www.picussecurity.com Open in urlscan Pro
2606:2c40::c73c:67e3 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://www.picussecurity.com/resource/blog/apt29-cozy-bear-evolution-techniques
Submission: On January 17 via api (January 17th 2025, 8:50:36 am UTC) from IN — Scanned from DE

Summary HTTP 131 Redirects Links 22 Behaviour Indicators

Summary

This website contacted 36 IPs in 4 countries across 27 domains to perform 131 HTTP transactions. The main IP is 2606:2c40::c73c:67e3, located in United States and belongs to CLOUDFLARESPECTRUM Cloudflare London, LLC, US. The main domain is www.picussecurity.com.
TLS certificate: Issued by WE1 on January 16th 2025. Valid for: 3 months.

This is the only time www.picussecurity.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
44	2606:2c40::c7... 2606:2c40::c73c:67e3	209242 (CLOUDFLAR...) (CLOUDFLARESPECTRUM Cloudflare London)
1	199.60.103.32 199.60.103.32	209242 (CLOUDFLAR...) (CLOUDFLARESPECTRUM Cloudflare London)
3	2606:4700:440... 2606:4700:4400::ac40:9284	13335 (CLOUDFLAR...) (CLOUDFLARENET)
4	2606:4700::68... 2606:4700::6811:190e	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	15.157.148.248 15.157.148.248	16509 (AMAZON-02) (AMAZON-02)
4 9	2606:4700::68... 2606:4700::6810:7674	13335 (CLOUDFLAR...) (CLOUDFLARENET)
3	2a00:1450:400... 2a00:1450:4001:80f::200a	15169 (GOOGLE) (GOOGLE)
3 16	2606:4700:303... 2606:4700:3031::ac43:a6ca	13335 (CLOUDFLAR...) (CLOUDFLARENET)
3	2600:9000:249... 2600:9000:2490:7a00:c:77c4:d500:93a1	16509 (AMAZON-02) (AMAZON-02)
1	2600:9000:235... 2600:9000:2359:1e00:9:96ee:a300:93a1	16509 (AMAZON-02) (AMAZON-02)
1	18.66.102.11 18.66.102.11	16509 (AMAZON-02) (AMAZON-02)
4	2a00:1450:400... 2a00:1450:4001:80e::2003	15169 (GOOGLE) (GOOGLE)
2	2606:4700::68... 2606:4700::6812:593e	13335 (CLOUDFLAR...) (CLOUDFLARENET)
4	2606:4700:440... 2606:4700:4400::ac40:9310	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700::68... 2606:4700::6810:4e8e	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700::68... 2606:4700::6811:80ac	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700::68... 2606:4700::6812:8b11	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	2606:4700::68... 2606:4700::6810:6bfe	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700::68... 2606:4700::6810:a0a8	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	52.222.236.43 52.222.236.43	16509 (AMAZON-02) (AMAZON-02)
3	2606:4700::68... 2606:4700::6810:7574	13335 (CLOUDFLAR...) (CLOUDFLARENET)
4	2a00:1450:400... 2a00:1450:4001:82b::2008	15169 (GOOGLE) (GOOGLE)
1	2606:4700::68... 2606:4700::6812:f06c	13335 (CLOUDFLAR...) (CLOUDFLARENET)
6	2606:4700::68... 2606:4700::6813:afbc	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	18.66.112.15 18.66.112.15	16509 (AMAZON-02) (AMAZON-02)
1	52.210.81.110 52.210.81.110	16509 (AMAZON-02) (AMAZON-02)
1	2a00:1450:400... 2a00:1450:4001:831::2002	15169 (GOOGLE) (GOOGLE)
2	2a02:26f0:350... 2a02:26f0:3500:10::210:a9a	20940 (AKAMAI-AS...) (AKAMAI-ASN1 Akamai International B.V.)
1	2001:4860:480... 2001:4860:4802:34::36	15169 (GOOGLE) (GOOGLE)
2	2606:4700::68... 2606:4700::6811:af5b	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1 3	2620:1ec:21::14 2620:1ec:21::14	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	13.107.42.14 13.107.42.14	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
3	2600:1f14:50b... 2600:1f14:50b:9a02:4f20:5197:da0f:c8af	16509 (AMAZON-02) (AMAZON-02)
3	2600:9000:264... 2600:9000:2646:b800:b:8c20:bf40:21	16509 (AMAZON-02) (AMAZON-02)
3	2600:9000:205... 2600:9000:2057:cc00:10:fb15:b700:21	16509 (AMAZON-02) (AMAZON-02)
131	36

44 2606:2c40::c73c:67e3 (United States)

ASN209242 (CLOUDFLARESPECTRUM Cloudflare London, LLC, US)

www.picussecurity.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 199.60.103.32 (United States)

ASN209242 (CLOUDFLARESPECTRUM Cloudflare London, LLC, US)

picussecurity.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2606:4700:4400::ac40:9284 (United States)

ASN13335 (CLOUDFLARENET, US)

39666904.fs1.hubspotusercontent-na1.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
7048931.fs1.hubspotusercontent-na1.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2606:4700::6811:190e (United States)

ASN13335 (CLOUDFLARENET, US)

cdnjs.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 15.157.148.248 (Montreal, Canada)

ASN16509 (AMAZON-02, US)
PTR: ec2-15-157-148-248.ca-central-1.compute.amazonaws.com

p.visitorqueue.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 2606:4700::6810:7674 (United States) 4 redirects

ASN13335 (CLOUDFLARENET, US)

js.hubspot.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
app.hubspot.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
cta-service-cms2.hubspot.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
static.hubspot.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
track.hubspot.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:80f::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

16 2606:4700:3031::ac43:a6ca (United States) 3 redirects

ASN13335 (CLOUDFLARENET, US)

cdn.popt.in	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
display.popt.in	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
fonts.popt.in	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2600:9000:2490:7a00:c:77c4:d500:93a1 (United States)

ASN16509 (AMAZON-02, US)

t.visitorqueue.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:2359:1e00:9:96ee:a300:93a1 (United States)

ASN16509 (AMAZON-02, US)

personalisation.visitorqueue.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.66.102.11 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-66-102-11.fra56.r.cloudfront.net

static.hotjar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:80e::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700::6812:593e (United States)

ASN13335 (CLOUDFLARENET, US)

cdn2.hubspot.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2606:4700:4400::ac40:9310 (United States)

ASN13335 (CLOUDFLARENET, US)

js.hs-banner.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6810:4e8e (United States)

ASN13335 (CLOUDFLARENET, US)

js.usemessages.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6811:80ac (United States)

ASN13335 (CLOUDFLARENET, US)

js.hsadspixel.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6812:8b11 (United States)

ASN13335 (CLOUDFLARENET, US)

js.hsleadflows.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700::6810:6bfe (United States)

ASN13335 (CLOUDFLARENET, US)

js.hscollectedforms.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
forms.hscollectedforms.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6810:a0a8 (United States)

ASN13335 (CLOUDFLARENET, US)

js.hs-analytics.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.222.236.43 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-52-222-236-43.fra56.r.cloudfront.net

script.hotjar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2606:4700::6810:7574 (United States)

ASN13335 (CLOUDFLARENET, US)

cta-service-cms2.hubspot.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
forms.hubspot.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:82b::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6812:f06c (United States)

ASN13335 (CLOUDFLARENET, US)

api.hubapi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2606:4700::6813:afbc (United States)

ASN13335 (CLOUDFLARENET, US)

forms-na1.hsforms.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
perf-na1.hsforms.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
forms.hsforms.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.66.112.15 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-66-112-15.fra56.r.cloudfront.net

vc.hotjar.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.210.81.110 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-210-81-110.eu-west-1.compute.amazonaws.com

content.hotjar.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:831::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a02:26f0:3500:10::210:a9a (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL)

snap.licdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2001:4860:4802:34::36 (United States)

ASN15169 (GOOGLE, US)

region1.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700::6811:af5b (United States)

ASN13335 (CLOUDFLARENET, US)

static.hsappstatic.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2620:1ec:21::14 (United States) 1 redirects

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

px.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.107.42.14 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

px4.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2600:1f14:50b:9a02:4f20:5197:da0f:c8af (Boardman, United States)

ASN16509 (AMAZON-02, US)

tctguyhimcwcyexxgullu3seem0fkhrh.lambda-url.us-west-2.on.aws	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2600:9000:2646:b800:b:8c20:bf40:21 (United States)

ASN16509 (AMAZON-02, US)

d3lopmpcew67el.cloudfront.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2600:9000:2057:cc00:10:fb15:b700:21 (United States)

ASN16509 (AMAZON-02, US)

d362h7pxdteoyk.cloudfront.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
45	picussecurity.com www.picussecurity.com picussecurity.com — Cisco Umbrella Rank: 414620	786 KB
16	popt.in 3 redirects cdn.popt.in — Cisco Umbrella Rank: 30995 display.popt.in — Cisco Umbrella Rank: 30334 fonts.popt.in — Cisco Umbrella Rank: 80207	92 KB
12	hubspot.com 4 redirects js.hubspot.com — Cisco Umbrella Rank: 3485 cta-service-cms2.hubspot.com — Cisco Umbrella Rank: 3510 app.hubspot.com — Cisco Umbrella Rank: 5898 static.hubspot.com — Cisco Umbrella Rank: 17757 track.hubspot.com — Cisco Umbrella Rank: 2343 forms.hubspot.com — Cisco Umbrella Rank: 5358	33 KB
6	cloudfront.net d3lopmpcew67el.cloudfront.net d362h7pxdteoyk.cloudfront.net	273 KB
6	hsforms.com forms-na1.hsforms.com — Cisco Umbrella Rank: 7145 perf-na1.hsforms.com — Cisco Umbrella Rank: 3637 forms.hsforms.com — Cisco Umbrella Rank: 4745	5 KB
6	visitorqueue.com p.visitorqueue.com — Cisco Umbrella Rank: 132784 t.visitorqueue.com — Cisco Umbrella Rank: 90234 personalisation.visitorqueue.com — Cisco Umbrella Rank: 235974	17 KB
4	linkedin.com 1 redirects px.ads.linkedin.com — Cisco Umbrella Rank: 321 px4.ads.linkedin.com — Cisco Umbrella Rank: 7068	2 KB
4	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 37	353 KB
4	hs-banner.com js.hs-banner.com — Cisco Umbrella Rank: 2253	29 KB
4	gstatic.com fonts.gstatic.com	117 KB
4	cloudflare.com cdnjs.cloudflare.com — Cisco Umbrella Rank: 218	66 KB
3	on.aws tctguyhimcwcyexxgullu3seem0fkhrh.lambda-url.us-west-2.on.aws — Cisco Umbrella Rank: 77250	5 KB
3	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 30	3 KB
3	hubspotusercontent-na1.net 39666904.fs1.hubspotusercontent-na1.net — Cisco Umbrella Rank: 89867 7048931.fs1.hubspotusercontent-na1.net	7 KB
2	hsappstatic.net static.hsappstatic.net — Cisco Umbrella Rank: 6653	1 KB
2	licdn.com snap.licdn.com — Cisco Umbrella Rank: 785	24 KB
2	hotjar.io vc.hotjar.io — Cisco Umbrella Rank: 3166 content.hotjar.io — Cisco Umbrella Rank: 6902	403 B
2	hscollectedforms.net js.hscollectedforms.net — Cisco Umbrella Rank: 4827 forms.hscollectedforms.net — Cisco Umbrella Rank: 4990	26 KB
2	hubspot.net cdn2.hubspot.net — Cisco Umbrella Rank: 10186	8 KB
2	hotjar.com static.hotjar.com — Cisco Umbrella Rank: 875 script.hotjar.com — Cisco Umbrella Rank: 1033	61 KB
1	google-analytics.com region1.google-analytics.com — Cisco Umbrella Rank: 2942
1	googlesyndication.com pagead2.googlesyndication.com — Cisco Umbrella Rank: 115
1	hubapi.com api.hubapi.com — Cisco Umbrella Rank: 3636	1013 B
1	hs-analytics.net js.hs-analytics.net — Cisco Umbrella Rank: 2261	25 KB
1	hsleadflows.net js.hsleadflows.net — Cisco Umbrella Rank: 5980	92 KB
1	hsadspixel.net js.hsadspixel.net — Cisco Umbrella Rank: 3298	4 KB
1	usemessages.com js.usemessages.com — Cisco Umbrella Rank: 5387	27 KB
131	27

	Domain	Requested by
44	www.picussecurity.com	www.picussecurity.com js.usemessages.com
7	display.popt.in	cdnjs.cloudflare.com
6	cdn.popt.in	www.picussecurity.com cdnjs.cloudflare.com
4	www.googletagmanager.com	www.picussecurity.com www.googletagmanager.com
4	cta-service-cms2.hubspot.com	2 redirects js.hubspot.com
4	js.hs-banner.com	www.picussecurity.com js.hs-banner.com
4	fonts.gstatic.com	fonts.googleapis.com
4	cdnjs.cloudflare.com	www.picussecurity.com cdn.popt.in cdnjs.cloudflare.com
3	d362h7pxdteoyk.cloudfront.net	tctguyhimcwcyexxgullu3seem0fkhrh.lambda-url.us-west-2.on.aws
3	track.hubspot.com
3	d3lopmpcew67el.cloudfront.net	cdnjs.cloudflare.com www.picussecurity.com
3	tctguyhimcwcyexxgullu3seem0fkhrh.lambda-url.us-west-2.on.aws	www.picussecurity.com
3	fonts.popt.in	3 redirects
3	px.ads.linkedin.com	1 redirects snap.licdn.com
3	t.visitorqueue.com	www.picussecurity.com t.visitorqueue.com
3	fonts.googleapis.com	www.picussecurity.com js.hs-banner.com
2	static.hsappstatic.net	www.picussecurity.com
2	static.hubspot.com	2 redirects
2	forms.hsforms.com	www.picussecurity.com
2	perf-na1.hsforms.com	www.picussecurity.com
2	snap.licdn.com	www.googletagmanager.com snap.licdn.com
2	forms-na1.hsforms.com	www.picussecurity.com
2	cdn2.hubspot.net	www.picussecurity.com
2	p.visitorqueue.com	www.picussecurity.com personalisation.visitorqueue.com
2	39666904.fs1.hubspotusercontent-na1.net	www.picussecurity.com
1	forms.hubspot.com	js.hsleadflows.net
1	px4.ads.linkedin.com	www.picussecurity.com
1	region1.google-analytics.com	www.googletagmanager.com
1	pagead2.googlesyndication.com	www.googletagmanager.com
1	content.hotjar.io	script.hotjar.com
1	vc.hotjar.io	script.hotjar.com
1	forms.hscollectedforms.net	js.hscollectedforms.net
1	api.hubapi.com	js.hsadspixel.net
1	app.hubspot.com	www.picussecurity.com
1	script.hotjar.com	static.hotjar.com
1	js.hs-analytics.net	www.picussecurity.com
1	js.hscollectedforms.net	www.picussecurity.com
1	js.hsleadflows.net	www.picussecurity.com
1	js.hsadspixel.net	www.picussecurity.com
1	js.usemessages.com	www.picussecurity.com
1	7048931.fs1.hubspotusercontent-na1.net	www.picussecurity.com
1	static.hotjar.com	www.picussecurity.com
1	personalisation.visitorqueue.com	www.picussecurity.com
1	js.hubspot.com	www.picussecurity.com
1	picussecurity.com	www.picussecurity.com
131	45

This site contains links to these domains. Also see Links.

Domain
events.picussecurity.com
discover.picussecurity.com
app.picussecurity.com
picussecurity.com
insights.picussecurity.com
picuslabs.io
academy.picussecurity.com
cta-service-cms2.hubspot.com
securelist.com
www.theguardian.com
www.ncsc.gov.uk
attack.mitre.org
twitter.com
www.linkedin.com
www.facebook.com
support.picussecurity.com
www.youtube.com

Subject Issuer	Validity	Valid
www.picussecurity.com WE1	`2025-01-16` - `2025-04-16`	3 months	crt.sh
ca67b291.sni.cloudflaressl.com WE1	`2024-11-21` - `2025-02-19`	3 months	crt.sh
hubspotusercontent-na1.net WE1	`2024-12-25` - `2025-03-26`	3 months	crt.sh
cdnjs.cloudflare.com WE1	`2024-11-26` - `2025-02-24`	3 months	crt.sh
p.visitorqueue.com Amazon RSA 2048 M03	`2024-08-02` - `2025-08-31`	a year	crt.sh
hubspot.com WE1	`2024-12-01` - `2025-03-01`	3 months	crt.sh
upload.video.google.com WR2	`2024-12-09` - `2025-03-03`	3 months	crt.sh
popt.in WE1	`2024-12-27` - `2025-03-27`	3 months	crt.sh
*.visitorqueue.com Amazon RSA 2048 M02	`2025-01-15` - `2026-02-14`	a year	crt.sh
personalisation.visitorqueue.com Amazon RSA 2048 M02	`2025-01-01` - `2026-01-31`	a year	crt.sh
*.hotjar.com Amazon RSA 2048 M03	`2024-05-22` - `2025-06-20`	a year	crt.sh
*.gstatic.com WR2	`2024-12-09` - `2025-03-03`	3 months	crt.sh
hubspot.net WE1	`2024-12-05` - `2025-03-05`	3 months	crt.sh
hs-banner.com WE1	`2024-11-22` - `2025-02-20`	3 months	crt.sh
usemessages.com WE1	`2024-12-04` - `2025-03-04`	3 months	crt.sh
hsadspixel.net WE1	`2024-12-08` - `2025-03-08`	3 months	crt.sh
hsleadflows.net WE1	`2024-11-27` - `2025-02-25`	3 months	crt.sh
hscollectedforms.net WE1	`2024-11-20` - `2025-02-18`	3 months	crt.sh
hs-analytics.net WE1	`2024-12-05` - `2025-03-05`	3 months	crt.sh
*.google-analytics.com WR2	`2024-12-09` - `2025-03-03`	3 months	crt.sh
hubapi.com WE1	`2025-01-05` - `2025-04-05`	3 months	crt.sh
hsforms.com WE1	`2024-12-08` - `2025-03-08`	3 months	crt.sh
*.hotjar.io Amazon ECDSA 256 M03	`2025-01-08` - `2026-02-07`	a year	crt.sh
*.g.doubleclick.net WR2	`2024-12-09` - `2025-03-03`	3 months	crt.sh
snap.licdn.com DigiCert SHA2 Secure Server CA	`2024-12-02` - `2025-12-01`	a year	crt.sh
www.linkedin.com DigiCert SHA2 Secure Server CA	`2024-10-14` - `2025-04-14`	6 months	crt.sh
*.cloudfront.net Amazon RSA 2048 M01	`2024-07-30` - `2025-07-03`	a year	crt.sh

This page contains 2 frames:

Primary Page: https://www.picussecurity.com/resource/blog/apt29-cozy-bear-evolution-techniques
Frame ID: 97F36632AC7BF180B880DC74C83E76D5
Requests: 129 HTTP requests in this frame

Frame: https://www.googletagmanager.com/static/service_worker/51g0/sw_iframe.html?origin=https%3A%2F%2Fwww.picussecurity.com
Frame ID: 322E2CDD978BB3BBC822499A6D84353F
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

APT29 Explained: Cozy Bear's Evolution, Techniques, and Notorious Cyber Attacks

Detected technologies

Font Awesome (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)

Google AdSense (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

googlesyndication\.com/

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtm\.js
googletagmanager\.com/gtag/js

Hotjar (Analytics) Expand

Overall confidence: 100%
Detected patterns

//static\.hotjar\.com/

HubSpot Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

js\.hs-analytics\.net/analytics

Linkedin Insight Tag (Analytics) Expand

Overall confidence: 100%
Detected patterns

snap\.licdn\.com/li\.lms-analytics/insight\.min\.js

Mautic (Marketing Automation) Expand

Overall confidence: 100%
Detected patterns

[^a-z]mtc.*\.js

Slick (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

(?:/([\d.]+))?/slick(?:\.min)?\.js

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

/([\d.]+)/jquery(?:\.min)?\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

jQuery Migrate (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]migrate(?:-([\d.]+))?(?:\.min)?\.js(?:\?ver=([\d.]+))?

Page Statistics

131
Requests

95 %
HTTPS

80 %
IPv6

27
Domains

45
Subdomains

36
IPs

4
Countries

2050 kB
Transfer

5081 kB
Size

49
Cookies

22 Outgoing links

These are links going to different origins than the main page.

URL: https://events.picussecurity.com/webinar/rethinking-automated-penetration-testing
Title: REGISTER NOW >>

Search URL Search Domain Scan URL

URL: https://discover.picussecurity.com/start-your-free-trial
Title: Free Trial

Search URL Search Domain Scan URL

URL: https://app.picussecurity.com/signin
Title: Login

Search URL Search Domain Scan URL

URL: https://events.picussecurity.com/demo-picus-platform
Title: Request a Demo

Search URL Search Domain Scan URL

URL: https://picussecurity.com/hubfs/General_Datasheet_2023/Picus%20Security%20Control%20Validation%20-%20Datasheet.pdf

Search URL Search Domain Scan URL

URL: https://insights.picussecurity.com/know-your-cyber-threats
Title: Actionable Threat Intelligence Report

Search URL Search Domain Scan URL

URL: https://picuslabs.io/tools/attack-simulator?__hstc=51282614.d347b0de772d0b336f3121ed40b444b7.1737103832760.1737103832760.1737103832760.1&__hssc=51282614.1.1737103832760&__hsfp=930271884
Title: Emerging Threat Simulator

Search URL Search Domain Scan URL

URL: https://academy.picussecurity.com/
Title: Purple Academy

Search URL Search Domain Scan URL

URL: https://events.picussecurity.com/assessing-zero-trust-program-assume-breach-webinar

Search URL Search Domain Scan URL

URL: https://cta-service-cms2.hubspot.com/web-interactives/public/v1/track/click?encryptedPayload=AVxigLIyAZ8J4EbNHZkMmIcE5MkUcIsleZcv0Qu2aewT6%2BSByl3B%2FoJ3Qgih5ipg1TRe1hroHXnzElo%2F2Yuy1WYeqaUBYvDncu1MN2D6GZgdA1uTnbYTejZx3n1fPzw8cKXQBob%2BGEM3FAYEoBJUb31hp0pUBJhb4kmLjJ4LdZejLuOuQjkLJgJroiUf0Q80qsU%3D&portalId=7048931&pageUrl=https%3A%2F%2Fwww.picussecurity.com%2Fresource%2Fblog%2Fapt29-cozy-bear-evolution-techniques&pageTitle=APT29+Explained%3A+Cozy+Bear%27s+Evolution%2C+Techniques%2C+and+Notorious+Cyber+Attacks&referrer=&userAgent=Mozilla%2F5.0+%28X11%3B+Linux+x86_64%29+AppleWebKit%2F537.36+%28KHTML%2C+like+Gecko%29+Chrome%2F131.0.0.0+Safari%2F537.36&hutk=d347b0de772d0b336f3121ed40b444b7&hssc=51282614.1.1737103832760&hstc=51282614.d347b0de772d0b336f3121ed40b444b7.1737103832760.1737103832760.1737103832760.1&pageId=183336913844&webInteractiveContentId=151218727472&webInteractiveId=286429421129&containerType=EMBEDDED&analyticsPageId=183336913844&hsfp=930271884&canonicalUrl=https%3A%2F%2Fwww.picussecurity.com%2Fresource%2Fblog%2Fapt29-cozy-bear-evolution-techniques&contentType=blog-post&__hstc=51282614.d347b0de772d0b336f3121ed40b444b7.1737103832760.1737103832760.1737103832760.1&__hssc=51282614.1.1737103832760&__hsfp=930271884
Title: GET A DEMO

Search URL Search Domain Scan URL

URL: https://cta-service-cms2.hubspot.com/web-interactives/public/v1/track/click?encryptedPayload=AVxigLKLf%2F5Vex%2FNcqPtbLL5ZBaAjdGlySv1dH4VlHsHowv6H8EHooldG97ULlVHR1r%2F83dPwacNNWZvCub3egB55aPnyZiiS4FxTeKdmBLUg0wGQv%2BBo3LI0PfW7Rahz3q54wHN9VczgoTspSfZe52XUhxKzqYS4qKZzxkmTozSepsL5dUJtx6EllPFKyF9SFg%3D&portalId=7048931&pageUrl=https%3A%2F%2Fwww.picussecurity.com%2Fresource%2Fblog%2Fapt29-cozy-bear-evolution-techniques&pageTitle=APT29+Explained%3A+Cozy+Bear%27s+Evolution%2C+Techniques%2C+and+Notorious+Cyber+Attacks&referrer=&userAgent=Mozilla%2F5.0+%28X11%3B+Linux+x86_64%29+AppleWebKit%2F537.36+%28KHTML%2C+like+Gecko%29+Chrome%2F131.0.0.0+Safari%2F537.36&hutk=d347b0de772d0b336f3121ed40b444b7&hssc=51282614.1.1737103832760&hstc=51282614.d347b0de772d0b336f3121ed40b444b7.1737103832760.1737103832760.1737103832760.1&pageId=183336913844&webInteractiveContentId=158544721292&webInteractiveId=306338576224&containerType=EMBEDDED&campaignId=dd471652-9fcc-4b70-8abd-581354cb190c&analyticsPageId=183336913844&hsfp=930271884&canonicalUrl=https%3A%2F%2Fwww.picussecurity.com%2Fresource%2Fblog%2Fapt29-cozy-bear-evolution-techniques&contentType=blog-post&__hstc=51282614.d347b0de772d0b336f3121ed40b444b7.1737103832760.1737103832760.1737103832760.1&__hssc=51282614.1.1737103832760&__hsfp=930271884
Title: SIMULATE THIS THREAT FOR FREE - NO SETUP

Search URL Search Domain Scan URL

URL: https://securelist.com/the-cozyduke-apt/69731/
Title: https://securelist.com/the-cozyduke-apt/69731/

Search URL Search Domain Scan URL

URL: https://www.theguardian.com/technology/2016/jul/26/dnc-email-leak-russian-hack-guccifer-2
Title: https://www.theguardian.com/technology/2016/jul/26/dnc-email-leak-russian-hack-guccifer-2

Search URL Search Domain Scan URL

URL: https://www.ncsc.gov.uk/news/advisory-apt29-targets-covid-19-vaccine-development
Title: https://www.ncsc.gov.uk/news/advisory-apt29-targets-covid-19-vaccine-development

Search URL Search Domain Scan URL

URL: https://attack.mitre.org/campaigns/C0024/
Title: https://attack.mitre.org/campaigns/C0024/

Search URL Search Domain Scan URL

URL: https://twitter.com/intent/tweet?url=https://www.picussecurity.com/resource/blog/apt29-cozy-bear-evolution-techniques&text=APT29%20Explained:%20Cozy%20Bear%27s%20Evolution,%20Techniques,%20and%20Notorious%20Cyber%20Attacks

Search URL Search Domain Scan URL

URL: http://www.linkedin.com/shareArticle?mini=true&url=https://www.picussecurity.com/resource/blog/apt29-cozy-bear-evolution-techniques

Search URL Search Domain Scan URL

URL: http://www.facebook.com/share.php?u=https://www.picussecurity.com/resource/blog/apt29-cozy-bear-evolution-techniques

Search URL Search Domain Scan URL

URL: https://support.picussecurity.com/
Title: Customer Support

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/company/picus-security
Title: .st0{fill:#FFFFFF;}

Search URL Search Domain Scan URL

URL: https://twitter.com/PicusSecurity

Search URL Search Domain Scan URL

URL: https://www.youtube.com/channel/UC5mXhfkplWvuVW2Jx9MvOIw

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 100

https://cta-service-cms2.hubspot.com/web-interactives/public/v1/track/view?webInteractiveContentId=151218727472&webInteractiveId=286429421129&containerType=EMBEDDED&portalId=7048931&audienceId=null&pageUrl=https%3A%2F%2Fwww.picussecurity.com%2Fresource%2Fblog%2Fapt29-cozy-bear-evolution-techniques&pageTitle=APT29+Explained%3A+Cozy+Bear%27s+Evolution%2C+Techniques%2C+and+Notorious+Cyber+Attacks&userAgent=Mozilla%2F5.0+%28X11%3B+Linux+x86_64%29+AppleWebKit%2F537.36+%28KHTML%2C+like+Gecko%29+Chrome%2F131.0.0.0+Safari%2F537.36&pageId=183336913844 HTTP 307
https://static.hubspot.com/img/trackers/blank001.gif HTTP 301
https://static.hsappstatic.net/static-hubspot-com/static-1.270519761/img/trackers/blank001.gif

Request Chain 101

https://cta-service-cms2.hubspot.com/web-interactives/public/v1/track/view?webInteractiveContentId=158544721292&webInteractiveId=306338576224&containerType=EMBEDDED&portalId=7048931&audienceId=null&campaignId=dd471652-9fcc-4b70-8abd-581354cb190c&pageUrl=https%3A%2F%2Fwww.picussecurity.com%2Fresource%2Fblog%2Fapt29-cozy-bear-evolution-techniques&pageTitle=APT29+Explained%3A+Cozy+Bear%27s+Evolution%2C+Techniques%2C+and+Notorious+Cyber+Attacks&userAgent=Mozilla%2F5.0+%28X11%3B+Linux+x86_64%29+AppleWebKit%2F537.36+%28KHTML%2C+like+Gecko%29+Chrome%2F131.0.0.0+Safari%2F537.36&pageId=183336913844 HTTP 307
https://static.hubspot.com/img/trackers/blank001.gif HTTP 301
https://static.hsappstatic.net/static-hubspot-com/static-1.270519761/img/trackers/blank001.gif

Request Chain 105

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=2042428&time=1737103831595&url=https%3A%2F%2Fwww.picussecurity.com%2Fresource%2Fblog%2Fapt29-cozy-bear-evolution-techniques&tm=gtmv2 HTTP 302
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=2042428&time=1737103831595&url=https%3A%2F%2Fwww.picussecurity.com%2Fresource%2Fblog%2Fapt29-cozy-bear-evolution-techniques&tm=gtmv2&e_ipv6=AQIxSV2bREFiAwAAAZRzdPK1092TQmgLiallPuESFQ8tbG201SiOuROf84eG79A7AemDDNpi5QFryrzchKRK-uEd9horNQ

Request Chain 106

https://fonts.popt.in/?family=Poppins&display=swap HTTP 302
https://tctguyhimcwcyexxgullu3seem0fkhrh.lambda-url.us-west-2.on.aws/?family=Poppins&display=swap

Request Chain 126

https://fonts.popt.in/?family=Poppins&display=swap HTTP 302
https://tctguyhimcwcyexxgullu3seem0fkhrh.lambda-url.us-west-2.on.aws/?family=Poppins&display=swap

Request Chain 127

https://fonts.popt.in/?family=Yeseva+One&display=swap HTTP 302
https://tctguyhimcwcyexxgullu3seem0fkhrh.lambda-url.us-west-2.on.aws/?family=Yeseva+One&display=swap

131 HTTP transactions
3 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H3 200 Primary Request apt29-cozy-bear-evolution-techniques Show response
www.picussecurity.com/resource/blog/ 174 KB
40 KB 122ms
58ms Document
text/html 2606:2c40::c73c:67e3
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.picussecurity.com/resource/blog/apt29-cozy-bear-evolution-techniques

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:2c40::c73c:67e3 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare London, LLC, US),

Reverse DNS

Software

cloudflare /

Resource Hash

9010a869111373688271063ae1825987889c28dacc0222ad97baa8f13a24a738

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=86400
cache-control: s-maxage=10800, max-age=0
cf-ray: 9035191c1c4e2c2e-FRA
content-encoding: br
content-security-policy: upgrade-insecure-requests
content-security-policy-report-only
content-type: text/html; charset=UTF-8
date: Fri, 17 Jan 2025 08:50:30 GMT
edge-cache-tag: CT-183336913844,CG-35190412163,P-7048931,W-32488136213,W-32488279843,W-32488280065,W-34050730072,CW-106636205147,CW-113292746136,CW-127211604583,CW-153850846592,CW-154512175274,CW-157190659966,CW-158831692418,CW-161965429884,CW-182994145600,CW-39038130957,CW-41162016556,E-117283871284,E-119013969479,E-125740770973,E-153853753872,E-154512352373,E-154797347330,E-155086192011,E-158844553760,E-158846858310,E-160359389297,E-161959088385,E-32300259976,E-32300424271,E-32300424286,E-32379253675,E-32379319518,E-32497563799,E-39027126556,E-81509078165,MENU-32488136213,MENU-32488279843,MENU-32488280065,MENU-34050730072,PGS-ALL,SW-3,B-35190412163,GC-113292746618,GC-150405732755,GC-153854563894,GC-153854773788,GC-158552791130,GC-161964680253,GC-161965565511,GC-182997922195,TS-32295139665
last-modified: Tue, 14 Jan 2025 14:11:39 GMT
link: </hs/hsstatic/content-cwv-embed/static-1.1293/embed.js>; rel=preload; as=script,</hs/hsstatic/keyboard-accessible-menu-flyouts/static-1.17/bundles/project.js>; rel=preload; as=script,</hs/hsstatic/cos-i18n/static-1.53/bundles/project.js>; rel=preload; as=script,</_hcms/forms/v2.js>; rel=preload; as=script
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
priority: u=0,i
referrer-policy: no-referrer-when-downgrade
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=yhOljb0ldnyYFGD38ot8j8%2BuSInV6pyd0e1SIkiv5BmrfUvu7JGlS7omoEjMQbHXMqoXMrdiPPdxyl8mK7QymG84%2BD4cIaNZzZrL3P8lMeAA6yGlzzHXEoPH5QJyqRVA6GbQBHfMEKn4Fww7uAtEk3%2BvSA%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
server-timing: cfExtPri
strict-transport-security: max-age=31536000; includeSubDomains; preload
vary: Accept-Encoding
x-content-type-options: nosniff
x-frame-options: sameorigin
x-hs-cache-config: BrowserCache-5s-EdgeCache-180s
x-hs-cache-control: s-maxage=10800, max-age=0
x-hs-cf-cache-status: HIT
x-hs-content-id: 183336913844
x-hs-hub-id: 7048931
x-hs-prerendered: Tue, 14 Jan 2025 14:11:39 GMT

GET
H3 200 embed.js Show response
www.picussecurity.com/hs/hsstatic/content-cwv-embed/static-1.1293/ 13 KB
6 KB 75ms
74ms Script
application/javascript 2606:2c40::c73c:67e3
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.picussecurity.com/hs/hsstatic/content-cwv-embed/static-1.1293/embed.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:2c40::c73c:67e3 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare London, LLC, US),

Reverse DNS

Software

cloudflare /

Resource Hash

cb5224674e43d02db0037517f4aa29ba5ce9ddd0672e513cc7289714ba657522

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.picussecurity.com/resource/blog/apt29-cozy-bear-evolution-techniques

Response headers

content-encoding: gzip
cf-cache-status: HIT
etag: W/"f667e53d5752ee2e5759f3dfaf20d330"
age: 1921121
x-amz-version-id: AFGFBaAC1397GFbOapH2DRIkjQ_NaZzY
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=sRlb6mm0swWfMP29x1Gp%2FyCVn%2FwjDDZaOAcbDN45x7r2SIknS53LrFT2FMHKgOUHS19rhfJCg1tfk%2BxoVcllBF6psCHGanFPqWA8B%2BCIQ8HLyRBW%2FIaAYoE1JK5gWfFOyze%2FwZAlmqxJNNBsvlb6fGSQcQ%3D%3D"}],"group":"cf-nel","max_age":604800}
expires: Sat, 17 Jan 2026 08:50:30 GMT
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: 4BjSAwe5c9hdNYUssHKFQ6-vn6ZwmDC5A08fRamOyot_uzdNig9xiA==
date: Fri, 17 Jan 2025 08:50:30 GMT
content-type: application/javascript
last-modified: Mon, 23 Sep 2024 19:59:06 GMT
vary: accept-encoding
priority: u=1,i=?0
server-timing: cfExtPri
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-amz-replication-status: COMPLETED
cache-control: public, max-age=31536000
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
via: 1.1 56a77d6c9e6b49fa4179a99507a9582e.cloudfront.net (CloudFront)
cf-ray: 9035191c7c842c2e-FRA
x-amz-cf-pop: FRA60-P6
server: cloudflare
x-amz-server-side-encryption: AES256

GET
H3 200 project.js Show response
www.picussecurity.com/hs/hsstatic/keyboard-accessible-menu-flyouts/static-1.17/bundles/ 2 KB
1 KB 87ms
86ms Script
application/javascript 2606:2c40::c73c:67e3
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.picussecurity.com/hs/hsstatic/keyboard-accessible-menu-flyouts/static-1.17/bundles/project.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:2c40::c73c:67e3 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare London, LLC, US),

Reverse DNS

Software

cloudflare /

Resource Hash

fb56af9f7623a55839dfb9cf019b05664a62e1b41671d925f3ed587c506443b5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.picussecurity.com/resource/blog/apt29-cozy-bear-evolution-techniques

Response headers

content-encoding: gzip
cf-cache-status: HIT
etag: W/"ef84f26c310485299d6b75777414eddb"
age: 1996466
x-amz-version-id: gEenO44eZUewxnIWfgj9q6LB.g9OszNv
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=kAaJ%2BBVb34U8EzHAX5%2BLti2udFpeXObE7Q7O%2F75KPMBddWQBCihecMRkqupqVzEJk52o7jR46gCkT4NJh3bRGwBK2Dga0lN120lxugALK3SU9m6%2B04Zr3hBt7Xlo3UTCJo1q%2FRDCKtu35Qib0RvfJeNRvw%3D%3D"}],"group":"cf-nel","max_age":604800}
expires: Sat, 17 Jan 2026 08:50:30 GMT
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: 2QgjYlpzM4UN3DNtBB5yom0VwMqC1scNzyQlX68K71Xvf9VT4hyUDg==
date: Fri, 17 Jan 2025 08:50:30 GMT
content-type: application/javascript
last-modified: Wed, 19 Aug 2020 22:24:11 GMT
vary: accept-encoding
priority: u=1,i=?0
server-timing: cfExtPri
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-amz-replication-status: COMPLETED
cache-control: public, max-age=31536000
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
via: 1.1 20bb5456515af18dfd439c3bbeca8dfc.cloudfront.net (CloudFront)
cf-ray: 9035191c7c852c2e-FRA
x-amz-cf-pop: FRA60-P11
server: cloudflare
x-amz-server-side-encryption: AES256

GET
H3 200 project.js Show response
www.picussecurity.com/hs/hsstatic/cos-i18n/static-1.53/bundles/ 1 KB
2 KB 73ms
71ms Script
application/javascript 2606:2c40::c73c:67e3
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.picussecurity.com/hs/hsstatic/cos-i18n/static-1.53/bundles/project.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:2c40::c73c:67e3 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare London, LLC, US),

Reverse DNS

Software

cloudflare /

Resource Hash

8da927b6b1240ffca4323fbb2a12c8e5abb541040965c2bc5b7d09a2eb963b02

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.picussecurity.com/resource/blog/apt29-cozy-bear-evolution-techniques

Response headers

content-encoding: gzip
cf-cache-status: HIT
etag: W/"61ca66de658cab9587e4636894680d5d"
age: 2097561
x-amz-version-id: P9ES7sOpFzrLl1QoRwjEAy5outPo5_GO
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=DGXwckGkqG6ltR1GJ5LF22QYCCGpBtJ9cjw2v2iwcW9H78W%2Bbi6gQYOrf7s0SGJE836gHiefRtwWpx8nW7dbGEEWvxvGO9CNiUgwXY4wf7jpPloWQxpahACzTq0%2BWLwvOwqdSUrEDIbijQndc07%2B4A%2BMeg%3D%3D"}],"group":"cf-nel","max_age":604800}
expires: Sat, 17 Jan 2026 08:50:30 GMT
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: yaQ-bXx_jN4KdUGVwFgUJY6N7WC2s9VOT_r5KqdbmuoblWDKYbMBpg==
date: Fri, 17 Jan 2025 08:50:30 GMT
content-type: application/javascript
last-modified: Tue, 09 Nov 2021 16:12:42 GMT
vary: accept-encoding
priority: u=1,i=?0
server-timing: cfExtPri
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-amz-replication-status: COMPLETED
cache-control: public, max-age=31536000
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
via: 1.1 08dc547306e2c7102196b53ce0859e80.cloudfront.net (CloudFront)
cf-ray: 9035191c8c872c2e-FRA
x-amz-cf-pop: FRA60-P11
server: cloudflare
x-amz-server-side-encryption: AES256

GET
H3 200 v2.js Show response
www.picussecurity.com/_hcms/forms/ 485 KB
161 KB 99ms
96ms Script
application/javascript 2606:2c40::c73c:67e3
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.picussecurity.com/_hcms/forms/v2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:2c40::c73c:67e3 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare London, LLC, US),

Reverse DNS

Software

cloudflare /

Resource Hash

53ced87a722a39027bc3d46d303d3e7e7d2435a29820340098a8b0eacdd0f003

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.picussecurity.com/resource/blog/apt29-cozy-bear-evolution-techniques

Response headers

x-request-id: f69077de-6551-45cd-acd1-cb42f9b04337
content-encoding: br
cf-cache-status: HIT
etag: W/"95a445eb1c87e1a68c90789f728495c8"
age: 331
cache-tag: staticjsapp-forms-embed-v2-web-prod,staticjsapp-prod
x-amz-version-id: mHTRYZ2ltezeehllaS9aMpgqbB9lyVN.
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=zSi%2B6rme0ot2h34cOqmxNRCN6uwgVPXTpPb4IYq5kE2dLWbUKQ1hesvjoacPNwcrU7oWFy4k8ydcd4IwF0B62KMpAZzRbcgrL7IB4%2BIOYI7QzVO46Gn1zeDXDtNi0epY22zmDEF%2Fzqn1WgYTC35sPH5q%2Bg%3D%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-evy-trace-listener: listener_https
x-amz-cf-id: UNb08RiK-tZlZWFEZLwX_vi3uu5j5JSRGCnwLEaJBb8KX_k2n2GV7w==
x-hubspot-correlation-id: f69077de-6551-45cd-acd1-cb42f9b04337
content-type: application/javascript; charset=utf-8
last-modified: Wed, 15 Jan 2025 12:19:52 UTC
priority: u=1,i=?0
server-timing: cfExtPri
x-amz-replication-status: COMPLETED
x-evy-trace-route-service-name: envoyset-translator
cache-control: s-maxage=600, max-age=300
x-evy-trace-served-by-pod: iad02/app-td/envoy-proxy-856d8787d5-mglm2
x-envoy-upstream-service-time: 0
x-hs-target-asset: forms-embed/static-1.7309/bundles/project-v2.js
server: cloudflare
x-evy-trace-virtual-host: all
x-amz-server-side-encryption: AES256
x-hs-cache-status: HIT
date: Fri, 17 Jan 2025 08:50:30 GMT
vary: accept-encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
content-security-policy-report-only: frame-ancestors 'self'; report-uri https://send.hsbrowserreports.com/csp/report?resource=forms-embed/static-1.7309/bundles/project-v2.js&cfRay=9025e0b71ffbd22f-WAW
via: 1.1 caafbc8a9aa04b09dd564a3ddef60622.cloudfront.net (CloudFront)
cf-ray: 9035191c8c882c2e-FRA
access-control-allow-origin: *
x-evy-trace-route-configuration: listener_https/all
x-amz-cf-pop: IAD12-P3

GET
H3 200 template_main.min.css
www.picussecurity.com/hubfs/hub_generated/template_assets/1/32300424271/1736420124568/ 63 KB
15 KB 92ms
90ms Stylesheet
text/css 2606:2c40::c73c:67e3
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.picussecurity.com/hubfs/hub_generated/template_assets/1/32300424271/1736420124568/template_main.min.css

Requested by

Host: www.picussecurity.com
URL: https://www.picussecurity.com/resource/blog/apt29-cozy-bear-evolution-techniques

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:2c40::c73c:67e3 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare London, LLC, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ee00ea4e08a430d6ce3d20e620e0a9ee9566abd90a7df0370e8bcc67a72678b2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.picussecurity.com/resource/blog/apt29-cozy-bear-evolution-techniques

Response headers

x-robots-tag: none
content-encoding: br
cf-cache-status: HIT
etag: W/"bef1b75a24f7864b4eded03bf5784ffe"
age: 239802
cache-tag: F-184695283731,FD-184694654049,P-7048931,FLS-ALL
x-amz-version-id: tC1YsjNNw84qp9Ptq_LHe3LXejckErre
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=2ELd76lpq6moqSOyX2lWlUi7RjD6jiCsmrYrJpF10H0VL89XmtGH1EEoQavf6Sa02ihFYU58bFcxNtPmrG8vzMxK%2FzKOVvclTMOb%2BiCDB9I6UzbWU0jQsVBHvY0DQs1DxeJ5gERsBdfHduBpwWo%2FMB5ohA%3D%3D"}],"group":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
x-cache: RefreshHit from cloudfront
x-amz-cf-id: JHGVJ7UdqV6800TE3s0mJr6GplMKsh6X-WwtwLmK447lH6z4dTE-XA==
content-type: text/css
last-modified: Thu, 09 Jan 2025 10:55:26 GMT
priority: u=0,i=?0
server-timing: cfExtPri
x-amz-meta-index-tag: none
x-amz-replication-status: COMPLETED
edge-cache-tag: F-184695283731,FD-184694654049,P-7048931,FLS-ALL
cache-control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900
x-amz-request-id: 1KPKK70V0SXAZQBS
x-hs-cf-lambda-enforce: us-east-1.EnforceAclForReads 3
x-amz-meta-cache-tag: F-184695283731,FD-184694654049,P-7048931,FLS-ALL
x-hs-alternate-content-type: text/plain
server: cloudflare
x-hs-cf-lambda: us-east-1.EnforceAclForReads 3
x-amz-server-side-encryption: AES256
access-control-allow-methods: GET
x-amz-storage-class: INTELLIGENT_TIERING
date: Fri, 17 Jan 2025 08:50:30 GMT
vary: Accept-Encoding
x-amz-id-2: l/fUTaRuEuvbJ2pnBV2iNPbkFhzaw/kbQJZATVNVNwh+5PKhc/4QQAHdBEHWSXU+7rdozn+VC8s=
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-amz-meta-access-tag: public-not-indexable
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
timing-allow-origin: d8fk70yj6xfhx.cloudfront.net
via: 1.1 134eef7df83fe066fda8a86e722c33dc.cloudfront.net (CloudFront)
cf-ray: 9035191c8c892c2e-FRA
access-control-allow-origin: *
x-amz-cf-pop: FRA60-P7
x-amz-meta-created-unix-time-millis: 1736420125796

GET
H3 200 theme-overrides.min.css
www.picussecurity.com/hs-fs/hub/7048931/hub_generated/template_assets/32300424286/1711704470960/Shield/css/ 19 KB
7 KB 77ms
75ms Stylesheet
text/css 2606:2c40::c73c:67e3
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.picussecurity.com/hs-fs/hub/7048931/hub_generated/template_assets/32300424286/1711704470960/Shield/css/theme-overrides.min.css

Requested by

Host: www.picussecurity.com
URL: https://www.picussecurity.com/resource/blog/apt29-cozy-bear-evolution-techniques

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:2c40::c73c:67e3 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare London, LLC, US),

Reverse DNS

Software

cloudflare /

Resource Hash

616a7f16e89518adbc89002f178ebfac5756fc3e96ca30a807ce65ee0e7e4530

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.picussecurity.com/resource/blog/apt29-cozy-bear-evolution-techniques

Response headers

x-request-id: 4ed32378-445c-44dc-9767-ed51c156591b
content-encoding: gzip
cf-cache-status: HIT
etag: W/"07f9f0ec26d491d70da1865437d30ea9"
age: 3462
x-amz-version-id: n7FSIrJj.QJIuwKIz3DUmVp9IJPz6b56
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=lbC8mRDjUUDSupnD7GNRdcrBoAfkf1YAcyE%2FaArfTehHw%2FaIJO2zgU5JGUUvpRBsj7%2FR4F1QuyEouhuZDDG6fuoQEG5pqpDMKpOjGdWP1%2FQceYoAzQcADZL%2FVZe1ddAwcTxgiKC19W15kWYH38ClbXiFaw%3D%3D"}],"group":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
x-cache: Miss from cloudfront
x-evy-trace-listener: listener_https
x-amz-cf-id: te267sSgQ7xg8QoL6DOuOjsyj3yx46FY930So52TaQgqRUwRXSZraQ==
x-hubspot-correlation-id: 4ed32378-445c-44dc-9767-ed51c156591b
content-type: text/css
last-modified: Fri, 29 Mar 2024 09:27:52 GMT
priority: u=0,i=?0
server-timing: cfExtPri
x-amz-replication-status: COMPLETED
x-evy-trace-route-service-name: envoyset-translator
cache-control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900,s-maxage=31536000, max-age=31536000
x-evy-trace-served-by-pod: iad02/cms-hubfs-td/envoy-proxy-5689dcb94b-q4l2p
x-envoy-upstream-service-time: 174
x-amz-request-id: 933B4Q44C8N73BDB
x-hs-cf-lambda-enforce: us-east-1.EnforceAclForReads 3
x-hs-alternate-content-type: text/plain
server: cloudflare
x-evy-trace-virtual-host: all
x-hs-cf-lambda: us-east-1.EnforceAclForReads 3
x-amz-server-side-encryption: AES256
x-amz-storage-class: INTELLIGENT_TIERING
date: Fri, 17 Jan 2025 08:50:30 GMT
vary: origin, Accept-Encoding
x-amz-id-2: +3C3dlgXdR60+Wo7eahJKauV9TLgk/so4miUA1mdO3ysQo5ao0UkgBFijb3qiXvWVHMIhjsgAmThH7U73iAjMg==
strict-transport-security: max-age=31536000; includeSubDomains; preload
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
timing-allow-origin: www.picussecurity.com
access-control-allow-credentials: false
via: 1.1 21921ea369a14dee885ead4f8f5ca75a.cloudfront.net (CloudFront)
cf-ray: 9035191c8c8a2c2e-FRA
x-evy-trace-route-configuration: listener_https/all
x-amz-cf-pop: IAD12-P2
x-amz-meta-created-unix-time-millis: 1711704471664

GET
H3 200 slick-theme.min.css
www.picussecurity.com/hs-fs/hub/7048931/hub_generated/template_assets/119013969479/1686049622830/Picus_IL_Shared/Shared_by_Themes/asset/ 3 KB
2 KB 76ms
73ms Stylesheet
text/css 2606:2c40::c73c:67e3
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.picussecurity.com/hs-fs/hub/7048931/hub_generated/template_assets/119013969479/1686049622830/Picus_IL_Shared/Shared_by_Themes/asset/slick-theme.min.css

Requested by

Host: www.picussecurity.com
URL: https://www.picussecurity.com/resource/blog/apt29-cozy-bear-evolution-techniques

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:2c40::c73c:67e3 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare London, LLC, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f80603874c68fef25ac9ffe412a6c6056ab267d7e4d044f090c8282ab80c4da5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.picussecurity.com/resource/blog/apt29-cozy-bear-evolution-techniques

Response headers

x-request-id: e94a4e5d-205c-44a5-bcc4-b1d52c31a765
content-encoding: gzip
cf-cache-status: HIT
etag: W/"fa83e77758ea493769a6cef5ef0df9c8"
age: 3462
x-amz-version-id: QzIQ8NfUG.gmqRzMZ_BnITV8_s.CjjH6
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=IrCZ%2F7hFh6AyXXIoaecPgE3SLic22gA%2BVgMLbo0EjTzOqFDuZjaRjBfPgMBMQ8aScQwrkMsCon7q%2BifKrJdeX%2F4XKV8TVq1PDngcKJMlWcA%2FtJz4MhnLKseYuwH92zOJSlgVc708oWz3tnLVAMLErcYS2A%3D%3D"}],"group":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
x-cache: Miss from cloudfront
x-evy-trace-listener: listener_https
x-amz-cf-id: WDImcIgACGbDj6dbacFgrc0X_lLkwPitKno_8kyhUbpbxvzIOxRHiQ==
x-hubspot-correlation-id: e94a4e5d-205c-44a5-bcc4-b1d52c31a765
content-type: text/css
last-modified: Tue, 06 Jun 2023 11:07:04 GMT
priority: u=0,i=?0
server-timing: cfExtPri
x-amz-replication-status: COMPLETED
x-evy-trace-route-service-name: envoyset-translator
cache-control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900,s-maxage=31536000, max-age=31536000
x-evy-trace-served-by-pod: iad02/cms-hubfs-td/envoy-proxy-5689dcb94b-s5c5z
x-envoy-upstream-service-time: 211
x-amz-request-id: F4EGRKRQBRHARCS9
x-hs-cf-lambda-enforce: us-east-1.EnforceAclForReads 3
x-hs-alternate-content-type: text/plain
server: cloudflare
x-evy-trace-virtual-host: all
x-hs-cf-lambda: us-east-1.EnforceAclForReads 3
x-amz-server-side-encryption: AES256
x-amz-storage-class: INTELLIGENT_TIERING
date: Fri, 17 Jan 2025 08:50:30 GMT
vary: origin, Accept-Encoding
x-amz-id-2: gfQBiP9JKqcC0iy3i1V0T72abhlKyMtRtTzaA4wUvAMDZlrkaqwMwuUVPtqP5+Z6kkLXrarmTSsn4ubkV8uc7fIrLsufdI0P
strict-transport-security: max-age=31536000; includeSubDomains; preload
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
timing-allow-origin: www.picussecurity.com
access-control-allow-credentials: false
via: 1.1 13f73562b215175ddd75c2902ae36650.cloudfront.net (CloudFront)
cf-ray: 9035191c8c8c2c2e-FRA
x-evy-trace-route-configuration: listener_https/all
x-amz-cf-pop: IAD61-P1
x-amz-meta-created-unix-time-millis: 1686049623451

GET
H3 200 module_Announcement_Bar.min.css
www.picussecurity.com/hubfs/hub_generated/module_assets/1/113292746136/1734698096927/ 2 KB
2 KB 74ms
72ms Stylesheet
text/css 2606:2c40::c73c:67e3
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.picussecurity.com/hubfs/hub_generated/module_assets/1/113292746136/1734698096927/module_Announcement_Bar.min.css

Requested by

Host: www.picussecurity.com
URL: https://www.picussecurity.com/resource/blog/apt29-cozy-bear-evolution-techniques

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:2c40::c73c:67e3 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare London, LLC, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a8e9fbbb12219582bb8f65789dc5329a957f36c3f63edaa57e4c0ca572229c62

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.picussecurity.com/resource/blog/apt29-cozy-bear-evolution-techniques

Response headers

x-robots-tag: none
content-encoding: br
cf-cache-status: HIT
etag: W/"6281425bca640d457af7bee08e45d626"
age: 239802
cache-tag: F-184124085821,FD-184124049293,P-7048931,FLS-ALL
x-amz-version-id: GyQHvdB40Zb_5JfsxWQxlEqMu8wThDSM
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=oVqQ2ixygt4fxg4JU98nU2Fk3SCrtooQk2ynEwfBETJdZb6jBAXPkU10jD%2B99eELk5RiJGj%2BnNnYFThp0y9fryzI3zA03jm17ReUOB30AfPei3NVDJVFKJw3PxyQdQBMdOXSrC%2FsSN9byQWgcUhLar5ZJQ%3D%3D"}],"group":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
x-cache: RefreshHit from cloudfront
x-amz-cf-id: dARmxHSzpzC_yGTyZzxWRB333VMms3BVOeFQDOxp969sYTEhV_qwdQ==
content-type: text/css
last-modified: Fri, 20 Dec 2024 12:34:58 GMT
priority: u=0,i=?0
server-timing: cfExtPri
x-amz-meta-index-tag: none
x-amz-replication-status: COMPLETED
edge-cache-tag: F-184124085821,FD-184124049293,P-7048931,FLS-ALL
cache-control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900
x-amz-request-id: DVJT1EJKGH50DAC2
x-hs-cf-lambda-enforce: us-east-1.EnforceAclForReads 3
x-amz-meta-cache-tag: F-184124085821,FD-184124049293,P-7048931,FLS-ALL
x-hs-alternate-content-type: text/plain
server: cloudflare
x-hs-cf-lambda: us-east-1.EnforceAclForReads 3
x-amz-server-side-encryption: AES256
access-control-allow-methods: GET
x-amz-storage-class: INTELLIGENT_TIERING
date: Fri, 17 Jan 2025 08:50:30 GMT
vary: Accept-Encoding
x-amz-id-2: uEPajjG2RA+u0hdbESWKefSTxv00phhpC5MrNRPlhSrYj0GwqTzx/PMtMZ2Ka8evt0iRuyZrh6oVdnoO/F+qNA==
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-amz-meta-access-tag: public-not-indexable
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
timing-allow-origin: d8fk70yj6xfhx.cloudfront.net
via: 1.1 12dba18ae3d66aa7dad74e664431ae9a.cloudfront.net (CloudFront)
cf-ray: 9035191c8c8d2c2e-FRA
access-control-allow-origin: *
x-amz-cf-pop: FRA60-P7
x-amz-meta-created-unix-time-millis: 1734698097690

GET
H3 200 slick.css
www.picussecurity.com/hubfs/ 2 KB
2 KB 72ms
70ms Stylesheet
text/css 2606:2c40::c73c:67e3
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.picussecurity.com/hubfs/slick.css

Requested by

Host: www.picussecurity.com
URL: https://www.picussecurity.com/resource/blog/apt29-cozy-bear-evolution-techniques

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:2c40::c73c:67e3 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare London, LLC, US),

Reverse DNS

Software

cloudflare /

Resource Hash

de1e399b07289f3b0a8d35142e363e128124a1185770e214e25e58030dad48e5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.picussecurity.com/resource/blog/apt29-cozy-bear-evolution-techniques

Response headers

x-robots-tag: all
content-encoding: br
cf-cache-status: HIT
etag: W/"f38b2db10e01b1572732a3191d538707"
age: 239802
cache-tag: F-88652463641,P-7048931,FLS-ALL
x-amz-version-id: POcUM6CkvZEPNg.2EBNI3HQQEk16JIcL
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=LeZhEx4s3w2K9HoktxW5%2BW5hGlBGu4WC7CDu9FnVaLQpkEFzouZXLx%2Fr%2Bw3c%2By0wlDZHInznJAY7BSkhVOrVOU8XvLlz%2Ben6zdu93JPIQidnurfOn926DjS3%2FUQDRSD39fMeCYRMIOnwOybOk9y3e1n8Ww%3D%3D"}],"group":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
x-cache: RefreshHit from cloudfront
x-amz-cf-id: YUQsmE29gOQDMHMjPMAHVge7xukdt9HxFbS61z5n3m2joWx9EZI3dg==
content-type: text/css
last-modified: Wed, 19 Oct 2022 07:14:40 GMT
priority: u=0,i=?0
server-timing: cfExtPri
x-amz-meta-index-tag: all
x-amz-replication-status: COMPLETED
edge-cache-tag: F-88652463641,P-7048931,FLS-ALL
cache-control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900
x-amz-request-id: 1KPGYWEM72TG7EPW
x-hs-cf-lambda-enforce: us-east-1.EnforceAclForReads 3
x-amz-meta-cache-tag: F-88652463641,P-7048931,FLS-ALL
x-hs-alternate-content-type: text/plain
server: cloudflare
x-hs-cf-lambda: us-east-1.EnforceAclForReads 3
x-amz-server-side-encryption: AES256
access-control-allow-methods: GET
x-amz-storage-class: INTELLIGENT_TIERING
date: Fri, 17 Jan 2025 08:50:30 GMT
vary: Accept-Encoding
x-amz-id-2: 9PxiIGEc9yU4EXZsJQBVJRXGiLygLP6yTbGew6jGbPQH8pdWU64/N1e4LMivUjTxIv4fc6ELOB8isPboX7Fo4Fc3DHOQGBmMiHnW3/aBCNM=
strict-transport-security: max-age=31536000; includeSubDomains; preload
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
timing-allow-origin: d8fk70yj6xfhx.cloudfront.net
via: 1.1 dc468f8259c800daf36aec7b41b2dac8.cloudfront.net (CloudFront)
cf-ray: 9035191c8c8e2c2e-FRA
access-control-allow-origin: *
x-amz-cf-pop: FRA60-P7
x-amz-meta-created-unix-time-millis: 1666163679669

GET
H3 200 buttons_24_live_temp.min.css
www.picussecurity.com/hs-fs/hub/7048931/hub_generated/template_assets/155086192011/1711467339040/Shield/css/elements/ 2 KB
2 KB 93ms
91ms Stylesheet
text/css 2606:2c40::c73c:67e3
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.picussecurity.com/hs-fs/hub/7048931/hub_generated/template_assets/155086192011/1711467339040/Shield/css/elements/buttons_24_live_temp.min.css

Requested by

Host: www.picussecurity.com
URL: https://www.picussecurity.com/resource/blog/apt29-cozy-bear-evolution-techniques

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:2c40::c73c:67e3 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare London, LLC, US),

Reverse DNS

Software

cloudflare /

Resource Hash

633600072534f800c00ce54b60270678545462434c28e1865dde26273d8b00d3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.picussecurity.com/resource/blog/apt29-cozy-bear-evolution-techniques

Response headers

x-request-id: a74a3127-ffb5-4db0-b31a-3d560582b51e
content-encoding: gzip
cf-cache-status: HIT
etag: W/"57dd5c7e70071fad5326af68ed136256"
age: 3462
x-amz-version-id: 7OWdRx4_wRnZy_TqVwi.z5ut8ubwppC5
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=rL5iLlDYGRckUOHsH2X0Xyh%2FCaT0rlqqXzxS2f%2FyJWycIQyJ2dkawKENmtT%2F32Ix0X0K51z2%2BzUP6mO5uCCgvy268aSd5dSdUvMKPwgjqgVL4PI4GexPSgdEtXPQcSVMAxojzvxHMuqezwQDrB2K6vAfKQ%3D%3D"}],"group":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
x-cache: Miss from cloudfront
x-evy-trace-listener: listener_https
x-amz-cf-id: hDyiOBS5KUlz9pGe0Mnk2BS0r0AqUPKv6vuftD6S2l93b5MIEB2ttg==
x-hubspot-correlation-id: a74a3127-ffb5-4db0-b31a-3d560582b51e
content-type: text/css
last-modified: Tue, 26 Mar 2024 15:35:40 GMT
priority: u=0,i=?0
server-timing: cfExtPri
x-amz-replication-status: COMPLETED
x-evy-trace-route-service-name: envoyset-translator
cache-control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900,s-maxage=31536000, max-age=31536000
x-evy-trace-served-by-pod: iad02/cms-hubfs-td/envoy-proxy-5689dcb94b-4dllm
x-envoy-upstream-service-time: 141
x-amz-request-id: EHPYVZTYMS59561K
x-hs-cf-lambda-enforce: us-east-1.EnforceAclForReads 3
x-hs-alternate-content-type: text/plain
server: cloudflare
x-evy-trace-virtual-host: all
x-hs-cf-lambda: us-east-1.EnforceAclForReads 3
x-amz-server-side-encryption: AES256
x-amz-storage-class: INTELLIGENT_TIERING
date: Fri, 17 Jan 2025 08:50:30 GMT
vary: origin, Accept-Encoding
x-amz-id-2: Xf9OJ8Eg1CXcurU0y9TvHSueSplzgVINRUO/HmMn+4PwOvMHIjkdxzC1numpia4YEHJHAUzTb/A=
strict-transport-security: max-age=31536000; includeSubDomains; preload
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
timing-allow-origin: www.picussecurity.com
access-control-allow-credentials: false
via: 1.1 bc330e83c319e99d19922ed79166586a.cloudfront.net (CloudFront)
cf-ray: 9035191c8c902c2e-FRA
x-evy-trace-route-configuration: listener_https/all
x-amz-cf-pop: IAD61-P1
x-amz-meta-created-unix-time-millis: 1711467339681

GET
H3 200 module_39038130957_Lead-Magnet-Banner.min.css
www.picussecurity.com/hs-fs/hub/7048931/hub_generated/module_assets/39038130957/1608575808109/ 521 B
2 KB 64ms
62ms Stylesheet
text/css 2606:2c40::c73c:67e3
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.picussecurity.com/hs-fs/hub/7048931/hub_generated/module_assets/39038130957/1608575808109/module_39038130957_Lead-Magnet-Banner.min.css

Requested by

Host: www.picussecurity.com
URL: https://www.picussecurity.com/resource/blog/apt29-cozy-bear-evolution-techniques

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:2c40::c73c:67e3 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare London, LLC, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5458bb001fbaee0822a06901d6989a7568457bc97c78ce726d8884c34f665910

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.picussecurity.com/resource/blog/apt29-cozy-bear-evolution-techniques

Response headers

x-request-id: 4dd04cf4-29fd-44c1-85de-ef452ea5ec7e
content-encoding: br
cf-cache-status: HIT
etag: W/"b598cb9f535e9d39bea6fb4c7afc98a2"
age: 3462
x-amz-version-id: _6kG0Z6N7nb2Amvf0P3QvVEgQec_PKrh
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=cIff1e0Q7IQBuPa5clvag0YOrlbj%2F5QB9jIHS3e%2BCkw5Eg%2BRgvzbFkr8uKmQPRUlUnqI%2BGvU5PMxuMlC9iCqRYjRLTnQhNRzWLqpXUTu%2Fs%2BAAzZsxwJ8XLczMsbnCA%2Fsl3TuGqqZIaAr27YEhqGtD66N4Q%3D%3D"}],"group":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
x-cache: RefreshHit from cloudfront
x-evy-trace-listener: listener_https
x-amz-cf-id: -wgUTPbUfI0ggCNX10D7SyTvZNIPtXkTnSn3YDuJ1ISNTZSsEB-0EA==
x-hubspot-correlation-id: 4dd04cf4-29fd-44c1-85de-ef452ea5ec7e
content-type: text/css
last-modified: Mon, 21 Dec 2020 18:36:49 GMT
priority: u=0,i=?0
server-timing: cfExtPri
x-amz-replication-status: COMPLETED
x-evy-trace-route-service-name: envoyset-translator
cache-control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900,s-maxage=31536000, max-age=31536000
x-evy-trace-served-by-pod: iad02/cms-hubfs-td/envoy-proxy-5689dcb94b-gvz58
x-envoy-upstream-service-time: 149
x-amz-request-id: YX5H0FTSN00KHFFW
x-hs-cf-lambda-enforce: us-east-1.EnforceAclForReads 3
x-hs-alternate-content-type: text/plain
server: cloudflare
x-evy-trace-virtual-host: all
x-hs-cf-lambda: us-east-1.EnforceAclForReads 3
x-amz-server-side-encryption: AES256
date: Fri, 17 Jan 2025 08:50:30 GMT
vary: origin, Accept-Encoding
x-amz-id-2: ayprQ2hPsW4S7ZjJLusP5PliD/BmvSX9QUF2O1DiZchMkMULvQnBFBzG6+nOgC73pmp2UHXCON+Lmu2B90ZEeSmA+XHqt58d
strict-transport-security: max-age=31536000; includeSubDomains; preload
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
timing-allow-origin: www.picussecurity.com
access-control-allow-credentials: false
via: 1.1 417c242b19212928b079740e6dd8f54c.cloudfront.net (CloudFront)
cf-ray: 9035191c8c912c2e-FRA
x-evy-trace-route-configuration: listener_https/all
x-amz-cf-pop: IAD89-C1
x-amz-meta-created-unix-time-millis: 1608575808109

GET
H3 200 main-blog.min.css
www.picussecurity.com/hs-fs/hub/7048931/hub_generated/template_assets/158846858310/1718643038303/Shield/templates/partials/blog-post-layouts/css/ 746 B
2 KB 77ms
75ms Stylesheet
text/css 2606:2c40::c73c:67e3
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.picussecurity.com/hs-fs/hub/7048931/hub_generated/template_assets/158846858310/1718643038303/Shield/templates/partials/blog-post-layouts/css/main-blog.min.css

Requested by

Host: www.picussecurity.com
URL: https://www.picussecurity.com/resource/blog/apt29-cozy-bear-evolution-techniques

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:2c40::c73c:67e3 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare London, LLC, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2d042ae177f7d076320fa923d0bfc2d3f831e3dacec0ff6fffc1328d4e36f2f9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.picussecurity.com/resource/blog/apt29-cozy-bear-evolution-techniques

Response headers

x-request-id: c8ceb6e9-63e1-4860-8dbc-5118f69614a2
content-encoding: br
cf-cache-status: HIT
etag: W/"c8a0733f23e3d47a998103c206215b1c"
age: 1728
x-amz-version-id: 67zOSufRDoTrJsiIpgZ.VHGK38h9xBf_
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=7PWrtCzujizYaUL6TV%2BXd8sHIKNJQmDXurEHzUllM3yCXH%2FU67%2BSf9BC2G%2FcTCM2%2BodlM1PQAH0dOJO%2BbpXqSNg2UnRojbPDNEU%2B4EyJjBd9OeGjN3XZTIygTukk389T66QaSy13hYdV4zoclkFVK%2BYuXw%3D%3D"}],"group":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
x-cache: RefreshHit from cloudfront
x-evy-trace-listener: listener_https
x-amz-cf-id: uuZUjFbPxKVd_v7kQWTGDYiw_WqBt8EET4FX1f8wytpchBHxah_dSA==
x-hubspot-correlation-id: c8ceb6e9-63e1-4860-8dbc-5118f69614a2
content-type: text/css
last-modified: Mon, 17 Jun 2024 16:50:39 GMT
priority: u=0,i=?0
server-timing: cfExtPri
x-amz-replication-status: COMPLETED
x-evy-trace-route-service-name: envoyset-translator
cache-control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900,s-maxage=31536000, max-age=31536000
x-evy-trace-served-by-pod: iad02/cms-hubfs-td/envoy-proxy-5689dcb94b-9phj2
x-envoy-upstream-service-time: 176
x-amz-request-id: WQENE2WS4ZCTM9W6
x-hs-cf-lambda-enforce: us-east-1.EnforceAclForReads 3
x-hs-alternate-content-type: text/plain
server: cloudflare
x-evy-trace-virtual-host: all
x-hs-cf-lambda: us-east-1.EnforceAclForReads 3
x-amz-server-side-encryption: AES256
x-amz-storage-class: INTELLIGENT_TIERING
date: Fri, 17 Jan 2025 08:50:30 GMT
vary: origin, Accept-Encoding
x-amz-id-2: MYnZp1YE19G0uotPQuJAtfgMaBe2lWkD8aEBue/y9JdkBeaBJUUn8XTuR4gCRWbQ0GoQ8bmhq1A=
strict-transport-security: max-age=31536000; includeSubDomains; preload
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
timing-allow-origin: www.picussecurity.com
access-control-allow-credentials: false
via: 1.1 05f27386f4cfcb918eb11b3fea4d975e.cloudfront.net (CloudFront)
cf-ray: 9035191c8c922c2e-FRA
x-evy-trace-route-configuration: listener_https/all
x-amz-cf-pop: IAD61-P1
x-amz-meta-created-unix-time-millis: 1718643038991

GET
H3 200 module_158831692418_promotion-box-v2.min.css
www.picussecurity.com/hs-fs/hub/7048931/hub_generated/module_assets/158831692418/1722507877768/ 265 B
2 KB 70ms
68ms Stylesheet
text/css 2606:2c40::c73c:67e3
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.picussecurity.com/hs-fs/hub/7048931/hub_generated/module_assets/158831692418/1722507877768/module_158831692418_promotion-box-v2.min.css

Requested by

Host: www.picussecurity.com
URL: https://www.picussecurity.com/resource/blog/apt29-cozy-bear-evolution-techniques

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:2c40::c73c:67e3 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare London, LLC, US),

Reverse DNS

Software

cloudflare /

Resource Hash

041685b0e5a31c63c4c06ffc86484bdd0c56100f1f0b36c91571e6a00bcec715

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.picussecurity.com/resource/blog/apt29-cozy-bear-evolution-techniques

Response headers

x-request-id: 8bc061d7-7e92-4843-9168-b21067a36a17
content-encoding: br
cf-cache-status: HIT
etag: W/"24d6a4097278d1fd6d98de8011279fb7"
age: 692
x-amz-version-id: R2tkIutFE4R55yodW8QuYHz4reXF6E66
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=vISLrEHexkMjg9m%2BqwZPI1CMv4fkngSkJQJbrQ%2FG3XkB49w%2Fmcj2MCgPE%2FAAt%2BuptOwtDp%2BHexTdIrL4CE5kx33zBNPpdi57klUYSvd4NbmEfk8DXr4ewUz9oRcvvo7XP5%2BzeKrBqTKhth7jhAcHr2tkUA%3D%3D"}],"group":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
x-cache: RefreshHit from cloudfront
x-evy-trace-listener: listener_https
x-amz-cf-id: XPKoIjOK8BBvZqkVDzTqB6kqrychOhHWS6SZWVhztrEgUeAIZlN4Nw==
x-hubspot-correlation-id: 8bc061d7-7e92-4843-9168-b21067a36a17
content-type: text/css
last-modified: Thu, 01 Aug 2024 10:24:38 GMT
priority: u=0,i=?0
server-timing: cfExtPri
x-amz-replication-status: COMPLETED
x-evy-trace-route-service-name: envoyset-translator
cache-control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900,s-maxage=31536000, max-age=31536000
x-evy-trace-served-by-pod: iad02/cms-hubfs-td/envoy-proxy-5689dcb94b-f6sfd
x-envoy-upstream-service-time: 178
x-amz-request-id: VB9AR3ZBS9K225YZ
x-hs-cf-lambda-enforce: us-east-1.EnforceAclForReads 3
x-hs-alternate-content-type: text/plain
server: cloudflare
x-evy-trace-virtual-host: all
x-hs-cf-lambda: us-east-1.EnforceAclForReads 3
x-amz-server-side-encryption: AES256
x-amz-storage-class: INTELLIGENT_TIERING
date: Fri, 17 Jan 2025 08:50:30 GMT
vary: origin, Accept-Encoding
x-amz-id-2: ATGKyuHNvXTWgwR+eYsNBYBbBxNyaAztJuVf4vETzkCoRabuby6wgc64xFljzwDo/HvRnMTmp7g=
strict-transport-security: max-age=31536000; includeSubDomains; preload
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
timing-allow-origin: www.picussecurity.com
access-control-allow-credentials: false
via: 1.1 d640ec12547ee097cb75dd5bdc8787b8.cloudfront.net (CloudFront)
cf-ray: 9035191c8c942c2e-FRA
x-evy-trace-route-configuration: listener_https/all
x-amz-cf-pop: IAD61-P1
x-amz-meta-created-unix-time-millis: 1722507877768

GET
H3 200 s2-slick-style.min.css
www.picussecurity.com/hs-fs/hub/7048931/hub_generated/template_assets/154797347330/1729693014912/Shield/css/components/ 2 KB
2 KB 95ms
93ms Stylesheet
text/css 2606:2c40::c73c:67e3
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.picussecurity.com/hs-fs/hub/7048931/hub_generated/template_assets/154797347330/1729693014912/Shield/css/components/s2-slick-style.min.css

Requested by

Host: www.picussecurity.com
URL: https://www.picussecurity.com/resource/blog/apt29-cozy-bear-evolution-techniques

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:2c40::c73c:67e3 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare London, LLC, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ffba9a52471b5e7d35690f8297267837b94bdce89a67fa3ab13e5574d686a546

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.picussecurity.com/resource/blog/apt29-cozy-bear-evolution-techniques

Response headers

x-request-id: f76fa8a4-bb01-49f5-8fa0-72af7469ea54
content-encoding: gzip
cf-cache-status: HIT
etag: W/"d6dc4e832b6b870e023ff0d6ef6b2b39"
age: 692
x-amz-version-id: bN7b2z5R61z9bPWhzSSKI3SRUbuSSZRx
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=CRao1dlQuBPi7QZzz2Ib12T62HQK3Dcunxm687HkK3S1wHCQuMgLPof%2Fr7sktR3QY0q9X6F8IqDJRewvk7ilfKUX6x%2BL%2FVJf%2FH2Q7bharoVSLW4vF50OJvhHDO9BgzuPM94ZambMCOLlJvDQfDXkEjA5Fw%3D%3D"}],"group":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
x-cache: Miss from cloudfront
x-evy-trace-listener: listener_https
x-amz-cf-id: wkFAdMQhIZE4uJRcIaCAJs1UTCMiW8qZ10Lp5tT-XYW8g-QG2kS1bw==
x-hubspot-correlation-id: f76fa8a4-bb01-49f5-8fa0-72af7469ea54
content-type: text/css
last-modified: Wed, 23 Oct 2024 14:16:56 GMT
priority: u=0,i=?0
server-timing: cfExtPri
x-amz-replication-status: COMPLETED
x-evy-trace-route-service-name: envoyset-translator
cache-control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900,s-maxage=31536000, max-age=31536000
x-evy-trace-served-by-pod: iad02/cms-hubfs-td/envoy-proxy-6548769dcd-ttbmk
x-envoy-upstream-service-time: 249
x-amz-request-id: QMBN2CD0W40WTRC3
x-hs-cf-lambda-enforce: us-east-1.EnforceAclForReads 3
x-hs-alternate-content-type: text/plain
server: cloudflare
x-evy-trace-virtual-host: all
x-hs-cf-lambda: us-east-1.EnforceAclForReads 3
x-amz-server-side-encryption: AES256
x-amz-storage-class: INTELLIGENT_TIERING
date: Fri, 17 Jan 2025 08:50:30 GMT
vary: origin, Accept-Encoding
x-amz-id-2: 6RONwFmIg2ZjNHVjtIfQ6Cpt2Jkywhaj1IPN1lHSwhBSf+htpIhShhOnw5ianqcmDVPjv8gwZHM3gPZaEIB4PlE8TbrzEK7a
strict-transport-security: max-age=31536000; includeSubDomains; preload
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
timing-allow-origin: www.picussecurity.com
access-control-allow-credentials: false
via: 1.1 7a99ed3f39c18af8fe138a695e5f657c.cloudfront.net (CloudFront)
cf-ray: 9035191c8c952c2e-FRA
x-evy-trace-route-configuration: listener_https/all
x-amz-cf-pop: IAD89-C1
x-amz-meta-created-unix-time-millis: 1729693015688

GET
H3 200 s2-generic-2024.min.css
www.picussecurity.com/hs-fs/hub/7048931/hub_generated/template_assets/154512352373/1727789447438/Shield/css/templates/ 15 KB
5 KB 96ms
95ms Stylesheet
text/css 2606:2c40::c73c:67e3
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.picussecurity.com/hs-fs/hub/7048931/hub_generated/template_assets/154512352373/1727789447438/Shield/css/templates/s2-generic-2024.min.css

Requested by

Host: www.picussecurity.com
URL: https://www.picussecurity.com/resource/blog/apt29-cozy-bear-evolution-techniques

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:2c40::c73c:67e3 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare London, LLC, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7cc1ff7f9b57caf071c85b50968032dea1fa2ff1dc8a84da9d248d70a7820ffd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.picussecurity.com/resource/blog/apt29-cozy-bear-evolution-techniques

Response headers

x-request-id: 3a21d344-9d28-4917-9be9-a41c90f15cf8
content-encoding: gzip
cf-cache-status: HIT
etag: W/"4b2acceb7f22fa88055b1b6ea68f43f6"
age: 692
x-amz-version-id: P6D8I2IPwV0ppjV6J83azg6P8d4.ZgZ9
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=XqbJwX5Zowb9PEMQ7xo5Ac9f5hYLh6oP1vtkF7eKqwso2ksxhd826NcL4IXm1c8ri5IMLgqEts8u3iHMYWJ7xv50sihV3zmsCywz7Tc8EADPsX2fE6OxCeRTvS%2FNOazK3NGe6YfufDL%2BB%2BizL85cquaFWA%3D%3D"}],"group":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
x-cache: Miss from cloudfront
x-evy-trace-listener: listener_https
x-amz-cf-id: _Lb1oV1S5r0RHXMxoxPVm-_OnFOety4LsdcTa1p_xqyTK6Hpmc9hxA==
x-hubspot-correlation-id: 3a21d344-9d28-4917-9be9-a41c90f15cf8
content-type: text/css
last-modified: Tue, 01 Oct 2024 13:30:49 GMT
priority: u=0,i=?0
server-timing: cfExtPri
x-amz-replication-status: COMPLETED
x-evy-trace-route-service-name: envoyset-translator
cache-control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900,s-maxage=31536000, max-age=31536000
x-evy-trace-served-by-pod: iad02/cms-hubfs-td/envoy-proxy-5689dcb94b-4dllm
x-envoy-upstream-service-time: 158
x-amz-request-id: F2VEY7DZ3E30R6ND
x-hs-cf-lambda-enforce: us-east-1.EnforceAclForReads 3
x-hs-alternate-content-type: text/plain
server: cloudflare
x-evy-trace-virtual-host: all
x-hs-cf-lambda: us-east-1.EnforceAclForReads 3
x-amz-server-side-encryption: AES256
x-amz-storage-class: INTELLIGENT_TIERING
date: Fri, 17 Jan 2025 08:50:30 GMT
vary: origin, Accept-Encoding
x-amz-id-2: y/d6fJRDXw0IBWgQjUAnPh7U77PIzkwtfK7omzN/4n8m1sqKP01QQsjvhQsRudnTAu0PjW0vCDU=
strict-transport-security: max-age=31536000; includeSubDomains; preload
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
timing-allow-origin: www.picussecurity.com
access-control-allow-credentials: false
via: 1.1 05f27386f4cfcb918eb11b3fea4d975e.cloudfront.net (CloudFront)
cf-ray: 9035191c8c972c2e-FRA
x-evy-trace-route-configuration: listener_https/all
x-amz-cf-pop: IAD61-P1
x-amz-meta-created-unix-time-millis: 1727789448244

GET
H2 200 pattern-banner-image-2544x754-70kb.jpg
picussecurity.com/hubfs/2023%20-%20Optimization/ 27 KB
29 KB 112ms
52ms Image
image/webp 199.60.103.32
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://picussecurity.com/hubfs/2023%20-%20Optimization/pattern-banner-image-2544x754-70kb.jpg

Requested by

Host: www.picussecurity.com
URL: https://www.picussecurity.com/resource/blog/apt29-cozy-bear-evolution-techniques

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

199.60.103.32 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare London, LLC, US),

Reverse DNS

Software

cloudflare /

Resource Hash

37ae22001cbbeb0ac14954c007c7406b2c17b8d30d8b74f8bff0a225b5a9ebe3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.picussecurity.com/resource/blog/apt29-cozy-bear-evolution-techniques

Response headers

x-robots-tag: all
cf-cache-status: HIT
etag: "f5940fd3a9217a3adefdb33e97b3c664"
age: 239799
cache-tag: F-184128918409,FD-106424384934,P-7048931,FLS-ALL
x-amz-version-id: a8UhJjsBgdy_kFiS0O14MdG.o1.rll.0
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=sZX0FqhobgtCzMZrzVXNSmWNEcG4xi2KiyYRLmzGaWrzGUEndUGG77MYPCSE11YTyvK7zuIeYTe25dlVDTb4FsHqRB7Y4aFDErmFXZpb6pDvm6yRWuqCeraq32EEdUmISVKm"}],"group":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
x-cache: RefreshHit from cloudfront
x-amz-cf-id: DpvNTd5hOAvgfXysUJLUcgYnPt6P68DwvEZlfji9Aa3vqP2uzzRfHg==
content-type: image/webp
content-disposition: inline; filename="pattern-banner-image-2544x754-70kb.webp"
last-modified: Fri, 20 Dec 2024 14:16:22 GMT
x-amz-meta-index-tag: all
x-amz-replication-status: COMPLETED
edge-cache-tag: F-184128918409,FD-106424384934,P-7048931,FLS-ALL
cache-control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900
x-amz-request-id: K1R5TW216HZWDE93
x-hs-cf-lambda-enforce: us-east-1.EnforceAclForReads 3
accept-ranges: bytes
x-amz-meta-cache-tag: F-184128918409,FD-106424384934,P-7048931,FLS-ALL
content-length: 27620
x-hs-alternate-content-type: text/plain
server: cloudflare
x-amz-server-side-encryption: AES256
x-hs-cf-lambda: us-east-1.EnforceAclForReads 3
cf-bgj: imgq:85,h2pri
access-control-allow-methods: GET
x-amz-storage-class: INTELLIGENT_TIERING
cf-polished: qual=85, origFmt=jpeg, origSize=70398
date: Fri, 17 Jan 2025 08:50:30 GMT
vary: Accept, Accept-Encoding
x-amz-id-2: CnkSuz4dYiEWPHwjjw0zvQupdZh94Hvl76dOEgSvuOczuSApbbsZdBshTlQj4z2bIGV/rM8Lr9U=
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-amz-meta-access-tag: public-indexable
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
timing-allow-origin: d8fk70yj6xfhx.cloudfront.net
via: 1.1 cce339e34372cea758a4181fcf4e7c14.cloudfront.net (CloudFront)
cf-ray: 9035191ebf3c37d2-FRA
access-control-allow-origin: *
x-amz-cf-pop: FRA60-P7
x-amz-meta-created-unix-time-millis: 1734704180979

GET
H3 200 module_153850846592_footer-subscribe-column.min.css
www.picussecurity.com/hs-fs/hub/7048931/hub_generated/module_assets/153850846592/1711461276903/ 2 KB
2 KB 97ms
95ms Stylesheet
text/css 2606:2c40::c73c:67e3
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.picussecurity.com/hs-fs/hub/7048931/hub_generated/module_assets/153850846592/1711461276903/module_153850846592_footer-subscribe-column.min.css

Requested by

Host: www.picussecurity.com
URL: https://www.picussecurity.com/resource/blog/apt29-cozy-bear-evolution-techniques

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:2c40::c73c:67e3 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare London, LLC, US),

Reverse DNS

Software

cloudflare /

Resource Hash

794559db00f5a68a8a82dc14f100cd1f9a970cbea66701ca8a43dee9919ffe03

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.picussecurity.com/resource/blog/apt29-cozy-bear-evolution-techniques

Response headers

x-request-id: 2c30885a-900f-4756-87a8-7b8c654c95eb
content-encoding: gzip
cf-cache-status: HIT
etag: W/"f0bb9c2921cb8261ba425f19ee6a96cf"
age: 3462
x-amz-version-id: eXne9q1JzSZgmx3FIoxMEAYoI0TuCmV.
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=PlsulmzlFgYtoiGsVluCvsgtL53QshDOGDA18yeHSvtOBfmWgK8BunIFoW5Jfu5%2Fs1MyZZicWQA7OEptFKuJBdnsyJIn%2FeaK5fYVRiSP5dGnWcWRPp43VwNmnJl1Ed8rSE8KOrGOpr4Hz38wI62XSqO92g%3D%3D"}],"group":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
x-cache: Miss from cloudfront
x-evy-trace-listener: listener_https
x-amz-cf-id: Fsl-UQZO50Ij5d31QVXwNlREWU9ttjTTtVFO-7WUo_mS9yKtmyWAMA==
x-hubspot-correlation-id: 2c30885a-900f-4756-87a8-7b8c654c95eb
content-type: text/css
last-modified: Tue, 26 Mar 2024 13:54:37 GMT
priority: u=0,i=?0
server-timing: cfExtPri
x-amz-replication-status: COMPLETED
x-evy-trace-route-service-name: envoyset-translator
cache-control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900,s-maxage=31536000, max-age=31536000
x-evy-trace-served-by-pod: iad02/cms-hubfs-td/envoy-proxy-5689dcb94b-qphjm
x-envoy-upstream-service-time: 174
x-amz-request-id: WWCJ09S8PQ59Y2GE
x-hs-cf-lambda-enforce: us-east-1.EnforceAclForReads 3
x-hs-alternate-content-type: text/plain
server: cloudflare
x-evy-trace-virtual-host: all
x-hs-cf-lambda: us-east-1.EnforceAclForReads 3
x-amz-server-side-encryption: AES256
x-amz-storage-class: INTELLIGENT_TIERING
date: Fri, 17 Jan 2025 08:50:30 GMT
vary: origin, Accept-Encoding
x-amz-id-2: UOmohJoBQfWJFp7CLWmRMDECuLrF80NNbCwr+FIgMNMTiIcoqQ2J5/n8riDmgXnvLdlsEI/Qsf4=
strict-transport-security: max-age=31536000; includeSubDomains; preload
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
timing-allow-origin: www.picussecurity.com
access-control-allow-credentials: false
via: 1.1 b5e757a7da6f6fe6261f56a8a9646880.cloudfront.net (CloudFront)
cf-ray: 9035191c8c982c2e-FRA
x-evy-trace-route-configuration: listener_https/all
x-amz-cf-pop: IAD89-C1
x-amz-meta-created-unix-time-millis: 1711461276903

GET
H2 200 TrackPlayAnalytics-Cm48oVxd.css
39666904.fs1.hubspotusercontent-na1.net/hubfs/39666904/raw_assets/media-default-modules/master/433/js_client_assets/assets/ 6 KB
3 KB 106ms
50ms Stylesheet
text/css 2606:4700:4400::ac40:9284
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://39666904.fs1.hubspotusercontent-na1.net/hubfs/39666904/raw_assets/media-default-modules/master/433/js_client_assets/assets/TrackPlayAnalytics-Cm48oVxd.css
Requested by: Host: www.picussecurity.com
URL: https://www.picussecurity.com/resource/blog/apt29-cozy-bear-evolution-techniques
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:4400::ac40:9284 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b0403829bc66fd1f26c7ad7f42a2560787fe44f34417d357ed83d107ab32d983

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.picussecurity.com/resource/blog/apt29-cozy-bear-evolution-techniques

Response headers

x-robots-tag: none
content-encoding: br
cf-cache-status: HIT
etag: W/"65806cc0ba70516e6b234221657321ef"
age: 899396
cache-tag: F-184593155330,FD-184593155328,P-39666904,FLS-ALL
x-amz-version-id: VMKzcA93t19f70k33nErDxVQsbjvIfNX
x-cache: RefreshHit from cloudfront
x-amz-cf-id: zFQLbFdL4nZbkwIqY1qpRtUYH8J3Om3c-T24ixYOCZcFKCVR7hZUQA==
content-type: text/css
last-modified: Mon, 06 Jan 2025 22:48:47 GMT
x-amz-meta-index-tag: none
x-amz-replication-status: COMPLETED
edge-cache-tag: F-184593155330,FD-184593155328,P-39666904,FLS-ALL
cache-control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900
x-amz-request-id: FTSZPJZJMDD7CAG2
x-hs-cf-lambda-enforce: us-east-1.EnforceAclForReads 3
x-amz-meta-cache-tag: F-184593155330,FD-184593155328,P-39666904,FLS-ALL
x-hs-alternate-content-type: text/plain
server: cloudflare
x-hs-cf-lambda: us-east-1.EnforceAclForReads 3
x-amz-server-side-encryption: AES256
access-control-allow-methods: GET
x-amz-storage-class: INTELLIGENT_TIERING
date: Fri, 17 Jan 2025 08:50:30 GMT
vary: Accept-Encoding
x-amz-id-2: wth0Ld8rStSPqa4AOHUaeryvI5zgr5BvEvIL02qH1eHqQ6svBfS+Q6VYqU4J0Ri5BrMpUe/K7Eg=
x-amz-meta-access-tag: public-not-indexable
timing-allow-origin: 39666904.fs1.hubspotusercontent-na1.net
via: 1.1 85b175d782816d34ed73f9ca030bf062.cloudfront.net (CloudFront)
cf-ray: 9035191cd89fd217-FRA
access-control-allow-origin: *
x-amz-cf-pop: FRA60-P7
x-amz-meta-created-unix-time-millis: 1736203726517

GET
H2 200 Tooltip-DkS5dgLo.css
39666904.fs1.hubspotusercontent-na1.net/hubfs/39666904/raw_assets/media-default-modules/master/433/js_client_assets/assets/ 3 KB
1 KB 108ms
53ms Stylesheet
text/css 2606:4700:4400::ac40:9284
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://39666904.fs1.hubspotusercontent-na1.net/hubfs/39666904/raw_assets/media-default-modules/master/433/js_client_assets/assets/Tooltip-DkS5dgLo.css
Requested by: Host: www.picussecurity.com
URL: https://www.picussecurity.com/resource/blog/apt29-cozy-bear-evolution-techniques
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:4400::ac40:9284 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4a948cad1525b333f4615fb0203e3dcf4a5fdef9409adb657fceeab1dcb37f7d

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.picussecurity.com/resource/blog/apt29-cozy-bear-evolution-techniques

Response headers

x-robots-tag: none
content-encoding: br
cf-cache-status: HIT
etag: W/"983d8d84588e7c3f88e069694360be07"
age: 899396
cache-tag: F-184595633987,FD-184593155328,P-39666904,FLS-ALL
x-amz-version-id: VMaV0CVlDXLb7WuDzMO2FiCNHrStKFBk
x-cache: RefreshHit from cloudfront
x-amz-cf-id: 9W6lkjs3UfqdMw6KO83yg2BDvBNTJjqQ11sIeLJh4_MqBiNMP4wW4Q==
content-type: text/css
last-modified: Mon, 06 Jan 2025 22:48:47 GMT
x-amz-meta-index-tag: none
x-amz-replication-status: COMPLETED
edge-cache-tag: F-184595633987,FD-184593155328,P-39666904,FLS-ALL
cache-control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900
x-amz-request-id: FTSNCDR7YS12N4JX
x-hs-cf-lambda-enforce: us-east-1.EnforceAclForReads 3
x-amz-meta-cache-tag: F-184595633987,FD-184593155328,P-39666904,FLS-ALL
x-hs-alternate-content-type: text/plain
server: cloudflare
x-hs-cf-lambda: us-east-1.EnforceAclForReads 3
x-amz-server-side-encryption: AES256
access-control-allow-methods: GET
x-amz-storage-class: INTELLIGENT_TIERING
date: Fri, 17 Jan 2025 08:50:30 GMT
vary: Accept-Encoding
x-amz-id-2: 5N4LXtYTADOGhIV7sIatvmKgxScdcx5DI2xumwwhwaCbEbp5ilY6EVSpEKYtr1xeoetC3sxWPFY=
x-amz-meta-access-tag: public-not-indexable
timing-allow-origin: 39666904.fs1.hubspotusercontent-na1.net
via: 1.1 56df5811b9d89103539b9b0b5fd9b262.cloudfront.net (CloudFront)
cf-ray: 9035191cd8a0d217-FRA
access-control-allow-origin: *
x-amz-cf-pop: FRA60-P7
x-amz-meta-created-unix-time-millis: 1736203726618

GET
H3 200 jquery.min.js Show response
cdnjs.cloudflare.com/ajax/libs/jquery/3.6.0/ 87 KB
28 KB 59ms
31ms Script
application/javascript 2606:4700::6811:190e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/jquery/3.6.0/jquery.min.js

Requested by

Host: www.picussecurity.com
URL: https://www.picussecurity.com/resource/blog/apt29-cozy-bear-evolution-techniques

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6811:190e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.picussecurity.com/resource/blog/apt29-cozy-bear-evolution-techniques

Response headers

cf-cdnjs-via: cfworker/kv
content-encoding: br
cf-cache-status: HIT
etag: "603e8adc-15d9d"
age: 49294
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=dhMpWUpVRDzlkuS7ITlkNlXPBijDYR7iLz4yrlmC2w0IVtEVyfB8ZUkDgQJ2Hy2XSJfgeLoHZnZxW%2FvH3%2BwQrgeUlqbL%2FJp3JDPwtxyKzme3se8cr2HrEc8HeWsJDciKtVami9QB6SQCT5TlqRBJfy%2Fa"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
expires: Wed, 07 Jan 2026 08:50:30 GMT
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Fri, 17 Jan 2025 08:50:30 GMT
content-type: application/javascript; charset=utf-8
last-modified: Tue, 02 Mar 2021 18:58:36 GMT
vary: Accept-Encoding
priority: u=1,i=?0
strict-transport-security: max-age=15780000
cache-control: public, max-age=30672000
timing-allow-origin: *
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
cross-origin-resource-policy: cross-origin
cf-ray: 9035191caa6edbe8-FRA
accept-ranges: bytes
access-control-allow-origin: *
content-length: 27938
server: cloudflare

GET
H3 200 jquery-migrate.min.js Show response
cdnjs.cloudflare.com/ajax/libs/jquery-migrate/3.3.2/ 11 KB
4 KB 81ms
53ms Script
application/javascript 2606:4700::6811:190e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/jquery-migrate/3.3.2/jquery-migrate.min.js

Requested by

Host: www.picussecurity.com
URL: https://www.picussecurity.com/resource/blog/apt29-cozy-bear-evolution-techniques

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6811:190e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

106fcd8d723eda7d92a26893a439ccef998e5fc68ad228253607143d801e8cd8

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.picussecurity.com/resource/blog/apt29-cozy-bear-evolution-techniques

Response headers

cf-cdnjs-via: cfworker/kv
content-encoding: br
cf-cache-status: HIT
etag: "5fb4701e-2c03"
age: 41527
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=kZzl09EbZR3J3%2BK%2B48ErZaN5sxlNSO2bOtNmwlphHXshVIlQ5PvMOiXbBjK1dPVFUdaFp0T%2F5jx8iu0ddJjTtXkDLxklvxdOtZrTgsVG5TFna8TlDNSVx9k6tFG5BFM7IKXEuckDQ4bDcPvcRDg%2FB9mj"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
expires: Wed, 07 Jan 2026 08:50:30 GMT
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Fri, 17 Jan 2025 08:50:30 GMT
content-type: application/javascript; charset=utf-8
last-modified: Wed, 18 Nov 2020 00:51:42 GMT
vary: Accept-Encoding
priority: u=1,i=?0
strict-transport-security: max-age=15780000
cache-control: public, max-age=30672000
timing-allow-origin: *
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
cross-origin-resource-policy: cross-origin
cf-ray: 9035191caa6fdbe8-FRA
accept-ranges: bytes
access-control-allow-origin: *
content-length: 3718
server: cloudflare

GET
H2 200 67ab0ee7-fcba-400b-8cb3-db7bb1cc0033.css
p.visitorqueue.com/styles/ 0
117 B 520ms
120ms Stylesheet
text/css 15.157.148.248
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://p.visitorqueue.com/styles/67ab0ee7-fcba-400b-8cb3-db7bb1cc0033.css
Requested by: Host: www.picussecurity.com
URL: https://www.picussecurity.com/resource/blog/apt29-cozy-bear-evolution-techniques
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 15.157.148.248 Montreal, Canada, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-15-157-148-248.ca-central-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.picussecurity.com/resource/blog/apt29-cozy-bear-evolution-techniques

Response headers

access-control-request-method: *
access-control-allow-origin: *
content-length: 0
date: Fri, 17 Jan 2025 08:50:30 GMT
content-type: text/css
access-control-allow-headers: *

GET
H3 200 light_logo-original-SVG.svg
www.picussecurity.com/hubfs/ 3 KB
3 KB 47ms
47ms Image
image/svg+xml 2606:2c40::c73c:67e3
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.picussecurity.com/hubfs/light_logo-original-SVG.svg

Requested by

Host: www.picussecurity.com
URL: https://www.picussecurity.com/resource/blog/apt29-cozy-bear-evolution-techniques

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:2c40::c73c:67e3 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare London, LLC, US),

Reverse DNS

Software

cloudflare /

Resource Hash

21036da1013e88ad1be39946746a916786b081557a7a72b6a194c153c175aa59

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.picussecurity.com/resource/blog/apt29-cozy-bear-evolution-techniques

Response headers

x-robots-tag: all
content-encoding: br
cf-cache-status: HIT
etag: W/"48ed4add03225d471676e998d8262bb9"
age: 239799
cache-tag: F-75149788735,P-7048931,FLS-ALL
x-amz-version-id: 2bbLkTbvsvFQW3gHMJyxn2VjG1fJz2sZ
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=svWU8Q05CjTf0CMzsdOlT4Xmeo167FnRNh2Ye%2FSOgwHFYOJXr4ZMOEd7ndN7Tg17A5AJrUbgoe2YCXAjx79owE64MPDm%2FuJXWkdwwv%2B3ugyTLCvuPA186Ty%2BI3mTs%2Ba%2FYwhiyppBww4bcdpcPF%2Bo4orVrg%3D%3D"}],"group":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
x-cache: RefreshHit from cloudfront
x-amz-cf-id: EoTsGw5WAOP5EzHLQYlsQop3rxofGAvaxQTOTk4ZDBNdqFvkxoUWsQ==
content-type: image/svg+xml
last-modified: Thu, 21 Mar 2024 08:53:36 GMT
priority: u=3,i
server-timing: cfExtPri
x-amz-meta-index-tag: all
x-amz-replication-status: COMPLETED
edge-cache-tag: F-75149788735,P-7048931,FLS-ALL
cache-control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900
x-amz-request-id: VTJZFE38S5CGZ0AK
x-hs-cf-lambda-enforce: us-east-1.EnforceAclForReads 3
x-amz-meta-cache-tag: F-75149788735,P-7048931,FLS-ALL
x-hs-alternate-content-type: text/plain
server: cloudflare
x-hs-cf-lambda: us-east-1.EnforceAclForReads 3
x-amz-server-side-encryption: AES256
access-control-allow-methods: GET
x-amz-storage-class: INTELLIGENT_TIERING
date: Fri, 17 Jan 2025 08:50:30 GMT
vary: Accept-Encoding
x-amz-id-2: +9+1PXCS2Mzr6WxpAD4XecXBWDsjXvMBFdMfQ4R/EZX9BqhPDBoATQu/hgPH+bT4PNHGQhqpQcs=
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-amz-meta-access-tag: public-indexable
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
timing-allow-origin: d8fk70yj6xfhx.cloudfront.net
via: 1.1 1903071a927324e2fb28199ee96c4bb2.cloudfront.net (CloudFront)
cf-ray: 9035191f0e902c2e-FRA
access-control-allow-origin: *
x-amz-cf-pop: FRA60-P7
x-amz-meta-created-unix-time-millis: 1654140894047

GET
H3 200 report%20(1).svg
www.picussecurity.com/hubfs/ 5 KB
3 KB 58ms
57ms Image
image/svg+xml 2606:2c40::c73c:67e3
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.picussecurity.com/hubfs/report%20(1).svg

Requested by

Host: www.picussecurity.com
URL: https://www.picussecurity.com/resource/blog/apt29-cozy-bear-evolution-techniques

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:2c40::c73c:67e3 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare London, LLC, US),

Reverse DNS

Software

cloudflare /

Resource Hash

cf773224fb7b3fd5978d7b527d003387334f71f37ed57e9ea50fe7b9bf4d6a76

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.picussecurity.com/resource/blog/apt29-cozy-bear-evolution-techniques

Response headers

x-robots-tag: all
content-encoding: br
cf-cache-status: HIT
etag: W/"9e7e94a90a4311547fb36c1f1dd7ef9c"
age: 239801
cache-tag: F-162786143818,P-7048931,FLS-ALL
x-amz-version-id: .CzJW_cs2EkiJ0JohZpoME2Kp1Jni00a
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=sSIHSYdI8Hta%2BgW85v9uqYzlRfI20Ex27aALlvLfPd7HHAPjz%2FI6azo%2BTgmjbKyItySObmKb53lQKSBrMKWOUOtVkH3JyKNQnfVSf%2B2ez6kyUYKSmSRlnZFxGdLgy1KqbpTNVbkEgI6OzUY%2BTYR1e3IkHA%3D%3D"}],"group":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
x-cache: RefreshHit from cloudfront
x-amz-cf-id: 0_Jl2T0ddEvJVsUzNAqOpEQN_a88szMKJWs_mf7koMq9rrpephXGcg==
content-type: image/svg+xml
last-modified: Mon, 01 Apr 2024 11:45:25 GMT
priority: u=2,i
server-timing: cfExtPri
x-amz-meta-index-tag: all
x-amz-replication-status: COMPLETED
edge-cache-tag: F-162786143818,P-7048931,FLS-ALL
cache-control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900
x-amz-request-id: CDQYX584XGVJA92A
x-hs-cf-lambda-enforce: us-east-1.EnforceAclForReads 3
x-amz-meta-cache-tag: F-162786143818,P-7048931,FLS-ALL
x-hs-alternate-content-type: text/plain
server: cloudflare
x-hs-cf-lambda: us-east-1.EnforceAclForReads 3
x-amz-server-side-encryption: AES256
access-control-allow-methods: GET
x-amz-storage-class: INTELLIGENT_TIERING
date: Fri, 17 Jan 2025 08:50:30 GMT
vary: Accept-Encoding
x-amz-id-2: b4ZMrHkOde9BXFS2G6C5O6D4GG8iDRATS1hmMNoVTm1RsrOXFhFeT3n5sCQ4ZhW51++UBGbgeaA=
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-amz-meta-access-tag: public-indexable
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
timing-allow-origin: d8fk70yj6xfhx.cloudfront.net
via: 1.1 6ca8e27dbbf453f10039db7154486394.cloudfront.net (CloudFront)
cf-ray: 9035191c9ca52c2e-FRA
access-control-allow-origin: *
x-amz-cf-pop: FRA60-P7
x-amz-meta-created-unix-time-millis: 1711971924316

GET
H3 200 white%20paper.svg
www.picussecurity.com/hubfs/2023%20-%20Optimization/logos/menu-featured/ 2 KB
2 KB 70ms
70ms Image
image/svg+xml 2606:2c40::c73c:67e3
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.picussecurity.com/hubfs/2023%20-%20Optimization/logos/menu-featured/white%20paper.svg

Requested by

Host: www.picussecurity.com
URL: https://www.picussecurity.com/resource/blog/apt29-cozy-bear-evolution-techniques

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:2c40::c73c:67e3 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare London, LLC, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a3ca2178c03aa90413665605224901388a8a7694be710ccf31d1c9546f6bb558

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.picussecurity.com/resource/blog/apt29-cozy-bear-evolution-techniques

Response headers

x-robots-tag: all
content-encoding: br
cf-cache-status: HIT
etag: W/"66405d9753202d06b0b9b8c0731c122e"
age: 239801
cache-tag: F-162784353194,FD-162786929972,P-7048931,FLS-ALL
x-amz-version-id: qKWviCmcUVpCSakC.wZPgGk71W9rF9zO
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=f3OpPmZ%2BvUgHW%2FENNRwY7X2FVYaWZINeJEMAcMNvVMkXRsN4krfa0Kt40w6ary0W%2F7xwn4badTtnm0FXMsu%2FAdouTJiovaVK2mSXOaKO9RtMrlU67pxUObucH6xye7CMWtbE6RGtwtXk%2BkCoMdp6USa61g%3D%3D"}],"group":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
x-cache: Miss from cloudfront
x-amz-cf-id: Er696uqik-vFJ2IAk7AwU5hFH7YSmFwtf_hTUS-4j1JFBdYusYMCLQ==
content-type: image/svg+xml
last-modified: Mon, 01 Apr 2024 12:08:04 GMT
priority: u=2,i
server-timing: cfExtPri
x-amz-meta-index-tag: all
x-amz-replication-status: COMPLETED
edge-cache-tag: F-162784353194,FD-162786929972,P-7048931,FLS-ALL
cache-control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900
x-amz-request-id: 5QQ11R8SZ1AJSXRD
x-hs-cf-lambda-enforce: us-east-1.EnforceAclForReads 3
x-amz-meta-cache-tag: F-162784353194,FD-162786929972,P-7048931,FLS-ALL
x-hs-alternate-content-type: text/plain
server: cloudflare
x-hs-cf-lambda: us-east-1.EnforceAclForReads 3
x-amz-server-side-encryption: AES256
access-control-allow-methods: GET
x-amz-storage-class: INTELLIGENT_TIERING
date: Fri, 17 Jan 2025 08:50:30 GMT
vary: Accept-Encoding
x-amz-id-2: giSErgFn25UDh2L1VD0k2AQKsPIJ6PgkpTlYbZxJJshhlE/050gahI7M23oDw0kzGdAt3+wxbLU=
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-amz-meta-access-tag: public-indexable
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
timing-allow-origin: d8fk70yj6xfhx.cloudfront.net
via: 1.1 d8006f736d3dc32a20a91813f2f50fa2.cloudfront.net (CloudFront)
cf-ray: 9035191c9ca72c2e-FRA
access-control-allow-origin: *
x-amz-cf-pop: FRA60-P7
x-amz-meta-created-unix-time-millis: 1711973283545

GET
H3 200 Group.svg
www.picussecurity.com/hubfs/2023%20-%20Optimization/ 2 KB
2 KB 64ms
63ms Image
image/svg+xml 2606:2c40::c73c:67e3
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.picussecurity.com/hubfs/2023%20-%20Optimization/Group.svg

Requested by

Host: www.picussecurity.com
URL: https://www.picussecurity.com/resource/blog/apt29-cozy-bear-evolution-techniques

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:2c40::c73c:67e3 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare London, LLC, US),

Reverse DNS

Software

cloudflare /

Resource Hash

228f08d7d79b9a75e9df18997ee260c139fe2d538924d5f05037e047d3f41d38

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.picussecurity.com/resource/blog/apt29-cozy-bear-evolution-techniques

Response headers

x-robots-tag: all
content-encoding: br
cf-cache-status: HIT
etag: W/"8f574252daab27008baf3457366fe0bc"
age: 239800
cache-tag: F-161968113191,FD-106424384934,P-7048931,FLS-ALL
x-amz-version-id: Y4m6PvMsT0hDs0VfCSSE5aTeXjUonr7R
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=jcXXa9fOqd9mBppE5Ml5UOGtbhmX%2F4wMHeaV3xnJ8IxfUFusyV%2B7LWiwYiuohqghdeutaElQsKd4eDblxxk5nQ%2BFCFUKNi6cHujHCLfKcSD7sA78QElW49aMZ%2FmQVVhlYoHc5j8Op3nzaFhHJLWbT1B%2FVw%3D%3D"}],"group":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
x-cache: Miss from cloudfront
x-amz-cf-id: Ka4bqrxNSzLPtCzAk0WlYxsGC073s__uVOx2Dxsl9jZTxoTEAWZbqQ==
content-type: image/svg+xml
last-modified: Mon, 25 Mar 2024 09:47:07 GMT
priority: u=2,i
server-timing: cfExtPri
x-amz-meta-index-tag: all
x-amz-replication-status: COMPLETED
edge-cache-tag: F-161968113191,FD-106424384934,P-7048931,FLS-ALL
cache-control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900
x-amz-request-id: WCXHRSXMWTE6AXA0
x-hs-cf-lambda-enforce: us-east-1.EnforceAclForReads 3
x-amz-meta-cache-tag: F-161968113191,FD-106424384934,P-7048931,FLS-ALL
x-hs-alternate-content-type: text/plain
server: cloudflare
x-hs-cf-lambda: us-east-1.EnforceAclForReads 3
x-amz-server-side-encryption: AES256
access-control-allow-methods: GET
x-amz-storage-class: INTELLIGENT_TIERING
date: Fri, 17 Jan 2025 08:50:30 GMT
vary: Accept-Encoding
x-amz-id-2: 1rlE927gK+3hP2Umr1m3Wi2LDoHf04++GMbvKuSq14VJNueWdcS0/A6CFAWFOiBCyxGusyVnwGo=
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-amz-meta-access-tag: public-indexable
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
timing-allow-origin: d8fk70yj6xfhx.cloudfront.net
via: 1.1 6f4aa26c09fb9bb4d152519f44256a4c.cloudfront.net (CloudFront)
cf-ray: 9035191cfcee2c2e-FRA
access-control-allow-origin: *
x-amz-cf-pop: FRA60-P7
x-amz-meta-created-unix-time-millis: 1711360026267

GET
H3 200 Paper%20Icons.svg
www.picussecurity.com/hubfs/2023%20-%20Optimization/ 3 KB
3 KB 54ms
54ms Image
image/svg+xml 2606:2c40::c73c:67e3
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.picussecurity.com/hubfs/2023%20-%20Optimization/Paper%20Icons.svg

Requested by

Host: www.picussecurity.com
URL: https://www.picussecurity.com/resource/blog/apt29-cozy-bear-evolution-techniques

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:2c40::c73c:67e3 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare London, LLC, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e8762831ff219f8b76b3479d9ffb9da218a058d059993123584cdbb5da6c079b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.picussecurity.com/resource/blog/apt29-cozy-bear-evolution-techniques

Response headers

x-robots-tag: all
content-encoding: br
cf-cache-status: HIT
etag: W/"af898a1c995d79d5de9c5bbd71bda7b7"
age: 239800
cache-tag: F-161967644941,FD-106424384934,P-7048931,FLS-ALL
x-amz-version-id: G6aTXUudX1thnchIZCO_zEyjoyxJwiGR
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Ey%2FBWGxVB%2BtHxJViYXSiHp2vrxe%2FJk2p7DaliwPFchQ6iNrVfT7keuORpwBYOK06LsUYjEd7V3e7xqZ%2B2Yd2faWqPWcw4W%2FFsde9b0Kbs0vzxNOYghM2v24YHTMEiACin4QmDsvpVFWBsPQJ1%2F1hbLD8nQ%3D%3D"}],"group":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
x-cache: RefreshHit from cloudfront
x-amz-cf-id: TFJGwSe976TDRoNHNEGH01JEyAK98wzsQXYrZuxDe6ewxG028s8AvQ==
content-type: image/svg+xml
last-modified: Mon, 25 Mar 2024 09:51:40 GMT
priority: u=2,i
server-timing: cfExtPri
x-amz-meta-index-tag: all
x-amz-replication-status: COMPLETED
edge-cache-tag: F-161967644941,FD-106424384934,P-7048931,FLS-ALL
cache-control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900
x-amz-request-id: 5G40NKQAKD8R5PD0
x-hs-cf-lambda-enforce: us-east-1.EnforceAclForReads 3
x-amz-meta-cache-tag: F-161967644941,FD-106424384934,P-7048931,FLS-ALL
x-hs-alternate-content-type: text/plain
server: cloudflare
x-hs-cf-lambda: us-east-1.EnforceAclForReads 3
x-amz-server-side-encryption: AES256
access-control-allow-methods: GET
x-amz-storage-class: INTELLIGENT_TIERING
date: Fri, 17 Jan 2025 08:50:30 GMT
vary: Accept-Encoding
x-amz-id-2: YXCbxDYGfVsaYYVcYCj72fywoUQ03JHfVD+hRMLffYKcNs9Jg0EKXNzFxOu0FIh+2bKw4YaPv7/hCsJUQHzWSOnexwFIJ+oc
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-amz-meta-access-tag: public-indexable
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
timing-allow-origin: d8fk70yj6xfhx.cloudfront.net
via: 1.1 256cd380c9790a2b71d68709829caa18.cloudfront.net (CloudFront)
cf-ray: 9035191d0cfc2c2e-FRA
access-control-allow-origin: *
x-amz-cf-pop: FRA60-P7
x-amz-meta-created-unix-time-millis: 1711360299644

GET
H3 200 report%20(1).svg
www.picussecurity.com/hubfs/2023%20-%20Optimization/logos/menu-featured/ 5 KB
3 KB 51ms
50ms Image
image/svg+xml 2606:2c40::c73c:67e3
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.picussecurity.com/hubfs/2023%20-%20Optimization/logos/menu-featured/report%20(1).svg

Requested by

Host: www.picussecurity.com
URL: https://www.picussecurity.com/resource/blog/apt29-cozy-bear-evolution-techniques

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:2c40::c73c:67e3 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare London, LLC, US),

Reverse DNS

Software

cloudflare /

Resource Hash

cf773224fb7b3fd5978d7b527d003387334f71f37ed57e9ea50fe7b9bf4d6a76

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.picussecurity.com/resource/blog/apt29-cozy-bear-evolution-techniques

Response headers

x-robots-tag: all
content-encoding: br
cf-cache-status: HIT
etag: W/"9e7e94a90a4311547fb36c1f1dd7ef9c"
age: 239799
cache-tag: F-162786139288,FD-162786929972,P-7048931,FLS-ALL
x-amz-version-id: vLyxAfyxINwLbl8l.uvRN1DJ6FrzhUON
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=RjtDuLq1d%2BPiVcbCMnvRybFxuKVT6jFQ6sgHXBZXCcKYkv9w33YU5%2BQb2YVOGct3l%2Fa%2FYdd8HcgDEyA5NKMHcHhVQhgURq9t8Xhx%2FjRhLXdx9ehjR%2BoSGP2TGHJEcB31Va71dslq2lDt7cP1YV5vV2Gq%2Fw%3D%3D"}],"group":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
x-cache: RefreshHit from cloudfront
x-amz-cf-id: dZXb0zz4cqL9_AhiMM5qD4me1yYbxRJrhrSsB2953Xf2lpGsyIQpPA==
content-type: image/svg+xml
last-modified: Mon, 01 Apr 2024 12:08:04 GMT
priority: u=3,i
server-timing: cfExtPri
x-amz-meta-index-tag: all
x-amz-replication-status: COMPLETED
edge-cache-tag: F-162786139288,FD-162786929972,P-7048931,FLS-ALL
cache-control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900
x-amz-request-id: EHGD5986D4S30B35
x-hs-cf-lambda-enforce: us-east-1.EnforceAclForReads 3
x-amz-meta-cache-tag: F-162786139288,FD-162786929972,P-7048931,FLS-ALL
x-hs-alternate-content-type: text/plain
server: cloudflare
x-hs-cf-lambda: us-east-1.EnforceAclForReads 3
x-amz-server-side-encryption: AES256
access-control-allow-methods: GET
x-amz-storage-class: INTELLIGENT_TIERING
date: Fri, 17 Jan 2025 08:50:30 GMT
vary: Accept-Encoding
x-amz-id-2: sqaVyNACIlLDuPkPevdbYt4JHRUkyobZH9RT9ey7e/XBw5AFg1TTDp0ZeNGwcMM6N1HNt7ajqYI=
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-amz-meta-access-tag: public-indexable
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
timing-allow-origin: d8fk70yj6xfhx.cloudfront.net
via: 1.1 21f03f5333352c6494e837ba1b3bb6ce.cloudfront.net (CloudFront)
cf-ray: 9035191f5eca2c2e-FRA
access-control-allow-origin: *
x-amz-cf-pop: FRA60-P7
x-amz-meta-created-unix-time-millis: 1711973283596

GET
H3 200 webinar.svg
www.picussecurity.com/hubfs/2023%20-%20Optimization/logos/menu-featured/ 2 KB
2 KB 49ms
49ms Image
image/svg+xml 2606:2c40::c73c:67e3
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.picussecurity.com/hubfs/2023%20-%20Optimization/logos/menu-featured/webinar.svg

Requested by

Host: www.picussecurity.com
URL: https://www.picussecurity.com/resource/blog/apt29-cozy-bear-evolution-techniques

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:2c40::c73c:67e3 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare London, LLC, US),

Reverse DNS

Software

cloudflare /

Resource Hash

4071465b2c0223da0e296a2d9ed8fbec379caa2d8eccacf96113afa481d7714a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.picussecurity.com/resource/blog/apt29-cozy-bear-evolution-techniques

Response headers

x-robots-tag: all
content-encoding: br
cf-cache-status: HIT
etag: W/"1870d43d00ab230724e0509f1d40c007"
age: 239800
cache-tag: F-162787310732,FD-162786929972,P-7048931,FLS-ALL
x-amz-version-id: Wb4ah8A.92KNq.UjMkeG8TpLY3dVHhNK
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=RUIYwhZ4z64Op5S%2FoGxqDRG9moQxHcP2pzgw7MYt96nRvNjRKsD78pGwimGfcTNCogd08Y8JaNtQLuvkQWqhkVTquU7iPdjsSK3AmwsB3EJAIVza4RRADeZIvh3PB3WBr%2FmcGl50S9J5FuAEl0Qt6OFNTQ%3D%3D"}],"group":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
x-cache: RefreshHit from cloudfront
x-amz-cf-id: bWnoQJJL1ahY_31D7cRCjUeyPRZWh688gKyv6Rthkru1ggbKd-64-Q==
content-type: image/svg+xml
last-modified: Mon, 01 Apr 2024 12:08:04 GMT
priority: u=3,i
server-timing: cfExtPri
x-amz-meta-index-tag: all
x-amz-replication-status: COMPLETED
edge-cache-tag: F-162787310732,FD-162786929972,P-7048931,FLS-ALL
cache-control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900
x-amz-request-id: TM35QG9VXTE4NNDW
x-hs-cf-lambda-enforce: us-east-1.EnforceAclForReads 3
x-amz-meta-cache-tag: F-162787310732,FD-162786929972,P-7048931,FLS-ALL
x-hs-alternate-content-type: text/plain
server: cloudflare
x-hs-cf-lambda: us-east-1.EnforceAclForReads 3
x-amz-server-side-encryption: AES256
access-control-allow-methods: GET
x-amz-storage-class: INTELLIGENT_TIERING
date: Fri, 17 Jan 2025 08:50:31 GMT
vary: Accept-Encoding
x-amz-id-2: zLcs1emg+PVGOWe0Dhprkp6pCTLZQImofXUnflzPX3NMd4uKMEm6YH24w/mLUvRw+qtjouQBWAjKmauQhfragg==
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-amz-meta-access-tag: public-indexable
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
timing-allow-origin: d8fk70yj6xfhx.cloudfront.net
via: 1.1 85b175d782816d34ed73f9ca030bf062.cloudfront.net (CloudFront)
cf-ray: 9035191fbef92c2e-FRA
access-control-allow-origin: *
x-amz-cf-pop: FRA60-P7
x-amz-meta-created-unix-time-millis: 1711973283530

GET
H3 200 Data%20sheet.svg
www.picussecurity.com/hubfs/2023%20-%20Optimization/logos/menu-featured/ 2 KB
2 KB 51ms
51ms Image
image/svg+xml 2606:2c40::c73c:67e3
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.picussecurity.com/hubfs/2023%20-%20Optimization/logos/menu-featured/Data%20sheet.svg

Requested by

Host: www.picussecurity.com
URL: https://www.picussecurity.com/resource/blog/apt29-cozy-bear-evolution-techniques

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:2c40::c73c:67e3 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare London, LLC, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0d24d7930883c81a956a8d25026d6befdf264a901da8570a7fa27b6db580c2bf

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.picussecurity.com/resource/blog/apt29-cozy-bear-evolution-techniques

Response headers

x-robots-tag: all
content-encoding: br
cf-cache-status: HIT
etag: W/"2978bb799a23d124f5407472f883155a"
age: 239800
cache-tag: F-162787304607,FD-162786929972,P-7048931,FLS-ALL
x-amz-version-id: aGCl_khANGAehik.SERmQr2ajrV713hJ
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=E2Fo1vz2HmoYocp72cUFVzw19UCSreGz4IMytGkCi3KyxsWIPLye%2BNgEWWDWMH06qALbdkBmAf2PAsr%2FWB4ntovJBfTrgCz8P70WTWOgNNAF568L%2BrH9SdbqKfPt72YpCM%2BD38YRaeCs9W5yZDwzvpdwIw%3D%3D"}],"group":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
x-cache: RefreshHit from cloudfront
x-amz-cf-id: 4_rzLkcRVxSs42gK9YRCZ_DWzoffAXDHnO6f835930arqKxH_qANkQ==
content-type: image/svg+xml
last-modified: Mon, 01 Apr 2024 12:08:04 GMT
priority: u=3,i
server-timing: cfExtPri
x-amz-meta-index-tag: all
x-amz-replication-status: COMPLETED
edge-cache-tag: F-162787304607,FD-162786929972,P-7048931,FLS-ALL
cache-control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900
x-amz-request-id: 5DD31F0ZX348XQEA
x-hs-cf-lambda-enforce: us-east-1.EnforceAclForReads 3
x-amz-meta-cache-tag: F-162787304607,FD-162786929972,P-7048931,FLS-ALL
x-hs-alternate-content-type: text/plain
server: cloudflare
x-hs-cf-lambda: us-east-1.EnforceAclForReads 3
x-amz-server-side-encryption: AES256
access-control-allow-methods: GET
x-amz-storage-class: INTELLIGENT_TIERING
date: Fri, 17 Jan 2025 08:50:31 GMT
vary: Accept-Encoding
x-amz-id-2: pRqDOhsqRUawkn0cW7UH9s0JFiXEUumXSa7v1GmKQTvO4dbJDfnyvvGHn+GvyMt1sg2UhX/Pgnk=
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-amz-meta-access-tag: public-indexable
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
timing-allow-origin: d8fk70yj6xfhx.cloudfront.net
via: 1.1 7a6b4cd1254095c5b4b5ec2c3af1870a.cloudfront.net (CloudFront)
cf-ray: 9035191fcf152c2e-FRA
access-control-allow-origin: *
x-amz-cf-pop: FRA60-P7
x-amz-meta-created-unix-time-millis: 1711973283543

GET
H3 200 main.min.js Show response
www.picussecurity.com/hs-fs/hub/7048931/hub_generated/template_assets/32300259976/1729690095644/Shield/js/ 3 KB
3 KB 43ms
43ms Script
application/javascript 2606:2c40::c73c:67e3
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.picussecurity.com/hs-fs/hub/7048931/hub_generated/template_assets/32300259976/1729690095644/Shield/js/main.min.js

Requested by

Host: www.picussecurity.com
URL: https://www.picussecurity.com/resource/blog/apt29-cozy-bear-evolution-techniques

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:2c40::c73c:67e3 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare London, LLC, US),

Reverse DNS

Software

cloudflare /

Resource Hash

fe6ee10b03114d58ae3552f76f67608965f961c9d2743a003b3c8da7e5ff4f7c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.picussecurity.com/resource/blog/apt29-cozy-bear-evolution-techniques

Response headers

x-request-id: 18a37960-d131-40ec-94f1-25a57e4d9565
content-encoding: br
cf-cache-status: HIT
etag: W/"4042981d0fd53bd731911bfb42a40b61"
age: 3462
x-amz-version-id: ePExGe_G5Tnc9w7AEPf3KqlYIIH7Mdzl
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=B6D1AFIkOwbyh13fQuOpcW%2B6uaw33Ap38zMXSlnYxBL2%2B%2FHlWX7sB9G4q9r7AoHEmdjADGhef2PfqWuB85fnuhXjRePJ9tXOfEjdYonS1rLIywvguh8%2FeHSYZNEK%2Fkc%2BRbsX2Kp7unrOix7JquSUY8YRAw%3D%3D"}],"group":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
x-cache: Miss from cloudfront
x-evy-trace-listener: listener_https
x-amz-cf-id: VmxUcJgE8DHFVDZIQOEovAV060bh0c68jfwYU1pfxWTmQB_Tkl4-2w==
x-hubspot-correlation-id: 18a37960-d131-40ec-94f1-25a57e4d9565
content-type: application/javascript; charset=utf-8
last-modified: Wed, 23 Oct 2024 13:28:16 GMT
priority: u=2,i=?0
server-timing: cfExtPri
x-amz-replication-status: COMPLETED
x-evy-trace-route-service-name: envoyset-translator
cache-control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900,s-maxage=31536000, max-age=31536000
x-evy-trace-served-by-pod: iad02/cms-hubfs-td/envoy-proxy-6548769dcd-wg65f
x-envoy-upstream-service-time: 254
x-amz-request-id: Y4F11VS56MEMXG6Q
x-hs-cf-lambda-enforce: us-east-1.EnforceAclForReads 3
x-hs-alternate-content-type: text/plain
server: cloudflare
x-evy-trace-virtual-host: all
x-hs-cf-lambda: us-east-1.EnforceAclForReads 3
x-amz-server-side-encryption: AES256
x-amz-storage-class: INTELLIGENT_TIERING
date: Fri, 17 Jan 2025 08:50:30 GMT
vary: origin, Accept-Encoding
x-amz-id-2: MqHy3wq6H/csPclq3chpNgyMQ9rvikz249d5eDTb+59A/JnC09gj2hyqoCCue69DdTt9W17GzdY=
strict-transport-security: max-age=31536000; includeSubDomains; preload
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
timing-allow-origin: www.picussecurity.com
access-control-allow-credentials: false
via: 1.1 b4346add631a498bf6cdbf88cbc5ff12.cloudfront.net (CloudFront)
cf-ray: 9035191d6d4d2c2e-FRA
x-evy-trace-route-configuration: listener_https/all
x-amz-cf-pop: IAD89-C1
x-amz-meta-created-unix-time-millis: 1729690095835

GET
H3 200 slick.min.js Show response
www.picussecurity.com/hubfs/ 42 KB
12 KB 47ms
46ms Script
application/javascript 2606:2c40::c73c:67e3
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.picussecurity.com/hubfs/slick.min.js

Requested by

Host: www.picussecurity.com
URL: https://www.picussecurity.com/resource/blog/apt29-cozy-bear-evolution-techniques

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:2c40::c73c:67e3 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare London, LLC, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0c7178cc6ca34fb18e30f070a5e7a1c287b2d7ccfcba2cfdf06e0f46eda55740

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.picussecurity.com/resource/blog/apt29-cozy-bear-evolution-techniques

Response headers

x-robots-tag: all
content-encoding: br
cf-cache-status: HIT
etag: W/"d5a61c749e44e47159af8a6579dda121"
age: 239800
cache-tag: F-88670129552,P-7048931,FLS-ALL
x-amz-version-id: rscA3GqdMhf_6Xt5rKM52hFVPQ.2lsXw
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=o6YMK6wu4FiaFqmH5InFysi7vSlw345a32ThpCGPxmi1tmazJWg6LS8IEx3YE82QOsASbQFho1Cg7lk7FFYehpnBD%2F0QfIRt9zmSt0T%2FboFRl7ScLi%2Fg4giBmKqDj%2BjhJirqEtHdhAX8yb98H8Vx4o5MRA%3D%3D"}],"group":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
x-cache: RefreshHit from cloudfront
x-amz-cf-id: YzjQCmIPsRp_jyWWQ3rtvpL--TXS1B66Mn5Ef4tI7FTyG7P-RXwLkw==
content-type: application/javascript
last-modified: Wed, 19 Oct 2022 07:03:01 GMT
priority: u=2,i=?0
server-timing: cfExtPri
x-amz-meta-index-tag: all
x-amz-replication-status: COMPLETED
edge-cache-tag: F-88670129552,P-7048931,FLS-ALL
cache-control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900
x-amz-request-id: KY9Y24871XT3G410
x-hs-cf-lambda-enforce: us-east-1.EnforceAclForReads 3
x-amz-meta-cache-tag: F-88670129552,P-7048931,FLS-ALL
x-hs-alternate-content-type: text/plain
server: cloudflare
x-hs-cf-lambda: us-east-1.EnforceAclForReads 3
x-amz-server-side-encryption: AES256
access-control-allow-methods: GET
x-amz-storage-class: INTELLIGENT_TIERING
date: Fri, 17 Jan 2025 08:50:30 GMT
vary: Accept-Encoding
x-amz-id-2: uonBOxGLTzKZ1brTAd1OAgFfnDbbAtG6oVH9ayQvAo2qqdAyVVNKuX/cTEPLF8frmtRtWQ0wfBk=
strict-transport-security: max-age=31536000; includeSubDomains; preload
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
timing-allow-origin: d8fk70yj6xfhx.cloudfront.net
via: 1.1 21f03f5333352c6494e837ba1b3bb6ce.cloudfront.net (CloudFront)
cf-ray: 9035191d6d552c2e-FRA
access-control-allow-origin: *
x-amz-cf-pop: FRA60-P7
x-amz-meta-created-unix-time-millis: 1666162980835

GET
H3 200 module_Mega_Menu_24.min.js Show response
www.picussecurity.com/hubfs/hub_generated/module_assets/1/161965429884/1736339641673/ 3 KB
2 KB 48ms
48ms Script
application/javascript 2606:2c40::c73c:67e3
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.picussecurity.com/hubfs/hub_generated/module_assets/1/161965429884/1736339641673/module_Mega_Menu_24.min.js

Requested by

Host: www.picussecurity.com
URL: https://www.picussecurity.com/resource/blog/apt29-cozy-bear-evolution-techniques

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:2c40::c73c:67e3 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare London, LLC, US),

Reverse DNS

Software

cloudflare /

Resource Hash

4033cfc5f5d8742d9b7bbafabdc19c999daa2cecc5ac9895fb820fa76b6749fc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.picussecurity.com/resource/blog/apt29-cozy-bear-evolution-techniques

Response headers

x-robots-tag: none
content-encoding: br
cf-cache-status: HIT
etag: W/"a244d3a73aadf9c5b235d8f4656a8f0b"
age: 239800
cache-tag: F-184656915459,FD-184658675500,P-7048931,FLS-ALL
x-amz-version-id: EbD2cxkEKJbwfoIz9cafE6E.LshQ1l_A
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=gpmNaDPVgpHdugElIjWMZ8udhZJ%2BZktP3dDbEWUbUx%2BDTmBgGcibVVLtxiCMsPu1BJ0eBfgfmaeWr0weny37bq6sLA91ngBi9fRz6NgaMN%2BrrHQ33TKmtGdoVYsHMSiiOT4MZ57tMYl%2B4B8bNrgqYI3lGA%3D%3D"}],"group":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
x-cache: Miss from cloudfront
x-amz-cf-id: lrgpGmgVX_84BqkB2a_4BzQ1NwI4eeMAK_xHJq_9B4TG2gt43LHIdw==
content-type: application/javascript
last-modified: Wed, 08 Jan 2025 12:34:02 GMT
priority: u=2,i=?0
server-timing: cfExtPri
x-amz-meta-index-tag: none
x-amz-replication-status: COMPLETED
edge-cache-tag: F-184656915459,FD-184658675500,P-7048931,FLS-ALL
cache-control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900
x-amz-request-id: WCXJSWVE7E5E83VF
x-hs-cf-lambda-enforce: us-east-1.EnforceAclForReads 3
x-amz-meta-cache-tag: F-184656915459,FD-184658675500,P-7048931,FLS-ALL
x-hs-alternate-content-type: text/plain
server: cloudflare
x-hs-cf-lambda: us-east-1.EnforceAclForReads 3
x-amz-server-side-encryption: AES256
access-control-allow-methods: GET
x-amz-storage-class: INTELLIGENT_TIERING
date: Fri, 17 Jan 2025 08:50:30 GMT
vary: Accept-Encoding
x-amz-id-2: ErrJG1y2svp4UjaiQH1bHBrtj0AJaSTiavau2ueK3VGzZj/hG7p1oJ1josoH7Ftzi+CP754kJaw=
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-amz-meta-access-tag: public-not-indexable
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
timing-allow-origin: d8fk70yj6xfhx.cloudfront.net
via: 1.1 0833e8be76641de099b8f4a92c7a1c4e.cloudfront.net (CloudFront)
cf-ray: 9035191dad7a2c2e-FRA
access-control-allow-origin: *
x-amz-cf-pop: FRA60-P7
x-amz-meta-created-unix-time-millis: 1736339641959

GET
H2 200 web-interactives-embed.js Show response
js.hubspot.com/ 84 KB
25 KB 88ms
34ms Script
application/javascript 2606:4700::6810:7674
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://js.hubspot.com/web-interactives-embed.js

Requested by

Host: www.picussecurity.com
URL: https://www.picussecurity.com/resource/blog/apt29-cozy-bear-evolution-techniques

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7674 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a380a9a7fc676bef053e1f3716b212719e3dd4ced09cf58bd961f8903908bbaa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.picussecurity.com/resource/blog/apt29-cozy-bear-evolution-techniques

Response headers

x-request-id: 1e75f8de-ee5a-436e-b154-70e7b1cdb399
content-encoding: gzip
cf-cache-status: HIT
etag: W/"e731b6707eb6368e593abb6df789d598"
x-amz-version-id: veS.SEia_QBkSUiCuPQ0GehGSVt5V.RX
cache-tag: staticjsapp-web-interactives-embed-web-prod,staticjsapp-prod
age: 239
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=5hBVxhRDSZeft%2BGGZcv0FPn0DOBAMi5JtreeGysMIavpQjGryNRpY62kG0EcIIo%2FvORgkQ8oxGHEMeALlCEBN%2FVdRImYK9MGYBAAE6nXRzxzM1oqeKTJm03vxjN5uTgDERCFvmFvBVo6UcUi"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
x-cache: Miss from cloudfront
x-evy-trace-listener: listener_https
x-amz-cf-id: Y1Ehr_g5qnDKOZQeX53KMRwgEyq9FVsDLnAJr-SVm0yX9NfjZC_yzg==
x-hubspot-correlation-id: 1e75f8de-ee5a-436e-b154-70e7b1cdb399
content-type: application/javascript; charset=utf-8
last-modified: Fri, 10 Jan 2025 11:59:29 UTC
x-amz-replication-status: COMPLETED
x-evy-trace-route-service-name: envoyset-translator
cache-control: max-age=600
x-evy-trace-served-by-pod: iad02/app-td/envoy-proxy-856d8787d5-t5rvw
x-envoy-upstream-service-time: 1
x-hs-target-asset: web-interactives-embed/static-2.2140/bundles/project.js
server: cloudflare
x-evy-trace-virtual-host: all
x-amz-server-side-encryption: AES256
x-hs-cache-status: HIT
date: Fri, 17 Jan 2025 08:50:31 GMT
vary: accept-encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
content-security-policy-report-only: frame-ancestors 'self'; report-uri https://send.hsbrowserreports.com/csp/report?resource=web-interactives-embed/static-2.2140/bundles/project.js&cfRay=8ffc8f3a5adf4c85-ARN
via: 1.1 76e55a2361219fb19722e949475d1844.cloudfront.net (CloudFront)
cf-ray: 9035192018d9dc59-FRA
access-control-allow-origin: *
x-evy-trace-route-configuration: listener_https/all
x-amz-cf-pop: IAD12-P3

GET
H3 200 template_header_height.min.js Show response
www.picussecurity.com/hubfs/hub_generated/template_assets/1/117283871284/1734698618665/ 1 KB
2 KB 47ms
46ms Script
application/javascript 2606:2c40::c73c:67e3
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.picussecurity.com/hubfs/hub_generated/template_assets/1/117283871284/1734698618665/template_header_height.min.js

Requested by

Host: www.picussecurity.com
URL: https://www.picussecurity.com/resource/blog/apt29-cozy-bear-evolution-techniques

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:2c40::c73c:67e3 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare London, LLC, US),

Reverse DNS

Software

cloudflare /

Resource Hash

101968119222fed85bc57fffcd41d002c8a073538faf936a6806c6a0ecc96508

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.picussecurity.com/resource/blog/apt29-cozy-bear-evolution-techniques

Response headers

x-robots-tag: none
content-encoding: br
cf-cache-status: HIT
etag: W/"d6b309cc0e5562fc0b680ca0e7acd979"
age: 239800
cache-tag: F-184124443510,FD-184125808252,P-7048931,FLS-ALL
x-amz-version-id: MTme1A77YKiCQXj0u_Nuxs7JanOnZLFP
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=z2MBzVa8J%2B0O8oDrmGB5uQSRfZKuCiLh3HsQhi8l6C4kujNeAbHqzivoDLPgzh%2Bw3Ql5pp%2FPZrqcWsCrZiS02jrRI4ilYEU%2FJItdnB%2F80zUEiGvpNKZFIpOIu59nAsmbnOCVKpJfcUUdTPaZ4n6B0iJxeA%3D%3D"}],"group":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
x-cache: RefreshHit from cloudfront
x-amz-cf-id: kC2zcXac3xn0r4pXqgNXZcWnxd_7O9uNEUidfWxGqX5whn56GZFnwQ==
content-type: application/javascript
last-modified: Fri, 20 Dec 2024 12:43:40 GMT
priority: u=2,i=?0
server-timing: cfExtPri
x-amz-meta-index-tag: none
x-amz-replication-status: COMPLETED
edge-cache-tag: F-184124443510,FD-184125808252,P-7048931,FLS-ALL
cache-control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900
x-amz-request-id: VTJTNQ03VFSMKQTZ
x-hs-cf-lambda-enforce: us-east-1.EnforceAclForReads 3
x-amz-meta-cache-tag: F-184124443510,FD-184125808252,P-7048931,FLS-ALL
x-hs-alternate-content-type: text/plain
server: cloudflare
x-hs-cf-lambda: us-east-1.EnforceAclForReads 3
x-amz-server-side-encryption: AES256
access-control-allow-methods: GET
x-amz-storage-class: INTELLIGENT_TIERING
date: Fri, 17 Jan 2025 08:50:30 GMT
vary: Accept-Encoding
x-amz-id-2: wR10GnKfpbFv4wAhMgfHIuy6PX8QFElo0OeBIcyhZ6+Cs+5Sg4WjufJmBD8qLvzfT2430esdJFnrpQ6CXjNt4i8IN+0uUwHLfK24Oo6neEU=
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-amz-meta-access-tag: public-not-indexable
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
timing-allow-origin: d8fk70yj6xfhx.cloudfront.net
via: 1.1 3e28473376ca49b2cafcfef86a39cf34.cloudfront.net (CloudFront)
cf-ray: 9035191dbd832c2e-FRA
access-control-allow-origin: *
x-amz-cf-pop: FRA60-P7
x-amz-meta-created-unix-time-millis: 1734698619078

GET
H3 200 main-blog.min.js Show response
www.picussecurity.com/hs-fs/hub/7048931/hub_generated/template_assets/158844553760/1727782857967/Shield/templates/partials/blog-post-layouts/js/ 2 KB
2 KB 47ms
47ms Script
application/javascript 2606:2c40::c73c:67e3
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.picussecurity.com/hs-fs/hub/7048931/hub_generated/template_assets/158844553760/1727782857967/Shield/templates/partials/blog-post-layouts/js/main-blog.min.js

Requested by

Host: www.picussecurity.com
URL: https://www.picussecurity.com/resource/blog/apt29-cozy-bear-evolution-techniques

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:2c40::c73c:67e3 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare London, LLC, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7c2591f422aa5cfb1f8bf00a5db7c9407e81037dbeaf22b2e8a791e56468cdf3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.picussecurity.com/resource/blog/apt29-cozy-bear-evolution-techniques

Response headers

x-request-id: 89acd324-244f-44ba-bc11-f20d3d9dd5b6
content-encoding: br
cf-cache-status: HIT
etag: W/"8f1dca59f4a10730aace2d8c45529cab"
age: 692
x-amz-version-id: QZiKZKg8tx7TF06UX1gXrwkYWSUUQRrD
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=PPFkMMeG9C2dKtjqcYFzJ9qnNnzaZb6HM%2FM56fUl6KaBBSxkd9M6txrqmMDWy1SQGtobeHyDWTleiu7BJsTHpLrLsXh4fEVQd1QjyITTt2O8UGemMUN5ZFMD2bZJhUOI8HzGUwS0ygWTrT5S7hWMyHkK0Q%3D%3D"}],"group":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
x-cache: RefreshHit from cloudfront
x-evy-trace-listener: listener_https
x-amz-cf-id: zy7wFAWZDfUj-SPDkNLPuJdyyZgf5PpiWF10Qa3aErLc25L8YOfhKg==
x-hubspot-correlation-id: 89acd324-244f-44ba-bc11-f20d3d9dd5b6
content-type: application/javascript; charset=utf-8
last-modified: Tue, 01 Oct 2024 11:40:59 GMT
priority: u=2,i=?0
server-timing: cfExtPri
x-amz-replication-status: COMPLETED
x-evy-trace-route-service-name: envoyset-translator
cache-control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900,s-maxage=31536000, max-age=31536000
x-evy-trace-served-by-pod: iad02/cms-hubfs-td/envoy-proxy-5689dcb94b-4dllm
x-envoy-upstream-service-time: 271
x-amz-request-id: 55Y1H4ENSAQ99EG6
x-hs-cf-lambda-enforce: us-east-1.EnforceAclForReads 3
x-hs-alternate-content-type: text/plain
server: cloudflare
x-evy-trace-virtual-host: all
x-hs-cf-lambda: us-east-1.EnforceAclForReads 3
x-amz-server-side-encryption: AES256
x-amz-storage-class: INTELLIGENT_TIERING
date: Fri, 17 Jan 2025 08:50:30 GMT
vary: origin, Accept-Encoding
x-amz-id-2: KOKAkv/YJdnppEw2k8Oj/DwBuaVf7EXMq2fIMCJfW/RANdq0+c6U4iluQr6JIj3MQvcQGTsIivQ=
strict-transport-security: max-age=31536000; includeSubDomains; preload
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
timing-allow-origin: www.picussecurity.com
access-control-allow-credentials: false
via: 1.1 ea42f57e1e0a065bc1c1c637f97d3be4.cloudfront.net (CloudFront)
cf-ray: 9035191dfda02c2e-FRA
x-evy-trace-route-configuration: listener_https/all
x-amz-cf-pop: IAD61-P1
x-amz-meta-created-unix-time-millis: 1727782858138

GET
H3 200 slick.min.min.js Show response
www.picussecurity.com/hs-fs/hub/7048931/hub_generated/template_assets/32497563799/1619786241508/Shield/js/ 42 KB
12 KB 47ms
46ms Script
application/javascript 2606:2c40::c73c:67e3
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.picussecurity.com/hs-fs/hub/7048931/hub_generated/template_assets/32497563799/1619786241508/Shield/js/slick.min.min.js

Requested by

Host: www.picussecurity.com
URL: https://www.picussecurity.com/resource/blog/apt29-cozy-bear-evolution-techniques

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:2c40::c73c:67e3 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare London, LLC, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d875f9a2038e25a599452c9e774403240c3bc83df261ed41188bd7ecdf71fee0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.picussecurity.com/resource/blog/apt29-cozy-bear-evolution-techniques

Response headers

x-request-id: 1d517cda-9d5c-41e0-8f1f-63c8435005ec
content-encoding: br
cf-cache-status: HIT
etag: W/"a8efc8a1f019dce7f17886f4d81411ca"
age: 692
x-amz-version-id: ZPb_r_lrZScln9b_.gUpWD_pgBVu7aX9
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=icjncZrNpkCbl5yx0wKZgyfgTyxQmo3PrIEcxWEi3gLfWMQmTADz%2BLTqtbFAvXno%2FDW3U5bzlLJ9Mgde0tygWaJZMR5%2FHuH88e7jKqYEpG0twID%2BTqroaU%2BXpIaDKPTfygb38Qkue6uvsv%2FG6NBfALaGhA%3D%3D"}],"group":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
x-cache: RefreshHit from cloudfront
x-evy-trace-listener: listener_https
x-amz-cf-id: KOBsMO6ziE133ESaFEmgPmJ2tiNr-yaDbEs3mtKJYS678LyU_ZwCCw==
x-hubspot-correlation-id: 1d517cda-9d5c-41e0-8f1f-63c8435005ec
content-type: application/javascript; charset=utf-8
last-modified: Fri, 30 Apr 2021 12:37:23 GMT
priority: u=2,i=?0
server-timing: cfExtPri
x-amz-replication-status: COMPLETED
x-evy-trace-route-service-name: envoyset-translator
cache-control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900,s-maxage=31536000, max-age=31536000
x-evy-trace-served-by-pod: iad02/cms-hubfs-td/envoy-proxy-6548769dcd-9j2mb
x-envoy-upstream-service-time: 226
x-amz-request-id: 5F975ZM6TCVPJKNW
x-hs-cf-lambda-enforce: us-east-1.EnforceAclForReads 3
x-hs-alternate-content-type: text/plain
server: cloudflare
x-evy-trace-virtual-host: all
x-hs-cf-lambda: us-east-1.EnforceAclForReads 3
x-amz-server-side-encryption: AES256
date: Fri, 17 Jan 2025 08:50:30 GMT
vary: origin, Accept-Encoding
x-amz-id-2: C7R3fKUqKX713HYCiuqiC24Qm0AHhmkEJNyHHbiIkYr0dHK5NHmfQa8EJtTvCx/G+qXP47XdbuRLJYOEtaM04Og2ABSAFMaEM50ze3FYpCY=
strict-transport-security: max-age=31536000; includeSubDomains; preload
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
timing-allow-origin: www.picussecurity.com
access-control-allow-credentials: false
via: 1.1 148f45d892bd2198be5295012ed59888.cloudfront.net (CloudFront)
cf-ray: 9035191e0da62c2e-FRA
x-evy-trace-route-configuration: listener_https/all
x-amz-cf-pop: IAD89-C1
x-amz-meta-created-unix-time-millis: 1619786242195

GET
H3 200 7048931.js Show response
www.picussecurity.com/hs/scriptloader/ 3 KB
2 KB 54ms
54ms Script
application/javascript 2606:2c40::c73c:67e3
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.picussecurity.com/hs/scriptloader/7048931.js

Requested by

Host: www.picussecurity.com
URL: https://www.picussecurity.com/resource/blog/apt29-cozy-bear-evolution-techniques

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:2c40::c73c:67e3 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare London, LLC, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6f60518843c6c99881993a0720555e360fc858a898cfb20608f40c66511f4287

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.picussecurity.com/resource/blog/apt29-cozy-bear-evolution-techniques

Response headers

access-control-max-age: 3600
content-encoding: gzip
cf-cache-status: HIT
age: 77
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=3d%2BAoiyK23dQ1B9q0d5HYhbhOvAt4cMl%2B0U1OREUISOo8VYGRzwWO1ggZ%2By4ITnznfCgyNXY1e%2FbOdcUm3NWUIr8T%2Bl0aQQoShqHSfk9RoX%2FwI2HBhNIRnyS4%2B%2BVo2AcUp%2F5oTQ7LABAGPSnr1GojLUdDw%3D%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
expires: Fri, 17 Jan 2025 08:52:01 GMT
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Fri, 17 Jan 2025 08:50:31 GMT
x-hubspot-correlation-id: 150a58fc-3b14-4d3b-994f-62570794ac2d
content-type: application/javascript;charset=utf-8
last-modified: Fri, 17 Jan 2025 08:49:14 GMT
vary: origin, Accept-Encoding
priority: u=3,i=?0
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-security-policy: upgrade-insecure-requests
cache-control: public, max-age=90
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
access-control-allow-credentials: true
cf-ray: 9035191fcf1a2c2e-FRA
accept-ranges: bytes
access-control-allow-origin: https://www.picussecurity.com
content-length: 721
server: cloudflare

GET
H3 200 index.js Show response
www.picussecurity.com/hs/hsstatic/HubspotToolsMenu/static-1.393/js/ 12 KB
5 KB 50ms
50ms Script
application/javascript 2606:2c40::c73c:67e3
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.picussecurity.com/hs/hsstatic/HubspotToolsMenu/static-1.393/js/index.js

Requested by

Host: www.picussecurity.com
URL: https://www.picussecurity.com/resource/blog/apt29-cozy-bear-evolution-techniques

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:2c40::c73c:67e3 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare London, LLC, US),

Reverse DNS

Software

cloudflare /

Resource Hash

3515e02fe5788cfcd3d13d7475727a0ba88b9e1559c786e1fcbd2fe1b08452df

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.picussecurity.com/resource/blog/apt29-cozy-bear-evolution-techniques

Response headers

content-encoding: gzip
cf-cache-status: HIT
etag: W/"38c48c0bdf3aa4294312a4e7c912393a"
age: 1235508
x-amz-version-id: iUprcr56H7UHDrpFZ8T5GWiQCFjmxxUH
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=b21RMWne3EAUer%2BXD%2FDTIsyOUo4ENzYydUJBE6qEqnqqdyrBmWQAQhStgdCWjErQldM47vWpbuxwVf4Rx3JqdjBGf%2B6FZhWU%2FRfhU1LNK8w4SVwFxfYKpdqoAQiqL5P107Gcuo%2BSooYo03uRKnyWVcca5A%3D%3D"}],"group":"cf-nel","max_age":604800}
expires: Sat, 17 Jan 2026 08:50:31 GMT
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: J41TOd2ItX0pTLIv1WnR3MIaPZBTnsaEWoEgkG2ZFiQJEUDMNFfdIw==
date: Fri, 17 Jan 2025 08:50:31 GMT
content-type: application/javascript
last-modified: Fri, 20 Dec 2024 14:04:47 GMT
vary: accept-encoding
priority: u=3,i=?0
server-timing: cfExtPri
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-amz-replication-status: COMPLETED
cache-control: public, max-age=31536000
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
via: 1.1 997d50190609a53c76124b45ad43b3ec.cloudfront.net (CloudFront)
cf-ray: 9035191fcf1b2c2e-FRA
x-amz-cf-pop: FRA60-P6
server: cloudflare
x-amz-server-side-encryption: AES256

GET
H2 200 css2
fonts.googleapis.com/ 12 KB
1 KB 79ms
30ms Stylesheet
text/css 2a00:1450:4001:80f::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Inter:wght@300;400;500;800;900&display=swap

Requested by

Host: www.picussecurity.com
URL: https://www.picussecurity.com/hs-fs/hub/7048931/hub_generated/template_assets/32300424286/1711704470960/Shield/css/theme-overrides.min.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

d1b07feb8dacb85eaa974e4da4e4268679888a74f92ed43e15123ac701717ec6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.picussecurity.com/hs-fs/hub/7048931/hub_generated/template_assets/32300424286/1711704470960/Shield/css/theme-overrides.min.css

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Fri, 17 Jan 2025 08:50:30 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 17 Jan 2025 08:50:30 GMT
content-type: text/css; charset=utf-8
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
last-modified: Fri, 17 Jan 2025 08:50:30 GMT
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
cross-origin-opener-policy: same-origin-allow-popups
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
x-xss-protection: 0
server: ESF

GET
H2 200 css2
fonts.googleapis.com/ 3 KB
737 B 66ms
38ms Stylesheet
text/css 2a00:1450:4001:80f::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Inter:wght@600&display=swap

Requested by

Host: www.picussecurity.com
URL: https://www.picussecurity.com/hs-fs/hub/7048931/hub_generated/template_assets/154512352373/1727789447438/Shield/css/templates/s2-generic-2024.min.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

5f2662d3a952503f1a49334a9436df710115bffcb783697a5c6e85f8d5883d1c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.picussecurity.com/hs-fs/hub/7048931/hub_generated/template_assets/154512352373/1727789447438/Shield/css/templates/s2-generic-2024.min.css

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Fri, 17 Jan 2025 08:50:30 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 17 Jan 2025 08:50:30 GMT
content-type: text/css; charset=utf-8
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
last-modified: Fri, 17 Jan 2025 07:16:40 GMT
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
cross-origin-opener-policy: same-origin-allow-popups
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
x-xss-protection: 0
server: ESF

GET
H3 200 pixel.js Show response
cdn.popt.in/ 277 KB
64 KB 68ms
31ms Script
text/javascript 2606:4700:3031::ac43:a6ca
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.popt.in/pixel.js?id=64d678615e3d0
Requested by: Host: www.picussecurity.com
URL: https://www.picussecurity.com/resource/blog/apt29-cozy-bear-evolution-techniques
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3031::ac43:a6ca , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 286daa531d6e30defea002e3f48c326fa055d62c51932d5c7ff17dcdbc03f44e

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.picussecurity.com/resource/blog/apt29-cozy-bear-evolution-techniques

Response headers

content-encoding: gzip
cf-cache-status: HIT
etag: W/"207aeddc24d13b41669c18cb2d811ffc"
x-amz-version-id: SMukA5H7cZjnoDJoVOtXtSVDHoMARgeY
age: 1421
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=pnrS8qO8DRAJuhJWkXYn5V6AOnVTK%2BquNwcENb5ApUxbNwbfBO1Ut5byRp9x4s%2Bn31djWvm9dk%2FUZRqQQuubLJxOO%2FJxKszb4MrrEeIF0jKCWAE%2BM13mpvHrbMFOZDa4t%2Fqkeq%2FDArH8hQ%3D%3D"}],"group":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: pTdtbR_7QRmFhKdsOmM_J1l1ZwXn7qIA-eSnrQvcSr3FWlPgvAVT2A==
date: Fri, 17 Jan 2025 08:50:31 GMT
content-type: text/javascript
last-modified: Thu, 16 Jan 2025 09:57:53 GMT
vary: accept-encoding
priority: u=3,i=?0
server-timing: cfL4;desc="?proto=QUIC&rtt=21641&min_rtt=21529&rtt_var=8153&sent=10&recv=7&lost=0&retrans=0&sent_bytes=4090&recv_bytes=4219&delivery_rate=132827&cwnd=12000&unsent_bytes=0&cid=35886563d505420f&ts=37&x=1", cfExtPri, cfHdrFlush;dur=0
cache-control: max-age=1800
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
via: 1.1 b0723c68cc136f4e89ad2f6a85c82e12.cloudfront.net (CloudFront)
cf-ray: 9035191ffed51da4-FRA
x-amz-cf-pop: FRA56-P8
server: cloudflare
x-amz-server-side-encryption: AES256

GET
H2 200 tracking.min.js Show response
t.visitorqueue.com/p/ 10 KB
5 KB 78ms
23ms Script
text/javascript 2600:9000:2490:7a00:c:77c4:d500:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://t.visitorqueue.com/p/tracking.min.js?id=67ab0ee7-fcba-400b-8cb3-db7bb1cc0033
Requested by: Host: www.picussecurity.com
URL: https://www.picussecurity.com/resource/blog/apt29-cozy-bear-evolution-techniques
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2490:7a00:c:77c4:d500:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: ccee1682963a5d9deecdb1dcf9f8e00135cf80c850f2e3309637aa0b14a47938

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.picussecurity.com/resource/blog/apt29-cozy-bear-evolution-techniques

Response headers

vary: accept-encoding
content-encoding: gzip
etag: W/"1a589f09f32aebb87ae510d59061222c"
x-amz-version-id: uG2fL3Qae8ASZDlRw6dZDgCiu.aZzUWG
age: 32361
via: 1.1 22ec86e3f4ec676e17ef8eea76eefba2.cloudfront.net (CloudFront)
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: E0TfxG73F_mbgqotlxqQiFO-9Br4M8U8MguZz3zaja8R0gkhJnKWBQ==
date: Thu, 16 Jan 2025 23:51:22 GMT
content-type: text/javascript
last-modified: Fri, 22 Nov 2024 15:35:08 GMT
server: AmazonS3
x-amz-cf-pop: FRA56-P6
x-amz-server-side-encryption: AES256

GET
H2 200 personalisation.min.js Show response
personalisation.visitorqueue.com/p/ 10 KB
11 KB 456ms
325ms Script
text/javascript 2600:9000:2359:1e00:9:96ee:a300:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://personalisation.visitorqueue.com/p/personalisation.min.js?id=67ab0ee7-fcba-400b-8cb3-db7bb1cc0033
Requested by: Host: www.picussecurity.com
URL: https://www.picussecurity.com/resource/blog/apt29-cozy-bear-evolution-techniques
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2359:1e00:9:96ee:a300:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 3eb7a1272994580582e8bf48cd4a2c0197e7a2082ed1042109985f66f4e4e751

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.picussecurity.com/resource/blog/apt29-cozy-bear-evolution-techniques

Response headers

x-amz-version-id: 1ujY6JsUlMnXdbYYnWS5iKAc3bX4ws1p
etag: "5b545c84a4f2e5a9a8ed70f9e81d9956"
via: 1.1 35cfa6fbcb341fd2ae15e24a43e2f57a.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: Miss from cloudfront
content-length: 10514
x-amz-cf-id: Xm7p2MOpPU21xgIh9fYVFeZnLtC_iVIC_QWFPBOvSafrvXmknGNDcA==
date: Fri, 17 Jan 2025 08:50:32 GMT
content-type: text/javascript
last-modified: Fri, 22 Nov 2024 15:36:16 GMT
server: AmazonS3
x-amz-cf-pop: FRA60-P10
x-amz-server-side-encryption: AES256

GET
H2 200 hotjar-2366058.js Show response
static.hotjar.com/c/ 13 KB
6 KB 80ms
23ms Script
application/javascript 18.66.102.11
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://static.hotjar.com/c/hotjar-2366058.js?sv=6

Requested by

Host: www.picussecurity.com
URL: https://www.picussecurity.com/resource/blog/apt29-cozy-bear-evolution-techniques

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.66.102.11 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-66-102-11.fra56.r.cloudfront.net

Software

Resource Hash

f4fe037b98a06a63f683cf40f2d70275693095d05d04998e1d12cdf8d3216497

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.picussecurity.com/resource/blog/apt29-cozy-bear-evolution-techniques

Response headers

content-encoding: br
etag: W/2143839bc1392a9d15caa0ba6b475105
age: 3
x-content-type-options: nosniff
x-cache-hit: 1
x-cache: Hit from cloudfront
x-amz-cf-id: GxfCwm7obNksCGXaGE-eafWTNSlnkrvY8FroPIwuVkcI6mIuZ8RrKg==
date: Fri, 17 Jan 2025 08:50:28 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
strict-transport-security: max-age=2592000; includeSubDomains
cache-control: max-age=60
cross-origin-resource-policy: cross-origin
via: 1.1 11e35514d631a9a9566fd489de935c06.cloudfront.net (CloudFront)
access-control-allow-origin: *
x-amz-cf-pop: FRA56-P2

GET
DATA 200
OK truncated
/ 160 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: d1af850eed9d8f478503ae0d24ebdd78691a15ed523db6f16df44b9da327c0d5

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/svg+xml;charset=utf-8

GET
H3 200 mega-menu-down-arrow.png
www.picussecurity.com/hubfs/Shield/Images/ 98 B
1 KB 44ms
44ms Image
image/webp 2606:2c40::c73c:67e3
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.picussecurity.com/hubfs/Shield/Images/mega-menu-down-arrow.png

Requested by

Host: www.picussecurity.com
URL: https://www.picussecurity.com/resource/blog/apt29-cozy-bear-evolution-techniques

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:2c40::c73c:67e3 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare London, LLC, US),

Reverse DNS

Software

cloudflare /

Resource Hash

387fafc4558eb44d4303fb1710ec85e39755ffa9378b8cdf982c7e66db79c463

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.picussecurity.com/resource/blog/apt29-cozy-bear-evolution-techniques

Response headers

x-robots-tag: all
cf-cache-status: HIT
etag: "8e2b3f8a9be7c266f20ac70b5ef7c9ef"
age: 239798
cache-tag: F-39029899220,FD-32586780943,P-7048931,FLS-ALL
x-amz-version-id: oVZ1tmPGae_LgGyoO.g0kL81yj6KC.HE
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Efmxd8GqQ%2B10jsf%2FuDnwRVbwV7EMqRtJUmsMLFHWJQdGtoBcX%2F2mwhCIMrARgK96GxKg9eh1mIAE6YdQcuS4BfAn%2Fp%2Bximmvx8HvPKSP46pvRevIVYwYPmrjqAGFoI1fa101ioHstgnq5jbSg3HFy9izAA%3D%3D"}],"group":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
x-cache: RefreshHit from cloudfront
x-amz-cf-id: SjK3Fv4QKxbz8pLkqJMn4h_lncHRQA3po-MRNxHDTv2qeJ5zRr3wtA==
content-type: image/webp
content-disposition: inline; filename="mega-menu-down-arrow.webp"
last-modified: Mon, 21 Dec 2020 15:20:35 GMT
priority: u=3,i
x-amz-meta-index-tag: all
x-amz-replication-status: COMPLETED
edge-cache-tag: F-39029899220,FD-32586780943,P-7048931,FLS-ALL
cache-control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900
server-timing: cfExtPri
x-amz-request-id: 5DD6M1SCAFCTFSHW
x-hs-cf-lambda-enforce: us-east-1.EnforceAclForReads 3
accept-ranges: bytes
x-amz-meta-cache-tag: F-39029899220,FD-32586780943,P-7048931,FLS-ALL
content-length: 98
x-hs-alternate-content-type: text/plain
server: cloudflare
x-amz-server-side-encryption: AES256
x-hs-cf-lambda: us-east-1.EnforceAclForReads 3
cf-bgj: imgq:85,h2pri
access-control-allow-methods: GET
cf-polished: origFmt=png, origSize=121
date: Fri, 17 Jan 2025 08:50:31 GMT
vary: Accept, Accept-Encoding
x-amz-id-2: 0j419ttoiLTj0n9se/cbcL/KvvZkC2PRGQmmICaD9Dl8w6ZlmKEijvsBVRjjh3PU+A9XsL32e4k=
strict-transport-security: max-age=31536000; includeSubDomains; preload
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
timing-allow-origin: d8fk70yj6xfhx.cloudfront.net
via: 1.1 6f4aa26c09fb9bb4d152519f44256a4c.cloudfront.net (CloudFront)
cf-ray: 9035191fdf262c2e-FRA
access-control-allow-origin: *
x-amz-cf-pop: FRA60-P7
x-amz-meta-created-unix-time-millis: 1608564034330

GET
H3 200 dropdown-bg.svg
www.picussecurity.com/hubfs/2023%20-%20Optimization/ 31 KB
15 KB 64ms
64ms Image
image/svg+xml 2606:2c40::c73c:67e3
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.picussecurity.com/hubfs/2023%20-%20Optimization/dropdown-bg.svg

Requested by

Host: www.picussecurity.com
URL: https://www.picussecurity.com/resource/blog/apt29-cozy-bear-evolution-techniques

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:2c40::c73c:67e3 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare London, LLC, US),

Reverse DNS

Software

cloudflare /

Resource Hash

4bf7bbe2ff34569ca8208b5df957ae1bd37d2403d378146fb4e993155cb9820d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.picussecurity.com/resource/blog/apt29-cozy-bear-evolution-techniques

Response headers

x-robots-tag: all
content-encoding: br
cf-cache-status: HIT
etag: W/"9f9d4423178b24188abc6b47edb3cdc4"
age: 239801
cache-tag: F-161975016249,FD-106424384934,P-7048931,FLS-ALL
x-amz-version-id: GOOL_26Jvo0IEgl0bjBjQHkckzY3zQ9q
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=8lqqKGnyxf1MJkmqyBgYbhCqK%2BaleEYl2d8RdmO1JtgDa8sSDjTamdxLtnD1mffcyaPLf80W2YziCcJLC1ntNOyUT3Wr%2Bpja65wnc3YVqqrLOv%2Bsahslilw3NxX9hGbPwL077FQf3rJhTkki9jEKmgh%2BCQ%3D%3D"}],"group":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
x-cache: RefreshHit from cloudfront
x-amz-cf-id: -2e6pMcbbF1aVFJ0RJ48PKnmIYOlCCltQQL5fVj4pfETpySFzXw5hw==
content-type: image/svg+xml
last-modified: Mon, 25 Mar 2024 10:54:26 GMT
priority: u=3,i
server-timing: cfExtPri
x-amz-meta-index-tag: all
x-amz-replication-status: COMPLETED
edge-cache-tag: F-161975016249,FD-106424384934,P-7048931,FLS-ALL
cache-control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900
x-amz-request-id: TM35XX04SX58N51A
x-hs-cf-lambda-enforce: us-east-1.EnforceAclForReads 3
x-amz-meta-cache-tag: F-161975016249,FD-106424384934,P-7048931,FLS-ALL
x-hs-alternate-content-type: text/plain
server: cloudflare
x-hs-cf-lambda: us-east-1.EnforceAclForReads 3
x-amz-server-side-encryption: AES256
access-control-allow-methods: GET
x-amz-storage-class: INTELLIGENT_TIERING
date: Fri, 17 Jan 2025 08:50:31 GMT
vary: Accept-Encoding
x-amz-id-2: uuF3iorZZblNzZjD8S2+d5ZhRKPndKwCWMsRxP/WxVH0m9ZNCTKNkfDpdkqNIKzYv8bcF7PZ0gQvBNv4DSdTVQ==
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-amz-meta-access-tag: public-indexable
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
timing-allow-origin: d8fk70yj6xfhx.cloudfront.net
via: 1.1 7a6b4cd1254095c5b4b5ec2c3af1870a.cloudfront.net (CloudFront)
cf-ray: 9035191fdf272c2e-FRA
access-control-allow-origin: *
x-amz-cf-pop: FRA60-P7
x-amz-meta-created-unix-time-millis: 1711364057618

GET
H3 200 Rectangle%20102.svg
www.picussecurity.com/hubfs/2023%20-%20Optimization/ 197 B
2 KB 55ms
55ms Image
image/svg+xml 2606:2c40::c73c:67e3
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.picussecurity.com/hubfs/2023%20-%20Optimization/Rectangle%20102.svg

Requested by

Host: www.picussecurity.com
URL: https://www.picussecurity.com/resource/blog/apt29-cozy-bear-evolution-techniques

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:2c40::c73c:67e3 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare London, LLC, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ea40563dac288d2a4e806100888a28be233519095512b5b0f44f02d4a4b23aea

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.picussecurity.com/resource/blog/apt29-cozy-bear-evolution-techniques

Response headers

x-robots-tag: all
content-encoding: br
cf-cache-status: HIT
etag: W/"977c98d8ef6f43bbf2d0b84be827e3f4"
age: 239800
cache-tag: F-161969425522,FD-106424384934,P-7048931,FLS-ALL
x-amz-version-id: 6SKLAgGDi0sGrjUFBlWH1sxZJTNCi3le
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=BQMp9r1oEkGczuzAc1ncXo6U4yhVmsPLkjf4hA2WwLrJ8a2juKnrTForAoZWgM90ZwR9t1nX5oOnFKPAz17NNivR%2BdFxpXfPteylKsXP%2BvK4dVPSJzUj1Is5wNjj78vniRpx98MRDtks1SnruXhIpCd4Vg%3D%3D"}],"group":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
x-cache: RefreshHit from cloudfront
x-amz-cf-id: nhxijZ0NK3fv5zQwwpjJfULGDSLgH5vWc3Q5FFignH-tQfvIrIdlAg==
content-type: image/svg+xml
last-modified: Mon, 25 Mar 2024 10:52:23 GMT
priority: u=3,i
server-timing: cfExtPri
x-amz-meta-index-tag: all
x-amz-replication-status: COMPLETED
edge-cache-tag: F-161969425522,FD-106424384934,P-7048931,FLS-ALL
cache-control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900
x-amz-request-id: 5DDDPQJDTSWN1FAK
x-hs-cf-lambda-enforce: us-east-1.EnforceAclForReads 3
x-amz-meta-cache-tag: F-161969425522,FD-106424384934,P-7048931,FLS-ALL
x-hs-alternate-content-type: text/plain
server: cloudflare
x-hs-cf-lambda: us-east-1.EnforceAclForReads 3
x-amz-server-side-encryption: AES256
access-control-allow-methods: GET
x-amz-storage-class: INTELLIGENT_TIERING
date: Fri, 17 Jan 2025 08:50:31 GMT
vary: Accept-Encoding
x-amz-id-2: Tq4aB2r7cv0LfQGLJDab8g/kMM5FiA5STYljRQDcAPOemFnpPsRyOAPYRggTI4zRFGtTouKRHcuZrZK1twejp4bmRgsZFjywdzlPb7O53/4=
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-amz-meta-access-tag: public-indexable
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
timing-allow-origin: d8fk70yj6xfhx.cloudfront.net
via: 1.1 444bee00bd8f759506e806be3c13fa6c.cloudfront.net (CloudFront)
cf-ray: 9035191fdf282c2e-FRA
access-control-allow-origin: *
x-amz-cf-pop: FRA60-P7
x-amz-meta-created-unix-time-millis: 1711363942083

GET
H2 200 ajax-loader.gif
7048931.fs1.hubspotusercontent-na1.net/hubfs/7048931/raw_assets/public/Picus%20IL%20Shared/Shared%20by%20Themes/asset/font/ 3 KB
3 KB 72ms
61ms Image
image/gif 2606:4700:4400::ac40:9284
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://7048931.fs1.hubspotusercontent-na1.net/hubfs/7048931/raw_assets/public/Picus%20IL%20Shared/Shared%20by%20Themes/asset/font/ajax-loader.gif
Requested by: Host: www.picussecurity.com
URL: https://www.picussecurity.com/hs-fs/hub/7048931/hub_generated/template_assets/119013969479/1686049622830/Picus_IL_Shared/Shared_by_Themes/asset/slick-theme.min.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:4400::ac40:9284 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 568d7b83659993469a2d729ad98daba3a7de2568f74d670d18ae618f118fe353

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.picussecurity.com/

Response headers

x-robots-tag: none
cf-cache-status: HIT
etag: "c5cd7f5300576ab4c88202b42f6ded62"
age: 1556457
cache-tag: F-119013776918,FD-119014686826,P-7048931,FLS-ALL
x-amz-version-id: In9ttezEZ_GM9U3eektboBkYWwcorOKA
x-cache: RefreshHit from cloudfront
x-amz-cf-id: 44GVKZ8PvScg-nnUrYh-YlwRB_7OIIbYSDj-weudaSjzepa2QLZDmA==
content-type: image/gif
last-modified: Tue, 06 Jun 2023 11:06:52 GMT
x-amz-meta-index-tag: none
x-amz-replication-status: COMPLETED
edge-cache-tag: F-119013776918,FD-119014686826,P-7048931,FLS-ALL
cache-control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900
x-amz-request-id: 9V28ERJM5XTW29XQ
x-hs-cf-lambda-enforce: us-east-1.EnforceAclForReads 3
accept-ranges: bytes
x-amz-meta-cache-tag: F-119013776918,FD-119014686826,P-7048931,FLS-ALL
content-length: 2592
x-hs-alternate-content-type: text/plain
server: cloudflare
x-amz-server-side-encryption: AES256
x-hs-cf-lambda: us-east-1.EnforceAclForReads 3
cf-bgj: imgq:85,h2pri
access-control-allow-methods: GET
x-amz-storage-class: INTELLIGENT_TIERING
cf-polished: origSize=4178
date: Fri, 17 Jan 2025 08:50:31 GMT
vary: Accept-Encoding
x-amz-id-2: bAoX7wZReMGQYWNbA4I2m6sC4EvqZl/I2LhA6Lgkb+sB3+D3HrMjo5pWpGvdmg0rOCJqVv9TsKWzT5ygDePHaw==
timing-allow-origin: 7048931.fs1.hubspotusercontent-na1.net
via: 1.1 56df5811b9d89103539b9b0b5fd9b262.cloudfront.net (CloudFront)
cf-ray: 9035191feb6ad217-FRA
access-control-allow-origin: *
x-amz-cf-pop: FRA60-P7
x-amz-meta-created-unix-time-millis: 1686049611853

GET
H3 200 bg-resources-hero.png
www.picussecurity.com/hubfs/2023%20-%20Optimization/ 271 KB
272 KB 56ms
56ms Image
image/webp 2606:2c40::c73c:67e3
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.picussecurity.com/hubfs/2023%20-%20Optimization/bg-resources-hero.png

Requested by

Host: www.picussecurity.com
URL: https://www.picussecurity.com/hubfs/hub_generated/template_assets/1/32300424271/1736420124568/template_main.min.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:2c40::c73c:67e3 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare London, LLC, US),

Reverse DNS

Software

cloudflare /

Resource Hash

4d853f486dc84fdc7d1b073cbe0567f4ad79b211fc28ed46186bbb0c8cd1ad26

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.picussecurity.com/hubfs/hub_generated/template_assets/1/32300424271/1736420124568/template_main.min.css

Response headers

x-robots-tag: all
cf-cache-status: HIT
etag: "d0fee8b958d9057e647a94f7db3c9a78"
age: 239798
cache-tag: F-157034522480,FD-106424384934,P-7048931,FLS-ALL
x-amz-version-id: EcSxbCGIawRyFaBBkybAUOhnSjgonGVI
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=1O8a8%2F09%2B8crAQXJf%2F5UQ0y0RUMzeAgls0vwyivyOfRJORCRKTwNRe9Y6O2FpFIa0bQyStUx9ExZ9Foe9bu63SPGP95YMJSp6PJ5%2FJ0CUvB%2FJ9gkTSJroT4YW%2BCWPSbYoYKCgzff%2Foir56iMnbCviLP5Gg%3D%3D"}],"group":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
x-cache: Miss from cloudfront
x-amz-cf-id: CB4oWJn4R3c1JWNQ1HJXeg5LaVJX26iyJbJ2u4Z-LYNPidjp27ElSA==
content-type: image/webp
content-disposition: inline; filename="bg-resources-hero.webp"
last-modified: Thu, 15 Feb 2024 12:13:55 GMT
priority: u=3,i
x-amz-meta-index-tag: all
x-amz-replication-status: COMPLETED
edge-cache-tag: F-157034522480,FD-106424384934,P-7048931,FLS-ALL
cache-control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900
server-timing: cfExtPri
x-amz-request-id: M227H4H2868874JM
x-hs-cf-lambda-enforce: us-east-1.EnforceAclForReads 3
accept-ranges: bytes
x-amz-meta-cache-tag: F-157034522480,FD-106424384934,P-7048931,FLS-ALL
content-length: 277185
x-hs-alternate-content-type: text/plain
server: cloudflare
x-amz-server-side-encryption: AES256
x-hs-cf-lambda: us-east-1.EnforceAclForReads 3
cf-bgj: imgq:85,h2pri
access-control-allow-methods: GET
x-amz-storage-class: INTELLIGENT_TIERING
cf-polished: origFmt=png, origSize=604050
date: Fri, 17 Jan 2025 08:50:31 GMT
vary: Accept, Accept-Encoding
x-amz-id-2: UKacxqfNHdlACaTbIsqtBAVFnmf+tOZEPQ/dd6I5hU7cerhAgRKxto6rXchPivkCaHoFVN5joDw=
strict-transport-security: max-age=31536000; includeSubDomains; preload
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
timing-allow-origin: d8fk70yj6xfhx.cloudfront.net
via: 1.1 444bee00bd8f759506e806be3c13fa6c.cloudfront.net (CloudFront)
cf-ray: 9035191fdf2c2c2e-FRA
access-control-allow-origin: *
x-amz-cf-pop: FRA60-P7
x-amz-meta-created-unix-time-millis: 1707999225481

GET
H3 200 700.woff2
www.picussecurity.com/_hcms/googlefonts/Red_Hat_Display/ 18 KB
19 KB 66ms
66ms Font
font/woff2 2606:2c40::c73c:67e3
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.picussecurity.com/_hcms/googlefonts/Red_Hat_Display/700.woff2

Requested by

Host: www.picussecurity.com
URL: https://www.picussecurity.com/resource/blog/apt29-cozy-bear-evolution-techniques

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:2c40::c73c:67e3 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare London, LLC, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b2353ab18ab8493a1cb644aec769a1db858be1cbd2a193d0910d8b00b9c2faaf

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://www.picussecurity.com
Referer: https://www.picussecurity.com/resource/blog/apt29-cozy-bear-evolution-techniques

Response headers

x-hs-cf-lambda: us-east-1.EnforceAclForReads 3
cf-cache-status: HIT
etag: "48bc51a9ad6f5730b8ea8e4676193213"
age: 3
x-amz-version-id: y.GpRLjswJk93hkSK24hsuNfBkE6rABX
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Ze0ZdVs0cCBBI53Akqp%2BbTE84qbeU9njA77V5lScNhkJrOJtDhmH4OR8VbVR7CbItWB%2BbMjZn5xhPbXy%2FfppoQEs5a8GtX97%2F%2BFyWmEmqSCkAC1NtltAddHwLPu%2FyAu2dRiA%2BF%2F%2B4ATHx5W5m1utIQdWdQ%3D%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-methods: GET
expires: Fri, 31 Jan 2025 08:50:31 GMT
alt-svc: h3=":443"; ma=86400
x-cache: RefreshHit from cloudfront
x-amz-cf-id: 8QynzAQONVpqPOX4fyJA3okEi7Rnx0gFuFC6h6pIlV1NopmyNF5nuA==
date: Fri, 17 Jan 2025 08:50:31 GMT
content-type: font/woff2
last-modified: Sat, 07 Dec 2024 14:05:50 GMT
vary: Accept-Encoding
priority: u=0,i=?0
x-amz-id-2: mIM6JhIZW7UJsObf7tMIWfKgiaK1FahI4Hmj/i2WbI6qrD07pYjZvJH1V8IABz5dmwwzlVzu9AVZWX2b+avyCgetM4bCnbjF
strict-transport-security: max-age=31536000; includeSubDomains; preload
server-timing: cfExtPri
cache-control: public, max-age=1209600
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
via: 1.1 7a6b4cd1254095c5b4b5ec2c3af1870a.cloudfront.net (CloudFront)
cf-ray: 903519200f4d2c2e-FRA
x-amz-request-id: 981D12HTYB8YQEQ8
x-hs-cf-lambda-enforce: us-east-1.EnforceAclForReads 3
accept-ranges: bytes
access-control-allow-origin: *
content-length: 18216
x-amz-cf-pop: FRA60-P7
server: cloudflare
x-amz-server-side-encryption: AES256

GET
H3 200 regular.woff2
www.picussecurity.com/_hcms/googlefonts/Red_Hat_Display/ 17 KB
18 KB 59ms
58ms Font
font/woff2 2606:2c40::c73c:67e3
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.picussecurity.com/_hcms/googlefonts/Red_Hat_Display/regular.woff2

Requested by

Host: www.picussecurity.com
URL: https://www.picussecurity.com/resource/blog/apt29-cozy-bear-evolution-techniques

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:2c40::c73c:67e3 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare London, LLC, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a3f04336cdf3733b903769767bd1e569f867f33fef41d94a42a0402e56e4045c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://www.picussecurity.com
Referer: https://www.picussecurity.com/resource/blog/apt29-cozy-bear-evolution-techniques

Response headers

x-hs-cf-lambda: us-east-1.EnforceAclForReads 3
cf-cache-status: HIT
etag: "ccabc7b57fe51ff67afece0f749a1d68"
age: 3
x-amz-version-id: VXWpDT96tKgfD_f7TW_davDe7n496B1K
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=tuj2QuwQw4tMF9tK9ZWuJpAZHLleHElPd4HBly1IXHcBavqqygVE%2Bpa1yZ3d4dedj4NIrlfpaZ3ba5T8J2DrbgXb2sutds%2FzZeOs845HIpBQ5%2BquOf2ebDAOmuhvJ2%2BoAagc7HcXzx1%2F3I8zbg0L6eHKiA%3D%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-methods: GET
expires: Fri, 31 Jan 2025 08:50:31 GMT
alt-svc: h3=":443"; ma=86400
x-cache: Miss from cloudfront
x-amz-cf-id: d_EqRb-yD9u1dvN3lAjzrAy3WHENRFK69T2_1l8nlMzZiMSXGNSTpQ==
date: Fri, 17 Jan 2025 08:50:31 GMT
content-type: font/woff2
last-modified: Sat, 07 Dec 2024 14:05:45 GMT
vary: Accept-Encoding
priority: u=0,i=?0
x-amz-id-2: cdYDXBdf3MGGcKq0ZmwVGStnXzozEKW7Tgn6ySlZ7NB3CtsL90eO+y1ZTinuJxXtbcSBIMwW4hk=
strict-transport-security: max-age=31536000; includeSubDomains; preload
server-timing: cfExtPri
cache-control: public, max-age=1209600
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
via: 1.1 69114e4ea0aa4e532a5be63a75c51e2c.cloudfront.net (CloudFront)
cf-ray: 903519200f4e2c2e-FRA
x-amz-request-id: 0DH9BJMWYGV08YEG
x-hs-cf-lambda-enforce: us-east-1.EnforceAclForReads 3
accept-ranges: bytes
access-control-allow-origin: *
content-length: 17484
x-amz-cf-pop: FRA60-P7
server: cloudflare
x-amz-server-side-encryption: AES256

GET
H3 200 UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa1ZL7.woff2
fonts.gstatic.com/s/inter/v18/ 47 KB
47 KB 55ms
22ms Font
font/woff2 2a00:1450:4001:80e::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/inter/v18/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa1ZL7.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Inter:wght@300;400;500;800;900&display=swap

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f052ee44c3728dfd23aba8a4567150bc314d23903026fbb6ad089422c2df56af

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://www.picussecurity.com
Referer: https://fonts.googleapis.com/

Response headers

age: 259164
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
x-content-type-options: nosniff
expires: Wed, 14 Jan 2026 08:51:07 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Tue, 14 Jan 2025 08:51:07 GMT
last-modified: Mon, 29 Jul 2024 22:51:01 GMT
content-type: font/woff2
cache-control: public, max-age=31536000
timing-allow-origin: *
cross-origin-opener-policy: same-origin; report-to="apps-themes"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
accept-ranges: bytes
access-control-allow-origin: *
content-length: 48444
x-xss-protection: 0
server: sffe

GET
H3 200 UcCO3FwrK3iLTeHuS_nVMrMxCp50SjIw2boKoduKmMEVuGKYAZ9hiA.woff2
fonts.gstatic.com/s/inter/v18/ 24 KB
24 KB 58ms
25ms Font
font/woff2 2a00:1450:4001:80e::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/inter/v18/UcCO3FwrK3iLTeHuS_nVMrMxCp50SjIw2boKoduKmMEVuGKYAZ9hiA.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Inter:wght@600&display=swap

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

62553d159189834af73c9a6264704be5b2bee9a08da66a14768d8e5c6ffd2cdb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://www.picussecurity.com
Referer: https://fonts.googleapis.com/

Response headers

age: 259132
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
x-content-type-options: nosniff
expires: Wed, 14 Jan 2026 08:51:39 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Tue, 14 Jan 2025 08:51:39 GMT
last-modified: Mon, 29 Jul 2024 22:45:23 GMT
content-type: font/woff2
cache-control: public, max-age=31536000
timing-allow-origin: *
cross-origin-opener-policy: same-origin; report-to="apps-themes"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
accept-ranges: bytes
access-control-allow-origin: *
content-length: 24304
x-xss-protection: 0
server: sffe

GET
H3 200 regular.woff2
www.picussecurity.com/_hcms/googlefonts/Inter/ 106 KB
107 KB 60ms
59ms Font
font/woff2 2606:2c40::c73c:67e3
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.picussecurity.com/_hcms/googlefonts/Inter/regular.woff2

Requested by

Host: www.picussecurity.com
URL: https://www.picussecurity.com/resource/blog/apt29-cozy-bear-evolution-techniques

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:2c40::c73c:67e3 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare London, LLC, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2e095c77cbc278604a08136ba272382190c0c7a12a26777a33ca20fafbb59186

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://www.picussecurity.com
Referer: https://www.picussecurity.com/resource/blog/apt29-cozy-bear-evolution-techniques

Response headers

x-hs-cf-lambda: us-east-1.EnforceAclForReads 3
cf-cache-status: HIT
etag: "7206d65c5fe7587e1efb16144ff41175"
age: 3
x-amz-version-id: qqsy1i54n5NfUHnt2CpgzmQxrsUTlalp
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=RE5ZUUnAzBlER0uXX1ypMuSWgW90ZjNipAmjQMbxBlbm5oClOlAhRyUmCVk2l%2Fb69B2zXtVBt9m0ANLJz3VEQNbGQHfoq%2Fdap6FACKtZNGwJ5nCmAaPrr27j9riLvcUQmer19%2FPOe6jJZh30SIovWUQYaw%3D%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-methods: GET
expires: Fri, 31 Jan 2025 08:50:31 GMT
alt-svc: h3=":443"; ma=86400
x-cache: RefreshHit from cloudfront
x-amz-cf-id: oATA7Nt2Z_wUNmqKjLB7oLSweU3K99lSHjG_LDUoArCLRPOHP9GbfQ==
date: Fri, 17 Jan 2025 08:50:31 GMT
content-type: font/woff2
last-modified: Sat, 07 Sep 2024 14:17:57 GMT
vary: Accept-Encoding
priority: u=0,i=?0
x-amz-id-2: IWLnnCFwGxqws4vpwQadOb1262h4U9nskWhn/DMDA7HODtg4mXxEyKhv9x0ayGmKijv282Ctw7uTiOqdKeQ9IHoKLoP0je/trOsZ/Njp8xE=
strict-transport-security: max-age=31536000; includeSubDomains; preload
server-timing: cfExtPri
cache-control: public, max-age=1209600
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
via: 1.1 8bd22c4e977189bdb5963957ff8477de.cloudfront.net (CloudFront)
cf-ray: 903519200f4f2c2e-FRA
x-amz-request-id: SK4WMKE3DEX3KPY5
x-hs-cf-lambda-enforce: us-east-1.EnforceAclForReads 3
accept-ranges: bytes
access-control-allow-origin: *
content-length: 108176
x-amz-cf-pop: FRA60-P7
server: cloudflare
x-amz-server-side-encryption: AES256

GET
H3 200 json Show response
www.picussecurity.com/_hcms/forms/embed/v3/form/7048931/10a2d0b0-9f91-4cd7-a1e0-1cff39706638/ 7 KB
2 KB 152ms
152ms XHR
application/json 2606:2c40::c73c:67e3
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.picussecurity.com/_hcms/forms/embed/v3/form/7048931/10a2d0b0-9f91-4cd7-a1e0-1cff39706638/json?hs_static_app=forms-embed&hs_static_app_version=1.7309&X-HubSpot-Static-App-Info=forms-embed-1.7309

Requested by

Host: www.picussecurity.com
URL: https://www.picussecurity.com/_hcms/forms/v2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:2c40::c73c:67e3 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare London, LLC, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7449d6e6793b78987e22f3935dec733f9620e51ba459be743bc7ddfb8da3c73e

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Accept: application/json, text/plain, */*
Referer: https://www.picussecurity.com/resource/blog/apt29-cozy-bear-evolution-techniques

Response headers

x-robots-tag: none
access-control-max-age: 180
x-request-id: 14a4a72f-bbc3-4bed-8791-f12b8b92369f
access-control-expose-headers: X-Origin-Hublet
content-encoding: br
cf-cache-status: DYNAMIC
x-origin-hublet: na1
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=wuSmrE%2F0KJeusMUWKENC1GuSGZowc3qhuHlaljSPraXTImkdRFC3lNVvb4E4ogL0UUnuSOcBF29uN0qPAPhhAeWwGAE6GGM7ISdzT5rnL%2B7KYJBw6htrCM0KBm8RCZ0tEXbb4xLAU%2FvalDItbTMczRxtbg%3D%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-methods: OPTIONS, GET
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
x-evy-trace-listener: listener_https
server-timing: cfExtPri
date: Fri, 17 Jan 2025 08:50:31 GMT
x-hubspot-correlation-id: 14a4a72f-bbc3-4bed-8791-f12b8b92369f
content-type: application/json;charset=utf-8
vary: origin, Accept-Encoding
priority: u=1,i
access-control-allow-headers: *
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-security-policy: upgrade-insecure-requests
cache-control: max-age=0, no-cache, no-store
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-evy-trace-route-service-name: envoyset-translator
x-envoy-upstream-service-time: 11
x-evy-trace-served-by-pod: iad02/star-hubspot-td/envoy-proxy-b967ccf5d-jddbj
access-control-allow-credentials: false
cf-ray: 903519202f7b2c2e-FRA
x-evy-trace-route-configuration: listener_https/all
server: cloudflare
x-evy-trace-virtual-host: all

GET
H3 200 json Show response
www.picussecurity.com/_hcms/forms/embed/v3/form/7048931/10a2d0b0-9f91-4cd7-a1e0-1cff39706638/ 7 KB
2 KB 307ms
155ms XHR
application/json 2606:2c40::c73c:67e3
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host: www.picussecurity.com
URL: https://www.picussecurity.com/_hcms/forms/v2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:2c40::c73c:67e3 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare London, LLC, US),

Reverse DNS

Software

cloudflare /

Resource Hash

3c1c67c3c77d727b1c7d37a07a9d4e3303cfe1c9b30db9c68238d9c14b6b0ea4

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Accept: application/json, text/plain, */*
Referer: https://www.picussecurity.com/resource/blog/apt29-cozy-bear-evolution-techniques

Response headers

x-robots-tag: none
access-control-max-age: 180
x-request-id: 4dfaa995-79ec-4ca9-8441-4bc8f69c9ab5
access-control-expose-headers: X-Origin-Hublet
content-encoding: br
cf-cache-status: DYNAMIC
x-origin-hublet: na1
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=kvgnJDeJUNvGN4igcYnPotx%2B3a8WqNw35ZEcUu3hUt%2BtC0Z%2Bhhfkkk9heDSGB%2BDlpGY2yIayUcWrNMetSJcur6udhn3zmTSnl1Jcl0QkWJXvGGoKwMfrXd2aY90B6SdcpFI151V5MnY7S1XL6ITAW6%2BoFQ%3D%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-methods: OPTIONS, GET
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
x-evy-trace-listener: listener_https
server-timing: cfExtPri
date: Fri, 17 Jan 2025 08:50:31 GMT
x-hubspot-correlation-id: 4dfaa995-79ec-4ca9-8441-4bc8f69c9ab5
content-type: application/json;charset=utf-8
vary: origin, Accept-Encoding
priority: u=1,i
access-control-allow-headers: *
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-security-policy: upgrade-insecure-requests
cache-control: max-age=0, no-cache, no-store
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-evy-trace-route-service-name: envoyset-translator
x-envoy-upstream-service-time: 12
x-evy-trace-served-by-pod: iad02/star-hubspot-td/envoy-proxy-b967ccf5d-gqz7d
access-control-allow-credentials: false
cf-ray: 9035192118282c2e-FRA
x-evy-trace-route-configuration: listener_https/all
server: cloudflare
x-evy-trace-virtual-host: all

GET
H3 200 shield-animate.min.css
cdn2.hubspot.net/hub/7048931/hub_generated/template_assets/32379319518/1682685745883/Shield/css/ 15 KB
4 KB 83ms
48ms Stylesheet
text/css 2606:4700::6812:593e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn2.hubspot.net/hub/7048931/hub_generated/template_assets/32379319518/1682685745883/Shield/css/shield-animate.min.css
Requested by: Host: www.picussecurity.com
URL: https://www.picussecurity.com/resource/blog/apt29-cozy-bear-evolution-techniques
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700::6812:593e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ad35b390ce3898cfef7bb94973d42ab290ec56f7315e0b459f4ba017eac96f07

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.picussecurity.com/resource/blog/apt29-cozy-bear-evolution-techniques

Response headers

x-request-id: 6d32a640-daeb-4655-9185-5629c8415e53
content-encoding: gzip
cf-cache-status: HIT
etag: W/"dc33969eb4c5a40ef5e6be0462874811"
age: 2413735
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=OPyz3%2FC4lR2ve7Paj07OR1bWnE3I3iYH393B0Es%2FnJzxxjSZZixoDhdTcV98r2nMwbHvszr%2F1OBRaGXyAAsyYaCLTCLWnGuhlG5V1j03Ef8Yk%2B%2FjfYZ6kxbLXAtcSg0omqhId9Uc%2BjPDGLc%2Bt6U%3D"}],"group":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
x-evy-trace-listener: listener_https
server-timing: cfExtPri
x-hubspot-correlation-id: 6d32a640-daeb-4655-9185-5629c8415e53
content-type: text/css
last-modified: Fri, 28 Apr 2023 12:42:28 GMT
priority: u=0,i=?0
x-amz-replication-status: COMPLETED
x-evy-trace-route-service-name: envoyset-translator
cache-control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900
x-evy-trace-served-by-pod: iad02/cms-cdn2-td/envoy-proxy-6748d4cfc8-b44gw
x-envoy-upstream-service-time: 234
x-hs-cf-lambda-enforce: us-east-1.EnforceAclForReads 3
x-hs-alternate-content-type: text/plain
server: cloudflare
x-evy-trace-virtual-host: all
x-hs-cf-lambda: us-east-1.EnforceAclForReads 3
x-amz-server-side-encryption: AES256
access-control-allow-methods: GET
x-amz-storage-class: INTELLIGENT_TIERING
date: Fri, 17 Jan 2025 08:50:31 GMT
vary: Accept-Encoding
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
timing-allow-origin: cdn2.hubspot.net
cf-ray: 903519205ee2d38e-FRA
access-control-allow-origin: *
x-evy-trace-route-configuration: listener_https/all
x-amz-cf-pop: IAD89-C1
x-amz-meta-created-unix-time-millis: 1682685747003

GET
H3 200 shield-wow.min.js Show response
cdn2.hubspot.net/hub/7048931/hub_generated/template_assets/32379253675/1682685740703/Shield/js/ 8 KB
4 KB 80ms
45ms Script
application/javascript 2606:4700::6812:593e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn2.hubspot.net/hub/7048931/hub_generated/template_assets/32379253675/1682685740703/Shield/js/shield-wow.min.js
Requested by: Host: www.picussecurity.com
URL: https://www.picussecurity.com/resource/blog/apt29-cozy-bear-evolution-techniques
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700::6812:593e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e4efcc099f128e3655108f269adb8e838c24ee54d98c3903a22dec225e3e1221

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.picussecurity.com/resource/blog/apt29-cozy-bear-evolution-techniques

Response headers

x-request-id: f09c9864-5cba-4ce6-b73b-cb82c4e19395
content-encoding: br
cf-cache-status: HIT
etag: W/"6309bf850dea6345af0b537f2e628964"
age: 2418914
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=yFMDADGUE8KLNyzLkPuXZy6D6hMzCNFmG4EGMLX%2BkfP2rUOqXrpbU5dM5dbS%2FKngPTb9lHT9OiqnjLup8mdkA39%2BWDkD2RTUXtnbZVhsKUS5TiQnmLNJ87AF5JDpYUGuBrbGzCYWX8nYKCUcIgw%3D"}],"group":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
x-evy-trace-listener: listener_https
server-timing: cfExtPri
x-hubspot-correlation-id: f09c9864-5cba-4ce6-b73b-cb82c4e19395
content-type: application/javascript; charset=utf-8
last-modified: Fri, 28 Apr 2023 12:42:21 GMT
priority: u=3,i=?0
x-amz-replication-status: COMPLETED
x-evy-trace-route-service-name: envoyset-translator
cache-control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900
x-evy-trace-served-by-pod: iad02/cms-cdn2-td/envoy-proxy-7b656c968b-pchxr
x-envoy-upstream-service-time: 162
x-hs-cf-lambda-enforce: us-east-1.EnforceAclForReads 3
x-hs-alternate-content-type: text/plain
server: cloudflare
x-evy-trace-virtual-host: all
x-hs-cf-lambda: us-east-1.EnforceAclForReads 3
x-amz-server-side-encryption: AES256
access-control-allow-methods: GET
x-amz-storage-class: INTELLIGENT_TIERING
date: Fri, 17 Jan 2025 08:50:31 GMT
vary: Accept-Encoding
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
timing-allow-origin: cdn2.hubspot.net
cf-ray: 903519205ee0d38e-FRA
access-control-allow-origin: *
x-evy-trace-route-configuration: listener_https/all
x-amz-cf-pop: IAD61-P1
x-amz-meta-created-unix-time-millis: 1682685740979

GET
H2 200 banner.js Show response
js.hs-banner.com/v2/7048931/ 86 KB
28 KB 98ms
31ms Script
text/javascript 2606:4700:4400::ac40:9310
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js.hs-banner.com/v2/7048931/banner.js
Requested by: Host: www.picussecurity.com
URL: https://www.picussecurity.com/hs/scriptloader/7048931.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:4400::ac40:9310 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 41413e45a7aca363b6a7e8bb94fc87708d66997ee9cdac64467d94aa69020caf

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.picussecurity.com/resource/blog/apt29-cozy-bear-evolution-techniques

Response headers

x-evy-trace-virtual-host: all
access-control-max-age: 604800
x-request-id: 898dda2c-7215-4e4b-b200-ec2743d26095
access-control-expose-headers: x-last-modified-timestamp, X-HubSpot-NotFound, X-HS-User-Request, Link, Server-Timing
content-encoding: gzip
cf-cache-status: HIT
etag: W/"8d3bf988b493cca2a6fe0915a71f0a81"
x-amz-version-id: WCmITkA1L7o8eh.8SLfWU6FMRQ0LVSB9
age: 3
access-control-allow-methods: GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD
expires: Fri, 17 Jan 2025 08:55:28 GMT
x-evy-trace-listener: listener_https
date: Fri, 17 Jan 2025 08:50:31 GMT
x-hubspot-correlation-id: 898dda2c-7215-4e4b-b200-ec2743d26095
content-type: text/javascript; charset=UTF-8
last-modified: Thu, 21 Nov 2024 07:12:04 GMT
vary: origin, Accept-Encoding
x-amz-id-2: GFMSyCcMkNAzq4YY2tPv8C+V8O5NOSXva5eWWsEpBZtCt8ENcCjMFCiH5rG5iCr8BIQYJsX3Z6g=
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Accept-Charset, Accept-Encoding, X-Override-Internal-Permissions, X-Properties-Source, X-Properties-SourceId, X-Properties-Flag, X-Hubspot-User-Id, X-Hubspot-Trace, X-Hubspot-Callee, X-Hubspot-Offset, X-Hubspot-No-Trace, X-HubSpot-Static-App-Info, X-HubSpot-Messages-Uri, X-HubSpot-Request-Source, X-HubSpot-Request-Reason, Subscription-Billing-Auth-Token, X-App-CSRF, X-Tools-CSRF, Online-Payment-Signing-UUID, X-Source, X-SourceId, X-Origin-UserId, X-Biden-Request-Source, X-HubSpot-CSRF-hubspotapi, X-Force-Cookie-Refresh, X-Force-Cookie-Refresh-No-Cache, X-HS-User-Request, X-Application-Id, X-HS-Referer, X-HubSpot-Correlation-Id
x-evy-trace-route-service-name: envoyset-translator
cache-control: max-age=300,public
timing-allow-origin: *
x-evy-trace-served-by-pod: iad02/analytics-js-proxy-td/envoy-proxy-8586d94f84-2ftsj
x-envoy-upstream-service-time: 39
access-control-allow-credentials: true
x-amz-request-id: 6FKQBJ8M3W4Y4R8F
cf-ray: 903519209d92db03-FRA
access-control-allow-origin: https://events.picussecurity.com
x-evy-trace-route-configuration: listener_https/all
server: cloudflare
x-amz-server-side-encryption: AES256

GET
H2 200 conversations-embed.js Show response
js.usemessages.com/ 94 KB
27 KB 111ms
37ms Script
application/javascript 2606:4700::6810:4e8e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://js.usemessages.com/conversations-embed.js

Requested by

Host: www.picussecurity.com
URL: https://www.picussecurity.com/hs/scriptloader/7048931.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:4e8e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

30f5b70598630108952d978da585dc53cf4e81d066429a08cc9db4d1b37fcdc6

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.picussecurity.com/resource/blog/apt29-cozy-bear-evolution-techniques

Response headers

x-evy-trace-virtual-host: all
x-request-id: 1fef9a9b-3e3d-40e9-9cc6-e35a73b7eeba
content-encoding: gzip
cf-cache-status: HIT
etag: W/"0228b1135f5eda926ba3a0c628a06e17"
x-amz-version-id: UgNAGB6Q41UN46yjdtXsj69WImNUmBAx
age: 571
cache-tag: staticjsapp-conversations-embed-web-prod,staticjsapp-prod
x-content-type-options: nosniff
x-cache: Hit from cloudfront
x-hs-cache-status: HIT
x-amz-cf-id: cdO4josV4hWmdPwsH5PURFueap8ofVHxi_b0nA2va4FmgvT8-8t0Yw==
date: Fri, 17 Jan 2025 08:50:31 GMT
x-hubspot-correlation-id: 1fef9a9b-3e3d-40e9-9cc6-e35a73b7eeba
content-type: application/javascript; charset=utf-8
last-modified: Thu, 16 Jan 2025 18:39:28 UTC
vary: accept-encoding
x-evy-trace-listener: listener_https
x-amz-replication-status: COMPLETED
x-evy-trace-route-service-name: envoyset-translator
cache-control: max-age=600
x-evy-trace-served-by-pod: iad02/app-td/envoy-proxy-856d8787d5-dcdcz
x-envoy-upstream-service-time: 3
content-security-policy-report-only: frame-ancestors 'self'; report-uri https://send.hsbrowserreports.com/csp/report?resource=conversations-embed/static-1.19797/bundles/project.js&cfRay=90350b2f8f40d9d7-FRA
via: 1.1 dfc1931cc62ecd4133c2b9bdae1bb476.cloudfront.net (CloudFront)
cf-ray: 903519209e0a1968-FRA
x-evy-trace-route-configuration: listener_https/all
x-hs-target-asset: conversations-embed/static-1.19797/bundles/project.js
x-amz-cf-pop: IAD12-P3
server: cloudflare
x-amz-server-side-encryption: AES256

GET
H2 200 fb.js Show response
js.hsadspixel.net/ 6 KB
4 KB 106ms
32ms Script
application/javascript 2606:4700::6811:80ac
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://js.hsadspixel.net/fb.js

Requested by

Host: www.picussecurity.com
URL: https://www.picussecurity.com/hs/scriptloader/7048931.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:80ac , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

769efb813106ed9bf203aa8f047adb235ac9ec7a55a352f517f9b4f12143d4ae

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.picussecurity.com/resource/blog/apt29-cozy-bear-evolution-techniques

Response headers

x-evy-trace-virtual-host: all
x-request-id: 128a32d2-bd2e-4164-b31b-3ab7edc76d0a
content-encoding: gzip
cf-cache-status: HIT
etag: W/"f6789dd1dcf954593277a09a4e10e984"
x-amz-version-id: GLM6CAPdi4A8dBbJ_DVN0prtd1glPAAM
cache-tag: staticjsapp-AdsScriptLoaderCloudflare-web-prod,staticjsapp-prod
age: 473
x-content-type-options: nosniff
x-cache: Hit from cloudfront
x-hs-cache-status: HIT
x-amz-cf-id: G-jpuhZSJDO7KuBVp5I4eAJZl1nssY3bQ3lC3s0aYdh__BUgOUKXfQ==
date: Fri, 17 Jan 2025 08:50:31 GMT
x-hubspot-correlation-id: 128a32d2-bd2e-4164-b31b-3ab7edc76d0a
content-type: application/javascript; charset=utf-8
last-modified: Thu, 16 Jan 2025 20:31:18 UTC
vary: accept-encoding
x-evy-trace-listener: listener_https
x-amz-replication-status: COMPLETED
x-evy-trace-route-service-name: envoyset-translator
cache-control: max-age=600
x-evy-trace-served-by-pod: iad02/app-td/envoy-proxy-856d8787d5-bjt9r
x-envoy-upstream-service-time: 0
content-security-policy-report-only: frame-ancestors 'self'; report-uri https://send.hsbrowserreports.com/csp/report?resource=adsscriptloaderstatic/static-1.1160/bundles/pixels-release.js&cfRay=9030ed170ae571c1-WAW
via: 1.1 66b6cd04ec22251498906e833eb08668.cloudfront.net (CloudFront)
cf-ray: 903519209fe89054-FRA
x-evy-trace-route-configuration: listener_https/all
x-hs-target-asset: adsscriptloaderstatic/static-1.1160/bundles/pixels-release.js
x-amz-cf-pop: IAD12-P3
server: cloudflare
x-amz-server-side-encryption: AES256

GET
H2 200 leadflows.js Show response
js.hsleadflows.net/ 550 KB
92 KB 89ms
31ms Script
application/javascript 2606:4700::6812:8b11
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://js.hsleadflows.net/leadflows.js

Requested by

Host: www.picussecurity.com
URL: https://www.picussecurity.com/hs/scriptloader/7048931.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:8b11 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a8cdacdb576b14e22902e6c9e8bf5d82ebc38172183932f040754a71eac4ef8c

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://www.picussecurity.com
Referer: https://www.picussecurity.com/resource/blog/apt29-cozy-bear-evolution-techniques

Response headers

x-request-id: 103b770b-e5a0-46c0-81c3-37c2024ef676
content-encoding: gzip
cf-cache-status: HIT
x-amz-version-id: iphih9FyTh9aXfDXTaA5caC2ioHEcJsk
etag: W/"613e6f8678d96786e31d98b00fb312d2"
cache-tag: staticjsapp-lead-flows-cloudflare-web-prod,staticjsapp-prod
age: 69826
x-content-type-options: nosniff
x-cache: Miss from cloudfront
x-evy-trace-listener: listener_https
x-amz-cf-id: AcgRmSEBcmXRWN33iS_E_SYWHihxV3OQvteZjbqbvEkH_PizIczxxg==
x-hubspot-correlation-id: 103b770b-e5a0-46c0-81c3-37c2024ef676
content-type: application/javascript; charset=utf-8
last-modified: Wed, 15 Jan 2025 12:38:17 UTC
x-amz-replication-status: COMPLETED
x-evy-trace-route-service-name: envoyset-translator
cache-control: s-maxage=86400, max-age=0
x-evy-trace-served-by-pod: iad02/app-td/envoy-proxy-856d8787d5-q6sv6
x-envoy-upstream-service-time: 43
x-hs-target-asset: lead-flows-js/static-1.2308/bundle/main/lead-flows-release.js
server: cloudflare
x-evy-trace-virtual-host: all
x-amz-server-side-encryption: AES256
access-control-max-age: 3000
access-control-allow-methods: GET
x-hs-cache-status: MISS
date: Fri, 17 Jan 2025 08:50:31 GMT
vary: Origin,Access-Control-Request-Headers,Access-Control-Request-Method,accept-encoding
content-security-policy-report-only: frame-ancestors 'self'; report-uri https://send.hsbrowserreports.com/csp/report?resource=lead-flows-js/static-1.2308/bundle/main/lead-flows-release.js&cfRay=9025ee477865e3dc-ARN
via: 1.1 73c5607bdb5db0d651e25c848846d554.cloudfront.net (CloudFront)
cf-ray: 90351920ab34db07-FRA
access-control-allow-origin: *
x-evy-trace-route-configuration: listener_https/all
x-amz-cf-pop: IAD12-P3

GET
H2 200 collectedforms.js Show response
js.hscollectedforms.net/ 70 KB
25 KB 89ms
32ms Script
application/javascript 2606:4700::6810:6bfe
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://js.hscollectedforms.net/collectedforms.js

Requested by

Host: www.picussecurity.com
URL: https://www.picussecurity.com/hs/scriptloader/7048931.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:6bfe , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e66dfbcc8ba7cd3624126a2d8825bd6216fe0202af9d9f750ab7b02e6ca8fc44

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://www.picussecurity.com
Referer: https://www.picussecurity.com/resource/blog/apt29-cozy-bear-evolution-techniques

Response headers

x-request-id: e94b2155-a24b-4032-bf6f-13d80c67d228
content-encoding: gzip
cf-cache-status: HIT
etag: W/"cce97ce600e1081dce3e5e7b5bc08d18"
x-amz-version-id: uvrInopjoN5gevNwHh934Ck4iPjUIIdV
cache-tag: staticjsapp-collected-forms-embed-js-web-prod,staticjsapp-prod
age: 3
x-content-type-options: nosniff
x-cache: Hit from cloudfront
x-evy-trace-listener: listener_https
x-amz-cf-id: TRhCmAMzMxl_1X7Efr35cuUmz_QMz78qOuTgB33PbyQGX-M2I95QFg==
x-hubspot-correlation-id: e94b2155-a24b-4032-bf6f-13d80c67d228
content-type: application/javascript; charset=utf-8
last-modified: Tue, 07 Jan 2025 09:36:44 UTC
x-amz-replication-status: COMPLETED
x-evy-trace-route-service-name: envoyset-translator
cache-control: s-maxage=600, max-age=300
x-evy-trace-served-by-pod: iad02/app-td/envoy-proxy-856d8787d5-t5rvw
x-envoy-upstream-service-time: 1
x-hs-target-asset: collected-forms-embed-js/static-1.1283/bundles/project.js
server: cloudflare
x-evy-trace-virtual-host: all
x-amz-server-side-encryption: AES256
x-hs-cache-status: HIT
date: Fri, 17 Jan 2025 08:50:31 GMT
vary: accept-encoding
content-security-policy-report-only: frame-ancestors 'self'; report-uri https://send.hsbrowserreports.com/csp/report?resource=collected-forms-embed-js/static-1.1283/bundles/project.js&cfRay=8fe2f7f7cb1656a3-WAW
via: 1.1 f57a09c5455a80253c61001d750462e6.cloudfront.net (CloudFront)
cf-ray: 90351920adf83804-FRA
access-control-allow-origin: *
x-evy-trace-route-configuration: listener_https/all
x-amz-cf-pop: IAD12-P3

GET
H2 200 7048931.js Show response
js.hs-analytics.net/analytics/1737103500000/ 68 KB
25 KB 97ms
37ms Script
text/javascript 2606:4700::6810:a0a8
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js.hs-analytics.net/analytics/1737103500000/7048931.js
Requested by: Host: www.picussecurity.com
URL: https://www.picussecurity.com/hs/scriptloader/7048931.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6810:a0a8 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 326282418d162c0341d44f854fbfe4b0dd18929ccf13cb94a56f03b34029d554

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.picussecurity.com/resource/blog/apt29-cozy-bear-evolution-techniques

Response headers

x-amz-server-side-encryption: AES256
x-request-id: d6c55142-7012-4a80-95ab-dcec7b7f9130
content-encoding: gzip
cf-cache-status: HIT
etag: W/"91af0eeeed2ce8d192b077db2e26efe6"
x-amz-version-id: null
age: 280
expires: Fri, 17 Jan 2025 08:50:51 GMT
x-evy-trace-listener: listener_https
date: Fri, 17 Jan 2025 08:50:31 GMT
x-hubspot-correlation-id: d6c55142-7012-4a80-95ab-dcec7b7f9130
content-type: text/javascript
last-modified: Thu, 16 Jan 2025 19:49:37 GMT
vary: origin, Accept-Encoding
x-amz-id-2: 7o0odEV+0jw79VMtb/2P04BTdII+wxBOYaY9qf+BRrD9f3Pb6rZu9+DyQ/j6SwIn5K8y84rD2Cw=
x-evy-trace-route-service-name: envoyset-translator
cache-control: max-age=300,public
x-evy-trace-served-by-pod: iad02/analytics-js-proxy-td/envoy-proxy-8586d94f84-f65mp
x-envoy-upstream-service-time: 75
access-control-allow-credentials: false
x-amz-request-id: 7QF6GX0Y660XSEWJ
cf-ray: 90351920af05925c-FRA
x-evy-trace-route-configuration: listener_https/all
server: cloudflare
x-evy-trace-virtual-host: all

POST
H2 200 open
t.visitorqueue.com/p/ 2 B
315 B 119ms
118ms Ping
text/plain 2600:9000:2490:7a00:c:77c4:d500:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://t.visitorqueue.com/p/open
Requested by: Host: t.visitorqueue.com
URL: https://t.visitorqueue.com/p/tracking.min.js?id=67ab0ee7-fcba-400b-8cb3-db7bb1cc0033
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2490:7a00:c:77c4:d500:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: 565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://www.picussecurity.com/resource/blog/apt29-cozy-bear-evolution-techniques

Response headers

via: 1.1 22ec86e3f4ec676e17ef8eea76eefba2.cloudfront.net (CloudFront)
access-control-request-method: *
access-control-allow-origin: *
x-cache: Miss from cloudfront
content-length: 2
alt-svc: h3=":443"; ma=86400
date: Fri, 17 Jan 2025 08:50:31 GMT
content-type: text/plain
x-amz-cf-pop: FRA56-P6
x-amz-cf-id: sXrg6lw7270J_emQCBV2-HMB-7l0GiBJy3uQA20xxbDl0vApKe4WTA==
access-control-allow-headers: *

GET
H2 200 open
t.visitorqueue.com/p/ 35 B
367 B 306ms
306ms Image
image/gif 2600:9000:2490:7a00:c:77c4:d500:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://t.visitorqueue.com/p/open?l=9&q=cGFnZVZpZXdJZD1jZWY4NmVmNy1iNmRjLTRmNjAtODk5Mi1iOTZlMDllZjRhMjYmcGF0aE5hbWU9L3Jlc291cmNlL2Jsb2cvYXB0MjktY296eS1iZWFyLWV2b2x1dGlvbi10ZWNobmlxdWVzJnZpc2l0b3JJZD0yMDliYWZhNy00MWE1LTRkZjctOTg1Ni1lNWQ2MDgwOThmMzkmdmlzaXRJZD00MDZkNzdiZC1iMTRhLTRmNjktYmM2ZC05NGFlNWYzZWVhYTkmbmV3VmlzaXRvcj0xJmFjY2Vzc2VkQXQ9MTczNzEwMzgzMSZ2cVRyYWNraW5nSWQ9NjdhYjBlZTctZmNiYS00MDBiLThjYjMtZGI3YmIxY2MwMDMzJm9yaWdpbj13d3cucGljdXNzZWN1cml0eS5jb20mc2NyaXB0VmVyc2lvbj0yLjMuMSZwYWdlVmlld0NvdW50PTEmdmlzaXRTdGFydD0xNzM3MTAzODMx
Requested by: Host: www.picussecurity.com
URL: https://www.picussecurity.com/resource/blog/apt29-cozy-bear-evolution-techniques
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2490:7a00:c:77c4:d500:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: 8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.picussecurity.com/resource/blog/apt29-cozy-bear-evolution-techniques

Response headers

cache-control: No-Store
via: 1.1 22ec86e3f4ec676e17ef8eea76eefba2.cloudfront.net (CloudFront)
access-control-request-method: *
access-control-allow-origin: *
x-cache: Miss from cloudfront
content-length: 35
alt-svc: h3=":443"; ma=86400
date: Fri, 17 Jan 2025 08:50:31 GMT
content-type: image/gif
x-amz-cf-pop: FRA56-P6
x-amz-cf-id: V8Q-0DCVpKb88ICBLhKUIHn958f2Ik-ihiM6gqfqtlKQGr70nR5eow==
access-control-allow-headers: *

GET
H2 200 modules.1f3821f9cafd68374ab2.js Show response
script.hotjar.com/ 223 KB
56 KB 78ms
25ms Script
application/javascript 52.222.236.43
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://script.hotjar.com/modules.1f3821f9cafd68374ab2.js

Requested by

Host: static.hotjar.com
URL: https://static.hotjar.com/c/hotjar-2366058.js?sv=6

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.222.236.43 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-52-222-236-43.fra56.r.cloudfront.net

Software

Resource Hash

28a9962f431d01e35ee3a7f72952ab8f8bfb286c38b8dfea9ad530e2d5c4db5b

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.picussecurity.com/resource/blog/apt29-cozy-bear-evolution-techniques

Response headers

x-robots-tag: none
content-encoding: br
etag: "68ecc58a934636e32b60461c4ee4f930"
age: 323004
x-content-type-options: nosniff
x-cache: Hit from cloudfront
x-amz-cf-id: zhQfXWksIYnNHiD95SCoThfi27BZWICLZWQUUZ-8s35axMBZpEmcUg==
date: Mon, 13 Jan 2025 15:07:07 GMT
content-type: application/javascript; charset=utf-8
last-modified: Mon, 13 Jan 2025 15:07:06 GMT
vary: Accept-Encoding
strict-transport-security: max-age=2592000; includeSubDomains
cache-control: max-age=31536000
cross-origin-resource-policy: cross-origin
via: 1.1 a89f27dcb39a061266ddc18ab5416cba.cloudfront.net (CloudFront)
accept-ranges: bytes
access-control-allow-origin: *
content-length: 56393
x-amz-cf-pop: FRA56-P4

GET
H2 200 combinedConfigs Show response
cta-service-cms2.hubspot.com/web-interactives/public/v1/embed/ 2 KB
1 KB 389ms
336ms Fetch
application/json 2606:4700::6810:7574
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cta-service-cms2.hubspot.com/web-interactives/public/v1/embed/combinedConfigs?contentIds=151218727472&contentIds=158544721292&portalId=7048931&currentUrl=https%3A%2F%2Fwww.picussecurity.com%2Fresource%2Fblog%2Fapt29-cozy-bear-evolution-techniques&contentId=183336913844

Requested by

Host: js.hubspot.com
URL: https://js.hubspot.com/web-interactives-embed.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7574 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

15d436832ea63ac77ab00dcedeeda8e38fb2913f7c9d6d217dc6b18c601584f2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.picussecurity.com/resource/blog/apt29-cozy-bear-evolution-techniques

Response headers

x-robots-tag: noindex, follow
access-control-max-age: 180
x-request-id: ad6f42c3-7d28-4d93-a153-044495dab466
content-encoding: gzip
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=xJUuTCkjUXvNdWaZkrcp0cEnwtffY6m%2B9u8ozgWRlGM8h6qY6lmE9mBPPPs2EBCnl4znwAciO6x3UyQlC%2FFe%2B5a5mBoYnFHPalV0cPyCew9wrDxUjze5DOuw4CR6oMNzZ8pc13s6ZNiuuzEpLvbDM%2Bmdz%2F6hW1UDREo%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
access-control-allow-methods: OPTIONS, GET
x-evy-trace-listener: listener_https
date: Fri, 17 Jan 2025 08:50:31 GMT
x-hubspot-correlation-id: ad6f42c3-7d28-4d93-a153-044495dab466
content-type: application/json;charset=utf-8
vary: origin
access-control-allow-headers: Accept, Accept-Charset, Accept-Encoding, Accept-Language, Content-Type, Host, Origin, Referer, User-Agent
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-evy-trace-route-service-name: envoyset-translator
cache-control: max-age=0, no-cache, no-store
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-evy-trace-served-by-pod: iad02/star-hubspot-td/envoy-proxy-b967ccf5d-2g9kq
x-envoy-upstream-service-time: 16
access-control-allow-credentials: true
cf-ray: 90351920b9c19b52-FRA
access-control-allow-origin: https://www.picussecurity.com
x-evy-trace-route-configuration: listener_https/all
content-length: 626
server: cloudflare
x-evy-trace-virtual-host: all

GET
H2 200 html Show response
cta-service-cms2.hubspot.com/web-interactives/public/v1/render/ 1 KB
2 KB 243ms
190ms Fetch
application/json 2606:4700::6810:7574
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cta-service-cms2.hubspot.com/web-interactives/public/v1/render/html?contentIds=151218727472&contentIds=158544721292&portalId=7048931&currentUrl=https%3A%2F%2Fwww.picussecurity.com%2Fresource%2Fblog%2Fapt29-cozy-bear-evolution-techniques&contentId=183336913844&isHubspotPage=true

Requested by

Host: js.hubspot.com
URL: https://js.hubspot.com/web-interactives-embed.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7574 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

1b43b96cdc730ee98b4585054e07f3f94d5135b0f1b7bf68be42b396dd631cd8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.picussecurity.com/resource/blog/apt29-cozy-bear-evolution-techniques

Response headers

x-robots-tag: noindex, follow
access-control-max-age: 180
x-request-id: 5439bfd1-7350-4c17-b75c-3f9b32b2667e
content-encoding: gzip
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=CbjdUExcu3Iu5hwZMDFSN%2Bl0itZku7rtQdKBJBVxGlLcIdqKw69%2Fu33CyaoEnFZRzJAjzrI0yq1tmkhL%2FmSC10KoEi7slPg46v3NVWvDsuMtstIcRl4KJ1U4e1uT09P8ylsdWAicFOcR69UUmWTabK8Xj4hsKmckIM8%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
access-control-allow-methods: OPTIONS, GET
x-evy-trace-listener: listener_https
date: Fri, 17 Jan 2025 08:50:31 GMT
x-hubspot-correlation-id: 5439bfd1-7350-4c17-b75c-3f9b32b2667e
content-type: application/json;charset=utf-8
vary: origin
access-control-allow-headers: Accept, Accept-Charset, Accept-Encoding, Accept-Language, Content-Type, Host, Origin, Referer, User-Agent
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-evy-trace-route-service-name: envoyset-translator
cache-control: max-age=0, no-cache, no-store
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-evy-trace-served-by-pod: iad02/star-hubspot-td/envoy-proxy-b967ccf5d-jmj8r
x-envoy-upstream-service-time: 56
access-control-allow-credentials: true
cf-ray: 90351920b9c39b52-FRA
access-control-allow-origin: https://www.picussecurity.com
x-evy-trace-route-configuration: listener_https/all
content-length: 716
server: cloudflare
x-evy-trace-virtual-host: all

GET
H2 204 has-permission-json Show response
app.hubspot.com/content-tools-menu/api/v1/tools-menu/ 0
455 B 166ms
157ms XHR
text/plain 2606:4700::6810:7674
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://app.hubspot.com/content-tools-menu/api/v1/tools-menu/has-permission-json?portalId=7048931

Requested by

Host: www.picussecurity.com
URL: https://www.picussecurity.com/hs/hsstatic/HubspotToolsMenu/static-1.393/js/index.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7674 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	no-sniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.picussecurity.com/resource/blog/apt29-cozy-bear-evolution-techniques

Response headers

x-request-id: 6fdacbfc-5020-42e3-a388-02b25c897ce7
cf-cache-status: DYNAMIC
x-hs-worker-debug-mode: false
report-to: {"group":"default","max_age":86400,"endpoints":[{"url":"https://send.hsbrowserreports.com/csp/reports"}]}
access-control-allow-methods: GET
x-content-type-options: no-sniff
x-evy-trace-listener: listener_https
date: Fri, 17 Jan 2025 08:50:31 GMT
x-hubspot-correlation-id: 6fdacbfc-5020-42e3-a388-02b25c897ce7
vary: origin, Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
reporting-endpoints: default="https://send.hsbrowserreports.com/csp/reports?cfRay=90351920797fdc59&resource=unknown"
x-evy-trace-route-service-name: envoyset-translator
cache-control: max-age=0
x-evy-trace-served-by-pod: iad02/app-td/envoy-proxy-856d8787d5-pv5fk
x-envoy-upstream-service-time: 3
access-control-allow-credentials: true
cf-ray: 90351920797fdc59-FRA
access-control-allow-origin: https://www.picussecurity.com
x-evy-trace-route-configuration: listener_https/all
server: cloudflare
x-evy-trace-virtual-host: all

GET
DATA 200
OK truncated
/ 180 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: a00ac1e97469410d27c7807937a01a9fb37272970d20a0178bad424be0bdf6ae

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/svg+xml;charset=utf-8

GET
DATA 200
OK truncated
/ 214 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: fffcc1196c1beb2cd92264e3b6efe6fdebc9129610b8308987eff5d97ebab507

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/svg+xml;charset=utf-8

GET
H3 200 jquery.min.js Show response
cdnjs.cloudflare.com/ajax/libs/jquery/3.7.1/ 85 KB
27 KB 28ms
28ms Script
application/javascript 2606:4700::6811:190e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/jquery/3.7.1/jquery.min.js

Requested by

Host: cdn.popt.in
URL: https://cdn.popt.in/pixel.js?id=64d678615e3d0

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6811:190e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

fc9a93dd241f6b045cbff0481cf4e1901becd0e12fb45166a8f17f95823f0b1a

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.picussecurity.com/resource/blog/apt29-cozy-bear-evolution-techniques

Response headers

cf-cdnjs-via: cfworker/kv
content-encoding: br
cf-cache-status: HIT
etag: "64ed75bb-6b36"
age: 50665
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=lCzEgo2q8c%2FStIDgq8vk%2FdZ6zluAt4JHuyijtH6qimIBO0txqPNR%2Fk4QOAlZqzgIEY5p7D1c5zno3h8Z6yo7kTMijxm%2Bs2RY%2FfJPKQYfAnT9giAfpH8Qe1gLcnu3ee2FkfnsOgog2N2csvW1tx23bagF"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
expires: Wed, 07 Jan 2026 08:50:31 GMT
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Fri, 17 Jan 2025 08:50:31 GMT
content-type: application/javascript; charset=utf-8
last-modified: Tue, 29 Aug 2023 04:36:11 GMT
vary: Accept-Encoding
priority: u=3,i=?0
strict-transport-security: max-age=15780000
cache-control: public, max-age=30672000
timing-allow-origin: *
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
cross-origin-resource-policy: cross-origin
cf-ray: 90351920e9b7dbe8-FRA
accept-ranges: bytes
access-control-allow-origin: *
content-length: 27446
server: cloudflare

GET
H2 200 cf-location Show response
js.hs-banner.com/v2/ 2 B
345 B 73ms
30ms Fetch
text/plain 2606:4700:4400::ac40:9310
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js.hs-banner.com/v2/cf-location
Requested by: Host: js.hs-banner.com
URL: https://js.hs-banner.com/v2/7048931/banner.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:4400::ac40:9310 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6814ef46f686990cf4e946f966167b0507e1d642c44e51f61bffb0bba2d4672b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.picussecurity.com/resource/blog/apt29-cozy-bear-evolution-techniques

Response headers

cache-control: private, max-age=1500
cf-ray: 903519213ea0dc90-FRA
access-control-allow-origin: *
content-length: 2
date: Fri, 17 Jan 2025 08:50:31 GMT
content-type: text/plain;charset=UTF-8
vary: Accept-Encoding
server: cloudflare

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 362 KB
117 KB 91ms
42ms Script
application/javascript 2a00:1450:4001:82b::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-N3KD4ZR

Requested by

Host: www.picussecurity.com
URL: https://www.picussecurity.com/resource/blog/apt29-cozy-bear-evolution-techniques

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

0120aa4d7cc1cf96b08f24a7d702f342cc96fa02b693b8739009b000bad5a88a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.picussecurity.com/resource/blog/apt29-cozy-bear-evolution-techniques

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:1080:0"}],}
expires: Fri, 17 Jan 2025 08:50:31 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 17 Jan 2025 08:50:31 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Fri, 17 Jan 2025 06:00:00 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:1080:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 119060
x-xss-protection: 0
server: Google Tag Manager

GET
H2 200 css2
fonts.googleapis.com/ 2 KB
575 B 40ms
40ms Stylesheet
text/css 2a00:1450:4001:80f::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Lato:ital,wght@0,400;0,700;1,400&display=swap

Requested by

Host: js.hs-banner.com
URL: https://js.hs-banner.com/v2/7048931/banner.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

ce1eade43de61291fb7e1708bdbe373f955aa88e54e9c894fa6ab1ed455ab1b5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.picussecurity.com/resource/blog/apt29-cozy-bear-evolution-techniques

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Fri, 17 Jan 2025 08:50:31 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 17 Jan 2025 08:50:31 GMT
content-type: text/css; charset=utf-8
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
last-modified: Fri, 17 Jan 2025 08:35:50 GMT
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
cross-origin-opener-policy: same-origin-allow-popups
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
x-xss-protection: 0
server: ESF

POST
H2 204 view
js.hs-banner.com/v2/activity/ 0
0 149ms
148ms Fetch 2606:4700:4400::ac40:9310
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://js.hs-banner.com/v2/activity/view

Requested by

Host: js.hs-banner.com
URL: https://js.hs-banner.com/v2/7048931/banner.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::ac40:9310 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Content-Type: application/json
Referer: https://www.picussecurity.com/resource/blog/apt29-cozy-bear-evolution-techniques

Response headers

access-control-max-age: 604800
x-request-id: 80e59eda-b241-429a-8353-6f4450ab116e
access-control-expose-headers: x-last-modified-timestamp, X-HubSpot-NotFound, X-HS-User-Request, Link, Server-Timing
cf-cache-status: DYNAMIC
x-content-type-options: nosniff
access-control-allow-methods: GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD
x-evy-trace-listener: listener_http, listener_https
date: Fri, 17 Jan 2025 08:50:31 GMT
x-hubspot-correlation-id: 80e59eda-b241-429a-8353-6f4450ab116e
vary: origin
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Accept-Charset, Accept-Encoding, X-Override-Internal-Permissions, X-Properties-Source, X-Properties-SourceId, X-Properties-Flag, X-Hubspot-User-Id, X-Hubspot-Trace, X-Hubspot-Callee, X-Hubspot-Offset, X-Hubspot-No-Trace, X-HubSpot-Static-App-Info, X-HubSpot-Messages-Uri, X-HubSpot-Request-Source, X-HubSpot-Request-Reason, Subscription-Billing-Auth-Token, X-App-CSRF, X-Tools-CSRF, Online-Payment-Signing-UUID, X-Source, X-SourceId, X-Origin-UserId, X-Biden-Request-Source, X-HubSpot-CSRF-hubspotapi, X-Force-Cookie-Refresh, X-Force-Cookie-Refresh-No-Cache, X-HS-User-Request, X-Application-Id, X-HS-Referer, X-HubSpot-Correlation-Id
x-evy-trace-route-service-name: envoyset-translator, envoyset-translator
x-evy-trace-served-by-pod: iad02/private-hubapi-td/envoy-proxy-5f9df65f7b-r6pwb, iad02/analytics-js-proxy-td/envoy-proxy-8586d94f84-zddwd
timing-allow-origin: *
x-envoy-upstream-service-time: 26
access-control-allow-credentials: true
cf-ray: 903519220ff8dc90-FRA
access-control-allow-origin: https://www.picussecurity.com
x-evy-trace-route-configuration: listener_http/all, listener_https/all
server: cloudflare
x-evy-trace-virtual-host: all, all

OPTIONS
H2 200 view
js.hs-banner.com/v2/activity/ Frame 0
0 167ms
127ms Preflight
application/octet-stream 2606:4700:4400::ac40:9310
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js.hs-banner.com/v2/activity/view
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:4400::ac40:9310 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://www.picussecurity.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Accept-Charset, Accept-Encoding, X-Override-Internal-Permissions, X-Properties-Source, X-Properties-SourceId, X-Properties-Flag, X-Hubspot-User-Id, X-Hubspot-Trace, X-Hubspot-Callee, X-Hubspot-Offset, X-Hubspot-No-Trace, X-HubSpot-Static-App-Info, X-HubSpot-Messages-Uri, X-HubSpot-Request-Source, X-HubSpot-Request-Reason, Subscription-Billing-Auth-Token, X-App-CSRF, X-Tools-CSRF, Online-Payment-Signing-UUID, X-Source, X-SourceId, X-Origin-UserId, X-Biden-Request-Source, X-HubSpot-CSRF-hubspotapi, X-Force-Cookie-Refresh, X-Force-Cookie-Refresh-No-Cache, X-HS-User-Request, X-Application-Id, X-HS-Referer, X-HubSpot-Correlation-Id
access-control-allow-methods: GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD
access-control-allow-origin: https://www.picussecurity.com
access-control-expose-headers: x-last-modified-timestamp, X-HubSpot-NotFound, X-HS-User-Request, Link, Server-Timing
access-control-max-age: 604800
cf-cache-status: DYNAMIC
cf-ray: 903519213ea3dc90-FRA
content-length: 0
content-type: application/octet-stream
date: Fri, 17 Jan 2025 08:50:31 GMT
server: cloudflare
timing-allow-origin: *
vary: origin
x-envoy-upstream-service-time: 1
x-evy-trace-listener: listener_https
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-route-service-name: envoyset-translator
x-evy-trace-served-by-pod: iad02/analytics-js-proxy-td/envoy-proxy-8586d94f84-mgk9v
x-evy-trace-virtual-host: all
x-hubspot-correlation-id: c177296d-eae1-4405-b43c-1bd444305463
x-request-id: c177296d-eae1-4405-b43c-1bd444305463

GET
H2 200 json Show response
api.hubapi.com/hs-script-loader-public/v1/config/pixels-and-events/ 114 B
1013 B 192ms
141ms XHR
application/json 2606:4700::6812:f06c
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://api.hubapi.com/hs-script-loader-public/v1/config/pixels-and-events/json?portalId=7048931

Requested by

Host: js.hsadspixel.net
URL: https://js.hsadspixel.net/fb.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:f06c , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

109a14abac939df0ab29af6bbf5c0ca592b1cdf7adb33a0052f166c8b303bc37

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.picussecurity.com/resource/blog/apt29-cozy-bear-evolution-techniques

Response headers

access-control-max-age: 180
content-encoding: br
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=0C9Sqtue8fwxyPILUrhHaa%2FbG%2FGMpBn9WA4ydDzzR1M9E%2FJ8lyyL4%2FV0RhJZEYUQvk1A5qAy%2F7mb8H8brZzgz75%2FlQ7U6EC1oJ6nGt2zSvJXQPTbLv%2FBsGsuFmrle498yF0dFuyzRv1i4onQ"}],"group":"cf-nel","max_age":604800}
access-control-allow-methods: GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD
x-content-type-options: nosniff
date: Fri, 17 Jan 2025 08:50:31 GMT
x-hubspot-correlation-id: e5571189-79e7-43a3-ae26-998193b9f231
content-type: application/json;charset=utf-8
vary: origin, Accept-Encoding
access-control-allow-headers: *
strict-transport-security: max-age=31536000; includeSubDomains; preload
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
access-control-allow-credentials: false
cf-ray: 9035192158dfdbf4-FRA
access-control-allow-origin: https://www.picussecurity.com
server: cloudflare

GET
H3 200 widget Show response
www.picussecurity.com/_hcms/livechat/ 314 B
1 KB 165ms
165ms XHR
application/json 2606:2c40::c73c:67e3
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.picussecurity.com/_hcms/livechat/widget?portalId=7048931&conversations-embed=static-1.19797&mobile=false&messagesUtk=e0ac33cc917a4b2da8c8638a3e440fd4&traceId=e0ac33cc917a4b2da8c8638a3e440fd4

Requested by

Host: js.usemessages.com
URL: https://js.usemessages.com/conversations-embed.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:2c40::c73c:67e3 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare London, LLC, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6202a707389216018296d2573a0e128aaa0e4036b8177721b4e40df999ba87e4

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
X-HubSpot-Messages-Uri: https://www.picussecurity.com/resource/blog/apt29-cozy-bear-evolution-techniques
Referer: https://www.picussecurity.com/resource/blog/apt29-cozy-bear-evolution-techniques

Response headers

cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=2XZQIOGoH%2Fd%2BBuFK6VWK8GpmASlD0DCi0BEcTbRTn8NJQRRUehyzbeMNFcqQV98L9V%2F2bUaV1%2BHw8hQ%2BXDWYmw6Cu8%2FRK53T9Ykvi0N%2FSIM9RlgXUg%2BcoktkTJXHXJnYSko1JDShZwd8NJ6PapZ86%2FKu5g%3D%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-methods: GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Fri, 17 Jan 2025 08:50:31 GMT
x-hubspot-correlation-id: fef7423b-5e0f-49aa-b561-108678107227
content-type: application/json;charset=utf-8
vary: origin, Accept-Encoding
priority: u=1,i
access-control-allow-headers: Accept, Accept-Charset, Accept-Encoding, Accept-Language, Content-Type, Host, Origin, Referer, User-Agent, X-HubSpot-Messages-Uri
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-security-policy: upgrade-insecure-requests
cache-control: no-cache, no-store, no-transform, must-revalidate, max-age=0
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
access-control-allow-credentials: false
cf-ray: 90351921282e2c2e-FRA
server: cloudflare

GET
H3 200 counters.gif
forms-na1.hsforms.com/embed/v3/ 35 B
916 B 160ms
126ms Image
image/gif 2606:4700::6813:afbc
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://forms-na1.hsforms.com/embed/v3/counters.gif?key=forms-embed-v2-DEFINITION_SUCCESS&count=1

Requested by

Host: www.picussecurity.com
URL: https://www.picussecurity.com/resource/blog/apt29-cozy-bear-evolution-techniques

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6813:afbc , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.picussecurity.com/resource/blog/apt29-cozy-bear-evolution-techniques

Response headers

x-robots-tag: none
x-request-id: 65687341-d156-4280-8a60-26776abf8fc1
access-control-expose-headers: X-Origin-Hublet
cf-cache-status: DYNAMIC
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
x-evy-trace-listener: listener_https
server-timing: cfExtPri
date: Fri, 17 Jan 2025 08:50:31 GMT
x-hubspot-correlation-id: 65687341-d156-4280-8a60-26776abf8fc1
content-type: image/gif
vary: origin
priority: u=3,i
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-evy-trace-route-service-name: envoyset-translator
cache-control: max-age=0, no-cache, no-store
x-evy-trace-served-by-pod: iad02/star-hubspot-td/envoy-proxy-b967ccf5d-qqnrv
x-envoy-upstream-service-time: 1
access-control-allow-credentials: false
cf-ray: 903519216cea699b-FRA
x-evy-trace-route-configuration: listener_https/all
content-length: 35
server: cloudflare
x-evy-trace-virtual-host: all

GET
H2 200 json Show response
forms.hscollectedforms.net/collected-forms/v1/config/ 135 B
676 B 140ms
132ms XHR
application/json 2606:4700::6810:6bfe
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://forms.hscollectedforms.net/collected-forms/v1/config/json?portalId=7048931&utk=

Requested by

Host: js.hscollectedforms.net
URL: https://js.hscollectedforms.net/collectedforms.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:6bfe , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0af58bcdda4bce4a998c3c1d32d5a6bbebd8ef7c7007e8888531cb493cc9f64b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Accept: application/json, text/plain, */*
Referer: https://www.picussecurity.com/resource/blog/apt29-cozy-bear-evolution-techniques

Response headers

x-robots-tag: none
access-control-max-age: 180
x-request-id: c7b9a73f-6405-4459-ae80-fc31acdde0a9
content-encoding: br
cf-cache-status: DYNAMIC
access-control-allow-methods: GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD
x-content-type-options: nosniff
x-evy-trace-listener: listener_https
date: Fri, 17 Jan 2025 08:50:31 GMT
x-hubspot-correlation-id: c7b9a73f-6405-4459-ae80-fc31acdde0a9
content-type: application/json;charset=utf-8
vary: Accept-Encoding
access-control-allow-headers: *
x-evy-trace-route-service-name: envoyset-translator
cache-control: max-age=0
x-evy-trace-served-by-pod: iad02/app-td/envoy-proxy-856d8787d5-wzzh5
x-envoy-upstream-service-time: 9
cf-ray: 903519214e8d3804-FRA
access-control-allow-origin: https://www.picussecurity.com
x-evy-trace-route-configuration: listener_https/all
server: cloudflare
x-evy-trace-virtual-host: all

GET
H2 204 2366058 Show response
vc.hotjar.io/sessions/ 0
232 B 132ms
53ms XHR
text/plain 18.66.112.15
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://vc.hotjar.io/sessions/2366058?s=0.25&r=0.21711893897693924
Requested by: Host: script.hotjar.com
URL: https://script.hotjar.com/modules.1f3821f9cafd68374ab2.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.66.112.15 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-66-112-15.fra56.r.cloudfront.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.picussecurity.com/resource/blog/apt29-cozy-bear-evolution-techniques

Response headers

via: 1.1 83f46196ad7d99e4351e2a7adab8f174.cloudfront.net (CloudFront)
access-control-allow-origin: *
cache-control: no-store
x-cache: Miss from cloudfront
x-amz-cf-id: Y-2s8MYLoGKfg9F5LvTfCzuvztNoRu0Efxn8eSSWqQf5EWPdi7FV-A==
date: Fri, 17 Jan 2025 08:50:31 GMT
x-amz-cf-pop: FRA56-P5

GET
H3 200 S6uyw4BMUTPHjx4wXg.woff2
fonts.gstatic.com/s/lato/v24/ 23 KB
23 KB 22ms
22ms Font
font/woff2 2a00:1450:4001:80e::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/lato/v24/S6uyw4BMUTPHjx4wXg.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Lato:ital,wght@0,400;0,700;1,400&display=swap

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

918b7dc3e2e2d015c16ce08b57bcb64d2253bafc1707658f361e72865498e537

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://www.picussecurity.com
Referer: https://fonts.googleapis.com/

Response headers

age: 258761
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
x-content-type-options: nosniff
expires: Wed, 14 Jan 2026 08:57:50 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Tue, 14 Jan 2025 08:57:50 GMT
last-modified: Tue, 02 May 2023 15:17:22 GMT
content-type: font/woff2
cache-control: public, max-age=31536000
timing-allow-origin: *
cross-origin-opener-policy: same-origin; report-to="apps-themes"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
accept-ranges: bytes
access-control-allow-origin: *
content-length: 23580
x-xss-protection: 0
server: sffe

GET
H3 200 S6u9w4BMUTPHh6UVSwiPGQ.woff2
fonts.gstatic.com/s/lato/v24/ 23 KB
23 KB 24ms
24ms Font
font/woff2 2a00:1450:4001:80e::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/lato/v24/S6u9w4BMUTPHh6UVSwiPGQ.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Lato:ital,wght@0,400;0,700;1,400&display=swap

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c447dd7677b419db7b21dbdfc6277c7816a913ffda76fd2e52702df538de0e49

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://www.picussecurity.com
Referer: https://fonts.googleapis.com/

Response headers

age: 258220
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
x-content-type-options: nosniff
expires: Wed, 14 Jan 2026 09:06:51 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Tue, 14 Jan 2025 09:06:51 GMT
last-modified: Tue, 02 May 2023 15:07:25 GMT
content-type: font/woff2
cache-control: public, max-age=31536000
timing-allow-origin: *
cross-origin-opener-policy: same-origin; report-to="apps-themes"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
accept-ranges: bytes
access-control-allow-origin: *
content-length: 23040
x-xss-protection: 0
server: sffe

POST
H2 200 / Show response
content.hotjar.io/ 56 B
171 B 249ms
127ms XHR
application/json 52.210.81.110
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://content.hotjar.io/?site_id=2366058&gzip=1
Requested by: Host: script.hotjar.com
URL: https://script.hotjar.com/modules.1f3821f9cafd68374ab2.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.210.81.110 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-210-81-110.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: acd99bc44c7dee5ab0ef7bc6c98937717e7b36b8fe8eef3a6ea9ec44ef2f90b0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Content-Type: text/plain; charset=UTF-8
Referer: https://www.picussecurity.com/resource/blog/apt29-cozy-bear-evolution-techniques

Response headers

access-control-max-age: 86400
access-control-allow-origin: *
content-length: 56
date: Fri, 17 Jan 2025 08:50:31 GMT
content-type: application/json

GET
H3 200 counters.gif
forms-na1.hsforms.com/embed/v3/ 35 B
881 B 129ms
129ms Image
image/gif 2606:4700::6813:afbc
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://forms-na1.hsforms.com/embed/v3/counters.gif?key=forms-embed-v2-RENDER_SUCCESS&count=1

Requested by

Host: www.picussecurity.com
URL: https://www.picussecurity.com/resource/blog/apt29-cozy-bear-evolution-techniques

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6813:afbc , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.picussecurity.com/resource/blog/apt29-cozy-bear-evolution-techniques

Response headers

x-robots-tag: none
x-request-id: a3243512-a741-4fa9-916c-f4cb0c61ba70
access-control-expose-headers: X-Origin-Hublet
cf-cache-status: DYNAMIC
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
x-evy-trace-listener: listener_https
server-timing: cfExtPri
date: Fri, 17 Jan 2025 08:50:31 GMT
x-hubspot-correlation-id: a3243512-a741-4fa9-916c-f4cb0c61ba70
content-type: image/gif
vary: origin
priority: u=3,i
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-evy-trace-route-service-name: envoyset-translator
cache-control: max-age=0, no-cache, no-store
x-evy-trace-served-by-pod: iad02/star-hubspot-td/envoy-proxy-b967ccf5d-pk4c4
x-envoy-upstream-service-time: 3
access-control-allow-credentials: false
cf-ray: 90351921dd3f699b-FRA
x-evy-trace-route-configuration: listener_https/all
content-length: 35
server: cloudflare
x-evy-trace-virtual-host: all

POST
H3 200 64d678615e3d0 Show response
display.popt.in/api/display/ 6 KB
2 KB 343ms
306ms XHR
application/json 2606:4700:3031::ac43:a6ca
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://display.popt.in/api/display/64d678615e3d0

Requested by

Host: cdnjs.cloudflare.com
URL: https://cdnjs.cloudflare.com/ajax/libs/jquery/3.7.1/jquery.min.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3031::ac43:a6ca , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7dcd5e1ea1ce1c1aaabc54e378185ce8daae846cb2517d370280d8c1bfa95813

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://bc.popt.in https://.mybigcommerce.com https://.jumpseller.com https://.myshopline.com https://.myshopify.com https://.grisynava.com https://poptin.test https://poptinemail.test https://.dev.popt.in https://amantilak.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff, nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.picussecurity.com/resource/blog/apt29-cozy-bear-evolution-techniques
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Accept: application/json, text/javascript, */*; q=0.01
Content-Type: application/x-www-form-urlencoded; charset=UTF-8

Response headers

content-encoding: gzip
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=l9dSlhjChOgwcKx6oHQ3EDl1dV5qAx%2BM6oZtyWMpdy0%2FLJiE9vDPKG5vlstxLxq4%2FKa03CrV9wx1P215d7DvfjcO8nKYi15d%2BrQ9CQC4ANQ3KewzfvmvVcf4Fhw3l1a4bcvGymkBUPMjstqBi4U%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff, nosniff
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=22261&min_rtt=21663&rtt_var=3953&sent=11&recv=12&lost=0&retrans=0&sent_bytes=4124&recv_bytes=5817&delivery_rate=586&cwnd=12000&unsent_bytes=0&cid=697f163569f80189&ts=310&x=1", cfExtPri, cfHdrFlush;dur=0
date: Fri, 17 Jan 2025 08:50:31 GMT
content-type: application/json
vary: Accept-Encoding
priority: u=1,i
x-frame-options: SAMEORIGIN
access-control-allow-headers: Origin, Content-Type
strict-transport-security: max-age=31536000; includeSubDomains
content-security-policy: frame-ancestors https://bc.popt.in https://*.mybigcommerce.com https://*.jumpseller.com https://*.myshopline.com https://*.myshopify.com https://*.grisynava.com https://poptin.test https://poptinemail.test https://*.dev.popt.in https://amantilak.com
cache-control: no-cache, private
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
access-control-allow-credentials: true
cf-ray: 9035192239f371c4-FRA
access-control-allow-origin: *
x-xss-protection: 1; mode=block
server: cloudflare

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 291 KB
100 KB 40ms
39ms Script
application/javascript 2a00:1450:4001:82b::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-670063733&l=dataLayer&cx=c&gtm=45He51d0v837849470za200

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-N3KD4ZR

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

c643d360774246811d0309f6c7357dacc875243941403fb0edcb2d3e37e2a159

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.picussecurity.com/resource/blog/apt29-cozy-bear-evolution-techniques

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],}
expires: Fri, 17 Jan 2025 08:50:31 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 17 Jan 2025 08:50:31 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Fri, 17 Jan 2025 06:00:00 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 102440
x-xss-protection: 0
server: Google Tag Manager

POST
H3 200 collect
pagead2.googlesyndication.com/ccm/ 0
0 73ms
31ms Ping
text/plain 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://pagead2.googlesyndication.com/ccm/collect?en=page_view&dl=https%3A%2F%2Fwww.picussecurity.com%2Fresource%2Fblog%2Fapt29-cozy-bear-evolution-techniques&scrsrc=www.googletagmanager.com&frm=0&rnd=1980324195.1737103831&navt=n&npa=1&gtm=45He51d0v837849470za200&gcs=G100&gcd=13u3u3u2u5l1&dma_cps=-&dma=1&tag_exp=102067555~102067808~102081485~102123608&tft=1737103831370&tfd=1027&apve=1
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-N3KD4ZR
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.picussecurity.com/resource/blog/apt29-cozy-bear-evolution-techniques

Response headers

GET
H2 200 insight.min.js Show response
snap.licdn.com/li.lms-analytics/ 25 KB
9 KB 134ms
40ms Script
application/javascript 2a02:26f0:3500:10::210:a9a
AKAMAI-ASN1 Akama...

General

Check archive.org

Show headers Download Go to

Full URL

https://snap.licdn.com/li.lms-analytics/insight.min.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-N3KD4ZR

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:3500:10::210:a9a Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),

Reverse DNS

Software

Resource Hash

8273304fd0142c815d16b78e336b373d5446fcc4a06167972d581721209fc3ca

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.picussecurity.com/resource/blog/apt29-cozy-bear-evolution-techniques

Response headers

cache-control: max-age=12612
content-encoding: gzip
x-cdn: AKAM
x-content-type-options: nosniff
accept-ranges: bytes
content-length: 9404
date: Fri, 17 Jan 2025 08:50:31 GMT
last-modified: Wed, 15 Jan 2025 10:09:18 GMT
content-type: application/javascript;charset=utf-8
vary: Accept-Encoding
x-amz-server-side-encryption: AES256

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 428 KB
136 KB 43ms
43ms Script
application/javascript 2a00:1450:4001:82b::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-DB6MKXQ2E6&l=dataLayer&cx=c&gtm=45He51d0v837849470za200

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-N3KD4ZR

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

61511c5c4086c97cc5afe6c5bb9f9bb444e559e8fafbd2f7d34e5b5539a12a14

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.picussecurity.com/resource/blog/apt29-cozy-bear-evolution-techniques

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],}
expires: Fri, 17 Jan 2025 08:50:31 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 17 Jan 2025 08:50:31 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 138693
x-xss-protection: 0
server: Google Tag Manager

GET
H3 200 counters.gif
perf-na1.hsforms.com/embed/v3/ 35 B
921 B 138ms
129ms Image
image/gif 2606:4700::6813:afbc
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://perf-na1.hsforms.com/embed/v3/counters.gif?key=inline-interactive-render-success&value=1

Requested by

Host: www.picussecurity.com
URL: https://www.picussecurity.com/resource/blog/apt29-cozy-bear-evolution-techniques

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6813:afbc , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.picussecurity.com/resource/blog/apt29-cozy-bear-evolution-techniques

Response headers

x-robots-tag: none
x-request-id: 5dba899b-592f-4c4d-a587-a64c8ba0014d
access-control-expose-headers: X-Origin-Hublet
cf-cache-status: MISS
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
x-evy-trace-listener: listener_https
server-timing: cfExtPri
date: Fri, 17 Jan 2025 08:50:31 GMT
x-hubspot-correlation-id: 5dba899b-592f-4c4d-a587-a64c8ba0014d
content-type: image/gif
vary: origin, Accept-Encoding
last-modified: Fri, 17 Jan 2025 08:50:31 GMT
priority: u=3,i
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-evy-trace-route-service-name: envoyset-translator
cache-control: max-age=0, no-cache, no-store
x-evy-trace-served-by-pod: iad02/star-hubspot-td/envoy-proxy-b967ccf5d-b6857
x-envoy-upstream-service-time: 2
access-control-allow-credentials: false
cf-ray: 903519223d63699b-FRA
accept-ranges: bytes
x-evy-trace-route-configuration: listener_https/all
content-length: 35
server: cloudflare
x-evy-trace-virtual-host: all

GET
H3 200 counters.gif
forms.hsforms.com/embed/v3/ 35 B
880 B 137ms
129ms Image
image/gif 2606:4700::6813:afbc
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://forms.hsforms.com/embed/v3/counters.gif?key=collected-forms-embed-js-form-bind&count=1

Requested by

Host: www.picussecurity.com
URL: https://www.picussecurity.com/resource/blog/apt29-cozy-bear-evolution-techniques

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6813:afbc , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.picussecurity.com/resource/blog/apt29-cozy-bear-evolution-techniques

Response headers

x-robots-tag: none
x-request-id: 7163b8be-bdbd-46ea-a3d9-0bf0d8d4bb09
access-control-expose-headers: X-Origin-Hublet
cf-cache-status: DYNAMIC
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
x-evy-trace-listener: listener_https
server-timing: cfExtPri
date: Fri, 17 Jan 2025 08:50:31 GMT
x-hubspot-correlation-id: 7163b8be-bdbd-46ea-a3d9-0bf0d8d4bb09
content-type: image/gif
vary: origin
priority: u=3,i
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-evy-trace-route-service-name: envoyset-translator
cache-control: max-age=0, no-cache, no-store
x-evy-trace-served-by-pod: iad02/star-hubspot-td/envoy-proxy-b967ccf5d-hhvtf
x-envoy-upstream-service-time: 4
access-control-allow-credentials: false
cf-ray: 903519223d66699b-FRA
x-evy-trace-route-configuration: listener_https/all
content-length: 35
server: cloudflare
x-evy-trace-virtual-host: all

GET
H2 200 sw_iframe.html
www.googletagmanager.com/static/service_worker/51g0/ Frame 322E 0
0 73ms
22ms Document
text/html 2a00:1450:4001:82b::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/static/service_worker/51g0/sw_iframe.html?origin=https%3A%2F%2Fwww.picussecurity.com

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-N3KD4ZR

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
age: 53712
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: br
content-length: 1476
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="analytics-container-tag-serving"
cross-origin-resource-policy: cross-origin
date: Thu, 16 Jan 2025 17:55:19 GMT
expires: Fri, 16 Jan 2026 17:55:19 GMT
last-modified: Thu, 16 Jan 2025 10:38:00 GMT
report-to: {"group":"analytics-container-tag-serving","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/analytics-container-tag-serving"}]}
server: sffe
service-worker-allowed: /static/service_worker
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

POST
H2 204 collect
region1.google-analytics.com/g/ 0
0 138ms
31ms Fetch
text/plain 2001:4860:4802:34::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://region1.google-analytics.com/g/collect?v=2&tid=G-DB6MKXQ2E6&gtm=45je51d0v872608557za200zb837849470&_p=1737103831184&gcs=G100&gcd=13q3qPq2q5l1&npa=1&dma_cps=-&dma=1&tag_exp=102067555~102067808~102081485~102123608&gdid=dZTQ1Zm&cid=615741802.1737103831&ul=de-de&sr=1600x1200&ir=1&are=1&frm=0&pscdl=denied&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_eu=BA&_s=1&dl=https%3A%2F%2Fwww.picussecurity.com%2Fresource%2Fblog%2Fapt29-cozy-bear-evolution-techniques&sid=1737103831&sct=1&seg=0&dt=APT29%20Explained%3A%20Cozy%20Bear%27s%20Evolution%2C%20Techniques%2C%20and%20Notorious%20Cyber%20Attacks&en=page_view&_fv=1&_ss=1&ep.page_location_clean=https%3A%2F%2Fwww.picussecurity.com%2Fresource%2Fblog%2Fapt29-cozy-bear-evolution-techniques&ep.anonymizeIp=true&tfd=1142
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-DB6MKXQ2E6&l=dataLayer&cx=c&gtm=45He51d0v837849470za200
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:34::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.picussecurity.com/resource/blog/apt29-cozy-bear-evolution-techniques

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:86:0
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:86:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://www.picussecurity.com
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 17 Jan 2025 08:50:31 GMT
content-type: text/plain
server: Golfe2

POST
H2 200 personalization Show response
p.visitorqueue.com/ 24 B
165 B 339ms
115ms XHR
application/json 15.157.148.248
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://p.visitorqueue.com/personalization
Requested by: Host: personalisation.visitorqueue.com
URL: https://personalisation.visitorqueue.com/p/personalisation.min.js?id=67ab0ee7-fcba-400b-8cb3-db7bb1cc0033
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 15.157.148.248 Montreal, Canada, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-15-157-148-248.ca-central-1.compute.amazonaws.com
Software: /
Resource Hash: b687d1ff1bb1385dfef7d064b930c67934354bd0cee4c2aa2500a329ff0d98c4

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://www.picussecurity.com/resource/blog/apt29-cozy-bear-evolution-techniques

Response headers

access-control-request-method: *
access-control-allow-origin: *
content-length: 24
date: Fri, 17 Jan 2025 08:50:31 GMT
content-type: application/json
access-control-allow-headers: *

GET
H3 200 counters.gif
perf-na1.hsforms.com/embed/v3/ 35 B
611 B 172ms
172ms Image
image/gif 2606:4700::6813:afbc
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://perf-na1.hsforms.com/embed/v3/counters.gif?key=config-loaded-success&value=1

Requested by

Host: www.picussecurity.com
URL: https://www.picussecurity.com/resource/blog/apt29-cozy-bear-evolution-techniques

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6813:afbc , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.picussecurity.com/resource/blog/apt29-cozy-bear-evolution-techniques

Response headers

x-robots-tag: none
x-request-id: 5c244fa3-cbc5-4fc3-ad6c-3172668e616c
access-control-expose-headers: X-Origin-Hublet
cf-cache-status: MISS
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
x-evy-trace-listener: listener_https
server-timing: cfExtPri
date: Fri, 17 Jan 2025 08:50:31 GMT
x-hubspot-correlation-id: 5c244fa3-cbc5-4fc3-ad6c-3172668e616c
content-type: image/gif
vary: origin, Accept-Encoding
last-modified: Fri, 17 Jan 2025 08:50:31 GMT
priority: u=3,i
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-evy-trace-route-service-name: envoyset-translator
cache-control: max-age=0, no-cache, no-store
x-evy-trace-served-by-pod: iad02/star-hubspot-td/envoy-proxy-b967ccf5d-kb529
x-envoy-upstream-service-time: 2
access-control-allow-credentials: false
cf-ray: 90351922ddb2699b-FRA
accept-ranges: bytes
x-evy-trace-route-configuration: listener_https/all
content-length: 35
server: cloudflare
x-evy-trace-virtual-host: all

GET
H2

200

blank001.gif
static.hsappstatic.net/static-hubspot-com/static-1.270519761/img/trackers/
Redirect Chain

https://cta-service-cms2.hubspot.com/web-interactives/public/v1/track/view?webInteractiveContentId=151218727472&webInteractiveId=286429421129&containerType=EMBEDDED&portalId=7048931&audienceId=null...
https://static.hubspot.com/img/trackers/blank001.gif
https://static.hsappstatic.net/static-hubspot-com/static-1.270519761/img/trackers/blank001.gif

43 B
1 KB

88ms
34ms

Image
image/gif

2606:4700::6811:af5b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.hsappstatic.net/static-hubspot-com/static-1.270519761/img/trackers/blank001.gif

Requested by

Host: www.picussecurity.com
URL: https://www.picussecurity.com/resource/blog/apt29-cozy-bear-evolution-techniques

Protocol

Server

2606:4700::6811:af5b , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

115c7f3cf61e4ec19070b9e59e20e78756d39d193eb9b544065059b9935d2491

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.picussecurity.com/resource/blog/apt29-cozy-bear-evolution-techniques

Response headers

cf-bgj: imgq:85,h2pri
etag: "51416c7ff0b9d7efc8c9b16d84052fab"
x-amz-version-id: MFfZlkR4U8_6aknbgflTSIqo4fNbniK3
cf-cache-status: HIT
age: 2000251
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=9uYwQEpC%2FaCiIT0jlMzgpROzcOsgX6hBrhUWU%2BsSFXvxKatbXWXEXRm2t%2FsubYHVnhGhI7FCZ5vz5CPoRxDi1Xb0ZrZIO8%2Fd%2FRXJj%2FtUwUpJH8PkrQBsAlTwe8cOnAZ8cLuixMf7qjDlmoGh7k9YhFsqSHQ%3D"}],"group":"cf-nel","max_age":604800}
expires: Sat, 17 Jan 2026 08:50:31 GMT
cf-polished: origSize=49, status=webp_bigger
x-cache: RefreshHit from cloudfront
x-amz-cf-id: eUZiij1BJVn5MySA-T8HsGGaKZYh6COEa3xKCPqnrRYBK6JlK-dIqQ==
date: Fri, 17 Jan 2025 08:50:31 GMT
content-type: image/gif
last-modified: Thu, 15 Apr 2021 16:47:19 GMT
vary: Origin,Accept-Encoding,Access-Control-Request-Headers,Access-Control-Request-Method
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-amz-replication-status: COMPLETED
cache-control: public, max-age=31536000
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
via: 1.1 14b4c9293b57ce6b6f8a0f276a7df856.cloudfront.net (CloudFront)
cf-ray: 903519244bafd266-FRA
accept-ranges: bytes
content-length: 43
x-amz-cf-pop: WAW51-P5
server: cloudflare
x-amz-server-side-encryption: AES256

Redirect headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: max-age=3600
location: https://static.hsappstatic.net/static-hubspot-com/static-1.270519761/img/trackers/blank001.gif
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=2dEE4e29t3QpnfKimbeuxYkPhTjk8b79zQJT%2BI03dmMl2nAAsXZs7XqLRmP7xD0AJ4%2BSEDq4LHmxN1GMM4ZfEwKnMtYUGOcfNL5WC5pByuYtmGC9rIpT5btRRSPX0AK%2B%2FysAdc1lC7A5%2FM7zKLeEpw%3D%3D"}],"group":"cf-nel","max_age":604800}
cf-ray: 90351923cf2fdc59-FRA
expires: Fri, 17 Jan 2025 09:50:31 GMT
content-length: 167
date: Fri, 17 Jan 2025 08:50:31 GMT
content-type: text/html
vary: Accept-Encoding
server: cloudflare

GET
H2

200

blank001.gif
static.hsappstatic.net/static-hubspot-com/static-1.270519761/img/trackers/
Redirect Chain

https://cta-service-cms2.hubspot.com/web-interactives/public/v1/track/view?webInteractiveContentId=158544721292&webInteractiveId=306338576224&containerType=EMBEDDED&portalId=7048931&audienceId=null...
https://static.hubspot.com/img/trackers/blank001.gif
https://static.hsappstatic.net/static-hubspot-com/static-1.270519761/img/trackers/blank001.gif

43 B
0

88ms
88ms

Image
image/gif

2606:4700::6811:af5b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.hsappstatic.net/static-hubspot-com/static-1.270519761/img/trackers/blank001.gif
Requested by: Host: www.picussecurity.com
URL: https://www.picussecurity.com/resource/blog/apt29-cozy-bear-evolution-techniques
Protocol: H2
Server: 2606:4700::6811:af5b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 115c7f3cf61e4ec19070b9e59e20e78756d39d193eb9b544065059b9935d2491

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.picussecurity.com/resource/blog/apt29-cozy-bear-evolution-techniques

Response headers

cf-bgj: imgq:85,h2pri
etag: "51416c7ff0b9d7efc8c9b16d84052fab"
x-amz-version-id: MFfZlkR4U8_6aknbgflTSIqo4fNbniK3
cf-cache-status: HIT
age: 2000251
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=9uYwQEpC%2FaCiIT0jlMzgpROzcOsgX6hBrhUWU%2BsSFXvxKatbXWXEXRm2t%2FsubYHVnhGhI7FCZ5vz5CPoRxDi1Xb0ZrZIO8%2Fd%2FRXJj%2FtUwUpJH8PkrQBsAlTwe8cOnAZ8cLuixMf7qjDlmoGh7k9YhFsqSHQ%3D"}],"group":"cf-nel","max_age":604800}
expires: Sat, 17 Jan 2026 08:50:31 GMT
cf-polished: origSize=49, status=webp_bigger
x-cache: RefreshHit from cloudfront
x-amz-cf-id: eUZiij1BJVn5MySA-T8HsGGaKZYh6COEa3xKCPqnrRYBK6JlK-dIqQ==
date: Fri, 17 Jan 2025 08:50:31 GMT
content-type: image/gif
last-modified: Thu, 15 Apr 2021 16:47:19 GMT
vary: Origin,Accept-Encoding,Access-Control-Request-Headers,Access-Control-Request-Method
x-amz-replication-status: COMPLETED
cache-control: public, max-age=31536000
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
via: 1.1 14b4c9293b57ce6b6f8a0f276a7df856.cloudfront.net (CloudFront)
cf-ray: 903519244bafd266-FRA
accept-ranges: bytes
content-length: 43
x-amz-cf-pop: WAW51-P5
server: cloudflare
x-amz-server-side-encryption: AES256

Redirect headers

cache-control: max-age=3600
location: https://static.hsappstatic.net/static-hubspot-com/static-1.270519761/img/trackers/blank001.gif
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=2dEE4e29t3QpnfKimbeuxYkPhTjk8b79zQJT%2BI03dmMl2nAAsXZs7XqLRmP7xD0AJ4%2BSEDq4LHmxN1GMM4ZfEwKnMtYUGOcfNL5WC5pByuYtmGC9rIpT5btRRSPX0AK%2B%2FysAdc1lC7A5%2FM7zKLeEpw%3D%3D"}],"group":"cf-nel","max_age":604800}
cf-ray: 90351923cf2fdc59-FRA
expires: Fri, 17 Jan 2025 09:50:31 GMT
content-length: 167
date: Fri, 17 Jan 2025 08:50:31 GMT
content-type: text/html
vary: Accept-Encoding
server: cloudflare

GET
H2 200 insight.old.min.js Show response
snap.licdn.com/li.lms-analytics/ 40 KB
14 KB 40ms
40ms Script
application/javascript 2a02:26f0:3500:10::210:a9a
AKAMAI-ASN1 Akama...

General

Check archive.org

Show headers Download Go to

Full URL

https://snap.licdn.com/li.lms-analytics/insight.old.min.js

Requested by

Host: snap.licdn.com
URL: https://snap.licdn.com/li.lms-analytics/insight.min.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:3500:10::210:a9a Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),

Reverse DNS

Software

Resource Hash

8a27dc7b44ebe886390bfa0a9beeea36ea5a3f37479f0e0836b6c9b80d9b35ed

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.picussecurity.com/resource/blog/apt29-cozy-bear-evolution-techniques

Response headers

cache-control: max-age=41623
content-encoding: gzip
x-cdn: AKAM
x-content-type-options: nosniff
accept-ranges: bytes
content-length: 14628
date: Fri, 17 Jan 2025 08:50:31 GMT
last-modified: Mon, 02 Dec 2024 10:13:56 GMT
content-type: application/javascript;charset=utf-8
vary: Accept-Encoding
x-amz-server-side-encryption: AES256

POST
H2 204 / Show response
px.ads.linkedin.com/wa/ 0
443 B 226ms
149ms XHR
text/plain 2620:1ec:21::14
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://px.ads.linkedin.com/wa/
Requested by: Host: snap.licdn.com
URL: https://snap.licdn.com/li.lms-analytics/insight.old.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:21::14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.picussecurity.com/resource/blog/apt29-cozy-bear-evolution-techniques
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Accept: *
Content-Type: text/plain;charset=UTF-8

Response headers

linkedin-action: 1
x-li-pop: afd-prod-lva1-x
x-msedge-ref: Ref A: A45B019F6DC7468B9CE8472927C8BB02 Ref B: FRAEDGE1215 Ref C: 2025-01-17T08:50:31Z
x-li-fabric: prod-lva1
access-control-allow-credentials: true
x-li-uuid: AAYr4wDT/38PC4qyjcYZ5w==
x-li-proto: http/2
access-control-allow-origin: https://www.picussecurity.com
x-cache: CONFIG_NOCACHE
date: Fri, 17 Jan 2025 08:50:31 GMT
vary: Origin

GET
H2 200 attribution_trigger Show response
px.ads.linkedin.com/ 2 B
813 B 274ms
202ms XHR
application/json 2620:1ec:21::14
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://px.ads.linkedin.com/attribution_trigger?pid=2042428&time=1737103831595&url=https%3A%2F%2Fwww.picussecurity.com%2Fresource%2Fblog%2Fapt29-cozy-bear-evolution-techniques&tm=gtmv2
Requested by: Host: snap.licdn.com
URL: https://snap.licdn.com/li.lms-analytics/insight.old.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:21::14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Accept: *
Referer: https://www.picussecurity.com/resource/blog/apt29-cozy-bear-evolution-techniques

Response headers

x-li-pop: afd-prod-lor1-x
content-encoding: gzip
x-fs-uuid: 00062be300d473091bc45f1b8379d1c2
x-msedge-ref: Ref A: 79B3F1D456304F21A5E65213CA876579 Ref B: FRAEDGE1908 Ref C: 2025-01-17T08:50:31Z
x-li-fabric: prod-lor1
x-restli-protocol-version: 1.0.0
access-control-allow-methods: GET, OPTIONS
x-li-uuid: AAYr4wDUcwkbxF8bg3nRwg==
x-li-proto: http/2
access-control-allow-origin: *
x-cache: CONFIG_NOCACHE
date: Fri, 17 Jan 2025 08:50:31 GMT
content-type: application/json
access-control-allow-headers: *

GET
H2

200

collect
px4.ads.linkedin.com/
Redirect Chain

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=2042428&time=1737103831595&url=https%3A%2F%2Fwww.picussecurity.com%2Fresource%2Fblog%2Fapt29-cozy-bear-evolution-techniques&tm=gtmv2
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=2042428&time=1737103831595&url=https%3A%2F%2Fwww.picussecurity.com%2Fresource%2Fblog%2Fapt29-cozy-bear-evolution-techniques&tm=gtmv2&e_ipv6=AQIxS...

0
266 B

301ms
167ms

Image
application/javascript

13.107.42.14
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=2042428&time=1737103831595&url=https%3A%2F%2Fwww.picussecurity.com%2Fresource%2Fblog%2Fapt29-cozy-bear-evolution-techniques&tm=gtmv2&e_ipv6=AQIxSV2bREFiAwAAAZRzdPK1092TQmgLiallPuESFQ8tbG201SiOuROf84eG79A7AemDDNpi5QFryrzchKRK-uEd9horNQ
Requested by: Host: www.picussecurity.com
URL: https://www.picussecurity.com/resource/blog/apt29-cozy-bear-evolution-techniques
Protocol: H2
Server: 13.107.42.14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.picussecurity.com/resource/blog/apt29-cozy-bear-evolution-techniques

Response headers

linkedin-action: 1
x-li-pop: afd-prod-lva1-x
x-msedge-ref: Ref A: 878CA946EF2B47DDA8346D06CCF70F1D Ref B: DUS30EDGE0314 Ref C: 2025-01-17T08:50:32Z
x-li-fabric: prod-lva1
x-li-uuid: AAYr4wDdkoB7eYRCfKmtNw==
x-li-proto: http/2
x-cache: CONFIG_NOCACHE
content-length: 0
date: Fri, 17 Jan 2025 08:50:32 GMT
content-type: application/javascript

Redirect headers

linkedin-action: 1
x-li-pop: afd-prod-lva1-x
location: https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=2042428&time=1737103831595&url=https%3A%2F%2Fwww.picussecurity.com%2Fresource%2Fblog%2Fapt29-cozy-bear-evolution-techniques&tm=gtmv2&e_ipv6=AQIxSV2bREFiAwAAAZRzdPK1092TQmgLiallPuESFQ8tbG201SiOuROf84eG79A7AemDDNpi5QFryrzchKRK-uEd9horNQ
x-msedge-ref: Ref A: 2CBBEE6CF6E84BDFBE89720984FF3DAB Ref B: FRAEDGE1215 Ref C: 2025-01-17T08:50:31Z
x-li-fabric: prod-lva1
x-li-uuid: AAYr4wDT+LPuNioi2mx5UQ==
x-li-proto: http/2
x-cache: CONFIG_NOCACHE
content-length: 0
date: Fri, 17 Jan 2025 08:50:31 GMT

GET
H/1.1

200
OK

/
tctguyhimcwcyexxgullu3seem0fkhrh.lambda-url.us-west-2.on.aws/
Redirect Chain

https://fonts.popt.in/?family=Poppins&display=swap
https://tctguyhimcwcyexxgullu3seem0fkhrh.lambda-url.us-west-2.on.aws/?family=Poppins&display=swap

1015 B
1 KB

585ms
200ms

Stylesheet
text/css

2600:1f14:50b:9a02:4f20:5197:da0f:c8af
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tctguyhimcwcyexxgullu3seem0fkhrh.lambda-url.us-west-2.on.aws/?family=Poppins&display=swap
Requested by: Host: www.picussecurity.com
URL: https://www.picussecurity.com/resource/blog/apt29-cozy-bear-evolution-techniques
Protocol: HTTP/1.1
Server: 2600:1f14:50b:9a02:4f20:5197:da0f:c8af Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: 8503bb1f3969798a88dce37ee7f38979711dfd7495f5b8dafd66a19ff24e2d15

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.picussecurity.com/resource/blog/apt29-cozy-bear-evolution-techniques

Response headers

x-amzn-RequestId: 88abc55d-33f7-4579-90a8-26a68149a90b
x-amzn-Remapped-host: fonts.popt.in
Content-Length: 1015
Date: Fri, 17 Jan 2025 08:50:32 GMT
Content-Type: text/css; charset=utf-8
Connection: keep-alive
X-Amzn-Trace-Id: Root=1-678a19d8-145bc2a272431af50d502208;Parent=1ffa2c0942ea4471;Sampled=0;Lineage=1:013914a9:0

Redirect headers

cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
location: https://tctguyhimcwcyexxgullu3seem0fkhrh.lambda-url.us-west-2.on.aws?family=Poppins&display=swap
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=cweRDnb1HFAWTesZEJn%2Bss0KU0aw5pfOakypiS515e%2Fr5RqioaJ%2FhpsS0WpCy4AGlR6neS%2FTQ0uDG5fSvJA35QdKloPs6mpVmG6gtXegL4VZqIfClLMNWPJ4mz%2BHtdwcXXUk2RRPEq9cRWJY"}],"group":"cf-nel","max_age":604800}
cf-ray: 9035192439c71da4-FRA
expires: Thu, 01 Jan 1970 00:00:01 GMT
content-length: 143
date: Fri, 17 Jan 2025 08:50:31 GMT
content-type: text/html
vary: Accept-Encoding
server: cloudflare

GET
H3 200 heb-fonts.min.css
cdn.popt.in/css/ 22 KB
3 KB 42ms
42ms Stylesheet
text/css 2606:4700:3031::ac43:a6ca
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.popt.in/css/heb-fonts.min.css
Requested by: Host: cdnjs.cloudflare.com
URL: https://cdnjs.cloudflare.com/ajax/libs/jquery/3.7.1/jquery.min.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3031::ac43:a6ca , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d7459dd5ce48ddd21da15f490514af4be07ff85f0b0b6b9e118542d68ff5ec91

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.picussecurity.com/resource/blog/apt29-cozy-bear-evolution-techniques

Response headers

content-encoding: gzip
cf-cache-status: HIT
x-amz-version-id: qXd_m_chdhWvR5DNrvI834tklGtnWkb9
etag: W/"fb58ef8ec15444a0d0cf977973d4f824"
age: 8621
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ZTd0NnsQNNBwXk6v6ASS7f7eWSlSeCVkhM%2Fzm95PXqABzYAzIW3j9y%2Bykx1AUNUgQsBmp0i5D1jUd7W8aRHrqFgw9%2FeR%2B4CyE7XQzlW2wDoISaWWoz1Sgjc2VeyEv7%2BOp4h2kjvr9ZR2kA%3D%3D"}],"group":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: VekOxzSOqc-fEhcX5MS8o2rHeDRmTyzV6akngOYmvm7_ai-aIOB3fQ==
date: Fri, 17 Jan 2025 08:50:31 GMT
content-type: text/css
last-modified: Wed, 12 Sep 2018 18:05:20 GMT
vary: accept-encoding
priority: u=0,i=?0
server-timing: cfL4;desc="?proto=QUIC&rtt=28063&min_rtt=21373&rtt_var=5154&sent=86&recv=44&lost=0&retrans=0&sent_bytes=87814&recv_bytes=7355&delivery_rate=649443&cwnd=30900&unsent_bytes=0&cid=35886563d505420f&ts=715&x=1", cfExtPri, cfHdrFlush;dur=0
cache-control: public, max-age=30672000
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
via: 1.1 90d4d7d1a3cebe66392e229fd5792ae0.cloudfront.net (CloudFront)
cf-ray: 9035192429ad1da4-FRA
x-amz-cf-pop: FRA56-P8
server: cloudflare

GET
H3 200 font-awesome.min.css
cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/css/ 30 KB
6 KB 30ms
30ms Stylesheet
text/css 2606:4700::6811:190e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/css/font-awesome.min.css

Requested by

Host: cdnjs.cloudflare.com
URL: https://cdnjs.cloudflare.com/ajax/libs/jquery/3.7.1/jquery.min.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6811:190e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.picussecurity.com/resource/blog/apt29-cozy-bear-evolution-techniques

Response headers

cf-cdnjs-via: cfworker/kv
content-encoding: br
cf-cache-status: HIT
etag: "5eb03e5f-7918"
age: 733079
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=O2iFV0%2Bcg9y%2Fhc%2FjPwjXYsqO2iizBH8%2Fnpr%2BmSWKXbmegbgXqv3ef%2Fle4ikmp4nFE%2BKSaCGrdIckfW1AA8kE2Iu6nx%2BzU8Se48l%2BCq5J%2FViAumWrGkkMeD8a5ZUjXw36SN4nSZv89O5eON3RffeKdA06"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
expires: Wed, 07 Jan 2026 08:50:31 GMT
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Fri, 17 Jan 2025 08:50:31 GMT
content-type: text/css; charset=utf-8
last-modified: Mon, 04 May 2020 16:10:07 GMT
vary: Accept-Encoding
priority: u=0,i=?0
strict-transport-security: max-age=15780000
cache-control: public, max-age=30672000
timing-allow-origin: *
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
cross-origin-resource-policy: cross-origin
cf-ray: 903519242f22dbe8-FRA
accept-ranges: bytes
access-control-allow-origin: *
content-length: 5631
server: cloudflare

GET
H3 200 brands.min.css
cdn.popt.in/css/ 18 KB
6 KB 38ms
37ms Stylesheet
text/css 2606:4700:3031::ac43:a6ca
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.popt.in/css/brands.min.css
Requested by: Host: cdnjs.cloudflare.com
URL: https://cdnjs.cloudflare.com/ajax/libs/jquery/3.7.1/jquery.min.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3031::ac43:a6ca , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5cfa83504aa9c8a4654937559cbe6419ad26c4582eb55be91d5ddf975b5cb807

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.picussecurity.com/resource/blog/apt29-cozy-bear-evolution-techniques

Response headers

content-encoding: gzip
cf-cache-status: HIT
etag: W/"37af6636f1692eddc4e241653bbb57ca"
x-amz-version-id: gT1iHlAVlZxCJzqyZ2gXi0FVdCn3kiDS
age: 1420
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=0lIuoGhvBHtwi9kPT24DU8rKFsVwr%2BfSx4eIgiU4gMATMrB57vw7hY7Qyx%2FZSBvX4BxHDOGO%2B2doCvEjnJYbGuy7Xk6T0bXjpUYXSqRoJOoNV8w1zv3Mn12tjN6u9s7%2B%2BtoRn0k4%2Bz6Z0w%3D%3D"}],"group":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: xntrcZeiD8vrVI9Rx-UpTnl5O14IL93VOgGFJDZQ-LmYLyZAnnY27g==
date: Fri, 17 Jan 2025 08:50:31 GMT
content-type: text/css
last-modified: Tue, 07 Nov 2023 12:34:16 GMT
vary: accept-encoding
priority: u=0,i=?0
server-timing: cfL4;desc="?proto=QUIC&rtt=28063&min_rtt=21373&rtt_var=5154&sent=80&recv=44&lost=0&retrans=0&sent_bytes=81334&recv_bytes=7355&delivery_rate=649443&cwnd=30900&unsent_bytes=0&cid=35886563d505420f&ts=711&x=1", cfExtPri, cfHdrFlush;dur=0
cache-control: max-age=1800
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
via: 1.1 1e0f88a39289286be3e03ff93487da80.cloudfront.net (CloudFront)
cf-ray: 9035192429b01da4-FRA
x-amz-cf-pop: FRA56-P8
server: cloudflare
x-amz-server-side-encryption: AES256

GET
H3 200 poptin-style-en.css
cdn.popt.in/css/ 42 KB
7 KB 36ms
36ms Stylesheet
text/css 2606:4700:3031::ac43:a6ca
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.popt.in/css/poptin-style-en.css?ver=10
Requested by: Host: cdnjs.cloudflare.com
URL: https://cdnjs.cloudflare.com/ajax/libs/jquery/3.7.1/jquery.min.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3031::ac43:a6ca , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: fa4341c1fd7414777725b672f5ba250909de031e832ae84f9658b763ba638702

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.picussecurity.com/resource/blog/apt29-cozy-bear-evolution-techniques

Response headers

content-encoding: gzip
cf-cache-status: HIT
etag: W/"f9ed0e9ba14201c7796360478aa973fa"
x-amz-version-id: BviMIyU43j7PKY8A21m3CN7j11sCKI9I
age: 1420
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=wH733DIdlP%2BY9uVEyK4R9P5snX%2BwnPD5wl4SXOAnJHutOdsoxxPzp5brcXgdm7f1MZ1rMXTyzVIh9j24132NZXJ4vGZ8Ne3eUxAkJNtvuOcw99i%2FTaLqg9D%2FinlNwzS1yiUyUDPYP7O9Xg%3D%3D"}],"group":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: I6wJZufGmnjlqu67e3ztZcenRwg9rShfYa6TQ5q9fiaDDjn4RQZXSg==
date: Fri, 17 Jan 2025 08:50:31 GMT
content-type: text/css
last-modified: Fri, 17 Jan 2025 06:26:47 GMT
vary: accept-encoding
priority: u=0,i=?0
server-timing: cfL4;desc="?proto=QUIC&rtt=28063&min_rtt=21373&rtt_var=5154&sent=73&recv=44&lost=0&retrans=0&sent_bytes=73622&recv_bytes=7355&delivery_rate=649443&cwnd=30900&unsent_bytes=0&cid=35886563d505420f&ts=711&x=1", cfExtPri, cfHdrFlush;dur=0
cache-control: max-age=1800
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
via: 1.1 193d38535c6cb246e365763e9c32e672.cloudfront.net (CloudFront)
cf-ray: 9035192429b11da4-FRA
x-amz-cf-pop: FRA56-P8
server: cloudflare
x-amz-server-side-encryption: AES256

GET
H3 200 poptin-animations.css
cdn.popt.in/css/ 6 KB
2 KB 36ms
36ms Stylesheet
text/css 2606:4700:3031::ac43:a6ca
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.popt.in/css/poptin-animations.css?ver=10
Requested by: Host: cdnjs.cloudflare.com
URL: https://cdnjs.cloudflare.com/ajax/libs/jquery/3.7.1/jquery.min.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3031::ac43:a6ca , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0e0e91c655429e89e6f922885ea309f734d5f61c770b759a89713bda73b19ae8

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.picussecurity.com/resource/blog/apt29-cozy-bear-evolution-techniques

Response headers

content-encoding: gzip
cf-cache-status: HIT
etag: W/"c4792cc666ef27a117644a46c3b9d6fc"
x-amz-version-id: Q8phDXpzU84rOw1R8X74QHqwN0nMq73R
age: 1421
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=JJN2HtEYXk7cpTg4wKqkpB4gje9Qi23bz2y85GtruvJIfCUVGIP27%2FFoP%2FZtyqEkZJYBy6w%2F2CWJQH4Qsj11LKMxFl7IH4R6pzLC6tAZkqKwo7%2FSjlZgoWNzGTnFNeGQboql2guKduFD3g%3D%3D"}],"group":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
x-cache: Miss from cloudfront
x-amz-cf-id: vD2De2fAzEpbyxKdp9Mn542U8_dU4c8If3l-qycRGT2smYTxjvi9cw==
date: Fri, 17 Jan 2025 08:50:31 GMT
content-type: text/css
last-modified: Fri, 17 Jan 2025 06:26:47 GMT
vary: accept-encoding
priority: u=0,i=?0
server-timing: cfL4;desc="?proto=QUIC&rtt=28063&min_rtt=21373&rtt_var=5154&sent=71&recv=44&lost=0&retrans=0&sent_bytes=71264&recv_bytes=7355&delivery_rate=649443&cwnd=30900&unsent_bytes=0&cid=35886563d505420f&ts=710&x=1", cfExtPri, cfHdrFlush;dur=0
cache-control: max-age=1800
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
via: 1.1 5dbbe1c6db9a003131a63be8ded250a4.cloudfront.net (CloudFront)
cf-ray: 9035192429b21da4-FRA
x-amz-cf-pop: FRA56-P8
server: cloudflare
x-amz-server-side-encryption: AES256

GET
H2 200 account_613f053dd8506_poptin_6d77a91c06469_2024-12-24_13-35-57_version_4.html Show response
d3lopmpcew67el.cloudfront.net/client_64d678615e3d0/ 32 KB
5 KB 88ms
24ms XHR
text/html 2600:9000:2646:b800:b:8c20:bf40:21
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d3lopmpcew67el.cloudfront.net/client_64d678615e3d0/account_613f053dd8506_poptin_6d77a91c06469_2024-12-24_13-35-57_version_4.html
Requested by: Host: cdnjs.cloudflare.com
URL: https://cdnjs.cloudflare.com/ajax/libs/jquery/3.7.1/jquery.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2646:b800:b:8c20:bf40:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 174435f079753524341d6ec3f3767cb2d2170d62bdab01c7063fdb28b8c039e2

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Accept: */*
Referer: https://www.picussecurity.com/resource/blog/apt29-cozy-bear-evolution-techniques

Response headers

access-control-max-age: 3000
content-encoding: gzip
x-amz-version-id: szfFefYNrMyGcWt1IRimbCi7MpD.X5eE
etag: W/"1882d8de9354a3ccbdbf4d57cbda60e7"
age: 7670
access-control-allow-methods: GET
x-cache: Hit from cloudfront
x-amz-cf-id: 6GSbQK7JURJd5_quSDU3PdgovTqYKv1WRrBChFN8NUNYHwfae2v4bQ==
date: Fri, 17 Jan 2025 07:09:47 GMT
content-type: text/html
vary: accept-encoding
last-modified: Tue, 07 Jan 2025 07:48:59 GMT
via: 1.1 bd96095bb3c15c742ab4d72d1fecba6c.cloudfront.net (CloudFront)
access-control-allow-origin: *
x-amz-cf-pop: FRA60-P5
server: AmazonS3
x-amz-server-side-encryption: AES256

POST
H3 200 64d678615e3d0 Show response
display.popt.in/api/display/total-website-session/ 0
933 B 235ms
235ms XHR
text/html 2606:4700:3031::ac43:a6ca
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://display.popt.in/api/display/total-website-session/64d678615e3d0

Requested by

Host: cdnjs.cloudflare.com
URL: https://cdnjs.cloudflare.com/ajax/libs/jquery/3.7.1/jquery.min.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3031::ac43:a6ca , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://bc.popt.in https://.mybigcommerce.com https://.jumpseller.com https://.myshopline.com https://.myshopify.com https://.grisynava.com https://poptin.test https://poptinemail.test https://.dev.popt.in https://amantilak.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff, nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.picussecurity.com/resource/blog/apt29-cozy-bear-evolution-techniques
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Accept: application/json, text/javascript, */*; q=0.01
Content-Type: application/json

Response headers

content-encoding: zstd
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ZEjCZdamFGMko7HT7lxRewBHE3AhUcEZ7MDSH6zLHkiaVf6NuxgUqfYz8hiYP0q%2FE51f9hP9Xfj3Kt8roCV%2FZyDYaYPi5bEN%2BzXxZjD%2FiFfTXtFtidu4ayBZtm75yJCDfnNNXBMszb3R18cMfL8%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff, nosniff
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=22269&min_rtt=21663&rtt_var=1882&sent=18&recv=17&lost=0&retrans=0&sent_bytes=7661&recv_bytes=6867&delivery_rate=4654&cwnd=12000&unsent_bytes=0&cid=697f163569f80189&ts=760&x=1", cfExtPri, cfHdrFlush;dur=0
date: Fri, 17 Jan 2025 08:50:32 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding
priority: u=0,i
x-frame-options: SAMEORIGIN
access-control-allow-headers: Origin, Content-Type
strict-transport-security: max-age=31536000; includeSubDomains
content-security-policy: frame-ancestors https://bc.popt.in https://*.mybigcommerce.com https://*.jumpseller.com https://*.myshopline.com https://*.myshopify.com https://*.grisynava.com https://poptin.test https://poptinemail.test https://*.dev.popt.in https://amantilak.com
cache-control: no-cache, private
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
access-control-allow-credentials: true
cf-ray: 903519258cef71c4-FRA
access-control-allow-origin: *
x-xss-protection: 1; mode=block
server: cloudflare

OPTIONS
H3 204 64d678615e3d0
display.popt.in/api/display/total-website-session/ Frame 0
0 210ms
210ms Preflight 2606:4700:3031::ac43:a6ca
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://display.popt.in/api/display/total-website-session/64d678615e3d0

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3031::ac43:a6ca , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://bc.popt.in https://.mybigcommerce.com https://.jumpseller.com https://.myshopline.com https://.myshopify.com https://.grisynava.com https://poptin.test https://poptinemail.test https://.dev.popt.in https://amantilak.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://www.picussecurity.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Origin, Content-Type content-type
access-control-allow-methods: POST
access-control-allow-origin: *
access-control-max-age: 0
alt-svc: h3=":443"; ma=86400
cache-control: no-cache, private
cf-cache-status: DYNAMIC
cf-ray: 903519243b6b71c4-FRA
content-security-policy: frame-ancestors https://bc.popt.in https://*.mybigcommerce.com https://*.jumpseller.com https://*.myshopline.com https://*.myshopify.com https://*.grisynava.com https://poptin.test https://poptinemail.test https://*.dev.popt.in https://amantilak.com
date: Fri, 17 Jan 2025 08:50:31 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
priority: u=0,i
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=BWQenC%2B%2B1fRnRQMueSY6wSfpkav1CLmrtr78NIHZRA2PBtq1IBwmd8F2tPa%2BvhOC1JdGmDSght1GaVXk8X8lk4em%2Bd5zq7F5jrRhNrVWQfsHsf7em6GOrGmiTpCEzYRVnWRf%2FvYAaN4bQmDK%2Bts%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
server-timing: cfL4;desc="?proto=QUIC&rtt=22330&min_rtt=21663&rtt_var=2345&sent=16&recv=15&lost=0&retrans=0&sent_bytes=6663&recv_bytes=6290&delivery_rate=111536&cwnd=12000&unsent_bytes=0&cid=697f163569f80189&ts=525&x=1" cfExtPri cfHdrFlush;dur=0
strict-transport-security: max-age=31536000; includeSubDomains
vary: Access-Control-Request-Method, Access-Control-Request-Headers
x-content-type-options: nosniff nosniff
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block

GET
H3 200 timer.css
cdn.popt.in/css/v_2/ 8 KB
2 KB 31ms
31ms Stylesheet
text/css 2606:4700:3031::ac43:a6ca
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.popt.in/css/v_2/timer.css?ver=10
Requested by: Host: cdnjs.cloudflare.com
URL: https://cdnjs.cloudflare.com/ajax/libs/jquery/3.7.1/jquery.min.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3031::ac43:a6ca , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f1d5ab17a991bc2f7bbb97f88d96d7ba58cd7831ec086ad157fe89a62ade052a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.picussecurity.com/resource/blog/apt29-cozy-bear-evolution-techniques

Response headers

content-encoding: gzip
cf-cache-status: HIT
etag: W/"4a5e8e39ce641c871346ab0d715aaa8f"
x-amz-version-id: 6_3IpTvdJj2rYov5GXTwz3349jjvUdfh
age: 1356
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=82npDNAyxLPb3AvLbLaGsUUt%2Bwr6Ypoxoxf65F4KJRTs5hFmTaRb8cMz7W%2F7Yok2TX%2FPWlqcH9iyMJZzi3xS6DAgFc5f1QQ3Yt%2FcKpfeIlk2ZCoMKzcvQgtHVRRVg3aOfC7Jz42Wig90zw%3D%3D"}],"group":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: yXb0oTBKEG06Lk2jBcgyxQ4DDwAcfU6zlJeEqnPAOau7CVEkd6JnIw==
date: Fri, 17 Jan 2025 08:50:32 GMT
content-type: text/css
last-modified: Fri, 17 Jan 2025 06:26:47 GMT
vary: accept-encoding
priority: u=0,i=?0
server-timing: cfL4;desc="?proto=QUIC&rtt=25560&min_rtt=21373&rtt_var=2759&sent=91&recv=55&lost=0&retrans=0&sent_bytes=91353&recv_bytes=8148&delivery_rate=598647&cwnd=30900&unsent_bytes=0&cid=35886563d505420f&ts=1187&x=1", cfExtPri, cfHdrFlush;dur=0
cache-control: max-age=1800
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
via: 1.1 64c8688da1fd73389eb91af90ae83792.cloudfront.net (CloudFront)
cf-ray: 903519273bf71da4-FRA
x-amz-cf-pop: FRA56-P8
server: cloudflare
x-amz-server-side-encryption: AES256

GET
H2 200 272587cdb878c3227cd6cfb3b81619ab.png
d3lopmpcew67el.cloudfront.net/client_64d678615e3d0/ 217 KB
218 KB 71ms
26ms Image
image/png 2600:9000:2646:b800:b:8c20:bf40:21
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d3lopmpcew67el.cloudfront.net/client_64d678615e3d0/272587cdb878c3227cd6cfb3b81619ab.png
Requested by: Host: www.picussecurity.com
URL: https://www.picussecurity.com/resource/blog/apt29-cozy-bear-evolution-techniques
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2646:b800:b:8c20:bf40:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 2d7d69d8f51f380637087e8373287046efdb12d60e5ee7f8fe8412e79c2ee0f5

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.picussecurity.com/resource/blog/apt29-cozy-bear-evolution-techniques

Response headers

vary: accept-encoding
x-amz-version-id: BW2mSSOv24JCUwzk5q5UIxwRtxLNXoPn
etag: "c07242b394ce13e473c661ff6b6cc24b"
age: 7670
via: 1.1 c2bfbd57ba266fad66928f7d9fe2f1c6.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: Hit from cloudfront
content-length: 222592
x-amz-cf-id: 47GcvlrNPVhlFWgN_4358ns6o10rblNfNKvP8WtGEED6SjSgo8rFuQ==
date: Fri, 17 Jan 2025 07:09:48 GMT
content-type: image/png
last-modified: Tue, 24 Dec 2024 11:41:34 GMT
server: AmazonS3
x-amz-cf-pop: FRA60-P5
x-amz-server-side-encryption: AES256

GET
H2 200 __ptq.gif
track.hubspot.com/ 45 B
440 B 143ms
135ms Image
image/gif 2606:4700::6810:7674
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://track.hubspot.com/__ptq.gif?k=1&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=de-de&bfp=930271884&v=1.1&a=7048931&pi=183336913844&ct=blog-post&ccu=https%3A%2F%2Fwww.picussecurity.com%2Fresource%2Fblog%2Fapt29-cozy-bear-evolution-techniques&cpi=183336913844&cgi=35190412163&lpi=183336913844&lvi=183336913844&lvc=en-us&pu=https%3A%2F%2Fwww.picussecurity.com%2Fresource%2Fblog%2Fapt29-cozy-bear-evolution-techniques&t=APT29+Explained%3A+Cozy+Bear%27s+Evolution%2C+Techniques%2C+and+Notorious+Cyber+Attacks&cts=1737103832761&vi=d347b0de772d0b336f3121ed40b444b7&nc=true&u=51282614.d347b0de772d0b336f3121ed40b444b7.1737103832760.1737103832760.1737103832760.1&b=51282614.1.1737103832760&cc=15

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7674 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.picussecurity.com/resource/blog/apt29-cozy-bear-evolution-techniques

Response headers

x-robots-tag: none
x-request-id: c0b252c8-8cb8-43ac-87d0-5fb02c7293f0
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Pqom9aLOHApbHssUaoRncxACvU1WypbfDHnOv1%2FfOkJxpS9IEI5c%2BeH%2FXqhs0se%2F%2BPJhP13sClFiU40EbnonqwHqNVkMd8Ik%2B%2BQGVzGGrqzrshdGxGUSqYn%2F1wi1d2mg%2FLSv7YPct8VQ2w3E7EUp"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
x-evy-trace-listener: listener_https
p3p: CP="NOI CUR ADM OUR NOR STA NID"
date: Fri, 17 Jan 2025 08:50:32 GMT
x-hubspot-correlation-id: c0b252c8-8cb8-43ac-87d0-5fb02c7293f0
content-type: image/gif
vary: origin, Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-evy-trace-route-service-name: envoyset-translator
cache-control: no-cache, no-store, no-transform
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-evy-trace-served-by-pod: iad02/analytics-tracking-td/envoy-proxy-c658cb6d4-g6gd4
x-envoy-upstream-service-time: 7
access-control-allow-credentials: false
cf-ray: 9035192adbeadc59-FRA
x-evy-trace-route-configuration: listener_https/all
content-length: 45
server: cloudflare
x-evy-trace-virtual-host: all

GET
H2 200 __ptq.gif
track.hubspot.com/ 45 B
522 B 138ms
136ms Image
image/gif 2606:4700::6810:7674
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://track.hubspot.com/__ptq.gif?k=15&fi=10a2d0b0-9f91-4cd7-a1e0-1cff39706638&fci=b9cbfee2-60ce-48eb-b8c8-62f1ef57d9ed&ft=0&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=de-de&bfp=930271884&v=1.1&a=7048931&pi=183336913844&ct=blog-post&ccu=https%3A%2F%2Fwww.picussecurity.com%2Fresource%2Fblog%2Fapt29-cozy-bear-evolution-techniques&cpi=183336913844&cgi=35190412163&lpi=183336913844&lvi=183336913844&lvc=en-us&pu=https%3A%2F%2Fwww.picussecurity.com%2Fresource%2Fblog%2Fapt29-cozy-bear-evolution-techniques&t=APT29+Explained%3A+Cozy+Bear%27s+Evolution%2C+Techniques%2C+and+Notorious+Cyber+Attacks&cts=1737103832763&vi=d347b0de772d0b336f3121ed40b444b7&nc=true&u=51282614.d347b0de772d0b336f3121ed40b444b7.1737103832760.1737103832760.1737103832760.1&b=51282614.1.1737103832760&cc=15

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7674 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.picussecurity.com/resource/blog/apt29-cozy-bear-evolution-techniques

Response headers

x-robots-tag: none
x-request-id: d34cfb4d-96ed-4a05-9c91-899b7b28f71c
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=T64HRBTvYjX8IuGfbnvqb72NpHJ1zMyrDxTelFi37puVdx4Az7AFBfM00IPISHhcQ4RYWyKMrOxCyb6%2FuQsBKjhUluo4eN%2Fk8fnPP6896GVbm26%2BCCNqciCVIP8qnlKCieuhvoL%2Fme%2BJzwsPsp9J"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
x-evy-trace-listener: listener_https
p3p: CP="NOI CUR ADM OUR NOR STA NID"
date: Fri, 17 Jan 2025 08:50:32 GMT
x-hubspot-correlation-id: d34cfb4d-96ed-4a05-9c91-899b7b28f71c
content-type: image/gif
vary: origin, Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-evy-trace-route-service-name: envoyset-translator
cache-control: no-cache, no-store, no-transform
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-evy-trace-served-by-pod: iad02/analytics-tracking-td/envoy-proxy-c658cb6d4-hwgvx
x-envoy-upstream-service-time: 8
access-control-allow-credentials: false
cf-ray: 9035192adbe6dc59-FRA
x-evy-trace-route-configuration: listener_https/all
content-length: 45
server: cloudflare
x-evy-trace-virtual-host: all

GET
H2 200 __ptq.gif
track.hubspot.com/ 45 B
597 B 135ms
133ms Image
image/gif 2606:4700::6810:7674
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://track.hubspot.com/__ptq.gif?k=15&fi=10a2d0b0-9f91-4cd7-a1e0-1cff39706638&fci=c9c8c2a3-68c7-46c2-8602-b8a102db7b97&ft=0&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=de-de&bfp=930271884&v=1.1&a=7048931&pi=183336913844&ct=blog-post&ccu=https%3A%2F%2Fwww.picussecurity.com%2Fresource%2Fblog%2Fapt29-cozy-bear-evolution-techniques&cpi=183336913844&cgi=35190412163&lpi=183336913844&lvi=183336913844&lvc=en-us&pu=https%3A%2F%2Fwww.picussecurity.com%2Fresource%2Fblog%2Fapt29-cozy-bear-evolution-techniques&t=APT29+Explained%3A+Cozy+Bear%27s+Evolution%2C+Techniques%2C+and+Notorious+Cyber+Attacks&cts=1737103832763&vi=d347b0de772d0b336f3121ed40b444b7&nc=true&u=51282614.d347b0de772d0b336f3121ed40b444b7.1737103832760.1737103832760.1737103832760.1&b=51282614.1.1737103832760&cc=15

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7674 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.picussecurity.com/resource/blog/apt29-cozy-bear-evolution-techniques

Response headers

x-robots-tag: none
x-request-id: e828b822-5b50-4445-bc95-f8f3bd12376e
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Tyypj5lTj9RGvU917KZsrrrYr%2Fepl%2FQ1r1DVS3x92zAUGlMZ9E2WoDi%2F15plGUQlgD1oy2Z4jf29xgn8JoCSpRFnZk%2BpUPb9m%2Fu4jRP96a4iyzsvhle50QaLhkI5VMG5Pb3xWsezMeC7zwtGgem9"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
x-evy-trace-listener: listener_https
p3p: CP="NOI CUR ADM OUR NOR STA NID"
date: Fri, 17 Jan 2025 08:50:32 GMT
x-hubspot-correlation-id: e828b822-5b50-4445-bc95-f8f3bd12376e
content-type: image/gif
vary: origin, Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-evy-trace-route-service-name: envoyset-translator
cache-control: no-cache, no-store, no-transform
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-evy-trace-served-by-pod: iad02/analytics-tracking-td/envoy-proxy-c658cb6d4-2r2nq
x-envoy-upstream-service-time: 7
access-control-allow-credentials: false
cf-ray: 9035192adbe8dc59-FRA
x-evy-trace-route-configuration: listener_https/all
content-length: 45
server: cloudflare
x-evy-trace-virtual-host: all

GET
H3 200 favicon.ico
www.picussecurity.com/hubfs/Picus_February2020/images/ 15 KB
3 KB 58ms
58ms Other
image/vnd.microsoft.icon 2606:2c40::c73c:67e3
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.picussecurity.com/hubfs/Picus_February2020/images/favicon.ico

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:2c40::c73c:67e3 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare London, LLC, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5242ab5df4690e1c975cefd6c70bc7f19037060288e9254c16b3ea0b07f3b222

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.picussecurity.com/resource/blog/apt29-cozy-bear-evolution-techniques

Response headers

content-encoding: br
cf-cache-status: HIT
etag: W/"02925aef9384fc19f8c138ed9d04e72f"
age: 239791
cache-tag: F-25850183661,FD-25847619727,P-7048931,FLS-ALL
x-amz-version-id: GPbuCeGk..cIOQ1w6ZV9XsM2rrDBylkN
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=g9dWor6GDOqaUAlNSx25msH2IjMTP4coceg4ubvP1KtmaspnxDzSJv%2BFI8F%2F9DKVrENRRl8j1ui8Oo%2Bas6Fo2lVfPV9yYU5OwzaFqqNqnAWHZngdIwJKvYAWQpATm6zlFWRePC8X57g0OAtUJInrht0nZg%3D%3D"}],"group":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
x-cache: RefreshHit from cloudfront
x-amz-cf-id: xBvaYLsglkM8KXr-gIVkjD7MsNSp4GgPyKB96iZ9GbDDFGwA7O3DRg==
content-type: image/vnd.microsoft.icon
last-modified: Fri, 14 Feb 2020 06:16:24 GMT
priority: u=1,i
server-timing: cfExtPri
edge-cache-tag: F-25850183661,FD-25847619727,P-7048931,FLS-ALL
cache-control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900
x-amz-request-id: YPZBMW8YPKB3BYFT
x-hs-cf-lambda-enforce: us-east-1.EnforceAclForReads 3
x-amz-meta-cache-tag: F-25850183661,FD-25847619727,P-7048931,FLS-ALL
server: cloudflare
x-hs-cf-lambda: us-east-1.EnforceAclForReads 3
access-control-allow-methods: GET
date: Fri, 17 Jan 2025 08:50:32 GMT
vary: Accept-Encoding
x-amz-id-2: UVNE7Lv/bbuFBlVJ7Cz2tuDbj56PScooK35Sls4zlOx6d7/yUxrdzwDcJqkSmxRo8z4Q/c6PnD8=
strict-transport-security: max-age=31536000; includeSubDomains; preload
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
timing-allow-origin: d8fk70yj6xfhx.cloudfront.net
via: 1.1 a5607d37f6322bee208b762f730550a0.cloudfront.net (CloudFront)
cf-ray: 9035192aee572c2e-FRA
access-control-allow-origin: *
x-amz-cf-pop: FRA60-P7

GET
H2 200 json Show response
forms.hubspot.com/lead-flows-config/v1/config/ 178 B
935 B 171ms
162ms XHR
application/json 2606:4700::6810:7574
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://forms.hubspot.com/lead-flows-config/v1/config/json?portalId=7048931&utk=d347b0de772d0b336f3121ed40b444b7&__hstc=51282614.d347b0de772d0b336f3121ed40b444b7.1737103832760.1737103832760.1737103832760.1&__hssc=51282614.1.1737103832760&contentId=183336913844&currentUrl=https%3A%2F%2Fwww.picussecurity.com%2Fresource%2Fblog%2Fapt29-cozy-bear-evolution-techniques

Requested by

Host: js.hsleadflows.net
URL: https://js.hsleadflows.net/leadflows.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7574 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ca60365fe71f65979adc28bc6ca7ad87b2266af2d92f145be47bd874559e4b60

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.picussecurity.com/resource/blog/apt29-cozy-bear-evolution-techniques

Response headers

x-robots-tag: none
access-control-max-age: 180
x-request-id: 84f31bd1-6a0f-40ff-afd8-4117e9599269
content-encoding: br
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=XYLIuT2nl7DML7JqNHmIrZg6%2FSikki%2BaFTus3HCfYI5KQPncgdSqSdhhlnXSqLBKSCy0yFMI%2B9WUQwOaF6967fdnfu5pZPyLer8WHmvI2TMTsAPu1v3r3WZ5R4qFolYKdc%2B61Hjx6JEuOQ1zPJ%2Fg"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
access-control-allow-methods: GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD
x-evy-trace-listener: listener_https
date: Fri, 17 Jan 2025 08:50:32 GMT
x-hubspot-correlation-id: 84f31bd1-6a0f-40ff-afd8-4117e9599269
content-type: application/json;charset=utf-8
vary: origin
access-control-allow-headers: Accept, Accept-Charset, Accept-Encoding, Accept-Language, Content-Type, Host, Origin, Referer, User-Agent
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-evy-trace-route-service-name: envoyset-translator
cache-control: max-age=0, no-cache, no-store
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-evy-trace-served-by-pod: iad02/star-hubspot-td/envoy-proxy-b967ccf5d-pk4c4
x-envoy-upstream-service-time: 32
access-control-allow-credentials: false
cf-ray: 9035192b1f609b52-FRA
access-control-allow-origin: https://www.picussecurity.com
x-evy-trace-route-configuration: listener_https/all
server: cloudflare
x-evy-trace-virtual-host: all

GET
H2 200 RedHatDisplay-Bold.ttf
d362h7pxdteoyk.cloudfront.net/custom/64d678615e3d0/RedHatDisplay/ 46 KB
25 KB 95ms
27ms Font
font/ttf 2600:9000:2057:cc00:10:fb15:b700:21
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d362h7pxdteoyk.cloudfront.net/custom/64d678615e3d0/RedHatDisplay/RedHatDisplay-Bold.ttf
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2057:cc00:10:fb15:b700:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 6fa5f40c6218b575eacc8e145c84c31789d4576951ad15dc3866c6dab1e026df

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://www.picussecurity.com
Referer: https://www.picussecurity.com/

Response headers

vary: accept-encoding
content-encoding: br
etag: W/"8e3712389d8ab88d3b133fd9e07af04b"
age: 7670
access-control-allow-methods: GET, HEAD
via: 1.1 04599a8a3c6eb66f23e5ae02d1ec4cf2.cloudfront.net (CloudFront)
access-control-allow-origin: *
x-cache: Hit from cloudfront
x-amz-cf-id: j6TmGCckPFqzkXiWmVwtSa0N6KVL4FyW1OdPXljhG1LoDbOp7ANLXw==
date: Fri, 17 Jan 2025 07:23:10 GMT
content-type: font/ttf
last-modified: Thu, 02 Feb 2023 12:15:01 GMT
server: AmazonS3
x-amz-cf-pop: FRA6-C1
x-amz-server-side-encryption: AES256

GET
H2 200 pxiEyp8kv8JHgFVrJJfecg.woff2
d362h7pxdteoyk.cloudfront.net/fonts/poppins/ 8 KB
8 KB 91ms
23ms Font
binary/octet-stream 2600:9000:2057:cc00:10:fb15:b700:21
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d362h7pxdteoyk.cloudfront.net/fonts/poppins/pxiEyp8kv8JHgFVrJJfecg.woff2
Requested by: Host: tctguyhimcwcyexxgullu3seem0fkhrh.lambda-url.us-west-2.on.aws
URL: https://tctguyhimcwcyexxgullu3seem0fkhrh.lambda-url.us-west-2.on.aws/?family=Poppins&display=swap
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2057:cc00:10:fb15:b700:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 7d93459d86585bfcdbb7e0376056226adb25821ee54b96236fe2123e9560929f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://www.picussecurity.com
Referer: https://tctguyhimcwcyexxgullu3seem0fkhrh.lambda-url.us-west-2.on.aws/

Response headers

etag: "9212f6f9860f9fc6c69b02fedf6db8c3"
age: 10102
access-control-allow-methods: GET, HEAD
via: 1.1 04599a8a3c6eb66f23e5ae02d1ec4cf2.cloudfront.net (CloudFront)
accept-ranges: bytes
access-control-allow-origin: *
x-cache: Hit from cloudfront
content-length: 7884
x-amz-cf-id: I7umdsvuWNU5foLO_uvB91Uy42-yDMcfrondGd-dIOQF4m3K9YhDAQ==
date: Fri, 17 Jan 2025 06:02:14 GMT
content-type: binary/octet-stream
last-modified: Wed, 14 Dec 2022 11:49:37 GMT
server: AmazonS3
x-amz-cf-pop: FRA6-C1
vary: accept-encoding

GET
H2 200 272587cdb878c3227cd6cfb3b81619ab.png
d3lopmpcew67el.cloudfront.net/client_64d678615e3d0/ 217 KB
0 0ms
0ms Image
image/png 2600:9000:2646:b800:b:8c20:bf40:21
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d3lopmpcew67el.cloudfront.net/client_64d678615e3d0/272587cdb878c3227cd6cfb3b81619ab.png
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2646:b800:b:8c20:bf40:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 2d7d69d8f51f380637087e8373287046efdb12d60e5ee7f8fe8412e79c2ee0f5

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.picussecurity.com/resource/blog/apt29-cozy-bear-evolution-techniques

Response headers

vary: accept-encoding
x-amz-version-id: BW2mSSOv24JCUwzk5q5UIxwRtxLNXoPn
etag: "c07242b394ce13e473c661ff6b6cc24b"
age: 7670
via: 1.1 c2bfbd57ba266fad66928f7d9fe2f1c6.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: Hit from cloudfront
content-length: 222592
x-amz-cf-id: 47GcvlrNPVhlFWgN_4358ns6o10rblNfNKvP8WtGEED6SjSgo8rFuQ==
date: Fri, 17 Jan 2025 07:09:48 GMT
content-type: image/png
last-modified: Tue, 24 Dec 2024 11:41:34 GMT
server: AmazonS3
x-amz-cf-pop: FRA60-P5
x-amz-server-side-encryption: AES256

GET
H3 200 counters.gif
forms.hsforms.com/embed/v3/ 35 B
569 B 131ms
130ms Image
image/gif 2606:4700::6813:afbc
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://forms.hsforms.com/embed/v3/counters.gif?key=collected-forms-embed-js-form-bind&count=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6813:afbc , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.picussecurity.com/resource/blog/apt29-cozy-bear-evolution-techniques

Response headers

x-robots-tag: none
x-request-id: 89cdac4d-6bf2-4aeb-8f8b-ca2f060e939b
access-control-expose-headers: X-Origin-Hublet
cf-cache-status: DYNAMIC
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
x-evy-trace-listener: listener_https
server-timing: cfExtPri
date: Fri, 17 Jan 2025 08:50:34 GMT
x-hubspot-correlation-id: 89cdac4d-6bf2-4aeb-8f8b-ca2f060e939b
content-type: image/gif
vary: origin
priority: u=3,i
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-evy-trace-route-service-name: envoyset-translator
cache-control: max-age=0, no-cache, no-store
x-evy-trace-served-by-pod: iad02/star-hubspot-td/envoy-proxy-b967ccf5d-2g9kq
x-envoy-upstream-service-time: 2
access-control-allow-credentials: false
cf-ray: 903519340ed8699b-FRA
x-evy-trace-route-configuration: listener_https/all
content-length: 35
server: cloudflare
x-evy-trace-virtual-host: all

GET
H/1.1

200
OK

/
tctguyhimcwcyexxgullu3seem0fkhrh.lambda-url.us-west-2.on.aws/
Redirect Chain

https://fonts.popt.in/?family=Poppins&display=swap
https://tctguyhimcwcyexxgullu3seem0fkhrh.lambda-url.us-west-2.on.aws/?family=Poppins&display=swap

1015 B
1 KB

192ms
192ms

Stylesheet
text/css

2600:1f14:50b:9a02:4f20:5197:da0f:c8af
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tctguyhimcwcyexxgullu3seem0fkhrh.lambda-url.us-west-2.on.aws/?family=Poppins&display=swap
Protocol: HTTP/1.1
Server: 2600:1f14:50b:9a02:4f20:5197:da0f:c8af Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: 8503bb1f3969798a88dce37ee7f38979711dfd7495f5b8dafd66a19ff24e2d15

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.picussecurity.com/resource/blog/apt29-cozy-bear-evolution-techniques

Response headers

x-amzn-RequestId: dc7f9826-9788-427e-b19e-dea3fee807f4
x-amzn-Remapped-host: fonts.popt.in
Content-Length: 1015
Date: Fri, 17 Jan 2025 08:50:35 GMT
Content-Type: text/css; charset=utf-8
Connection: keep-alive
X-Amzn-Trace-Id: Root=1-678a19db-2d84a8e11594b9a2654f8bf7;Parent=2810c1ff14e601ac;Sampled=0;Lineage=1:013914a9:0

Redirect headers

cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
location: https://tctguyhimcwcyexxgullu3seem0fkhrh.lambda-url.us-west-2.on.aws?family=Poppins&display=swap
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=SmGvu5iMHFHaq7uahmlB%2BFlY1WEenYEgzkSpOqa%2FWOi1%2BpHshrUBBRYQqGNv6xwMSKMr0TIHpx%2BBdbdWxKW%2BNqdeR2ct3z5VBPoyEMoKOQkVVQ2CGxMjta6aq1lN9cpVzNVJmnR6KUCOiM5H"}],"group":"cf-nel","max_age":604800}
cf-ray: 90351936ae381da4-FRA
expires: Thu, 01 Jan 1970 00:00:01 GMT
content-length: 143
date: Fri, 17 Jan 2025 08:50:34 GMT
content-type: text/html
vary: Accept-Encoding
server: cloudflare

GET
H/1.1

200
OK

/
tctguyhimcwcyexxgullu3seem0fkhrh.lambda-url.us-west-2.on.aws/
Redirect Chain

https://fonts.popt.in/?family=Yeseva+One&display=swap
https://tctguyhimcwcyexxgullu3seem0fkhrh.lambda-url.us-west-2.on.aws/?family=Yeseva+One&display=swap

2 KB
2 KB

390ms
197ms

Stylesheet
text/css

2600:1f14:50b:9a02:4f20:5197:da0f:c8af
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tctguyhimcwcyexxgullu3seem0fkhrh.lambda-url.us-west-2.on.aws/?family=Yeseva+One&display=swap
Protocol: HTTP/1.1
Server: 2600:1f14:50b:9a02:4f20:5197:da0f:c8af Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: dce3ba700ff47fbef568d7d322c669176b4150abc990ef6a9941bb4fdfa17299

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.picussecurity.com/resource/blog/apt29-cozy-bear-evolution-techniques

Response headers

x-amzn-RequestId: 0f59957a-4d19-4efd-b785-f610342a4bec
x-amzn-Remapped-host: fonts.popt.in
Content-Length: 1615
Date: Fri, 17 Jan 2025 08:50:35 GMT
Content-Type: text/css; charset=utf-8
Connection: keep-alive
X-Amzn-Trace-Id: Root=1-678a19db-5e6530a94e88eadd0725f42f;Parent=7ee2cb55cb419f25;Sampled=0;Lineage=1:013914a9:0

Redirect headers

cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
location: https://tctguyhimcwcyexxgullu3seem0fkhrh.lambda-url.us-west-2.on.aws?family=Yeseva+One&display=swap
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=E2hoPQOAsGejPZ2CxHcGuUQb8hp%2BxogTaj918hVznzCG2DnDwacqt5o%2BJ0NO0wl8xy%2F2skqPb68o%2BKK4RA6eB8Q7kOg%2Fd4%2FsfZkVtZOURYcelAuxODXCOhK4AwcCj%2BtHnpPDBxb2KVTOKhY0"}],"group":"cf-nel","max_age":604800}
cf-ray: 90351936ae391da4-FRA
expires: Thu, 01 Jan 1970 00:00:01 GMT
content-length: 143
date: Fri, 17 Jan 2025 08:50:34 GMT
content-type: text/html
vary: Accept-Encoding
server: cloudflare

POST
H3 200 64d678615e3d0 Show response
display.popt.in/api/display/conversion-activities/ 0
932 B 213ms
212ms XHR
text/html 2606:4700:3031::ac43:a6ca
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://display.popt.in/api/display/conversion-activities/64d678615e3d0

Requested by

Host: cdnjs.cloudflare.com
URL: https://cdnjs.cloudflare.com/ajax/libs/jquery/3.7.1/jquery.min.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3031::ac43:a6ca , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://bc.popt.in https://.mybigcommerce.com https://.jumpseller.com https://.myshopline.com https://.myshopify.com https://.grisynava.com https://poptin.test https://poptinemail.test https://.dev.popt.in https://amantilak.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff, nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.picussecurity.com/resource/blog/apt29-cozy-bear-evolution-techniques
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Accept: application/json, text/javascript, */*; q=0.01
Content-Type: application/json

Response headers

content-encoding: zstd
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=og0K39ZpAVNDnXs2SAH8ehRWBubHPfBtmGIqKwPTjiCxKPsNRD%2BIlDSH%2BpDmcC3BHbNLhdvdYNgdyouSO8HvposQEoy7aTuo%2B3IUmBF46AXhEWUEJ%2FydaU3ohMmEACNimhR8697zPGgwCKoz52g%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff, nosniff
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=22204&min_rtt=21663&rtt_var=1172&sent=23&recv=21&lost=0&retrans=0&sent_bytes=9663&recv_bytes=7925&delivery_rate=4206&cwnd=12000&unsent_bytes=0&cid=697f163569f80189&ts=3741&x=1", cfExtPri, cfHdrFlush;dur=0
date: Fri, 17 Jan 2025 08:50:35 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding
priority: u=0,i
x-frame-options: SAMEORIGIN
access-control-allow-headers: Origin, Content-Type
strict-transport-security: max-age=31536000; includeSubDomains
content-security-policy: frame-ancestors https://bc.popt.in https://*.mybigcommerce.com https://*.jumpseller.com https://*.myshopline.com https://*.myshopify.com https://*.grisynava.com https://poptin.test https://poptinemail.test https://*.dev.popt.in https://amantilak.com
cache-control: no-cache, private
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
access-control-allow-credentials: true
cf-ray: 903519384b5971c4-FRA
access-control-allow-origin: *
x-xss-protection: 1; mode=block
server: cloudflare

OPTIONS
H3 204 64d678615e3d0
display.popt.in/api/display/conversion-activities/ Frame 0
0 232ms
232ms Preflight 2606:4700:3031::ac43:a6ca
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://display.popt.in/api/display/conversion-activities/64d678615e3d0

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3031::ac43:a6ca , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://bc.popt.in https://.mybigcommerce.com https://.jumpseller.com https://.myshopline.com https://.myshopify.com https://.grisynava.com https://poptin.test https://poptinemail.test https://.dev.popt.in https://amantilak.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://www.picussecurity.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Origin, Content-Type content-type
access-control-allow-methods: POST
access-control-allow-origin: *
access-control-max-age: 0
alt-svc: h3=":443"; ma=86400
cache-control: no-cache, private
cf-cache-status: DYNAMIC
cf-ray: 90351936da6f71c4-FRA
content-security-policy: frame-ancestors https://bc.popt.in https://*.mybigcommerce.com https://*.jumpseller.com https://*.myshopline.com https://*.myshopify.com https://*.grisynava.com https://poptin.test https://poptinemail.test https://*.dev.popt.in https://amantilak.com
date: Fri, 17 Jan 2025 08:50:34 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
priority: u=0,i
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=1wWaIegMJhTz%2Baj5eCvNDJCZvti1%2BtdINtuSWhjJgq10K%2FWyGQGPYS9QPVOdTStvIEc1oZU%2Bkbr43XS9cITp2aScWLm4bDpayHWXVW%2BF5C3toJIEe752fqdZaXgnEvJ%2Fr6w2GmULMXwO2Aqmoww%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
server-timing: cfL4;desc="?proto=QUIC&rtt=22237&min_rtt=21663&rtt_var=1475&sent=20&recv=19&lost=0&retrans=0&sent_bytes=8641&recv_bytes=7299&delivery_rate=3694&cwnd=12000&unsent_bytes=0&cid=697f163569f80189&ts=3528&x=1" cfExtPri cfHdrFlush;dur=0
strict-transport-security: max-age=31536000; includeSubDomains
vary: Access-Control-Request-Method, Access-Control-Request-Headers
x-content-type-options: nosniff nosniff
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block

OPTIONS
H3 204 6d77a91c06469
display.popt.in/api/display/viewed/ Frame 0
0 206ms
206ms Preflight 2606:4700:3031::ac43:a6ca
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://display.popt.in/api/display/viewed/6d77a91c06469

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3031::ac43:a6ca , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://bc.popt.in https://.mybigcommerce.com https://.jumpseller.com https://.myshopline.com https://.myshopify.com https://.grisynava.com https://poptin.test https://poptinemail.test https://.dev.popt.in https://amantilak.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://www.picussecurity.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Origin, Content-Type content-type
access-control-allow-methods: POST
access-control-allow-origin: *
access-control-max-age: 0
alt-svc: h3=":443"; ma=86400
cache-control: no-cache, private
cf-cache-status: DYNAMIC
cf-ray: 903519399c2771c4-FRA
content-security-policy: frame-ancestors https://bc.popt.in https://*.mybigcommerce.com https://*.jumpseller.com https://*.myshopline.com https://*.myshopify.com https://*.grisynava.com https://poptin.test https://poptinemail.test https://*.dev.popt.in https://amantilak.com
date: Fri, 17 Jan 2025 08:50:35 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
priority: u=1,i
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=iK6rtS6T6j9xW8v2Y8uTHLMXoBgSsCfYvkFeOsgnuIJX7RFUKRIJbGg7xmrrAtyMn%2FgXRAvJ%2FCaXz9FF5H3XPisrjIL3VwFFnIKuWN2AcQj3sWWOpQ5ikUJV9KJy3YCu%2BEHxqQKI3YKoKo%2Bcx6M%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
server-timing: cfL4;desc="?proto=QUIC&rtt=22158&min_rtt=21663&rtt_var=970&sent=25&recv=22&lost=0&retrans=0&sent_bytes=10642&recv_bytes=8309&delivery_rate=4468&cwnd=12000&unsent_bytes=0&cid=697f163569f80189&ts=3950&x=1" cfExtPri cfHdrFlush;dur=0
strict-transport-security: max-age=31536000; includeSubDomains
vary: Access-Control-Request-Method, Access-Control-Request-Headers
x-content-type-options: nosniff nosniff
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block

POST
H3 200 6d77a91c06469 Show response
display.popt.in/api/display/viewed/ 105 B
1001 B 232ms
231ms XHR
application/json 2606:4700:3031::ac43:a6ca
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://display.popt.in/api/display/viewed/6d77a91c06469

Requested by

Host: cdnjs.cloudflare.com
URL: https://cdnjs.cloudflare.com/ajax/libs/jquery/3.7.1/jquery.min.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3031::ac43:a6ca , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7b78451da3c7c6e9d5120ba7ebce5c06bcea2ef1fac4b59ee86fbb3e08280b14

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://bc.popt.in https://.mybigcommerce.com https://.jumpseller.com https://.myshopline.com https://.myshopify.com https://.grisynava.com https://poptin.test https://poptinemail.test https://.dev.popt.in https://amantilak.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff, nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.picussecurity.com/resource/blog/apt29-cozy-bear-evolution-techniques
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Accept: application/json, text/javascript, */*; q=0.01
Content-Type: application/json

Response headers

content-encoding: gzip
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=0Ak7xtF9J2t4xglsklxIDdakAxON7NVcR2yuxaxaTGXWEwijEDBrozssJnIcghkVlu8VZvaQgHzzK0CvVwr%2B4AK81UXXlpjfphohuyaggJ0fK%2FzJEOUl0D%2BvezBJuHq41w6ns8yjNi3n74q1MGY%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff, nosniff
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=22135&min_rtt=21663&rtt_var=774&sent=28&recv=24&lost=0&retrans=0&sent_bytes=11663&recv_bytes=9037&delivery_rate=4722&cwnd=12000&unsent_bytes=0&cid=697f163569f80189&ts=4181&x=1", cfExtPri, cfHdrFlush;dur=0
date: Fri, 17 Jan 2025 08:50:35 GMT
content-type: application/json
vary: Accept-Encoding
priority: u=1,i
x-frame-options: SAMEORIGIN
access-control-allow-headers: Origin, Content-Type
strict-transport-security: max-age=31536000; includeSubDomains
content-security-policy: frame-ancestors https://bc.popt.in https://*.mybigcommerce.com https://*.jumpseller.com https://*.myshopline.com https://*.myshopify.com https://*.grisynava.com https://poptin.test https://poptinemail.test https://*.dev.popt.in https://amantilak.com
cache-control: no-cache, private
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
access-control-allow-credentials: true
cf-ray: 9035193aed0671c4-FRA
access-control-allow-origin: *
x-xss-protection: 1; mode=block
server: cloudflare

GET
H2 200 OpNJno4ck8vc-xYpwWWxli1VWw.woff2
d362h7pxdteoyk.cloudfront.net/fonts/yesevaone/ 16 KB
17 KB 25ms
25ms Font
binary/octet-stream 2600:9000:2057:cc00:10:fb15:b700:21
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d362h7pxdteoyk.cloudfront.net/fonts/yesevaone/OpNJno4ck8vc-xYpwWWxli1VWw.woff2
Requested by: Host: tctguyhimcwcyexxgullu3seem0fkhrh.lambda-url.us-west-2.on.aws
URL: https://tctguyhimcwcyexxgullu3seem0fkhrh.lambda-url.us-west-2.on.aws/?family=Yeseva+One&display=swap
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2057:cc00:10:fb15:b700:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 4df2558618d59bf36dcdafac03f2a3d4b6fed61a7381558bff35a1b81675114a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://www.picussecurity.com
Referer: https://tctguyhimcwcyexxgullu3seem0fkhrh.lambda-url.us-west-2.on.aws/

Response headers

etag: "247f3761e787cb917d84b6beb4826113"
age: 5234
access-control-allow-methods: GET, HEAD
via: 1.1 04599a8a3c6eb66f23e5ae02d1ec4cf2.cloudfront.net (CloudFront)
accept-ranges: bytes
access-control-allow-origin: *
x-cache: Hit from cloudfront
content-length: 16664
x-amz-cf-id: zhC0bgTWAeM75JhUiW0uZ-Kc3jPw64kVg-BJcl9MDYDx-fzbNpDkIw==
date: Fri, 17 Jan 2025 07:23:22 GMT
content-type: binary/octet-stream
last-modified: Wed, 14 Dec 2022 11:53:07 GMT
server: AmazonS3
x-amz-cf-pop: FRA6-C1
vary: accept-encoding

Verdicts & Comments Add Verdict or Comment

153 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

49 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.www.picussecurity.com/	1970-01-21 02:31:45	Name: __cf_bm Value: EQNOPizvs4usF0rFsJCI0wa1PZbBKhf2ERMmAhNcbUY-1737103830-1.0.1.1-JJk.i7kYbUhnJRAtsf30mZ.opN0ARc0ruYlNP1tItZ1iKUjuMiwuNIFEouMcvjqWVEJUxvKuMiYTmxMMMqzhwQ
.www.picussecurity.com/	1969-12-31 23:59:59	Name: _cfuvid Value: ILloGET6b7reLpmXRMNEckrBVR4XcOhxw1m1ZhpYr5w-1737103830451-0.0.1.1-604800000
.hubspotusercontent-na1.net/	1970-01-21 02:31:45	Name: __cf_bm Value: rb38iDU3v9Edpzf8a6ADkEzIaC2yDYShA9zkSoYAjrY-1737103830-1.0.1.1-4.GFgIJ4E5Pw_Agd6O2kRNKbqMbxJqUwQTjlqgIIOlM10dai4550BbCAfDTZRMQkJbNSfWG4Nt0539FvQrCbIA
.picussecurity.com/	1970-01-21 02:31:45	Name: __cf_bm Value: ZB00hxjZ.cd8qhgEkwBcPX5FOFohfG0tgUWaifhybwk-1737103830-1.0.1.1-zkLvBAMV.1TSohTF00AmrN.I7RooWtQaDou28REANPw_FXWzpCrqd02mGBXqFE9istPlbOBVuS8XrK3YK3SgGQ
.picussecurity.com/	1969-12-31 23:59:59	Name: _cfuvid Value: ICLMMtAzlgRZpur1Gp83xgdWDCQWEvCD6H1CD6FAm3Q-1737103830861-0.0.1.1-604800000
.picussecurity.com/	1969-12-31 23:59:59	Name: traffic_start_page Value: https://www.picussecurity.com/resource/blog/apt29-cozy-bear-evolution-techniques
.picussecurity.com/	1970-01-21 02:31:47	Name: MF69CXJ-OZ2jFJm35 Value: :::2
.picussecurity.com/	1970-01-21 02:31:47	Name: MF6JIbbIciiT7 Value: :::2
.picussecurity.com/	1970-01-21 02:31:47	Name: MF6JIbbJSfd Value: :::2
.picussecurity.com/	1970-01-21 02:31:47	Name: MF6JIbbCSRZlD Value: :::2
.picussecurity.com/	1970-01-21 12:07:43	Name: MFVaCk Value: 1:::2
.picussecurity.com/	1970-01-21 12:07:43	Name: MFVaKX5 Value: 209bafa7-41a5-4df7-9856-e5d608098f39:::2
.picussecurity.com/	1970-01-21 02:31:47	Name: MFVaKkbIhOik Value: 1737103831:::2
.picussecurity.com/	1970-01-21 02:31:47	Name: MFVaKk-5 Value: 406d77bd-b14a-4f69-bc6d-94ae5f3eeaa9:::2
.picussecurity.com/	1970-01-21 02:31:47	Name: MFVaEkb4ciek Value: 1:::2
.picussecurity.com/	1970-01-21 02:31:47	Name: MFVaEk-5 Value: cef86ef7-b6dc-4f60-8992-b96e09ef4a26:::2
.picussecurity.com/	1970-01-21 02:31:47	Name: MFVaEkbIhOik Value: 1737103831:::2
.hubspot.com/	1970-01-21 02:31:45	Name: __cf_bm Value: BPoZ_fVnmsGz7aS0tKhxektdgovTxqf779kgpmywoPE-1737103831-1.0.1.1-W6YqnDhO6x0xI5XSNl6rySGtGTs4l5YLxtO28imPrISVqUx2Fvw8_oGcdUOl60bzBaPcBALEE1cpwXOT6OhXZQ
.hubspot.com/	1969-12-31 23:59:59	Name: _cfuvid Value: tZOj2HnDBdG0mOGVdNaFgaXWHDgFJMMDyWH_ctUlnfM-1737103831069-0.0.1.1-604800000
.hubspot.net/	1970-01-21 02:31:45	Name: __cf_bm Value: 3DXeR9t2alrV3ow3PvQNyOYqr8SaC_fe_5ErDHuOYkw-1737103831-1.0.1.1-qInkR6XG6RqnHieX4dpQgY6Mcd22cGysRrQV3AVLO25GXhIZtFjib6BvKGsd.AWg6FUM6ORhclUEywZDs6zMeA
.hs-banner.com/	1970-01-21 02:31:45	Name: __cf_bm Value: HDgMhPwK1xh0m7ckwH2J.zBCb0QKF6BvZ.13LU89jug-1737103831-1.0.1.1-nIrX8ANn3dj3mmfFm2fTU0FVUUQPzK_Ldi.UUDB0OyxOg58iQR06aeb2RHK.4JpiiLSuiYku2i1RHq3bxnUZoA
.hsadspixel.net/	1970-01-21 02:31:45	Name: __cf_bm Value: hweEYbFELqgXQkGA7seTSGc6pX3pfEl9BRWVjFgcs_k-1737103831-1.0.1.1-s4Vkr2euU66D5.KhBbOcYnOF8dg8V_.QTRNZqP_CyZ7WGC0FZWdYARGcCalIGty2_3HVu9Wx_E9b6qAASDWIjw
.usemessages.com/	1970-01-21 02:31:45	Name: __cf_bm Value: qoXVfB.DvUwF.wKR9M9O_UN5YLwK0Qwoq3JqLlHkRxQ-1737103831-1.0.1.1-pD7Lp1RcRy6J_0qSCDBIcl4auup15MQe2fDIs5gqvUYbiqCJKx7h75dV_i14LpeHzTft2DgzAMUrhD36ywpq6A
.hs-analytics.net/	1970-01-21 02:31:45	Name: __cf_bm Value: MOYeWRPToAPq0Rp04aCLDqzOY76vqCSHMeAB6uU7vJ8-1737103831-1.0.1.1-3boZzfvlZuzJp4rKKL.wPB.ak.fdMXRImT9cyFo85p0mjPef.jdLZQq7tN6PXBQTIf.XXn8bb7Z1zVh3udKndQ
www.picussecurity.com/	1970-01-21 02:34:36	Name: poptin_old_user Value: true
www.picussecurity.com/	1970-01-21 11:17:19	Name: poptin_user_id Value: 0.frbvxkosl
.picussecurity.com/	1970-01-21 11:17:19	Name: _hjSessionUser_2366058 Value: eyJpZCI6ImE3YWY3ZTZhLTU5YmQtNTAwNC1hYzRkLTBkMGRlMWU4MTVhOSIsImNyZWF0ZWQiOjE3MzcxMDM4MzEyNDQsImV4aXN0aW5nIjp0cnVlfQ==
.picussecurity.com/	1970-01-21 02:31:45	Name: _hjSession_2366058 Value: eyJpZCI6IjEzZWY5MzkxLTgwNDAtNGEzNC05N2Y3LThiZjMzYjc5M2JhNiIsImMiOjE3MzcxMDM4MzEyNDUsInMiOjEsInIiOjEsInNiIjowLCJzciI6MCwic2UiOjAsImZzIjoxLCJzcCI6MX0=
www.picussecurity.com/	1970-01-21 02:31:43	Name: poptin_previous_url Value:
.hsforms.com/	1970-01-21 02:31:45	Name: __cf_bm Value: 8wCLkO3VbCW8eKeK3kOsvvBMoBRCQ2yuSYJmxA2Q4Is-1737103831-1.0.1.1-AwDxzVfIaEZOy52lgs.13Wse_vkXfc06YLcwvVihCWu8nBTeMnRmSPO2RMqzLm086Jdr1fYGmqoTXD8F.V0dQQ
.hsforms.com/	1969-12-31 23:59:59	Name: _cfuvid Value: MuvBFr5WEKJgUfDzPHKElA9t6jvRukGBU0Hv996AK8c-1737103831505-0.0.1.1-604800000
www.picussecurity.com/	1970-01-21 11:17:19	Name: poptin_user_ip Value: 2001:1b60:1010:2:1011:1439:5ad8:e9e9
www.picussecurity.com/	1970-01-21 11:17:19	Name: poptin_user_country_code Value: false
www.picussecurity.com/	1970-01-21 03:14:55	Name: poptin_session_account_613f053dd8506 Value: true
www.picussecurity.com/	1970-01-21 02:31:45	Name: poptin_o_v_6d77a91c06469 Value: 878961d8e7ba6
www.picussecurity.com/	1970-01-21 02:31:45	Name: poptin_session Value: true
www.picussecurity.com/	1970-01-21 03:14:55	Name: poptin_c_visitor Value: true
.hsappstatic.net/	1970-01-21 02:31:45	Name: __cf_bm Value: MUiP1yLAw1qbVS6g98SV85UquSyWcKyr4lMXr8fKwx4-1737103831-1.0.1.1-mGxyLZithJyfurdpTIm5CDMg4gsg8rzLYUE6GLXG0fTmWm7EqFWNNV34sXwpGqCtPwH0A5HNBvm8rmjdOtI_jg
.linkedin.com/	1970-01-21 02:33:10	Name: lidc Value: "b=VGST09:s=V:r=V:a=V:p=V:g=3079:u=1:x=1:i=1737103831:t=1737190231:v=2:sig=AQHW8StZAJ5rAizLaWCJvrXV2Gt7ehmb"
.linkedin.com/	1970-01-21 11:17:19	Name: bcookie Value: "v=2&d8b91807-3f7b-4364-85cc-c9ddf6db0c04"
.linkedin.com/	1970-01-21 06:50:55	Name: li_gc Value: MTswOzE3MzcxMDM4MzE7MjswMjGwiZySEHbpnPekq9awK15XvcnRo8CkRCgZUzHog8CYIg==
www.picussecurity.com/	1970-01-21 11:17:19	Name: poptin_last_visit Value: 2025-01-17
.picussecurity.com/	1970-01-21 06:50:55	Name: __hstc Value: 51282614.d347b0de772d0b336f3121ed40b444b7.1737103832760.1737103832760.1737103832760.1
.picussecurity.com/	1970-01-21 06:50:55	Name: hubspotutk Value: d347b0de772d0b336f3121ed40b444b7
.picussecurity.com/	1969-12-31 23:59:59	Name: __hssrc Value: 1
.picussecurity.com/	1970-01-21 02:31:45	Name: __hssc Value: 51282614.1.1737103832760
www.picussecurity.com/	1970-01-21 11:17:19	Name: poptin_d_r_v_6d77a91c06469 Value: 0
www.picussecurity.com/	1970-01-21 02:33:10	Name: poptin_o_a_d_6d77a91c06469 Value: 878961d8e7ba6
www.picussecurity.com/	1970-01-21 02:31:45	Name: poptin_o_a_v_6d77a91c06469 Value: 878961d8e7ba6

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

39666904.fs1.hubspotusercontent-na1.net
7048931.fs1.hubspotusercontent-na1.net
api.hubapi.com
app.hubspot.com
cdn.popt.in
cdn2.hubspot.net
cdnjs.cloudflare.com
content.hotjar.io
cta-service-cms2.hubspot.com
d362h7pxdteoyk.cloudfront.net
d3lopmpcew67el.cloudfront.net
display.popt.in
fonts.googleapis.com
fonts.gstatic.com
fonts.popt.in
forms-na1.hsforms.com
forms.hscollectedforms.net
forms.hsforms.com
forms.hubspot.com
js.hs-analytics.net
js.hs-banner.com
js.hsadspixel.net
js.hscollectedforms.net
js.hsleadflows.net
js.hubspot.com
js.usemessages.com
p.visitorqueue.com
pagead2.googlesyndication.com
perf-na1.hsforms.com
personalisation.visitorqueue.com
picussecurity.com
px.ads.linkedin.com
px4.ads.linkedin.com
region1.google-analytics.com
script.hotjar.com
snap.licdn.com
static.hotjar.com
static.hsappstatic.net
static.hubspot.com
t.visitorqueue.com
tctguyhimcwcyexxgullu3seem0fkhrh.lambda-url.us-west-2.on.aws
track.hubspot.com
vc.hotjar.io
www.googletagmanager.com
www.picussecurity.com
13.107.42.14
15.157.148.248
18.66.102.11
18.66.112.15
199.60.103.32
2001:4860:4802:34::36
2600:1f14:50b:9a02:4f20:5197:da0f:c8af
2600:9000:2057:cc00:10:fb15:b700:21
2600:9000:2359:1e00:9:96ee:a300:93a1
2600:9000:2490:7a00:c:77c4:d500:93a1
2600:9000:2646:b800:b:8c20:bf40:21
2606:2c40::c73c:67e3
2606:4700:3031::ac43:a6ca
2606:4700:4400::ac40:9284
2606:4700:4400::ac40:9310
2606:4700::6810:4e8e
2606:4700::6810:6bfe
2606:4700::6810:7574
2606:4700::6810:7674
2606:4700::6810:a0a8
2606:4700::6811:190e
2606:4700::6811:80ac
2606:4700::6811:af5b
2606:4700::6812:593e
2606:4700::6812:8b11
2606:4700::6812:f06c
2606:4700::6813:afbc
2620:1ec:21::14
2a00:1450:4001:80e::2003
2a00:1450:4001:80f::200a
2a00:1450:4001:82b::2008
2a00:1450:4001:831::2002
2a02:26f0:3500:10::210:a9a
52.210.81.110
52.222.236.43
0120aa4d7cc1cf96b08f24a7d702f342cc96fa02b693b8739009b000bad5a88a
041685b0e5a31c63c4c06ffc86484bdd0c56100f1f0b36c91571e6a00bcec715
0af58bcdda4bce4a998c3c1d32d5a6bbebd8ef7c7007e8888531cb493cc9f64b
0c7178cc6ca34fb18e30f070a5e7a1c287b2d7ccfcba2cfdf06e0f46eda55740
0d24d7930883c81a956a8d25026d6befdf264a901da8570a7fa27b6db580c2bf
0e0e91c655429e89e6f922885ea309f734d5f61c770b759a89713bda73b19ae8
101968119222fed85bc57fffcd41d002c8a073538faf936a6806c6a0ecc96508
106fcd8d723eda7d92a26893a439ccef998e5fc68ad228253607143d801e8cd8
109a14abac939df0ab29af6bbf5c0ca592b1cdf7adb33a0052f166c8b303bc37
115c7f3cf61e4ec19070b9e59e20e78756d39d193eb9b544065059b9935d2491
15d436832ea63ac77ab00dcedeeda8e38fb2913f7c9d6d217dc6b18c601584f2
174435f079753524341d6ec3f3767cb2d2170d62bdab01c7063fdb28b8c039e2
1b43b96cdc730ee98b4585054e07f3f94d5135b0f1b7bf68be42b396dd631cd8
21036da1013e88ad1be39946746a916786b081557a7a72b6a194c153c175aa59
228f08d7d79b9a75e9df18997ee260c139fe2d538924d5f05037e047d3f41d38
286daa531d6e30defea002e3f48c326fa055d62c51932d5c7ff17dcdbc03f44e
28a9962f431d01e35ee3a7f72952ab8f8bfb286c38b8dfea9ad530e2d5c4db5b
2d042ae177f7d076320fa923d0bfc2d3f831e3dacec0ff6fffc1328d4e36f2f9
2d7d69d8f51f380637087e8373287046efdb12d60e5ee7f8fe8412e79c2ee0f5
2e095c77cbc278604a08136ba272382190c0c7a12a26777a33ca20fafbb59186
30f5b70598630108952d978da585dc53cf4e81d066429a08cc9db4d1b37fcdc6
326282418d162c0341d44f854fbfe4b0dd18929ccf13cb94a56f03b34029d554
3515e02fe5788cfcd3d13d7475727a0ba88b9e1559c786e1fcbd2fe1b08452df
37ae22001cbbeb0ac14954c007c7406b2c17b8d30d8b74f8bff0a225b5a9ebe3
387fafc4558eb44d4303fb1710ec85e39755ffa9378b8cdf982c7e66db79c463
3c1c67c3c77d727b1c7d37a07a9d4e3303cfe1c9b30db9c68238d9c14b6b0ea4
3eb7a1272994580582e8bf48cd4a2c0197e7a2082ed1042109985f66f4e4e751
4033cfc5f5d8742d9b7bbafabdc19c999daa2cecc5ac9895fb820fa76b6749fc
4071465b2c0223da0e296a2d9ed8fbec379caa2d8eccacf96113afa481d7714a
41413e45a7aca363b6a7e8bb94fc87708d66997ee9cdac64467d94aa69020caf
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
4a948cad1525b333f4615fb0203e3dcf4a5fdef9409adb657fceeab1dcb37f7d
4bf7bbe2ff34569ca8208b5df957ae1bd37d2403d378146fb4e993155cb9820d
4d853f486dc84fdc7d1b073cbe0567f4ad79b211fc28ed46186bbb0c8cd1ad26
4df2558618d59bf36dcdafac03f2a3d4b6fed61a7381558bff35a1b81675114a
5242ab5df4690e1c975cefd6c70bc7f19037060288e9254c16b3ea0b07f3b222
53ced87a722a39027bc3d46d303d3e7e7d2435a29820340098a8b0eacdd0f003
5458bb001fbaee0822a06901d6989a7568457bc97c78ce726d8884c34f665910
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3
568d7b83659993469a2d729ad98daba3a7de2568f74d670d18ae618f118fe353
5cfa83504aa9c8a4654937559cbe6419ad26c4582eb55be91d5ddf975b5cb807
5f2662d3a952503f1a49334a9436df710115bffcb783697a5c6e85f8d5883d1c
61511c5c4086c97cc5afe6c5bb9f9bb444e559e8fafbd2f7d34e5b5539a12a14
616a7f16e89518adbc89002f178ebfac5756fc3e96ca30a807ce65ee0e7e4530
6202a707389216018296d2573a0e128aaa0e4036b8177721b4e40df999ba87e4
62553d159189834af73c9a6264704be5b2bee9a08da66a14768d8e5c6ffd2cdb
633600072534f800c00ce54b60270678545462434c28e1865dde26273d8b00d3
6814ef46f686990cf4e946f966167b0507e1d642c44e51f61bffb0bba2d4672b
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992
6f60518843c6c99881993a0720555e360fc858a898cfb20608f40c66511f4287
6fa5f40c6218b575eacc8e145c84c31789d4576951ad15dc3866c6dab1e026df
7449d6e6793b78987e22f3935dec733f9620e51ba459be743bc7ddfb8da3c73e
769efb813106ed9bf203aa8f047adb235ac9ec7a55a352f517f9b4f12143d4ae
794559db00f5a68a8a82dc14f100cd1f9a970cbea66701ca8a43dee9919ffe03
799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd
7b78451da3c7c6e9d5120ba7ebce5c06bcea2ef1fac4b59ee86fbb3e08280b14
7c2591f422aa5cfb1f8bf00a5db7c9407e81037dbeaf22b2e8a791e56468cdf3
7cc1ff7f9b57caf071c85b50968032dea1fa2ff1dc8a84da9d248d70a7820ffd
7d93459d86585bfcdbb7e0376056226adb25821ee54b96236fe2123e9560929f
7dcd5e1ea1ce1c1aaabc54e378185ce8daae846cb2517d370280d8c1bfa95813
8273304fd0142c815d16b78e336b373d5446fcc4a06167972d581721209fc3ca
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
8503bb1f3969798a88dce37ee7f38979711dfd7495f5b8dafd66a19ff24e2d15
8a27dc7b44ebe886390bfa0a9beeea36ea5a3f37479f0e0836b6c9b80d9b35ed
8da927b6b1240ffca4323fbb2a12c8e5abb541040965c2bc5b7d09a2eb963b02
9010a869111373688271063ae1825987889c28dacc0222ad97baa8f13a24a738
918b7dc3e2e2d015c16ce08b57bcb64d2253bafc1707658f361e72865498e537
a00ac1e97469410d27c7807937a01a9fb37272970d20a0178bad424be0bdf6ae
a380a9a7fc676bef053e1f3716b212719e3dd4ced09cf58bd961f8903908bbaa
a3ca2178c03aa90413665605224901388a8a7694be710ccf31d1c9546f6bb558
a3f04336cdf3733b903769767bd1e569f867f33fef41d94a42a0402e56e4045c
a8cdacdb576b14e22902e6c9e8bf5d82ebc38172183932f040754a71eac4ef8c
a8e9fbbb12219582bb8f65789dc5329a957f36c3f63edaa57e4c0ca572229c62
acd99bc44c7dee5ab0ef7bc6c98937717e7b36b8fe8eef3a6ea9ec44ef2f90b0
ad35b390ce3898cfef7bb94973d42ab290ec56f7315e0b459f4ba017eac96f07
b0403829bc66fd1f26c7ad7f42a2560787fe44f34417d357ed83d107ab32d983
b2353ab18ab8493a1cb644aec769a1db858be1cbd2a193d0910d8b00b9c2faaf
b687d1ff1bb1385dfef7d064b930c67934354bd0cee4c2aa2500a329ff0d98c4
c447dd7677b419db7b21dbdfc6277c7816a913ffda76fd2e52702df538de0e49
c643d360774246811d0309f6c7357dacc875243941403fb0edcb2d3e37e2a159
ca60365fe71f65979adc28bc6ca7ad87b2266af2d92f145be47bd874559e4b60
cb5224674e43d02db0037517f4aa29ba5ce9ddd0672e513cc7289714ba657522
ccee1682963a5d9deecdb1dcf9f8e00135cf80c850f2e3309637aa0b14a47938
ce1eade43de61291fb7e1708bdbe373f955aa88e54e9c894fa6ab1ed455ab1b5
cf773224fb7b3fd5978d7b527d003387334f71f37ed57e9ea50fe7b9bf4d6a76
d1af850eed9d8f478503ae0d24ebdd78691a15ed523db6f16df44b9da327c0d5
d1b07feb8dacb85eaa974e4da4e4268679888a74f92ed43e15123ac701717ec6
d7459dd5ce48ddd21da15f490514af4be07ff85f0b0b6b9e118542d68ff5ec91
d875f9a2038e25a599452c9e774403240c3bc83df261ed41188bd7ecdf71fee0
dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4
dce3ba700ff47fbef568d7d322c669176b4150abc990ef6a9941bb4fdfa17299
de1e399b07289f3b0a8d35142e363e128124a1185770e214e25e58030dad48e5
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e4efcc099f128e3655108f269adb8e838c24ee54d98c3903a22dec225e3e1221
e66dfbcc8ba7cd3624126a2d8825bd6216fe0202af9d9f750ab7b02e6ca8fc44
e8762831ff219f8b76b3479d9ffb9da218a058d059993123584cdbb5da6c079b
ea40563dac288d2a4e806100888a28be233519095512b5b0f44f02d4a4b23aea
ee00ea4e08a430d6ce3d20e620e0a9ee9566abd90a7df0370e8bcc67a72678b2
f052ee44c3728dfd23aba8a4567150bc314d23903026fbb6ad089422c2df56af
f1d5ab17a991bc2f7bbb97f88d96d7ba58cd7831ec086ad157fe89a62ade052a
f4fe037b98a06a63f683cf40f2d70275693095d05d04998e1d12cdf8d3216497
f80603874c68fef25ac9ffe412a6c6056ab267d7e4d044f090c8282ab80c4da5
fa4341c1fd7414777725b672f5ba250909de031e832ae84f9658b763ba638702
fb56af9f7623a55839dfb9cf019b05664a62e1b41671d925f3ed587c506443b5
fc9a93dd241f6b045cbff0481cf4e1901becd0e12fb45166a8f17f95823f0b1a
fe6ee10b03114d58ae3552f76f67608965f961c9d2743a003b3c8da7e5ff4f7c
ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e
ffba9a52471b5e7d35690f8297267837b94bdce89a67fa3ab13e5574d686a546
fffcc1196c1beb2cd92264e3b6efe6fdebc9129610b8308987eff5d97ebab507

www.picussecurity.com Open in urlscan Pro 2606:2c40::c73c:67e3 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

131 Requests

95 %HTTPS

80 %IPv6

27 Domains

45 Subdomains

36 IPs

4 Countries

2050 kBTransfer

5081 kBSize

49 Cookies

22 Outgoing links

Redirected requests

131 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 3 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

www.picussecurity.com Open in urlscan Pro
2606:2c40::c73c:67e3 Public Scan

Screenshot
Live screenshot

Full Image

131
Requests

95 %
HTTPS

80 %
IPv6

27
Domains

45
Subdomains

36
IPs

4
Countries

2050 kB
Transfer

5081 kB
Size

49
Cookies

131 HTTP transactions
3 data transactions