www.fireeye.com Open in urlscan Pro
2606:4700:300b::a29f:f77d Public Scan

Go To Rescan
Add Verdict Report

URL:
https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incid...
Submission: On August 11 via api (August 11th 2020, 8:10:37 pm UTC) from US

Summary HTTP 95 Redirects Behaviour Indicators

Summary

This website contacted 43 IPs in 8 countries across 42 domains to perform 95 HTTP transactions. The main IP is 2606:4700:300b::a29f:f77d, located in United States and belongs to CLOUDFLARENET, US. The main domain is www.fireeye.com.
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on July 1st 2020. Valid for: a year.

This is the only time www.fireeye.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
28	2606:4700:300... 2606:4700:300b::a29f:f77d	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1 1	95.100.99.145 95.100.99.145	16625 (AKAMAI-AS) (AKAMAI-AS)
1	13.108.249.135 13.108.249.135	14340 (SALESFORCE) (SALESFORCE)
6	104.17.70.206 104.17.70.206	13335 (CLOUDFLAR...) (CLOUDFLARENET)
5	23.210.248.44 23.210.248.44	16625 (AKAMAI-AS) (AKAMAI-AS)
1	2a00:1450:400... 2a00:1450:4001:821::2008	15169 (GOOGLE) (GOOGLE)
2	2606:4700::68... 2606:4700::6810:252f	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a02:26f0:10c... 2a02:26f0:10c:382::25ea	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
2	2620:1ec:c11:... 2620:1ec:c11::200	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
2 3	2a00:1450:400... 2a00:1450:4001:814::200e	15169 (GOOGLE) (GOOGLE)
1	151.101.12.157 151.101.12.157	54113 (FASTLY) (FASTLY)
1	172.217.23.98 172.217.23.98	15169 (GOOGLE) (GOOGLE)
1 2	172.217.23.134 172.217.23.134	15169 (GOOGLE) (GOOGLE)
2	2a03:2880:f01... 2a03:2880:f01c:8012:face:b00c:0:3	32934 (FACEBOOK) (FACEBOOK)
2	104.109.95.62 104.109.95.62	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	13.226.155.81 13.226.155.81	16509 (AMAZON-02) (AMAZON-02)
1	2606:4700:303... 2606:4700:3032::681b:9c96	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	13.226.155.5 13.226.155.5	16509 (AMAZON-02) (AMAZON-02)
1 1	68.67.153.60 68.67.153.60	29990 (ASN-APPNEX) (ASN-APPNEX)
2 3	185.33.220.243 185.33.220.243	29990 (ASN-APPNEX) (ASN-APPNEX)
1	13.226.155.74 13.226.155.74	16509 (AMAZON-02) (AMAZON-02)
1	13.226.155.119 13.226.155.119	16509 (AMAZON-02) (AMAZON-02)
1 2	2a05:f500:11:... 2a05:f500:11:101::b93f:9005	14413 (LINKEDIN) (LINKEDIN)
1 1	2620:1ec:21::14 2620:1ec:21::14	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
2 2	2a00:1450:400... 2a00:1450:400c:c00::9b	15169 (GOOGLE) (GOOGLE)
2 3	2a00:1450:400... 2a00:1450:4001:800::2004	15169 (GOOGLE) (GOOGLE)
3	2a00:1450:400... 2a00:1450:4001:800::2003	15169 (GOOGLE) (GOOGLE)
1	104.244.42.197 104.244.42.197	13414 (TWITTER) (TWITTER)
1	2a00:1450:400... 2a00:1450:4001:806::2002	15169 (GOOGLE) (GOOGLE)
3	23.34.183.125 23.34.183.125	16625 (AKAMAI-AS) (AKAMAI-AS)
2	2a03:2880:f11... 2a03:2880:f11c:8183:face:b00c:0:25de	32934 (FACEBOOK) (FACEBOOK)
1	2600:9000:218... 2600:9000:2182:6600:1a:2af:6d00:93a1	16509 (AMAZON-02) (AMAZON-02)
1	2001:4de0:ac1... 2001:4de0:ac19::1:b:3a	20446 (HIGHWINDS3) (HIGHWINDS3)
1	2a00:1450:400... 2a00:1450:4001:825::200a	15169 (GOOGLE) (GOOGLE)
1	13.226.155.25 13.226.155.25	16509 (AMAZON-02) (AMAZON-02)
3	52.45.104.28 52.45.104.28	14618 (AMAZON-AES) (AMAZON-AES)
2	54.81.89.51 54.81.89.51	14618 (AMAZON-AES) (AMAZON-AES)
1	13.226.155.9 13.226.155.9	16509 (AMAZON-02) (AMAZON-02)
1	52.57.146.39 52.57.146.39	16509 (AMAZON-02) (AMAZON-02)
1 2	52.16.156.50 52.16.156.50	16509 (AMAZON-02) (AMAZON-02)
1	23.210.250.213 23.210.250.213	16625 (AKAMAI-AS) (AKAMAI-AS)
1	104.244.42.3 104.244.42.3	13414 (TWITTER) (TWITTER)
1	183.79.248.252 183.79.248.252	24572 (YAHOO-JP-...) (YAHOO-JP-AS-AP Yahoo Japan)
1	192.28.147.68 192.28.147.68	53580 (MARKETO) (MARKETO)
1	2a00:1288:f03... 2a00:1288:f03d:1fa::4000	10310 (YAHOO-1) (YAHOO-1)
1	52.18.209.245 52.18.209.245	16509 (AMAZON-02) (AMAZON-02)
95	43

28 2606:4700:300b::a29f:f77d (United States)

ASN13335 (CLOUDFLARENET, US)

www.fireeye.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 95.100.99.145 (Ascension Island) 1 redirects

ASN16625 (AKAMAI-AS, US)
PTR: a95-100-99-145.deploy.static.akamaitechnologies.com

cloud.typography.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.108.249.135 (United States)

ASN14340 (SALESFORCE, US)
PTR: dcl4-ord.la1-c2-ord.salesforceliveagent.com

c.la2c2.salesforceliveagent.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 104.17.70.206 (United States)

ASN13335 (CLOUDFLARENET, US)

www2.fireeye.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 23.210.248.44 (Netherlands)

ASN16625 (AKAMAI-AS, US)
PTR: a23-210-248-44.deploy.static.akamaitechnologies.com

s7.addthis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
v1.addthisedge.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
m.addthis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:821::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700::6810:252f (United States)

ASN13335 (CLOUDFLARENET, US)

js.maxmind.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:26f0:10c:382::25ea (Ascension Island)

ASN20940 (AKAMAI-ASN1, EU)

snap.licdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2620:1ec:c11::200 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

bat.bing.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:814::200e (Frankfurt am Main, Germany) 2 redirects

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.12.157 (Frankfurt am Main, Germany)

ASN54113 (FASTLY, US)

static.ads-twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 172.217.23.98 (United States)

ASN15169 (GOOGLE, US)
PTR: mil04s23-in-f98.1e100.net

www.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 172.217.23.134 (United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: fra16s18-in-f134.1e100.net

8443343.fls.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f01c:8012:face:b00c:0:3 (Ireland)

ASN32934 (FACEBOOK, US)

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 104.109.95.62 (Netherlands)

ASN20940 (AKAMAI-ASN1, EU)
PTR: a104-109-95-62.deploy.static.akamaitechnologies.com

munchkin.marketo.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.226.155.81 (Seattle, United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-226-155-81.dus51.r.cloudfront.net

app.cdn.lookbookhq.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:3032::681b:9c96 (United States)

ASN13335 (CLOUDFLARENET, US)

v2.listenloop.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.226.155.5 (Seattle, United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-226-155-5.dus51.r.cloudfront.net

js.driftt.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 68.67.153.60 (United States) 1 redirects

ASN29990 (ASN-APPNEX, US)
PTR: s.ml-attr.com.pxlsrv.net

s.ml-attr.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 185.33.220.243 (Netherlands) 2 redirects

ASN29990 (ASN-APPNEX, US)
PTR: 722.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

secure.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.226.155.74 (Seattle, United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-226-155-74.dus51.r.cloudfront.net

attr.ml-api.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.226.155.119 (Seattle, United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-226-155-119.dus51.r.cloudfront.net

lftracker.leadfeeder.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a05:f500:11:101::b93f:9005 (Ireland) 1 redirects

ASN14413 (LINKEDIN, US)

px.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2620:1ec:21::14 (United States) 1 redirects

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

www.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:400c:c00::9b (Brussels, Belgium) 2 redirects

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:800::2004 (Frankfurt am Main, Germany) 2 redirects

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:800::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.244.42.197 (United States)

ASN13414 (TWITTER, US)

t.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:806::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 23.34.183.125 (Netherlands)

ASN16625 (AKAMAI-AS, US)
PTR: a23-34-183-125.deploy.static.akamaitechnologies.com

j.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
c.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
b.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f11c:8183:face:b00c:0:25de (Ireland)

ASN32934 (FACEBOOK, US)

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:2182:6600:1a:2af:6d00:93a1 (United States)

ASN16509 (AMAZON-02, US)

tr.lfeeder.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2001:4de0:ac19::1:b:3a (Netherlands)

ASN20446 (HIGHWINDS3, US)

maxcdn.bootstrapcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:825::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.226.155.25 (Seattle, United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-226-155-25.dus51.r.cloudfront.net

cdn.pathfactory.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 52.45.104.28 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-45-104-28.compute-1.amazonaws.com

jukebox.pathfactory.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
jukebox.lookbookhq.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 54.81.89.51 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-81-89-51.compute-1.amazonaws.com

abm2.listenloop.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.226.155.9 (Seattle, United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-226-155-9.dus51.r.cloudfront.net

widget.driftqa.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.57.146.39 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-57-146-39.eu-central-1.compute.amazonaws.com

epsilon.6sense.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.16.156.50 (Dublin, Ireland) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-52-16-156-50.eu-west-1.compute.amazonaws.com

segment.prod.bidr.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 23.210.250.213 (Netherlands)

ASN16625 (AKAMAI-AS, US)
PTR: a23-210-250-213.deploy.static.akamaitechnologies.com

z.moatads.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.244.42.3 (United States)

ASN13414 (TWITTER, US)

analytics.twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 183.79.248.252 (Japan)

ASN24572 (YAHOO-JP-AS-AP Yahoo Japan, JP)

s.yimg.jp	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 192.28.147.68 (United States)

ASN53580 (MARKETO, US)

848-did-242.mktoresp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1288:f03d:1fa::4000 (United Kingdom)

ASN10310 (YAHOO-1, US)

s.yimg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.18.209.245 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-18-209-245.eu-west-1.compute.amazonaws.com

fireeye.tt.omtrdc.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
34	fireeye.com www.fireeye.com www2.fireeye.com	2 MB
5	doubleclick.net 3 redirects 8443343.fls.doubleclick.net stats.g.doubleclick.net googleads.g.doubleclick.net	2 KB
4	addthis.com s7.addthis.com m.addthis.com	190 KB
3	6sc.co j.6sc.co c.6sc.co b.6sc.co	8 KB
3	google.de www.google.de	319 B
3	google.com 2 redirects www.google.com	447 B
3	linkedin.com 2 redirects px.ads.linkedin.com www.linkedin.com	2 KB
3	adnxs.com 2 redirects secure.adnxs.com	3 KB
3	listenloop.com v2.listenloop.com abm2.listenloop.com	59 KB
3	lookbookhq.com app.cdn.lookbookhq.com jukebox.lookbookhq.com	231 KB
3	google-analytics.com 2 redirects www.google-analytics.com	18 KB
2	bidr.io 1 redirects segment.prod.bidr.io	1 KB
2	pathfactory.com cdn.pathfactory.com jukebox.pathfactory.com	32 KB
2	facebook.com www.facebook.com	357 B
2	marketo.net munchkin.marketo.net	7 KB
2	facebook.net connect.facebook.net	166 KB
2	bing.com bat.bing.com	8 KB
2	maxmind.com js.maxmind.com	2 KB
1	omtrdc.net fireeye.tt.omtrdc.net	1014 B
1	yimg.com s.yimg.com	6 KB
1	mktoresp.com 848-did-242.mktoresp.com	311 B
1	yimg.jp s.yimg.jp	2 KB
1	addthisedge.com v1.addthisedge.com	958 B
1	twitter.com analytics.twitter.com	280 B
1	moatads.com z.moatads.com	1 KB
1	6sense.com epsilon.6sense.com	561 B
1	driftqa.com widget.driftqa.com	21 KB
1	googleapis.com fonts.googleapis.com	759 B
1	bootstrapcdn.com maxcdn.bootstrapcdn.com	7 KB
1	lfeeder.com tr.lfeeder.com	293 B
1	t.co t.co	170 B
1	leadfeeder.com lftracker.leadfeeder.com	4 KB
1	ml-api.io attr.ml-api.io	485 B
1	ml-attr.com 1 redirects s.ml-attr.com	277 B
1	driftt.com js.driftt.com	71 KB
1	googleadservices.com www.googleadservices.com	11 KB
1	ads-twitter.com static.ads-twitter.com	2 KB
1	licdn.com snap.licdn.com	2 KB
1	googletagmanager.com www.googletagmanager.com	90 KB
1	salesforceliveagent.com c.la2c2.salesforceliveagent.com d.la2c2.salesforceliveagent.com Failed	41 KB
1	typography.com 1 redirects cloud.typography.com	458 B
0	yahoo.co.jp Failed b91.yahoo.co.jp Failed
95	42

	Domain	Requested by
28	www.fireeye.com	www.fireeye.com
6	www2.fireeye.com	www.fireeye.com www2.fireeye.com
3	www.google.de	www.fireeye.com
3	www.google.com	2 redirects www.fireeye.com
3	secure.adnxs.com	2 redirects www.fireeye.com
3	www.google-analytics.com	2 redirects www.googletagmanager.com
3	s7.addthis.com	www.fireeye.com s7.addthis.com
2	jukebox.lookbookhq.com	www.fireeye.com
2	segment.prod.bidr.io	1 redirects www.fireeye.com
2	abm2.listenloop.com	www.fireeye.com
2	www.facebook.com	www.fireeye.com
2	stats.g.doubleclick.net	2 redirects
2	px.ads.linkedin.com	1 redirects www.fireeye.com
2	munchkin.marketo.net	www.googletagmanager.com munchkin.marketo.net
2	connect.facebook.net	www.fireeye.com connect.facebook.net
2	8443343.fls.doubleclick.net	1 redirects www.googletagmanager.com
2	bat.bing.com	www.googletagmanager.com www.fireeye.com
2	js.maxmind.com	www.fireeye.com
1	fireeye.tt.omtrdc.net	www.fireeye.com
1	s.yimg.com	www.fireeye.com
1	848-did-242.mktoresp.com	www.fireeye.com
1	s.yimg.jp	www.googletagmanager.com
1	m.addthis.com	s7.addthis.com
1	v1.addthisedge.com	s7.addthis.com
1	analytics.twitter.com	www.fireeye.com
1	z.moatads.com	s7.addthis.com
1	epsilon.6sense.com	www.fireeye.com
1	b.6sc.co	www.fireeye.com
1	widget.driftqa.com	www.fireeye.com
1	c.6sc.co	www.fireeye.com
1	jukebox.pathfactory.com	www.fireeye.com
1	cdn.pathfactory.com	www.fireeye.com
1	fonts.googleapis.com	www.fireeye.com
1	maxcdn.bootstrapcdn.com	www.fireeye.com
1	tr.lfeeder.com	www.fireeye.com
1	j.6sc.co	www.fireeye.com
1	googleads.g.doubleclick.net	www.fireeye.com
1	t.co	www.fireeye.com
1	www.linkedin.com	1 redirects
1	lftracker.leadfeeder.com	www.fireeye.com
1	attr.ml-api.io	www.fireeye.com
1	s.ml-attr.com	1 redirects
1	js.driftt.com	www.fireeye.com
1	v2.listenloop.com	www.fireeye.com
1	app.cdn.lookbookhq.com	www.fireeye.com
1	www.googleadservices.com	www.googletagmanager.com
1	static.ads-twitter.com	www.googletagmanager.com
1	snap.licdn.com	www.googletagmanager.com
1	www.googletagmanager.com	www.fireeye.com
1	c.la2c2.salesforceliveagent.com	www.fireeye.com
1	cloud.typography.com	1 redirects
0	b91.yahoo.co.jp Failed	www.fireeye.com
0	d.la2c2.salesforceliveagent.com Failed	www.fireeye.com
95	53

This site contains no links.

Subject Issuer	Validity	Valid
fireeye.com Cloudflare Inc ECC CA-3	`2020-07-01` - `2021-07-01`	a year	crt.sh
la1-c2-ord.salesforceliveagent.com DigiCert SHA2 Secure Server CA	`2020-07-09` - `2021-07-06`	a year	crt.sh
www2.fireeye.com Cloudflare Inc ECC CA-3	`2020-07-05` - `2021-07-05`	a year	crt.sh
odc-prod-01.oracle.com DigiCert Secure Site ECC CA-1	`2020-07-22` - `2021-10-13`	a year	crt.sh
*.google-analytics.com GTS CA 1O1	`2020-07-15` - `2020-10-07`	3 months	crt.sh
*.maxmind.com COMODO RSA Organization Validation Secure Server CA	`2018-10-15` - `2020-11-06`	2 years	crt.sh
*.licdn.com DigiCert SHA2 Secure Server CA	`2019-04-01` - `2021-05-07`	2 years	crt.sh
www.bing.com Microsoft IT TLS CA 2	`2019-04-30` - `2021-04-30`	2 years	crt.sh
ads-twitter.com DigiCert SHA2 High Assurance Server CA	`2019-08-14` - `2020-08-18`	a year	crt.sh
www.googleadservices.com GTS CA 1O1	`2020-07-15` - `2020-10-07`	3 months	crt.sh
*.doubleclick.net GTS CA 1O1	`2020-07-15` - `2020-10-07`	3 months	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2020-07-21` - `2020-10-12`	3 months	crt.sh
*.marketo.net DigiCert SHA2 Secure Server CA	`2020-03-14` - `2021-04-13`	a year	crt.sh
cdn.lookbookhq.com Amazon	`2019-12-06` - `2021-01-06`	a year	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2020-08-05` - `2021-08-05`	a year	crt.sh
drift.com Amazon	`2019-10-03` - `2020-11-03`	a year	crt.sh
*.ml-api.io Amazon	`2020-02-06` - `2021-03-06`	a year	crt.sh
*.leadfeeder.com Amazon	`2020-03-13` - `2021-04-13`	a year	crt.sh
px.ads.linkedin.com DigiCert SHA2 Secure Server CA	`2020-08-05` - `2021-02-05`	6 months	crt.sh
www.google.de GTS CA 1O1	`2020-07-15` - `2020-10-07`	3 months	crt.sh
t.co DigiCert SHA2 High Assurance Server CA	`2020-03-05` - `2021-03-02`	a year	crt.sh
*.g.doubleclick.net GTS CA 1O1	`2020-07-15` - `2020-10-07`	3 months	crt.sh
*.6sc.co DigiCert SHA2 Secure Server CA	`2020-01-07` - `2021-04-07`	a year	crt.sh
www.google.com GTS CA 1O1	`2020-07-15` - `2020-10-07`	3 months	crt.sh
*.lfeeder.com Amazon	`2019-10-02` - `2020-11-02`	a year	crt.sh
*.bootstrapcdn.com Sectigo RSA Domain Validation Secure Server CA	`2019-09-14` - `2020-10-13`	a year	crt.sh
upload.video.google.com GTS CA 1O1	`2020-07-15` - `2020-10-07`	3 months	crt.sh
*.pathfactory.com Amazon	`2020-04-05` - `2021-05-05`	a year	crt.sh
*.listenloop.com RapidSSL RSA CA 2018	`2019-06-14` - `2021-06-17`	2 years	crt.sh
*.adnxs.com DigiCert ECC Secure Server CA	`2019-01-23` - `2021-03-08`	2 years	crt.sh
driftqa.com Amazon	`2020-02-10` - `2021-03-10`	a year	crt.sh
*.6sense.com Amazon	`2020-07-29` - `2021-08-28`	a year	crt.sh
*.segment.prod.bidr.io Amazon	`2020-03-26` - `2021-04-26`	a year	crt.sh
*.lookbookhq.com Amazon	`2020-04-28` - `2021-05-28`	a year	crt.sh
moatads.com DigiCert SHA2 Secure Server CA	`2020-01-17` - `2021-03-17`	a year	crt.sh
*.twitter.com DigiCert SHA2 High Assurance Server CA	`2020-03-05` - `2021-03-02`	a year	crt.sh
*.yahoo.co.jp Cybertrust Japan Public CA G3	`2019-09-24` - `2020-10-23`	a year	crt.sh
*.mktoresp.com DigiCert SHA2 Secure Server CA	`2020-01-17` - `2022-01-21`	2 years	crt.sh
*.yahoo.com DigiCert SHA2 High Assurance Server CA	`2020-08-06` - `2020-09-20`	a month	crt.sh
*.tt.omtrdc.net DigiCert SHA2 High Assurance Server CA	`2017-10-19` - `2020-11-25`	3 years	crt.sh

This page contains 5 frames:

Primary Page: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html
Frame ID: 84F599F25D70728FC618638166DF2CD7
Requests: 100 HTTP requests in this frame

Frame: https://8443343.fls.doubleclick.net/activityi;dc_pre=CKPWycD6k-sCFVVN5QodLyAN0Q;src=8443343;type=sitew0;cat=firee0;ord=6562365312559;gtm=2wg871;auiddc=1661597319.1597176603;u1=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2020%2F05%2Ftactics-techniques-procedures-associated-with-maze-ransomware-incidents.html;u2=Navigating%20the%20MAZE%3A%20Tactics%2C%20Techniques%20and%20Procedures%20Associated%20With%20MAZE%20Ransomware%20Incidents%20%7C%20FireEye%20Inc;~oref=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2020%2F05%2Ftactics-techniques-procedures-associated-with-maze-ransomware-incidents.html
Frame ID: 3C20F23A6BF6F3ED2C065860331B8EBA
Requests: 1 HTTP requests in this frame

Frame: https://s7.addthis.com/static/sh.f48a1a04fe8dbf021b4cda1d.html
Frame ID: 25EDDEA772721C3D02AE5C4E937DA892
Requests: 1 HTTP requests in this frame

Frame: https://s7.addthis.com/static/sh.f48a1a04fe8dbf021b4cda1d.html
Frame ID: 186C55329A895596F367EC8FCBCFFD96
Requests: 1 HTTP requests in this frame

Frame: https://www2.fireeye.com/index.php/form/XDFrame
Frame ID: 5B19C1EC7858AA8DA45EEDC421F1FECA
Requests: 2 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

CloudFlare (CDN) Expand

Overall confidence: 100%
Detected patterns

headers server /^cloudflare$/i

Page Statistics

95
Requests

95 %
HTTPS

41 %
IPv6

42
Domains

53
Subdomains

43
IPs

8
Countries

3602 kB
Transfer

7035 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 3

https://cloud.typography.com/6746836/6977592/css/fonts.css HTTP 302
https://www.fireeye.com/content/dam/fireeye-www/fw/f/775489/3982EDB9831683D51.css

Request Chain 33

https://8443343.fls.doubleclick.net/activityi;src=8443343;type=sitew0;cat=firee0;ord=6562365312559;gtm=2wg871;auiddc=1661597319.1597176603;u1=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2020%2F05%2Ftactics-techniques-procedures-associated-with-maze-ransomware-incidents.html;u2=Navigating%20the%20MAZE%3A%20Tactics%2C%20Techniques%20and%20Procedures%20Associated%20With%20MAZE%20Ransomware%20Incidents%20%7C%20FireEye%20Inc;~oref=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2020%2F05%2Ftactics-techniques-procedures-associated-with-maze-ransomware-incidents.html HTTP 302
https://8443343.fls.doubleclick.net/activityi;dc_pre=CKPWycD6k-sCFVVN5QodLyAN0Q;src=8443343;type=sitew0;cat=firee0;ord=6562365312559;gtm=2wg871;auiddc=1661597319.1597176603;u1=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2020%2F05%2Ftactics-techniques-procedures-associated-with-maze-ransomware-incidents.html;u2=Navigating%20the%20MAZE%3A%20Tactics%2C%20Techniques%20and%20Procedures%20Associated%20With%20MAZE%20Ransomware%20Incidents%20%7C%20FireEye%20Inc;~oref=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2020%2F05%2Ftactics-techniques-procedures-associated-with-maze-ransomware-incidents.html

Request Chain 39

https://s.ml-attr.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dfireeye.com%26pId%3d%24UID HTTP 302
https://secure.adnxs.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dfireeye.com%26pId%3d%24UID HTTP 307
https://secure.adnxs.com/bounce?%2Fgetuid%3Fhttps%253a%252f%252fattr.ml-api.io%252f%253fdomain%253dfireeye.com%2526pId%253d%2524UID HTTP 302
https://attr.ml-api.io/?domain=fireeye.com&pId=5943920088028517729

Request Chain 41

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=6572&url=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2020%2F05%2Ftactics-techniques-procedures-associated-with-maze-ransomware-incidents.html&time=1597176603124 HTTP 302
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D6572%26url%3Dhttps%253A%252F%252Fwww.fireeye.com%252Fblog%252Fthreat-research%252F2020%252F05%252Ftactics-techniques-procedures-associated-with-maze-ransomware-incidents.html%26time%3D1597176603124%26liSync%3Dtrue HTTP 302
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=6572&url=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2020%2F05%2Ftactics-techniques-procedures-associated-with-maze-ransomware-incidents.html&time=1597176603124&liSync=true

Request Chain 42

https://www.google-analytics.com/r/collect?v=1&_v=j83&a=186233434&t=pageview&_s=1&dl=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2020%2F05%2Ftactics-techniques-procedures-associated-with-maze-ransomware-incidents.html&ul=en-us&de=UTF-8&dt=Navigating%20the%20MAZE%3A%20Tactics%2C%20Techniques%20and%20Procedures%20Associated%20With%20MAZE%20Ransomware%20Incidents%20%7C%20FireEye%20Inc&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YEBAAEAB~&jid=1249946458&gjid=1561069368&cid=1259957762.1597176603&tid=UA-363943-1&_gid=1827356261.1597176603&_r=1&gtm=2wg871MVGC8KK&cd39=1259957762.1597176603&z=420093417 HTTP 302
https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-363943-1&cid=1259957762.1597176603&jid=1249946458&_gid=1827356261.1597176603&gjid=1561069368&_v=j83&z=420093417 HTTP 302
https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-363943-1&cid=1259957762.1597176603&jid=1249946458&_v=j83&z=420093417 HTTP 302
https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-363943-1&cid=1259957762.1597176603&jid=1249946458&_v=j83&z=420093417&slf_rd=1&random=1318528015

Request Chain 67

https://segment.prod.bidr.io/associate-segment?buzz_key=listenloop&segment_key=listenloop-11912&value= HTTP 303
https://segment.prod.bidr.io/associate-segment?buzz_key=listenloop&segment_key=listenloop-11912&value=&_bee_ppp=1

Request Chain 97

https://www.google-analytics.com/r/collect?v=1&_v=j83&a=186233434&t=event&ni=0&_s=1&dl=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2020%2F05%2Ftactics-techniques-procedures-associated-with-maze-ransomware-incidents.html&ul=en-us&de=UTF-8&dt=Navigating%20the%20MAZE%3A%20Tactics%2C%20Techniques%20and%20Procedures%20Associated%20With%20MAZE%20Ransomware%20Incidents%20%7C%20FireEye%20Inc&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=Page%20views%20with%20form&ea=view&el=Form&_u=aHhAAEAB~&jid=448307362&gjid=179698387&cid=1259957762.1597176603&tid=UA-363943-1&_gid=1976774407.1597176606&_r=1&gtm=2wg871MVGC8KK&cd3=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2020%2F05%2Ftactics-techniques-procedures-associated-with-maze-ransomware-incidents.html&cd17=Form&cd18=3353&cd19=Navigating%20the%20MAZE%3A%20Tactics%2C%20Techniques%20and%20Procedures%20Associated%20With%20MAZE%20Ransomware%20Incidents%20%7C%20FireEye%20Inc&z=447183283 HTTP 302
https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-363943-1&cid=1259957762.1597176603&jid=448307362&_gid=1976774407.1597176606&gjid=179698387&_v=j83&z=447183283 HTTP 302
https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-363943-1&cid=1259957762.1597176603&jid=448307362&_v=j83&z=447183283 HTTP 302
https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-363943-1&cid=1259957762.1597176603&jid=448307362&_v=j83&z=447183283&slf_rd=1&random=2887154891

95 HTTP transactions
10 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html Show response
www.fireeye.com/blog/threat-research/2020/05/ 115 KB
31 KB 55ms
38ms Document
text/html 2606:4700:300b::a29f:f77d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:300b::a29f:f77d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

3b5bda8d765f3931c7f90e3055dae350212c7ec063456b9c9f637ca19154f749

Security Headers

Name	Value
Content-Security-Policy	worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff nosniff
X-Frame-Options	ALLOW-FROM https://content.fireeye.com
X-Xss-Protection	1; mode=block

Request headers

:method: GET
:authority: www.fireeye.com
:scheme: https
:path: /blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status: 200
date: Tue, 11 Aug 2020 20:10:02 GMT
content-type: text/html; charset=UTF-8
set-cookie: __cfduid=d1f4e686ba376507bce768d5c64d3bbd51597176602; expires=Thu, 10-Sep-20 20:10:02 GMT; path=/; domain=.fireeye.com; HttpOnly; SameSite=Lax; Secure
cf-ray: 5c149907ec1e6347-FRA
age: 9
cache-control: no-cache="set-cookie"
strict-transport-security: max-age=31536000; includeSubDomains
vary: Accept-Encoding,User-Agent
cf-cache-status: HIT
cf-request-id: 0480bdf8ed0000634799831200000001
content-security-policy: worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-content-type-options: nosniff nosniff
x-dispatcher: dispatcher1uswest1
x-frame-options: ALLOW-FROM https://content.fireeye.com
x-vhost: publish
x-xss-protection: 1; mode=block
server: cloudflare
content-encoding: gzip

GET
H2 200 jquery.min.js Show response
www.fireeye.com/etc.clientlibs/clientlibs/granite/ 111 KB
38 KB 43ms
40ms Script
application/javascript 2606:4700:300b::a29f:f77d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery.min.js

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:300b::a29f:f77d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b397476bcbcf8c9eae3f82007cc4f9495661b367e02e6d3dea6e15f0610ef20a

Security Headers

Name	Value
Content-Security-Policy	worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff, nosniff
X-Frame-Options	ALLOW-FROM https://content.fireeye.com
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-dispatcher: dispatcher2uswest1
date: Tue, 11 Aug 2020 20:10:02 GMT
content-encoding: gzip
x-content-type-options: nosniff, nosniff
cf-cache-status: HIT
age: 422
x-vhost: publish
status: 200
vary: Accept-Encoding,User-Agent
content-length: 38305
cf-request-id: 0480bdf92d0000634799833200000001
last-modified: Fri, 26 Jul 2019 09:54:26 GMT
server: cloudflare
x-frame-options: ALLOW-FROM https://content.fireeye.com
etag: "1baa2-58e9287119880-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript
x-xss-protection: 1; mode=block
content-security-policy: worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
accept-ranges: bytes
cf-ray: 5c1499084c5c6347-FRA

GET
H2 200 csrf.min.js Show response
www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite/ 4 KB
2 KB 72ms
69ms Script
application/javascript 2606:4700:300b::a29f:f77d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.js

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:300b::a29f:f77d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

fbcc2c7d4dfbc5d0251c789843b8d7edf25306dfa23188ad267e2786357233c0

Security Headers

Name	Value
Content-Security-Policy	worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff, nosniff
X-Frame-Options	ALLOW-FROM https://content.fireeye.com
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-dispatcher: dispatcher2uswest1
date: Tue, 11 Aug 2020 20:10:02 GMT
content-encoding: gzip
x-content-type-options: nosniff, nosniff
cf-cache-status: HIT
age: 422
x-vhost: publish
status: 200
vary: Accept-Encoding,User-Agent
content-length: 1676
cf-request-id: 0480bdf92d0000634799837200000001
last-modified: Fri, 26 Jul 2019 09:54:26 GMT
server: cloudflare
x-frame-options: ALLOW-FROM https://content.fireeye.com
etag: "f3e-58e9287119880-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript
x-xss-protection: 1; mode=block
content-security-policy: worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
accept-ranges: bytes
cf-ray: 5c1499084c616347-FRA

GET
H2 200 clientlibs_nav.min.js Show response
www.fireeye.com/etc/designs/fireeye-www/ 12 KB
4 KB 53ms
50ms Script
application/javascript 2606:4700:300b::a29f:f77d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.fireeye.com/etc/designs/fireeye-www/clientlibs_nav.min.js

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:300b::a29f:f77d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

84a91ff2a1a995e3816750f53342b4499bfefc817a8ee1a5d4b401433692d510

Security Headers

Name	Value
Content-Security-Policy	worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff, nosniff
X-Frame-Options	ALLOW-FROM https://content.fireeye.com
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-dispatcher: dispatcher2uswest1
date: Tue, 11 Aug 2020 20:10:02 GMT
content-encoding: gzip
x-content-type-options: nosniff, nosniff
cf-cache-status: HIT
age: 422
x-vhost: publish
status: 200
vary: Accept-Encoding,User-Agent
content-length: 3882
cf-request-id: 0480bdf92d0000634799838200000001
last-modified: Fri, 24 Apr 2020 04:08:24 GMT
server: cloudflare
x-frame-options: ALLOW-FROM https://content.fireeye.com
etag: "2f77-5a401843bfe00-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript
x-xss-protection: 1; mode=block
content-security-policy: worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
accept-ranges: bytes
cf-ray: 5c1499084c626347-FRA

GET
H2

200

3982EDB9831683D51.css
www.fireeye.com/content/dam/fireeye-www/fw/f/775489/
Redirect Chain

https://cloud.typography.com/6746836/6977592/css/fonts.css
https://www.fireeye.com/content/dam/fireeye-www/fw/f/775489/3982EDB9831683D51.css

293 KB
219 KB

22ms
21ms

Stylesheet
text/css

2606:4700:300b::a29f:f77d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.fireeye.com/content/dam/fireeye-www/fw/f/775489/3982EDB9831683D51.css

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:300b::a29f:f77d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a0a0933f843198c607baaf63f153e3fb5fd900d91f31d37d0f71b53ca66c4ab9

Security Headers

Name	Value
Content-Security-Policy	worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	ALLOW-FROM https://content.fireeye.com
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-dispatcher: dispatcher2uswest1
date: Tue, 11 Aug 2020 20:10:03 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
age: 40496
cf-polished: origSize=301416
x-vhost: publish
status: 200
vary: Accept-Encoding,User-Agent
cf-request-id: 0480bdf9db0000634799856200000001
last-modified: Wed, 01 Apr 2020 20:06:18 GMT
server: cloudflare
x-frame-options: ALLOW-FROM https://content.fireeye.com
etag: W/"49968-5a240379a0280-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains
content-type: text/css
x-xss-protection: 1; mode=block
cache-control: no-cache="set-cookie"
content-security-policy: worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
cf-ray: 5c1499095d646347-FRA
cf-bgj: minify

Redirect headers

Date: Tue, 11 Aug 2020 20:10:03 GMT
Last-Modified: Wed, 01 Apr 2020 20:12:09 GMT
Server: AkamaiNetStorage
ETag: "d0795af83d79e23ccaffb60b4a75e364:1585771928"
Content-Type: text/html
Location: https://www.fireeye.com/content/dam/fireeye-www/fw/f/775489/3982EDB9831683D51.css
Cache-Control: must-revalidate, private
Connection: keep-alive
X-HCo-pid: 14
Content-Length: 154
Expires: Tue, 11 August 2020 20:10:03 GMT

GET
H2 200 patch.css
www.fireeye.com/content/dam/fireeye-www/fw/css/ 543 B
417 B 45ms
42ms Stylesheet
text/css 2606:4700:300b::a29f:f77d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.fireeye.com/content/dam/fireeye-www/fw/css/patch.css

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:300b::a29f:f77d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f08cea88c54a644c35abf8c3b33f3d997ff5bd673b940936f82bb80fcb37b6e2

Security Headers

Name	Value
Content-Security-Policy	worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	ALLOW-FROM https://content.fireeye.com
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-dispatcher: dispatcher2uswest1
date: Tue, 11 Aug 2020 20:10:02 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
age: 38982
cf-polished: origSize=827
x-vhost: publish
status: 200
vary: Accept-Encoding,User-Agent
cf-request-id: 0480bdf92d0000634799834200000001
last-modified: Thu, 30 Jul 2020 18:38:23 GMT
server: cloudflare
x-frame-options: ALLOW-FROM https://content.fireeye.com
etag: W/"33b-5abacfa24e5c0-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains
content-type: text/css
x-xss-protection: 1; mode=block
cache-control: no-cache="set-cookie"
content-security-policy: worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
cf-ray: 5c1499084c5d6347-FRA
cf-bgj: minify

GET
H2 200 clientlibs_fw-2019.min.css
www.fireeye.com/etc/designs/fireeye-www/ 210 KB
40 KB 56ms
54ms Stylesheet
text/css 2606:4700:300b::a29f:f77d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.fireeye.com/etc/designs/fireeye-www/clientlibs_fw-2019.min.css

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:300b::a29f:f77d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d20cf953b941d38ca8b450334f135fbe787dc4cb8371f4032fda9337cbfd5836

Security Headers

Name	Value
Content-Security-Policy	worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff, nosniff
X-Frame-Options	ALLOW-FROM https://content.fireeye.com
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-dispatcher: dispatcher2uswest1
date: Tue, 11 Aug 2020 20:10:02 GMT
content-encoding: gzip
x-content-type-options: nosniff, nosniff
cf-cache-status: HIT
age: 38981
x-vhost: publish
status: 200
vary: Accept-Encoding,User-Agent
content-length: 41247
cf-request-id: 0480bdf92d0000634799835200000001
last-modified: Fri, 29 May 2020 04:55:23 GMT
server: cloudflare
x-frame-options: ALLOW-FROM https://content.fireeye.com
etag: "3467b-5a6c240b4a4c0-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains
content-type: text/css
x-xss-protection: 1; mode=block
cache-control: no-cache="set-cookie"
content-security-policy: worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
accept-ranges: bytes
cf-ray: 5c1499084c5e6347-FRA

GET
H2 200 clientlibs_base.min.css
www.fireeye.com/etc/clientlibs/fireeye-blog/ 5 KB
2 KB 66ms
64ms Stylesheet
text/css 2606:4700:300b::a29f:f77d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.fireeye.com/etc/clientlibs/fireeye-blog/clientlibs_base.min.css

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:300b::a29f:f77d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

757eb886edd9a887fc95b701c88b08191eb743657027636c0c9d4973547ebb4a

Security Headers

Name	Value
Content-Security-Policy	worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff, nosniff
X-Frame-Options	ALLOW-FROM https://content.fireeye.com
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-dispatcher: dispatcher1uswest1
date: Tue, 11 Aug 2020 20:10:02 GMT
content-encoding: gzip
x-content-type-options: nosniff, nosniff
cf-cache-status: HIT
age: 915
x-vhost: publish
status: 200
vary: Accept-Encoding,User-Agent
content-length: 1501
cf-request-id: 0480bdf92d0000634799836200000001
last-modified: Fri, 04 Oct 2019 04:55:04 GMT
server: cloudflare
x-frame-options: ALLOW-FROM https://content.fireeye.com
etag: "1507-5940e81577a00-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains
content-type: text/css
x-xss-protection: 1; mode=block
cache-control: no-cache="set-cookie"
content-security-policy: worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
accept-ranges: bytes
cf-ray: 5c1499084c606347-FRA

GET
H2 200 utils.min.js Show response
www.fireeye.com/etc.clientlibs/clientlibs/granite/ 10 KB
4 KB 48ms
46ms Script
application/javascript 2606:4700:300b::a29f:f77d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.fireeye.com/etc.clientlibs/clientlibs/granite/utils.min.js

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:300b::a29f:f77d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

799cb15a25ed2fa78bdba496d1afbc68f033a3a5dd9ead12f4eaac4e0a93236d

Security Headers

Name	Value
Content-Security-Policy	worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff, nosniff
X-Frame-Options	ALLOW-FROM https://content.fireeye.com
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-dispatcher: dispatcher2uswest1
date: Tue, 11 Aug 2020 20:10:02 GMT
content-encoding: gzip
x-content-type-options: nosniff, nosniff
cf-cache-status: HIT
age: 422
x-vhost: publish
status: 200
vary: Accept-Encoding,User-Agent
content-length: 3706
cf-request-id: 0480bdf92d0000634799839200000001
last-modified: Fri, 26 Jul 2019 09:54:26 GMT
server: cloudflare
x-frame-options: ALLOW-FROM https://content.fireeye.com
etag: "26ad-58e9287119880-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript
x-xss-protection: 1; mode=block
content-security-policy: worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
accept-ranges: bytes
cf-ray: 5c1499084c636347-FRA

GET
H2 200 granite.min.js Show response
www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/ 4 KB
2 KB 59ms
57ms Script
application/javascript 2606:4700:300b::a29f:f77d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite.min.js

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:300b::a29f:f77d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c986afd07a4082d65befeef18869a4cd5e00f3ac6e8228d49658802c7453a1b8

Security Headers

Name	Value
Content-Security-Policy	worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff, nosniff
X-Frame-Options	ALLOW-FROM https://content.fireeye.com
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-dispatcher: dispatcher2uswest1
date: Tue, 11 Aug 2020 20:10:02 GMT
content-encoding: gzip
x-content-type-options: nosniff, nosniff
cf-cache-status: HIT
age: 422
x-vhost: publish
status: 200
vary: Accept-Encoding,User-Agent
content-length: 1702
cf-request-id: 0480bdf92d000063479983a200000001
last-modified: Fri, 26 Jul 2019 09:54:26 GMT
server: cloudflare
x-frame-options: ALLOW-FROM https://content.fireeye.com
etag: "f90-58e9287119880-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript
x-xss-protection: 1; mode=block
content-security-policy: worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
accept-ranges: bytes
cf-ray: 5c1499084c656347-FRA

GET
H2 200 jquery.min.js Show response
www.fireeye.com/etc.clientlibs/foundation/clientlibs/ 16 B
170 B 65ms
63ms Script
application/javascript 2606:4700:300b::a29f:f77d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.fireeye.com/etc.clientlibs/foundation/clientlibs/jquery.min.js

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:300b::a29f:f77d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c084b47104c493fb377b6d35d8c08df67d773f6dcf8294c0a7360710cd8cacbd

Security Headers

Name	Value
Content-Security-Policy	worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff, nosniff
X-Frame-Options	ALLOW-FROM https://content.fireeye.com
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-dispatcher: dispatcher2uswest1
date: Tue, 11 Aug 2020 20:10:02 GMT
x-content-type-options: nosniff, nosniff
cf-cache-status: HIT
age: 422
x-vhost: publish
status: 200
vary: User-Agent, Accept-Encoding
content-length: 16
cf-request-id: 0480bdf92d000063479983b200000001
last-modified: Fri, 26 Jul 2019 09:54:49 GMT
server: cloudflare
x-frame-options: ALLOW-FROM https://content.fireeye.com
etag: "10-58e9288708c40"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript
x-xss-protection: 1; mode=block
content-security-policy: worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
accept-ranges: bytes
cf-ray: 5c1499084c666347-FRA

GET
H2 200 shared.min.js Show response
www.fireeye.com/etc.clientlibs/foundation/clientlibs/ 24 KB
7 KB 58ms
56ms Script
application/javascript 2606:4700:300b::a29f:f77d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.fireeye.com/etc.clientlibs/foundation/clientlibs/shared.min.js

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:300b::a29f:f77d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

4086c8cd4c3361452c1c1da9af3034fc90f4a375c4f6195f31d6dcf1c7b56f00

Security Headers

Name	Value
Content-Security-Policy	worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff, nosniff
X-Frame-Options	ALLOW-FROM https://content.fireeye.com
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-dispatcher: dispatcher2uswest1
date: Tue, 11 Aug 2020 20:10:02 GMT
content-encoding: gzip
x-content-type-options: nosniff, nosniff
cf-cache-status: HIT
age: 422
x-vhost: publish
status: 200
vary: Accept-Encoding,User-Agent
content-length: 6920
cf-request-id: 0480bdf92d000063479983c200000001
last-modified: Fri, 26 Jul 2019 09:54:49 GMT
server: cloudflare
x-frame-options: ALLOW-FROM https://content.fireeye.com
etag: "5e7e-58e9288708c40-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript
x-xss-protection: 1; mode=block
content-security-policy: worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
accept-ranges: bytes
cf-ray: 5c1499084c676347-FRA

GET
H2 200 modern.min.js Show response
www.fireeye.com/etc.clientlibs/clientlibs/granite/lodash/ 34 KB
12 KB 45ms
43ms Script
application/javascript 2606:4700:300b::a29f:f77d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.fireeye.com/etc.clientlibs/clientlibs/granite/lodash/modern.min.js

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:300b::a29f:f77d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

355604a949ef95ceffcd21a7e9b5ed27c95d847f95127e0ddad5aa1793f1bb74

Security Headers

Name	Value
Content-Security-Policy	worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff, nosniff
X-Frame-Options	ALLOW-FROM https://content.fireeye.com
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-dispatcher: dispatcher2uswest1
date: Tue, 11 Aug 2020 20:10:02 GMT
content-encoding: gzip
x-content-type-options: nosniff, nosniff
cf-cache-status: HIT
age: 422
x-vhost: publish
status: 200
vary: Accept-Encoding,User-Agent
content-length: 11784
cf-request-id: 0480bdf92d000063479983d200000001
last-modified: Tue, 17 Oct 2017 06:49:31 GMT
server: cloudflare
x-frame-options: ALLOW-FROM https://content.fireeye.com
etag: "87c8-55bb8866db4c0-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript
x-xss-protection: 1; mode=block
content-security-policy: worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
accept-ranges: bytes
cf-ray: 5c1499084c686347-FRA

GET
H2 200 kernel.min.js Show response
www.fireeye.com/etc.clientlibs/cq/personalization/clientlib/personalization/ 119 KB
26 KB 57ms
55ms Script
application/javascript 2606:4700:300b::a29f:f77d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.fireeye.com/etc.clientlibs/cq/personalization/clientlib/personalization/kernel.min.js

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:300b::a29f:f77d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

79b2448738716f0daf11d4a206e105e3b79e9d082f9c9bf4ad2bd55e591a1a3c

Security Headers

Name	Value
Content-Security-Policy	worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff, nosniff
X-Frame-Options	ALLOW-FROM https://content.fireeye.com
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-dispatcher: dispatcher2uswest1
date: Tue, 11 Aug 2020 20:10:02 GMT
content-encoding: gzip
x-content-type-options: nosniff, nosniff
cf-cache-status: HIT
age: 422
x-vhost: publish
status: 200
vary: Accept-Encoding,User-Agent
content-length: 26194
cf-request-id: 0480bdf92d000063479983e200000001
last-modified: Fri, 26 Jul 2019 09:54:50 GMT
server: cloudflare
x-frame-options: ALLOW-FROM https://content.fireeye.com
etag: "1dd96-58e92887fce80-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript
x-xss-protection: 1; mode=block
content-security-policy: worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
accept-ranges: bytes
cf-ray: 5c1499084c696347-FRA

GET
H/1.1 200
OK deployment.js Show response
c.la2c2.salesforceliveagent.com/content/g/js/34.0/ 40 KB
41 KB 1019ms
262ms Script
application/javascript 13.108.249.135
SALESFORCE

General

Check archive.org

Show headers Download Go to

Full URL: https://c.la2c2.salesforceliveagent.com/content/g/js/34.0/deployment.js
Requested by: Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 13.108.249.135 , United States, ASN14340 (SALESFORCE, US),
Reverse DNS: dcl4-ord.la1-c2-ord.salesforceliveagent.com
Software: Jetty(9.4.z-SNAPSHOT) /
Resource Hash: 3aadac47cf44df595934bec631a78bf2ba62081ab95528e684a85b4c74453e77

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Tue, 11 Aug 2020 20:10:03 GMT
Cache-Control: max-age=60, must-revalidate
Last-Modified: Fri, 17 Jul 2020 17:41:24 GMT
Server: Jetty(9.4.z-SNAPSHOT)
Accept-Ranges: bytes
Content-Length: 41338
Content-Type: application/javascript

GET
H2 200 fe-logo-color.svg
www.fireeye.com/content/dam/fireeye-www/fw/images/ 3 KB
1 KB 33ms
30ms Image
image/svg+xml 2606:4700:300b::a29f:f77d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fireeye.com/content/dam/fireeye-www/fw/images/fe-logo-color.svg

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:300b::a29f:f77d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f684d50dc9b24df0a4845f688a45b856d945f79d79549240187e171e1655f236

Security Headers

Name	Value
Content-Security-Policy	worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	ALLOW-FROM https://content.fireeye.com
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-dispatcher: dispatcher1uswest1
date: Tue, 11 Aug 2020 20:10:03 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
age: 36535
x-vhost: publish
status: 200
vary: Accept-Encoding,User-Agent
content-length: 1239
cf-request-id: 0480bdf96b0000634799849200000001
last-modified: Wed, 22 Jul 2020 19:07:05 GMT
server: cloudflare
x-frame-options: ALLOW-FROM https://content.fireeye.com
etag: "cec-5ab0c720d8840-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/svg+xml
x-xss-protection: 1; mode=block
content-security-policy: worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
accept-ranges: bytes
cf-ray: 5c149908acc66347-FRA

GET
H2 200 Picture1.png
www.fireeye.com/content/dam/fireeye-www/blog/images/maze/ 381 KB
381 KB 25ms
22ms Image
image/png 2606:4700:300b::a29f:f77d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fireeye.com/content/dam/fireeye-www/blog/images/maze/Picture1.png

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:300b::a29f:f77d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

1755acef8199c66af06c7e1d318bb90542a3053412575d978dcb6dafad7cd98b

Security Headers

Name	Value
Content-Security-Policy	worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	ALLOW-FROM https://content.fireeye.com
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-dispatcher: dispatcher2uswest1
date: Tue, 11 Aug 2020 20:10:03 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
age: 9
cf-polished: origSize=591321
x-vhost: publish
status: 200
vary: Accept-Encoding
content-length: 389632
cf-request-id: 0480bdf96b000063479984a200000001
last-modified: Thu, 07 May 2020 19:42:31 GMT
server: cloudflare
x-frame-options: ALLOW-FROM https://content.fireeye.com
etag: "905d9-5a51414d537c0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/png
x-xss-protection: 1; mode=block
content-security-policy: worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
accept-ranges: bytes
cf-ray: 5c149908acc76347-FRA
cf-bgj: imgq:85,h2pri

GET
H2 200 Picture2.png
www.fireeye.com/content/dam/fireeye-www/blog/images/maze/ 233 KB
234 KB 40ms
38ms Image
image/png 2606:4700:300b::a29f:f77d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fireeye.com/content/dam/fireeye-www/blog/images/maze/Picture2.png

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:300b::a29f:f77d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

771f01c80b031bd10d587c781474cc0f896b4d08a20356fdef47b0eb2e586b6d

Security Headers

Name	Value
Content-Security-Policy	worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	ALLOW-FROM https://content.fireeye.com
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-dispatcher: dispatcher2uswest1
date: Tue, 11 Aug 2020 20:10:03 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
age: 9
cf-polished: origSize=385644
x-vhost: publish
status: 200
vary: Accept-Encoding
content-length: 238920
cf-request-id: 0480bdf96b000063479984b200000001
last-modified: Thu, 07 May 2020 19:42:32 GMT
server: cloudflare
x-frame-options: ALLOW-FROM https://content.fireeye.com
etag: "5e26c-5a51414e47a00"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/png
x-xss-protection: 1; mode=block
cache-control: no-cache="set-cookie"
content-security-policy: worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
accept-ranges: bytes
cf-ray: 5c149908acc86347-FRA
cf-bgj: imgq:85,h2pri

GET
H2 200 Picture3.png
www.fireeye.com/content/dam/fireeye-www/blog/images/maze/ 165 KB
166 KB 32ms
30ms Image
image/png 2606:4700:300b::a29f:f77d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fireeye.com/content/dam/fireeye-www/blog/images/maze/Picture3.png

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:300b::a29f:f77d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a968b17677c357d33a924969a798e009e63d3c6667e41f8997c9804007f17fe0

Security Headers

Name	Value
Content-Security-Policy	worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	ALLOW-FROM https://content.fireeye.com
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-dispatcher: dispatcher1uswest1
date: Tue, 11 Aug 2020 20:10:03 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
age: 9
cf-polished: origSize=169029
x-vhost: publish
status: 200
vary: Accept-Encoding
content-length: 168888
cf-request-id: 0480bdf96b000063479984c200000001
last-modified: Thu, 07 May 2020 19:42:33 GMT
server: cloudflare
x-frame-options: ALLOW-FROM https://content.fireeye.com
etag: "29445-5a51414f3bc40"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/png
x-xss-protection: 1; mode=block
cache-control: no-cache="set-cookie"
content-security-policy: worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
accept-ranges: bytes
cf-ray: 5c149908acc96347-FRA
cf-bgj: imgq:85,h2pri

GET
H2 200 Picture4.png
www.fireeye.com/content/dam/fireeye-www/blog/images/maze/ 286 KB
287 KB 34ms
31ms Image
image/png 2606:4700:300b::a29f:f77d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fireeye.com/content/dam/fireeye-www/blog/images/maze/Picture4.png

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:300b::a29f:f77d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

553a661ebca404c9efff0b67e7c71f3dfd78a53d0c8fb6a498c914d7910772af

Security Headers

Name	Value
Content-Security-Policy	worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	ALLOW-FROM https://content.fireeye.com
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-dispatcher: dispatcher1uswest1
date: Tue, 11 Aug 2020 20:10:03 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
age: 9
cf-polished: origSize=333586
x-vhost: publish
status: 200
vary: Accept-Encoding
content-length: 293289
cf-request-id: 0480bdf96b000063479984d200000001
last-modified: Thu, 07 May 2020 19:42:33 GMT
server: cloudflare
x-frame-options: ALLOW-FROM https://content.fireeye.com
etag: "51712-5a51414f3bc40"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/png
x-xss-protection: 1; mode=block
cache-control: no-cache="set-cookie"
content-security-policy: worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
accept-ranges: bytes
cf-ray: 5c149908acca6347-FRA
cf-bgj: imgq:85,h2pri

GET
H2 200 Picture5.png
www.fireeye.com/content/dam/fireeye-www/blog/images/maze/ 234 KB
234 KB 36ms
33ms Image
image/png 2606:4700:300b::a29f:f77d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fireeye.com/content/dam/fireeye-www/blog/images/maze/Picture5.png

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:300b::a29f:f77d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

cdb1913bcbe7fc4c6b5275adaa24244fd793424baef358810990b57b5c686ac7

Security Headers

Name	Value
Content-Security-Policy	worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	ALLOW-FROM https://content.fireeye.com
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-dispatcher: dispatcher1uswest1
date: Tue, 11 Aug 2020 20:10:03 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
age: 9
cf-polished: origSize=239307
x-vhost: publish
status: 200
vary: Accept-Encoding
content-length: 239118
cf-request-id: 0480bdf96b000063479984e200000001
last-modified: Thu, 07 May 2020 19:42:34 GMT
server: cloudflare
x-frame-options: ALLOW-FROM https://content.fireeye.com
etag: "3a6cb-5a5141502fe80"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/png
x-xss-protection: 1; mode=block
cache-control: no-cache="set-cookie"
content-security-policy: worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
accept-ranges: bytes
cf-ray: 5c149908accc6347-FRA
cf-bgj: imgq:85,h2pri

GET
H2 200 email-decode.min.js Show response
www.fireeye.com/cdn-cgi/scripts/5c5dd728/cloudflare-static/ 1 KB
839 B 13ms
9ms Script
application/javascript 2606:4700:300b::a29f:f77d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.fireeye.com/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:300b::a29f:f77d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 11 Aug 2020 20:10:02 GMT
content-encoding: gzip
vary: Accept-Encoding
last-modified: Wed, 05 Aug 2020 10:00:12 GMT
server: cloudflare
etag: W/"5f2a832c-4d7"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-frame-options: SAMEORIGIN
content-type: application/javascript
status: 200
cache-control: max-age=172800, public
cf-ray: 5c149908acc46347-FRA
cf-request-id: 0480bdf96b0000634799847200000001
expires: Thu, 13 Aug 2020 20:10:02 GMT

GET
H2 200 blog-vision-edition7.gif
www.fireeye.com/content/dam/fireeye-www/blog/images/ 570 KB
571 KB 31ms
29ms Image
image/gif 2606:4700:300b::a29f:f77d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fireeye.com/content/dam/fireeye-www/blog/images/blog-vision-edition7.gif

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:300b::a29f:f77d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5062a8070951a1c77103a1bb6d96a11f185c50e4ee7b317320a8588243f6d828

Security Headers

Name	Value
Content-Security-Policy	worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	ALLOW-FROM https://content.fireeye.com
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-dispatcher: dispatcher1uswest1
date: Tue, 11 Aug 2020 20:10:03 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
age: 757
cf-polished: origSize=592867
x-vhost: publish
status: 200
vary: Accept-Encoding
content-length: 584046
cf-request-id: 0480bdf96b000063479984f200000001
last-modified: Thu, 04 Jun 2020 22:12:02 GMT
server: cloudflare
x-frame-options: ALLOW-FROM https://content.fireeye.com
etag: "90be3-5a7496f1a5080"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
x-xss-protection: 1; mode=block
cache-control: no-cache="set-cookie"
content-security-policy: worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
accept-ranges: bytes
cf-ray: 5c149908accd6347-FRA
cf-bgj: imgq:85,h2pri

GET
H2 200 forms2.min.js Show response
www2.fireeye.com/js/forms2/js/ 205 KB
68 KB 179ms
76ms Script
application/x-javascript 104.17.70.206
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www2.fireeye.com/js/forms2/js/forms2.min.js

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

104.17.70.206 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f24c51a94a931f1bdd7c3dacc9ebb3848305f5eb5a3feddf0b01227f6c778c17

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 11 Aug 2020 20:10:03 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
age: 2805
status: 200
cf-request-id: 0480bdf9e30000bdfa5eb67200000001
last-modified: Wed, 22 Jul 2020 19:04:14 GMT
server: cloudflare
etag: "4c236b-33237-5ab0c67dc4780"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: public, max-age=14400
cf-ray: 5c1499096fb7bdfa-AMS
expires: Wed, 12 Aug 2020 00:10:03 GMT

GET
H2 200 clientlibs_fw.min.js Show response
www.fireeye.com/etc/designs/fireeye-www/ 164 KB
49 KB 51ms
47ms Script
application/javascript 2606:4700:300b::a29f:f77d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.fireeye.com/etc/designs/fireeye-www/clientlibs_fw.min.js

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:300b::a29f:f77d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0590bf440f1352fb0ef85c8f6c4c50ccfa58715f148ba274078f5a574d54450d

Security Headers

Name	Value
Content-Security-Policy	worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff, nosniff
X-Frame-Options	ALLOW-FROM https://content.fireeye.com
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-dispatcher: dispatcher2uswest1
date: Tue, 11 Aug 2020 20:10:03 GMT
content-encoding: gzip
x-content-type-options: nosniff, nosniff
cf-cache-status: HIT
age: 423
x-vhost: publish
status: 200
vary: Accept-Encoding,User-Agent
content-length: 50458
cf-request-id: 0480bdf96b0000634799848200000001
last-modified: Fri, 24 Jul 2020 06:42:42 GMT
server: cloudflare
x-frame-options: ALLOW-FROM https://content.fireeye.com
etag: "28e32-5ab2a479cfc80-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript
x-xss-protection: 1; mode=block
content-security-policy: worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
accept-ranges: bytes
cf-ray: 5c149908acc56347-FRA

GET
H2 200 addthis_widget.js Show response
s7.addthis.com/js/300/ 353 KB
114 KB 154ms
52ms Script
application/javascript 23.210.248.44
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://s7.addthis.com/js/300/addthis_widget.js

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.210.248.44 , Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-210-248-44.deploy.static.akamaitechnologies.com

Software

nginx/1.15.8 /

Resource Hash

eb12a261a24e54883613710a4c12f4d9205f634ca1a29d1df07f90105a93e746

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=15724800; includeSubDomains
content-encoding: gzip
last-modified: Thu, 04 Jun 2020 15:49:19 GMT
server: nginx/1.15.8
etag: "5ed917ff-5834c"
vary: Accept-Encoding
x-distribution: 99
content-type: application/javascript
status: 200
cache-control: public, max-age=600
date: Tue, 11 Aug 2020 20:10:03 GMT
x-host: s7.addthis.com
content-length: 116323

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 298 KB
90 KB 44ms
42ms Script
application/javascript 2a00:1450:4001:821::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-MVGC8KK

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:821::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

8b6cd0c8af52cae5a5a72bf372f595f4c7b49e2ef74fc4b18d5da9428cb83312

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 11 Aug 2020 20:10:03 GMT
content-encoding: br
vary: Accept-Encoding
status: 200
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 91609
x-xss-protection: 0
last-modified: Tue, 11 Aug 2020 18:08:31 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Tue, 11 Aug 2020 20:10:03 GMT

GET
H2 200 token.json Show response
www.fireeye.com/libs/granite/csrf/ 2 B
854 B 707ms
707ms XHR
application/json 2606:4700:300b::a29f:f77d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.fireeye.com/libs/granite/csrf/token.json

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:300b::a29f:f77d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Security Headers

Name	Value
Content-Security-Policy	worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff, nosniff
X-Frame-Options	ALLOW-FROM https://content.fireeye.com
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-dispatcher: dispatcher1uswest1
date: Tue, 11 Aug 2020 20:10:03 GMT
x-content-type-options: nosniff, nosniff
cf-cache-status: DYNAMIC
x-vhost: publish
status: 200
vary: User-Agent, Accept-Encoding
content-length: 2
cf-request-id: 0480bdf9650000634799846200000001
server: cloudflare
x-frame-options: ALLOW-FROM https://content.fireeye.com
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/json;charset=iso-8859-1
x-xss-protection: 1; mode=block
cache-control: no-cache, no-cache="set-cookie"
content-security-policy: worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
cf-ray: 5c149908acb76347-FRA
expires: -1

GET
H2 200 me Show response
js.maxmind.com/geoip/v2.1/country/ 771 B
1 KB 86ms
65ms XHR
application/vnd.maxmind.com-country+json 2606:4700::6810:252f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js.maxmind.com/geoip/v2.1/country/me?referrer=https%3A%2F%2Fwww.fireeye.com
Requested by: Host: www.fireeye.com
URL: https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6810:252f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b76705355ced55168fd590661d7df9b0a26b431a00e43891494b8cd3b845f9e1

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 11 Aug 2020 20:10:03 GMT
cf-cache-status: DYNAMIC
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
status: 200
content-type: application/vnd.maxmind.com-country+json; charset=UTF-8; version=2.1
access-control-allow-origin: *
cf-ray: 5c149908c99b05d8-FRA
content-length: 771
cf-request-id: 0480bdf97c000005d81c0cb200000001

GET
H/1.1 200
OK insight.min.js Show response
snap.licdn.com/li.lms-analytics/ 3 KB
2 KB 10ms
10ms Script
application/x-javascript 2a02:26f0:10c:382::25ea
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://snap.licdn.com/li.lms-analytics/insight.min.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MVGC8KK
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:10c:382::25ea , Ascension Island, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS
Software: /
Resource Hash: 41dd5e421fe221a7d2921d6fa2b36e8b01a9f2c054aaef5fad866fe896c1d1e0

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Tue, 11 Aug 2020 20:10:03 GMT
Content-Encoding: gzip
Last-Modified: Mon, 07 Oct 2019 16:41:31 GMT
X-CDN: AKAM
Vary: Accept-Encoding
Content-Type: application/x-javascript;charset=utf-8
Cache-Control: max-age=33919
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 1576

GET
H2 200 bat.js Show response
bat.bing.com/ 26 KB
8 KB 27ms
27ms Script
application/javascript 2620:1ec:c11::200
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://bat.bing.com/bat.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MVGC8KK
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: 5c622f5433cbb6ea1df5c0dd8671e55ef7d1464366074730473c453de50a579b

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 11 Aug 2020 20:10:02 GMT
content-encoding: gzip
last-modified: Thu, 16 Jul 2020 20:00:00 GMT
x-msedge-ref: Ref A: E227BD381B26442F8199D7206DED5CE8 Ref B: FRAEDGE1416 Ref C: 2020-08-11T20:10:03Z
status: 200
etag: "0e0bdafab5bd61:0"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: private,max-age=1800
accept-ranges: bytes
content-length: 8022

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 45 KB
18 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:814::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MVGC8KK

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:814::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

fd361b57998c76f86335afa28b8a62527d88a8200fb5c428d6f0fff73383e955

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Thu, 04 Jun 2020 23:38:14 GMT
server: Golfe2
age: 5782
date: Tue, 11 Aug 2020 18:33:41 GMT
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: public, max-age=7200
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 18469
expires: Tue, 11 Aug 2020 20:33:41 GMT

GET
H2 200 uwt.js Show response
static.ads-twitter.com/ 5 KB
2 KB 40ms
40ms Script
application/javascript 151.101.12.157
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://static.ads-twitter.com/uwt.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MVGC8KK
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.12.157 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 8247f4332667950989fe6bf790f87723343db2ec83d975503e9c5dc13a6eb5dc

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 11 Aug 2020 20:10:03 GMT
content-encoding: gzip
age: 72374
x-cache: HIT
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
status: 200
content-length: 1958
x-served-by: cache-fra19135-FRA
last-modified: Mon, 10 Aug 2020 18:10:59 GMT
x-timer: S1597176603.098636,VS0,VE0
etag: "a4cc3f907681b24a3efd540acd5d2996+gzip"
vary: Accept-Encoding,Host
content-type: application/javascript; charset=utf-8
via: 1.1 varnish
cache-control: no-cache
accept-ranges: bytes

GET
H2 200 conversion_async.js Show response
www.googleadservices.com/pagead/ 29 KB
11 KB 53ms
52ms Script
text/javascript 172.217.23.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/conversion_async.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MVGC8KK

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.23.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

mil04s23-in-f98.1e100.net

Software

cafe /

Resource Hash

92f410985c0233c9abcba33b98f05b3e24d5ea3e80f5083466d545e94d49ec43

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 11 Aug 2020 20:10:03 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 11332
x-xss-protection: 0
server: cafe
etag: 5272426352805486351
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Tue, 11 Aug 2020 20:10:03 GMT

GET
H2

200

activityi;dc_pre=CKPWycD6k-sCFVVN5QodLyAN0Q;src=8443343;type=sitew0;cat=firee0;ord=6562365312559;gtm=2wg871;auiddc=1661597319.1597176603;u1=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F...
8443343.fls.doubleclick.net/ Frame 3C20
Redirect Chain

https://8443343.fls.doubleclick.net/activityi;src=8443343;type=sitew0;cat=firee0;ord=6562365312559;gtm=2wg871;auiddc=1661597319.1597176603;u1=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%...
https://8443343.fls.doubleclick.net/activityi;dc_pre=CKPWycD6k-sCFVVN5QodLyAN0Q;src=8443343;type=sitew0;cat=firee0;ord=6562365312559;gtm=2wg871;auiddc=1661597319.1597176603;u1=https%3A%2F%2Fwww.fir...

0
0

50ms
49ms

Document
text/html

172.217.23.134
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://8443343.fls.doubleclick.net/activityi;dc_pre=CKPWycD6k-sCFVVN5QodLyAN0Q;src=8443343;type=sitew0;cat=firee0;ord=6562365312559;gtm=2wg871;auiddc=1661597319.1597176603;u1=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2020%2F05%2Ftactics-techniques-procedures-associated-with-maze-ransomware-incidents.html;u2=Navigating%20the%20MAZE%3A%20Tactics%2C%20Techniques%20and%20Procedures%20Associated%20With%20MAZE%20Ransomware%20Incidents%20%7C%20FireEye%20Inc;~oref=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2020%2F05%2Ftactics-techniques-procedures-associated-with-maze-ransomware-incidents.html?

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MVGC8KK

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.23.134 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s18-in-f134.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: 8443343.fls.doubleclick.net
:scheme: https
:path: /activityi;dc_pre=CKPWycD6k-sCFVVN5QodLyAN0Q;src=8443343;type=sitew0;cat=firee0;ord=6562365312559;gtm=2wg871;auiddc=1661597319.1597176603;u1=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2020%2F05%2Ftactics-techniques-procedures-associated-with-maze-ransomware-incidents.html;u2=Navigating%20the%20MAZE%3A%20Tactics%2C%20Techniques%20and%20Procedures%20Associated%20With%20MAZE%20Ransomware%20Incidents%20%7C%20FireEye%20Inc;~oref=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2020%2F05%2Ftactics-techniques-procedures-associated-with-maze-ransomware-incidents.html?
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: about:blank

Response headers

status: 200
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
date: Tue, 11 Aug 2020 20:10:03 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, must-revalidate
strict-transport-security: max-age=21600
content-type: text/html; charset=UTF-8
pragma: no-cache
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 531
x-xss-protection: 0
set-cookie: test_cookie=CheckForPermission; expires=Tue, 11-Aug-2020 20:25:03 GMT; path=/; domain=.doubleclick.net; Secure; SameSite=none
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

Redirect headers

status: 302
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
date: Tue, 11 Aug 2020 20:10:03 GMT
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, must-revalidate
follow-only-when-prerender-shown: 1
strict-transport-security: max-age=21600
location: https://8443343.fls.doubleclick.net/activityi;dc_pre=CKPWycD6k-sCFVVN5QodLyAN0Q;src=8443343;type=sitew0;cat=firee0;ord=6562365312559;gtm=2wg871;auiddc=1661597319.1597176603;u1=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2020%2F05%2Ftactics-techniques-procedures-associated-with-maze-ransomware-incidents.html;u2=Navigating%20the%20MAZE%3A%20Tactics%2C%20Techniques%20and%20Procedures%20Associated%20With%20MAZE%20Ransomware%20Incidents%20%7C%20FireEye%20Inc;~oref=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2020%2F05%2Ftactics-techniques-procedures-associated-with-maze-ransomware-incidents.html?
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
server: cafe
content-length: 0
x-xss-protection: 0
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 fbevents.js Show response
connect.facebook.net/en_US/ 134 KB
34 KB 6ms
6ms Script
application/x-javascript 2a03:2880:f01c:8012:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f01c:8012:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

893df2b9ceb653f94333139d561d363bf4c365e651a0a3ade839d96200942e37

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob:;script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .virtualearth.net .google.com 127.0.0.1:* .spotilocal.com: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net .spotilocal.com: wss://.facebook.com: https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
status: 200
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 34269
x-xss-protection: 0
pragma: public
x-fb-debug: YK0aPKUNQkpWWfXd/HY/7Iisn5VVTrKRvSQqFz5kaF9fj0KGfYW4HjfDCh+Sgcy3hw0zDrm1Y7p7NGo9/wHgew==
x-fb-trip-id: 664085054
x-frame-options: DENY
date: Tue, 11 Aug 2020 20:10:03 GMT
vary: Accept-Encoding
content-type: application/x-javascript; charset=utf-8
cache-control: public, max-age=1200
content-security-policy: default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H/1.1 200
OK munchkin.js Show response
munchkin.marketo.net/ 1 KB
1 KB 169ms
74ms Script
application/x-javascript 104.109.95.62
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://munchkin.marketo.net/munchkin.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MVGC8KK
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.109.95.62 , Netherlands, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS: a104-109-95-62.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 5cc2628039ee08964a5f46fb8abb1d5e1ec87e1200d12862ef1232bbfed7da55

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Tue, 11 Aug 2020 20:10:03 GMT
Content-Encoding: gzip
Last-Modified: Wed, 05 Aug 2020 03:11:00 GMT
Server: AkamaiNetStorage
ETag: "a67ed8ce0a86706b9f73a86806ce5bd3:1596597060.25158"
Vary: Accept-Encoding
P3P: policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR"
Connection: keep-alive
Accept-Ranges: bytes
Content-Type: application/x-javascript
Content-Length: 752

GET
H2 200 jukebox.js Show response
app.cdn.lookbookhq.com/production/jukebox/current/ 978 KB
230 KB 188ms
75ms Script
text/javascript 13.226.155.81
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://app.cdn.lookbookhq.com/production/jukebox/current/jukebox.js
Requested by: Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 13.226.155.81 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-226-155-81.dus51.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 399015e782f7252a2433dc591526bd0fa9fcb4e74544f521aaad257b8a2b1311

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-amz-version-id: null
content-encoding: gzip
last-modified: Thu, 06 Aug 2020 00:59:01 GMT
server: AmazonS3
age: 12205
date: Tue, 11 Aug 2020 16:46:39 GMT
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: text/javascript
status: 200
cache-control: max-age=43200
x-amz-cf-pop: DUS51-C1
x-amz-cf-id: _c9y_9g1_XP7xKXCoAdh7chA69iVR59dQxr9KkQv018RTlMkC5gjJQ==
via: 1.1 e5dcf90f3787d486ad40e46070021460.cloudfront.net (CloudFront)

GET
H2 200 loop.bundle.js Show response
v2.listenloop.com/ 175 KB
58 KB 64ms
42ms Script
application/javascript 2606:4700:3032::681b:9c96
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://v2.listenloop.com/loop.bundle.js
Requested by: Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3032::681b:9c96 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3d860c5fb1c65a11fc6a71feac206483f8c3ebc81d823177aa7ef9bf8d70523

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 11 Aug 2020 20:10:03 GMT
content-encoding: br
cf-cache-status: HIT
age: 4263
status: 200
x-amz-request-id: 19B1A7AEBC674E48
x-amz-id-2: 8GU2QkGSMIRuVjKDBg5oTY+6IEE0ilgvCobzgqZwH5Zw3rKf1JKZ3taxczngAbqo+Dor902eCko=
last-modified: Wed, 05 Aug 2020 11:20:48 GMT
server: cloudflare
etag: W/"a320b78a69adf03eab9be173a2d7c510"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=1800
cf-request-id: 0480bdf9f1000016f205191200000001
cf-ray: 5c1499098f9616f2-FRA

GET
H2 200 wm3vc3smix6y.js Show response
js.driftt.com/include/1597176900000/ 244 KB
71 KB 434ms
434ms Script
application/javascript 13.226.155.5
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/include/1597176900000/wm3vc3smix6y.js

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

13.226.155.5 Seattle, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-226-155-5.dus51.r.cloudfront.net

Software

nginx /

Resource Hash

974aae5186719dc27b519ca27e94fa64106caa532d17c1ddc0b7b246ab9d8e24

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
content-encoding: gzip
etag: "bfeabe9e267cdb8c2df55dcb72e372de"
x-amz-cf-pop: DUS51-C1
x-amz-server-side-encryption: AES256
x-cache: RefreshHit from cloudfront
status: 200
access-control-allow-origin: *
last-modified: Fri, 07 Aug 2020 19:05:57 GMT
server: nginx
date: Tue, 11 Aug 2020 20:10:03 GMT
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=UTF-8
via: 1.1 58dd513f0a53b3e6851a071cb857a706.cloudfront.net (CloudFront)
cache-control: no-cache
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: StgFHbgLRSeDdrCiovqN6MPxAwoK3ixPZySLK1rNCdbjkFrIVO_KRQ==

GET
H/1.1

200
OK

/
attr.ml-api.io/
Redirect Chain

https://s.ml-attr.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dfireeye.com%26pId%3d%24UID
https://secure.adnxs.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dfireeye.com%26pId%3d%24UID
https://secure.adnxs.com/bounce?%2Fgetuid%3Fhttps%253a%252f%252fattr.ml-api.io%252f%253fdomain%253dfireeye.com%2526pId%253d%2524UID
https://attr.ml-api.io/?domain=fireeye.com&pId=5943920088028517729

4 B
485 B

473ms
373ms

Image
image/jpeg

13.226.155.74
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://attr.ml-api.io/?domain=fireeye.com&pId=5943920088028517729
Requested by: Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 13.226.155.74 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-226-155-74.dus51.r.cloudfront.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Tue, 11 Aug 2020 20:10:04 GMT
Via: 1.1 0406d08716a9781a5c19ff86db2debd3.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: DUS51-C1
x-amzn-RequestId: 46462990-1ba5-42b2-a592-96ba0b2ee75a
X-Cache: Miss from cloudfront
Content-Type: image/jpeg
X-Amzn-Trace-Id: Root=1-5f32fb1c-5fbc9a48009c36d0e181f900;Sampled=0
Connection: keep-alive
x-amz-apigw-id: RHwsZFZlIAMF7Mg=
Content-Length: 4
X-Amz-Cf-Id: toG9eAMPGTwd0Zm-QUseoxoPUTdTSoYt8YSIqgEVRvTjGMeJBPqd2w==

Redirect headers

Pragma: no-cache
Date: Tue, 11 Aug 2020 20:10:03 GMT
X-Proxy-Origin: 194.99.105.99; 194.99.105.99; 722.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.223.57:80
AN-X-Request-Uuid: c8f8251b-313e-419f-84b6-443ba92cd2d8
Server: nginx/1.13.4
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://attr.ml-api.io/?domain=fireeye.com&pId=5943920088028517729
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 lftracker_v1_3P1w24dgrmJ7mY5n.js Show response
lftracker.leadfeeder.com/ 10 KB
4 KB 156ms
51ms Script
application/javascript 13.226.155.119
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://lftracker.leadfeeder.com/lftracker_v1_3P1w24dgrmJ7mY5n.js
Requested by: Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 13.226.155.119 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-226-155-119.dus51.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: c12b0339ae4601edf3d549f50b7996d241b44ac2a4d1268adf7d8a0695ccb142

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 11 Aug 2020 19:58:11 GMT
content-encoding: gzip
last-modified: Thu, 23 Jul 2020 09:23:02 GMT
server: AmazonS3
age: 713
etag: W/"b143da0177b52b6047fbb8d09c393d36"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
status: 200
cache-control: max-age=3600
x-amz-cf-pop: DUS51-C1
x-amz-cf-id: 4HTshP1uOLXVXj91RSsTBfIPkJrudZgUpwyFhsS-CEA_YY47wo1eHg==
via: 1.1 51054083366f59cdc509361d23d873eb.cloudfront.net (CloudFront)

GET
H2

200

collect
px.ads.linkedin.com/
Redirect Chain

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=6572&url=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2020%2F05%2Ftactics-techniques-procedures-associated-with-maze-ransomware-incide...
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D6572%26url%3Dhttps%253A%252F%252Fwww.fireeye.com%252Fblog%252Fthreat-research%252...
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=6572&url=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2020%2F05%2Ftactics-techniques-procedures-associated-with-maze-ransomware-incide...

0
40 B

170ms
169ms

Image
application/javascript

2a05:f500:11:101::b93f:9005
LINKEDIN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=6572&url=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2020%2F05%2Ftactics-techniques-procedures-associated-with-maze-ransomware-incidents.html&time=1597176603124&liSync=true
Requested by: Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2a05:f500:11:101::b93f:9005 , Ireland, ASN14413 (LINKEDIN, US),
Reverse DNS
Software: Play /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 11 Aug 2020 20:10:03 GMT
server: Play
linkedin-action: 1
x-li-fabric: prod-lor1
status: 200
x-li-proto: http/2
x-li-pop: prod-tln1
content-type: application/javascript
content-length: 0
x-li-uuid: 9dJkoKhPKhbwGdhT2yoAAA==

Redirect headers

content-security-policy: default-src *; connect-src 'self' https://media-src.linkedin.com/media/ www.linkedin.com s.c.lnkd.licdn.com m.c.lnkd.licdn.com s.c.exp1.licdn.com s.c.exp2.licdn.com m.c.exp1.licdn.com m.c.exp2.licdn.com wss://*.linkedin.com dms.licdn.com https://dpm.demdex.net/id https://lnkd.demdex.net/event blob: https://accounts.google.com/gsi/status https://linkedin.sc.omtrdc.net/b/ss/ www.google-analytics.com static.licdn.com static-exp1.licdn.com static-exp2.licdn.com static-exp3.licdn.com media.licdn.com media-exp1.licdn.com media-exp2.licdn.com media-exp3.licdn.com; img-src data: blob: *; font-src data: *; style-src 'unsafe-inline' 'self' static-src.linkedin.com *.licdn.com; script-src 'report-sample' 'unsafe-inline' 'unsafe-eval' 'self' spdy.linkedin.com static-src.linkedin.com *.ads.linkedin.com *.licdn.com static.chartbeat.com www.google-analytics.com ssl.google-analytics.com bcvipva02.rightnowtech.com www.bizographics.com sjs.bizographics.com js.bizographics.com d.la4-c1-was.salesforceliveagent.com slideshare.www.linkedin.com https://snap.licdn.com/li.lms-analytics/insight.min.js platform.linkedin.com platform-akam.linkedin.com platform-ecst.linkedin.com platform-azur.linkedin.com; object-src 'none'; media-src blob: *; child-src blob: lnkd-communities: voyager: *; frame-ancestors 'self'
x-content-type-options: nosniff
linkedin-action: 1
status: 302
content-length: 0
x-li-uuid: ajfqmKhPKhZwJCOZBCsAAA==
pragma: no-cache
x-li-pop: afd-prod-lor1
x-msedge-ref: Ref A: 852B85DE470943B687B1F81E7E2AED17 Ref B: FRAEDGE1416 Ref C: 2020-08-11T20:10:03Z
x-frame-options: sameorigin
date: Tue, 11 Aug 2020 20:10:03 GMT
expect-ct: max-age=86400, report-uri="https://www.linkedin.com/platform-telemetry/ct"
strict-transport-security: max-age=2592000
x-li-fabric: prod-lor1
location: https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=6572&url=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2020%2F05%2Ftactics-techniques-procedures-associated-with-maze-ransomware-incidents.html&time=1597176603124&liSync=true
x-xss-protection: 1; mode=block
cache-control: no-cache, no-store
x-li-proto: http/2
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2

200

ga-audiences
www.google.de/ads/
Redirect Chain

https://www.google-analytics.com/r/collect?v=1&_v=j83&a=186233434&t=pageview&_s=1&dl=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2020%2F05%2Ftactics-techniques-procedures-associated-wi...
https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-363943-1&cid=1259957762.1597176603&jid=1249946458&_gid=1827356261.1597176603&gjid=1561069368&_v=j83&z=420093417
https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-363943-1&cid=1259957762.1597176603&jid=1249946458&_v=j83&z=420093417
https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-363943-1&cid=1259957762.1597176603&jid=1249946458&_v=j83&z=420093417&slf_rd=1&random=1318528015

42 B
106 B

52ms
52ms

Image
image/gif

2a00:1450:4001:800::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-363943-1&cid=1259957762.1597176603&jid=1249946458&_v=j83&z=420093417&slf_rd=1&random=1318528015

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 11 Aug 2020 20:10:03 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 11 Aug 2020 20:10:03 GMT
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 302
content-type: text/html; charset=UTF-8
location: https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-363943-1&cid=1259957762.1597176603&jid=1249946458&_v=j83&z=420093417&slf_rd=1&random=1318528015
cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 204 0
bat.bing.com/action/ 0
134 B 28ms
27ms Image
text/plain 2620:1ec:c11::200
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://bat.bing.com/action/0?ti=5870833&Ver=2&mid=391c60f3-8206-1017-6d00-b4865f3e43f6&sid=d1842536dd38be9a5e47ab200af61e44&vid=ac6a6e90d615b9cf814674b4cec1df82&vids=1&pi=0&lg=en-US&sw=1600&sh=1200&sc=24&tl=Navigating%20the%20MAZE%3A%20Tactics,%20Techniques%20and%20Procedures%20Associated%20With%20MAZE%20Ransomware%20Incidents%20%7C%20FireEye%20Inc&p=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2020%2F05%2Ftactics-techniques-procedures-associated-with-maze-ransomware-incidents.html&r=&evt=pageLoad&msclkid=N&sv=1&rn=808221
Requested by: Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status: 204
pragma: no-cache
date: Tue, 11 Aug 2020 20:10:02 GMT
cache-control: no-cache, must-revalidate
x-msedge-ref: Ref A: C8DB68EC8165419282A043702C7F3C17 Ref B: FRAEDGE1416 Ref C: 2020-08-11T20:10:03Z
access-control-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 1847206522249226 Show response
connect.facebook.net/signals/config/ 524 KB
132 KB 8ms
8ms Script
application/x-javascript 2a03:2880:f01c:8012:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/1847206522249226?v=2.9.23&r=stable

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f01c:8012:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

2ad5294b998a0ca14aeb5f130286eef4f45d646b3467c68643fd8727a1b392e3

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob:;script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .virtualearth.net .google.com 127.0.0.1:* .spotilocal.com: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net .spotilocal.com: wss://.facebook.com: https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
status: 200
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 134848
x-xss-protection: 0
pragma: public
x-fb-debug: rzaHQsIFiHPYu70g/Cq2G8WVNTAVmTWgsIVQfPiyUUCG1xG4WJPZv/5dda9OOw0W2pB5a8rezm1BSyAeZQsLYg==
x-fb-trip-id: 664085054
x-frame-options: DENY
date: Tue, 11 Aug 2020 20:10:03 GMT
vary: Accept-Encoding
content-type: application/x-javascript; charset=utf-8
cache-control: public, max-age=1200
content-security-policy: default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 adsct
t.co/i/ 43 B
170 B 169ms
169ms Image
image/gif 104.244.42.197
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://t.co/i/adsct?type=javascript&version=1.1.0&p_id=Twitter&p_user_id=0&txn_id=nw2v7&events=%5B%5B%22pageview%22%2Cnull%5D%5D&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=0&tw_document_href=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2020%2F05%2Ftactics-techniques-procedures-associated-with-maze-ransomware-incidents.html

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

104.244.42.197 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=0
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 11 Aug 2020 20:10:03 GMT
content-encoding: gzip
x-content-type-options: nosniff
status: 200, 200 OK
x-twitter-response-tags: BouncerCompliant
content-length: 65
x-xss-protection: 0
x-response-time: 120
pragma: no-cache
last-modified: Tue, 11 Aug 2020 20:10:03 GMT
server: tsa_o
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=0
content-type: image/gif;charset=utf-8
cache-control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash: e686b0bc9837ba44b70246453de47d42
x-transaction: 002e4572000a0b4b
expires: Tue, 31 Mar 1981 05:00:00 GMT

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/968899429/ 3 KB
1 KB 21ms
21ms Script
text/javascript 2a00:1450:4001:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/968899429/?random=1597176603175&cv=9&fst=1597176603175&num=1&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2wg871&sendb=1&ig=1&frm=0&url=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2020%2F05%2Ftactics-techniques-procedures-associated-with-maze-ransomware-incidents.html&tiba=Navigating%20the%20MAZE%3A%20Tactics%2C%20Techniques%20and%20Procedures%20Associated%20With%20MAZE%20Ransomware%20Incidents%20%7C%20FireEye%20Inc&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

6040c7be8f33e31fe2fc48e6ce0d5acb94d92f81432ad8b0b7075ddceb5ca47d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 11 Aug 2020 20:10:03 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status: 200
cache-control: no-cache, must-revalidate
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 1122
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK 6si.min.js Show response
j.6sc.co/ 15 KB
7 KB 181ms
54ms Script
application/javascript 23.34.183.125
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://j.6sc.co/6si.min.js
Requested by: Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.34.183.125 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-34-183-125.deploy.static.akamaitechnologies.com
Software: nginx/1.14.0 (Ubuntu) /
Resource Hash: f8e9b5bec9f48d639838d32b29d6713fece521a5d96913cc37a267a69b7e598b

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Tue, 11 Aug 2020 20:10:03 GMT
Content-Encoding: gzip
Last-Modified: Tue, 28 Jul 2020 17:10:34 GMT
Server: nginx/1.14.0 (Ubuntu)
ETag: "5f205c0a-3a07"
Vary: Accept-Encoding
Access-Control-Allow-Methods: GET,POST
Content-Type: application/javascript
Access-Control-Allow-Origin
Access-Control-Max-Age: 86400
Access-Control-Allow-Credentials: true
Connection: keep-alive
Accept-Ranges: bytes
Access-Control-Allow-Headers: *
Content-Length: 6080

GET
DATA 200
OK truncated
/ 17 KB
17 KB Font
application/x-font-woff2

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: f20b7aacff69fbfc6fc0aaff9220bab48d3ce87c45bd077fea61e5d9e7662c2c

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
Origin: https://www.fireeye.com

Response headers

Content-Type: application/x-font-woff2

GET
H2 200 fireicons.woff
www.fireeye.com/content/dam/fireeye-www/fw/f/ 72 KB
36 KB 21ms
20ms Font
application/x-font-woff 2606:4700:300b::a29f:f77d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.fireeye.com/content/dam/fireeye-www/fw/f/fireicons.woff?mva1rk

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:300b::a29f:f77d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

1de5a2b057fc1fd85e8b3ccffa91101c8304a88b32fccb33e19d7657a1460dae

Security Headers

Name	Value
Content-Security-Policy	worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	ALLOW-FROM https://content.fireeye.com
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://www.fireeye.com/etc/designs/fireeye-www/clientlibs_fw-2019.min.css
Origin: https://www.fireeye.com

Response headers

x-dispatcher: dispatcher1uswest1
date: Tue, 11 Aug 2020 20:10:03 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
age: 31974
x-vhost: publish
status: 200
vary: Accept-Encoding,User-Agent
content-length: 36804
cf-request-id: 0480bdfa4c0000634799858200000001
last-modified: Tue, 24 Sep 2019 21:47:18 GMT
server: cloudflare
x-frame-options: ALLOW-FROM https://content.fireeye.com
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/x-font-woff
x-xss-protection: 1; mode=block
cache-control: no-cache="set-cookie"
content-security-policy: worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
accept-ranges: bytes
cf-ray: 5c14990a1dcc6347-FRA

GET
DATA 200
OK truncated
/ 5 KB
5 KB Font
application/x-font-woff2

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 1c7c6cbe8b5beb7e138cfcc8f6301d21b35437e5559be7afd0afe3f536d5fc02

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
Origin: https://www.fireeye.com

Response headers

Content-Type: application/x-font-woff2

GET
H2 200 /
www.facebook.com/tr/ 44 B
257 B 6ms
6ms Image
image/gif 2a03:2880:f11c:8183:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=1847206522249226&ev=PageView&dl=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2020%2F05%2Ftactics-techniques-procedures-associated-with-maze-ransomware-incidents.html&rl=&if=false&ts=1597176603362&sw=1600&sh=1200&v=2.9.23&r=stable&ec=0&o=30&fbp=fb.1.1597176603360.1680617334&it=1597176603165&coo=false&rqm=GET

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f11c:8183:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 11 Aug 2020 20:10:03 GMT
last-modified: Fri, 21 Dec 2012 00:00:01 GMT
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
status: 200
cache-control: no-cache, must-revalidate, max-age=0
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 44
expires: Tue, 11 Aug 2020 20:10:03 GMT

GET
H2 200 /
www.google.com/pagead/1p-user-list/968899429/ 42 B
107 B 19ms
19ms Image
image/gif 2a00:1450:4001:800::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/968899429/?random=1597176603175&cv=9&fst=1597176000000&num=1&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2wg871&sendb=1&frm=0&url=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2020%2F05%2Ftactics-techniques-procedures-associated-with-maze-ransomware-incidents.html&tiba=Navigating%20the%20MAZE%3A%20Tactics%2C%20Techniques%20and%20Procedures%20Associated%20With%20MAZE%20Ransomware%20Incidents%20%7C%20FireEye%20Inc&async=1&fmt=3&is_vtc=1&random=963632262&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 11 Aug 2020 20:10:03 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.de/pagead/1p-user-list/968899429/ 42 B
107 B 20ms
20ms Image
image/gif 2a00:1450:4001:800::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/968899429/?random=1597176603175&cv=9&fst=1597176000000&num=1&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2wg871&sendb=1&frm=0&url=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2020%2F05%2Ftactics-techniques-procedures-associated-with-maze-ransomware-incidents.html&tiba=Navigating%20the%20MAZE%3A%20Tactics%2C%20Techniques%20and%20Procedures%20Associated%20With%20MAZE%20Ransomware%20Incidents%20%7C%20FireEye%20Inc&async=1&fmt=3&is_vtc=1&random=963632262&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 11 Aug 2020 20:10:03 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
tr.lfeeder.com/ 43 B
293 B 32ms
32ms Image
image/gif 2600:9000:2182:6600:1a:2af:6d00:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tr.lfeeder.com/?sid=3P1w24dgrmJ7mY5n&data=eyJnYVRyYWNraW5nSWRzIjpbIlVBLTM2Mzk0My0xIl0sImdhQ2xpZW50SWRzIjpbIjEyNTk5NTc3NjIuMTU5NzE3NjYwMyJdLCJjb250ZXh0Ijp7ImxpYnJhcnkiOnsibmFtZSI6ImxmdHJhY2tlciIsInZlcnNpb24iOiIxLjYuMSJ9LCJwYWdlVXJsIjoiaHR0cHM6Ly93d3cuZmlyZWV5ZS5jb20vYmxvZy90aHJlYXQtcmVzZWFyY2gvMjAyMC8wNS90YWN0aWNzLXRlY2huaXF1ZXMtcHJvY2VkdXJlcy1hc3NvY2lhdGVkLXdpdGgtbWF6ZS1yYW5zb213YXJlLWluY2lkZW50cy5odG1sIiwicGFnZVRpdGxlIjoiTmF2aWdhdGluZyB0aGUgTUFaRTogVGFjdGljcywgVGVjaG5pcXVlcyBhbmQgUHJvY2VkdXJlcyBBc3NvY2lhdGVkIFdpdGggTUFaRSBSYW5zb213YXJlIEluY2lkZW50cyB8IEZpcmVFeWUgSW5jIiwicmVmZXJyZXIiOiIifSwiZXZlbnQiOiJ0cmFja2luZy1ldmVudCIsImNsaWVudFRpbWVzdGFtcCI6IjIwMjAtMDgtMTFUMjA6MTA6MDMuMzY4WiIsImNsaWVudFRpbWV6b25lIjotMTIwLCJzY3JpcHRJZCI6IjNQMXcyNGRncm1KN21ZNW4iLCJjb29raWVzRW5hYmxlZCI6dHJ1ZSwiYW5vbnltaXplSXAiOmZhbHNlLCJsZkNsaWVudElkIjoiTEYxLjEuZTg0NDBmMzNkNzJiZjAyMC4xNTk3MTc2NjAzMzY4IiwiZm9yZWlnbkNvb2tpZXMiOltdLCJwcm9wZXJ0aWVzIjp7fX0=
Requested by: Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:9000:2182:6600:1a:2af:6d00:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: CloudFront /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 11 Aug 2020 20:10:03 GMT
via: 1.1 a608f2055229f2ea193f6b8f15267a71.cloudfront.net (CloudFront)
server: CloudFront
x-amz-cf-pop: DUS51-C1
x-cache: LambdaGeneratedResponse from cloudfront
content-type: image/gif
status: 200
content-length: 43
x-amz-cf-id: 1NcyLo-I2QSbi7ISUhhYtUNm85thLZNMkyGGlxPYj94moy_kIB5SKg==

GET
H2 200 font-awesome.min.css
maxcdn.bootstrapcdn.com/font-awesome/4.6.1/css/ 28 KB
7 KB 23ms
8ms Stylesheet
text/css 2001:4de0:ac19::1:b:3a
HIGHWINDS3

General

Check archive.org

Show headers Download Go to

Full URL

https://maxcdn.bootstrapcdn.com/font-awesome/4.6.1/css/font-awesome.min.css

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2001:4de0:ac19::1:b:3a , Netherlands, ASN20446 (HIGHWINDS3, US),

Reverse DNS

Software

Resource Hash

b5d7707ea8fc00aae40bf500ac7498d7f32f6b1bbff7b4fde976a40345eb5f9d

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 11 Aug 2020 20:10:03 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 12 Dec 2018 18:35:20 GMT
status: 200
etag: "1544639720"
vary: Accept-Encoding
x-cache: HIT
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
content-length: 6591

GET
H2 200 css
fonts.googleapis.com/ 5 KB
759 B 15ms
14ms Stylesheet
text/css 2a00:1450:4001:825::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto:400,700

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:825::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

d32996520262a9559a26eafe3413cf1a2fe53f448da989d0493e7851f887a1b0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
status: 200
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Tue, 11 Aug 2020 19:31:26 GMT
server: ESF
date: Tue, 11 Aug 2020 20:10:03 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Tue, 11 Aug 2020 20:10:03 GMT

GET
H2 200 sp.js Show response
cdn.pathfactory.com/sp/2.14.0/ 98 KB
30 KB 202ms
81ms Script
application/javascript 13.226.155.25
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.pathfactory.com/sp/2.14.0/sp.js
Requested by: Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 13.226.155.25 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-226-155-25.dus51.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 50cf303cfaa020fcbedd6ad1bf045a008cbb88dfc792f731f07235dd1ca13599

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 05 Aug 2020 04:58:10 GMT
content-encoding: gzip
last-modified: Wed, 06 May 2020 07:53:19 GMT
server: AmazonS3
age: 573114
x-amz-server-side-encryption: AES256
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
status: 200
cache-control: max-age=315360000
x-amz-cf-pop: DUS51-C1
x-amz-cf-id: SVREfKTyq_2Vc0qnsjRUufC9tyEuLTQsVUxXoYYOixIEfLaCfeiRXA==
via: 1.1 a67be963c7536322e9a591e428e62d28.cloudfront.net (CloudFront)

GET
H2 200 website_experience Show response
jukebox.pathfactory.com/api/public/v1/ 4 KB
2 KB 480ms
221ms XHR
application/json 52.45.104.28
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://jukebox.pathfactory.com/api/public/v1/website_experience?clientId=LB-9AC90F09-10427&visitorUuid=&title=Navigating%20the%20MAZE%3A%20Tactics%2C%20Techniques%20and%20Procedures%20Associated%20With%0AMAZE%20Ransomware%20Incidents&url=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2020%2F05%2Ftactics-techniques-procedures-associated-with-maze-ransomware-incidents.html&image=https%3A%2F%2Fwww.fireeye.com%2Fcontent%2Fdam%2Ffireeye-www%2Ffw%2Fimages%2Ffireeye-2-color-square.png

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.45.104.28 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-52-45-104-28.compute-1.amazonaws.com

Software

Resource Hash

549fbc39b71cd05d2b8cfb88341249b1fa0220d5c97321c95e68039a6534653c

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept: application/json
Referer: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: application/json

Response headers

x-runtime: 0.084912
date: Tue, 11 Aug 2020 20:10:04 GMT
content-encoding: gzip
x-content-type-options: nosniff
status: 200
etag: W/"549fbc39b71cd05d2b8cfb88341249b1"
access-control-max-age: 1728000
access-control-allow-methods: GET, PUT, POST, PATCH, OPTIONS
content-type: application/json; charset=utf-8
access-control-allow-origin: https://www.fireeye.com
access-control-expose-headers
cache-control: max-age=0, private, must-revalidate
access-control-allow-credentials: true
vary: Origin, Accept-Encoding
x-request-id: d4ad4d31-ee02-448c-bbc8-0e437c254fcc

GET
H/1.1 200
OK me Show response
abm2.listenloop.com/api/v1/public/organizations/ 574 B
1 KB 524ms
135ms XHR
application/json 54.81.89.51
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://abm2.listenloop.com/api/v1/public/organizations/me?public_key=MRxJc5qdz5T-wKxBNsh4
Requested by: Host: www.fireeye.com
URL: https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.81.89.51 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-81-89-51.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 56bf97572cc7de5a19131a062e5e0e64ffa38dc71e87cdfa7c0e481e15f2d628

Request headers

Accept: */*
Referer: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

X-Runtime: 0.005549
Date: Tue, 11 Aug 2020 20:10:03 GMT
Content-Encoding: gzip
Server: nginx
ETag: W/"795e5e22a66051a70daafd8d2f58f18d"
Vary: Accept-Encoding
Access-Control-Allow-Methods: GET, POST, DELETE, PUT, PATCH, OPTIONS, HEAD
Content-Type: application/json; charset=utf-8
Access-Control-Allow-Origin: https://www.fireeye.com
Cache-Control: max-age=0, private, must-revalidate
Access-Control-Allow-Credentials: true
Connection: keep-alive
Access-Control-Allow-Headers: Access-Control-Request-Headers,X-User-Token,X-User-email,content-type,X-RateLimit-Limit,X-RateLimit-Remaining,X-RateLimit-Reset
Content-Length: 361
X-Request-Id: 483513d3-08c2-475d-b2b9-a2c5e15cfd7a

POST
H/1.1 200
OK retargeting_segments Show response
abm2.listenloop.com/api/v1/public/ 27 B
760 B 547ms
141ms XHR
application/json 54.81.89.51
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://abm2.listenloop.com/api/v1/public/retargeting_segments
Requested by: Host: www.fireeye.com
URL: https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.81.89.51 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-81-89-51.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 1cddcd88d3332d560856627ab2cecc7d9aa6c9d616729701ae13902d1671d0b0

Request headers

Accept: */*
Referer: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8

Response headers

X-Runtime: 0.005266
Date: Tue, 11 Aug 2020 20:10:03 GMT
Content-Encoding: gzip
Server: nginx
ETag: W/"075708cda5f07f593aac9ed6d489aad9"
Vary: Accept-Encoding
Access-Control-Allow-Methods: GET, POST, DELETE, PUT, PATCH, OPTIONS, HEAD
Content-Type: application/json; charset=utf-8
Access-Control-Allow-Origin: https://www.fireeye.com
Cache-Control: max-age=0, private, must-revalidate
Access-Control-Allow-Credentials: true
Connection: keep-alive
Access-Control-Allow-Headers: Access-Control-Request-Headers,X-User-Token,X-User-email,content-type,X-RateLimit-Limit,X-RateLimit-Remaining,X-RateLimit-Reset
Content-Length: 53
X-Request-Id: 1238cc94-823c-45fc-b78a-83c325a1d0b3

GET
H/1.1 200
OK / Show response
c.6sc.co/ 47 B
371 B 164ms
54ms XHR
text/plain 23.34.183.125
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://c.6sc.co/
Requested by: Host: www.fireeye.com
URL: https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.34.183.125 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-34-183-125.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 5773bc4e147bd50beb3836c301dc2468218a94d6cf6a628bf2584dc7cf334790

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Tue, 11 Aug 2020 20:10:03 GMT
Access-Control-Max-Age: 86400
Access-Control-Allow-Methods: GET,POST
Content-Type: text/plain
Access-Control-Allow-Origin: https://www.fireeye.com
Access-Control-Allow-Credentials: true
Connection: keep-alive
Access-Control-Allow-Headers: *
Content-Length: 47

GET
H/1.1 200
OK getuidj Show response
secure.adnxs.com/ 11 B
703 B 129ms
46ms XHR
application/json 185.33.220.243
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.adnxs.com/getuidj

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.220.243 , Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

722.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

Software

nginx/1.13.4 /

Resource Hash

31b45c462302ac175bfa43f9e5591491db780ca094f6ecdd2907f25ad578448d

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 11 Aug 2020 20:10:03 GMT
X-Proxy-Origin: 194.99.105.99; 194.99.105.99; 722.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.220.117:80
AN-X-Request-Uuid: a17c5b98-07f0-4f43-b6b2-8aabe03a9f0b
Server: nginx/1.13.4
P3P: policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://www.fireeye.com
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json; charset=utf-8
Content-Length: 11
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 206 notification.d46d7db1.mp3
widget.driftqa.com/conductor/assets/media/ 20 KB
21 KB 184ms
73ms Media
audio/mpeg 13.226.155.9
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://widget.driftqa.com/conductor/assets/media/notification.d46d7db1.mp3

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

13.226.155.9 Seattle, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-226-155-9.dus51.r.cloudfront.net

Software

nginx /

Resource Hash

ad80ac33ed04b4e6d78167b4162ecd3d2e8c29d17b43eb3df1f35b216b2ac5c5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html
Accept-Encoding: identity;q=1, *;q=0
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Range: bytes=0-

Response headers

date: Mon, 23 Mar 2020 19:32:41 GMT
via: 1.1 dc81a30f5f4fc309ae9445723779b894.cloudfront.net (CloudFront)
age: 12184642
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
status: 206
Content-Length: 20897
Content-Range: bytes 0-20896/20897
last-modified: Mon, 23 Mar 2020 13:44:35 GMT
server: nginx
etag: "d46d7db110874da77e094dcbc4bec8e6"
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-methods: GET, POST, OPTIONS
content-type: audio/mpeg
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: DUS51-C1
accept-ranges: bytes
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: mHVYTTQrB8tdk_-err7GZYvrAcvbHZnYSoAsCbPgKGcYnQ0Szw8IAg==

GET
H/1.1 200
OK img.gif
b.6sc.co/v1/beacon/ 43 B
774 B 372ms
258ms Image
image/gif 23.34.183.125
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=1322340356018696d853e0ac6f7ce3a2&svisitor=&visitor=17e1242f-b85f-452a-89f4-03a3c18f2085&session=fd3578ab-e876-4ffe-8b15-826b7491e710&event=a_pageload&q=%7B%7D&isIframe=false&m=%7B%22description%22%3A%22Malicious%20actors%20have%20been%20actively%20deploying%20MAZE%20ransomware%20since%20at%20least%20May%202019.%5Cn%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Navigating%20the%20MAZE%3A%20Tactics%2C%20Techniques%20and%20Procedures%20Associated%20With%5CnMAZE%20Ransomware%20Incidents%20%7C%20FireEye%20Inc%22%7D&cb=76603651&r=&thirdParty=%7B%7D&pageURL=https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

23.34.183.125 , Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-34-183-125.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Tue, 11 Aug 2020 20:10:03 GMT
X-Content-Type-Options: nosniff
Connection: keep-alive
Content-Length: 43
Pragma: no-cache
Last-Modified: Fri, 21 Feb 2020 18:51:25 GMT
Server: nginx/1.14.0 (Ubuntu)
ETag: "5e5026ad-2b"
Access-Control-Max-Age: 86400
Access-Control-Allow-Methods: GET,POST
Content-Type: image/gif
Access-Control-Allow-Origin
Cache-Control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
Access-Control-Allow-Credentials: true
Accept-Ranges: bytes
Access-Control-Allow-Headers: *
Expires: Wed, 19 Apr 2000 11:43:00 GMT

GET
H2 200 details Show response
epsilon.6sense.com/v1/company/ 573 B
561 B 172ms
59ms XHR
application/json 52.57.146.39
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://epsilon.6sense.com/v1/company/details
Requested by: Host: www.fireeye.com
URL: https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.57.146.39 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-57-146-39.eu-central-1.compute.amazonaws.com
Software: nginx/1.16.0 /
Resource Hash: 7de9e22f2deff27cf79bc33ff8f904358bca8b9ec5401c69c16c90b7bc2e291a

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html
Authorization: Token 325d6d60e24c7cfc3a782839d85ce08c8d3bb27c

Response headers

date: Tue, 11 Aug 2020 20:10:03 GMT
content-encoding: gzip
server: nginx/1.16.0
status: 200
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: https://www.fireeye.com
access-control-allow-credentials: true
content-length: 372

GET
H2 200 /
www.facebook.com/tr/ 44 B
100 B 6ms
6ms Image
image/gif 2a03:2880:f11c:8183:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=1847206522249226&ev=Microdata&dl=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2020%2F05%2Ftactics-techniques-procedures-associated-with-maze-ransomware-incidents.html&rl=&if=false&ts=1597176603865&cd[DataLayer]=%5B%5D&cd[Meta]=%7B%22title%22%3A%22Navigating%20the%20MAZE%3A%20Tactics%2C%20Techniques%20and%20Procedures%20Associated%20With%5CnMAZE%20Ransomware%20Incidents%20%7C%20FireEye%20Inc%22%2C%22meta%3Adescription%22%3A%22Malicious%20actors%20have%20been%20actively%20deploying%20MAZE%20ransomware%20since%20at%20least%20May%202019.%5Cn%22%7D&cd[OpenGraph]=%7B%22og%3Atitle%22%3A%22Navigating%20the%20MAZE%3A%20Tactics%2C%20Techniques%20and%20Procedures%20Associated%20With%5CnMAZE%20Ransomware%20Incidents%22%2C%22og%3Atype%22%3A%22website%22%2C%22og%3Aurl%22%3A%22https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2020%2F05%2Ftactics-techniques-procedures-associated-with-maze-ransomware-incidents.html%22%2C%22og%3Aimage%22%3A%22https%3A%2F%2Fwww.fireeye.com%2Fcontent%2Fdam%2Ffireeye-www%2Ffw%2Fimages%2Ffireeye-2-color-square.png%22%2C%22og%3Adescription%22%3A%22Malicious%20actors%20have%20been%20actively%20deploying%20MAZE%20ransomware%20since%20at%20least%20May%202019.%5Cn%22%2C%22og%3Asite_name%22%3A%22FireEye%22%7D&cd[Schema.org]=%5B%7B%22dimensions%22%3A%7B%22h%22%3A86%2C%22w%22%3A1600%7D%2C%22properties%22%3A%7B%7D%2C%22subscopes%22%3A%5B%5D%2C%22type%22%3A%22http%3A%2F%2Fschema.org%2FWebPage%22%7D%5D&cd[JSON-LD]=%5B%5D&sw=1600&sh=1200&v=2.9.23&r=stable&ec=1&o=30&fbp=fb.1.1597176603360.1680617334&it=1597176603165&coo=false&es=automatic&tm=3&rqm=GET

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f11c:8183:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 11 Aug 2020 20:10:03 GMT
last-modified: Fri, 21 Dec 2012 00:00:01 GMT
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
status: 200
cache-control: no-cache, must-revalidate, max-age=0
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 44
expires: Tue, 11 Aug 2020 20:10:03 GMT

GET
H/1.1

200
OK

associate-segment
segment.prod.bidr.io/
Redirect Chain

https://segment.prod.bidr.io/associate-segment?buzz_key=listenloop&segment_key=listenloop-11912&value=
https://segment.prod.bidr.io/associate-segment?buzz_key=listenloop&segment_key=listenloop-11912&value=&_bee_ppp=1

43 B
793 B

69ms
68ms

Image
image/gif

52.16.156.50
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://segment.prod.bidr.io/associate-segment?buzz_key=listenloop&segment_key=listenloop-11912&value=&_bee_ppp=1

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.16.156.50 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-16-156-50.eu-west-1.compute.amazonaws.com

Software

nginx /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
Date: Tue, 11 Aug 2020 20:10:04 GMT
Server: nginx
strict-transport-security: max-age=2592000; includeSubDomains
p3p: CP="This is not a P3P policy! See https://beeswax.com/privacy for more info."
cache-control: no-cache, must-revalidate
Connection: keep-alive
content-type: image/gif
Content-Length: 43
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://segment.prod.bidr.io/associate-segment?buzz_key=listenloop&segment_key=listenloop-11912&value=&_bee_ppp=1
Date: Tue, 11 Aug 2020 20:10:04 GMT
Server: nginx
Connection: keep-alive
Content-Length: 0
strict-transport-security: max-age=2592000; includeSubDomains

POST
H2 200 page_views Show response
jukebox.lookbookhq.com/api/public/v1/ 153 B
657 B 493ms
227ms XHR
application/json 52.45.104.28
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://jukebox.lookbookhq.com/api/public/v1/page_views

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.45.104.28 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-52-45-104-28.compute-1.amazonaws.com

Software

Resource Hash

726aad265062235b2d8390d501aa97d12666a4e066ba64801072924225128e81

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept: application/json
Referer: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: application/json

Response headers

x-runtime: 0.084324
date: Tue, 11 Aug 2020 20:10:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
status: 200
etag: W/"726aad265062235b2d8390d501aa97d1"
access-control-max-age: 1728000
access-control-allow-methods: GET, PUT, POST, PATCH, OPTIONS
content-type: application/json; charset=utf-8
access-control-allow-origin: https://www.fireeye.com
access-control-expose-headers
cache-control: max-age=0, private, must-revalidate
access-control-allow-credentials: true
vary: Origin, Accept-Encoding
x-request-id: 8fc225f9-e389-4815-b506-e2cb40b2de86

GET
DATA 200
OK truncated
/ 17 KB
17 KB Font
application/x-font-woff2

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: ac8511a575f9ff43c005f8be9f0fb7b81b8aebf2fd2e1df8df7809df4b77cc07

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
Origin: https://www.fireeye.com

Response headers

Content-Type: application/x-font-woff2

GET
DATA 200
OK truncated
/ 17 KB
17 KB Font
application/x-font-woff2

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 7d6fd646e0efeb5d1209c2d9008343cb061cc7d70408fbd108f683dbc4d17fa8

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
Origin: https://www.fireeye.com

Response headers

Content-Type: application/x-font-woff2

GET
DATA 200
OK truncated
/ 17 KB
17 KB Font
application/x-font-woff2

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 9b935949913b686e1e44928fb476ad5611303afc06e844ff620f59370d9c77bd

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
Origin: https://www.fireeye.com

Response headers

Content-Type: application/x-font-woff2

GET
DATA 200
OK truncated
/ 18 KB
18 KB Font
application/x-font-woff2

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 3091b6187cdf72d32615fd3df8c882e3cf6ca0f3e8b010d5f4f937ab2d619d94

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
Origin: https://www.fireeye.com

Response headers

Content-Type: application/x-font-woff2

GET
DATA 200
OK truncated
/ 4 KB
4 KB Font
application/x-font-woff2

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 5b701db4813b82b18ad7f0db593b1dcc5c435f7be396ef3a937f8ed1ec7b343d

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
Origin: https://www.fireeye.com

Response headers

Content-Type: application/x-font-woff2

GET
DATA 200
OK truncated
/ 4 KB
4 KB Font
application/x-font-woff2

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: aeb54739ad664ca0dde2785d1a4c64495b8d91e7eee6ab4d7788769655746f88

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
Origin: https://www.fireeye.com

Response headers

Content-Type: application/x-font-woff2

GET
DATA 200
OK truncated
/ 5 KB
5 KB Font
application/x-font-woff2

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 325788f630aa3ff90d75e60d764ebba3adf2d304671b57e327fe3801bbdad9de

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
Origin: https://www.fireeye.com

Response headers

Content-Type: application/x-font-woff2

GET
DATA 200
OK truncated
/ 5 KB
5 KB Font
application/x-font-woff2

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 0e28cd255cac05ac63cb7b021b9436cbf1bd24b34218edefc7b9675bbcb6dec7

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
Origin: https://www.fireeye.com

Response headers

Content-Type: application/x-font-woff2

GET
H2 200 getForm Show response
www2.fireeye.com/index.php/form/ 8 KB
2 KB 81ms
81ms Script
application/javascript 104.17.70.206
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www2.fireeye.com/index.php/form/getForm?munchkinId=848-DID-242&form=3353&url=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2020%2F05%2Ftactics-techniques-procedures-associated-with-maze-ransomware-incidents.html&callback=jQuery1124017563536493232457_1597176604639&_=1597176604640
Requested by: Host: www2.fireeye.com
URL: https://www2.fireeye.com/js/forms2/js/forms2.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 104.17.70.206 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ecf5adf2b57718d5744ffb522e9a754b934a4fae7e22daf75684d5e956b2b2a8

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 11 Aug 2020 20:10:04 GMT
content-encoding: gzip
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
status: 200
cf-request-id: 0480be00020000bdfa5ebda200000001
cf-ray: 5c1499133ef9bdfa-AMS
cached: true

GET
H2 200 moatframe.js Show response
z.moatads.com/addthismoatframe568911941483/ 2 KB
1 KB 141ms
49ms Script
application/x-javascript 23.210.250.213
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://z.moatads.com/addthismoatframe568911941483/moatframe.js
Requested by: Host: s7.addthis.com
URL: https://s7.addthis.com/js/300/addthis_widget.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.210.250.213 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-210-250-213.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: 05090f9390f5bc0cd23fe5f432037cc92d7cbce1ced9bfe8faf3d1c9abae85cd

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 11 Aug 2020 20:10:04 GMT
content-encoding: gzip
last-modified: Fri, 08 Nov 2019 20:13:52 GMT
server: AmazonS3
x-amz-request-id: D5503D14AA2F06AA
etag: "f14b4e1f799b14f798a195f43cf58376"
vary: Accept-Encoding
content-type: application/x-javascript
status: 200
cache-control: max-age=28977
accept-ranges: bytes
content-length: 948
x-amz-id-2: JgalEtxvSAtZmM7+naGfrhsdf0JFS0gJW8lypWF8Tp90EkcPp4c3eAnpK+RDOIL1ltWgpx8wc3s=

GET
H2 200 me Show response
js.maxmind.com/geoip/v2.1/country/ 771 B
978 B 30ms
29ms XHR
application/vnd.maxmind.com-country+json 2606:4700::6810:252f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js.maxmind.com/geoip/v2.1/country/me?referrer=https%3A%2F%2Fwww.fireeye.com
Requested by: Host: www.fireeye.com
URL: https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6810:252f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9b3eac129339ae021c89398f35c952bddc1185d8f002c834a5a0c2a3901bdf4b

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 11 Aug 2020 20:10:04 GMT
cf-cache-status: DYNAMIC
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
status: 200
content-type: application/vnd.maxmind.com-country+json; charset=UTF-8; version=2.1
access-control-allow-origin: *
cf-ray: 5c1499140a2605d8-FRA
content-length: 771
cf-request-id: 0480be0081000005d81c1b2200000001

GET
H2 200 segmentation.segment.js Show response
www.fireeye.com/etc/ 0
157 B 37ms
36ms XHR
application/x-javascript 2606:4700:300b::a29f:f77d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.fireeye.com/etc/segmentation.segment.js

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:300b::a29f:f77d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff, nosniff
X-Frame-Options	ALLOW-FROM https://content.fireeye.com
X-Xss-Protection	1; mode=block

Request headers

Accept: text/javascript, application/javascript, application/ecmascript, application/x-ecmascript, */*; q=0.01
Referer: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-dispatcher: dispatcher2uswest1
date: Tue, 11 Aug 2020 20:10:04 GMT
x-content-type-options: nosniff, nosniff
cf-cache-status: HIT
age: 42224
x-vhost: publish
status: 200
vary: User-Agent, Accept-Encoding
content-length: 0
cf-request-id: 0480be008600006347998bd200000001
cf-bgj: minify
server: cloudflare
x-frame-options: ALLOW-FROM https://content.fireeye.com
etag: "d41d8cd98f00b204e9800998ecf8427e"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/x-javascript
x-xss-protection: 1; mode=block
content-security-policy: worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
accept-ranges: bytes
cf-ray: 5c1499140bd96347-FRA

GET
H2 403 stores.init.js Show response
www.fireeye.com/etc/clientcontext/default/content/jcr:content/ 3 KB
1 KB 12ms
12ms XHR
text/html 2606:4700:300b::a29f:f77d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.fireeye.com/etc/clientcontext/default/content/jcr:content/stores.init.js?path=%2Fcontent%2Ffireeye-www%2Fen_US%2Fblog%2Fthreat-research%2F2020%2F05%2Ftactics-techniques-procedures-associated-with-maze-ransomware-incidents&_=1597176602967

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:300b::a29f:f77d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

21a644398492917aabd43a3e31a6cab2ec27b3423a08fe4674b9a7a91a01c90d

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Accept: text/javascript, application/javascript, application/ecmascript, application/x-ecmascript, */*; q=0.01
Referer: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 11 Aug 2020 20:10:04 GMT
content-encoding: gzip
server: cloudflare
x-frame-options: SAMEORIGIN
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/html; charset=UTF-8
status: 403
cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
cf-ray: 5c1499140be16347-FRA
cf-request-id: 0480be008800006347998be200000001
expires: Thu, 01 Jan 1970 00:00:01 GMT

GET
H/1.1 200
OK munchkin.js Show response
munchkin.marketo.net/159/ 11 KB
5 KB 47ms
47ms Script
application/x-javascript 104.109.95.62
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://munchkin.marketo.net/159/munchkin.js
Requested by: Host: munchkin.marketo.net
URL: https://munchkin.marketo.net/munchkin.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.109.95.62 , Netherlands, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS: a104-109-95-62.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 459e23d23ffe65a86f3a1f67c07edc92e0c69461ff83fbd63764d7b36cac92fc

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Tue, 11 Aug 2020 20:10:04 GMT
Content-Encoding: gzip
Last-Modified: Fri, 08 May 2020 02:24:14 GMT
Server: AkamaiNetStorage
ETag: "79274ffc293e4f76fc372b953f780d16:1588904654.430334"
Vary: Accept-Encoding
P3P: policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR"
Cache-Control: max-age=8640000
Connection: keep-alive
Accept-Ranges: bytes
Content-Type: application/x-javascript
Content-Length: 4810
Expires: Thu, 19 Nov 2020 20:10:04 GMT

GET
H2 200 read-blogentries Show response
www.fireeye.com/bin/www-blogs/ 96 KB
17 KB 1113ms
1113ms XHR
text/plain 2606:4700:300b::a29f:f77d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.fireeye.com/bin/www-blogs/read-blogentries?categoryPath=%2Fcontent%2Ffireeye-www%2Fen_US%2Fblog%2Fthreat-research

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:300b::a29f:f77d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

af3f4261750c979105a75d6ac17c96475d2050e192f16171d1a304fa480de013

Security Headers

Name	Value
Content-Security-Policy	worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff, nosniff
X-Frame-Options	ALLOW-FROM https://content.fireeye.com
X-Xss-Protection	1; mode=block

Request headers

Accept: application/json, text/javascript, */*; q=0.01
Referer: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-dispatcher: dispatcher1uswest1
date: Tue, 11 Aug 2020 20:10:05 GMT
content-encoding: gzip
x-content-type-options: nosniff, nosniff
cf-cache-status: DYNAMIC
x-vhost: publish
status: 200
vary: Accept-Encoding,User-Agent
content-length: 17196
x-xss-protection: 1; mode=block
server: cloudflare
x-frame-options: ALLOW-FROM https://content.fireeye.com
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains
content-security-policy: worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
cf-request-id: 0480be008c00006347998bf200000001
cf-ray: 5c1499141be96347-FRA

GET sh.f48a1a04fe8dbf021b4cda1d.html
s7.addthis.com/static/ Frame 25ED 0
0

GET
H2 200 adsct Show response
analytics.twitter.com/i/ 31 B
280 B 167ms
166ms Script
application/javascript 104.244.42.3
TWITTER

General

Check archive.org

Show headers Download Go to

Full URL

https://analytics.twitter.com/i/adsct?type=javascript&version=1.1.0&p_id=Twitter&p_user_id=0&txn_id=nw2v7&events=%5B%5B%22pageview%22%2Cnull%5D%5D&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=0&tpx_cb=twttr.conversion.loadPixels&tw_document_href=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2020%2F05%2Ftactics-techniques-procedures-associated-with-maze-ransomware-incidents.html

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

104.244.42.3 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

df3e003cc30e9bdd0313100e8ee5d468070b4b34d11ad355f276a356d4b9c7bf

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 11 Aug 2020 20:10:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
status: 200, 200 OK
x-twitter-response-tags: BouncerCompliant
strict-transport-security: max-age=631138519
content-length: 57
x-xss-protection: 0
x-response-time: 121
pragma: no-cache
last-modified: Tue, 11 Aug 2020 20:10:06 GMT
server: tsa_o
x-frame-options: SAMEORIGIN
content-type: application/javascript;charset=utf-8
cache-control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash: 64b741db2cde36edd0b58f22cb93483d
x-transaction: 00fd6dc800bb74fa
expires: Tue, 31 Mar 1981 05:00:00 GMT

GET MultiNoun.jsonp
d.la2c2.salesforceliveagent.com/chat/rest/System/ 0
0

GET
H2 200 _ate.track.config_resp Show response
v1.addthisedge.com/live/boost/fewebadmin/ 3 KB
958 B 106ms
105ms Script
application/javascript 23.210.248.44
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://v1.addthisedge.com/live/boost/fewebadmin/_ate.track.config_resp
Requested by: Host: s7.addthis.com
URL: https://s7.addthis.com/js/300/addthis_widget.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.210.248.44 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-210-248-44.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 4e040b6884ad0623aece79feb28b75ee490c568a930c6bbfd83255d058d54611

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 11 Aug 2020 20:10:06 GMT
content-encoding: gzip
etag: 2015823830--gzip
vary: Accept-Encoding
content-type: application/javascript;charset=utf-8
status: 200
cache-control: public, max-age=38, s-maxage=86400
content-disposition: attachment; filename=1.txt
content-length: 782

GET
H2 200 300lo.json Show response
m.addthis.com/live/red_lojson/ 89 B
249 B 212ms
211ms Script
application/javascript 23.210.248.44
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://m.addthis.com/live/red_lojson/300lo.json?si=5f32fb1c8459f051&bkl=0&bl=1&pdt=69&sid=5f32fb1c8459f051&pub=fewebadmin&rev=v8.28.7-wp&ln=en&pc=men&cb=0&ab=-&dp=www.fireeye.com&fp=blog%2Fthreat-research%2F2020%2F05%2Ftactics-techniques-procedures-associated-with-maze-ransomware-incidents.html&fr=&of=0&pd=0&irt=0&vcl=0&md=0&ct=0&tct=0&abt=0&cdn=0&pi=1&rb=0&gen=100&chr=UTF-8&colc=1597176605948&jsl=8193&uvs=5f32fb1c2dc5aa5d000&skipb=1&callback=addthis.cbs.jsonp__55323728897339850
Requested by: Host: s7.addthis.com
URL: https://s7.addthis.com/js/300/addthis_widget.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.210.248.44 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-210-248-44.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: d2a075d80c094ba99ceb624341fa47d86daec08696a69e85cbf6e0bc8f4c31a7

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status: 200
pragma: no-cache
date: Tue, 11 Aug 2020 20:10:06 GMT
cache-control: max-age=0, no-cache, no-store, no-transform
content-disposition: attachment; filename=1.txt
content-length: 89
content-type: application/javascript;charset=utf-8

GET
H2 200 sh.f48a1a04fe8dbf021b4cda1d.html
s7.addthis.com/static/ Frame 186C 0
0 59ms
59ms Document
text/html 23.210.248.44
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://s7.addthis.com/static/sh.f48a1a04fe8dbf021b4cda1d.html

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.210.248.44 , Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-210-248-44.deploy.static.akamaitechnologies.com

Software

nginx/1.15.8 /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains

Request headers

:method: GET
:authority: s7.addthis.com
:scheme: https
:path: /static/sh.f48a1a04fe8dbf021b4cda1d.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html

Response headers

status: 200
server: nginx/1.15.8
content-type: text/html
last-modified: Mon, 09 Sep 2019 15:34:57 GMT
etag: W/"5d767121-1115f"
timing-allow-origin: *
cache-control: public, max-age=86313600
p3p: CP="NON ADM OUR DEV IND COM STA"
strict-transport-security: max-age=15724800; includeSubDomains
content-encoding: gzip
content-length: 25412
date: Tue, 11 Aug 2020 20:10:05 GMT
vary: Accept-Encoding
x-host: s7.addthis.com

POST
H2 204 create_event Show response
jukebox.lookbookhq.com/api/public/v1/page_views/ 0
378 B 154ms
154ms XHR
text/plain 52.45.104.28
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://jukebox.lookbookhq.com/api/public/v1/page_views/create_event

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.45.104.28 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-52-45-104-28.compute-1.amazonaws.com

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept: application/json
Referer: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: application/json

Response headers

x-runtime: 0.018091
date: Tue, 11 Aug 2020 20:10:06 GMT
x-content-type-options: nosniff
status: 204
access-control-max-age: 1728000
access-control-allow-methods: GET, PUT, POST, PATCH, OPTIONS
access-control-allow-origin: https://www.fireeye.com
access-control-expose-headers
cache-control: no-cache
access-control-allow-credentials: true
vary: Origin
x-request-id: c14f184f-ec27-481d-a01c-3c3343b0e5dc

GET
H2 200 conversion.js Show response
s.yimg.jp/images/listing/tool/cv/ 4 KB
2 KB 885ms
294ms Script
application/javascript 183.79.248.252
YAHOO-JP-AS-AP Ya...

General

Check archive.org

Show headers Download Go to

Full URL: https://s.yimg.jp/images/listing/tool/cv/conversion.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MVGC8KK
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 183.79.248.252 , Japan, ASN24572 (YAHOO-JP-AS-AP Yahoo Japan, JP),
Reverse DNS
Software: ATS /
Resource Hash: e55596fc1c3349cbbc926529c29c27e1de7b98b47a31cc7bb4789970e571065f

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

ats-carp-promotion: 1
date: Tue, 11 Aug 2020 20:01:43 GMT
content-encoding: gzip
last-modified: Thu, 29 Aug 2019 10:27:08 GMT
server: ATS
age: 503
vary: Accept-Encoding
p3p: policyref="http://privacy.yahoo.co.jp/w3c/p3p_jp.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE GOV"
status: 200
cache-control: public, max-age=600
accept-ranges: bytes
content-type: application/javascript
content-length: 1421
via: http/1.1 edge2144.img.djm.yahoo.co.jp (ApacheTrafficServer [cRs f ]), http/1.1 edge2167.img.djm.yahoo.co.jp (ApacheTrafficServer [cRs f ]), http/1.1 edge2134.img.djm.yahoo.co.jp (ApacheTrafficServer [cRs f ])
expires: Tue, 11 Aug 2020 20:11:43 GMT

POST page_views
abm2.listenloop.com/api/v1/public/ 0
0

GET
H2 200 forms2.css
www2.fireeye.com/js/forms2/css/ 13 KB
3 KB 54ms
53ms Stylesheet
text/css 104.17.70.206
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www2.fireeye.com/js/forms2/css/forms2.css

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

104.17.70.206 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

256e42104f48a5fa80b031da12dc56acde224fba3f9810f8f8192b39136d365a

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 11 Aug 2020 20:10:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
age: 758
status: 200
content-length: 2623
cf-request-id: 0480be058e0000bdfa5e822200000001
last-modified: Wed, 22 Jul 2020 19:04:14 GMT
server: cloudflare
etag: "4c17e7-3437-5ab0c67dc4780"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/css
cache-control: public, max-age=14400
accept-ranges: bytes
cf-ray: 5c14991c1dd6bdfa-AMS
expires: Wed, 12 Aug 2020 00:10:06 GMT

GET
H2 200 forms2-theme-simple.css
www2.fireeye.com/js/forms2/css/ 826 B
721 B 52ms
52ms Stylesheet
text/css 104.17.70.206
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www2.fireeye.com/js/forms2/css/forms2-theme-simple.css

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

104.17.70.206 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

14c8c62dc692fd8faa04434e3fed25e7c23d596b732f9db88f6e9f9ff5dfa61c

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 11 Aug 2020 20:10:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
age: 758
status: 200
content-length: 242
cf-request-id: 0480be058e0000bdfa5e823200000001
last-modified: Wed, 22 Jul 2020 19:04:14 GMT
server: cloudflare
etag: "4c17ed-33a-5ab0c67dc4780"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/css
cache-control: public, max-age=14400
accept-ranges: bytes
cf-ray: 5c14991c1dd8bdfa-AMS
expires: Wed, 12 Aug 2020 00:10:06 GMT

GET
H/1.1 200
OK visitWebPage Show response
848-did-242.mktoresp.com/webevents/ 2 B
311 B 778ms
196ms XHR
text/plain 192.28.147.68
MARKETO

General

Check archive.org

Show headers Download Go to

Full URL: https://848-did-242.mktoresp.com/webevents/visitWebPage?_mchNc=1597176606081&_mchCn=&_mchId=848-DID-242&_mchTk=_mch-fireeye.com-1597176606080-32357&_mchHo=www.fireeye.com&_mchPo=&_mchRu=%2Fblog%2Fthreat-research%2F2020%2F05%2Ftactics-techniques-procedures-associated-with-maze-ransomware-incidents.html&_mchPc=https%3A&_mchVr=159&_mchEcid=&_mchHa=&_mchRe=&_mchQp=
Requested by: Host: www.fireeye.com
URL: https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 192.28.147.68 , United States, ASN53580 (MARKETO, US),
Reverse DNS
Software: nginx /
Resource Hash: 565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Tue, 11 Aug 2020 20:10:06 GMT
Content-Encoding: gzip
Server: nginx
Transfer-Encoding: chunked
Content-Type: text/plain; charset=UTF-8
Access-Control-Allow-Origin: *
Connection: keep-alive
X-Request-Id: ed00389a-92d6-40ac-9acb-c1554ee0eaf0

GET
H2 200 layers.33f5b85045a5f2308467.js Show response
s7.addthis.com/static/ 263 KB
76 KB 51ms
51ms Script
application/javascript 23.210.248.44
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://s7.addthis.com/static/layers.33f5b85045a5f2308467.js

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.210.248.44 , Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-210-248-44.deploy.static.akamaitechnologies.com

Software

nginx/1.15.8 /

Resource Hash

137e41c449677deb7c8da3afde63fc781b095bb028f78b789be44192e8e3f4be

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=15724800; includeSubDomains
content-encoding: gzip
last-modified: Thu, 04 Jun 2020 15:49:19 GMT
server: nginx/1.15.8
etag: W/"5ed917ff-41b9f"
vary: Accept-Encoding
content-type: application/javascript
status: 200
cache-control: public, max-age=86313600
date: Tue, 11 Aug 2020 20:10:06 GMT
x-host: s7.addthis.com
timing-allow-origin: *
content-length: 77540

GET
H2

200

ga-audiences
www.google.de/ads/
Redirect Chain

https://www.google-analytics.com/r/collect?v=1&_v=j83&a=186233434&t=event&ni=0&_s=1&dl=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2020%2F05%2Ftactics-techniques-procedures-associated-...
https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-363943-1&cid=1259957762.1597176603&jid=448307362&_gid=1976774407.1597176606&gjid=179698387&_v=j83&z=447183283
https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-363943-1&cid=1259957762.1597176603&jid=448307362&_v=j83&z=447183283
https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-363943-1&cid=1259957762.1597176603&jid=448307362&_v=j83&z=447183283&slf_rd=1&random=2887154891

42 B
106 B

18ms
18ms

Image
image/gif

2a00:1450:4001:800::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-363943-1&cid=1259957762.1597176603&jid=448307362&_v=j83&z=447183283&slf_rd=1&random=2887154891

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 11 Aug 2020 20:10:06 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 11 Aug 2020 20:10:06 GMT
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 302
content-type: text/html; charset=UTF-8
location: https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-363943-1&cid=1259957762.1597176603&jid=448307362&_v=j83&z=447183283&slf_rd=1&random=2887154891
cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 XDFrame Show response
www2.fireeye.com/index.php/form/ Frame 5B19 2 KB
887 B 216ms
215ms Document
text/html 104.17.70.206
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www2.fireeye.com/index.php/form/XDFrame

Requested by

Host: www2.fireeye.com
URL: https://www2.fireeye.com/js/forms2/js/forms2.min.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

104.17.70.206 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

4ecd284b8811543e88f4c470ba7b3fe3f4b7a458c512bb92ab41d2b491aee6ca

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

:method: GET
:authority: www2.fireeye.com
:scheme: https
:path: /index.php/form/XDFrame
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: vid=6010f6fa-3e06-4043-9efb-40fbc0aa1ef0; _mkto_trk=id:848-DID-242&token:_mch-fireeye.com-1597176606080-32357; __cfduid=d927b53db3e2c240529beb8450bbaf7a41597176606; __cf_bm=925fdf54b9da0c77fe511d47472d1f0e39bd1857-1597176606-1800-AZm+ygkaA+AAnCnjJWHlPD9bK1bCXNf4XTXNwutPualMuLqIKk8MFnYGNagukS277i10yD0qYmysXrB8DP4JWNs=; _ga=GA1.2.1259957762.1597176603; _gid=GA1.2.1976774407.1597176606; _gat_UA-363943-1=1
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html

Response headers

status: 200
date: Tue, 11 Aug 2020 20:10:06 GMT
content-type: text/html; charset=utf-8
cache-control: max-age=3600
x-content-type-options: nosniff
vary: Accept-Encoding
set-cookie: BIGipServersjiweb-nginx-app_https=!TIO09L8aXnAJu8DInuzRy4alk/3R/laEbjjYuMQAc47NLImuPRNxQkiPLsRrQqwpMwSPadLs7ypSbOc=;Path=/;Version=1;Secure;Httponly
cf-cache-status: DYNAMIC
cf-request-id: 0480be060f0000bdfa5e828200000001
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server: cloudflare
cf-ray: 5c14991cee69bdfa-AMS
content-encoding: gzip

GET
H2 200 forms2.min.js Show response
www2.fireeye.com/js/forms2/js/ Frame 5B19 205 KB
68 KB 50ms
50ms Script
application/x-javascript 104.17.70.206
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www2.fireeye.com/js/forms2/js/forms2.min.js

Requested by

Host: www2.fireeye.com
URL: https://www2.fireeye.com/index.php/form/XDFrame

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

104.17.70.206 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f24c51a94a931f1bdd7c3dacc9ebb3848305f5eb5a3feddf0b01227f6c778c17

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www2.fireeye.com/index.php/form/XDFrame
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 11 Aug 2020 20:10:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
age: 2808
status: 200
cf-request-id: 0480be06ea0000bdfa5e834200000001
last-modified: Wed, 22 Jul 2020 19:04:14 GMT
server: cloudflare
etag: "4c236b-33237-5ab0c67dc4780"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: public, max-age=14400
cf-ray: 5c14991e4f34bdfa-AMS
expires: Wed, 12 Aug 2020 00:10:06 GMT

GET /
b91.yahoo.co.jp/pagead/conversion/1000244663/ 0
0

GET
H2 200 ytc.js Show response
s.yimg.com/wi/ 15 KB
6 KB 55ms
17ms Script
application/javascript 2a00:1288:f03d:1fa::4000
YAHOO-1

General

Check archive.org

Show headers Download Go to

Full URL

https://s.yimg.com/wi/ytc.js

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1288:f03d:1fa::4000 , United Kingdom, ASN10310 (YAHOO-1, US),

Reverse DNS

Software

ATS /

Resource Hash

88cf2c9a4c4bcef2aa64fb6ea0f337f78e9a7dc61d87993441369fa5cb429d32

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

ats-carp-promotion: 1
date: Tue, 11 Aug 2020 19:45:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1456
x-amz-server-side-encryption: AES256
status: 200
vary: Origin, Accept-Encoding
content-length: 5573
x-amz-id-2: ALRFN140Wv7mZ2q+OK8ilvX9/P8LdjagEDdTuv8ytAtheElmMF+p29IxcuOJBiKtxgWJGjLqU4U=
referrer-policy: no-referrer-when-downgrade
x-amz-expiration: expiry-date="Thu, 16 Sep 2021 00:00:00 GMT", rule-id="oath-standard-lifecycle"
last-modified: Tue, 11 Aug 2020 09:21:22 GMT
server: ATS
etag: "4af30fdfb3f25202fae672877237b12e-df"
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security: max-age=15552000
x-amz-request-id: D6D48E78A31C9C6B
x-xss-protection: 1; mode=block
cache-control: public,max-age=3600
x-amz-version-id: v0T4VwTcSKojm0k.rRPUA2jezlg4p0ZC
accept-ranges: bytes
content-type: application/javascript

GET
H2 200 json Show response
fireeye.tt.omtrdc.net/m2/fireeye/mbox/ 6 KB
1014 B 190ms
68ms XHR
application/json 52.18.209.245
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://fireeye.tt.omtrdc.net/m2/fireeye/mbox/json?mbox=target-global-mbox&mboxSession=71d1015a42ec4d008008460aaf9b3cb3&mboxPC=&mboxPage=baa3db67fc5a475a8f0b10d3ef76b32f&mboxRid=0fcf81ed15f0407e8d88b79e093fdb09&mboxVersion=1.7.1&mboxCount=1&mboxTime=1597183806896&mboxHost=www.fireeye.com&mboxURL=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2020%2F05%2Ftactics-techniques-procedures-associated-with-maze-ransomware-incidents.html&mboxReferrer=&browserHeight=1200&browserWidth=1600&browserTimeOffset=120&screenHeight=1200&screenWidth=1600&colorDepth=24&devicePixelRatio=1&screenOrientation=landscape&companyRevenueRange=%245B%2B&companyCountry=Poland&companyIndustry=Transportation%20and%20Logistics&companyName=American%20Airlines&companyRegion=Eastern%20Europe&companyDomain=aa.com&segments=%5B%22FY2020%20Security%20Effectiveness%20Intent%22%5D
Requested by: Host: www.fireeye.com
URL: https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.18.209.245 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-18-209-245.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: a4d527e2552c0ee4893094ec2d7125f41fbaa9771bc0a399cd1e479684b76271

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 11 Aug 2020 20:10:07 GMT
content-encoding: gzip
status: 200
vary: Origin,Accept-Encoding
content-type: application/json;charset=UTF-8
access-control-allow-origin: https://www.fireeye.com
cache-control: no-cache
access-control-allow-credentials: true
timing-allow-origin: *
x-request-id: 0fcf81ed15f0407e8d88b79e093fdb09

GET 435600.json
s.yimg.com/wi/config/ 0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: s7.addthis.com
URL: https://s7.addthis.com/static/sh.f48a1a04fe8dbf021b4cda1d.html

Domain: d.la2c2.salesforceliveagent.com
URL: https://d.la2c2.salesforceliveagent.com/chat/rest/System/MultiNoun.jsonp?nouns=VisitorId,Settings&VisitorId.prefix=Visitor&Settings.prefix=Visitor&Settings.buttonIds=[573a00000008kP3]&Settings.updateBreadcrumb=1&Settings.urlPrefix=undefined&callback=liveagent._.handlePing&deployment_id=572a0000000H8aJ&org_id=00D3000000063LS&version=34

Domain: abm2.listenloop.com
URL: https://abm2.listenloop.com/api/v1/public/page_views

Domain: b91.yahoo.co.jp
URL: https://b91.yahoo.co.jp/pagead/conversion/1000244663/?random=1597176606873&cv=9&fst=1597176606873&num=1&fmt=3&value=0&label=ppcGCKvb3mcQ_c2swgM&guid=ON&disvt=true&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&sendb=1&ig=1&frm=0&url=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2020%2F05%2Ftactics-techniques-procedures-associated-with-maze-ransomware-incidents.html&tiba=Navigating%20the%20MAZE%3A%20Tactics%2C%20Techniques%20and%20Procedures%20Associated%20With%20MAZE%20Ransomware%20Incidents%20%7C%20FireEye%20Inc&hn=www.googleadservices.com&async=1

Domain: s.yimg.com
URL: https://s.yimg.com/wi/config/435600.json

Verdicts & Comments Add Verdict or Comment

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

4 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
console-api	debug	URL: https://v2.listenloop.com/loop.bundle.js(Line 4) Message: [bugsnag] Loaded!
console-api	log	URL: https://v2.listenloop.com/loop.bundle.js(Line 4) Message: currentPagePath :: /blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents
console-api	log	URL: https://v2.listenloop.com/loop.bundle.js(Line 4) Message: [object Object]
console-api	log	URL: https://v2.listenloop.com/loop.bundle.js(Line 4) Message: [object Object]

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff nosniff
X-Frame-Options	ALLOW-FROM https://content.fireeye.com
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

8443343.fls.doubleclick.net
848-did-242.mktoresp.com
abm2.listenloop.com
analytics.twitter.com
app.cdn.lookbookhq.com
attr.ml-api.io
b.6sc.co
b91.yahoo.co.jp
bat.bing.com
c.6sc.co
c.la2c2.salesforceliveagent.com
cdn.pathfactory.com
cloud.typography.com
connect.facebook.net
d.la2c2.salesforceliveagent.com
epsilon.6sense.com
fireeye.tt.omtrdc.net
fonts.googleapis.com
googleads.g.doubleclick.net
j.6sc.co
js.driftt.com
js.maxmind.com
jukebox.lookbookhq.com
jukebox.pathfactory.com
lftracker.leadfeeder.com
m.addthis.com
maxcdn.bootstrapcdn.com
munchkin.marketo.net
px.ads.linkedin.com
s.ml-attr.com
s.yimg.com
s.yimg.jp
s7.addthis.com
secure.adnxs.com
segment.prod.bidr.io
snap.licdn.com
static.ads-twitter.com
stats.g.doubleclick.net
t.co
tr.lfeeder.com
v1.addthisedge.com
v2.listenloop.com
widget.driftqa.com
www.facebook.com
www.fireeye.com
www.google-analytics.com
www.google.com
www.google.de
www.googleadservices.com
www.googletagmanager.com
www.linkedin.com
www2.fireeye.com
z.moatads.com
abm2.listenloop.com
b91.yahoo.co.jp
d.la2c2.salesforceliveagent.com
s.yimg.com
s7.addthis.com
104.109.95.62
104.17.70.206
104.244.42.197
104.244.42.3
13.108.249.135
13.226.155.119
13.226.155.25
13.226.155.5
13.226.155.74
13.226.155.81
13.226.155.9
151.101.12.157
172.217.23.134
172.217.23.98
183.79.248.252
185.33.220.243
192.28.147.68
2001:4de0:ac19::1:b:3a
23.210.248.44
23.210.250.213
23.34.183.125
2600:9000:2182:6600:1a:2af:6d00:93a1
2606:4700:300b::a29f:f77d
2606:4700:3032::681b:9c96
2606:4700::6810:252f
2620:1ec:21::14
2620:1ec:c11::200
2a00:1288:f03d:1fa::4000
2a00:1450:4001:800::2003
2a00:1450:4001:800::2004
2a00:1450:4001:806::2002
2a00:1450:4001:814::200e
2a00:1450:4001:821::2008
2a00:1450:4001:825::200a
2a00:1450:400c:c00::9b
2a02:26f0:10c:382::25ea
2a03:2880:f01c:8012:face:b00c:0:3
2a03:2880:f11c:8183:face:b00c:0:25de
2a05:f500:11:101::b93f:9005
52.16.156.50
52.18.209.245
52.45.104.28
52.57.146.39
54.81.89.51
68.67.153.60
95.100.99.145
05090f9390f5bc0cd23fe5f432037cc92d7cbce1ced9bfe8faf3d1c9abae85cd
0590bf440f1352fb0ef85c8f6c4c50ccfa58715f148ba274078f5a574d54450d
0e28cd255cac05ac63cb7b021b9436cbf1bd24b34218edefc7b9675bbcb6dec7
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
137e41c449677deb7c8da3afde63fc781b095bb028f78b789be44192e8e3f4be
14c8c62dc692fd8faa04434e3fed25e7c23d596b732f9db88f6e9f9ff5dfa61c
1755acef8199c66af06c7e1d318bb90542a3053412575d978dcb6dafad7cd98b
1c7c6cbe8b5beb7e138cfcc8f6301d21b35437e5559be7afd0afe3f536d5fc02
1cddcd88d3332d560856627ab2cecc7d9aa6c9d616729701ae13902d1671d0b0
1de5a2b057fc1fd85e8b3ccffa91101c8304a88b32fccb33e19d7657a1460dae
21a644398492917aabd43a3e31a6cab2ec27b3423a08fe4674b9a7a91a01c90d
256e42104f48a5fa80b031da12dc56acde224fba3f9810f8f8192b39136d365a
2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8
2ad5294b998a0ca14aeb5f130286eef4f45d646b3467c68643fd8727a1b392e3
3091b6187cdf72d32615fd3df8c882e3cf6ca0f3e8b010d5f4f937ab2d619d94
31b45c462302ac175bfa43f9e5591491db780ca094f6ecdd2907f25ad578448d
325788f630aa3ff90d75e60d764ebba3adf2d304671b57e327fe3801bbdad9de
355604a949ef95ceffcd21a7e9b5ed27c95d847f95127e0ddad5aa1793f1bb74
399015e782f7252a2433dc591526bd0fa9fcb4e74544f521aaad257b8a2b1311
3aadac47cf44df595934bec631a78bf2ba62081ab95528e684a85b4c74453e77
3b5bda8d765f3931c7f90e3055dae350212c7ec063456b9c9f637ca19154f749
4086c8cd4c3361452c1c1da9af3034fc90f4a375c4f6195f31d6dcf1c7b56f00
41dd5e421fe221a7d2921d6fa2b36e8b01a9f2c054aaef5fad866fe896c1d1e0
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
459e23d23ffe65a86f3a1f67c07edc92e0c69461ff83fbd63764d7b36cac92fc
4e040b6884ad0623aece79feb28b75ee490c568a930c6bbfd83255d058d54611
4ecd284b8811543e88f4c470ba7b3fe3f4b7a458c512bb92ab41d2b491aee6ca
5062a8070951a1c77103a1bb6d96a11f185c50e4ee7b317320a8588243f6d828
50cf303cfaa020fcbedd6ad1bf045a008cbb88dfc792f731f07235dd1ca13599
549fbc39b71cd05d2b8cfb88341249b1fa0220d5c97321c95e68039a6534653c
553a661ebca404c9efff0b67e7c71f3dfd78a53d0c8fb6a498c914d7910772af
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3
56bf97572cc7de5a19131a062e5e0e64ffa38dc71e87cdfa7c0e481e15f2d628
5773bc4e147bd50beb3836c301dc2468218a94d6cf6a628bf2584dc7cf334790
5b701db4813b82b18ad7f0db593b1dcc5c435f7be396ef3a937f8ed1ec7b343d
5c622f5433cbb6ea1df5c0dd8671e55ef7d1464366074730473c453de50a579b
5cc2628039ee08964a5f46fb8abb1d5e1ec87e1200d12862ef1232bbfed7da55
6040c7be8f33e31fe2fc48e6ce0d5acb94d92f81432ad8b0b7075ddceb5ca47d
726aad265062235b2d8390d501aa97d12666a4e066ba64801072924225128e81
757eb886edd9a887fc95b701c88b08191eb743657027636c0c9d4973547ebb4a
771f01c80b031bd10d587c781474cc0f896b4d08a20356fdef47b0eb2e586b6d
799cb15a25ed2fa78bdba496d1afbc68f033a3a5dd9ead12f4eaac4e0a93236d
79b2448738716f0daf11d4a206e105e3b79e9d082f9c9bf4ad2bd55e591a1a3c
7d6fd646e0efeb5d1209c2d9008343cb061cc7d70408fbd108f683dbc4d17fa8
7de9e22f2deff27cf79bc33ff8f904358bca8b9ec5401c69c16c90b7bc2e291a
8247f4332667950989fe6bf790f87723343db2ec83d975503e9c5dc13a6eb5dc
84a91ff2a1a995e3816750f53342b4499bfefc817a8ee1a5d4b401433692d510
88cf2c9a4c4bcef2aa64fb6ea0f337f78e9a7dc61d87993441369fa5cb429d32
893df2b9ceb653f94333139d561d363bf4c365e651a0a3ade839d96200942e37
8b6cd0c8af52cae5a5a72bf372f595f4c7b49e2ef74fc4b18d5da9428cb83312
92f410985c0233c9abcba33b98f05b3e24d5ea3e80f5083466d545e94d49ec43
974aae5186719dc27b519ca27e94fa64106caa532d17c1ddc0b7b246ab9d8e24
9b3eac129339ae021c89398f35c952bddc1185d8f002c834a5a0c2a3901bdf4b
9b935949913b686e1e44928fb476ad5611303afc06e844ff620f59370d9c77bd
a0a0933f843198c607baaf63f153e3fb5fd900d91f31d37d0f71b53ca66c4ab9
a4d527e2552c0ee4893094ec2d7125f41fbaa9771bc0a399cd1e479684b76271
a968b17677c357d33a924969a798e009e63d3c6667e41f8997c9804007f17fe0
ac8511a575f9ff43c005f8be9f0fb7b81b8aebf2fd2e1df8df7809df4b77cc07
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
ad80ac33ed04b4e6d78167b4162ecd3d2e8c29d17b43eb3df1f35b216b2ac5c5
aeb54739ad664ca0dde2785d1a4c64495b8d91e7eee6ab4d7788769655746f88
af3f4261750c979105a75d6ac17c96475d2050e192f16171d1a304fa480de013
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b397476bcbcf8c9eae3f82007cc4f9495661b367e02e6d3dea6e15f0610ef20a
b5d7707ea8fc00aae40bf500ac7498d7f32f6b1bbff7b4fde976a40345eb5f9d
b76705355ced55168fd590661d7df9b0a26b431a00e43891494b8cd3b845f9e1
c084b47104c493fb377b6d35d8c08df67d773f6dcf8294c0a7360710cd8cacbd
c12b0339ae4601edf3d549f50b7996d241b44ac2a4d1268adf7d8a0695ccb142
c986afd07a4082d65befeef18869a4cd5e00f3ac6e8228d49658802c7453a1b8
cdb1913bcbe7fc4c6b5275adaa24244fd793424baef358810990b57b5c686ac7
d20cf953b941d38ca8b450334f135fbe787dc4cb8371f4032fda9337cbfd5836
d2a075d80c094ba99ceb624341fa47d86daec08696a69e85cbf6e0bc8f4c31a7
d32996520262a9559a26eafe3413cf1a2fe53f448da989d0493e7851f887a1b0
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
df3e003cc30e9bdd0313100e8ee5d468070b4b34d11ad355f276a356d4b9c7bf
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e3d860c5fb1c65a11fc6a71feac206483f8c3ebc81d823177aa7ef9bf8d70523
e55596fc1c3349cbbc926529c29c27e1de7b98b47a31cc7bb4789970e571065f
eb12a261a24e54883613710a4c12f4d9205f634ca1a29d1df07f90105a93e746
ecf5adf2b57718d5744ffb522e9a754b934a4fae7e22daf75684d5e956b2b2a8
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f08cea88c54a644c35abf8c3b33f3d997ff5bd673b940936f82bb80fcb37b6e2
f20b7aacff69fbfc6fc0aaff9220bab48d3ce87c45bd077fea61e5d9e7662c2c
f24c51a94a931f1bdd7c3dacc9ebb3848305f5eb5a3feddf0b01227f6c778c17
f684d50dc9b24df0a4845f688a45b856d945f79d79549240187e171e1655f236
f8e9b5bec9f48d639838d32b29d6713fece521a5d96913cc37a267a69b7e598b
fbcc2c7d4dfbc5d0251c789843b8d7edf25306dfa23188ad267e2786357233c0
fd361b57998c76f86335afa28b8a62527d88a8200fb5c428d6f0fff73383e955

www.fireeye.com Open in urlscan Pro 2606:4700:300b::a29f:f77d Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

95 Requests

95 %HTTPS

41 %IPv6

42 Domains

53 Subdomains

43 IPs

8 Countries

3602 kBTransfer

7035 kBSize

0 Cookies

0 Outgoing links

Redirected requests

95 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 10 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

www.fireeye.com Open in urlscan Pro
2606:4700:300b::a29f:f77d Public Scan

Screenshot
Live screenshot

Full Image

95
Requests

95 %
HTTPS

41 %
IPv6

42
Domains

53
Subdomains

43
IPs

8
Countries

3602 kB
Transfer

7035 kB
Size

0
Cookies

95 HTTP transactions
10 data transactions