ics-cert.kaspersky.com Open in urlscan Pro
185.105.225.103 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://ics-cert.kaspersky.com/publications/reports/2023/08/10/common-ttps-of-attacks-against-industrial-organizations-implants...
Submission: On August 14 via api (August 14th 2023, 11:25:48 am UTC) from DE — Scanned from DE

Summary HTTP 96 Redirects Links 6 Behaviour Indicators

Summary

This website contacted 18 IPs in 5 countries across 12 domains to perform 96 HTTP transactions. The main IP is 185.105.225.103, located in St Petersburg, Russian Federation and belongs to OOOVPS-AS, RU. The main domain is ics-cert.kaspersky.com.
TLS certificate: Issued by DigiCert TLS RSA SHA256 2020 CA1 on September 29th 2022. Valid for: a year.

This is the only time ics-cert.kaspersky.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
61	185.105.225.103 185.105.225.103	200487 (OOOVPS-AS) (OOOVPS-AS)
4	2a00:1450:400... 2a00:1450:4001:829::2004	15169 (GOOGLE) (GOOGLE)
1	104.17.73.206 104.17.73.206	13335 (CLOUDFLAR...) (CLOUDFLARENET)
5	2606:4700::68... 2606:4700::6812:d63b	13335 (CLOUDFLAR...) (CLOUDFLARENET)
5	2a00:1450:400... 2a00:1450:4001:80f::2008	15169 (GOOGLE) (GOOGLE)
6	2a00:1450:400... 2a00:1450:4001:809::2003	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:810::200e	15169 (GOOGLE) (GOOGLE)
1	2001:4860:480... 2001:4860:4802:34::36	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:400c:c03::9c	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:827::2003	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:831::2003	15169 (GOOGLE) (GOOGLE)
1	2a02:26f0:480... 2a02:26f0:480:f::213:7ec6	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	65.9.95.127 65.9.95.127	16509 (AMAZON-02) (AMAZON-02)
1 3	172.217.16.198 172.217.16.198	15169 (GOOGLE) (GOOGLE)
1	2600:9000:212... 2600:9000:2127:fc00:2:53b2:240:93a1	16509 (AMAZON-02) (AMAZON-02)
4 4	2620:1ec:21::14 2620:1ec:21::14	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	13.107.42.14 13.107.42.14	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
2	2a00:1450:400... 2a00:1450:4001:82f::2002	15169 (GOOGLE) (GOOGLE)
1 1	2a00:1450:400... 2a00:1450:4001:80e::2002	15169 (GOOGLE) (GOOGLE)
2 2	142.250.185.102 142.250.185.102	15169 (GOOGLE) (GOOGLE)
96	18

61 185.105.225.103 (St Petersburg, Russian Federation)

ASN200487 (OOOVPS-AS, RU)
PTR: fthub.kaspersky.com

ics-cert.kaspersky.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:829::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.17.73.206 (None, )

ASN13335 (CLOUDFLARENET, US)

go.kaspersky.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2606:4700::6812:d63b (United States)

ASN13335 (CLOUDFLARENET, US)

cdn.onesignal.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
onesignal.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2a00:1450:4001:80f::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2a00:1450:4001:809::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:810::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2001:4860:4802:34::36 (United States)

ASN15169 (GOOGLE, US)

region1.analytics.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:400c:c03::9c (Brussels, Belgium)

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:827::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:831::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:26f0:480:f::213:7ec6 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)

snap.licdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 65.9.95.127 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-65-9-95-127.prg50.r.cloudfront.net

js.go2sdk.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 172.217.16.198 (United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: fra16s08-in-f6.1e100.net

12346775.fls.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:2127:fc00:2:53b2:240:93a1 (United States)

ASN16509 (AMAZON-02, US)

cdn.linkedin.oribi.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2620:1ec:21::14 (United States) 4 redirects

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

px.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
www.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.107.42.14 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

px4.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:82f::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

adservice.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:80e::2002 (Frankfurt am Main, Germany) 1 redirects

ASN15169 (GOOGLE, US)

adservice.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 142.250.185.102 (Grosse Pointe, United States) 2 redirects

ASN15169 (GOOGLE, US)
PTR: fra16s49-in-f6.1e100.net

ad.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
62	kaspersky.com ics-cert.kaspersky.com go.kaspersky.com	2 MB
7	gstatic.com www.gstatic.com fonts.gstatic.com	598 KB
7	google.com www.google.com — Cisco Umbrella Rank: 3 region1.analytics.google.com — Cisco Umbrella Rank: 2770 adservice.google.com — Cisco Umbrella Rank: 116	35 KB
6	doubleclick.net 3 redirects stats.g.doubleclick.net — Cisco Umbrella Rank: 114 12346775.fls.doubleclick.net — Cisco Umbrella Rank: 407773 ad.doubleclick.net — Cisco Umbrella Rank: 194	3 KB
5	linkedin.com 4 redirects px.ads.linkedin.com — Cisco Umbrella Rank: 368 www.linkedin.com — Cisco Umbrella Rank: 543 px4.ads.linkedin.com — Cisco Umbrella Rank: 5984	5 KB
5	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 65	497 KB
5	onesignal.com cdn.onesignal.com — Cisco Umbrella Rank: 3840 onesignal.com — Cisco Umbrella Rank: 1426	83 KB
2	google.de 1 redirects www.google.de — Cisco Umbrella Rank: 5933 adservice.google.de — Cisco Umbrella Rank: 12711	1 KB
2	google-analytics.com www.google-analytics.com — Cisco Umbrella Rank: 54	21 KB
1	oribi.io cdn.linkedin.oribi.io — Cisco Umbrella Rank: 890	376 B
1	go2sdk.com js.go2sdk.com — Cisco Umbrella Rank: 36541	18 KB
1	licdn.com snap.licdn.com — Cisco Umbrella Rank: 819	5 KB
96	12

	Domain	Requested by
61	ics-cert.kaspersky.com	ics-cert.kaspersky.com
6	www.gstatic.com	www.google.com www.gstatic.com
5	www.googletagmanager.com	ics-cert.kaspersky.com www.google-analytics.com www.googletagmanager.com
4	www.google.com	ics-cert.kaspersky.com www.gstatic.com www.google.com
3	px.ads.linkedin.com	3 redirects
3	12346775.fls.doubleclick.net	1 redirects www.googletagmanager.com adservice.google.com
3	onesignal.com	cdn.onesignal.com
2	ad.doubleclick.net	2 redirects
2	adservice.google.com	12346775.fls.doubleclick.net
2	www.google-analytics.com	ics-cert.kaspersky.com www.google-analytics.com
2	cdn.onesignal.com	ics-cert.kaspersky.com cdn.onesignal.com
1	adservice.google.de	1 redirects
1	px4.ads.linkedin.com
1	www.linkedin.com	1 redirects
1	cdn.linkedin.oribi.io	snap.licdn.com
1	js.go2sdk.com	www.googletagmanager.com
1	snap.licdn.com	www.googletagmanager.com
1	fonts.gstatic.com	www.google.com
1	www.google.de	ics-cert.kaspersky.com
1	stats.g.doubleclick.net	www.googletagmanager.com
1	region1.analytics.google.com	www.googletagmanager.com
1	go.kaspersky.com	ics-cert.kaspersky.com
96	22

This site contains links to these domains. Also see Links.

Domain
twitter.com
www.linkedin.com
www.kaspersky.com
www.sei.cmu.edu

Subject Issuer	Validity	Valid
ics-cert.kaspersky.com DigiCert TLS RSA SHA256 2020 CA1	`2022-09-29` - `2023-10-30`	a year	crt.sh
www.google.com GTS CA 1C3	`2023-07-17` - `2023-10-09`	3 months	crt.sh
go.kaspersky.com Cloudflare Inc ECC CA-3	`2023-04-03` - `2024-04-02`	a year	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2023-05-03` - `2024-05-02`	a year	crt.sh
*.google-analytics.com GTS CA 1C3	`2023-07-17` - `2023-10-09`	3 months	crt.sh
*.gstatic.com GTS CA 1C3	`2023-07-17` - `2023-10-09`	3 months	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2023-07-17` - `2023-10-09`	3 months	crt.sh
www.google.de GTS CA 1C3	`2023-07-17` - `2023-10-09`	3 months	crt.sh
*.google.com GTS CA 1C3	`2023-07-17` - `2023-10-09`	3 months	crt.sh
snap.licdn.com DigiCert SHA2 Secure Server CA	`2023-02-01` - `2024-01-31`	a year	crt.sh
js.go2sdk.com Amazon RSA 2048 M01	`2023-08-06` - `2024-09-02`	a year	crt.sh
*.doubleclick.net GTS CA 1C3	`2023-07-17` - `2023-10-09`	3 months	crt.sh
linkedin.oribi.io Amazon RSA 2048 M01	`2023-06-08` - `2024-07-07`	a year	crt.sh

This page contains 6 frames:

Primary Page: https://ics-cert.kaspersky.com/publications/reports/2023/08/10/common-ttps-of-attacks-against-industrial-organizations-implants-for-uploading-data/
Frame ID: FEA101104D6E6683BA792E5AD1F5C8A9
Requests: 83 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6Lc4EwkUAAAAAMHZJ47EcbYQ2SNuyT-nYvVtRfqq&co=aHR0cHM6Ly9pY3MtY2VydC5rYXNwZXJza3kuY29tOjQ0Mw..&hl=de&v=3kTz7WGoZLQTivI-amNftGZO&size=normal&cb=a1fycqi8rwu5
Frame ID: 76A4AC0C75EDBF7ADF8D1782AA131874
Requests: 8 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/bframe?hl=de&v=3kTz7WGoZLQTivI-amNftGZO&k=6Lc4EwkUAAAAAMHZJ47EcbYQ2SNuyT-nYvVtRfqq
Frame ID: ABEEDAE1C8D5D66727E6CB58F009BE55
Requests: 3 HTTP requests in this frame

Frame: https://12346775.fls.doubleclick.net/activityi;dc_pre=COfYhpaF3IADFQ0OaAgdadcMSw;src=12346775;type=globalc;cat=globa0;ord=2684071233837;auiddc=289667616.1692012344;u1=B2C;u2=no_locale;u4=ics-cert.kaspersky.com;u5=%2Fpublications%2Freports%2F2023%2F08%2F10%2Fcommon-ttps-of-attacks-against-industrial-organizations-implants-for-uploading-data%2F;u6=;u7=undefined-1849714543.1692012343;u9=_publications_reports_2023_08_10_common-ttps-of-attacks-against-industrial-organizations-implants-for-uploading-data_;gtm=45fe3890;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;epver=2;~oref=https%3A%2F%2Fics-cert.kaspersky.com%2Fpublications%2Freports%2F2023%2F08%2F10%2Fcommon-ttps-of-attacks-against-industrial-organizations-implants-for-uploading-data%2F
Frame ID: DE89ADAC28A4665AA4BF5AEE270BEEB1
Requests: 1 HTTP requests in this frame

Frame: https://adservice.google.com/ddm/fls/i/dc_pre=COfYhpaF3IADFQ0OaAgdadcMSw;src=12346775;type=globalc;cat=globa0;ord=2684071233837;auiddc=289667616.1692012344;u1=B2C;u2=no_locale;u4=ics-cert.kaspersky.com;u5=%2Fpublications%2Freports%2F2023%2F08%2F10%2Fcommon-ttps-of-attacks-against-industrial-organizations-implants-for-uploading-data%2F;u6=;u7=undefined-1849714543.1692012343;u9=_publications_reports_2023_08_10_common-ttps-of-attacks-against-industrial-organizations-implants-for-uploading-data_;gtm=45fe3890;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;epver=2;~oref=https%3A%2F%2Fics-cert.kaspersky.com%2Fpublications%2Freports%2F2023%2F08%2F10%2Fcommon-ttps-of-attacks-against-industrial-organizations-implants-for-uploading-data%2F
Frame ID: 55E735584A458700DEC1932DAA41CE9E
Requests: 1 HTTP requests in this frame

Frame: https://12346775.fls.doubleclick.net/ddm/fls/r/dc_pre=COfYhpaF3IADFQ0OaAgdadcMSw;src=12346775;type=globalc;cat=globa0;ord=2684071233837;auiddc=289667616.1692012344;u1=B2C;u2=no_locale;u4=ics-cert.kaspersky.com;u5=%2Fpublications%2Freports%2F2023%2F08%2F10%2Fcommon-ttps-of-attacks-against-industrial-organizations-implants-for-uploading-data%2F;u6=;u7=undefined-1849714543.1692012343;u9=_publications_reports_2023_08_10_common-ttps-of-attacks-against-industrial-organizations-implants-for-uploading-data_;gtm=45fe3890;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;epver=2;~oref=https%3A%2F%2Fics-cert.kaspersky.com%2Fpublications%2Freports%2F2023%2F08%2F10%2Fcommon-ttps-of-attacks-against-industrial-organizations-implants-for-uploading-data%2F
Frame ID: F8EB6888D43E7029D82DEE71DEC08426
Requests: 2 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Common TTPs of attacks against industrial organizations. Implants for uploading data | Kaspersky ICS CERT

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

<link rel=["']stylesheet["'] [^>]+/wp-(?:content|includes)/
/wp-(?:content|includes)/

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

google-analytics\.com/(?:ga|urchin|analytics)\.js

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtm\.js
googletagmanager\.com/gtag/js

Linkedin Insight Tag (Analytics) Expand

Overall confidence: 100%
Detected patterns

snap\.licdn\.com/li\.lms-analytics/insight\.min\.js

OneSignal (Marketing automation) Expand

Overall confidence: 100%
Detected patterns

cdn\.onesignal\.com

Select2 (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

select2(?:\.min|\.full)?\.js

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

reCAPTCHA (Captchas) Expand

Overall confidence: 100%
Detected patterns

/recaptcha/api\.js

Page Statistics

96
Requests

98 %
HTTPS

70 %
IPv6

12
Domains

22
Subdomains

18
IPs

5
Countries

2901 kB
Transfer

7143 kB
Size

17
Cookies

6 Outgoing links

These are links going to different origins than the main page.

URL: https://twitter.com/intent/tweet?text=Common%20TTPs%20of%20attacks%20against%20industrial%20organizations.%20Implants%20for%20uploading%20data&url=https://ics-cert.kaspersky.com/publications/reports/2023/08/10/common-ttps-of-attacks-against-industrial-organizations-implants-for-uploading-data

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/shareArticle?mini=true&url=https://ics-cert.kaspersky.com/publications/reports/2023/08/10/common-ttps-of-attacks-against-industrial-organizations-implants-for-uploading-data&title=Common%20TTPs%20of%20attacks%20against%20industrial%20organizations.%20Implants%20for%20uploading%20data

Search URL Search Domain Scan URL

URL: https://www.kaspersky.com/enterprise-security/threat-intelligence
Title: Kaspersky Threat Intelligence

Search URL Search Domain Scan URL

URL: https://www.sei.cmu.edu/our-work/cybersecurity-center-development/authorized-users/index.cfm

Search URL Search Domain Scan URL

URL: https://www.kaspersky.com/

Search URL Search Domain Scan URL

URL: https://www.kaspersky.com/web-privacy-policy
Title: Privacy policy

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 91

https://12346775.fls.doubleclick.net/activityi;src=12346775;type=globalc;cat=globa0;ord=2684071233837;auiddc=289667616.1692012344;u1=B2C;u2=no_locale;u4=ics-cert.kaspersky.com;u5=%2Fpublications%2Freports%2F2023%2F08%2F10%2Fcommon-ttps-of-attacks-against-industrial-organizations-implants-for-uploading-data%2F;u6=;u7=undefined-1849714543.1692012343;u9=_publications_reports_2023_08_10_common-ttps-of-attacks-against-industrial-organizations-implants-for-uploading-data_;gtm=45fe3890;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;epver=2;~oref=https%3A%2F%2Fics-cert.kaspersky.com%2Fpublications%2Freports%2F2023%2F08%2F10%2Fcommon-ttps-of-attacks-against-industrial-organizations-implants-for-uploading-data%2F HTTP 302
https://12346775.fls.doubleclick.net/activityi;dc_pre=COfYhpaF3IADFQ0OaAgdadcMSw;src=12346775;type=globalc;cat=globa0;ord=2684071233837;auiddc=289667616.1692012344;u1=B2C;u2=no_locale;u4=ics-cert.kaspersky.com;u5=%2Fpublications%2Freports%2F2023%2F08%2F10%2Fcommon-ttps-of-attacks-against-industrial-organizations-implants-for-uploading-data%2F;u6=;u7=undefined-1849714543.1692012343;u9=_publications_reports_2023_08_10_common-ttps-of-attacks-against-industrial-organizations-implants-for-uploading-data_;gtm=45fe3890;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;epver=2;~oref=https%3A%2F%2Fics-cert.kaspersky.com%2Fpublications%2Freports%2F2023%2F08%2F10%2Fcommon-ttps-of-attacks-against-industrial-organizations-implants-for-uploading-data%2F

Request Chain 93

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=39138&time=1692012344509&url=https%3A%2F%2Fics-cert.kaspersky.com%2Fpublications%2Freports%2F2023%2F08%2F10%2Fcommon-ttps-of-attacks-against-industrial-organizations-implants-for-uploading-data%2F HTTP 302
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=39138&time=1692012344509&url=https%3A%2F%2Fics-cert.kaspersky.com%2Fpublications%2Freports%2F2023%2F08%2F10%2Fcommon-ttps-of-attacks-against-industrial-organizations-implants-for-uploading-data%2F&cookiesTest=true HTTP 302
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D39138%26time%3D1692012344509%26url%3Dhttps%253A%252F%252Fics-cert.kaspersky.com%252Fpublications%252Freports%252F2023%252F08%252F10%252Fcommon-ttps-of-attacks-against-industrial-organizations-implants-for-uploading-data%252F%26cookiesTest%3Dtrue%26liSync%3Dtrue HTTP 302
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=39138&time=1692012344509&url=https%3A%2F%2Fics-cert.kaspersky.com%2Fpublications%2Freports%2F2023%2F08%2F10%2Fcommon-ttps-of-attacks-against-industrial-organizations-implants-for-uploading-data%2F&cookiesTest=true&liSync=true HTTP 302
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=39138&time=1692012344509&url=https%3A%2F%2Fics-cert.kaspersky.com%2Fpublications%2Freports%2F2023%2F08%2F10%2Fcommon-ttps-of-attacks-against-industrial-organizations-implants-for-uploading-data%2F&cookiesTest=true&liSync=true&e_ipv6=AQIXDIkq_QeCjwAAAYnzy3cQtm4qdj71GDSFx0pYrAapTSAjV8rKYgY71-fHC4nfX5zbWwo

Request Chain 95

https://adservice.google.de/ddm/fls/i/dc_pre=COfYhpaF3IADFQ0OaAgdadcMSw;src=12346775;type=globalc;cat=globa0;ord=2684071233837;auiddc=289667616.1692012344;u1=B2C;u2=no_locale;u4=ics-cert.kaspersky.com;u5=%2Fpublications%2Freports%2F2023%2F08%2F10%2Fcommon-ttps-of-attacks-against-industrial-organizations-implants-for-uploading-data%2F;u6=;u7=undefined-1849714543.1692012343;u9=_publications_reports_2023_08_10_common-ttps-of-attacks-against-industrial-organizations-implants-for-uploading-data_;gtm=45fe3890;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;epver=2;~oref=https%3A%2F%2Fics-cert.kaspersky.com%2Fpublications%2Freports%2F2023%2F08%2F10%2Fcommon-ttps-of-attacks-against-industrial-organizations-implants-for-uploading-data%2F HTTP 302
https://12346775.fls.doubleclick.net/ddm/fls/r/dc_pre=COfYhpaF3IADFQ0OaAgdadcMSw;src=12346775;type=globalc;cat=globa0;ord=2684071233837;auiddc=289667616.1692012344;u1=B2C;u2=no_locale;u4=ics-cert.kaspersky.com;u5=%2Fpublications%2Freports%2F2023%2F08%2F10%2Fcommon-ttps-of-attacks-against-industrial-organizations-implants-for-uploading-data%2F;u6=;u7=undefined-1849714543.1692012343;u9=_publications_reports_2023_08_10_common-ttps-of-attacks-against-industrial-organizations-implants-for-uploading-data_;gtm=45fe3890;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;epver=2;~oref=https%3A%2F%2Fics-cert.kaspersky.com%2Fpublications%2Freports%2F2023%2F08%2F10%2Fcommon-ttps-of-attacks-against-industrial-organizations-implants-for-uploading-data%2F

Request Chain 96

https://ad.doubleclick.net/ddm/activity/src=13364882;type=invmedia;cat=kaspe00v;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=;gdpr_consent=;ord=3904305599918.8867 HTTP 302
https://ad.doubleclick.net/ddm/activity/src=13364882;dc_pre=CO31wpaF3IADFYdIwQodh_8GaA;type=invmedia;cat=kaspe00v;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=;gdpr_consent=;ord=3904305599918.8867 HTTP 302
https://adservice.google.com/ddm/fls/z/src=13364882;dc_pre=CO31wpaF3IADFYdIwQodh_8GaA;type=invmedia;cat=kaspe00v;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=;gdpr_consent=;ord=3904305599918.8867

96 HTTP transactions
2 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
ics-cert.kaspersky.com/publications/reports/2023/08/10/common-ttps-of-attacks-against-industrial-organizations-implants-for-uploading-data/ 93 KB
24 KB 416ms
277ms Document
text/html 185.105.225.103
OOOVPS-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://ics-cert.kaspersky.com/publications/reports/2023/08/10/common-ttps-of-attacks-against-industrial-organizations-implants-for-uploading-data/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

185.105.225.103 St Petersburg, Russian Federation, ASN200487 (OOOVPS-AS, RU),

Reverse DNS

fthub.kaspersky.com

Software

nginx /

Resource Hash

68434a159f52da1ccae58acfe770f5d2fbda1d40f8bef214e44722798b027185

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

access-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range
access-control-allow-methods: GET, POST, OPTIONS
access-control-expose-headers: Content-Length,Content-Range
content-encoding: gzip
content-type: text/html; charset=UTF-8
date: Mon, 14 Aug 2023 11:25:42 GMT
link: <https://ics-cert.kaspersky.com/wp-json/>; rel="https://api.w.org/" <https://ics-cert.kaspersky.com/wp-json/wp/v2/publications/8117>; rel="alternate"; type="application/json" <https://ics-cert.kaspersky.com/?p=8117>; rel=shortlink
server: nginx
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
x-frame-options: sameorigin
x-xss-protection: 1; mode=block

GET
H2 200 api.js Show response
www.google.com/recaptcha/ 1 KB
1 KB 138ms
48ms Script
text/javascript 2a00:1450:4001:829::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api.js

Requested by

Host: ics-cert.kaspersky.com
URL: https://ics-cert.kaspersky.com/publications/reports/2023/08/10/common-ttps-of-attacks-against-industrial-organizations-implants-for-uploading-data/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

d9e88e50017aa3bdee310cf9b081cc729d10851438070983ee041e508ea84d2d

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ics-cert.kaspersky.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 14 Aug 2023 11:25:43 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy: frame-ancestors 'self'
server: GSE
x-frame-options: SAMEORIGIN
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=300
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 834
x-xss-protection: 1; mode=block
expires: Mon, 14 Aug 2023 11:25:43 GMT

GET
H2 200 style.min.css
ics-cert.kaspersky.com/wp-includes/css/dist/block-library/ 95 KB
16 KB 75ms
71ms Stylesheet
text/css 185.105.225.103
OOOVPS-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://ics-cert.kaspersky.com/wp-includes/css/dist/block-library/style.min.css?ver=6.2.2

Requested by

Host: ics-cert.kaspersky.com
URL: https://ics-cert.kaspersky.com/publications/reports/2023/08/10/common-ttps-of-attacks-against-industrial-organizations-implants-for-uploading-data/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

185.105.225.103 St Petersburg, Russian Federation, ASN200487 (OOOVPS-AS, RU),

Reverse DNS

fthub.kaspersky.com

Software

nginx /

Resource Hash

aca566587618e75fa291a419c7c430be02e03fc72f6105658c1bc8e7d59a65e4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ics-cert.kaspersky.com/publications/reports/2023/08/10/common-ttps-of-attacks-against-industrial-organizations-implants-for-uploading-data/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 14 Aug 2023 11:25:43 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
last-modified: Wed, 28 Jun 2023 22:12:33 GMT
server: nginx
content-encoding: gzip
etag: W/"649cb051-17ced"
x-frame-options: sameorigin
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/css
access-control-expose-headers: Content-Length,Content-Range
access-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range
x-xss-protection: 1; mode=block

GET
H2 200 classic-themes.min.css
ics-cert.kaspersky.com/wp-includes/css/ 291 B
612 B 76ms
71ms Stylesheet
text/css 185.105.225.103
OOOVPS-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://ics-cert.kaspersky.com/wp-includes/css/classic-themes.min.css?ver=6.2.2

Requested by

Host: ics-cert.kaspersky.com
URL: https://ics-cert.kaspersky.com/publications/reports/2023/08/10/common-ttps-of-attacks-against-industrial-organizations-implants-for-uploading-data/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

185.105.225.103 St Petersburg, Russian Federation, ASN200487 (OOOVPS-AS, RU),

Reverse DNS

fthub.kaspersky.com

Software

nginx /

Resource Hash

dcd9f488bd62ba0ee403b07a97e40b9ffd63a0eff61091588c913b16d5153d48

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ics-cert.kaspersky.com/publications/reports/2023/08/10/common-ttps-of-attacks-against-industrial-organizations-implants-for-uploading-data/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 14 Aug 2023 11:25:43 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
last-modified: Wed, 28 Jun 2023 22:12:33 GMT
server: nginx
content-encoding: gzip
etag: W/"649cb051-123"
x-frame-options: sameorigin
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/css
access-control-expose-headers: Content-Length,Content-Range
access-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range
x-xss-protection: 1; mode=block

GET
H2 200 swiper.min.css
ics-cert.kaspersky.com/wp-content/themes/new_ics_cert/assests/css/cdn/ 19 KB
4 KB 76ms
72ms Stylesheet
text/css 185.105.225.103
OOOVPS-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://ics-cert.kaspersky.com/wp-content/themes/new_ics_cert/assests/css/cdn/swiper.min.css?ver=6.2.2

Requested by

Host: ics-cert.kaspersky.com
URL: https://ics-cert.kaspersky.com/publications/reports/2023/08/10/common-ttps-of-attacks-against-industrial-organizations-implants-for-uploading-data/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

185.105.225.103 St Petersburg, Russian Federation, ASN200487 (OOOVPS-AS, RU),

Reverse DNS

fthub.kaspersky.com

Software

nginx /

Resource Hash

5f07d43571a20235b2506061c9729d91179d32b8b3c75123aa8fcd45e60d7541

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ics-cert.kaspersky.com/publications/reports/2023/08/10/common-ttps-of-attacks-against-industrial-organizations-implants-for-uploading-data/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 14 Aug 2023 11:25:43 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
last-modified: Thu, 13 Oct 2022 20:21:24 GMT
server: nginx
content-encoding: gzip
etag: W/"63487344-4d42"
x-frame-options: sameorigin
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/css
access-control-expose-headers: Content-Length,Content-Range
access-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range
x-xss-protection: 1; mode=block

GET
H2 200 select2.min.css
ics-cert.kaspersky.com/wp-content/themes/new_ics_cert/assests/css/cdn/ 15 KB
3 KB 76ms
72ms Stylesheet
text/css 185.105.225.103
OOOVPS-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://ics-cert.kaspersky.com/wp-content/themes/new_ics_cert/assests/css/cdn/select2.min.css?ver=6.2.2

Requested by

Host: ics-cert.kaspersky.com
URL: https://ics-cert.kaspersky.com/publications/reports/2023/08/10/common-ttps-of-attacks-against-industrial-organizations-implants-for-uploading-data/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

185.105.225.103 St Petersburg, Russian Federation, ASN200487 (OOOVPS-AS, RU),

Reverse DNS

fthub.kaspersky.com

Software

nginx /

Resource Hash

31e49ff119a0ddbe6a2c59628e7a7193a97e20992247dd7ffd818f0ab0a6a205

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ics-cert.kaspersky.com/publications/reports/2023/08/10/common-ttps-of-attacks-against-industrial-organizations-implants-for-uploading-data/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 14 Aug 2023 11:25:43 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
last-modified: Thu, 13 Oct 2022 20:21:24 GMT
server: nginx
content-encoding: gzip
etag: W/"63487344-3b4c"
x-frame-options: sameorigin
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/css
access-control-expose-headers: Content-Length,Content-Range
access-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range
x-xss-protection: 1; mode=block

GET
H2 200 selectize.default.min.css
ics-cert.kaspersky.com/wp-content/themes/new_ics_cert/assests/css/cdn/ 9 KB
3 KB 77ms
73ms Stylesheet
text/css 185.105.225.103
OOOVPS-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://ics-cert.kaspersky.com/wp-content/themes/new_ics_cert/assests/css/cdn/selectize.default.min.css?ver=6.2.2

Requested by

Host: ics-cert.kaspersky.com
URL: https://ics-cert.kaspersky.com/publications/reports/2023/08/10/common-ttps-of-attacks-against-industrial-organizations-implants-for-uploading-data/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

185.105.225.103 St Petersburg, Russian Federation, ASN200487 (OOOVPS-AS, RU),

Reverse DNS

fthub.kaspersky.com

Software

nginx /

Resource Hash

89bbd336534007854ca84e6e1659c1304ea19696ab8f9b04af5a2f67707f6cd0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ics-cert.kaspersky.com/publications/reports/2023/08/10/common-ttps-of-attacks-against-industrial-organizations-implants-for-uploading-data/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 14 Aug 2023 11:25:43 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
last-modified: Thu, 13 Oct 2022 20:21:24 GMT
server: nginx
content-encoding: gzip
etag: W/"63487344-24b5"
x-frame-options: sameorigin
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/css
access-control-expose-headers: Content-Length,Content-Range
access-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range
x-xss-protection: 1; mode=block

GET
H2 200 tooltipster.min.css
ics-cert.kaspersky.com/wp-content/themes/new_ics_cert/assests/css/cdn/ 7 KB
2 KB 77ms
74ms Stylesheet
text/css 185.105.225.103
OOOVPS-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://ics-cert.kaspersky.com/wp-content/themes/new_ics_cert/assests/css/cdn/tooltipster.min.css?ver=6.2.2

Requested by

Host: ics-cert.kaspersky.com
URL: https://ics-cert.kaspersky.com/publications/reports/2023/08/10/common-ttps-of-attacks-against-industrial-organizations-implants-for-uploading-data/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

185.105.225.103 St Petersburg, Russian Federation, ASN200487 (OOOVPS-AS, RU),

Reverse DNS

fthub.kaspersky.com

Software

nginx /

Resource Hash

a47d6b5e7293f77a4aaea5a7df20d3830b10acafcce2c54c14befbe3fa5f69ab

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ics-cert.kaspersky.com/publications/reports/2023/08/10/common-ttps-of-attacks-against-industrial-organizations-implants-for-uploading-data/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 14 Aug 2023 11:25:43 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
last-modified: Thu, 13 Oct 2022 20:21:23 GMT
server: nginx
content-encoding: gzip
etag: W/"63487343-1b22"
x-frame-options: sameorigin
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/css
access-control-expose-headers: Content-Length,Content-Range
access-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range
x-xss-protection: 1; mode=block

GET
H2 200 tooltipster-light.min.css
ics-cert.kaspersky.com/wp-content/themes/new_ics_cert/assests/css/cdn/ 207 B
568 B 139ms
136ms Stylesheet
text/css 185.105.225.103
OOOVPS-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://ics-cert.kaspersky.com/wp-content/themes/new_ics_cert/assests/css/cdn/tooltipster-light.min.css?ver=6.2.2

Requested by

Host: ics-cert.kaspersky.com
URL: https://ics-cert.kaspersky.com/publications/reports/2023/08/10/common-ttps-of-attacks-against-industrial-organizations-implants-for-uploading-data/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

185.105.225.103 St Petersburg, Russian Federation, ASN200487 (OOOVPS-AS, RU),

Reverse DNS

fthub.kaspersky.com

Software

nginx /

Resource Hash

1745ea436aaa982c56ab869677fd4846dcd07ea2261fb573572b0af35bb13555

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ics-cert.kaspersky.com/publications/reports/2023/08/10/common-ttps-of-attacks-against-industrial-organizations-implants-for-uploading-data/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 14 Aug 2023 11:25:43 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
last-modified: Thu, 13 Oct 2022 20:21:23 GMT
server: nginx
content-encoding: gzip
etag: W/"63487343-cf"
x-frame-options: sameorigin
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/css
access-control-expose-headers: Content-Length,Content-Range
access-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range
x-xss-protection: 1; mode=block

GET
H2 200 magnific-popup.min.css
ics-cert.kaspersky.com/wp-content/themes/new_ics_cert/assests/css/cdn/ 5 KB
2 KB 142ms
138ms Stylesheet
text/css 185.105.225.103
OOOVPS-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://ics-cert.kaspersky.com/wp-content/themes/new_ics_cert/assests/css/cdn/magnific-popup.min.css?ver=6.2.2

Requested by

Host: ics-cert.kaspersky.com
URL: https://ics-cert.kaspersky.com/publications/reports/2023/08/10/common-ttps-of-attacks-against-industrial-organizations-implants-for-uploading-data/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

185.105.225.103 St Petersburg, Russian Federation, ASN200487 (OOOVPS-AS, RU),

Reverse DNS

fthub.kaspersky.com

Software

nginx /

Resource Hash

3d92e113ac3031b838001ddddf965d045f470ff748ff2e116b30378910eeaecb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ics-cert.kaspersky.com/publications/reports/2023/08/10/common-ttps-of-attacks-against-industrial-organizations-implants-for-uploading-data/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 14 Aug 2023 11:25:43 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
last-modified: Thu, 13 Oct 2022 20:21:23 GMT
server: nginx
content-encoding: gzip
etag: W/"63487343-148b"
x-frame-options: sameorigin
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/css
access-control-expose-headers: Content-Length,Content-Range
access-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range
x-xss-protection: 1; mode=block

GET
H2 200 style.css
ics-cert.kaspersky.com/wp-content/themes/new_ics_cert/assests/css/ 249 KB
54 KB 142ms
139ms Stylesheet
text/css 185.105.225.103
OOOVPS-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://ics-cert.kaspersky.com/wp-content/themes/new_ics_cert/assests/css/style.css?ver=6.2.2

Requested by

Host: ics-cert.kaspersky.com
URL: https://ics-cert.kaspersky.com/publications/reports/2023/08/10/common-ttps-of-attacks-against-industrial-organizations-implants-for-uploading-data/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

185.105.225.103 St Petersburg, Russian Federation, ASN200487 (OOOVPS-AS, RU),

Reverse DNS

fthub.kaspersky.com

Software

nginx /

Resource Hash

b2adb4f008e0cfee4d09dae8a1e4f5c19d2e492ca646326bc026cbcd9874a847

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ics-cert.kaspersky.com/publications/reports/2023/08/10/common-ttps-of-attacks-against-industrial-organizations-implants-for-uploading-data/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 14 Aug 2023 11:25:43 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
last-modified: Mon, 30 Jan 2023 07:34:35 GMT
server: nginx
content-encoding: gzip
etag: W/"63d7730b-3e469"
x-frame-options: sameorigin
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/css
access-control-expose-headers: Content-Length,Content-Range
access-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range
x-xss-protection: 1; mode=block

GET
H2 200 service.css
ics-cert.kaspersky.com/wp-content/themes/new_ics_cert/assests/css/ 1 KB
803 B 142ms
139ms Stylesheet
text/css 185.105.225.103
OOOVPS-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://ics-cert.kaspersky.com/wp-content/themes/new_ics_cert/assests/css/service.css?ver=6.2.2

Requested by

Host: ics-cert.kaspersky.com
URL: https://ics-cert.kaspersky.com/publications/reports/2023/08/10/common-ttps-of-attacks-against-industrial-organizations-implants-for-uploading-data/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

185.105.225.103 St Petersburg, Russian Federation, ASN200487 (OOOVPS-AS, RU),

Reverse DNS

fthub.kaspersky.com

Software

nginx /

Resource Hash

63355ec0cc69d2bbc2fd4aedeec5d2eae03e8453192bff018c65da5493d6853a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ics-cert.kaspersky.com/publications/reports/2023/08/10/common-ttps-of-attacks-against-industrial-organizations-implants-for-uploading-data/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 14 Aug 2023 11:25:43 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
last-modified: Mon, 18 Apr 2022 12:28:43 GMT
server: nginx
content-encoding: gzip
etag: W/"625d597b-422"
x-frame-options: sameorigin
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/css
access-control-expose-headers: Content-Length,Content-Range
access-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range
x-xss-protection: 1; mode=block

GET
H2 200 post.css
ics-cert.kaspersky.com/wp-content/themes/new_ics_cert/assests/css/ 71 KB
16 KB 142ms
139ms Stylesheet
text/css 185.105.225.103
OOOVPS-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://ics-cert.kaspersky.com/wp-content/themes/new_ics_cert/assests/css/post.css?ver=6.2.2

Requested by

Host: ics-cert.kaspersky.com
URL: https://ics-cert.kaspersky.com/publications/reports/2023/08/10/common-ttps-of-attacks-against-industrial-organizations-implants-for-uploading-data/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

185.105.225.103 St Petersburg, Russian Federation, ASN200487 (OOOVPS-AS, RU),

Reverse DNS

fthub.kaspersky.com

Software

nginx /

Resource Hash

9011d877f13b080cfffe09ecf451453de5b60c1af56b35f488561d309edb32b4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ics-cert.kaspersky.com/publications/reports/2023/08/10/common-ttps-of-attacks-against-industrial-organizations-implants-for-uploading-data/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 14 Aug 2023 11:25:43 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
last-modified: Thu, 06 Jul 2023 20:49:03 GMT
server: nginx
content-encoding: gzip
etag: W/"64a728bf-11cc5"
x-frame-options: sameorigin
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/css
access-control-expose-headers: Content-Length,Content-Range
access-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range
x-xss-protection: 1; mode=block

GET
H2 200 simplebar.css
ics-cert.kaspersky.com/wp-content/themes/new_ics_cert/assests/css/libs/ 4 KB
2 KB 142ms
140ms Stylesheet
text/css 185.105.225.103
OOOVPS-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://ics-cert.kaspersky.com/wp-content/themes/new_ics_cert/assests/css/libs/simplebar.css?ver=6.2.2

Requested by

Host: ics-cert.kaspersky.com
URL: https://ics-cert.kaspersky.com/publications/reports/2023/08/10/common-ttps-of-attacks-against-industrial-organizations-implants-for-uploading-data/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

185.105.225.103 St Petersburg, Russian Federation, ASN200487 (OOOVPS-AS, RU),

Reverse DNS

fthub.kaspersky.com

Software

nginx /

Resource Hash

c9e76321a30fe79540c5a5fe74410d3ca813e12e13065b2eb79ce4e969443d11

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ics-cert.kaspersky.com/publications/reports/2023/08/10/common-ttps-of-attacks-against-industrial-organizations-implants-for-uploading-data/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 14 Aug 2023 11:25:43 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
last-modified: Fri, 19 Aug 2022 09:49:34 GMT
server: nginx
content-encoding: gzip
etag: W/"62ff5cae-f32"
x-frame-options: sameorigin
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/css
access-control-expose-headers: Content-Length,Content-Range
access-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range
x-xss-protection: 1; mode=block

GET
H2 200 fix.css
ics-cert.kaspersky.com/wp-content/themes/new_ics_cert/assests/css/ 3 KB
1 KB 142ms
140ms Stylesheet
text/css 185.105.225.103
OOOVPS-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://ics-cert.kaspersky.com/wp-content/themes/new_ics_cert/assests/css/fix.css?ver=6.2.2

Requested by

Host: ics-cert.kaspersky.com
URL: https://ics-cert.kaspersky.com/publications/reports/2023/08/10/common-ttps-of-attacks-against-industrial-organizations-implants-for-uploading-data/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

185.105.225.103 St Petersburg, Russian Federation, ASN200487 (OOOVPS-AS, RU),

Reverse DNS

fthub.kaspersky.com

Software

nginx /

Resource Hash

1d3745f80b6110a92a9c4eb260a1f34c93b118e2898f0af2bc83d1894c67f63a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ics-cert.kaspersky.com/publications/reports/2023/08/10/common-ttps-of-attacks-against-industrial-organizations-implants-for-uploading-data/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 14 Aug 2023 11:25:43 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
last-modified: Thu, 06 Jul 2023 20:59:10 GMT
server: nginx
content-encoding: gzip
etag: W/"64a72b1e-b59"
x-frame-options: sameorigin
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/css
access-control-expose-headers: Content-Length,Content-Range
access-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range
x-xss-protection: 1; mode=block

GET
H2 200 X27_enlighterjs.min.css
ics-cert.kaspersky.com/wp-content/plugins/enlighter/cache/ 78 KB
12 KB 142ms
140ms Stylesheet
text/css 185.105.225.103
OOOVPS-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://ics-cert.kaspersky.com/wp-content/plugins/enlighter/cache/X27_enlighterjs.min.css?ver=M75GyXRxHHGm8B9

Requested by

Host: ics-cert.kaspersky.com
URL: https://ics-cert.kaspersky.com/publications/reports/2023/08/10/common-ttps-of-attacks-against-industrial-organizations-implants-for-uploading-data/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

185.105.225.103 St Petersburg, Russian Federation, ASN200487 (OOOVPS-AS, RU),

Reverse DNS

fthub.kaspersky.com

Software

nginx /

Resource Hash

2db9f73aadc19fc7a482d18f2ad3626268a76237e4d64f07d46214ca3fed20d6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ics-cert.kaspersky.com/publications/reports/2023/08/10/common-ttps-of-attacks-against-industrial-organizations-implants-for-uploading-data/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 14 Aug 2023 11:25:43 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
last-modified: Mon, 14 Aug 2023 11:25:43 GMT
server: nginx
content-encoding: gzip
etag: W/"64da0f37-1388a"
x-frame-options: sameorigin
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/css
access-control-expose-headers: Content-Length,Content-Range
access-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range
x-xss-protection: 1; mode=block

GET
H2 200 logo-ics.svg
ics-cert.kaspersky.com/wp-content/themes/new_ics_cert/assests/img/ 7 KB
3 KB 142ms
135ms Image
image/svg+xml 185.105.225.103
OOOVPS-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ics-cert.kaspersky.com/wp-content/themes/new_ics_cert/assests/img/logo-ics.svg

Requested by

Host: ics-cert.kaspersky.com
URL: https://ics-cert.kaspersky.com/publications/reports/2023/08/10/common-ttps-of-attacks-against-industrial-organizations-implants-for-uploading-data/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

185.105.225.103 St Petersburg, Russian Federation, ASN200487 (OOOVPS-AS, RU),

Reverse DNS

fthub.kaspersky.com

Software

nginx /

Resource Hash

55fb0a022d2809bd202995a210109bdd7ff494af4fd47336902b2fbd952c808a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ics-cert.kaspersky.com/publications/reports/2023/08/10/common-ttps-of-attacks-against-industrial-organizations-implants-for-uploading-data/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 14 Aug 2023 11:25:43 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
last-modified: Wed, 06 Oct 2021 14:27:01 GMT
server: nginx
content-encoding: gzip
etag: W/"615db235-1c7b"
x-frame-options: sameorigin
access-control-allow-methods: GET, POST, OPTIONS
content-type: image/svg+xml
access-control-expose-headers: Content-Length,Content-Range
access-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range
x-xss-protection: 1; mode=block

GET
H2 200 telegram.svg
ics-cert.kaspersky.com/wp-content/themes/new_ics_cert/assests/img/icons/ 1 KB
989 B 142ms
136ms Image
image/svg+xml 185.105.225.103
OOOVPS-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ics-cert.kaspersky.com/wp-content/themes/new_ics_cert/assests/img/icons/telegram.svg

Requested by

Host: ics-cert.kaspersky.com
URL: https://ics-cert.kaspersky.com/publications/reports/2023/08/10/common-ttps-of-attacks-against-industrial-organizations-implants-for-uploading-data/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

185.105.225.103 St Petersburg, Russian Federation, ASN200487 (OOOVPS-AS, RU),

Reverse DNS

fthub.kaspersky.com

Software

nginx /

Resource Hash

fc9310308aaf2b1b2b0dd07ac2458a8c27075f269107bae5c8d1523a1b433406

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ics-cert.kaspersky.com/publications/reports/2023/08/10/common-ttps-of-attacks-against-industrial-organizations-implants-for-uploading-data/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 14 Aug 2023 11:25:43 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
last-modified: Wed, 23 Mar 2022 22:19:08 GMT
server: nginx
content-encoding: gzip
etag: W/"623b9cdc-449"
x-frame-options: sameorigin
access-control-allow-methods: GET, POST, OPTIONS
content-type: image/svg+xml
access-control-expose-headers: Content-Length,Content-Range
access-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range
x-xss-protection: 1; mode=block

GET
H2 200 twitter.svg
ics-cert.kaspersky.com/wp-content/themes/new_ics_cert/assests/img/icons/ 2 KB
1 KB 142ms
136ms Image
image/svg+xml 185.105.225.103
OOOVPS-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ics-cert.kaspersky.com/wp-content/themes/new_ics_cert/assests/img/icons/twitter.svg

Requested by

Host: ics-cert.kaspersky.com
URL: https://ics-cert.kaspersky.com/publications/reports/2023/08/10/common-ttps-of-attacks-against-industrial-organizations-implants-for-uploading-data/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

185.105.225.103 St Petersburg, Russian Federation, ASN200487 (OOOVPS-AS, RU),

Reverse DNS

fthub.kaspersky.com

Software

nginx /

Resource Hash

cb23d15260f981e96001c4ed717434452f702481486e3b181b11334e857044b7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ics-cert.kaspersky.com/publications/reports/2023/08/10/common-ttps-of-attacks-against-industrial-organizations-implants-for-uploading-data/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 14 Aug 2023 11:25:43 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
last-modified: Wed, 09 Jun 2021 09:44:34 GMT
server: nginx
content-encoding: gzip
etag: W/"60c08d82-850"
x-frame-options: sameorigin
access-control-allow-methods: GET, POST, OPTIONS
content-type: image/svg+xml
access-control-expose-headers: Content-Length,Content-Range
access-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range
x-xss-protection: 1; mode=block

GET
H2 200 in.svg
ics-cert.kaspersky.com/wp-content/themes/new_ics_cert/assests/img/icons/ 868 B
884 B 142ms
136ms Image
image/svg+xml 185.105.225.103
OOOVPS-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ics-cert.kaspersky.com/wp-content/themes/new_ics_cert/assests/img/icons/in.svg

Requested by

Host: ics-cert.kaspersky.com
URL: https://ics-cert.kaspersky.com/publications/reports/2023/08/10/common-ttps-of-attacks-against-industrial-organizations-implants-for-uploading-data/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

185.105.225.103 St Petersburg, Russian Federation, ASN200487 (OOOVPS-AS, RU),

Reverse DNS

fthub.kaspersky.com

Software

nginx /

Resource Hash

30960da3876f4fe08239419423e5f31d9715e50fac4c892f6d6087c2a817d752

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ics-cert.kaspersky.com/publications/reports/2023/08/10/common-ttps-of-attacks-against-industrial-organizations-implants-for-uploading-data/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 14 Aug 2023 11:25:43 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
last-modified: Fri, 20 Aug 2021 12:34:17 GMT
server: nginx
content-encoding: gzip
etag: W/"611fa149-364"
x-frame-options: sameorigin
access-control-allow-methods: GET, POST, OPTIONS
content-type: image/svg+xml
access-control-expose-headers: Content-Length,Content-Range
access-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range
x-xss-protection: 1; mode=block

GET
H2 200 email.svg
ics-cert.kaspersky.com/wp-content/themes/new_ics_cert/assests/img/icons/ 1 KB
893 B 142ms
136ms Image
image/svg+xml 185.105.225.103
OOOVPS-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ics-cert.kaspersky.com/wp-content/themes/new_ics_cert/assests/img/icons/email.svg

Requested by

Host: ics-cert.kaspersky.com
URL: https://ics-cert.kaspersky.com/publications/reports/2023/08/10/common-ttps-of-attacks-against-industrial-organizations-implants-for-uploading-data/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

185.105.225.103 St Petersburg, Russian Federation, ASN200487 (OOOVPS-AS, RU),

Reverse DNS

fthub.kaspersky.com

Software

nginx /

Resource Hash

190615a6ddc58e11e24bce9d742205deac48e47037dd32bab36574536af1e7c2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ics-cert.kaspersky.com/publications/reports/2023/08/10/common-ttps-of-attacks-against-industrial-organizations-implants-for-uploading-data/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 14 Aug 2023 11:25:43 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
last-modified: Wed, 09 Jun 2021 09:44:31 GMT
server: nginx
content-encoding: gzip
etag: W/"60c08d7f-4c4"
x-frame-options: sameorigin
access-control-allow-methods: GET, POST, OPTIONS
content-type: image/svg+xml
access-control-expose-headers: Content-Length,Content-Range
access-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range
x-xss-protection: 1; mode=block

GET
H2 200 kruglov.jpg
ics-cert.kaspersky.com/wp-content/uploads/sites/27/2021/11/ 250 KB
250 KB 142ms
137ms Image
image/jpeg 185.105.225.103
OOOVPS-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ics-cert.kaspersky.com/wp-content/uploads/sites/27/2021/11/kruglov.jpg

Requested by

Host: ics-cert.kaspersky.com
URL: https://ics-cert.kaspersky.com/publications/reports/2023/08/10/common-ttps-of-attacks-against-industrial-organizations-implants-for-uploading-data/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

185.105.225.103 St Petersburg, Russian Federation, ASN200487 (OOOVPS-AS, RU),

Reverse DNS

fthub.kaspersky.com

Software

nginx /

Resource Hash

177fa440deacfe8aa6b3d01e431308c1cab3c165d2f9175ce4a3e63952dd6cb3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ics-cert.kaspersky.com/publications/reports/2023/08/10/common-ttps-of-attacks-against-industrial-organizations-implants-for-uploading-data/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 14 Aug 2023 11:25:43 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
last-modified: Wed, 24 Nov 2021 13:02:31 GMT
server: nginx
etag: "619e37e7-3e6e3"
x-frame-options: sameorigin
access-control-allow-methods: GET, POST, OPTIONS
content-type: image/jpeg
access-control-expose-headers: Content-Length,Content-Range
accept-ranges: bytes
access-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range
content-length: 255715
x-xss-protection: 1; mode=block

GET
H2 200 kopeycev.jpg
ics-cert.kaspersky.com/wp-content/uploads/sites/27/2021/11/ 33 KB
33 KB 142ms
137ms Image
image/jpeg 185.105.225.103
OOOVPS-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ics-cert.kaspersky.com/wp-content/uploads/sites/27/2021/11/kopeycev.jpg

Requested by

Host: ics-cert.kaspersky.com
URL: https://ics-cert.kaspersky.com/publications/reports/2023/08/10/common-ttps-of-attacks-against-industrial-organizations-implants-for-uploading-data/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

185.105.225.103 St Petersburg, Russian Federation, ASN200487 (OOOVPS-AS, RU),

Reverse DNS

fthub.kaspersky.com

Software

nginx /

Resource Hash

1fbf65ee83992c5928497d41fbb6da61f884761dda468d2dbaa3c851c2a0b65a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ics-cert.kaspersky.com/publications/reports/2023/08/10/common-ttps-of-attacks-against-industrial-organizations-implants-for-uploading-data/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 14 Aug 2023 11:25:43 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
last-modified: Wed, 24 Nov 2021 13:08:10 GMT
server: nginx
etag: "619e393a-8301"
x-frame-options: sameorigin
access-control-allow-methods: GET, POST, OPTIONS
content-type: image/jpeg
access-control-expose-headers: Content-Length,Content-Range
accept-ranges: bytes
access-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range
content-length: 33537
x-xss-protection: 1; mode=block

GET
H2 200 snegirev.png
ics-cert.kaspersky.com/wp-content/uploads/sites/27/2022/06/ 29 KB
30 KB 143ms
137ms Image
image/png 185.105.225.103
OOOVPS-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ics-cert.kaspersky.com/wp-content/uploads/sites/27/2022/06/snegirev.png

Requested by

Host: ics-cert.kaspersky.com
URL: https://ics-cert.kaspersky.com/publications/reports/2023/08/10/common-ttps-of-attacks-against-industrial-organizations-implants-for-uploading-data/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

185.105.225.103 St Petersburg, Russian Federation, ASN200487 (OOOVPS-AS, RU),

Reverse DNS

fthub.kaspersky.com

Software

nginx /

Resource Hash

fa9df2917ec7c5bbb641eadbcf39890a04fcae497df7fd6b566db6f88e1b8f11

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ics-cert.kaspersky.com/publications/reports/2023/08/10/common-ttps-of-attacks-against-industrial-organizations-implants-for-uploading-data/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 14 Aug 2023 11:25:43 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
last-modified: Thu, 23 Jun 2022 15:27:05 GMT
server: nginx
etag: "62b48649-74e9"
x-frame-options: sameorigin
access-control-allow-methods: GET, POST, OPTIONS
content-type: image/png
access-control-expose-headers: Content-Length,Content-Range
accept-ranges: bytes
access-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range
content-length: 29929
x-xss-protection: 1; mode=block

GET
H2 200 table_of_contents.js Show response
ics-cert.kaspersky.com/wp-content/themes/new_ics_cert/assests/js/ 4 KB
2 KB 68ms
68ms Script
application/javascript 185.105.225.103
OOOVPS-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://ics-cert.kaspersky.com/wp-content/themes/new_ics_cert/assests/js/table_of_contents.js

Requested by

Host: ics-cert.kaspersky.com
URL: https://ics-cert.kaspersky.com/publications/reports/2023/08/10/common-ttps-of-attacks-against-industrial-organizations-implants-for-uploading-data/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

185.105.225.103 St Petersburg, Russian Federation, ASN200487 (OOOVPS-AS, RU),

Reverse DNS

fthub.kaspersky.com

Software

nginx /

Resource Hash

67c26a5fecf3cf8d59f0525c9026dddf05d60ff355b28380d0edaa39934ec850

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ics-cert.kaspersky.com/publications/reports/2023/08/10/common-ttps-of-attacks-against-industrial-organizations-implants-for-uploading-data/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 14 Aug 2023 11:25:43 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
last-modified: Thu, 20 Apr 2023 21:37:42 GMT
server: nginx
content-encoding: gzip
etag: W/"6441b0a6-e6c"
x-frame-options: sameorigin
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-expose-headers: Content-Length,Content-Range
access-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range
x-xss-protection: 1; mode=block

GET
H2 200 rss-vector-footer.svg
ics-cert.kaspersky.com/wp-content/themes/new_ics_cert/assests/img/ 779 B
856 B 143ms
137ms Image
image/svg+xml 185.105.225.103
OOOVPS-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ics-cert.kaspersky.com/wp-content/themes/new_ics_cert/assests/img/rss-vector-footer.svg

Requested by

Host: ics-cert.kaspersky.com
URL: https://ics-cert.kaspersky.com/publications/reports/2023/08/10/common-ttps-of-attacks-against-industrial-organizations-implants-for-uploading-data/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

185.105.225.103 St Petersburg, Russian Federation, ASN200487 (OOOVPS-AS, RU),

Reverse DNS

fthub.kaspersky.com

Software

nginx /

Resource Hash

d0b124b8f696eba5c0d222ec4d34eea1d44e372001121a61f5048f34cda8840e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ics-cert.kaspersky.com/publications/reports/2023/08/10/common-ttps-of-attacks-against-industrial-organizations-implants-for-uploading-data/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 14 Aug 2023 11:25:43 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
last-modified: Thu, 19 Jan 2023 05:01:03 GMT
server: nginx
content-encoding: gzip
etag: W/"63c8ce8f-30b"
x-frame-options: sameorigin
access-control-allow-methods: GET, POST, OPTIONS
content-type: image/svg+xml
access-control-expose-headers: Content-Length,Content-Range
access-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range
x-xss-protection: 1; mode=block

GET
H2 200 key.svg
ics-cert.kaspersky.com/wp-content/themes/new_ics_cert/assests/img/icons/ 696 B
804 B 143ms
138ms Image
image/svg+xml 185.105.225.103
OOOVPS-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ics-cert.kaspersky.com/wp-content/themes/new_ics_cert/assests/img/icons/key.svg

Requested by

Host: ics-cert.kaspersky.com
URL: https://ics-cert.kaspersky.com/publications/reports/2023/08/10/common-ttps-of-attacks-against-industrial-organizations-implants-for-uploading-data/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

185.105.225.103 St Petersburg, Russian Federation, ASN200487 (OOOVPS-AS, RU),

Reverse DNS

fthub.kaspersky.com

Software

nginx /

Resource Hash

fe9d09bad67180679d03b4770178e713030ed0f67118d9efa98f4f15165de2ee

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ics-cert.kaspersky.com/publications/reports/2023/08/10/common-ttps-of-attacks-against-industrial-organizations-implants-for-uploading-data/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 14 Aug 2023 11:25:43 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
last-modified: Wed, 09 Jun 2021 09:05:02 GMT
server: nginx
content-encoding: gzip
etag: W/"60c0843e-2b8"
x-frame-options: sameorigin
access-control-allow-methods: GET, POST, OPTIONS
content-type: image/svg+xml
access-control-expose-headers: Content-Length,Content-Range
access-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range
x-xss-protection: 1; mode=block

GET
H2 200 footer_cert.svg
ics-cert.kaspersky.com/wp-content/themes/new_ics_cert/assests/img/ 11 KB
4 KB 143ms
138ms Image
image/svg+xml 185.105.225.103
OOOVPS-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ics-cert.kaspersky.com/wp-content/themes/new_ics_cert/assests/img/footer_cert.svg

Requested by

Host: ics-cert.kaspersky.com
URL: https://ics-cert.kaspersky.com/publications/reports/2023/08/10/common-ttps-of-attacks-against-industrial-organizations-implants-for-uploading-data/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

185.105.225.103 St Petersburg, Russian Federation, ASN200487 (OOOVPS-AS, RU),

Reverse DNS

fthub.kaspersky.com

Software

nginx /

Resource Hash

31a1988204c7cd76f06d2dbd82b0ee536ce8f004f1e7afd8dfb411229bbb43c3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ics-cert.kaspersky.com/publications/reports/2023/08/10/common-ttps-of-attacks-against-industrial-organizations-implants-for-uploading-data/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 14 Aug 2023 11:25:43 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
last-modified: Fri, 19 Nov 2021 18:28:44 GMT
server: nginx
content-encoding: gzip
etag: W/"6197ecdc-2b4e"
x-frame-options: sameorigin
access-control-allow-methods: GET, POST, OPTIONS
content-type: image/svg+xml
access-control-expose-headers: Content-Length,Content-Range
access-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range
x-xss-protection: 1; mode=block

GET
H2 200 kaspersky.svg
ics-cert.kaspersky.com/wp-content/themes/new_ics_cert/assests/img/ 3 KB
2 KB 143ms
138ms Image
image/svg+xml 185.105.225.103
OOOVPS-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ics-cert.kaspersky.com/wp-content/themes/new_ics_cert/assests/img/kaspersky.svg

Requested by

Host: ics-cert.kaspersky.com
URL: https://ics-cert.kaspersky.com/publications/reports/2023/08/10/common-ttps-of-attacks-against-industrial-organizations-implants-for-uploading-data/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

185.105.225.103 St Petersburg, Russian Federation, ASN200487 (OOOVPS-AS, RU),

Reverse DNS

fthub.kaspersky.com

Software

nginx /

Resource Hash

13c01fc2e94ee7c569128355c1e85f6a8c85b6f34a26270215d4b1a3fe3f72ef

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ics-cert.kaspersky.com/publications/reports/2023/08/10/common-ttps-of-attacks-against-industrial-organizations-implants-for-uploading-data/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 14 Aug 2023 11:25:43 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
last-modified: Wed, 09 Jun 2021 09:04:53 GMT
server: nginx
content-encoding: gzip
etag: W/"60c08435-d69"
x-frame-options: sameorigin
access-control-allow-methods: GET, POST, OPTIONS
content-type: image/svg+xml
access-control-expose-headers: Content-Length,Content-Range
access-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range
x-xss-protection: 1; mode=block

GET
H2 200 jquery-3.6.4.min.js Show response
ics-cert.kaspersky.com/wp-content/themes/new_ics_cert/assests/js/ 88 KB
36 KB 79ms
71ms Script
application/javascript 185.105.225.103
OOOVPS-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://ics-cert.kaspersky.com/wp-content/themes/new_ics_cert/assests/js/jquery-3.6.4.min.js?ver=6.2.2

Requested by

Host: ics-cert.kaspersky.com
URL: https://ics-cert.kaspersky.com/publications/reports/2023/08/10/common-ttps-of-attacks-against-industrial-organizations-implants-for-uploading-data/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

185.105.225.103 St Petersburg, Russian Federation, ASN200487 (OOOVPS-AS, RU),

Reverse DNS

fthub.kaspersky.com

Software

nginx /

Resource Hash

a0fe8723dcf55da64d06b25446d0a8513e52527c45afcb37073465f9c6f352af

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ics-cert.kaspersky.com/publications/reports/2023/08/10/common-ttps-of-attacks-against-industrial-organizations-implants-for-uploading-data/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 14 Aug 2023 11:25:43 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
last-modified: Thu, 20 Apr 2023 21:00:44 GMT
server: nginx
content-encoding: gzip
etag: W/"6441a7fc-15ec3"
x-frame-options: sameorigin
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-expose-headers: Content-Length,Content-Range
access-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range
x-xss-protection: 1; mode=block

GET
H2 200 libs.js Show response
ics-cert.kaspersky.com/wp-content/themes/new_ics_cert/assests/js/ 478 KB
167 KB 85ms
77ms Script
application/javascript 185.105.225.103
OOOVPS-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://ics-cert.kaspersky.com/wp-content/themes/new_ics_cert/assests/js/libs.js

Requested by

Host: ics-cert.kaspersky.com
URL: https://ics-cert.kaspersky.com/publications/reports/2023/08/10/common-ttps-of-attacks-against-industrial-organizations-implants-for-uploading-data/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

185.105.225.103 St Petersburg, Russian Federation, ASN200487 (OOOVPS-AS, RU),

Reverse DNS

fthub.kaspersky.com

Software

nginx /

Resource Hash

da924ffa322b79af0af2e0c4ac8ee6beb62e16c0313d723dda9f8d27c7bbdb96

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ics-cert.kaspersky.com/publications/reports/2023/08/10/common-ttps-of-attacks-against-industrial-organizations-implants-for-uploading-data/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 14 Aug 2023 11:25:43 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
last-modified: Tue, 12 Jul 2022 20:37:33 GMT
server: nginx
content-encoding: gzip
etag: W/"62cddb8d-778a0"
x-frame-options: sameorigin
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-expose-headers: Content-Length,Content-Range
access-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range
x-xss-protection: 1; mode=block

GET
H2 200 ScrollMagic.min.js Show response
ics-cert.kaspersky.com/wp-content/themes/new_ics_cert/assests/js/libs/ 17 KB
7 KB 137ms
129ms Script
application/javascript 185.105.225.103
OOOVPS-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://ics-cert.kaspersky.com/wp-content/themes/new_ics_cert/assests/js/libs/ScrollMagic.min.js

Requested by

Host: ics-cert.kaspersky.com
URL: https://ics-cert.kaspersky.com/publications/reports/2023/08/10/common-ttps-of-attacks-against-industrial-organizations-implants-for-uploading-data/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

185.105.225.103 St Petersburg, Russian Federation, ASN200487 (OOOVPS-AS, RU),

Reverse DNS

fthub.kaspersky.com

Software

nginx /

Resource Hash

da9dad45994fa30a773ffd383f0daba950926e1c95fc807b644554825ac34bf7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ics-cert.kaspersky.com/publications/reports/2023/08/10/common-ttps-of-attacks-against-industrial-organizations-implants-for-uploading-data/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 14 Aug 2023 11:25:43 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
last-modified: Tue, 23 Aug 2022 13:26:17 GMT
server: nginx
content-encoding: gzip
etag: W/"6304d579-4416"
x-frame-options: sameorigin
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-expose-headers: Content-Length,Content-Range
access-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range
x-xss-protection: 1; mode=block

GET
H2 200 debug.addIndicators.min.js Show response
ics-cert.kaspersky.com/wp-content/themes/new_ics_cert/assests/js/libs/ 7 KB
3 KB 137ms
129ms Script
application/javascript 185.105.225.103
OOOVPS-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://ics-cert.kaspersky.com/wp-content/themes/new_ics_cert/assests/js/libs/debug.addIndicators.min.js

Requested by

Host: ics-cert.kaspersky.com
URL: https://ics-cert.kaspersky.com/publications/reports/2023/08/10/common-ttps-of-attacks-against-industrial-organizations-implants-for-uploading-data/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

185.105.225.103 St Petersburg, Russian Federation, ASN200487 (OOOVPS-AS, RU),

Reverse DNS

fthub.kaspersky.com

Software

nginx /

Resource Hash

5c15402dcdd0b03490883b62681c0d676af10894c7ce55218650d0f3827c6f0f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ics-cert.kaspersky.com/publications/reports/2023/08/10/common-ttps-of-attacks-against-industrial-organizations-implants-for-uploading-data/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 14 Aug 2023 11:25:43 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
last-modified: Tue, 23 Aug 2022 13:26:30 GMT
server: nginx
content-encoding: gzip
etag: W/"6304d586-1bb8"
x-frame-options: sameorigin
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-expose-headers: Content-Length,Content-Range
access-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range
x-xss-protection: 1; mode=block

GET
H2 200 select2.min.js Show response
ics-cert.kaspersky.com/wp-content/themes/new_ics_cert/assests/js/libs/ 67 KB
23 KB 137ms
130ms Script
application/javascript 185.105.225.103
OOOVPS-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://ics-cert.kaspersky.com/wp-content/themes/new_ics_cert/assests/js/libs/select2.min.js

Requested by

Host: ics-cert.kaspersky.com
URL: https://ics-cert.kaspersky.com/publications/reports/2023/08/10/common-ttps-of-attacks-against-industrial-organizations-implants-for-uploading-data/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

185.105.225.103 St Petersburg, Russian Federation, ASN200487 (OOOVPS-AS, RU),

Reverse DNS

fthub.kaspersky.com

Software

nginx /

Resource Hash

1870b7c456eb7af4346917168392449543a7717617c53b4c3ae03be1c5803d3c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ics-cert.kaspersky.com/publications/reports/2023/08/10/common-ttps-of-attacks-against-industrial-organizations-implants-for-uploading-data/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 14 Aug 2023 11:25:43 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
last-modified: Tue, 23 Aug 2022 13:26:16 GMT
server: nginx
content-encoding: gzip
etag: W/"6304d578-10b24"
x-frame-options: sameorigin
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-expose-headers: Content-Length,Content-Range
access-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range
x-xss-protection: 1; mode=block

GET
H2 200 selectize.min.js Show response
ics-cert.kaspersky.com/wp-content/themes/new_ics_cert/assests/js/libs/ 45 KB
18 KB 140ms
132ms Script
application/javascript 185.105.225.103
OOOVPS-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://ics-cert.kaspersky.com/wp-content/themes/new_ics_cert/assests/js/libs/selectize.min.js

Requested by

Host: ics-cert.kaspersky.com
URL: https://ics-cert.kaspersky.com/publications/reports/2023/08/10/common-ttps-of-attacks-against-industrial-organizations-implants-for-uploading-data/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

185.105.225.103 St Petersburg, Russian Federation, ASN200487 (OOOVPS-AS, RU),

Reverse DNS

fthub.kaspersky.com

Software

nginx /

Resource Hash

f82d00e4896a9aee107123f1ae51a9699c49d38563b118cabbe1bcda49795099

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ics-cert.kaspersky.com/publications/reports/2023/08/10/common-ttps-of-attacks-against-industrial-organizations-implants-for-uploading-data/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 14 Aug 2023 11:25:43 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
last-modified: Tue, 23 Aug 2022 13:26:15 GMT
server: nginx
content-encoding: gzip
etag: W/"6304d577-b309"
x-frame-options: sameorigin
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-expose-headers: Content-Length,Content-Range
access-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range
x-xss-protection: 1; mode=block

GET
H2 200 jquery.tooltipster.min.js Show response
ics-cert.kaspersky.com/wp-content/themes/new_ics_cert/assests/js/libs/ 17 KB
6 KB 140ms
132ms Script
application/javascript 185.105.225.103
OOOVPS-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://ics-cert.kaspersky.com/wp-content/themes/new_ics_cert/assests/js/libs/jquery.tooltipster.min.js

Requested by

Host: ics-cert.kaspersky.com
URL: https://ics-cert.kaspersky.com/publications/reports/2023/08/10/common-ttps-of-attacks-against-industrial-organizations-implants-for-uploading-data/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

185.105.225.103 St Petersburg, Russian Federation, ASN200487 (OOOVPS-AS, RU),

Reverse DNS

fthub.kaspersky.com

Software

nginx /

Resource Hash

95e9e3ea5a0771d7eeead1503d41cde92d8eec6da0bfbc97fcff4e9d173c967a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ics-cert.kaspersky.com/publications/reports/2023/08/10/common-ttps-of-attacks-against-industrial-organizations-implants-for-uploading-data/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 14 Aug 2023 11:25:43 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
last-modified: Tue, 23 Aug 2022 13:26:20 GMT
server: nginx
content-encoding: gzip
etag: W/"6304d57c-4473"
x-frame-options: sameorigin
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-expose-headers: Content-Length,Content-Range
access-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range
x-xss-protection: 1; mode=block

GET
H2 200 jquery.magnific-popup.min.js Show response
ics-cert.kaspersky.com/wp-content/themes/new_ics_cert/assests/js/libs/ 20 KB
8 KB 140ms
132ms Script
application/javascript 185.105.225.103
OOOVPS-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://ics-cert.kaspersky.com/wp-content/themes/new_ics_cert/assests/js/libs/jquery.magnific-popup.min.js

Requested by

Host: ics-cert.kaspersky.com
URL: https://ics-cert.kaspersky.com/publications/reports/2023/08/10/common-ttps-of-attacks-against-industrial-organizations-implants-for-uploading-data/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

185.105.225.103 St Petersburg, Russian Federation, ASN200487 (OOOVPS-AS, RU),

Reverse DNS

fthub.kaspersky.com

Software

nginx /

Resource Hash

3fddc6d28aba3c13d64cfd4847c333ff48c71d4a5a58bd1a0494ca6ae8ac1bb4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ics-cert.kaspersky.com/publications/reports/2023/08/10/common-ttps-of-attacks-against-industrial-organizations-implants-for-uploading-data/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 14 Aug 2023 11:25:43 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
last-modified: Tue, 23 Aug 2022 13:26:22 GMT
server: nginx
content-encoding: gzip
etag: W/"6304d57e-4ef8"
x-frame-options: sameorigin
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-expose-headers: Content-Length,Content-Range
access-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range
x-xss-protection: 1; mode=block

GET
H2 200 inputmask.min.js Show response
ics-cert.kaspersky.com/wp-content/themes/new_ics_cert/assests/js/ 93 KB
33 KB 140ms
133ms Script
application/javascript 185.105.225.103
OOOVPS-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://ics-cert.kaspersky.com/wp-content/themes/new_ics_cert/assests/js/inputmask.min.js

Requested by

Host: ics-cert.kaspersky.com
URL: https://ics-cert.kaspersky.com/publications/reports/2023/08/10/common-ttps-of-attacks-against-industrial-organizations-implants-for-uploading-data/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

185.105.225.103 St Petersburg, Russian Federation, ASN200487 (OOOVPS-AS, RU),

Reverse DNS

fthub.kaspersky.com

Software

nginx /

Resource Hash

0f24ca5085d2d3181b6d4b20158b5282e9f0cf024afce687f8b9611833a17405

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ics-cert.kaspersky.com/publications/reports/2023/08/10/common-ttps-of-attacks-against-industrial-organizations-implants-for-uploading-data/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 14 Aug 2023 11:25:43 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
last-modified: Tue, 21 Sep 2021 07:58:20 GMT
server: nginx
content-encoding: gzip
etag: W/"6149909c-17329"
x-frame-options: sameorigin
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-expose-headers: Content-Length,Content-Range
access-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range
x-xss-protection: 1; mode=block

GET
H2 200 forms2.min.js Show response
go.kaspersky.com/js/forms2/js/ 208 KB
70 KB 149ms
59ms Script
application/x-javascript 104.17.73.206
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://go.kaspersky.com/js/forms2/js/forms2.min.js

Requested by

Host: ics-cert.kaspersky.com
URL: https://ics-cert.kaspersky.com/publications/reports/2023/08/10/common-ttps-of-attacks-against-industrial-organizations-implants-for-uploading-data/

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

104.17.73.206 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f244fcb6b0aeadba8f41f30a7f451c0aaa06445ec854c3d9bbef1c485a036424

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ics-cert.kaspersky.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 14 Aug 2023 11:25:43 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
last-modified: Thu, 13 Jul 2023 18:50:22 GMT
server: cloudflare
age: 1494
etag: "201e3f-34099-60062cdee3780"
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: public, max-age=14400
cf-ray: 7f68d6ba2c10bb3e-FRA
expires: Mon, 14 Aug 2023 15:25:43 GMT

GET
H2 200 simplebar.min.js Show response
ics-cert.kaspersky.com/wp-content/themes/new_ics_cert/assests/js/libs/ 64 KB
24 KB 140ms
133ms Script
application/javascript 185.105.225.103
OOOVPS-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://ics-cert.kaspersky.com/wp-content/themes/new_ics_cert/assests/js/libs/simplebar.min.js

Requested by

Host: ics-cert.kaspersky.com
URL: https://ics-cert.kaspersky.com/publications/reports/2023/08/10/common-ttps-of-attacks-against-industrial-organizations-implants-for-uploading-data/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

185.105.225.103 St Petersburg, Russian Federation, ASN200487 (OOOVPS-AS, RU),

Reverse DNS

fthub.kaspersky.com

Software

nginx /

Resource Hash

b6e9507fb570c499c7f80306e10f49aedc4b83ace08371c4024e1ebd04aa7b8b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ics-cert.kaspersky.com/publications/reports/2023/08/10/common-ttps-of-attacks-against-industrial-organizations-implants-for-uploading-data/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 14 Aug 2023 11:25:43 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
last-modified: Fri, 19 Aug 2022 09:41:19 GMT
server: nginx
content-encoding: gzip
etag: W/"62ff5abf-10140"
x-frame-options: sameorigin
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-expose-headers: Content-Length,Content-Range
access-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range
x-xss-protection: 1; mode=block

GET
H2 200 script.js Show response
ics-cert.kaspersky.com/wp-content/themes/new_ics_cert/assests/js/ 277 KB
77 KB 140ms
133ms Script
application/javascript 185.105.225.103
OOOVPS-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://ics-cert.kaspersky.com/wp-content/themes/new_ics_cert/assests/js/script.js

Requested by

Host: ics-cert.kaspersky.com
URL: https://ics-cert.kaspersky.com/publications/reports/2023/08/10/common-ttps-of-attacks-against-industrial-organizations-implants-for-uploading-data/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

185.105.225.103 St Petersburg, Russian Federation, ASN200487 (OOOVPS-AS, RU),

Reverse DNS

fthub.kaspersky.com

Software

nginx /

Resource Hash

c4c16e7aaba6f1771a33267ffa6a2edb3147ee8654e119794419219fed6c3061

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ics-cert.kaspersky.com/publications/reports/2023/08/10/common-ttps-of-attacks-against-industrial-organizations-implants-for-uploading-data/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 14 Aug 2023 11:25:43 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
last-modified: Thu, 06 Jul 2023 20:43:42 GMT
server: nginx
content-encoding: gzip
etag: W/"64a7277e-454b7"
x-frame-options: sameorigin
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-expose-headers: Content-Length,Content-Range
access-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range
x-xss-protection: 1; mode=block

GET
H2 200 post.js Show response
ics-cert.kaspersky.com/wp-content/themes/new_ics_cert/assests/js/ 14 KB
5 KB 140ms
133ms Script
application/javascript 185.105.225.103
OOOVPS-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://ics-cert.kaspersky.com/wp-content/themes/new_ics_cert/assests/js/post.js

Requested by

Host: ics-cert.kaspersky.com
URL: https://ics-cert.kaspersky.com/publications/reports/2023/08/10/common-ttps-of-attacks-against-industrial-organizations-implants-for-uploading-data/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

185.105.225.103 St Petersburg, Russian Federation, ASN200487 (OOOVPS-AS, RU),

Reverse DNS

fthub.kaspersky.com

Software

nginx /

Resource Hash

802201fb0c8df6708dfc7f2425f573e040cd4a4ce277a5e834972c5a70bc49bb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ics-cert.kaspersky.com/publications/reports/2023/08/10/common-ttps-of-attacks-against-industrial-organizations-implants-for-uploading-data/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 14 Aug 2023 11:25:43 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
last-modified: Wed, 05 Jul 2023 22:43:49 GMT
server: nginx
content-encoding: gzip
etag: W/"64a5f225-3922"
x-frame-options: sameorigin
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-expose-headers: Content-Length,Content-Range
access-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range
x-xss-protection: 1; mode=block

GET
H2 200 search.js Show response
ics-cert.kaspersky.com/wp-content/themes/new_ics_cert/assests/js/ 376 KB
131 KB 141ms
134ms Script
application/javascript 185.105.225.103
OOOVPS-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://ics-cert.kaspersky.com/wp-content/themes/new_ics_cert/assests/js/search.js

Requested by

Host: ics-cert.kaspersky.com
URL: https://ics-cert.kaspersky.com/publications/reports/2023/08/10/common-ttps-of-attacks-against-industrial-organizations-implants-for-uploading-data/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

185.105.225.103 St Petersburg, Russian Federation, ASN200487 (OOOVPS-AS, RU),

Reverse DNS

fthub.kaspersky.com

Software

nginx /

Resource Hash

a81fd0cb9f98399373bd142e503674322f3ece668d07731663da3fa925451030

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ics-cert.kaspersky.com/publications/reports/2023/08/10/common-ttps-of-attacks-against-industrial-organizations-implants-for-uploading-data/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 14 Aug 2023 11:25:43 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
last-modified: Thu, 06 Jul 2023 20:43:42 GMT
server: nginx
content-encoding: gzip
etag: W/"64a7277e-5e071"
x-frame-options: sameorigin
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-expose-headers: Content-Length,Content-Range
access-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range
x-xss-protection: 1; mode=block

GET
H2 200 ajax.js Show response
ics-cert.kaspersky.com/wp-content/themes/new_ics_cert/assests/js/ 0
411 B 141ms
134ms Script
application/javascript 185.105.225.103
OOOVPS-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://ics-cert.kaspersky.com/wp-content/themes/new_ics_cert/assests/js/ajax.js

Requested by

Host: ics-cert.kaspersky.com
URL: https://ics-cert.kaspersky.com/publications/reports/2023/08/10/common-ttps-of-attacks-against-industrial-organizations-implants-for-uploading-data/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

185.105.225.103 St Petersburg, Russian Federation, ASN200487 (OOOVPS-AS, RU),

Reverse DNS

fthub.kaspersky.com

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ics-cert.kaspersky.com/publications/reports/2023/08/10/common-ttps-of-attacks-against-industrial-organizations-implants-for-uploading-data/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 14 Aug 2023 11:25:43 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
last-modified: Fri, 18 Jun 2021 10:35:22 GMT
server: nginx
etag: "60cc76ea-0"
x-frame-options: sameorigin
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-expose-headers: Content-Length,Content-Range
accept-ranges: bytes
access-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range
content-length: 0
x-xss-protection: 1; mode=block

GET
H2 200 cvsscalc30.js Show response
ics-cert.kaspersky.com/wp-content/themes/new_ics_cert/assests/js/ 20 KB
7 KB 141ms
134ms Script
application/javascript 185.105.225.103
OOOVPS-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://ics-cert.kaspersky.com/wp-content/themes/new_ics_cert/assests/js/cvsscalc30.js

Requested by

Host: ics-cert.kaspersky.com
URL: https://ics-cert.kaspersky.com/publications/reports/2023/08/10/common-ttps-of-attacks-against-industrial-organizations-implants-for-uploading-data/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

185.105.225.103 St Petersburg, Russian Federation, ASN200487 (OOOVPS-AS, RU),

Reverse DNS

fthub.kaspersky.com

Software

nginx /

Resource Hash

515bc9f8975260083cab2128b2fd713331077149edfb309b08e8a3a9a4bba885

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ics-cert.kaspersky.com/publications/reports/2023/08/10/common-ttps-of-attacks-against-industrial-organizations-implants-for-uploading-data/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 14 Aug 2023 11:25:43 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
last-modified: Tue, 22 Jun 2021 10:58:44 GMT
server: nginx
content-encoding: gzip
etag: W/"60d1c264-4f08"
x-frame-options: sameorigin
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-expose-headers: Content-Length,Content-Range
access-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range
x-xss-protection: 1; mode=block

GET
H2 200 commit.js Show response
ics-cert.kaspersky.com/wp-content/themes/new_ics_cert/assests/js/ 50 KB
11 KB 141ms
135ms Script
application/javascript 185.105.225.103
OOOVPS-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://ics-cert.kaspersky.com/wp-content/themes/new_ics_cert/assests/js/commit.js

Requested by

Host: ics-cert.kaspersky.com
URL: https://ics-cert.kaspersky.com/publications/reports/2023/08/10/common-ttps-of-attacks-against-industrial-organizations-implants-for-uploading-data/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

185.105.225.103 St Petersburg, Russian Federation, ASN200487 (OOOVPS-AS, RU),

Reverse DNS

fthub.kaspersky.com

Software

nginx /

Resource Hash

b657648fea8dfd40797f82706fd82b2771a7c18aedac16ceaa3a64851f38b9b8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ics-cert.kaspersky.com/publications/reports/2023/08/10/common-ttps-of-attacks-against-industrial-organizations-implants-for-uploading-data/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 14 Aug 2023 11:25:43 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
last-modified: Thu, 06 Jul 2023 20:54:17 GMT
server: nginx
content-encoding: gzip
etag: W/"64a729f9-c743"
x-frame-options: sameorigin
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-expose-headers: Content-Length,Content-Range
access-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range
x-xss-protection: 1; mode=block

GET
H2 200 X27_enlighterjs.min.js Show response
ics-cert.kaspersky.com/wp-content/plugins/enlighter/cache/ 62 KB
21 KB 141ms
135ms Script
application/javascript 185.105.225.103
OOOVPS-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://ics-cert.kaspersky.com/wp-content/plugins/enlighter/cache/X27_enlighterjs.min.js?ver=M75GyXRxHHGm8B9

Requested by

Host: ics-cert.kaspersky.com
URL: https://ics-cert.kaspersky.com/publications/reports/2023/08/10/common-ttps-of-attacks-against-industrial-organizations-implants-for-uploading-data/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

185.105.225.103 St Petersburg, Russian Federation, ASN200487 (OOOVPS-AS, RU),

Reverse DNS

fthub.kaspersky.com

Software

nginx /

Resource Hash

b2d31599822dae1353d655633c6dbd9454ef2138d172798f4a91119eedd6d89d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ics-cert.kaspersky.com/publications/reports/2023/08/10/common-ttps-of-attacks-against-industrial-organizations-implants-for-uploading-data/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 14 Aug 2023 11:25:43 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
last-modified: Mon, 14 Aug 2023 11:25:43 GMT
server: nginx
content-encoding: gzip
etag: W/"64da0f37-f756"
x-frame-options: sameorigin
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-expose-headers: Content-Length,Content-Range
access-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range
x-xss-protection: 1; mode=block

GET
H2 200 OneSignalSDK.js Show response
cdn.onesignal.com/sdks/ 9 KB
3 KB 146ms
60ms Script
application/javascript 2606:4700::6812:d63b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.onesignal.com/sdks/OneSignalSDK.js?ver=6.2.2

Requested by

Host: ics-cert.kaspersky.com
URL: https://ics-cert.kaspersky.com/publications/reports/2023/08/10/common-ttps-of-attacks-against-industrial-organizations-implants-for-uploading-data/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:d63b , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c0d7eace6de7a123701ad163455f50ea9f6f51c5985a49f4d1f6e797009fbdb1

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ics-cert.kaspersky.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 14 Aug 2023 11:25:43 GMT
via: 1.1 google
content-encoding: br
cf-cache-status: HIT
server: cloudflare
strict-transport-security: max-age=15552000; includeSubDomains
age: 311
etag: W/"2a3bbde818bef34d53a0df862ead5d5f"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=259200
cf-ray: 7f68d6ba2a8e1e50-FRA
access-control-allow-headers: OneSignal-Subscription-Id
alt-svc: h3=":443"; ma=86400
expires: Thu, 17 Aug 2023 11:25:43 GMT

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 496 KB
123 KB 196ms
106ms Script
application/javascript 2a00:1450:4001:80f::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-WZ7LJ3

Requested by

Host: ics-cert.kaspersky.com
URL: https://ics-cert.kaspersky.com/publications/reports/2023/08/10/common-ttps-of-attacks-against-industrial-organizations-implants-for-uploading-data/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

bdf4fab427beceb19827fa750805a66faf459083f377c05be78ce06c06410db8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ics-cert.kaspersky.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 14 Aug 2023 11:25:43 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 125945
x-xss-protection: 0
last-modified: Mon, 14 Aug 2023 09:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Mon, 14 Aug 2023 11:25:43 GMT

GET
H2 200 wp-emoji-release.min.js Show response
ics-cert.kaspersky.com/wp-includes/js/ 18 KB
6 KB 143ms
138ms Script
application/javascript 185.105.225.103
OOOVPS-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://ics-cert.kaspersky.com/wp-includes/js/wp-emoji-release.min.js?ver=6.2.2

Requested by

Host: ics-cert.kaspersky.com
URL: https://ics-cert.kaspersky.com/publications/reports/2023/08/10/common-ttps-of-attacks-against-industrial-organizations-implants-for-uploading-data/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

185.105.225.103 St Petersburg, Russian Federation, ASN200487 (OOOVPS-AS, RU),

Reverse DNS

fthub.kaspersky.com

Software

nginx /

Resource Hash

4f79a89d16a5f717110fe080c0bf90b7e05ff95a4c4983f64d33110bf5f9c230

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ics-cert.kaspersky.com/publications/reports/2023/08/10/common-ttps-of-attacks-against-industrial-organizations-implants-for-uploading-data/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 14 Aug 2023 11:25:43 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
last-modified: Wed, 28 Jun 2023 22:12:33 GMT
server: nginx
content-encoding: gzip
etag: W/"649cb051-4904"
x-frame-options: sameorigin
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-expose-headers: Content-Length,Content-Range
access-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range
x-xss-protection: 1; mode=block

GET
H2 200 recaptcha__de.js Show response
www.gstatic.com/recaptcha/releases/3kTz7WGoZLQTivI-amNftGZO/ 441 KB
178 KB 131ms
39ms Script
text/javascript 2a00:1450:4001:809::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/recaptcha/releases/3kTz7WGoZLQTivI-amNftGZO/recaptcha__de.js

Requested by

Host: www.google.com
URL: https://www.google.com/recaptcha/api.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1d005e54c557c7b45e4dbbe2abb05bf33bb52631faed17189da60940b07c25ae

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://ics-cert.kaspersky.com/
Origin: https://ics-cert.kaspersky.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 14 Aug 2023 00:18:41 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 40022
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 181564
x-xss-protection: 0
last-modified: Sun, 06 Aug 2023 12:02:10 GMT
server: sffe
cross-origin-opener-policy: same-origin-allow-popups; report-to="recaptcha"
vary: Accept-Encoding
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Tue, 13 Aug 2024 00:18:41 GMT

GET
H2 200 search.svg
ics-cert.kaspersky.com/wp-content/themes/new_ics_cert/assests/images/icons/ 2 KB
1 KB 140ms
139ms Image
image/svg+xml 185.105.225.103
OOOVPS-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ics-cert.kaspersky.com/wp-content/themes/new_ics_cert/assests/images/icons/search.svg

Requested by

Host: ics-cert.kaspersky.com
URL: https://ics-cert.kaspersky.com/wp-content/themes/new_ics_cert/assests/css/style.css?ver=6.2.2

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

185.105.225.103 St Petersburg, Russian Federation, ASN200487 (OOOVPS-AS, RU),

Reverse DNS

fthub.kaspersky.com

Software

nginx /

Resource Hash

7fc0056c4e8fb3c755fa7ae276931566ae8b635948b6f663ae6812b9fafc8742

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ics-cert.kaspersky.com/wp-content/themes/new_ics_cert/assests/css/style.css?ver=6.2.2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 14 Aug 2023 11:25:43 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
last-modified: Fri, 20 Aug 2021 17:44:02 GMT
server: nginx
content-encoding: gzip
etag: W/"611fe9e2-789"
x-frame-options: sameorigin
access-control-allow-methods: GET, POST, OPTIONS
content-type: image/svg+xml
access-control-expose-headers: Content-Length,Content-Range
access-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range
x-xss-protection: 1; mode=block

GET
H2 200 breadcrumbs-arrow.svg
ics-cert.kaspersky.com/wp-content/themes/new_ics_cert/assests/images/icons/ 1 KB
1 KB 141ms
139ms Image
image/svg+xml 185.105.225.103
OOOVPS-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ics-cert.kaspersky.com/wp-content/themes/new_ics_cert/assests/images/icons/breadcrumbs-arrow.svg

Requested by

Host: ics-cert.kaspersky.com
URL: https://ics-cert.kaspersky.com/wp-content/themes/new_ics_cert/assests/css/style.css?ver=6.2.2

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

185.105.225.103 St Petersburg, Russian Federation, ASN200487 (OOOVPS-AS, RU),

Reverse DNS

fthub.kaspersky.com

Software

nginx /

Resource Hash

aa60c8b27a9a97424a86c8ac244c0d6b6986e0062ecde772de2a07aa446959d7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ics-cert.kaspersky.com/wp-content/themes/new_ics_cert/assests/css/style.css?ver=6.2.2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 14 Aug 2023 11:25:43 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
last-modified: Fri, 20 Aug 2021 17:44:04 GMT
server: nginx
content-encoding: gzip
etag: W/"611fe9e4-54e"
x-frame-options: sameorigin
access-control-allow-methods: GET, POST, OPTIONS
content-type: image/svg+xml
access-control-expose-headers: Content-Length,Content-Range
access-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range
x-xss-protection: 1; mode=block

GET
H2 200 pdf_white.svg
ics-cert.kaspersky.com/wp-content/themes/new_ics_cert/assests/images/icons/ 566 B
712 B 139ms
139ms Image
image/svg+xml 185.105.225.103
OOOVPS-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ics-cert.kaspersky.com/wp-content/themes/new_ics_cert/assests/images/icons/pdf_white.svg

Requested by

Host: ics-cert.kaspersky.com
URL: https://ics-cert.kaspersky.com/wp-content/themes/new_ics_cert/assests/css/style.css?ver=6.2.2

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

185.105.225.103 St Petersburg, Russian Federation, ASN200487 (OOOVPS-AS, RU),

Reverse DNS

fthub.kaspersky.com

Software

nginx /

Resource Hash

70ba6d4d54217bc2d539a1bbee55ce4aac3e73ec717fc802784cbe767442f35e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ics-cert.kaspersky.com/wp-content/themes/new_ics_cert/assests/css/style.css?ver=6.2.2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 14 Aug 2023 11:25:43 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
last-modified: Fri, 20 Aug 2021 17:44:03 GMT
server: nginx
content-encoding: gzip
etag: W/"611fe9e3-236"
x-frame-options: sameorigin
access-control-allow-methods: GET, POST, OPTIONS
content-type: image/svg+xml
access-control-expose-headers: Content-Length,Content-Range
access-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range
x-xss-protection: 1; mode=block

GET
H2 200 arrow-up_green.svg
ics-cert.kaspersky.com/wp-content/themes/new_ics_cert/assests/images/icons/ 294 B
630 B 139ms
139ms Image
image/svg+xml 185.105.225.103
OOOVPS-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ics-cert.kaspersky.com/wp-content/themes/new_ics_cert/assests/images/icons/arrow-up_green.svg

Requested by

Host: ics-cert.kaspersky.com
URL: https://ics-cert.kaspersky.com/wp-content/themes/new_ics_cert/assests/css/style.css?ver=6.2.2

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

185.105.225.103 St Petersburg, Russian Federation, ASN200487 (OOOVPS-AS, RU),

Reverse DNS

fthub.kaspersky.com

Software

nginx /

Resource Hash

5c713c5088e6e5670a082c76b5945af0bdf14874cabc5f3cbf2f967c2ace0ed9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ics-cert.kaspersky.com/wp-content/themes/new_ics_cert/assests/css/style.css?ver=6.2.2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 14 Aug 2023 11:25:43 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
last-modified: Fri, 20 Aug 2021 17:44:10 GMT
server: nginx
content-encoding: gzip
etag: W/"611fe9ea-126"
x-frame-options: sameorigin
access-control-allow-methods: GET, POST, OPTIONS
content-type: image/svg+xml
access-control-expose-headers: Content-Length,Content-Range
access-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range
x-xss-protection: 1; mode=block

GET
H2 200 MuseoSansCyrl-500.woff
ics-cert.kaspersky.com/wp-content/themes/new_ics_cert/assests/fonts/ 44 KB
45 KB 139ms
139ms Font
font/woff 185.105.225.103
OOOVPS-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://ics-cert.kaspersky.com/wp-content/themes/new_ics_cert/assests/fonts/MuseoSansCyrl-500.woff

Requested by

Host: ics-cert.kaspersky.com
URL: https://ics-cert.kaspersky.com/wp-content/themes/new_ics_cert/assests/css/style.css?ver=6.2.2

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

185.105.225.103 St Petersburg, Russian Federation, ASN200487 (OOOVPS-AS, RU),

Reverse DNS

fthub.kaspersky.com

Software

nginx /

Resource Hash

91612bae01a48954d84ad43d0753b720742d72730d13582f2d315fd21dadb561

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

Referer: https://ics-cert.kaspersky.com/wp-content/themes/new_ics_cert/assests/css/style.css?ver=6.2.2
Origin: https://ics-cert.kaspersky.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 14 Aug 2023 11:25:43 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
last-modified: Fri, 20 Aug 2021 11:57:26 GMT
server: nginx
etag: "611f98a6-b060"
x-frame-options: sameorigin
access-control-allow-methods: GET, POST, OPTIONS
content-type: font/woff
access-control-allow-origin: https://ics-cert.kaspersky.com
access-control-expose-headers: Content-Length,Content-Range
accept-ranges: bytes
access-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range
content-length: 45152
x-xss-protection: 1; mode=block

GET
H2 200 KasperskySans-Medium.woff
ics-cert.kaspersky.com/wp-content/themes/new_ics_cert/assests/fonts/ 45 KB
46 KB 139ms
139ms Font
font/woff 185.105.225.103
OOOVPS-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://ics-cert.kaspersky.com/wp-content/themes/new_ics_cert/assests/fonts/KasperskySans-Medium.woff

Requested by

Host: ics-cert.kaspersky.com
URL: https://ics-cert.kaspersky.com/wp-content/themes/new_ics_cert/assests/css/style.css?ver=6.2.2

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

185.105.225.103 St Petersburg, Russian Federation, ASN200487 (OOOVPS-AS, RU),

Reverse DNS

fthub.kaspersky.com

Software

nginx /

Resource Hash

5d08cf4192fbf7d68490f54b84f4d4d784126d0c7e3a72a95f9014eb07cbc92f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

Referer: https://ics-cert.kaspersky.com/wp-content/themes/new_ics_cert/assests/css/style.css?ver=6.2.2
Origin: https://ics-cert.kaspersky.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 14 Aug 2023 11:25:43 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
last-modified: Tue, 05 Apr 2022 12:44:38 GMT
server: nginx
etag: "624c39b6-b500"
x-frame-options: sameorigin
access-control-allow-methods: GET, POST, OPTIONS
content-type: font/woff
access-control-allow-origin: https://ics-cert.kaspersky.com
access-control-expose-headers: Content-Length,Content-Range
accept-ranges: bytes
access-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range
content-length: 46336
x-xss-protection: 1; mode=block

GET
H2 200 KasperskySans-Light.woff
ics-cert.kaspersky.com/wp-content/themes/new_ics_cert/assests/fonts/ 45 KB
46 KB 140ms
139ms Font
font/woff 185.105.225.103
OOOVPS-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://ics-cert.kaspersky.com/wp-content/themes/new_ics_cert/assests/fonts/KasperskySans-Light.woff

Requested by

Host: ics-cert.kaspersky.com
URL: https://ics-cert.kaspersky.com/wp-content/themes/new_ics_cert/assests/css/style.css?ver=6.2.2

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

185.105.225.103 St Petersburg, Russian Federation, ASN200487 (OOOVPS-AS, RU),

Reverse DNS

fthub.kaspersky.com

Software

nginx /

Resource Hash

e6c4ea7a876a3217a3ed3b77f102bcf88b06334e573b145af0c6018c78ce308a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

Referer: https://ics-cert.kaspersky.com/wp-content/themes/new_ics_cert/assests/css/style.css?ver=6.2.2
Origin: https://ics-cert.kaspersky.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 14 Aug 2023 11:25:43 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
last-modified: Tue, 05 Apr 2022 12:43:27 GMT
server: nginx
etag: "624c396f-b5b4"
x-frame-options: sameorigin
access-control-allow-methods: GET, POST, OPTIONS
content-type: font/woff
access-control-allow-origin: https://ics-cert.kaspersky.com
access-control-expose-headers: Content-Length,Content-Range
accept-ranges: bytes
access-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range
content-length: 46516
x-xss-protection: 1; mode=block

GET
H2 200 KasperskySans-Bold.woff
ics-cert.kaspersky.com/wp-content/themes/new_ics_cert/assests/fonts/ 45 KB
45 KB 140ms
139ms Font
font/woff 185.105.225.103
OOOVPS-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://ics-cert.kaspersky.com/wp-content/themes/new_ics_cert/assests/fonts/KasperskySans-Bold.woff

Requested by

Host: ics-cert.kaspersky.com
URL: https://ics-cert.kaspersky.com/wp-content/themes/new_ics_cert/assests/css/style.css?ver=6.2.2

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

185.105.225.103 St Petersburg, Russian Federation, ASN200487 (OOOVPS-AS, RU),

Reverse DNS

fthub.kaspersky.com

Software

nginx /

Resource Hash

2d223e51ec208d5f2b3c41dc05814044632a911344fd0031d5986c3d5bae35df

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

Referer: https://ics-cert.kaspersky.com/wp-content/themes/new_ics_cert/assests/css/style.css?ver=6.2.2
Origin: https://ics-cert.kaspersky.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 14 Aug 2023 11:25:43 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
last-modified: Fri, 20 Aug 2021 11:57:24 GMT
server: nginx
etag: "611f98a4-b2ec"
x-frame-options: sameorigin
access-control-allow-methods: GET, POST, OPTIONS
content-type: font/woff
access-control-allow-origin: https://ics-cert.kaspersky.com
access-control-expose-headers: Content-Length,Content-Range
accept-ranges: bytes
access-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range
content-length: 45804
x-xss-protection: 1; mode=block

GET
H2 200 23008-ttps-p3-pic1.png
ics-cert.kaspersky.com/wp-content/uploads/sites/27/2023/07/ 25 KB
26 KB 209ms
209ms Image
image/png 185.105.225.103
OOOVPS-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ics-cert.kaspersky.com/wp-content/uploads/sites/27/2023/07/23008-ttps-p3-pic1.png

Requested by

Host: ics-cert.kaspersky.com
URL: https://ics-cert.kaspersky.com/publications/reports/2023/08/10/common-ttps-of-attacks-against-industrial-organizations-implants-for-uploading-data/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

185.105.225.103 St Petersburg, Russian Federation, ASN200487 (OOOVPS-AS, RU),

Reverse DNS

fthub.kaspersky.com

Software

nginx /

Resource Hash

0bef0a74e8858b0f32daae15bc2053cbde2ad450210d04698663dc2622fd0e79

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ics-cert.kaspersky.com/publications/reports/2023/08/10/common-ttps-of-attacks-against-industrial-organizations-implants-for-uploading-data/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 14 Aug 2023 11:25:43 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
last-modified: Wed, 26 Jul 2023 13:08:05 GMT
server: nginx
etag: "64c11ab5-65cd"
x-frame-options: sameorigin
access-control-allow-methods: GET, POST, OPTIONS
content-type: image/png
access-control-expose-headers: Content-Length,Content-Range
accept-ranges: bytes
access-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range
content-length: 26061
x-xss-protection: 1; mode=block

GET
H2 200 23008-ttps-p3-pic2-1.png
ics-cert.kaspersky.com/wp-content/uploads/sites/27/2023/07/ 17 KB
17 KB 209ms
209ms Image
image/png 185.105.225.103
OOOVPS-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ics-cert.kaspersky.com/wp-content/uploads/sites/27/2023/07/23008-ttps-p3-pic2-1.png

Requested by

Host: ics-cert.kaspersky.com
URL: https://ics-cert.kaspersky.com/publications/reports/2023/08/10/common-ttps-of-attacks-against-industrial-organizations-implants-for-uploading-data/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

185.105.225.103 St Petersburg, Russian Federation, ASN200487 (OOOVPS-AS, RU),

Reverse DNS

fthub.kaspersky.com

Software

nginx /

Resource Hash

96fbf4d6ae61688dd127c7c1db79e0c635c8c04c4cfb0bee52404e33db99f752

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ics-cert.kaspersky.com/publications/reports/2023/08/10/common-ttps-of-attacks-against-industrial-organizations-implants-for-uploading-data/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 14 Aug 2023 11:25:43 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
last-modified: Wed, 26 Jul 2023 13:08:23 GMT
server: nginx
etag: "64c11ac7-436a"
x-frame-options: sameorigin
access-control-allow-methods: GET, POST, OPTIONS
content-type: image/png
access-control-expose-headers: Content-Length,Content-Range
accept-ranges: bytes
access-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range
content-length: 17258
x-xss-protection: 1; mode=block

GET
H2 200 23008-ttps-p3-pic3-1.png
ics-cert.kaspersky.com/wp-content/uploads/sites/27/2023/07/ 38 KB
38 KB 210ms
209ms Image
image/png 185.105.225.103
OOOVPS-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ics-cert.kaspersky.com/wp-content/uploads/sites/27/2023/07/23008-ttps-p3-pic3-1.png

Requested by

Host: ics-cert.kaspersky.com
URL: https://ics-cert.kaspersky.com/publications/reports/2023/08/10/common-ttps-of-attacks-against-industrial-organizations-implants-for-uploading-data/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

185.105.225.103 St Petersburg, Russian Federation, ASN200487 (OOOVPS-AS, RU),

Reverse DNS

fthub.kaspersky.com

Software

nginx /

Resource Hash

409cdaeed063e64948031f689511eebff70994ad174106cb2b05cae90028b54a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ics-cert.kaspersky.com/publications/reports/2023/08/10/common-ttps-of-attacks-against-industrial-organizations-implants-for-uploading-data/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 14 Aug 2023 11:25:43 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
last-modified: Wed, 26 Jul 2023 13:08:48 GMT
server: nginx
etag: "64c11ae0-9753"
x-frame-options: sameorigin
access-control-allow-methods: GET, POST, OPTIONS
content-type: image/png
access-control-expose-headers: Content-Length,Content-Range
accept-ranges: bytes
access-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range
content-length: 38739
x-xss-protection: 1; mode=block

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 52 KB
21 KB 126ms
39ms Script
text/javascript 2a00:1450:4001:810::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: ics-cert.kaspersky.com
URL: https://ics-cert.kaspersky.com/publications/reports/2023/08/10/common-ttps-of-attacks-against-industrial-organizations-implants-for-uploading-data/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ics-cert.kaspersky.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
date: Mon, 14 Aug 2023 09:44:23 GMT
last-modified: Mon, 12 Jun 2023 18:23:07 GMT
server: Golfe2
age: 6080
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 20994
expires: Mon, 14 Aug 2023 11:44:23 GMT

GET
H2 200 check_white.svg
ics-cert.kaspersky.com/wp-content/themes/new_ics_cert/assests/images/icons/ 2 KB
1 KB 166ms
166ms Image
image/svg+xml 185.105.225.103
OOOVPS-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ics-cert.kaspersky.com/wp-content/themes/new_ics_cert/assests/images/icons/check_white.svg

Requested by

Host: ics-cert.kaspersky.com
URL: https://ics-cert.kaspersky.com/wp-content/themes/new_ics_cert/assests/css/style.css?ver=6.2.2

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

185.105.225.103 St Petersburg, Russian Federation, ASN200487 (OOOVPS-AS, RU),

Reverse DNS

fthub.kaspersky.com

Software

nginx /

Resource Hash

0778cd2f1eba0c56ac2c8995079e044d7c80c67345a51799a2e86f70d6ff5f7e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ics-cert.kaspersky.com/wp-content/themes/new_ics_cert/assests/css/style.css?ver=6.2.2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 14 Aug 2023 11:25:43 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
last-modified: Fri, 20 Aug 2021 17:44:10 GMT
server: nginx
content-encoding: gzip
etag: W/"611fe9ea-7e3"
x-frame-options: sameorigin
access-control-allow-methods: GET, POST, OPTIONS
content-type: image/svg+xml
access-control-expose-headers: Content-Length,Content-Range
access-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range
x-xss-protection: 1; mode=block

GET
H2 200 23008-ttps-p3-pic4-1024x935.png
ics-cert.kaspersky.com/wp-content/uploads/sites/27/2023/07/ 196 KB
197 KB 160ms
160ms Image
image/png 185.105.225.103
OOOVPS-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ics-cert.kaspersky.com/wp-content/uploads/sites/27/2023/07/23008-ttps-p3-pic4-1024x935.png

Requested by

Host: ics-cert.kaspersky.com
URL: https://ics-cert.kaspersky.com/publications/reports/2023/08/10/common-ttps-of-attacks-against-industrial-organizations-implants-for-uploading-data/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

185.105.225.103 St Petersburg, Russian Federation, ASN200487 (OOOVPS-AS, RU),

Reverse DNS

fthub.kaspersky.com

Software

nginx /

Resource Hash

6c5dc32dceb1b24a9570dd2f6703d79a0c4c9b9e51b43cf85a43b050bff4f80b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ics-cert.kaspersky.com/publications/reports/2023/08/10/common-ttps-of-attacks-against-industrial-organizations-implants-for-uploading-data/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 14 Aug 2023 11:25:43 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
last-modified: Wed, 26 Jul 2023 13:09:07 GMT
server: nginx
etag: "64c11af3-311b1"
x-frame-options: sameorigin
access-control-allow-methods: GET, POST, OPTIONS
content-type: image/png
access-control-expose-headers: Content-Length,Content-Range
accept-ranges: bytes
access-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range
content-length: 201137
x-xss-protection: 1; mode=block

POST
H2 200 collect Show response
www.google-analytics.com/j/ 15 B
226 B 46ms
46ms XHR
text/plain 2a00:1450:4001:810::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j101&a=189212345&t=pageview&_s=1&dl=https%3A%2F%2Fics-cert.kaspersky.com%2Fpublications%2Freports%2F2023%2F08%2F10%2Fcommon-ttps-of-attacks-against-industrial-organizations-implants-for-uploading-data%2F&ul=en-us&de=UTF-8&dt=Common%20TTPs%20of%20attacks%20against%20industrial%20organizations.%20Implants%20for%20uploading%20data%20%7C%20Kaspersky%20ICS%20CERT&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=IEBAAEABAAAAACAAI~&jid=903983124&gjid=268384611&cid=1849714543.1692012343&tid=UA-88685013-1&_gid=966236890.1692012343&_r=1&_slc=1&z=258407471

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

b29d761d258ea9026f97b4470609b066558fe004a8e42199a5e40b1116d79b98

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://ics-cert.kaspersky.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 14 Aug 2023 11:25:43 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://ics-cert.kaspersky.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 233 KB
81 KB 63ms
62ms Script
application/javascript 2a00:1450:4001:80f::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-93LQN8J8DF&cx=c&_slc=1

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

ad8ebfca83448125b69075f66f41d014ae3ebaeca94c45db6152a24cd24270a7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ics-cert.kaspersky.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 14 Aug 2023 11:25:43 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 82882
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Mon, 14 Aug 2023 11:25:43 GMT

GET
H3 200 gtm.js Show response
www.googletagmanager.com/ 556 KB
142 KB 48ms
47ms Script
application/javascript 2a00:1450:4001:80f::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-T45JW6B&l=dataLayer

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-WZ7LJ3

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

1102a7cca5b96b26e72982d96c1dbcf61db00ef529a7c2bfbb8733d79e562ddf

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ics-cert.kaspersky.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 14 Aug 2023 11:25:43 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 145844
x-xss-protection: 0
last-modified: Mon, 14 Aug 2023 09:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Mon, 14 Aug 2023 11:25:43 GMT

GET
H2 200 OneSignalPageSDKES6.js Show response
cdn.onesignal.com/sdks/ 284 KB
68 KB 61ms
60ms Script
application/javascript 2606:4700::6812:d63b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.onesignal.com/sdks/OneSignalPageSDKES6.js?v=151604

Requested by

Host: cdn.onesignal.com
URL: https://cdn.onesignal.com/sdks/OneSignalSDK.js?ver=6.2.2

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:d63b , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

425197a561a2dc98259d7e284f708115b672f426a8adc0955f6f42fbaa61d7ae

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ics-cert.kaspersky.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 14 Aug 2023 11:25:43 GMT
via: 1.1 google
content-encoding: br
cf-cache-status: HIT
server: cloudflare
strict-transport-security: max-age=15552000; includeSubDomains
age: 365
etag: W/"7f9669464fe15e6a516c0eb693b26dbb"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=259200
cf-ray: 7f68d6bbfd871e50-FRA
access-control-allow-headers: OneSignal-Subscription-Id
alt-svc: h3=":443"; ma=86400
expires: Thu, 17 Aug 2023 11:25:43 GMT

GET
H2 200 MuseoSansCyrl-300.woff
ics-cert.kaspersky.com/wp-content/themes/new_ics_cert/assests/fonts/ 44 KB
44 KB 70ms
70ms Font
font/woff 185.105.225.103
OOOVPS-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://ics-cert.kaspersky.com/wp-content/themes/new_ics_cert/assests/fonts/MuseoSansCyrl-300.woff

Requested by

Host: ics-cert.kaspersky.com
URL: https://ics-cert.kaspersky.com/wp-content/themes/new_ics_cert/assests/css/style.css?ver=6.2.2

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

185.105.225.103 St Petersburg, Russian Federation, ASN200487 (OOOVPS-AS, RU),

Reverse DNS

fthub.kaspersky.com

Software

nginx /

Resource Hash

8d5cd94631173b6f37f652afe93483949846d80d76afe1c5fa2d9a561182c066

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

Referer: https://ics-cert.kaspersky.com/wp-content/themes/new_ics_cert/assests/css/style.css?ver=6.2.2
Origin: https://ics-cert.kaspersky.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 14 Aug 2023 11:25:43 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
last-modified: Fri, 20 Aug 2021 11:57:25 GMT
server: nginx
etag: "611f98a5-aeb4"
x-frame-options: sameorigin
access-control-allow-methods: GET, POST, OPTIONS
content-type: font/woff
access-control-allow-origin: https://ics-cert.kaspersky.com
access-control-expose-headers: Content-Length,Content-Range
accept-ranges: bytes
access-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range
content-length: 44724
x-xss-protection: 1; mode=block

GET
H2 200 anchor Show response
www.google.com/recaptcha/api2/ Frame 76A4 55 KB
31 KB 94ms
93ms Document
text/html 2a00:1450:4001:829::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/anchor?ar=1&k=6Lc4EwkUAAAAAMHZJ47EcbYQ2SNuyT-nYvVtRfqq&co=aHR0cHM6Ly9pY3MtY2VydC5rYXNwZXJza3kuY29tOjQ0Mw..&hl=de&v=3kTz7WGoZLQTivI-amNftGZO&size=normal&cb=a1fycqi8rwu5

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/3kTz7WGoZLQTivI-amNftGZO/recaptcha__de.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

81f6bd4c4c98555102834d312815696bad2d4c961fc1a89ea70f6a109be1ae9c

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-Lt72li5yiuVm6LM7M9g4Eg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://ics-cert.kaspersky.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, no-store, max-age=0, must-revalidate
content-encoding: gzip
content-length: 31323
content-security-policy: script-src 'report-sample' 'nonce-Lt72li5yiuVm6LM7M9g4Eg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Mon, 14 Aug 2023 11:25:43 GMT
expires: Mon, 01 Jan 1990 00:00:00 GMT
pragma: no-cache
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server: GSE
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

POST
H2 204 collect
region1.analytics.google.com/g/ 0
259 B 134ms
46ms Ping
text/plain 2001:4860:4802:34::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://region1.analytics.google.com/g/collect?v=2&tid=G-93LQN8J8DF&gtm=45je3890&_p=189212345&_gaz=1&ul=en-us&sr=1600x1200&cid=1849714543.1692012343&ir=1&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_eu=EBAI&_s=1&dl=https%3A%2F%2Fics-cert.kaspersky.com%2Fpublications%2Freports%2F2023%2F08%2F10%2Fcommon-ttps-of-attacks-against-industrial-organizations-implants-for-uploading-data%2F&dt=Common%20TTPs%20of%20attacks%20against%20industrial%20organizations.%20Implants%20for%20uploading%20data%20%7C%20Kaspersky%20ICS%20CERT&sid=1692012343&sct=1&seg=0&en=page_view&_fv=1&_ss=1&_ee=1
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-93LQN8J8DF&cx=c&_slc=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:34::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ics-cert.kaspersky.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 14 Aug 2023 11:25:43 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://ics-cert.kaspersky.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 collect
stats.g.doubleclick.net/g/ 0
250 B 145ms
48ms Ping
text/plain 2a00:1450:400c:c03::9c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://stats.g.doubleclick.net/g/collect?v=2&tid=G-93LQN8J8DF&cid=1849714543.1692012343&gtm=45je3890&aip=1
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-93LQN8J8DF&cx=c&_slc=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:400c:c03::9c Brussels, Belgium, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ics-cert.kaspersky.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 14 Aug 2023 11:25:43 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://ics-cert.kaspersky.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.de/ads/ 42 B
408 B 167ms
79ms Image
image/gif 2a00:1450:4001:827::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&tid=G-93LQN8J8DF&cid=1849714543.1692012343&gtm=45je3890&aip=1&z=983726954

Requested by

Host: ics-cert.kaspersky.com
URL: https://ics-cert.kaspersky.com/publications/reports/2023/08/10/common-ttps-of-attacks-against-industrial-organizations-implants-for-uploading-data/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ics-cert.kaspersky.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 14 Aug 2023 11:25:43 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 web Show response
onesignal.com/api/v1/sync/422be36b-503e-4627-a36f-992622a95746/ 3 KB
2 KB 52ms
51ms Script
text/javascript 2606:4700::6812:d63b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://onesignal.com/api/v1/sync/422be36b-503e-4627-a36f-992622a95746/web?callback=__jp0

Requested by

Host: cdn.onesignal.com
URL: https://cdn.onesignal.com/sdks/OneSignalPageSDKES6.js?v=151604

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:d63b , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0220d95f886614666a99356b01492d093707917e951cadd60df612ed32fa3783

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ics-cert.kaspersky.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 14 Aug 2023 11:25:43 GMT
via: 1.1 google
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: br
x-permitted-cross-domain-policies: none
strict-transport-security: max-age=15552000; includeSubDomains
age: 165
cf-polished: origSize=3396
alt-svc: h3=":443"; ma=86400
x-xss-protection: 1; mode=block
x-request-id: 7ce2efac-44fb-41be-917f-cbbfe9f9e45d
x-runtime: 0.041198
referrer-policy: strict-origin-when-cross-origin
cf-bgj: minify
server: cloudflare
etag: W/"8909ae62f1598fd72f451b4f14f6bbba"
x-download-options: noopen
vary: Origin, Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=3600
cf-ray: 7f68d6bcbe761e50-FRA
access-control-allow-headers: SDK-Version
expires: Mon, 14 Aug 2023 12:25:43 GMT

GET
H3 200 styles__ltr.css
www.gstatic.com/recaptcha/releases/3kTz7WGoZLQTivI-amNftGZO/ Frame 76A4 55 KB
24 KB 124ms
43ms Stylesheet
text/css 2a00:1450:4001:809::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/recaptcha/releases/3kTz7WGoZLQTivI-amNftGZO/styles__ltr.css

Requested by

Host: www.google.com
URL: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6Lc4EwkUAAAAAMHZJ47EcbYQ2SNuyT-nYvVtRfqq&co=aHR0cHM6Ly9pY3MtY2VydC5rYXNwZXJza3kuY29tOjQ0Mw..&hl=de&v=3kTz7WGoZLQTivI-amNftGZO&size=normal&cb=a1fycqi8rwu5

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

952833e41ba7a4b64c31a2d7b07dde81bf5bbacf5cbb967821cfe459d0c4a0d8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 14 Aug 2023 10:05:22 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 4821
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 24605
x-xss-protection: 0
last-modified: Sun, 06 Aug 2023 12:02:10 GMT
server: sffe
cross-origin-opener-policy: same-origin-allow-popups; report-to="recaptcha"
vary: Accept-Encoding
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type: text/css
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Tue, 13 Aug 2024 10:05:22 GMT

GET
H3 200 recaptcha__de.js Show response
www.gstatic.com/recaptcha/releases/3kTz7WGoZLQTivI-amNftGZO/ Frame 76A4 441 KB
177 KB 122ms
42ms Script
text/javascript 2a00:1450:4001:809::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/recaptcha/releases/3kTz7WGoZLQTivI-amNftGZO/recaptcha__de.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1d005e54c557c7b45e4dbbe2abb05bf33bb52631faed17189da60940b07c25ae

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 14 Aug 2023 00:18:41 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 40022
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 181564
x-xss-protection: 0
last-modified: Sun, 06 Aug 2023 12:02:10 GMT
server: sffe
cross-origin-opener-policy: same-origin-allow-popups; report-to="recaptcha"
vary: Accept-Encoding
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Tue, 13 Aug 2024 00:18:41 GMT

GET
H3 200 destination Show response
www.googletagmanager.com/gtag/ 260 KB
87 KB 48ms
48ms Script
application/javascript 2a00:1450:4001:80f::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/destination?id=G-NSVBRC7S52&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-T45JW6B&l=dataLayer

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

b2fe500cd00a2a9779cb5e31c7b56dd83d6c8a280ed5a92aaf369fcb091876a0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ics-cert.kaspersky.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 14 Aug 2023 11:25:43 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 89486
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Mon, 14 Aug 2023 11:25:43 GMT

GET
H3 200 OneSignalSDKStyles.css
onesignal.com/sdks/ 82 KB
9 KB 52ms
52ms Stylesheet
text/css 2606:4700::6812:d63b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://onesignal.com/sdks/OneSignalSDKStyles.css?v=2

Requested by

Host: cdn.onesignal.com
URL: https://cdn.onesignal.com/sdks/OneSignalPageSDKES6.js?v=151604

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6812:d63b , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

db7e0b393e175f19922fefbdcaa2866fca209c521d01cc834ae06cbf8d0f91b7

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ics-cert.kaspersky.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 14 Aug 2023 11:25:43 GMT
via: 1.1 google
content-encoding: br
cf-cache-status: HIT
server: cloudflare
strict-transport-security: max-age=15552000; includeSubDomains
age: 1901
etag: W/"4e9aaefffd5f8ae7dc83361aa2294190"
vary: Accept-Encoding
content-type: text/css
cache-control: public, max-age=2592000
cf-ray: 7f68d6bd4ef69100-FRA
access-control-allow-headers: OneSignal-Subscription-Id
alt-svc: h3=":443"; ma=86400
expires: Wed, 13 Sep 2023 11:25:43 GMT

GET
H3 200 icon Show response
onesignal.com/api/v1/apps/422be36b-503e-4627-a36f-992622a95746/ 240 B
775 B 146ms
103ms Fetch
application/json 2606:4700::6812:d63b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://onesignal.com/api/v1/apps/422be36b-503e-4627-a36f-992622a95746/icon

Requested by

Host: cdn.onesignal.com
URL: https://cdn.onesignal.com/sdks/OneSignalPageSDKES6.js?v=151604

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6812:d63b , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

97160b6dd11e6c712dac3618caa0b31927e95e0dedee9b9b205fbd2245ca0349

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ics-cert.kaspersky.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 14 Aug 2023 11:25:44 GMT
via: 1.1 google
x-content-type-options: nosniff
cf-cache-status: REVALIDATED
content-encoding: br
x-permitted-cross-domain-policies: none
strict-transport-security: max-age=15552000; includeSubDomains
alt-svc: h3=":443"; ma=86400
x-xss-protection: 1; mode=block
x-request-id: 85163200-f714-46bf-b3fe-8b31e9c0b609
x-runtime: 0.015032
referrer-policy: strict-origin-when-cross-origin
server: cloudflare
etag: W/"97160b6dd11e6c712dac3618caa0b319"
x-download-options: noopen
x-frame-options: SAMEORIGIN
vary: Accept, Origin, Accept-Encoding
content-type: application/json; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=0, private, must-revalidate
cf-ray: 7f68d6be1aed037c-FRA
access-control-allow-headers: SDK-Version

GET
DATA 200
OK truncated
/ Frame 76A4 14 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 0964d141519db34adc6aa127a33dbc6761cda1e56b584ea402082d99c44afb9e

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ Frame 76A4 2 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 43ef4025567f7a15859b5252b6ccc1efe2ff8c7331b1aefbea7ce88eb5084d27

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 logo_48.png
www.gstatic.com/recaptcha/api2/ Frame 76A4 2 KB
2 KB 42ms
42ms Image
image/png 2a00:1450:4001:809::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.gstatic.com/recaptcha/api2/logo_48.png

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/3kTz7WGoZLQTivI-amNftGZO/styles__ltr.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1b9efb22c938500971aac2b2130a475fa23684dd69e43103894968df83145b8a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.gstatic.com/recaptcha/releases/3kTz7WGoZLQTivI-amNftGZO/styles__ltr.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Fri, 11 Aug 2023 09:40:05 GMT
x-content-type-options: nosniff
age: 265539
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2228
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin-allow-popups; report-to="recaptcha"
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type: image/png
cache-control: public, max-age=604800
accept-ranges: bytes
expires: Fri, 18 Aug 2023 09:40:05 GMT

GET
H2 200 KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v18/ Frame 76A4 15 KB
16 KB 130ms
39ms Font
font/woff2 2a00:1450:4001:831::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v18/KFOmCnqEu92Fr1Mu4mxK.woff2

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3e253b66056519aa065b00a453bac37ac5ed8f3e6fe7b542e93a9dcdcc11d0bc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.google.com/
Origin: https://www.google.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Sat, 12 Aug 2023 02:58:03 GMT
x-content-type-options: nosniff
age: 203261
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15344
x-xss-protection: 0
last-modified: Mon, 16 Oct 2017 17:32:55 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 11 Aug 2024 02:58:03 GMT

GET
H3 200 webworker.js
www.google.com/recaptcha/api2/ Frame 76A4 102 B
134 B 50ms
50ms Other
text/javascript 2a00:1450:4001:829::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/webworker.js?hl=de&v=3kTz7WGoZLQTivI-amNftGZO

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

a9c87b1ce80a8696f4790411959bb5cf0ccf1bc0a9c8cf2477c88a44e1104f4b

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6Lc4EwkUAAAAAMHZJ47EcbYQ2SNuyT-nYvVtRfqq&co=aHR0cHM6Ly9pY3MtY2VydC5rYXNwZXJza3kuY29tOjQ0Mw..&hl=de&v=3kTz7WGoZLQTivI-amNftGZO&size=normal&cb=a1fycqi8rwu5
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 14 Aug 2023 11:25:44 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy: frame-ancestors 'self'
server: GSE
cross-origin-embedder-policy: require-corp
x-frame-options: SAMEORIGIN
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=300
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 112
x-xss-protection: 1; mode=block
expires: Mon, 14 Aug 2023 11:25:44 GMT

GET
H2 200 logo_for_push_ics_cert.png
ics-cert.kaspersky.com/wp-content/themes/ics_theme/assets/picture/ 9 KB
10 KB 68ms
68ms Image
image/png 185.105.225.103
OOOVPS-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ics-cert.kaspersky.com/wp-content/themes/ics_theme/assets/picture/logo_for_push_ics_cert.png

Requested by

Host: ics-cert.kaspersky.com
URL: https://ics-cert.kaspersky.com/publications/reports/2023/08/10/common-ttps-of-attacks-against-industrial-organizations-implants-for-uploading-data/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

185.105.225.103 St Petersburg, Russian Federation, ASN200487 (OOOVPS-AS, RU),

Reverse DNS

fthub.kaspersky.com

Software

nginx /

Resource Hash

24d0839fe019a3a2bf30ad9b50ed65935a2718c921e32147db3439a58bd8210a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ics-cert.kaspersky.com/publications/reports/2023/08/10/common-ttps-of-attacks-against-industrial-organizations-implants-for-uploading-data/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 14 Aug 2023 11:25:44 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
last-modified: Wed, 03 Feb 2021 18:33:07 GMT
server: nginx
etag: "601aec63-248f"
x-frame-options: sameorigin
access-control-allow-methods: GET, POST, OPTIONS
content-type: image/png
access-control-expose-headers: Content-Length,Content-Range
accept-ranges: bytes
access-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range
content-length: 9359
x-xss-protection: 1; mode=block

GET
H3 200 bframe Show response
www.google.com/recaptcha/api2/ Frame ABEE 7 KB
1 KB 49ms
49ms Document
text/html 2a00:1450:4001:829::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/bframe?hl=de&v=3kTz7WGoZLQTivI-amNftGZO&k=6Lc4EwkUAAAAAMHZJ47EcbYQ2SNuyT-nYvVtRfqq

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/3kTz7WGoZLQTivI-amNftGZO/recaptcha__de.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

a80116b743fe40a34d40e873673994e0f162f48588653b1b1de5a5fa83dffeea

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-Gq_7E2T7ZDnFdEUzJDbITA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://ics-cert.kaspersky.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, no-store, max-age=0, must-revalidate
content-encoding: gzip
content-length: 1157
content-security-policy: script-src 'report-sample' 'nonce-Gq_7E2T7ZDnFdEUzJDbITA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Mon, 14 Aug 2023 11:25:44 GMT
expires: Mon, 01 Jan 1990 00:00:00 GMT
pragma: no-cache
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server: GSE
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

GET
H3 200 styles__ltr.css
www.gstatic.com/recaptcha/releases/3kTz7WGoZLQTivI-amNftGZO/ Frame ABEE 55 KB
24 KB 39ms
39ms Stylesheet
text/css 2a00:1450:4001:809::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/recaptcha/releases/3kTz7WGoZLQTivI-amNftGZO/styles__ltr.css

Requested by

Host: www.google.com
URL: https://www.google.com/recaptcha/api2/bframe?hl=de&v=3kTz7WGoZLQTivI-amNftGZO&k=6Lc4EwkUAAAAAMHZJ47EcbYQ2SNuyT-nYvVtRfqq

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

952833e41ba7a4b64c31a2d7b07dde81bf5bbacf5cbb967821cfe459d0c4a0d8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 14 Aug 2023 10:05:22 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 4822
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 24605
x-xss-protection: 0
last-modified: Sun, 06 Aug 2023 12:02:10 GMT
server: sffe
cross-origin-opener-policy: same-origin-allow-popups; report-to="recaptcha"
vary: Accept-Encoding
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type: text/css
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Tue, 13 Aug 2024 10:05:22 GMT

GET
H3 200 recaptcha__de.js Show response
www.gstatic.com/recaptcha/releases/3kTz7WGoZLQTivI-amNftGZO/ Frame ABEE 441 KB
177 KB 41ms
40ms Script
text/javascript 2a00:1450:4001:809::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/recaptcha/releases/3kTz7WGoZLQTivI-amNftGZO/recaptcha__de.js

Requested by

Host: www.google.com
URL: https://www.google.com/recaptcha/api2/bframe?hl=de&v=3kTz7WGoZLQTivI-amNftGZO&k=6Lc4EwkUAAAAAMHZJ47EcbYQ2SNuyT-nYvVtRfqq

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1d005e54c557c7b45e4dbbe2abb05bf33bb52631faed17189da60940b07c25ae

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 14 Aug 2023 00:18:41 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 40023
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 181564
x-xss-protection: 0
last-modified: Sun, 06 Aug 2023 12:02:10 GMT
server: sffe
cross-origin-opener-policy: same-origin-allow-popups; report-to="recaptcha"
vary: Accept-Encoding
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Tue, 13 Aug 2024 00:18:41 GMT

GET
H2 200 insight.min.js Show response
snap.licdn.com/li.lms-analytics/ 13 KB
5 KB 197ms
42ms Script
application/x-javascript 2a02:26f0:480:f::213:7ec6
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://snap.licdn.com/li.lms-analytics/insight.min.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-T45JW6B&l=dataLayer

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:480:f::213:7ec6 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Resource Hash

fa53fcd8da139d256c0ca83b69cb37473ca627b6052368ed3327c80d9fb61e25

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ics-cert.kaspersky.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 14 Aug 2023 11:25:44 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Mon, 24 Jul 2023 09:07:54 GMT
x-cdn: AKAM
x-amz-server-side-encryption: AES256
vary: Accept-Encoding
content-type: application/x-javascript;charset=utf-8
cache-control: max-age=8673
accept-ranges: bytes
content-length: 4862

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 169 KB
62 KB 56ms
55ms Script
application/javascript 2a00:1450:4001:80f::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=DC-12346775

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-T45JW6B&l=dataLayer

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

294f901f35cbb8832dd7bb370a05103f82b1205e8eee2ed9ada53c41d4a89eb8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ics-cert.kaspersky.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 14 Aug 2023 11:25:44 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 63925
x-xss-protection: 0
last-modified: Mon, 14 Aug 2023 09:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Mon, 14 Aug 2023 11:25:44 GMT

GET
H2 200 tune.js Show response
js.go2sdk.com/v2/ 18 KB
18 KB 187ms
43ms Script
application/javascript 65.9.95.127
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://js.go2sdk.com/v2/tune.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-WZ7LJ3
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 65.9.95.127 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-65-9-95-127.prg50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: cca8ce472cbf8c44acf7ac24067c2d6075acd1e0cd4c9003de6055289ac5c68a

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ics-cert.kaspersky.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

x-amz-version-id: null
date: Mon, 14 Aug 2023 03:39:39 GMT
via: 1.1 d19bc25644fc0cb24d9e1c2cb87755ca.cloudfront.net (CloudFront)
last-modified: Wed, 06 Jan 2021 18:55:14 GMT
server: AmazonS3
x-amz-cf-pop: PRG50-C1
age: 27966
x-amz-server-side-encryption: AES256
etag: "074c9e70b17ef9db8aced963fef4e2d9"
x-cache: Hit from cloudfront
content-type: application/javascript
accept-ranges: bytes
content-length: 17921
x-amz-cf-id: z20KD7R9aSgrbZViS8WhT8xEfDnyTsMTuEjJxYCmpZJ3pPntrz1FYg==

GET
H2

200

activityi;dc_pre=COfYhpaF3IADFQ0OaAgdadcMSw;src=12346775;type=globalc;cat=globa0;ord=2684071233837;auiddc=289667616.1692012344;u1=B2C;u2=no_locale;u4=ics-cert.kaspersky.com;u5=%2Fpublications%2Frep... Show response
12346775.fls.doubleclick.net/ Frame DE89
Redirect Chain

https://12346775.fls.doubleclick.net/activityi;src=12346775;type=globalc;cat=globa0;ord=2684071233837;auiddc=289667616.1692012344;u1=B2C;u2=no_locale;u4=ics-cert.kaspersky.com;u5=%2Fpublications%2F...
https://12346775.fls.doubleclick.net/activityi;dc_pre=COfYhpaF3IADFQ0OaAgdadcMSw;src=12346775;type=globalc;cat=globa0;ord=2684071233837;auiddc=289667616.1692012344;u1=B2C;u2=no_locale;u4=ics-cert.k...

1013 B
624 B

143ms
143ms

Document
text/html

172.217.16.198
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://12346775.fls.doubleclick.net/activityi;dc_pre=COfYhpaF3IADFQ0OaAgdadcMSw;src=12346775;type=globalc;cat=globa0;ord=2684071233837;auiddc=289667616.1692012344;u1=B2C;u2=no_locale;u4=ics-cert.kaspersky.com;u5=%2Fpublications%2Freports%2F2023%2F08%2F10%2Fcommon-ttps-of-attacks-against-industrial-organizations-implants-for-uploading-data%2F;u6=;u7=undefined-1849714543.1692012343;u9=_publications_reports_2023_08_10_common-ttps-of-attacks-against-industrial-organizations-implants-for-uploading-data_;gtm=45fe3890;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;epver=2;~oref=https%3A%2F%2Fics-cert.kaspersky.com%2Fpublications%2Freports%2F2023%2F08%2F10%2Fcommon-ttps-of-attacks-against-industrial-organizations-implants-for-uploading-data%2F?

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=DC-12346775

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.16.198 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s08-in-f6.1e100.net

Software

cafe /

Resource Hash

898fe17f0ef8137ea960ecaa8db0e625733b4618b6b88b7d4cd67bff27f1224e

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://ics-cert.kaspersky.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-encoding: br
content-length: 448
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 14 Aug 2023 11:25:44 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 14 Aug 2023 11:25:44 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
follow-only-when-prerender-shown: 1
location: https://12346775.fls.doubleclick.net/activityi;dc_pre=COfYhpaF3IADFQ0OaAgdadcMSw;src=12346775;type=globalc;cat=globa0;ord=2684071233837;auiddc=289667616.1692012344;u1=B2C;u2=no_locale;u4=ics-cert.kaspersky.com;u5=%2Fpublications%2Freports%2F2023%2F08%2F10%2Fcommon-ttps-of-attacks-against-industrial-organizations-implants-for-uploading-data%2F;u6=;u7=undefined-1849714543.1692012343;u9=_publications_reports_2023_08_10_common-ttps-of-attacks-against-industrial-organizations-implants-for-uploading-data_;gtm=45fe3890;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;epver=2;~oref=https%3A%2F%2Fics-cert.kaspersky.com%2Fpublications%2Freports%2F2023%2F08%2F10%2Fcommon-ttps-of-attacks-against-industrial-organizations-implants-for-uploading-data%2F?
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 token Show response
cdn.linkedin.oribi.io/partner/39138/domain/ics-cert.kaspersky.com/ 36 B
376 B 127ms
41ms XHR
application/json 2600:9000:2127:fc00:2:53b2:240:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.linkedin.oribi.io/partner/39138/domain/ics-cert.kaspersky.com/token
Requested by: Host: snap.licdn.com
URL: https://snap.licdn.com/li.lms-analytics/insight.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2127:fc00:2:53b2:240:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: 7b1eaaaf180a13c29b6dddc3b0ae23333b4397e0f3c065b4c86da2f2530a5f89

Request headers

Accept: *
Referer: https://ics-cert.kaspersky.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 14 Aug 2023 11:05:31 GMT
content-encoding: gzip
via: 1.1 f3303a5632dc925c26253530523fa328.cloudfront.net (CloudFront)
x-amz-cf-pop: PRG50-C1
age: 1212
vary: accept-encoding
x-cache: Hit from cloudfront
content-type: application/json
access-control-allow-origin: *
cache-control: public, max-age=3600
x-amz-cf-id: SwUgfGWwf3kZ8nsQVmeZQSYxDtGCP-as92ZHnSofqQaaxFeQH86NoA==

GET
H2

200

collect
px4.ads.linkedin.com/
Redirect Chain

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=39138&time=1692012344509&url=https%3A%2F%2Fics-cert.kaspersky.com%2Fpublications%2Freports%2F2023%2F08%2F10%2Fcommon-ttps-of-attacks-against-indus...
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=39138&time=1692012344509&url=https%3A%2F%2Fics-cert.kaspersky.com%2Fpublications%2Freports%2F2023%2F08%2F10%2Fcommon-ttps-of-attacks-against-indus...
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D39138%26time%3D1692012344509%26url%3Dhttps%253A%252F%252Fics-cert.kaspersky.com%2...
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=39138&time=1692012344509&url=https%3A%2F%2Fics-cert.kaspersky.com%2Fpublications%2Freports%2F2023%2F08%2F10%2Fcommon-ttps-of-attacks-against-indus...
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=39138&time=1692012344509&url=https%3A%2F%2Fics-cert.kaspersky.com%2Fpublications%2Freports%2F2023%2F08%2F10%2Fcommon-ttps-of-attacks-against-indu...

0
267 B

233ms
142ms

Image
application/javascript

13.107.42.14
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=39138&time=1692012344509&url=https%3A%2F%2Fics-cert.kaspersky.com%2Fpublications%2Freports%2F2023%2F08%2F10%2Fcommon-ttps-of-attacks-against-industrial-organizations-implants-for-uploading-data%2F&cookiesTest=true&liSync=true&e_ipv6=AQIXDIkq_QeCjwAAAYnzy3cQtm4qdj71GDSFx0pYrAapTSAjV8rKYgY71-fHC4nfX5zbWwo
Protocol: H2
Server: 13.107.42.14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ics-cert.kaspersky.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 14 Aug 2023 11:25:44 GMT
x-li-pop: afd-prod-lva1-x
x-msedge-ref: Ref A: D8E9B8409E4649DB9D95A8A8265EF4DE Ref B: DUS30EDGE0407 Ref C: 2023-08-14T11:25:45Z
linkedin-action: 1
x-cache: CONFIG_NOCACHE
content-type: application/javascript
x-li-fabric: prod-lva1
x-li-proto: http/2
content-length: 0
x-li-uuid: AAYC4FLMjUYXjuJgPA0slg==

Redirect headers

date: Mon, 14 Aug 2023 11:25:44 GMT
x-li-pop: afd-prod-lva1-x
x-msedge-ref: Ref A: 05CAED16026B49228BB3717CD7BBCD7D Ref B: FRAEDGE1221 Ref C: 2023-08-14T11:25:45Z
linkedin-action: 1
x-cache: CONFIG_NOCACHE
x-li-fabric: prod-lva1
location: https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=39138&time=1692012344509&url=https%3A%2F%2Fics-cert.kaspersky.com%2Fpublications%2Freports%2F2023%2F08%2F10%2Fcommon-ttps-of-attacks-against-industrial-organizations-implants-for-uploading-data%2F&cookiesTest=true&liSync=true&e_ipv6=AQIXDIkq_QeCjwAAAYnzy3cQtm4qdj71GDSFx0pYrAapTSAjV8rKYgY71-fHC4nfX5zbWwo
x-li-proto: http/2
content-length: 0
x-li-uuid: AAYC4FLI/I9n+JQ1mcVfBg==

GET
H2 200 dc_pre=COfYhpaF3IADFQ0OaAgdadcMSw;src=12346775;type=globalc;cat=globa0;ord=2684071233837;auiddc=289667616.1692012344;u1=B2C;u2=no_locale;u4=ics-cert.kaspersky.com;u5=%2Fpublications%2Freports%2F202... Show response
adservice.google.com/ddm/fls/i/ Frame 55E7 1012 B
825 B 237ms
148ms Document
text/html 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/ddm/fls/i/dc_pre=COfYhpaF3IADFQ0OaAgdadcMSw;src=12346775;type=globalc;cat=globa0;ord=2684071233837;auiddc=289667616.1692012344;u1=B2C;u2=no_locale;u4=ics-cert.kaspersky.com;u5=%2Fpublications%2Freports%2F2023%2F08%2F10%2Fcommon-ttps-of-attacks-against-industrial-organizations-implants-for-uploading-data%2F;u6=;u7=undefined-1849714543.1692012343;u9=_publications_reports_2023_08_10_common-ttps-of-attacks-against-industrial-organizations-implants-for-uploading-data_;gtm=45fe3890;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;epver=2;~oref=https%3A%2F%2Fics-cert.kaspersky.com%2Fpublications%2Freports%2F2023%2F08%2F10%2Fcommon-ttps-of-attacks-against-industrial-organizations-implants-for-uploading-data%2F

Requested by

Host: 12346775.fls.doubleclick.net
URL: https://12346775.fls.doubleclick.net/activityi;dc_pre=COfYhpaF3IADFQ0OaAgdadcMSw;src=12346775;type=globalc;cat=globa0;ord=2684071233837;auiddc=289667616.1692012344;u1=B2C;u2=no_locale;u4=ics-cert.kaspersky.com;u5=%2Fpublications%2Freports%2F2023%2F08%2F10%2Fcommon-ttps-of-attacks-against-industrial-organizations-implants-for-uploading-data%2F;u6=;u7=undefined-1849714543.1692012343;u9=_publications_reports_2023_08_10_common-ttps-of-attacks-against-industrial-organizations-implants-for-uploading-data_;gtm=45fe3890;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;epver=2;~oref=https%3A%2F%2Fics-cert.kaspersky.com%2Fpublications%2Freports%2F2023%2F08%2F10%2Fcommon-ttps-of-attacks-against-industrial-organizations-implants-for-uploading-data%2F?

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d49fc542ef4b94218db65e59dd632b2df5182be2966d2c056e70d77a6b076c7c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://12346775.fls.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-encoding: br
content-length: 450
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 14 Aug 2023 11:25:45 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
pragma: no-cache
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3

200

dc_pre=COfYhpaF3IADFQ0OaAgdadcMSw;src=12346775;type=globalc;cat=globa0;ord=2684071233837;auiddc=289667616.1692012344;u1=B2C;u2=no_locale;u4=ics-cert.kaspersky.com;u5=%2Fpublications%2Freports%2F202... Show response
12346775.fls.doubleclick.net/ddm/fls/r/ Frame F8EB
Redirect Chain

https://adservice.google.de/ddm/fls/i/dc_pre=COfYhpaF3IADFQ0OaAgdadcMSw;src=12346775;type=globalc;cat=globa0;ord=2684071233837;auiddc=289667616.1692012344;u1=B2C;u2=no_locale;u4=ics-cert.kaspersky....
https://12346775.fls.doubleclick.net/ddm/fls/r/dc_pre=COfYhpaF3IADFQ0OaAgdadcMSw;src=12346775;type=globalc;cat=globa0;ord=2684071233837;auiddc=289667616.1692012344;u1=B2C;u2=no_locale;u4=ics-cert.k...

6 KB
681 B

114ms
114ms

Document
text/html

172.217.16.198
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://12346775.fls.doubleclick.net/ddm/fls/r/dc_pre=COfYhpaF3IADFQ0OaAgdadcMSw;src=12346775;type=globalc;cat=globa0;ord=2684071233837;auiddc=289667616.1692012344;u1=B2C;u2=no_locale;u4=ics-cert.kaspersky.com;u5=%2Fpublications%2Freports%2F2023%2F08%2F10%2Fcommon-ttps-of-attacks-against-industrial-organizations-implants-for-uploading-data%2F;u6=;u7=undefined-1849714543.1692012343;u9=_publications_reports_2023_08_10_common-ttps-of-attacks-against-industrial-organizations-implants-for-uploading-data_;gtm=45fe3890;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;epver=2;~oref=https%3A%2F%2Fics-cert.kaspersky.com%2Fpublications%2Freports%2F2023%2F08%2F10%2Fcommon-ttps-of-attacks-against-industrial-organizations-implants-for-uploading-data%2F

Requested by

Host: adservice.google.com
URL: https://adservice.google.com/ddm/fls/i/dc_pre=COfYhpaF3IADFQ0OaAgdadcMSw;src=12346775;type=globalc;cat=globa0;ord=2684071233837;auiddc=289667616.1692012344;u1=B2C;u2=no_locale;u4=ics-cert.kaspersky.com;u5=%2Fpublications%2Freports%2F2023%2F08%2F10%2Fcommon-ttps-of-attacks-against-industrial-organizations-implants-for-uploading-data%2F;u6=;u7=undefined-1849714543.1692012343;u9=_publications_reports_2023_08_10_common-ttps-of-attacks-against-industrial-organizations-implants-for-uploading-data_;gtm=45fe3890;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;epver=2;~oref=https%3A%2F%2Fics-cert.kaspersky.com%2Fpublications%2Freports%2F2023%2F08%2F10%2Fcommon-ttps-of-attacks-against-industrial-organizations-implants-for-uploading-data%2F

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.16.198 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s08-in-f6.1e100.net

Software

cafe /

Resource Hash

e79f07efdba7e03789d41c9f87c22bef1ac19de8b2f737735621bc6b10fde704

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://adservice.google.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=0
content-encoding: br
content-length: 656
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 14 Aug 2023 11:25:45 GMT
expires: Mon, 14 Aug 2023 11:25:45 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 14 Aug 2023 11:25:45 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
location: https://12346775.fls.doubleclick.net/ddm/fls/r/dc_pre=COfYhpaF3IADFQ0OaAgdadcMSw;src=12346775;type=globalc;cat=globa0;ord=2684071233837;auiddc=289667616.1692012344;u1=B2C;u2=no_locale;u4=ics-cert.kaspersky.com;u5=%2Fpublications%2Freports%2F2023%2F08%2F10%2Fcommon-ttps-of-attacks-against-industrial-organizations-implants-for-uploading-data%2F;u6=;u7=undefined-1849714543.1692012343;u9=_publications_reports_2023_08_10_common-ttps-of-attacks-against-industrial-organizations-implants-for-uploading-data_;gtm=45fe3890;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;epver=2;~oref=https%3A%2F%2Fics-cert.kaspersky.com%2Fpublications%2Freports%2F2023%2F08%2F10%2Fcommon-ttps-of-attacks-against-industrial-organizations-implants-for-uploading-data%2F
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
pragma: no-cache
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2

200

src=13364882;dc_pre=CO31wpaF3IADFYdIwQodh_8GaA;type=invmedia;cat=kaspe00v;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=;gdpr_consent=;ord=3904305599918.8867
adservice.google.com/ddm/fls/z/ Frame F8EB
Redirect Chain

https://ad.doubleclick.net/ddm/activity/src=13364882;type=invmedia;cat=kaspe00v;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=;gdpr_consent=;ord=3904305599918.8867?
https://ad.doubleclick.net/ddm/activity/src=13364882;dc_pre=CO31wpaF3IADFYdIwQodh_8GaA;type=invmedia;cat=kaspe00v;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=;gdpr_consent=;o...
https://adservice.google.com/ddm/fls/z/src=13364882;dc_pre=CO31wpaF3IADFYdIwQodh_8GaA;type=invmedia;cat=kaspe00v;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=;gdpr_consent=;or...

42 B
118 B

148ms
148ms

Image
image/gif

2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://adservice.google.com/ddm/fls/z/src=13364882;dc_pre=CO31wpaF3IADFYdIwQodh_8GaA;type=invmedia;cat=kaspe00v;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=;gdpr_consent=;ord=3904305599918.8867

Requested by

Host: 12346775.fls.doubleclick.net
URL: https://12346775.fls.doubleclick.net/ddm/fls/r/dc_pre=COfYhpaF3IADFQ0OaAgdadcMSw;src=12346775;type=globalc;cat=globa0;ord=2684071233837;auiddc=289667616.1692012344;u1=B2C;u2=no_locale;u4=ics-cert.kaspersky.com;u5=%2Fpublications%2Freports%2F2023%2F08%2F10%2Fcommon-ttps-of-attacks-against-industrial-organizations-implants-for-uploading-data%2F;u6=;u7=undefined-1849714543.1692012343;u9=_publications_reports_2023_08_10_common-ttps-of-attacks-against-industrial-organizations-implants-for-uploading-data_;gtm=45fe3890;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;epver=2;~oref=https%3A%2F%2Fics-cert.kaspersky.com%2Fpublications%2Freports%2F2023%2F08%2F10%2Fcommon-ttps-of-attacks-against-industrial-organizations-implants-for-uploading-data%2F

Protocol

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://12346775.fls.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 14 Aug 2023 11:25:45 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Mon, 14 Aug 2023 11:25:45 GMT
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://adservice.google.com/ddm/fls/z/src=13364882;dc_pre=CO31wpaF3IADFYdIwQodh_8GaA;type=invmedia;cat=kaspe00v;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=;gdpr_consent=;ord=3904305599918.8867
content-type: text/html; charset=UTF-8
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Verdicts & Comments Add Verdict or Comment

76 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

17 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.onesignal.com/	1970-01-20 14:00:14	Name: __cf_bm Value: z7x6_KOYY92z5r8NRMi86GWmvs4ejAheiX3yvA9Usg4-1692012343-0-AYNtzVrz4UraZ/59WGyPavl190n6UYvwfV3wk7HjBxTN1rupBEySeeLII5imV/7oYB8jO4gQ3r2cvcOrrf4tsjw=
.go.kaspersky.com/	1970-01-20 14:00:14	Name: __cf_bm Value: z5RYAuum0cZr_rMJRs9pAMQvt9PZoW0nYC2dAdXg3bU-1692012343-0-AZhgN7kHzt3CN7l80DWb7NjEahBV+aHzdNfo0SYqogrc5QSuYQCCcH3RbCWxCkPzvmJvgILj1Qfl9Ss/y/uWujg=
.kaspersky.com/	1970-01-20 23:36:12	Name: _ga Value: GA1.2.1849714543.1692012343
.kaspersky.com/	1970-01-20 14:01:38	Name: _gid Value: GA1.2.966236890.1692012343
.kaspersky.com/	1970-01-20 14:00:12	Name: _gat Value: 1
.kaspersky.com/	1970-01-20 23:36:12	Name: _ga_93LQN8J8DF Value: GS1.2.1692012343.1.0.1692012343.60.0.0
ics-cert.kaspersky.com/	1970-01-20 23:36:12	Name: CookieConsent Value: {stamp:963627202=='\|Cnecessary:true\|Cpreferences:true\|Cstatistics:true\|Cmarketing:true\|Cver:1\|Cutc:734710102\|Cregion:'not_gdpr'}
.kaspersky.com/	1970-01-20 16:09:48	Name: _gcl_au Value: 1.1.289667616.1692012344
ics-cert.kaspersky.com/	1970-01-20 14:01:38	Name: ln_or Value: eyIzOTEzOCI6ImQifQ%3D%3D
.linkedin.com/	1970-01-20 16:09:48	Name: li_sugr Value: 9387bbfb-10e5-4a8e-a3c0-8ad9d05b5a4e
.linkedin.com/	1970-01-20 22:45:48	Name: bcookie Value: "v=2&374dd26b-81eb-4847-8bc5-b1143aee4cda"
.linkedin.com/	1970-01-20 14:01:38	Name: lidc Value: "b=VGST08:s=V:r=V:a=V:p=V:g=2646:u=1:x=1:i=1692012344:t=1692098744:v=2:sig=AQG7LPa5cyqmmNiFc1i9OB3DPtEFf0pg"
.linkedin.com/	1970-01-20 14:43:24	Name: UserMatchHistory Value: AQLoKVUpkfUl2QAAAYnzy3Xujqjr1VDpNKaDY7jIm_FDud8NVfNgGhE1n4-CI9kQjJTrARdRrlo-3g
.linkedin.com/	1970-01-20 14:43:24	Name: AnalyticsSyncHistory Value: AQIhYcwenTtkFwAAAYnzy3Xu9ntSG2W0c2t9C_9lIYP85V2sKyytCNaJ4q6rYpOK16Hp2si5a79hwuZx6aJarA
.www.linkedin.com/	1970-01-20 22:45:48	Name: bscookie Value: "v=1&20230814112544e6fb1d18-b057-4d7f-8411-48d6ca9fe0afAQFwJdtfyvJKhKO9mt5cwTsKtt19FvEM"
.linkedin.com/	1970-01-20 18:19:24	Name: li_gc Value: MTswOzE2OTIwMTIzNDQ7MjswMjGfO00e/y4ZGR083v7FNaEMMNnnrn0QgdcOvE9NUqnkgA==
.doubleclick.net/	1970-01-20 23:21:48	Name: IDE Value: AHWqTUktLRMBncpo79ywR768QvQZY8kx8JIS15aZMyM3swBlFvNbZKeBwcPxApSTu3U

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

12346775.fls.doubleclick.net
ad.doubleclick.net
adservice.google.com
adservice.google.de
cdn.linkedin.oribi.io
cdn.onesignal.com
fonts.gstatic.com
go.kaspersky.com
ics-cert.kaspersky.com
js.go2sdk.com
onesignal.com
px.ads.linkedin.com
px4.ads.linkedin.com
region1.analytics.google.com
snap.licdn.com
stats.g.doubleclick.net
www.google-analytics.com
www.google.com
www.google.de
www.googletagmanager.com
www.gstatic.com
www.linkedin.com
104.17.73.206
13.107.42.14
142.250.185.102
172.217.16.198
185.105.225.103
2001:4860:4802:34::36
2600:9000:2127:fc00:2:53b2:240:93a1
2606:4700::6812:d63b
2620:1ec:21::14
2a00:1450:4001:809::2003
2a00:1450:4001:80e::2002
2a00:1450:4001:80f::2008
2a00:1450:4001:810::200e
2a00:1450:4001:827::2003
2a00:1450:4001:829::2004
2a00:1450:4001:82f::2002
2a00:1450:4001:831::2003
2a00:1450:400c:c03::9c
2a02:26f0:480:f::213:7ec6
65.9.95.127
0220d95f886614666a99356b01492d093707917e951cadd60df612ed32fa3783
0778cd2f1eba0c56ac2c8995079e044d7c80c67345a51799a2e86f70d6ff5f7e
0964d141519db34adc6aa127a33dbc6761cda1e56b584ea402082d99c44afb9e
0bef0a74e8858b0f32daae15bc2053cbde2ad450210d04698663dc2622fd0e79
0f24ca5085d2d3181b6d4b20158b5282e9f0cf024afce687f8b9611833a17405
1102a7cca5b96b26e72982d96c1dbcf61db00ef529a7c2bfbb8733d79e562ddf
13c01fc2e94ee7c569128355c1e85f6a8c85b6f34a26270215d4b1a3fe3f72ef
1745ea436aaa982c56ab869677fd4846dcd07ea2261fb573572b0af35bb13555
177fa440deacfe8aa6b3d01e431308c1cab3c165d2f9175ce4a3e63952dd6cb3
1870b7c456eb7af4346917168392449543a7717617c53b4c3ae03be1c5803d3c
190615a6ddc58e11e24bce9d742205deac48e47037dd32bab36574536af1e7c2
1b9efb22c938500971aac2b2130a475fa23684dd69e43103894968df83145b8a
1d005e54c557c7b45e4dbbe2abb05bf33bb52631faed17189da60940b07c25ae
1d3745f80b6110a92a9c4eb260a1f34c93b118e2898f0af2bc83d1894c67f63a
1fbf65ee83992c5928497d41fbb6da61f884761dda468d2dbaa3c851c2a0b65a
24d0839fe019a3a2bf30ad9b50ed65935a2718c921e32147db3439a58bd8210a
294f901f35cbb8832dd7bb370a05103f82b1205e8eee2ed9ada53c41d4a89eb8
2d223e51ec208d5f2b3c41dc05814044632a911344fd0031d5986c3d5bae35df
2db9f73aadc19fc7a482d18f2ad3626268a76237e4d64f07d46214ca3fed20d6
30960da3876f4fe08239419423e5f31d9715e50fac4c892f6d6087c2a817d752
31a1988204c7cd76f06d2dbd82b0ee536ce8f004f1e7afd8dfb411229bbb43c3
31e49ff119a0ddbe6a2c59628e7a7193a97e20992247dd7ffd818f0ab0a6a205
3d92e113ac3031b838001ddddf965d045f470ff748ff2e116b30378910eeaecb
3e253b66056519aa065b00a453bac37ac5ed8f3e6fe7b542e93a9dcdcc11d0bc
3fddc6d28aba3c13d64cfd4847c333ff48c71d4a5a58bd1a0494ca6ae8ac1bb4
409cdaeed063e64948031f689511eebff70994ad174106cb2b05cae90028b54a
425197a561a2dc98259d7e284f708115b672f426a8adc0955f6f42fbaa61d7ae
43ef4025567f7a15859b5252b6ccc1efe2ff8c7331b1aefbea7ce88eb5084d27
4f79a89d16a5f717110fe080c0bf90b7e05ff95a4c4983f64d33110bf5f9c230
515bc9f8975260083cab2128b2fd713331077149edfb309b08e8a3a9a4bba885
55fb0a022d2809bd202995a210109bdd7ff494af4fd47336902b2fbd952c808a
5c15402dcdd0b03490883b62681c0d676af10894c7ce55218650d0f3827c6f0f
5c713c5088e6e5670a082c76b5945af0bdf14874cabc5f3cbf2f967c2ace0ed9
5d08cf4192fbf7d68490f54b84f4d4d784126d0c7e3a72a95f9014eb07cbc92f
5f07d43571a20235b2506061c9729d91179d32b8b3c75123aa8fcd45e60d7541
63355ec0cc69d2bbc2fd4aedeec5d2eae03e8453192bff018c65da5493d6853a
67c26a5fecf3cf8d59f0525c9026dddf05d60ff355b28380d0edaa39934ec850
68434a159f52da1ccae58acfe770f5d2fbda1d40f8bef214e44722798b027185
6c5dc32dceb1b24a9570dd2f6703d79a0c4c9b9e51b43cf85a43b050bff4f80b
70ba6d4d54217bc2d539a1bbee55ce4aac3e73ec717fc802784cbe767442f35e
7b1eaaaf180a13c29b6dddc3b0ae23333b4397e0f3c065b4c86da2f2530a5f89
7fc0056c4e8fb3c755fa7ae276931566ae8b635948b6f663ae6812b9fafc8742
802201fb0c8df6708dfc7f2425f573e040cd4a4ce277a5e834972c5a70bc49bb
81f6bd4c4c98555102834d312815696bad2d4c961fc1a89ea70f6a109be1ae9c
898fe17f0ef8137ea960ecaa8db0e625733b4618b6b88b7d4cd67bff27f1224e
89bbd336534007854ca84e6e1659c1304ea19696ab8f9b04af5a2f67707f6cd0
8d5cd94631173b6f37f652afe93483949846d80d76afe1c5fa2d9a561182c066
9011d877f13b080cfffe09ecf451453de5b60c1af56b35f488561d309edb32b4
91612bae01a48954d84ad43d0753b720742d72730d13582f2d315fd21dadb561
952833e41ba7a4b64c31a2d7b07dde81bf5bbacf5cbb967821cfe459d0c4a0d8
95e9e3ea5a0771d7eeead1503d41cde92d8eec6da0bfbc97fcff4e9d173c967a
96fbf4d6ae61688dd127c7c1db79e0c635c8c04c4cfb0bee52404e33db99f752
97160b6dd11e6c712dac3618caa0b31927e95e0dedee9b9b205fbd2245ca0349
a0fe8723dcf55da64d06b25446d0a8513e52527c45afcb37073465f9c6f352af
a47d6b5e7293f77a4aaea5a7df20d3830b10acafcce2c54c14befbe3fa5f69ab
a80116b743fe40a34d40e873673994e0f162f48588653b1b1de5a5fa83dffeea
a81fd0cb9f98399373bd142e503674322f3ece668d07731663da3fa925451030
a9c87b1ce80a8696f4790411959bb5cf0ccf1bc0a9c8cf2477c88a44e1104f4b
aa60c8b27a9a97424a86c8ac244c0d6b6986e0062ecde772de2a07aa446959d7
aca566587618e75fa291a419c7c430be02e03fc72f6105658c1bc8e7d59a65e4
ad8ebfca83448125b69075f66f41d014ae3ebaeca94c45db6152a24cd24270a7
b29d761d258ea9026f97b4470609b066558fe004a8e42199a5e40b1116d79b98
b2adb4f008e0cfee4d09dae8a1e4f5c19d2e492ca646326bc026cbcd9874a847
b2d31599822dae1353d655633c6dbd9454ef2138d172798f4a91119eedd6d89d
b2fe500cd00a2a9779cb5e31c7b56dd83d6c8a280ed5a92aaf369fcb091876a0
b657648fea8dfd40797f82706fd82b2771a7c18aedac16ceaa3a64851f38b9b8
b6e9507fb570c499c7f80306e10f49aedc4b83ace08371c4024e1ebd04aa7b8b
bdf4fab427beceb19827fa750805a66faf459083f377c05be78ce06c06410db8
c0d7eace6de7a123701ad163455f50ea9f6f51c5985a49f4d1f6e797009fbdb1
c4c16e7aaba6f1771a33267ffa6a2edb3147ee8654e119794419219fed6c3061
c9e76321a30fe79540c5a5fe74410d3ca813e12e13065b2eb79ce4e969443d11
cb23d15260f981e96001c4ed717434452f702481486e3b181b11334e857044b7
cca8ce472cbf8c44acf7ac24067c2d6075acd1e0cd4c9003de6055289ac5c68a
d0b124b8f696eba5c0d222ec4d34eea1d44e372001121a61f5048f34cda8840e
d49fc542ef4b94218db65e59dd632b2df5182be2966d2c056e70d77a6b076c7c
d9e88e50017aa3bdee310cf9b081cc729d10851438070983ee041e508ea84d2d
da924ffa322b79af0af2e0c4ac8ee6beb62e16c0313d723dda9f8d27c7bbdb96
da9dad45994fa30a773ffd383f0daba950926e1c95fc807b644554825ac34bf7
db7e0b393e175f19922fefbdcaa2866fca209c521d01cc834ae06cbf8d0f91b7
dcd9f488bd62ba0ee403b07a97e40b9ffd63a0eff61091588c913b16d5153d48
de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e6c4ea7a876a3217a3ed3b77f102bcf88b06334e573b145af0c6018c78ce308a
e79f07efdba7e03789d41c9f87c22bef1ac19de8b2f737735621bc6b10fde704
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f244fcb6b0aeadba8f41f30a7f451c0aaa06445ec854c3d9bbef1c485a036424
f82d00e4896a9aee107123f1ae51a9699c49d38563b118cabbe1bcda49795099
fa53fcd8da139d256c0ca83b69cb37473ca627b6052368ed3327c80d9fb61e25
fa9df2917ec7c5bbb641eadbcf39890a04fcae497df7fd6b566db6f88e1b8f11
fc9310308aaf2b1b2b0dd07ac2458a8c27075f269107bae5c8d1523a1b433406
fe9d09bad67180679d03b4770178e713030ed0f67118d9efa98f4f15165de2ee

ics-cert.kaspersky.com Open in urlscan Pro 185.105.225.103 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

96 Requests

98 %HTTPS

70 %IPv6

12 Domains

22 Subdomains

18 IPs

5 Countries

2901 kBTransfer

7143 kBSize

17 Cookies

6 Outgoing links

Redirected requests

96 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 2 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

ics-cert.kaspersky.com Open in urlscan Pro
185.105.225.103 Public Scan

Screenshot
Live screenshot

Full Image

96
Requests

98 %
HTTPS

70 %
IPv6

12
Domains

22
Subdomains

18
IPs

5
Countries

2901 kB
Transfer

7143 kB
Size

17
Cookies

96 HTTP transactions
2 data transactions