ9zOehz0wCsEIdiz8hxEK8TLS33nfSDRRc0B3bwvG1A3zXoARpwcC9pDjR1oplZm0I7S7u/Dhd+I4UrmTLxNkN0vSlRNv53HEsg56ud65X+L0KuMt2JA9gYOPQQgjEvxgTq8mhYYQ/s3nmF7utrxFB0=
Referer: https://www.group-ib.com/blog/mysterious-team-bangladesh/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
X-GIB-FGSSCgib-w-61354c22-16cc-40a8-a871-6901f1a76e24: sgyTbdeffa5b422475eeeec2db27cedbb5cc7842
Content-Type: text/plain;charset=UTF-8

Response headers

date: Mon, 04 Dec 2023 17:50:55 GMT
content-encoding: gzip
server: nginx
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/json; charset=utf-8
access-control-allow-origin: https://www.group-ib.com
cache-control: no-store
access-control-allow-credentials: true
x-envoy-upstream-service-time: 3
access-control-allow-headers: Accept,DNT,Keep-Alive,User-Agent,If-Modified-Since,Cache-Control,Content-Type,Origin,ETag,If-None-Match,X-Cfids,Authorization

GET
H3 200 709834390277869 Show response
connect.facebook.net/signals/config/ 140 KB
36 KB 209ms
209ms Script
application/x-javascript 2a03:2880:f084:d:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/709834390277869?v=2.9.138&r=stable&domain=www.group-ib.com

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f084:d:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

f5a5703710663d26cfdf94d6e3223d9a2be8979a603bb96e4779326277a230e3

Security Headers

Name	Value
Content-Security-Policy	default-src facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com data: blob: 'self';script-src .fbcdn.net .facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

permissions-policy-report-only: autoplay=(), clipboard-read=(), clipboard-write=(), display-capture=(), document-domain=(), encrypted-media=(), fullscreen=(), gamepad=(), keyboard-map=(), otp-credentials=(), picture-in-picture=(), xr-spatial-tracking=()
content-security-policy: default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script';
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; preload; includeSubDomains
date: Mon, 04 Dec 2023 17:50:56 GMT
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
x-xss-protection: 0
reporting-endpoints
pragma: public
x-fb-debug: GvZVSWU+oC/rP0epmxET+QVR9MFj7tEc3VyJKXwCl/CPdYveHcmNAaYsSNyrQb81WXrGOhbvN62nn2P5338FoA==
cross-origin-opener-policy: same-origin-allow-popups
vary: Accept-Encoding
x-frame-options: DENY
content-type: application/x-javascript; charset=utf-8
origin-agent-cluster: ?0
cache-control: public, max-age=1200
permissions-policy: accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), payment=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), usb=(), window-management=()
timing-allow-origin: *
priority: u=3,i
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 __ptq.gif
track-eu1.hubspot.com/ 45 B
633 B 409ms
128ms Image
image/gif 172.65.240.166

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://track-eu1.hubspot.com/__ptq.gif?k=1&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=en-us&bfp=881765916&v=1.1&a=25755956&rcu=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fmysterious-team-bangladesh%2F&r=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fmysterious-team-bangladesh%2F&pu=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fmysterious-team-bangladesh%2F&t=Demystifying+Mysterious+Team+Bangladesh+%7C+Group-IB+Blog&cts=1701712255894&vi=6d93314604d304ad303c8addd0328963&nc=true&u=84897990.6d93314604d304ad303c8addd0328963.1701712255892.1701712255892.1701712255892.1&b=84897990.1.1701712255893&cc=15

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.65.240.166 -, , ASN (),

Reverse DNS

Software

cloudflare /

Resource Hash

dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 17:50:56 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: MISS
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-evy-trace-route-service-name: envoyset-translator
x-hubspot-correlation-id: dbef9ff9-471b-49a2-adb2-44a4fc1240bb
p3p: CP="NOI CUR ADM OUR NOR STA NID"
x-envoy-upstream-service-time: 3
content-length: 45
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: dbef9ff9-471b-49a2-adb2-44a4fc1240bb
last-modified: Mon, 04 Dec 2023 17:50:56 GMT
server: cloudflare
vary: origin, Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=KKJqYUICfctUS7zy2fLiu%2F2WeYUKfQFr4uALJAHfyKmhyQWaay2AXcwhyAWeg4bb8mJFLhFHxVQDigyyLUm0mKVm0ZUst%2FhK0cRO4sYxgHSuM68lhY1mVsetdSMJR7ngBXcE0NSoWw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/gif
x-evy-trace-served-by-pod: fra04/analytics-tracking-td/envoy-proxy-85847fc4bc-p7l66
x-evy-trace-virtual-host: all
cache-control: no-cache, no-store, no-transform
access-control-allow-credentials: false
accept-ranges: bytes
cf-ray: 8305e5013f4e4528-TXL
x-robots-tag: none

GET
H2 200 __ptq.gif
track-eu1.hubspot.com/ 45 B
1 KB 364ms
105ms Image
image/gif 172.65.240.166

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://track-eu1.hubspot.com/__ptq.gif?k=15&fi=044e7558-8073-478a-ad3c-5807dd76840f&fci=502aefdd-d612-4dd9-ab5c-be6a0da8755f&ft=0&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=en-us&bfp=881765916&v=1.1&a=25755956&rcu=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fmysterious-team-bangladesh%2F&r=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fmysterious-team-bangladesh%2F&pu=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fmysterious-team-bangladesh%2F&t=Demystifying+Mysterious+Team+Bangladesh+%7C+Group-IB+Blog&cts=1701712255895&vi=6d93314604d304ad303c8addd0328963&nc=true&u=84897990.6d93314604d304ad303c8addd0328963.1701712255892.1701712255892.1701712255892.1&b=84897990.1.1701712255893&cc=15

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.65.240.166 -, , ASN (),

Reverse DNS

Software

cloudflare /

Resource Hash

dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 17:50:56 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: MISS
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-evy-trace-route-service-name: envoyset-translator
x-hubspot-correlation-id: 8d67ef89-1edd-4471-a110-3c4a5c2c324a
p3p: CP="NOI CUR ADM OUR NOR STA NID"
x-envoy-upstream-service-time: 2
content-length: 45
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: 8d67ef89-1edd-4471-a110-3c4a5c2c324a
last-modified: Mon, 04 Dec 2023 17:50:56 GMT
server: cloudflare
vary: origin, Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=EVAbAwvSCr%2Fs6m5%2FraXjUoJknPuM%2FZrZUABjL7aPNNOPfUPMZRfGd2dd9jM2msMpeptnJ58JqWGQ1hmce%2B506ubPT%2BkCEPs37UebgvXfq32CYX4LrN4JNW%2FRVdspzGAcx9H88nLoSg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/gif
x-evy-trace-served-by-pod: fra04/analytics-tracking-td/envoy-proxy-85847fc4bc-cssf6
x-evy-trace-virtual-host: all
cache-control: no-cache, no-store, no-transform
access-control-allow-credentials: false
accept-ranges: bytes
cf-ray: 8305e5013f534528-TXL
x-robots-tag: none

GET
H2 200 __ptq.gif
track-eu1.hubspot.com/ 45 B
740 B 414ms
159ms Image
image/gif 172.65.240.166

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://track-eu1.hubspot.com/__ptq.gif?k=15&fi=5a995f05-701c-48e3-b25a-d1548ba3c0b3&fci=e600ab1d-dadd-4078-81ed-316282dbca45&ft=0&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=en-us&bfp=881765916&v=1.1&a=25755956&rcu=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fmysterious-team-bangladesh%2F&r=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fmysterious-team-bangladesh%2F&pu=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fmysterious-team-bangladesh%2F&t=Demystifying+Mysterious+Team+Bangladesh+%7C+Group-IB+Blog&cts=1701712255896&vi=6d93314604d304ad303c8addd0328963&nc=true&u=84897990.6d93314604d304ad303c8addd0328963.1701712255892.1701712255892.1701712255892.1&b=84897990.1.1701712255893&cc=15

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.65.240.166 -, , ASN (),

Reverse DNS

Software

cloudflare /

Resource Hash

dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 17:50:56 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: MISS
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-evy-trace-route-service-name: envoyset-translator
x-hubspot-correlation-id: 438ed642-6385-467b-ab6e-bf6964e7fbfb
p3p: CP="NOI CUR ADM OUR NOR STA NID"
x-envoy-upstream-service-time: 6
content-length: 45
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: 438ed642-6385-467b-ab6e-bf6964e7fbfb
last-modified: Mon, 04 Dec 2023 17:50:56 GMT
server: cloudflare
vary: origin, Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=leG9ZHmhIOCepUKoZBhS1r5GdTI9ldiCEc%2BrTmGhltC8aocqayv9T50HubXDZKlIqXtA36MQBieiW1d%2BAB0cS0rZ%2B7Nfek9rRqQU7FrrlvmXy3Wfl0Iu6tRrKKVpIptxwxSZqFuAAg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/gif
x-evy-trace-served-by-pod: fra04/analytics-tracking-td/envoy-proxy-85847fc4bc-hskgp
x-evy-trace-virtual-host: all
cache-control: no-cache, no-store, no-transform
access-control-allow-credentials: false
accept-ranges: bytes
cf-ray: 8305e5013f554528-TXL
x-robots-tag: none

GET
H2 200 __ptq.gif
track-eu1.hubspot.com/ 45 B
1 KB 372ms
117ms Image
image/gif 172.65.240.166

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://track-eu1.hubspot.com/__ptq.gif?k=15&fi=4dbceae1-75ae-423a-9c12-dee8f1ca3345&fci=082803ef-05ef-43be-b00a-94df43024381&ft=0&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=en-us&bfp=881765916&v=1.1&a=25755956&rcu=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fmysterious-team-bangladesh%2F&r=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fmysterious-team-bangladesh%2F&pu=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fmysterious-team-bangladesh%2F&t=Demystifying+Mysterious+Team+Bangladesh+%7C+Group-IB+Blog&cts=1701712255896&vi=6d93314604d304ad303c8addd0328963&nc=true&u=84897990.6d93314604d304ad303c8addd0328963.1701712255892.1701712255892.1701712255892.1&b=84897990.1.1701712255893&cc=15

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.65.240.166 -, , ASN (),

Reverse DNS

Software

cloudflare /

Resource Hash

dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 17:50:56 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: MISS
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-evy-trace-route-service-name: envoyset-translator
x-hubspot-correlation-id: d035ac70-6426-4a56-ab55-e682981d7114
p3p: CP="NOI CUR ADM OUR NOR STA NID"
x-envoy-upstream-service-time: 2
content-length: 45
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: d035ac70-6426-4a56-ab55-e682981d7114
last-modified: Mon, 04 Dec 2023 17:50:56 GMT
server: cloudflare
vary: origin, Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=kTdqcBFv0nxTYrX95OCAFIsdVRXvalV%2Fm1l2v6lLe3OnHfs1683HgMi4GKTLVYjrmIPwdmZiFqMJZIaPLBK3X2gHqaroKnUeundwVZZypT2QeSlWD0xRsdBpXyLWQ6p7n1pUOBfBIg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/gif
x-evy-trace-served-by-pod: fra04/analytics-tracking-td/envoy-proxy-85847fc4bc-lkpgg
x-evy-trace-virtual-host: all
cache-control: no-cache, no-store, no-transform
access-control-allow-credentials: false
accept-ranges: bytes
cf-ray: 8305e5013f594528-TXL
x-robots-tag: none

GET
H2 200 __ptq.gif
track-eu1.hubspot.com/ 45 B
741 B 376ms
121ms Image
image/gif 172.65.240.166

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://track-eu1.hubspot.com/__ptq.gif?k=15&fi=55a22738-d5a5-43f9-9c1c-fa4c1a6eb349&fci=3d080251-9b54-477b-b8f1-3bd736b24517&ft=0&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=en-us&bfp=881765916&v=1.1&a=25755956&rcu=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fmysterious-team-bangladesh%2F&r=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fmysterious-team-bangladesh%2F&pu=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fmysterious-team-bangladesh%2F&t=Demystifying+Mysterious+Team+Bangladesh+%7C+Group-IB+Blog&cts=1701712255897&vi=6d93314604d304ad303c8addd0328963&nc=true&u=84897990.6d93314604d304ad303c8addd0328963.1701712255892.1701712255892.1701712255892.1&b=84897990.1.1701712255893&cc=15

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.65.240.166 -, , ASN (),

Reverse DNS

Software

cloudflare /

Resource Hash

dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 17:50:56 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: MISS
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-evy-trace-route-service-name: envoyset-translator
x-hubspot-correlation-id: f47e2b9a-2ae3-44b9-9f33-2230f8d65082
p3p: CP="NOI CUR ADM OUR NOR STA NID"
x-envoy-upstream-service-time: 6
content-length: 45
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: f47e2b9a-2ae3-44b9-9f33-2230f8d65082
last-modified: Mon, 04 Dec 2023 17:50:56 GMT
server: cloudflare
vary: origin, Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=5V8oxHEPSsIQCubek4KMgaM06B57mfAt3Yrk%2B%2F%2BwN5hy3nEFlIT10YAFYZZt4rwtkCotDWDaRD8cNti728gIHilPWWWYL9nS61nfRADahZAnsxnbGXjjjp3EH0Nr1offgjN23QVp7A%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/gif
x-evy-trace-served-by-pod: fra04/analytics-tracking-td/envoy-proxy-85847fc4bc-hskgp
x-evy-trace-virtual-host: all
cache-control: no-cache, no-store, no-transform
access-control-allow-credentials: false
accept-ranges: bytes
cf-ray: 8305e5013f5d4528-TXL
x-robots-tag: none

GET
H2 200 __ptq.gif
track-eu1.hubspot.com/ 45 B
745 B 361ms
106ms Image
image/gif 172.65.240.166

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://track-eu1.hubspot.com/__ptq.gif?k=17&fi=4dbceae1-75ae-423a-9c12-dee8f1ca3345&fci=082803ef-05ef-43be-b00a-94df43024381&ft=0&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=en-us&bfp=881765916&v=1.1&a=25755956&rcu=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fmysterious-team-bangladesh%2F&r=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fmysterious-team-bangladesh%2F&pu=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fmysterious-team-bangladesh%2F&t=Demystifying+Mysterious+Team+Bangladesh+%7C+Group-IB+Blog&cts=1701712255897&vi=6d93314604d304ad303c8addd0328963&nc=true&u=84897990.6d93314604d304ad303c8addd0328963.1701712255892.1701712255892.1701712255892.1&b=84897990.1.1701712255893&cc=15

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.65.240.166 -, , ASN (),

Reverse DNS

Software

cloudflare /

Resource Hash

dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 17:50:56 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: MISS
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-evy-trace-route-service-name: envoyset-translator
x-hubspot-correlation-id: 86eaadcb-b931-42da-8483-1616a99fabcd
p3p: CP="NOI CUR ADM OUR NOR STA NID"
x-envoy-upstream-service-time: 7
content-length: 45
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: 86eaadcb-b931-42da-8483-1616a99fabcd
last-modified: Mon, 04 Dec 2023 17:50:56 GMT
server: cloudflare
vary: origin, Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=XNTkuN3YDfxDZSa95Mu%2Bbh3MSNYRNzKywbHGjO4MHTCwQKssVYdInlgItIKFDzA8eeh1Er76wlX1XbZWOQQJs2FatImriJ25ggH%2BhCm2z%2BQMIaC4xFO5wZ%2F54i0ljMBoo9BgtKRw%2FA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/gif
x-evy-trace-served-by-pod: fra04/analytics-tracking-td/envoy-proxy-85847fc4bc-fcpg5
x-evy-trace-virtual-host: all
cache-control: no-cache, no-store, no-transform
access-control-allow-credentials: false
accept-ranges: bytes
cf-ray: 8305e5013f604528-TXL
x-robots-tag: none

GET
H2 200 __ptq.gif
track-eu1.hubspot.com/ 45 B
737 B 104ms
103ms Image
image/gif 172.65.240.166

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://track-eu1.hubspot.com/__ptq.gif?k=17&fi=5a995f05-701c-48e3-b25a-d1548ba3c0b3&fci=e600ab1d-dadd-4078-81ed-316282dbca45&ft=0&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=en-us&bfp=881765916&v=1.1&a=25755956&rcu=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fmysterious-team-bangladesh%2F&r=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fmysterious-team-bangladesh%2F&pu=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fmysterious-team-bangladesh%2F&t=Demystifying+Mysterious+Team+Bangladesh+%7C+Group-IB+Blog&cts=1701712255897&vi=6d93314604d304ad303c8addd0328963&nc=true&u=84897990.6d93314604d304ad303c8addd0328963.1701712255892.1701712255892.1701712255892.1&b=84897990.1.1701712255893&cc=15

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.65.240.166 -, , ASN (),

Reverse DNS

Software

cloudflare /

Resource Hash

dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 17:50:56 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: MISS
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-evy-trace-route-service-name: envoyset-translator
x-hubspot-correlation-id: 1b19c33f-57b1-4bda-a4c2-e3c4478b17f3
p3p: CP="NOI CUR ADM OUR NOR STA NID"
x-envoy-upstream-service-time: 2
content-length: 45
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: 1b19c33f-57b1-4bda-a4c2-e3c4478b17f3
last-modified: Mon, 04 Dec 2023 17:50:56 GMT
server: cloudflare
vary: origin, Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Mlu0i1W63K79rRHSNjRj6MVMLmip4EPBEmMzMtBScV7aLT77rJgtqsGdbSpCnCkjYbVLw8bHEQuOF690XY90S7EWDrVxFZHmcFTvLVrEmX%2BZAZuIXb%2FzVngshyKVzkKJw6cmqiQjQg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/gif
x-evy-trace-served-by-pod: fra04/analytics-tracking-td/envoy-proxy-85847fc4bc-snkl8
x-evy-trace-virtual-host: all
cache-control: no-cache, no-store, no-transform
access-control-allow-credentials: false
accept-ranges: bytes
cf-ray: 8305e5014f894528-TXL
x-robots-tag: none

GET
H2 200 __ptq.gif
track-eu1.hubspot.com/ 45 B
736 B 107ms
107ms Image
image/gif 172.65.240.166

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://track-eu1.hubspot.com/__ptq.gif?k=17&fi=044e7558-8073-478a-ad3c-5807dd76840f&fci=502aefdd-d612-4dd9-ab5c-be6a0da8755f&ft=0&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=en-us&bfp=881765916&v=1.1&a=25755956&rcu=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fmysterious-team-bangladesh%2F&r=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fmysterious-team-bangladesh%2F&pu=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fmysterious-team-bangladesh%2F&t=Demystifying+Mysterious+Team+Bangladesh+%7C+Group-IB+Blog&cts=1701712255898&vi=6d93314604d304ad303c8addd0328963&nc=true&u=84897990.6d93314604d304ad303c8addd0328963.1701712255892.1701712255892.1701712255892.1&b=84897990.1.1701712255893&cc=15

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.65.240.166 -, , ASN (),

Reverse DNS

Software

cloudflare /

Resource Hash

dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 17:50:56 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: MISS
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-evy-trace-route-service-name: envoyset-translator
x-hubspot-correlation-id: d17a53b7-28a0-4321-bc87-0d3c7f580e51
p3p: CP="NOI CUR ADM OUR NOR STA NID"
x-envoy-upstream-service-time: 3
content-length: 45
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: d17a53b7-28a0-4321-bc87-0d3c7f580e51
last-modified: Mon, 04 Dec 2023 17:50:56 GMT
server: cloudflare
vary: origin, Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=8CPrSZdjGnoX4w1It344jcI1fW8Gl61XBKm3O0IO2DnvFuzSr0rgVOGHVtjTxiVsJ0k%2BWphTh4brTprjTZDAcVybwoLjSnyezeH3%2FM6QaW7F1sRdFUoEEZiRMsthNAnkybPdw6JG4Q%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/gif
x-evy-trace-served-by-pod: fra04/analytics-tracking-td/envoy-proxy-85847fc4bc-2xhll
x-evy-trace-virtual-host: all
cache-control: no-cache, no-store, no-transform
access-control-allow-credentials: false
accept-ranges: bytes
cf-ray: 8305e5014f8f4528-TXL
x-robots-tag: none

GET
H2 200 __ptq.gif
track-eu1.hubspot.com/ 45 B
1 KB 116ms
115ms Image
image/gif 172.65.240.166

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://track-eu1.hubspot.com/__ptq.gif?k=15&fi=eb903dab-0ef3-43b5-bdeb-71372e6ad0f0&fci=9ccb7e5b-d3f8-4683-be26-f026731c2e04&ft=0&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=en-us&bfp=881765916&v=1.1&a=25755956&rcu=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fmysterious-team-bangladesh%2F&r=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fmysterious-team-bangladesh%2F&pu=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fmysterious-team-bangladesh%2F&t=Demystifying+Mysterious+Team+Bangladesh+%7C+Group-IB+Blog&cts=1701712255898&vi=6d93314604d304ad303c8addd0328963&nc=true&u=84897990.6d93314604d304ad303c8addd0328963.1701712255892.1701712255892.1701712255892.1&b=84897990.1.1701712255893&cc=15

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.65.240.166 -, , ASN (),

Reverse DNS

Software

cloudflare /

Resource Hash

dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 17:50:56 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: MISS
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-evy-trace-route-service-name: envoyset-translator
x-hubspot-correlation-id: 9911f224-1e22-4984-afe6-7c5389e48bd4
p3p: CP="NOI CUR ADM OUR NOR STA NID"
x-envoy-upstream-service-time: 2
content-length: 45
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: 9911f224-1e22-4984-afe6-7c5389e48bd4
last-modified: Mon, 04 Dec 2023 17:50:56 GMT
server: cloudflare
vary: origin, Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=xAQUgsQK45GUUzWCGT%2F2287z4r1Jk0BfmE96hY0QQVrdE6F16e1zWaFB5pBxYhsuri5rLpMOfVGmvouQrATVEGxMT5MLKVxbHcn5%2BsY9wAkQO87sKX12TJwaGLtmpswbnCpScswYpA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/gif
x-evy-trace-served-by-pod: fra04/analytics-tracking-td/envoy-proxy-85847fc4bc-wj4r4
x-evy-trace-virtual-host: all
cache-control: no-cache, no-store, no-transform
access-control-allow-credentials: false
accept-ranges: bytes
cf-ray: 8305e5016fe24528-TXL
x-robots-tag: none

GET
H2 200 facebook-64.svg
website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/socials/ 627 B
1 KB 69ms
68ms Image
image/svg+xml 2600:9000:2487:4000:9:7af6:1700:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/socials/facebook-64.svg

Requested by

Host: website.cdn.group-ib.com
URL: https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-blog-post.css?x18492

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2487:4000:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

f006e8bbfa4f0537780571436b5bed50ff10ff28759924c53b67732ec5af28ba

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self';
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-blog-post.css?x18492
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

content-security-policy: frame-ancestors 'self';
content-encoding: gzip
x-content-type-options: nosniff
date: Mon, 04 Dec 2023 17:50:55 GMT
via: 1.1 a3ffeedc8ed545612c2465ea4fb13fbe.cloudfront.net (CloudFront)
strict-transport-security: max-age=31536000; includeSubDomains
x-amz-cf-pop: LHR61-P3
x-cache: Miss from cloudfront
content-length: 376
x-xss-protection: 1; mode=block
referrer-policy: strict-origin-when-cross-origin
last-modified: Tue, 29 Nov 2022 07:39:21 GMT
server: nginx
etag: "273-5ee9716178eea-gzip"
x-frame-options: sameorigin
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: https://www.group-ib.com
cache-control: private, max-age=3600
permissions-policy: accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=()
accept-ranges: bytes
x-amz-cf-id: 38OBDMgHSngL6x4-FAU0DCzCFJXjF8Zt_z4_rX011eDMaLCxyYU2vA==

GET
H2 200 facebook-lbg.svg
website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/socials/ 1 KB
1 KB 68ms
67ms Image
image/svg+xml 2600:9000:2487:4000:9:7af6:1700:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/socials/facebook-lbg.svg

Requested by

Host: website.cdn.group-ib.com
URL: https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-blog-post.css?x18492

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2487:4000:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

1e0e607b314623cf3e5ba71869ca47d1549556369988daa5e8a1bf56559c2973

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self';
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-blog-post.css?x18492
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

content-security-policy: frame-ancestors 'self';
content-encoding: gzip
x-content-type-options: nosniff
date: Mon, 04 Dec 2023 17:50:55 GMT
via: 1.1 a3ffeedc8ed545612c2465ea4fb13fbe.cloudfront.net (CloudFront)
strict-transport-security: max-age=31536000; includeSubDomains
x-amz-cf-pop: LHR61-P3
x-cache: Miss from cloudfront
content-length: 522
x-xss-protection: 1; mode=block
referrer-policy: strict-origin-when-cross-origin
last-modified: Tue, 29 Nov 2022 07:39:21 GMT
server: nginx
etag: "4f0-5ee9716178eea-gzip"
x-frame-options: sameorigin
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: https://www.group-ib.com
cache-control: private, max-age=3600
permissions-policy: accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=()
accept-ranges: bytes
x-amz-cf-id: Y9W9P1muMqu5K8AanEpVRlwKRF7c-3N7k8k-We5cjvN6UcK5330Fag==

GET
H2 200 /
www.facebook.com/tr/ 0
54 B 41ms
40ms Image
text/plain 2a03:2880:f177:185:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=709834390277869&ev=PageView&dl=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fmysterious-team-bangladesh%2F&rl=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fmysterious-team-bangladesh%2F&if=false&ts=1701712256152&sw=1600&sh=1200&ud[external_id]=6d93314604d304ad303c8addd0328963&v=2.9.138&r=stable&ec=0&o=4126&fbp=fb.1.1701712254853.1974125246&cs_est=true&it=1701712254658&coo=false&rqm=GET

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f177:185:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
date: Mon, 04 Dec 2023 17:50:56 GMT
server: proxygen-bolt
content-type: text/plain
access-control-allow-origin
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 0

Verdicts & Comments Add Verdict or Comment

104 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

46 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.www.group-ib.com/	1970-01-21 01:27:28	Name: __zzatgib-w-61354c22-16cc-40a8-a871-6901f1a76e24 Value: MDA0dBA=Fz2+aQ==
.group-ib.com/	1970-01-21 01:27:28	Name: __zzatgib-w-61354c22-16cc-40a8-a871-6901f1a76e24 Value: MDA0dBA=Fz2+aQ==
.group-ib.com/	1970-01-20 18:51:28	Name: _gcl_au Value: 1.1.976693889.1701712254
.group-ib.com/	1970-01-21 02:17:52	Name: _ga_QMES53K3Y2 Value: GS1.1.1701712254.1.0.1701712254.60.0.0
.group-ib.com/	1970-01-21 02:17:52	Name: _ga Value: GA1.1.1170303496.1701712255
.group-ib.com/	1970-01-21 01:27:28	Name: _ym_uid Value: 170171225517422594
.group-ib.com/	1970-01-21 01:27:28	Name: _ym_d Value: 1701712255
.group-ib.com/	1970-01-20 18:51:28	Name: _rdt_uuid Value: 1701712254620.38c9c39b-84de-45fa-9b1d-ecaab6d231df
www.group-ib.com/	1970-01-21 02:17:52	Name: _gd_visitor Value: 0c7d16f5-9eeb-4bee-8e53-71fc47d33801
www.group-ib.com/	1970-01-20 16:42:06	Name: _gd_session Value: 9da7d173-35fd-4609-849d-30d4718c495f
.linkedin.com/	1970-01-20 16:43:18	Name: lidc Value: "b=OGST05:s=O:r=O:a=O:p=O:g=2904:u=1:x=1:i=1701712254:t=1701798654:v=2:sig=AQH39vvK9Nq_Ygyw4zmUj0c5oitgDnRc"
tracking.g2crowd.com/	1970-01-20 17:02:01	Name: _session_id Value: 3d42dbf1eb8e14fc66917c93193422a3
.g2crowd.com/	1970-01-20 16:41:54	Name: __cf_bm Value: rlf.PfBe1_eRLIiLDVuaHqUG70Tu453etSz40afvGEA-1701712254-0-AQL4E2zpSb7M+5Ew1L1mptWUEdVMVb84chM4P5VaKc9NNu/L9qgVWgWR5bf2VdbgRN3NqsgMc5WxKeMKMVCq+8A=
.mc.yandex.com/	1970-01-20 16:41:52	Name: sync_cookie_csrf Value: 1045171784fake
.yandex.com/	1970-01-21 02:17:52	Name: i Value: 3EdqpsLqcqCNFeTS8p8GOxmWzt0Nj7pwgateRRXUfz4TpENZ7ccy+U3CBrjSFDjzmXT3SDaHFqK4A/b+P3JztAjsGR8=
.yandex.com/	1970-01-21 01:27:28	Name: yandexuid Value: 5751541551701712254
.group-ib.com/	1970-01-20 16:43:04	Name: _ym_isad Value: 2
.linkedin.com/	1970-01-20 18:51:28	Name: li_sugr Value: d74a8a3e-a4f6-4e6f-a342-2783fd67701f
.linkedin.com/	1970-01-21 01:27:28	Name: bcookie Value: "v=2&be3f6d71-2c9e-4eca-88f0-3e28c9d2d55a"
.mc.yandex.ru/	1970-01-20 16:41:52	Name: sync_cookie_csrf Value: 3581261881fake
.doubleclick.net/	1970-01-21 02:03:28	Name: IDE Value: AHWqTUmu1xubZT7mpkqZEZXej4KdB_XFsq_tUc_XdMeZuDVcmMfnSof-8sAmZFla
.ws.zoominfo.com/	1970-01-21 01:27:28	Name: visitorId Value: 3425767cdf9b1f822d625947ccd7022aabbf29462345b6568e5c3995f15d6894
.zoominfo.com/	1970-01-20 16:41:54	Name: __cf_bm Value: oYKgXSSZuZNa5AvUJ0j3iPNAqea4uQYzXdtRY45neGs-1701712254-0-Aen2lETmBmzQiLhgE497IN89L6i4ICxN64p6kPwvQfGuPWO9p7lpyi3n1jPxFbTXWUiSgAanomoIuPRSSiQJw5g=
.zoominfo.com/	1969-12-31 23:59:59	Name: _cfuvid Value: 5u7M.9s1d16vEXBTbP9.7.xvGPhl_OQ7KKwbh4QaR0E-1701712254823-0-604800000
.group-ib.com/	1970-01-20 18:51:28	Name: _fbp Value: fb.1.1701712254853.1974125246
.mc.yandex.com/	1970-01-20 16:43:18	Name: sync_cookie_ok Value: synced
.linkedin.com/	1970-01-20 17:25:04	Name: UserMatchHistory Value: AQLd1C1gAv9wRAAAAYw19Feyc_3AYXjxRTN9IA3Oluxes4eMjB-LpgU58PPPLvQ352DoPw6D3cX1TQ
.linkedin.com/	1970-01-20 17:25:04	Name: AnalyticsSyncHistory Value: AQJ6oHQw1G1P4gAAAYw19Feyf0yrL5JP9VujvwcQKsVmQdGZx4a-CyqP5REzlM9io1aDZIkAPZH7gopfLUoGbQ
.6sc.co/	1970-01-21 02:17:52	Name: 6suuid Value: bd641102bc0f09007f116e65360000001e036500
.www.linkedin.com/	1970-01-21 01:27:28	Name: bscookie Value: "v=1&20231204175055bd3729a3-d33e-4d86-8efc-b62ad0653741AQG0PqJyTA518ZpW85Mv4Axc9PZyhfJ1"
.linkedin.com/	1970-01-20 21:01:04	Name: li_gc Value: MTswOzE3MDE3MTIyNTU7MjswMjHYUlO5tUQd8ApWTgtaKhfW+tC5zuTn7ffuJPtxSvjpBA==
.yandex.ru/	1970-01-21 02:17:52	Name: yandexuid Value: 5751541551701712254
.yandex.ru/	1970-01-21 02:17:52	Name: yuidss Value: 5751541551701712254
.yandex.ru/	1970-01-21 02:17:52	Name: i Value: 3EdqpsLqcqCNFeTS8p8GOxmWzt0Nj7pwgateRRXUfz4TpENZ7ccy+U3CBrjSFDjzmXT3SDaHFqK4A/b+P3JztAjsGR8=
.yandex.ru/	1970-01-21 02:17:52	Name: yp Value: 1701798655.yu.9179302121701712254
.yandex.ru/	1970-01-21 01:27:28	Name: ymex Value: 1704304255.oyu.9179302121701712254
mc.yandex.com/	1969-12-31 23:59:59	Name: yabs-sid Value: 2262739901701712255
.yandex.com/	1970-01-21 01:27:28	Name: yuidss Value: 5751541551701712254
.yandex.com/	1970-01-21 01:27:28	Name: ymex Value: 1733248255.yrts.1701712255
.yandex.com/	1970-01-21 01:27:28	Name: bh Value: KgI/MA==
.www.group-ib.com/	1970-01-21 01:27:28	Name: cfidsgib-w-61354c22-16cc-40a8-a871-6901f1a76e24 Value: O9wrpRMBvYhdykfbkptjjJOyMsz704NIxNh54BwjGakGObREFbZQm7V1MJO4YQ0jA2ngrqx2e5wRhNu3U5Ked+6ux81ZF6UsK4QAouzdu1J7tV4bmHdrmwEMSRlfnZMfTQ1q25fvhR6LvJOwSEt4z/t08HshiQKpxMvC
.group-ib.com/	1970-01-21 01:27:28	Name: cfidsgib-w-61354c22-16cc-40a8-a871-6901f1a76e24 Value: O9wrpRMBvYhdykfbkptjjJOyMsz704NIxNh54BwjGakGObREFbZQm7V1MJO4YQ0jA2ngrqx2e5wRhNu3U5Ked+6ux81ZF6UsK4QAouzdu1J7tV4bmHdrmwEMSRlfnZMfTQ1q25fvhR6LvJOwSEt4z/t08HshiQKpxMvC
.www.group-ib.com/	1970-01-21 01:27:28	Name: gsscgib-w-61354c22-16cc-40a8-a871-6901f1a76e24 Value: p1Yz/CNBddO9YZdV7E9YTnY7Hek8HLaLBB6UwrV4R/yzy0G+KNww0TIICJcYBmdWJWwsyEAcWkN5Exaj/iFXcrzyA79a41WuufBTBKP/n7zBt5bKNQ4edty+HOw4IUSoCaKGa1yyrPHYsv0Tf0EXRV6BtOk+YNvzCo2BPnpJYvPFsf966RfN3BtA7wgMBC0K0sBK6haTHnFbJDrLFanTGciyO97mU4utwWpEovzOVZRswMUmZiXVjdDs32J3Rztgt5VWr9lQ+DKi4lMLXJY=
.group-ib.com/	1970-01-21 01:27:28	Name: gsscgib-w-61354c22-16cc-40a8-a871-6901f1a76e24 Value: p1Yz/CNBddO9YZdV7E9YTnY7Hek8HLaLBB6UwrV4R/yzy0G+KNww0TIICJcYBmdWJWwsyEAcWkN5Exaj/iFXcrzyA79a41WuufBTBKP/n7zBt5bKNQ4edty+HOw4IUSoCaKGa1yyrPHYsv0Tf0EXRV6BtOk+YNvzCo2BPnpJYvPFsf966RfN3BtA7wgMBC0K0sBK6haTHnFbJDrLFanTGciyO97mU4utwWpEovzOVZRswMUmZiXVjdDs32J3Rztgt5VWr9lQ+DKi4lMLXJY=
.www.group-ib.com/	1970-01-21 01:27:28	Name: fgsscgib-w-61354c22-16cc-40a8-a871-6901f1a76e24 Value: a2dP0142c3ff2b00178cc2d5478fb3c4c9b96191
.group-ib.com/	1970-01-21 01:27:28	Name: fgsscgib-w-61354c22-16cc-40a8-a871-6901f1a76e24 Value: a2dP0142c3ff2b00178cc2d5478fb3c4c9b96191

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://www.group-ib.com/blog/mysterious-team-bangladesh/ Message: Failed to load resource: the server responded with a status of 403 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

alb.reddit.com
api-eu1.hubapi.com
api.neverbounce.com
b.6sc.co
c.6sc.co
cdn.neverbounce.com
connect.facebook.net
cta-eu1.hubspot.com
fhp-de-js.group-ib.com
forms-eu1.hscollectedforms.net
forms-eu1.hsforms.com
forms.hsforms.com
googleads.g.doubleclick.net
ipv6.6sc.co
j.6sc.co
js-eu1.hs-analytics.net
js-eu1.hs-banner.com
js-eu1.hs-scripts.com
js-eu1.hsadspixel.net
js-eu1.hscollectedforms.net
js-eu1.hsforms.net
js-eu1.hubspot.com
mc.yandex.com
mc.yandex.ru
perf-eu1.hsforms.com
px.ads.linkedin.com
px4.ads.linkedin.com
region1.analytics.google.com
stats.g.doubleclick.net
track-eu1.hubspot.com
tracking.g2crowd.com
website.cdn.group-ib.com
ws.zoominfo.com
www.facebook.com
www.google.com
www.google.de
www.googletagmanager.com
www.group-ib.com
www.linkedin.com
www.redditstatic.com
108.157.229.98
13.107.42.14
151.101.193.140
172.65.192.122
172.65.198.159
172.65.202.201
172.65.208.22
172.65.219.229
172.65.232.43
172.65.236.181
172.65.238.60
172.65.240.166
172.65.255.172
195.201.183.123
2.17.100.193
2001:4860:4802:34::36
2600:9000:2487:4000:9:7af6:1700:93a1
2606:4700:4400::6812:2b1f
2606:4700::6810:890f
2606:4700::6811:cff9
2620:1ec:21::14
2a00:1450:4001:801::2002
2a00:1450:4001:803::2003
2a00:1450:4001:80f::2008
2a00:1450:4001:831::2004
2a00:1450:400c:c00::9a
2a02:26f0:480:21::217:d11c
2a02:6b8::1:119
2a03:2880:f084:d:face:b00c:0:3
2a03:2880:f177:185:face:b00c:0:25de
2a04:4e42:400::396
2a06:98c1:3200::90:0
3.72.181.255
54.162.203.31
00d13c8807288c2692bc56236b98893a0744399a724fc005fe93cfb32f0b871b
01caf20e667c8e300960582162f912d9405e9895c32cff1a9ee95511fd509a2c
085d5ab7549bcb7c4e86df292e05e2e579ec6ce11e052357110484554cdb12c1
0a014f28d198eaf2dbc55fd97dcde352e47f6519bccd6f2570e3d8f1874ab5bf
0ad17c7d661733bbf1cfe9bc6e85033bfed43c87c94cb72ba02f484adf1593c0
0c4056a2669d5cd532e6e904e2c46452a38844d259f6565ae91a9315bdb94229
14103b64df9857f9f7ad1f02efaafba97ce4772e8d8b448857de69c3537c338d
14f2ec002b176e0dee403cb7dd4ef2274a1353080e1e3e4084678770f4c15b9c
15534f98c260c3c3caaedf53335d912010b2de1731477a9fd4dbea89fb4995d9
17475478a6f14ff8a7cf296a2ff4507c254ce064e13a2ec83b8d8670f5ed3f57
1a54a1907a6443e3c81608130bfed4546eb0ce5d0c8897e1d7a3b43d89ecc367
1aa462865a143f6b053d5d1594aea3e38d36ebad2a23a7fcfdd84ba7a7a1fddb
1d26a8b07287923bfa829132476a39ef18a3d54142a095bead617044f2255eab
1d77c70aaafb858b17e26f0064114d407897297f4706605988ee12320817e191
1e0e607b314623cf3e5ba71869ca47d1549556369988daa5e8a1bf56559c2973
1efe16c9efbadde5e242d88a315eca3906a55669fcd4882a904fbc723306a4e4
2317091fa39eb021798470df7544a3c65cad27a26f4097fb84595ea217d6040f
26072689d9b79057ae71910b8718c5e69165fc90dcafadb3cd332fe89c963d0f
26d28830df1e9958b86a59aca1a51fb51f06392698f90fd02d1341294b32d998
28ed7b6ae56298df10f217060a8dafdcd00064e32f66346a3e5ab6917ca22b0a
294fdc878aa8c42b19edc18d385880ad886397846aca640c305f3eb53a965e13
2be8ce2b065360537771ed230d5d72cbd84758ec127ffa035e6d260ed14af5b0
2d619b14c6524d5cbcad2673c8041f6eb5ef8ebe893526542d58528e8246e195
30830f557fdc6a64c686abee404481eebe0d174d0884ac8b14d9d6dfbb8ec91e
31d1c5bd0cd38e6e6b8eb944944df273044e826c7d3daacbe602caead3068c7a
34e0bb5c5ed1184e6452cf7562faf332af1a26e95e50e035ff0a9f7065e6df9e
36052f59be8e5a3e17205937fd21871fb3126b984f23db6eabe6f9339c7fe58c
3689e488f5478e26f0347353ad608ccd66e4d62992021c51d9db93f89d43c880
38a0301e05d7c69fdf4fdf9158f5572e8e5d500a30f63f676b1176738ca0db02
3b63b449bde0f2c40eb23801ac24bd82666bd3a766c77b953ff75e6f3e257460
3b89c7709eff11ca263bf5a2ffeadefd1c12262d87f390d7d4fab229c20bd2d4
3c154eacd32e19affe40478340a9782ade87041dd5ccab6c1ae385180b20e6f3
3e136e77083bfc6ef14ffc5abd19da89a82bf12fc0cda3c603e01582b93303c8
42489ab0f577fc0c843c768c547a6e38de1b2f757cab60e40afc39191d987012
43f22362329b9705cf8629061fb5b1d1a38f1cc2bc9fd46728f73e5cd9eb77cf
47e3192c90563ef33fef195245191abd056342cd9f08f70716cbb1669eeb811c
48baf5d65c15a221cdcd9149090cd58551a785af39c67e25b0952ff8e8e7a891
4a3364f1379b22a90bbb962717bf5c2e73f63a219addd359ea38bbab61ecbafc
4d4a484a100e469b6e3dcf880a37755086e246cc291bab46e3edd4529e3d5d6a
4fb71bac54726b1d6ba366ee11128ba2c43cd9cc61608d49cffb20cd770d1dee
53b07966bbc49b19a64977259e275e0d85766865dc21e8bdc3ad1fe2c6c22f2f
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
574ab1a3d7b47add5d43a927f62c87698264f63572acd70b42081dd4a1dc5ced
579ff09d0cfe834581eb571dc5c49e854639c28af3c199857914d7cea9ba732b
5a5f39391fbf5b06db84b8f9716d53de575ee97a627d2c5f12f79a991a671eb5
5f35bb1f4e0fc7973cc41739788026b73188f412019fed3f200c5c45f1692ec7
5fddb6a44c754d81312b6a1d27b50b42b46677174b49172c9bef600066b5ca99
620418e15bd4302ca68fe0c806a6a6e74a11a7cbc56004a3e052529b73092e9b
65d89845e7e63b000a7b7f82db7276f8272b086cc65722d3c1c802dfa59eea01
666538cc669aa83b9921af035741028caa6de399a9cb7283d2c514bdbea2e92c
682b24f82f5ba230148a58710a4adf84b5b24a5fc86eabd0c9e2582aca5e2be9
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992
6b0775723ccade5ca3170fcc6a321c5b4768a5dc2b7c83b8b8b595407a2f0018
6cee0fb06339ba13e1f15d044e0e4904bbeeb7fbe4351e3f102b6d80b2465061
6d1e71087c4c474c09a5e9dcdefaa5a4c3d03bb88bf039961aea3933b47581ee
6dc2f225059a4c3de1118e821d95f90427737f19f31f44b61300c61430c951d5
7174bc56bf6ac9fa4e7dff3195a91124f95b6992775b2814a001084a614104a8
7574ba97d4ee7e81bd60873a52a31ff13359f246d0ac492ef2dabf96233a99e6
7803c89039a7bd4ce3ee7c5446d068655c595c27ae8032b33e058c1d69b951bc
7c1b4f874eb7f4887530d3061220ac294798671b8ae41d8329984af40edaaecf
81cc2a3a0c0b6e8335f5f3143390b8b6f036dc573e73d3f4b5742482f0bdca73
88029c742d2ab5d7f101ef05c78a6d72ee7c0dda17d1edfc2303b23e201e9fcc
8a828fd4ff75ed429a819ed9f9341336ecccfc91f77e7527df0aa217077c1a89
8c38ffa74ea0e988e8790a28ba10abce98189330ddaa9e307263b574153557de
8c8b7b664c258c761c5a5c1784ac1a9ff00396d0d5b34b346eca913f489b64b7
8d15a221986226efe4f742f390f46f9d5ae8b2008a6edd40e10ff121ef9cca9b
8fff8b978d9d60df3ff3d0ec43f85146cf783cc24dbd1797bed8f1c276e4223a
90feab54b3acd83fa6182b1099d882d4aa602ec61b8bcdfec8c3c8f413df5fe0
91256c71cebff7c9fa1cc53bfd63fe2357134222ada4b66c4cc3287adb128d38
942e02acf640c0308f65e057a8afaed63dfaf995034cda9cfc75532a1009ec72
96368853b51da6b74ecf4891933f261eda9a682bf1b19f14486729c1eaebb7f0
9796a93d50d319dfc65834b445458b00a7ebb95e1cedf5bc8d230e26e7b77447
997d49d316b533985208f14602a1ff15a76bf6a567afbb6b6980629ca8d78bab
a0db55df25ae4e15827fed2bf02fea97c9d8523056ab61f44f728be9b3bf5e29
a300a894e169169882504968fae71958a87e0a4322e2aee1b6b0bbd63fd9621f
a8db2c5feaeae215fc02c7a068b7c1f624adf29f5344f1ed90e5eaac466f6517
a9e9d5d62bdbbe46fee9a3a0ba4c2d7fe5a6f4b53c10df3ac7d34796ffb7c96b
ac57c7130d61697977d2ed1796c27eefed8249083472716e474e5604b20636aa
ae9dad69229703dfa3b6d226c4c7d692e2f2809bf2475f22612824c2f7602efc
aea508e3736bff7b4e81a79a6c3db2740b482f88b9d10404e8fc85b7f9066239
b0bdc2fc526a2fb0150c8d5bb3c13ce44ef44dbb7a8f2812e2859e601cb36353
b2c1528354197e8e8e777aae7bda28307c08983050b4f002e566b0266e765ab0
b624e1e378abe009ef0de69a698b0a3e734af47efcdbd6816d5fcb8fc64c8bfe
befef8a5a15a38f99844ae6a725e5c17903ea089796293e12b83b85cfc476a85
c0374631e7bf6589252aea40a9c76b6e85e8e33d063ea0f936249f6086c110f4
c21e5a2b32c47bc5f9d9efc97bc0e29fd081946d1d3ebffc5621cfafb1d3960e
c2c98193ecfdb61233be8d5f0fd21d8e6a105c9dbe0f26ac48b49d2015bf78c6
c33709a20ca4cd516d65b07a79c1d75445892fcb6d8c6f3871a47ab38d85e075
c5c67648fffd349f954ede67a063af9dc8fdd50c87e04d68adcc832761627167
c75ce78367d99e641567420678abf3731c7bd570cdaa84457d6eebc47f00d76c
c83ca0c69da08f97b59cbfcf7f63529d115f5e6b54d32c52ac70399bde8dbcae
c84eae5b234d8595c0318241296fe36e8a29f6f9077176a2b3f1c553b7ef823b
c99d11cb4960d6e1918ed55d5bcbb316d38b51098e2efc1201904d7274d3273e
ca4c33d7f44a36a0924572e19d6ba0fab648b9fa185bcdf0320e876e87e277dc
cc2a604a1e6f73444e8db5d749a64c62899943e68ad07feeee39050b4fdb32cb
cc5dcea4d483d798630d7fe0846a1b784618aa3d4f86bdfa655083d81750322a
cc7403bab52ed166e24ea9324241045af370be482f5b594468f4a6ac6e7e7981
cdb4fe28f69f85faeb237ff5f558b7b0b38c82d1c6af730e8c2a7d7ba2292613
cdc4d10b6b74ad79b55333b9882e854f054ee8b9953c6203dc46c68dc74eb0fb
d2db3491183b7f753f2a731fbd662fd7ac8e1fd7376d734c1cddaae0ea7df0a2
d4357e3108552252e742cec0e5da24814f9d62d6b37a71dc1307b5aec7daa2cf
d4c9ffda6ca556f36f402f6d1131a4f3f567505320a9f60151023d4a8bbdb458
d5792801335f11b32a948d51b64bb655b16f8767f5837f2be4c406715994752f
d5e95d6adf11e4a630265f96a786ee7278a3bc6244e0d66a89f71fb337f6a73a
d7065620e6207c720686e1668df607d41ed2f0a381f6c62be957493abad1e96d
dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
dedf6c9294a8b9e4b13b1575641071e45c8e61235bd154d19103fd2893ccd708
df02c5aa47c0a509fe7df969c1d41208d13ae97ba1c3e009693dff207ad8f447
df7b54b910cea4c4c5f726482df5312a7d0e87bdef8c08e051836497b7e04c1f
df998f2ab79818d229edfab989eb187dd3d94f0f40377fde4f5f97e08b691ecf
dfb059f8aa219769088fd6c85d85aae789f1e72bfe3d314748f1f3ccfffffb1c
dff2f83a4ddce2feedb348da5cb714cfeba192924120b7beab2d393b762dfbe8
e081385f59556e1cdd1140baf274cacc7ebb87fd4e5824e442123dd94f277728
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e803e774c7b59fe74f71ed93acaa875cf9a99947ff8ed7615cd0c93c1667250f
e91c5731358570d3e4cd684118251d243fc799059648b152403dcd775ceba632
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f006e8bbfa4f0537780571436b5bed50ff10ff28759924c53b67732ec5af28ba
f0898f4b2195e614d43d308d8ae23875e2703f8a746b2564dabf36752f4d1e02
f0e3a799744c0c67782742af2c13b85f769b58abd04800a04853d26f60cf7314
f367bbc4429fc9fb0a93045245aef519a000ab275549645cddecb3f953e0a05f
f451000610c622d410bcd703921782183ac287271cb9856eb5cd49a714e33703
f4991587d5312981e74087707ed399bd3820d83f773e7773c013ce00d6835f28
f5a5703710663d26cfdf94d6e3223d9a2be8979a603bb96e4779326277a230e3
f5adb3b6debbbee4c4a326c9a32a24c7d6c4a6f99d78a8604bc0d635d1b04f20
f69ebc1daa2d65ffb37e5307186bdd49d3c7db42c9f22907d806b5dd23e6adfb
fa4859289ded4c674dcee233811758743116b1d7ce4e9f0c0e7e259391504c43
fe04a9dc88d3f3be8d4f6bc63a9a80f45a4c6d8460e7551dab849457c091920a
fffe17f6fe0ca9bf2e69d087a687c9d2340f67d742a70a810a57ef3c7d17cefe

www.group-ib.com Open in urlscan Pro 3.72.181.255 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

138 Requests

98 %HTTPS

50 %IPv6

25 Domains

40 Subdomains

35 IPs

4 Countries

2506 kBTransfer

5737 kBSize

46 Cookies

21 Outgoing links

Page URL History

Redirected requests

138 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 22 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

www.group-ib.com Open in urlscan Pro
3.72.181.255 Public Scan

Screenshot
Live screenshot

Full Image

138
Requests

98 %
HTTPS

50 %
IPv6

25
Domains

40
Subdomains

35
IPs

4
Countries

2506 kB
Transfer

5737 kB
Size

46
Cookies

138 HTTP transactions
22 data transactions