Submitted URL: https://s1.ai/bb-fin7
Effective URL: https://www.sentinelone.com/labs/black-basta-ransomware-attacks-deploy-custom-edr-evasion-tools-tied-to-fin7-threat-actor/
Submission: On October 17 via api from RU — Scanned from DE

Summary

This website contacted 38 IPs in 5 countries across 33 domains to perform 107 HTTP transactions. The main IP is 172.67.74.101, located in United States and belongs to CLOUDFLARENET, US. The main domain is www.sentinelone.com. The Cisco Umbrella rank of the primary domain is 186213.
TLS certificate: Issued by E6 on September 1st 2024. Valid for: 3 months.
This is the only time www.sentinelone.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 1 52.72.49.79 14618 (AMAZON-AES)
14 16 172.67.74.101 13335 (CLOUDFLAR...)
11 2606:4700::68... 13335 (CLOUDFLAR...)
3 34.49.80.229 396982 (GOOGLE-CL...)
2 24 2620:12a:8001::2 54113 (FASTLY)
1 2a00:1450:400... 15169 (GOOGLE)
7 104.17.74.206 13335 (CLOUDFLAR...)
4 2a00:1450:400... 15169 (GOOGLE)
3 2606:4700::68... 13335 (CLOUDFLAR...)
1 2606:4700:440... 13335 (CLOUDFLAR...)
2 2a00:1450:400... 15169 (GOOGLE)
4 2620:1ec:33::10 8075 (MICROSOFT...)
2 18.245.46.22 16509 (AMAZON-02)
2 23.197.137.224 16625 (AKAMAI-AS)
1 2a02:26f0:350... 20940 (AKAMAI-ASN1)
2 162.159.152.17 13335 (CLOUDFLAR...)
1 2001:4860:480... 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
1 146.75.120.157 54113 (FASTLY)
3 2606:4700:303... 13335 (CLOUDFLAR...)
8 3.127.102.30 16509 (AMAZON-02)
2 2620:1ec:29:1... 8075 (MICROSOFT...)
2 2a00:1450:400... 15169 (GOOGLE)
1 1 68.67.153.60 29990 (ASN-APPNEX)
2 2 185.89.210.82 29990 (ASN-APPNEX)
1 2600:9000:206... 16509 (AMAZON-02)
3 2606:4700::68... 13335 (CLOUDFLAR...)
2 2a00:1450:400... 15169 (GOOGLE)
1 162.159.140.229 13335 (CLOUDFLAR...)
1 104.244.42.131 13414 (TWITTER)
2 4 2620:1ec:21::14 8068 (MICROSOFT...)
2 13.107.42.14 8068 (MICROSOFT...)
1 18.66.102.75 16509 (AMAZON-02)
1 2 34.248.126.255 16509 (AMAZON-02)
1 35.244.174.68 396982 (GOOGLE-CL...)
1 192.28.144.124 15224 (OMNITURE)
1 20.10.16.51 8075 (MICROSOFT...)
1 142.250.181.226 ()
1 2 142.250.185.198 ()
1 142.250.185.102 ()
1 1 2a00:1450:400... ()
1 1 2a00:1450:400... ()
107 38
Apex Domain
Subdomains
Transfer
47 sentinelone.com
www.sentinelone.com — Cisco Umbrella Rank: 186213
de.sentinelone.com
go.sentinelone.com — Cisco Umbrella Rank: 315182
819 KB
11 cookielaw.org
cdn.cookielaw.org — Cisco Umbrella Rank: 326
192 KB
8 stackadapt.com
tags.srv.stackadapt.com — Cisco Umbrella Rank: 2579
11 KB
6 linkedin.com
px.ads.linkedin.com — Cisco Umbrella Rank: 321
px4.ads.linkedin.com — Cisco Umbrella Rank: 6828
4 KB
6 onesignal.com
cdn.onesignal.com — Cisco Umbrella Rank: 5396
onesignal.com — Cisco Umbrella Rank: 1637
img.onesignal.com — Cisco Umbrella Rank: 9324
91 KB
5 doubleclick.net
stats.g.doubleclick.net — Cisco Umbrella Rank: 136
13115870.fls.doubleclick.net
ad.doubleclick.net
googleads.g.doubleclick.net
1 KB
5 knock-ai.com
js.knock-ai.com — Cisco Umbrella Rank: 395209
ca.knock-ai.com — Cisco Umbrella Rank: 416223
10 KB
4 bing.com
bat.bing.com — Cisco Umbrella Rank: 348
16 KB
4 googletagmanager.com
www.googletagmanager.com — Cisco Umbrella Rank: 39
401 KB
3 clarity.ms
www.clarity.ms — Cisco Umbrella Rank: 634
z.clarity.ms — Cisco Umbrella Rank: 6384
28 KB
3 calibermind.com
cdn.calibermind.com — Cisco Umbrella Rank: 58783
e.calibermind.com — Cisco Umbrella Rank: 57571
63 KB
2 bidr.io
match.prod.bidr.io — Cisco Umbrella Rank: 598
407 B
2 adnxs.com
secure.adnxs.com — Cisco Umbrella Rank: 479
2 KB
2 google.de
www.google.de — Cisco Umbrella Rank: 11271
127 B
2 google.com
region1.analytics.google.com — Cisco Umbrella Rank: 4401
www.google.com
24 B
2 quora.com
a.quora.com — Cisco Umbrella Rank: 6617
q.quora.com — Cisco Umbrella Rank: 5041
15 KB
2 marketo.net
munchkin.marketo.net — Cisco Umbrella Rank: 3657
7 KB
2 demandbase.com
scripts.demandbase.com — Cisco Umbrella Rank: 8945
tag.demandbase.com — Cisco Umbrella Rank: 5931
34 KB
2 youtube.com
www.youtube.com — Cisco Umbrella Rank: 77
12 KB
1 googleadservices.com
www.googleadservices.com
3 KB
1 mktoresp.com
327-mnm-087.mktoresp.com — Cisco Umbrella Rank: 689213
318 B
1 rlcdn.com
id.rlcdn.com — Cisco Umbrella Rank: 812
98 B
1 company-target.com
api.company-target.com — Cisco Umbrella Rank: 4087
513 B
1 twitter.com
analytics.twitter.com — Cisco Umbrella Rank: 962
722 B
1 t.co
t.co — Cisco Umbrella Rank: 859
629 B
1 ml-api.io
attr.ml-api.io — Cisco Umbrella Rank: 18180
280 B
1 ml-attr.com
s.ml-attr.com — Cisco Umbrella Rank: 16506
284 B
1 ads-twitter.com
static.ads-twitter.com — Cisco Umbrella Rank: 960
15 KB
1 licdn.com
snap.licdn.com — Cisco Umbrella Rank: 784
14 KB
1 onetrust.com
geolocation.onetrust.com — Cisco Umbrella Rank: 498
295 B
1 googleapis.com
ajax.googleapis.com — Cisco Umbrella Rank: 412
30 KB
1 s1.ai
s1.ai
280 B
0 abrankings.com Failed
cdn.abrankings.com Failed
107 33
Domain Requested by
24 de.sentinelone.com 2 redirects www.sentinelone.com
de.sentinelone.com
16 www.sentinelone.com 14 redirects www.sentinelone.com
11 cdn.cookielaw.org www.sentinelone.com
cdn.cookielaw.org
8 tags.srv.stackadapt.com www.sentinelone.com
tags.srv.stackadapt.com
7 go.sentinelone.com www.sentinelone.com
go.sentinelone.com
4 px.ads.linkedin.com 2 redirects snap.licdn.com
4 bat.bing.com www.googletagmanager.com
bat.bing.com
www.sentinelone.com
4 www.googletagmanager.com www.sentinelone.com
www.googletagmanager.com
3 onesignal.com cdn.onesignal.com
3 js.knock-ai.com www.sentinelone.com
js.knock-ai.com
2 13115870.fls.doubleclick.net 1 redirects www.googletagmanager.com
2 match.prod.bidr.io 1 redirects www.sentinelone.com
2 px4.ads.linkedin.com www.sentinelone.com
2 ca.knock-ai.com js.knock-ai.com
2 secure.adnxs.com 2 redirects
2 www.google.de www.sentinelone.com
2 www.clarity.ms www.sentinelone.com
www.clarity.ms
2 cdn.calibermind.com www.sentinelone.com
www.googletagmanager.com
2 munchkin.marketo.net www.sentinelone.com
munchkin.marketo.net
2 www.youtube.com www.sentinelone.com
www.youtube.com
2 cdn.onesignal.com www.sentinelone.com
cdn.onesignal.com
1 www.google.com 1 redirects
1 googleads.g.doubleclick.net 1 redirects
1 ad.doubleclick.net
1 www.googleadservices.com www.googletagmanager.com
1 z.clarity.ms www.clarity.ms
1 img.onesignal.com www.sentinelone.com
1 327-mnm-087.mktoresp.com munchkin.marketo.net
1 e.calibermind.com cdn.calibermind.com
1 q.quora.com www.sentinelone.com
1 id.rlcdn.com www.sentinelone.com
1 api.company-target.com scripts.demandbase.com
1 analytics.twitter.com www.sentinelone.com
1 t.co www.sentinelone.com
1 attr.ml-api.io www.sentinelone.com
1 s.ml-attr.com 1 redirects
1 tag.demandbase.com www.sentinelone.com
1 static.ads-twitter.com www.sentinelone.com
1 stats.g.doubleclick.net www.googletagmanager.com
1 region1.analytics.google.com www.googletagmanager.com
1 a.quora.com www.sentinelone.com
1 snap.licdn.com www.sentinelone.com
1 scripts.demandbase.com www.sentinelone.com
1 geolocation.onetrust.com cdn.cookielaw.org
1 ajax.googleapis.com www.sentinelone.com
1 s1.ai 1 redirects
0 cdn.abrankings.com Failed www.googletagmanager.com
107 47
Subject Issuer Validity Valid
sentinelone.com
E6
2024-09-01 -
2024-11-30
3 months crt.sh
cookielaw.org
WE1
2024-10-11 -
2025-01-09
3 months crt.sh
js.knock-ai.com
WR3
2024-09-04 -
2024-12-03
3 months crt.sh
upload.video.google.com
WR2
2024-09-30 -
2024-12-23
3 months crt.sh
go.sentinelone.com
E6
2024-09-15 -
2024-12-14
3 months crt.sh
*.google-analytics.com
WR2
2024-09-30 -
2024-12-23
3 months crt.sh
*.onesignal.com
WE1
2024-09-02 -
2024-12-01
3 months crt.sh
geolocation.onetrust.com
WE1
2024-10-11 -
2025-01-09
3 months crt.sh
attivonetworks.com
R10
2024-09-07 -
2024-12-06
3 months crt.sh
*.google.com
WR2
2024-09-30 -
2024-12-23
3 months crt.sh
www.bing.com
Microsoft Azure RSA TLS Issuing CA 03
2024-09-16 -
2025-03-15
6 months crt.sh
tag.demandbase.com
Go Daddy Secure Certificate Authority - G2
2024-08-27 -
2025-09-28
a year crt.sh
*.marketo.net
DigiCert TLS RSA SHA256 2020 CA1
2023-12-08 -
2024-12-11
a year crt.sh
snap.licdn.com
DigiCert SHA2 Secure Server CA
2023-12-13 -
2024-12-12
a year crt.sh
quora.com
WR1
2024-10-07 -
2025-01-05
3 months crt.sh
*.g.doubleclick.net
WR2
2024-09-30 -
2024-12-23
3 months crt.sh
ads-twitter.com
DigiCert Global G2 TLS RSA SHA256 2020 CA1
2024-06-25 -
2025-06-24
a year crt.sh
calibermind.com
WE1
2024-10-10 -
2025-01-08
3 months crt.sh
*.srv.stackadapt.com
Amazon RSA 2048 M02
2024-08-09 -
2025-09-07
a year crt.sh
www.clarity.ms
DigiCert TLS RSA SHA256 2020 CA1
2024-09-04 -
2025-09-04
a year crt.sh
*.google.de
WR2
2024-09-30 -
2024-12-23
3 months crt.sh
onesignal.com
WE1
2024-09-02 -
2024-12-01
3 months crt.sh
ca.knock-ai.com
WR3
2024-09-14 -
2024-12-13
3 months crt.sh
t.co
E5
2024-09-28 -
2024-12-27
3 months crt.sh
*.twitter.com
DigiCert Global G2 TLS RSA SHA256 2020 CA1
2024-09-30 -
2025-09-29
a year crt.sh
www.linkedin.com
DigiCert SHA2 Secure Server CA
2024-10-14 -
2025-04-14
6 months crt.sh
api.demandbase.com
Go Daddy Secure Certificate Authority - G2
2024-08-13 -
2025-09-14
a year crt.sh
*.rlcdn.com
Sectigo RSA Domain Validation Secure Server CA
2024-02-06 -
2025-03-05
a year crt.sh
*.mktoresp.com
DigiCert Global G2 TLS RSA SHA256 2020 CA1
2024-08-15 -
2025-09-15
a year crt.sh
a.clarity.ms
Microsoft Azure RSA TLS Issuing CA 08
2024-06-23 -
2025-06-18
a year crt.sh
*.googleadservices.com
WR2
2024-09-30 -
2024-12-23
3 months crt.sh
*.doubleclick.net
WR2
2024-09-30 -
2024-12-23
3 months crt.sh

This page contains 3 frames:

Primary Page: https://www.sentinelone.com/labs/black-basta-ransomware-attacks-deploy-custom-edr-evasion-tools-tied-to-fin7-threat-actor/
Frame ID: E329A57D83388403C6BA2D04BC3AD82A
Requests: 108 HTTP requests in this frame

Frame: https://go.sentinelone.com/index.php/form/XDFrame
Frame ID: C177A837273682B9297C03AA5448B4EE
Requests: 2 HTTP requests in this frame

Frame: https://13115870.fls.doubleclick.net/activityi;dc_pre=CLuQr7SclokDFbqHgwcd4voGcQ;src=13115870;type=pagev0;cat=reque0;ord=%5BSessionID%5D;npa=1;auiddc=1238549638.1729195814;ps=1;pcor=165679221;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=noapi;frm=0;gtm=45fe4ag0v9135076156za200;gcd=13l3l3l2l1l1;dma_cps=syphamo;dma=1;tag_exp=101686685;epver=2;~oref=https%3A%2F%2Fwww.sentinelone.com%2Flabs%2Fblack-basta-ransomware-attacks-deploy-custom-edr-evasion-tools-tied-to-fin7-threat-actor%2F
Frame ID: 1177EE571EF9461BF332B1F509D06D2A
Requests: 1 HTTP requests in this frame

Screenshot

Page Title

Black Basta Ransomware | Attacks Deploy Custom EDR Evasion Tools Tied to FIN7 Threat Actor - SentinelOne

Page URL History Show full URLs

  1. https://s1.ai/bb-fin7 HTTP 301
    https://www.sentinelone.com/labs/black-basta-ransomware-attacks-deploy-custom-edr-evasion-tools-tied-to-... HTTP 301
    https://www.sentinelone.com/labs/black-basta-ransomware-attacks-deploy-custom-edr-evasion-tools-tied-to-... Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • /wp-(?:content|includes)/

Overall confidence: 100%
Detected patterns
  • clipboard(?:-([\d.]+))?(?:\.min)?\.js

Overall confidence: 100%
Detected patterns

Overall confidence: 100%
Detected patterns
  • googletagmanager\.com/gtm\.js
  • googletagmanager\.com/gtag/js

Overall confidence: 100%
Detected patterns
  • snap\.licdn\.com/li\.lms-analytics/insight\.min\.js

Overall confidence: 100%
Detected patterns
  • munchkin\.marketo\.\w+/(?:([\d.]+)/)?munchkin\.js

Overall confidence: 100%
Detected patterns
  • cdn\.onesignal\.com

Overall confidence: 100%
Detected patterns
  • cdn\.cookielaw\.org
  • otSDKStub\.js

Overall confidence: 100%
Detected patterns
  • /([\d.]+)/jquery(?:\.min)?\.js
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

107
Requests

79 %
HTTPS

48 %
IPv6

33
Domains

47
Subdomains

38
IPs

5
Countries

1753 kB
Transfer

4769 kB
Size

39
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://s1.ai/bb-fin7 HTTP 301
    https://www.sentinelone.com/labs/black-basta-ransomware-attacks-deploy-custom-edr-evasion-tools-tied-to-fin7-threat-actor HTTP 301
    https://www.sentinelone.com/labs/black-basta-ransomware-attacks-deploy-custom-edr-evasion-tools-tied-to-fin7-threat-actor/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 2
  • https://www.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/css/style-labs.min.css?ver=1729074227 HTTP 302
  • https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/css/style-labs.min.css?ver=1729074227
Request Chain 6
  • https://www.sentinelone.com/wp-content/uploads/2022/11/BlackBasta_FIN7_4.jpg HTTP 302
  • https://de.sentinelone.com/wp-content/uploads/2022/11/BlackBasta_FIN7_4.jpg
Request Chain 7
  • https://www.sentinelone.com/wp-content/uploads/2022/11/BlackBasta_FIN7_6.jpg HTTP 302
  • https://de.sentinelone.com/wp-content/uploads/2022/11/BlackBasta_FIN7_6.jpg
Request Chain 8
  • https://www.sentinelone.com/wp-content/uploads/2022/11/BlackBasta_FIN7_1.jpg HTTP 302
  • https://de.sentinelone.com/wp-content/uploads/2022/11/BlackBasta_FIN7_1.jpg
Request Chain 10
  • https://www.sentinelone.com/wp-includes/js/clipboard.min.js?ver=2.0.11 HTTP 302
  • https://de.sentinelone.com/wp-includes/js/clipboard.min.js?ver=2.0.11
Request Chain 11
  • https://www.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/js/global.min.js?ver=1729074227 HTTP 302
  • https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/js/global.min.js?ver=1729074227
Request Chain 13
  • https://www.sentinelone.com/wp-content/themes/sentinelone/assets/fonts/whyte/ABCWhytePlusVariable.woff2 HTTP 302
  • https://de.sentinelone.com/wp-content/themes/sentinelone/assets/fonts/whyte/ABCWhytePlusVariable.woff2
Request Chain 31
  • https://www.sentinelone.com/wp-content/uploads/2024/09/Kryptina-Desert-Ftr-150x150.jpg HTTP 302
  • https://de.sentinelone.com/wp-content/uploads/2024/09/Kryptina-Desert-Ftr-150x150.jpg
Request Chain 34
  • https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/social-twitter-white.svg; HTTP 301
  • https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/social-twitter-white.svg
Request Chain 35
  • https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/social-linkedin-white.svg; HTTP 301
  • https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/social-linkedin-white.svg
Request Chain 36
  • https://www.sentinelone.com/wp-content/uploads/2024/09/Zuzana_labscon23-150x150.jpg HTTP 302
  • https://de.sentinelone.com/wp-content/uploads/2024/09/Zuzana_labscon23-150x150.jpg
Request Chain 37
  • https://www.sentinelone.com/wp-content/uploads/2024/08/Exploring-_VT_Bus_ftr-150x150.jpg HTTP 302
  • https://de.sentinelone.com/wp-content/uploads/2024/08/Exploring-_VT_Bus_ftr-150x150.jpg
Request Chain 42
  • https://www.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/search-icon-white.svg HTTP 302
  • https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/search-icon-white.svg
Request Chain 43
  • https://www.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/img/SentinelLabs_Logo_RGB_WhitePurp.png HTTP 302
  • https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/img/SentinelLabs_Logo_RGB_WhitePurp.png
Request Chain 44
  • https://www.sentinelone.com/wp-content/uploads/2022/11/Black-Basta-Feature.jpg HTTP 302
  • https://de.sentinelone.com/wp-content/uploads/2022/11/Black-Basta-Feature.jpg
Request Chain 68
  • https://s.ml-attr.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dwww.sentinelone.com%26pId%3d%24UID HTTP 302
  • https://secure.adnxs.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dwww.sentinelone.com%26pId%3d%24UID HTTP 307
  • https://secure.adnxs.com/bounce?%2Fgetuid%3Fhttps%253a%252f%252fattr.ml-api.io%252f%253fdomain%253dwww.sentinelone.com%2526pId%253d%2524UID HTTP 302
  • https://attr.ml-api.io/?domain=www.sentinelone.com&pId=6035139354339191431
Request Chain 82
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=432890%2C5427652%2C5500618&time=1729195814194&url=https%3A%2F%2Fwww.sentinelone.com%2Flabs%2Fblack-basta-ransomware-attacks-deploy-custom-edr-evasion-tools-tied-to-fin7-threat-actor%2F HTTP 302
  • https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=432890%2C5427652%2C5500618&time=1729195814194&url=https%3A%2F%2Fwww.sentinelone.com%2Flabs%2Fblack-basta-ransomware-attacks-deploy-custom-edr-evasion-tools-tied-to-fin7-threat-actor%2F&e_ipv6=AQJqh03tYUWtiwAAAZKcGi4-QbrbXp39McS-Vc00RQTmTyrZ5NTbwtfaO-jJclTyV9HZ0KUaZ_gdKYBNEUhpj7Zydaa7xw
Request Chain 85
  • https://match.prod.bidr.io/cookie-sync/demandbase HTTP 303
  • https://match.prod.bidr.io/cookie-sync/demandbase?_bee_ppp=1
Request Chain 105
  • https://13115870.fls.doubleclick.net/activityi;src=13115870;type=pagev0;cat=reque0;ord=%5BSessionID%5D;npa=1;auiddc=1238549638.1729195814;ps=1;pcor=165679221;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=noapi;frm=0;gtm=45fe4ag0v9135076156za200;gcd=13l3l3l2l1l1;dma_cps=syphamo;dma=1;tag_exp=101686685;epver=2;~oref=https%3A%2F%2Fwww.sentinelone.com%2Flabs%2Fblack-basta-ransomware-attacks-deploy-custom-edr-evasion-tools-tied-to-fin7-threat-actor%2F HTTP 302
  • https://13115870.fls.doubleclick.net/activityi;dc_pre=CLuQr7SclokDFbqHgwcd4voGcQ;src=13115870;type=pagev0;cat=reque0;ord=%5BSessionID%5D;npa=1;auiddc=1238549638.1729195814;ps=1;pcor=165679221;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=noapi;frm=0;gtm=45fe4ag0v9135076156za200;gcd=13l3l3l2l1l1;dma_cps=syphamo;dma=1;tag_exp=101686685;epver=2;~oref=https%3A%2F%2Fwww.sentinelone.com%2Flabs%2Fblack-basta-ransomware-attacks-deploy-custom-edr-evasion-tools-tied-to-fin7-threat-actor%2F
Request Chain 106
  • https://px.ads.linkedin.com/collect/?pid=432890&conversionId=2402852&fmt=gif HTTP 302
  • https://px4.ads.linkedin.com/collect/?pid=432890&conversionId=2402852&fmt=gif&e_ipv6=AQI5tqhfRMih6QAAAZKcGkBM_yzA3pRPHF4q-DwrSeMSnWAzeZspvnTtNuuUJTLs9oLLTDpZJr-JmnuEJflE6_lPZ8YH-Q
Request Chain 109
  • https://googleads.g.doubleclick.net/pagead/viewthroughconversion/970186784/?random=250992568&cv=11&fst=1729195818964&bg=ffffff&guid=ON&async=1&gtm=45be4ag0v890159661z871208095za201zb71208095&gcd=13l3l3l2l1l1&dma_cps=syphamo&dma=1&tag_exp=101686685&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.sentinelone.com%2Flabs%2Fblack-basta-ransomware-attacks-deploy-custom-edr-evasion-tools-tied-to-fin7-threat-actor%2F&label=P7U6CJqLydsBEKDAz84D&hn=www.googleadservices.com&frm=0&tiba=Black%20Basta%20Ransomware%20%7C%20Attacks%20Deploy%20Custom%20EDR%20Evasion%20Tools%20Tied%20to%20FIN7%20Threat%20Actor%20-%20SentinelOne&value=0&npa=1&pscdl=noapi&auid=1238549638.1729195814&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fdr=CA&capi=1&fmt=3&ct_cookie_present=false&crd=CLHBsQIIsMGxAgi5wbECCLHDsQIIisWxAgjCybECCMPJsQJKFXRyaWdnZXIsIGV2ZW50LXNvdXJjZVoDCgEBYgQKAgID&eitems=ChAI8OvCuAYQ7_LO19D0loACEh0AesaD7xw5nNlF_wguMPgExuKUYH9mKCcLwmaAOw&pscrd=IhMIpNyutJyWiQMVRIeDBx1qWiPZMgIIAzICCAQyAggHMgIICDICCAkyAggKMgIIAjICCAsyAggVMgIIHzICCBMyAggSOhxodHRwczovL3d3dy5zZW50aW5lbG9uZS5jb20vQlZDaEFJOE92Q3VBWVF6WW5QcS1Pcng5RkVFaXdBc3ROaXFCMVVUY1VfTU94ZGRVNFFEMXJ3cFM3ZUZlQzllMXM2NnVLVE5POWR6aW11clB4cGxWQkx4Zw HTTP 302
  • https://www.google.com/pagead/1p-conversion/970186784/?random=250992568&cv=11&fst=1729195818964&bg=ffffff&guid=ON&async=1&gtm=45be4ag0v890159661z871208095za201zb71208095&gcd=13l3l3l2l1l1&dma_cps=syphamo&dma=1&tag_exp=101686685&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.sentinelone.com%2Flabs%2Fblack-basta-ransomware-attacks-deploy-custom-edr-evasion-tools-tied-to-fin7-threat-actor%2F&label=P7U6CJqLydsBEKDAz84D&hn=www.googleadservices.com&frm=0&tiba=Black%20Basta%20Ransomware%20%7C%20Attacks%20Deploy%20Custom%20EDR%20Evasion%20Tools%20Tied%20to%20FIN7%20Threat%20Actor%20-%20SentinelOne&value=0&npa=1&pscdl=noapi&auid=1238549638.1729195814&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fdr=CA&capi=1&fmt=3&ct_cookie_present=false&crd=CLHBsQIIsMGxAgi5wbECCLHDsQIIisWxAgjCybECCMPJsQJKFXRyaWdnZXIsIGV2ZW50LXNvdXJjZVoDCgEBYgQKAgID&pscrd=IhMIpNyutJyWiQMVRIeDBx1qWiPZMgIIAzICCAQyAggHMgIICDICCAkyAggKMgIIAjICCAsyAggVMgIIHzICCBMyAggSOhxodHRwczovL3d3dy5zZW50aW5lbG9uZS5jb20vQlZDaEFJOE92Q3VBWVF6WW5QcS1Pcng5RkVFaXdBc3ROaXFCMVVUY1VfTU94ZGRVNFFEMXJ3cFM3ZUZlQzllMXM2NnVLVE5POWR6aW11clB4cGxWQkx4Zw&is_vtc=1&cid=CAQSGwDpaXnfEAIK7TuxMqplHHKcV0LFAL2rTTyVXA&eitems=ChAI8OvCuAYQ7_LO19D0loACEh0AesaD7zb2T9JBhpXSc8P3cdJRpAfyIM0fgo-z5Q&random=3874956410 HTTP 302
  • https://www.google.de/pagead/1p-conversion/970186784/?random=250992568&cv=11&fst=1729195818964&bg=ffffff&guid=ON&async=1&gtm=45be4ag0v890159661z871208095za201zb71208095&gcd=13l3l3l2l1l1&dma_cps=syphamo&dma=1&tag_exp=101686685&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.sentinelone.com%2Flabs%2Fblack-basta-ransomware-attacks-deploy-custom-edr-evasion-tools-tied-to-fin7-threat-actor%2F&label=P7U6CJqLydsBEKDAz84D&hn=www.googleadservices.com&frm=0&tiba=Black%20Basta%20Ransomware%20%7C%20Attacks%20Deploy%20Custom%20EDR%20Evasion%20Tools%20Tied%20to%20FIN7%20Threat%20Actor%20-%20SentinelOne&value=0&npa=1&pscdl=noapi&auid=1238549638.1729195814&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fdr=CA&capi=1&fmt=3&ct_cookie_present=false&crd=CLHBsQIIsMGxAgi5wbECCLHDsQIIisWxAgjCybECCMPJsQJKFXRyaWdnZXIsIGV2ZW50LXNvdXJjZVoDCgEBYgQKAgID&pscrd=IhMIpNyutJyWiQMVRIeDBx1qWiPZMgIIAzICCAQyAggHMgIICDICCAkyAggKMgIIAjICCAsyAggVMgIIHzICCBMyAggSOhxodHRwczovL3d3dy5zZW50aW5lbG9uZS5jb20vQlZDaEFJOE92Q3VBWVF6WW5QcS1Pcng5RkVFaXdBc3ROaXFCMVVUY1VfTU94ZGRVNFFEMXJ3cFM3ZUZlQzllMXM2NnVLVE5POWR6aW11clB4cGxWQkx4Zw&is_vtc=1&cid=CAQSGwDpaXnfEAIK7TuxMqplHHKcV0LFAL2rTTyVXA&eitems=ChAI8OvCuAYQ7_LO19D0loACEh0AesaD7zb2T9JBhpXSc8P3cdJRpAfyIM0fgo-z5Q&random=3874956410&ipr=y

107 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
www.sentinelone.com/labs/black-basta-ransomware-attacks-deploy-custom-edr-evasion-tools-tied-to-fin7-threat-actor/
Redirect Chain
  • https://s1.ai/bb-fin7
  • https://www.sentinelone.com/labs/black-basta-ransomware-attacks-deploy-custom-edr-evasion-tools-tied-to-fin7-threat-actor
  • https://www.sentinelone.com/labs/black-basta-ransomware-attacks-deploy-custom-edr-evasion-tools-tied-to-fin7-threat-actor/
317 KB
104 KB
Document
General
Full URL
https://www.sentinelone.com/labs/black-basta-ransomware-attacks-deploy-custom-edr-evasion-tools-tied-to-fin7-threat-actor/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.67.74.101 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e37e43924f0555458b8962330df115f258eafd68b9bed969938e0331f998c014
Security Headers
Name Value
Content-Security-Policy object-src 'none'; script-src 'unsafe-eval' https://snap.licdn.com/ https://cdn.calibermind.com/ https://a.quora.com/ https://app.cdn.lookbookhq.com/ https://connect.facebook.net/ https://ct.capterra.com/ https://ga.clearbit.com/ https://js.adsrvr.org/ https://munchkin.brightfunnel.com/ https://munchkin.marketo.net/ https://static.ads-twitter.com/ 'unsafe-inline' http://schema.org https://*.cloudfront.net/ https://*.googletagmanager.com https://a.omappapi.com/ https://analytics.twitter.com/ https://bat.bing.com/ https://cdn.abrankings.com https://cdn.abrankings.com/ https://cdn.cookielaw.org/ https://cdn.datatables.net/ https://cdn.jsdelivr.net/ https://cdn.onesignal.com/ https://cdnjs.cloudflare.com/ https://cloud.typography.com/ https://code.jquery.com/ https://collector-5527.tvsquared.com/ https://fonts.googleapis.com/ https://go.sentinelone.com/ https://googleads.g.doubleclick.net/ https://j.6sc.co/ https://js.maxmind.com/ https://js.qualified.com/ https://onesignal.com/ https://pixel-geo.prfct.co/ https://platform-api.sharethis.com/ https://platform.twitter.com/ https://pt.ispot.tv/ https://pubads.g.doubleclick.net/ https://px.spiceworks.com/ https://script.hotjar.com/ https://scripts.demandbase.com/ https://sentinelone.com https://ssl.google-analytics.com https://staging.s1preview.com/ https://static.hotjar.com/ https://tag.marinsm.com/ https://ws.qualified.com/ https://www.clickcease.com/ https://www.google-analytics.com https://www.google-analytics.com/ https://www.google.com/* https://www.googleoptimize.com/ https://www.googletagmanager.com/ https://www.googletagmanager.com/* https://www.redditstatic.com/ https://www.vantajs.com/ https://www.youtube.com/ https://yoast.com/ https://www.google.com/ https://qualified.com/ https://www.vantajs.com/ https://js.maxmind.com/ https://cdn.onesignal.com/ https://cdn.datatables.net/ https://platform-api.sharethis.com/ https://yoast.com/ https://fonts.googleapis.com/ https://cdn.datatables.net/ https://js-agent.newrelic.com/ https://www.sentinelone.com/ https://boards.greenhouse.io/ https://ajax.cloudflare.com/ https://www.googleadservices.com/ https://bam.nr-data.net/ https://cdn.linkedin.oribi.io/ https://fr.sentinelone.com/ https://it.sentinelone.com/ https://jp.sentinelone.com/ https://de.sentinelone.com/ https://it.sentinelone.com/ https://es.sentinelone.com/ https://nl.sentinelone.com/ https://kr.sentinelone.com/ https://www.google.it/ https://www.google.co.jp/ https://www.google.de/ https://ar.sentinelone.com/ https://www.google.es/ https://www.google.fr/ https://www.google.nl/ https://sonix.ai https://bam.nr-data.net/ https://docs.google.com/ https://apis.google.com/js/api.js/ https://accounts.google.com/ https://*.googleapis.com *.google.com https://*.gstatic.com https://sheets.googleapis.com/ https://tags.srv.stackadapt.com/events.js https://js.storylane.io/ https://qvdt3feo.com/ https://javascript.heeet.io/ https://api.brightfunnel.com https://a23gjzphzj.execute-api.us-east-1.amazonaws.com/ https://geolocation.onetrust.com/ https://js-agent.newrelic.com/ https://www.gstatic.com/ https://tag.demandbase.com/ https://cdnjs.com/libraries/Chart.js js.knock-ai.com https://www.clarity.ms https://js.zi-scripts.com/ https://ws.zoominfo.com/ https://tags.clickagy.com/ blob: https://ws-assets.zoominfo.com/ https://app.optimizely.com/ https://cdn.optimizely.com/ https://logx.optimizely.com/; frame-ancestors 'self' http://sentinelone.lookbookhq.com https://sentinelone.lookbookhq.com http://sentinelone.pathfactory.com https://sentinelone.pathfactory.com http://assets.sentinelone.com https://assets.sentinelone.com https://app.scalyr.com https://app.eu.scalyr.com localhost https://a23gjzphzj.execute-api.us-east-1.amazonaws.com/;
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

cache-control
max-age=60
cf-cache-status
EXPIRED
cf-ray
8d42ee46bbe71c97-FRA
content-encoding
br
content-security-policy
object-src 'none'; script-src 'unsafe-eval' https://snap.licdn.com/ https://cdn.calibermind.com/ https://a.quora.com/ https://app.cdn.lookbookhq.com/ https://connect.facebook.net/ https://ct.capterra.com/ https://ga.clearbit.com/ https://js.adsrvr.org/ https://munchkin.brightfunnel.com/ https://munchkin.marketo.net/ https://static.ads-twitter.com/ 'unsafe-inline' http://schema.org https://*.cloudfront.net/ https://*.googletagmanager.com https://a.omappapi.com/ https://analytics.twitter.com/ https://bat.bing.com/ https://cdn.abrankings.com https://cdn.abrankings.com/ https://cdn.cookielaw.org/ https://cdn.datatables.net/ https://cdn.jsdelivr.net/ https://cdn.onesignal.com/ https://cdnjs.cloudflare.com/ https://cloud.typography.com/ https://code.jquery.com/ https://collector-5527.tvsquared.com/ https://fonts.googleapis.com/ https://go.sentinelone.com/ https://googleads.g.doubleclick.net/ https://j.6sc.co/ https://js.maxmind.com/ https://js.qualified.com/ https://onesignal.com/ https://pixel-geo.prfct.co/ https://platform-api.sharethis.com/ https://platform.twitter.com/ https://pt.ispot.tv/ https://pubads.g.doubleclick.net/ https://px.spiceworks.com/ https://script.hotjar.com/ https://scripts.demandbase.com/ https://sentinelone.com https://ssl.google-analytics.com https://staging.s1preview.com/ https://static.hotjar.com/ https://tag.marinsm.com/ https://ws.qualified.com/ https://www.clickcease.com/ https://www.google-analytics.com https://www.google-analytics.com/ https://www.google.com/* https://www.googleoptimize.com/ https://www.googletagmanager.com/ https://www.googletagmanager.com/* https://www.redditstatic.com/ https://www.vantajs.com/ https://www.youtube.com/ https://yoast.com/ https://www.google.com/ https://qualified.com/ https://www.vantajs.com/ https://js.maxmind.com/ https://cdn.onesignal.com/ https://cdn.datatables.net/ https://platform-api.sharethis.com/ https://yoast.com/ https://fonts.googleapis.com/ https://cdn.datatables.net/ https://js-agent.newrelic.com/ https://www.sentinelone.com/ https://boards.greenhouse.io/ https://ajax.cloudflare.com/ https://www.googleadservices.com/ https://bam.nr-data.net/ https://cdn.linkedin.oribi.io/ https://fr.sentinelone.com/ https://it.sentinelone.com/ https://jp.sentinelone.com/ https://de.sentinelone.com/ https://it.sentinelone.com/ https://es.sentinelone.com/ https://nl.sentinelone.com/ https://kr.sentinelone.com/ https://www.google.it/ https://www.google.co.jp/ https://www.google.de/ https://ar.sentinelone.com/ https://www.google.es/ https://www.google.fr/ https://www.google.nl/ https://sonix.ai https://bam.nr-data.net/ https://docs.google.com/ https://apis.google.com/js/api.js/ https://accounts.google.com/ https://*.googleapis.com *.google.com https://*.gstatic.com https://sheets.googleapis.com/ https://tags.srv.stackadapt.com/events.js https://js.storylane.io/ https://qvdt3feo.com/ https://javascript.heeet.io/ https://api.brightfunnel.com https://a23gjzphzj.execute-api.us-east-1.amazonaws.com/ https://geolocation.onetrust.com/ https://js-agent.newrelic.com/ https://www.gstatic.com/ https://tag.demandbase.com/ https://cdnjs.com/libraries/Chart.js js.knock-ai.com https://www.clarity.ms https://js.zi-scripts.com/ https://ws.zoominfo.com/ https://tags.clickagy.com/ blob: https://ws-assets.zoominfo.com/ https://app.optimizely.com/ https://cdn.optimizely.com/ https://logx.optimizely.com/; frame-ancestors 'self' http://sentinelone.lookbookhq.com https://sentinelone.lookbookhq.com http://sentinelone.pathfactory.com https://sentinelone.pathfactory.com http://assets.sentinelone.com https://assets.sentinelone.com https://app.scalyr.com https://app.eu.scalyr.com localhost https://a23gjzphzj.execute-api.us-east-1.amazonaws.com/;
content-type
text/html; charset=UTF-8
date
Thu, 17 Oct 2024 20:10:13 GMT
last-modified
Thu, 17 Oct 2024 20:10:13 GMT
link
<https://www.sentinelone.com/wp-json/>; rel="https://api.w.org/", <https://www.sentinelone.com/wp-json/wp/v2/labs/72977>; rel="alternate"; title="JSON"; type="application/json", <https://www.sentinelone.com/?p=72977>; rel=shortlink
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
referrer-policy
origin-when-cross-origin
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=dB7uDfQCm9UMkY6aFVJhsPh1fuBgetiVAxIFmMVbgnAMXjTtXiZzfjnl7a5iO6VbWMEzQMLcXYigCMkkK6A%2BK22B51BO9TrQURsuZ7hdQsbmqCWKR0XH9Wpoo7wYMFnoEOEENKs%3D"}],"group":"cf-nel","max_age":604800}
server
cloudflare
strict-transport-security
max-age=31536000; includeSubDomains; preload
vary
Accept-Encoding, Cookie, Cookie
via
1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
x-cache
HIT, MISS, MISS, MISS
x-cache-hits
25, 0, 0, 0
x-content-type-options
nosniff
x-frame-options
SAMEORIGIN
x-pantheon-styx-hostname
styx-fe2-b-5b56695d4d-5gmlh
x-served-by
cache-chi-kigq8000103-CHI, cache-cdg-lfpb1150050-CDG, cache-cdg-lfpb1150050-CDG, cache-cdg-lfpb1150050-CDG
x-styx-req-id
b9877f7d-8bac-11ef-bbc4-a2db7fca53cd
x-timer
S1729195813.975503,VS0,VE105
x-xss-protection
1; mode=block

Redirect headers

cache-control
max-age=60
cf-cache-status
MISS
cf-ray
8d42ee40dd221c97-FRA
content-security-policy
object-src 'none'; script-src 'unsafe-eval' https://snap.licdn.com/ https://cdn.calibermind.com/ https://a.quora.com/ https://app.cdn.lookbookhq.com/ https://connect.facebook.net/ https://ct.capterra.com/ https://ga.clearbit.com/ https://js.adsrvr.org/ https://munchkin.brightfunnel.com/ https://munchkin.marketo.net/ https://static.ads-twitter.com/ 'unsafe-inline' http://schema.org https://*.cloudfront.net/ https://*.googletagmanager.com https://a.omappapi.com/ https://analytics.twitter.com/ https://bat.bing.com/ https://cdn.abrankings.com https://cdn.abrankings.com/ https://cdn.cookielaw.org/ https://cdn.datatables.net/ https://cdn.jsdelivr.net/ https://cdn.onesignal.com/ https://cdnjs.cloudflare.com/ https://cloud.typography.com/ https://code.jquery.com/ https://collector-5527.tvsquared.com/ https://fonts.googleapis.com/ https://go.sentinelone.com/ https://googleads.g.doubleclick.net/ https://j.6sc.co/ https://js.maxmind.com/ https://js.qualified.com/ https://onesignal.com/ https://pixel-geo.prfct.co/ https://platform-api.sharethis.com/ https://platform.twitter.com/ https://pt.ispot.tv/ https://pubads.g.doubleclick.net/ https://px.spiceworks.com/ https://script.hotjar.com/ https://scripts.demandbase.com/ https://sentinelone.com https://ssl.google-analytics.com https://staging.s1preview.com/ https://static.hotjar.com/ https://tag.marinsm.com/ https://ws.qualified.com/ https://www.clickcease.com/ https://www.google-analytics.com https://www.google-analytics.com/ https://www.google.com/* https://www.googleoptimize.com/ https://www.googletagmanager.com/ https://www.googletagmanager.com/* https://www.redditstatic.com/ https://www.vantajs.com/ https://www.youtube.com/ https://yoast.com/ https://www.google.com/ https://qualified.com/ https://www.vantajs.com/ https://js.maxmind.com/ https://cdn.onesignal.com/ https://cdn.datatables.net/ https://platform-api.sharethis.com/ https://yoast.com/ https://fonts.googleapis.com/ https://cdn.datatables.net/ https://js-agent.newrelic.com/ https://www.sentinelone.com/ https://boards.greenhouse.io/ https://ajax.cloudflare.com/ https://www.googleadservices.com/ https://bam.nr-data.net/ https://cdn.linkedin.oribi.io/ https://fr.sentinelone.com/ https://it.sentinelone.com/ https://jp.sentinelone.com/ https://de.sentinelone.com/ https://it.sentinelone.com/ https://es.sentinelone.com/ https://nl.sentinelone.com/ https://kr.sentinelone.com/ https://www.google.it/ https://www.google.co.jp/ https://www.google.de/ https://ar.sentinelone.com/ https://www.google.es/ https://www.google.fr/ https://www.google.nl/ https://sonix.ai https://bam.nr-data.net/ https://docs.google.com/ https://apis.google.com/js/api.js/ https://accounts.google.com/ https://*.googleapis.com *.google.com https://*.gstatic.com https://sheets.googleapis.com/ https://tags.srv.stackadapt.com/events.js https://js.storylane.io/ https://qvdt3feo.com/ https://javascript.heeet.io/ https://api.brightfunnel.com https://a23gjzphzj.execute-api.us-east-1.amazonaws.com/ https://geolocation.onetrust.com/ https://js-agent.newrelic.com/ https://www.gstatic.com/ https://tag.demandbase.com/ https://cdnjs.com/libraries/Chart.js js.knock-ai.com https://www.clarity.ms https://js.zi-scripts.com/ https://ws.zoominfo.com/ https://tags.clickagy.com/ blob: https://ws-assets.zoominfo.com/ https://app.optimizely.com/ https://cdn.optimizely.com/ https://logx.optimizely.com/; frame-ancestors 'self' http://sentinelone.lookbookhq.com https://sentinelone.lookbookhq.com http://sentinelone.pathfactory.com https://sentinelone.pathfactory.com http://assets.sentinelone.com https://assets.sentinelone.com https://app.scalyr.com https://app.eu.scalyr.com localhost https://a23gjzphzj.execute-api.us-east-1.amazonaws.com/;
content-type
text/html; charset=UTF-8
date
Thu, 17 Oct 2024 20:10:12 GMT
expires
Wed, 11 Jan 1984 05:00:00 GMT
location
https://www.sentinelone.com/labs/black-basta-ransomware-attacks-deploy-custom-edr-evasion-tools-tied-to-fin7-threat-actor/
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
referrer-policy
origin-when-cross-origin
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=iN5V42I5naQkB0EyhEdtN5NXYBTOv%2BUxQ2XmMhqGeFZ1IJyoKSwHIzOXU2izjcAhVrktH2mbof0JWqnd0PBq4U0Y7CA7j1IpzbCmznOeyRKGyFipdDLr79mwj6ISH%2Bt2yJeQndw%3D"}],"group":"cf-nel","max_age":604800}
server
cloudflare
strict-transport-security
max-age=31536000; includeSubDomains; preload
vary
Cookie, Cookie, Accept-Encoding
via
1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
x-cache
MISS, MISS, MISS, MISS
x-cache-hits
0, 0, 0, 0
x-content-type-options
nosniff
x-frame-options
ALLOW-FROM SAMEORIGIN, sentinelone.pathfactory.com, sentinelone.lookbookhq.com, assets.pathfactory.com, go.sentinelone.com, www.sentinelone.com, app.scalyr.com, app.eu.scalyr.com, localhost, https://bam.nr-data.net/, https://a23gjzphzj.execute-api.us-east-1.amazonaws.com/, epsilon-globalaccelerator.6sense.com/, cdn.abrankings.com/, https://na-ab14.marketodesigner.com/
x-pantheon-styx-hostname
styx-fe2-a-5466c7c5b8-xw494
x-redirect-by
WordPress
x-served-by
cache-chi-klot8100163-CHI, cache-mxp6959-MXP, cache-mxp6942-MXP, cache-mxp6942-MXP
x-styx-req-id
d10a462c-8cc3-11ef-8cbe-56e4174d1869
x-timer
S1729195812.466729,VS0,VE389
x-xss-protection
1; mode=block
otSDKStub.js
cdn.cookielaw.org/scripttemplates/
22 KB
8 KB
Script
General
Full URL
https://cdn.cookielaw.org/scripttemplates/otSDKStub.js
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/black-basta-ransomware-attacks-deploy-custom-edr-evasion-tools-tied-to-fin7-threat-actor/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:562a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
efad755939e511f2bc1feb0d58d6014006e8598a4d431f27a66dd59e14fc19cb
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/

Response headers

content-md5
uiXk8gw/ehyoMvZ3GeQiaQ==
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
content-encoding
gzip
x-ms-version
2009-09-19
etag
0x8DCEDAD087F157F
x-ms-lease-status
unlocked
cf-cache-status
HIT
age
4
x-content-type-options
nosniff
expires
Fri, 18 Oct 2024 20:10:13 GMT
date
Thu, 17 Oct 2024 20:10:13 GMT
content-type
application/javascript
last-modified
Wed, 16 Oct 2024 06:37:40 GMT
vary
Accept-Encoding
strict-transport-security
max-age=31536000; includeSubDomains; preload
cache-control
public, max-age=86400
cross-origin-resource-policy
cross-origin
x-ms-request-id
ca0be203-601e-00f9-010e-20596a000000
cf-ray
8d42ee48bd86dc8e-FRA
accept-ranges
bytes
access-control-allow-origin
*
content-length
7214
x-ms-blob-type
BlockBlob
server
cloudflare
97ee7348-9176-4a4b-9af2-40711264546b.js
js.knock-ai.com/
33 KB
9 KB
Script
General
Full URL
https://js.knock-ai.com/97ee7348-9176-4a4b-9af2-40711264546b.js
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/black-basta-ransomware-attacks-deploy-custom-edr-evasion-tools-tied-to-fin7-threat-actor/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.49.80.229 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
229.80.49.34.bc.googleusercontent.com
Software
UploadServer /
Resource Hash
e7db3ac042c15868e3c056ca476b6796182d2a7e752ae60aebf4ba300311777e

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/

Response headers

x-goog-metageneration
1
access-control-expose-headers
Content-Type
content-encoding
gzip
x-goog-hash
crc32c=d/mdHQ==, md5=5kJnp5LzzWIIqvCbzwi4ZA==
etag
"e64267a792f3cd6208aaf09bcf08b864"
age
0
x-goog-stored-content-encoding
gzip
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-goog-stored-content-length
8988
date
Thu, 17 Oct 2024 20:10:13 GMT
last-modified
Tue, 01 Oct 2024 09:16:01 GMT
content-type
application/javascript
vary
Accept-Encoding
x-guploader-uploadid
AHmUCY3HYB2wpy6sNSeJlSVbdo3o7iORN_KNLbMYynat1IFKVDIvcpWUQ6o2nbP3jjzPHmctL8ggJmqTFA
access-control-allow-headers
*
cache-control
public,max-age=3600
x-goog-storage-class
STANDARD
via
1.1 google
accept-ranges
bytes
access-control-allow-origin
*
x-goog-generation
1727774161474099
content-length
8988
server
UploadServer
style-labs.min.css
de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/css/
Redirect Chain
  • https://www.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/css/style-labs.min.css?ver=1729074227
  • https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/css/style-labs.min.css?ver=1729074227
270 KB
43 KB
Stylesheet
General
Full URL
https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/css/style-labs.min.css?ver=1729074227
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/black-basta-ransomware-attacks-deploy-custom-edr-evasion-tools-tied-to-fin7-threat-actor/
Protocol
H2
Server
2620:12a:8001::2 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
137d9e5a6f1b7e9290a7d0962fc1690b6d0c76532b741e8fb15174f1a19b4432
Security Headers
Name Value
Strict-Transport-Security max-age=31622400; includeSubDomains; preload

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/

Response headers

x-pantheon-styx-hostname
styx-fe2-a-7648d669f7-h7rbn
content-encoding
gzip
etag
W/"670f9433-43643"
age
117353
expires
Fri, 17 Oct 2025 11:34:19 GMT
x-cache
MISS, HIT, MISS, MISS
date
Thu, 17 Oct 2024 20:10:13 GMT
content-type
text/css
last-modified
Wed, 16 Oct 2024 10:23:47 GMT
x-served-by
cache-chi-kigq8000132-CHI, cache-fra-etou8220099-FRA, cache-fra-eddf8230032-FRA, cache-fra-eddf8230032-FRA
x-cache-hits
0, 0, 0, 0
vary
Accept-Encoding
strict-transport-security
max-age=31622400; includeSubDomains; preload
cache-control
max-age=31622400
x-timer
S1729195813.391406,VS0,VE9
x-styx-req-id
95789a86-8bb2-11ef-a0a8-6e3841428868
via
1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
accept-ranges
bytes
content-length
43803
server
nginx

Redirect headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
location
https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/css/style-labs.min.css?ver=1729074227
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=hlOBUgvTrvsd6YgU10rL2zzVxxtDxV2YydVGJVRPrB40%2BKQ%2BH768%2FRYSgP3YVypZ0Qndzr7ZJlCjkk1IERsU5Gs0Gzg4G5Q122tR%2FuNqnGbnjSOnrdJoz%2ByhnCJs%2FHUy8FN%2BS4s%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options
nosniff
cf-ray
8d42ee484db61c97-FRA
content-length
0
date
Thu, 17 Oct 2024 20:10:13 GMT
vary
Accept-Encoding
server
cloudflare
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/3.7.0/
85 KB
30 KB
Script
General
Full URL
https://ajax.googleapis.com/ajax/libs/jquery/3.7.0/jquery.min.js
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/black-basta-ransomware-attacks-deploy-custom-edr-evasion-tools-tied-to-fin7-threat-actor/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:828::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
d8f9afbf492e4c139e9d2bcb9ba6ef7c14921eb509fb703bc7a3f911b774eff8
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/

Response headers

content-encoding
gzip
age
246375
report-to
{"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
x-content-type-options
nosniff
expires
Tue, 14 Oct 2025 23:43:58 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Mon, 14 Oct 2024 23:43:58 GMT
last-modified
Wed, 17 May 2023 18:15:00 GMT
content-type
text/javascript; charset=UTF-8
vary
Accept-Encoding
cache-control
public, max-age=31536000, stale-while-revalidate=2592000
timing-allow-origin
*
cross-origin-opener-policy
same-origin; report-to="hosted-libraries-pushers"
cross-origin-resource-policy
cross-origin
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
accept-ranges
bytes
access-control-allow-origin
*
content-length
30433
x-xss-protection
0
server
sffe
forms2.min.js
go.sentinelone.com/js/forms2/js/
199 KB
67 KB
Script
General
Full URL
https://go.sentinelone.com/js/forms2/js/forms2.min.js
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/black-basta-ransomware-attacks-deploy-custom-edr-evasion-tools-tied-to-fin7-threat-actor/
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
104.17.74.206 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
0602c4fb1597b7e6e111fe79777e195cacbc73774fcaf233a7835b33372dceae
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/

Response headers

cache-control
public, max-age=14400
content-encoding
gzip
cf-cache-status
HIT
etag
"5c01fe-31b91-62370c030d900"
age
1328
x-content-type-options
nosniff
cf-ray
8d42ee494bfd8f3c-FRA
expires
Fri, 18 Oct 2024 00:10:13 GMT
date
Thu, 17 Oct 2024 20:10:13 GMT
content-type
application/x-javascript
last-modified
Tue, 01 Oct 2024 21:10:28 GMT
vary
Accept-Encoding
server
cloudflare
js
www.googletagmanager.com/gtag/
327 KB
107 KB
Script
General
Full URL
https://www.googletagmanager.com/gtag/js?id=G-KJPGLC9EVP
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/black-basta-ransomware-attacks-deploy-custom-edr-evasion-tools-tied-to-fin7-threat-actor/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81c::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
ebdc7e18fd394f6ad9ab51f71d49a95c2f1aaa12c35167862ca6ab05dc39565e
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/

Response headers

content-encoding
br
report-to
{"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],}
expires
Thu, 17 Oct 2024 20:10:13 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Thu, 17 Oct 2024 20:10:13 GMT
content-type
application/javascript; charset=UTF-8
vary
Accept-Encoding
access-control-allow-headers
Cache-Control
strict-transport-security
max-age=31536000; includeSubDomains
cache-control
private, max-age=900
cross-origin-resource-policy
cross-origin
access-control-allow-credentials
true
content-security-policy-report-only
script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
access-control-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to=coop_reporting
content-length
109361
x-xss-protection
0
server
Google Tag Manager
BlackBasta_FIN7_4.jpg
de.sentinelone.com/wp-content/uploads/2022/11/
Redirect Chain
  • https://www.sentinelone.com/wp-content/uploads/2022/11/BlackBasta_FIN7_4.jpg
  • https://de.sentinelone.com/wp-content/uploads/2022/11/BlackBasta_FIN7_4.jpg
50 KB
50 KB
Image
General
Full URL
https://de.sentinelone.com/wp-content/uploads/2022/11/BlackBasta_FIN7_4.jpg
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/black-basta-ransomware-attacks-deploy-custom-edr-evasion-tools-tied-to-fin7-threat-actor/
Protocol
H2
Server
2620:12a:8001::2 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
a8242b675ce39cfb1121740543c6e812490465c7c63858f7c77bcf217fcd4433
Security Headers
Name Value
Strict-Transport-Security max-age=31622400; includeSubDomains; preload

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/

Response headers

x-pantheon-styx-hostname
styx-fe2-a-7648d669f7-wtd9f
fastly-io-info
ifsz=106806 idim=767x462 ifmt=jpeg ofsz=50912 odim=767x462 ofmt=webp
etag
"U8f1Rt6myf9cb6LSROkWvPUXpNc98veuRGWmZ1X55xI"
age
577654
expires
Sun, 12 Oct 2025 03:42:39 GMT
x-cache
MISS, MISS, HIT, MISS
date
Thu, 17 Oct 2024 20:10:13 GMT
content-type
image/webp
x-served-by
cache-ams2100142-AMS, cache-ams21081-AMS, cache-fra-eddf8230032-FRA, cache-fra-eddf8230032-FRA
x-cache-hits
0, 0, 0, 0
vary
Accept
fastly-stats
io=1
strict-transport-security
max-age=31622400; includeSubDomains; preload
cache-control
max-age=31622400
x-timer
S1729195813.329612,VS0,VE6
x-styx-req-id
dcccc652-8782-11ef-b22d-62fe6b707d93
via
1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
accept-ranges
bytes
content-length
50912
fastly-io-served-by
vpop-etou8240193
server
nginx

Redirect headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
location
https://de.sentinelone.com/wp-content/uploads/2022/11/BlackBasta_FIN7_4.jpg
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=VGoAdTp0CsgwA4vfl2Qy3u4XkZBgU69MedLXuf3%2Fu%2FbAfhX42C7r%2BWha9KRj3C8k6lcIUUFBDm5pfVeM9ZTUXQ0wO%2FoDkiL2TXHUiI04ukPG0jPDIps6mxdoPErsAKqCQCNVrGY%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options
nosniff
cf-ray
8d42ee484db71c97-FRA
content-length
0
date
Thu, 17 Oct 2024 20:10:13 GMT
vary
Accept-Encoding
server
cloudflare
BlackBasta_FIN7_6.jpg
de.sentinelone.com/wp-content/uploads/2022/11/
Redirect Chain
  • https://www.sentinelone.com/wp-content/uploads/2022/11/BlackBasta_FIN7_6.jpg
  • https://de.sentinelone.com/wp-content/uploads/2022/11/BlackBasta_FIN7_6.jpg
49 KB
50 KB
Image
General
Full URL
https://de.sentinelone.com/wp-content/uploads/2022/11/BlackBasta_FIN7_6.jpg
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/black-basta-ransomware-attacks-deploy-custom-edr-evasion-tools-tied-to-fin7-threat-actor/
Protocol
H2
Server
2620:12a:8001::2 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
a7612cda562abb7a2e8ba8ff60d66230e02077e218980f4293422ce4c8e0369c
Security Headers
Name Value
Strict-Transport-Security max-age=31622400; includeSubDomains; preload

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/

Response headers

x-pantheon-styx-hostname
styx-fe2-b-5b56695d4d-7pjj6
fastly-io-info
ifsz=102954 idim=745x499 ifmt=jpeg ofsz=50682 odim=745x499 ofmt=webp
etag
"w44JQDHml0HXk7MFGSiPyMStDFV4lUM9YvhIYAbRWo8"
age
577654
expires
Sun, 12 Oct 2025 03:42:39 GMT
x-cache
MISS, MISS, HIT, MISS
date
Thu, 17 Oct 2024 20:10:13 GMT
content-type
image/webp
x-served-by
cache-ams21058-AMS, cache-ams21079-AMS, cache-fra-eddf8230032-FRA, cache-fra-eddf8230032-FRA
x-cache-hits
0, 0, 0, 0
vary
Accept
fastly-stats
io=1
strict-transport-security
max-age=31622400; includeSubDomains; preload
cache-control
max-age=31622400
x-timer
S1729195813.329586,VS0,VE5
x-styx-req-id
dcccd8a8-8782-11ef-8834-269e25c5c827
via
1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
accept-ranges
bytes
content-length
50682
fastly-io-served-by
vpop-etou8240198
server
nginx

Redirect headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
location
https://de.sentinelone.com/wp-content/uploads/2022/11/BlackBasta_FIN7_6.jpg
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Va1dOPwZsnrzt3XHm5ZslHbs9XCVWHds%2FAEU8AHMGTEAadSFrAVn2Iq17igHcYuk%2FZ7msP4qULsRWe%2F5CIrI7zFJz%2FZsVypdpe2N21VcJ0NZgxeir8ZaNncJxMrwOCJrTFVxqy0%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options
nosniff
cf-ray
8d42ee484db91c97-FRA
content-length
0
date
Thu, 17 Oct 2024 20:10:13 GMT
vary
Accept-Encoding
server
cloudflare
BlackBasta_FIN7_1.jpg
de.sentinelone.com/wp-content/uploads/2022/11/
Redirect Chain
  • https://www.sentinelone.com/wp-content/uploads/2022/11/BlackBasta_FIN7_1.jpg
  • https://de.sentinelone.com/wp-content/uploads/2022/11/BlackBasta_FIN7_1.jpg
12 KB
13 KB
Image
General
Full URL
https://de.sentinelone.com/wp-content/uploads/2022/11/BlackBasta_FIN7_1.jpg
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/black-basta-ransomware-attacks-deploy-custom-edr-evasion-tools-tied-to-fin7-threat-actor/
Protocol
H2
Server
2620:12a:8001::2 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
f97c33a0d47b04256842d5e0fe975b4d6a6dd91ad35de032f9df63d0dbef1816
Security Headers
Name Value
Strict-Transport-Security max-age=31622400; includeSubDomains; preload

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/

Response headers

x-pantheon-styx-hostname
styx-fe2-a-7648d669f7-b7fb8
fastly-io-info
ifsz=26171 idim=744x79 ifmt=jpeg ofsz=12782 odim=744x79 ofmt=webp
etag
"oweOqeutlVHfRi5ebUnctAJJlqkjC6/vuGozw2bad9A"
age
577654
expires
Sun, 12 Oct 2025 03:42:39 GMT
x-cache
MISS, MISS, HIT, MISS
date
Thu, 17 Oct 2024 20:10:13 GMT
content-type
image/webp
x-served-by
cache-ams2100111-AMS, cache-ams21069-AMS, cache-fra-eddf8230032-FRA, cache-fra-eddf8230032-FRA
x-cache-hits
0, 0, 0, 0
vary
Accept
fastly-stats
io=1
strict-transport-security
max-age=31622400; includeSubDomains; preload
cache-control
max-age=31622400
x-timer
S1729195813.329733,VS0,VE7
x-styx-req-id
dcfc5c4c-8782-11ef-b55b-1a66bd80a50f
via
1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
accept-ranges
bytes
content-length
12782
fastly-io-served-by
vpop-etou8240193
server
nginx

Redirect headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
location
https://de.sentinelone.com/wp-content/uploads/2022/11/BlackBasta_FIN7_1.jpg
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=TZOUiJx%2F%2FvfDPsJXOUfunXeSM5uRRJ%2FQ0aEhi7ATU60Txmse1onsuaUn%2B%2BTmR%2BfmqfQWqoxbacp%2BK4EPQBgR3ugqqj1718AwRktT24s0jScvx%2B3UGs6Dqet9j0QoathNVQVebRY%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options
nosniff
cf-ray
8d42ee484dbc1c97-FRA
content-length
0
date
Thu, 17 Oct 2024 20:10:13 GMT
vary
Accept-Encoding
server
cloudflare
email-decode.min.js
www.sentinelone.com/cdn-cgi/scripts/5c5dd728/cloudflare-static/
1 KB
1 KB
Script
General
Full URL
https://www.sentinelone.com/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/black-basta-ransomware-attacks-deploy-custom-edr-evasion-tools-tied-to-fin7-threat-actor/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.67.74.101 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/labs/black-basta-ransomware-attacks-deploy-custom-edr-evasion-tools-tied-to-fin7-threat-actor/

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cache-control
max-age=172800, public
content-encoding
gzip
etag
W/"670ce4f9-4d7"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=TYyWuuc5bj0XqL%2BkKJI0AF59zX0OtNTWb5X3sMfpYKdFqcjXVAd4BCU8SoPtLJq8YNJTwk8h1sBTdBZyZmPIPkHubNya4AaNNyGLtSeOUo%2FJjun9emlwFApS3NFSruxaCbBIIJA%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options
nosniff
cf-ray
8d42ee49dfe31c97-FRA
expires
Sat, 19 Oct 2024 20:10:13 GMT
date
Thu, 17 Oct 2024 20:10:13 GMT
content-type
application/javascript
last-modified
Mon, 14 Oct 2024 09:31:37 GMT
vary
Accept-Encoding
server
cloudflare
x-frame-options
DENY
clipboard.min.js
de.sentinelone.com/wp-includes/js/
Redirect Chain
  • https://www.sentinelone.com/wp-includes/js/clipboard.min.js?ver=2.0.11
  • https://de.sentinelone.com/wp-includes/js/clipboard.min.js?ver=2.0.11
9 KB
4 KB
Script
General
Full URL
https://de.sentinelone.com/wp-includes/js/clipboard.min.js?ver=2.0.11
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/black-basta-ransomware-attacks-deploy-custom-edr-evasion-tools-tied-to-fin7-threat-actor/
Protocol
H2
Server
2620:12a:8001::2 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
700c8bd73d93522ca53cdc35e2a71e96caf7c344bc7a8391f3af90c10b917033
Security Headers
Name Value
Strict-Transport-Security max-age=31622400; includeSubDomains; preload

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/

Response headers

x-pantheon-styx-hostname
styx-fe2-a-7648d669f7-7vnzc
content-encoding
gzip
etag
W/"670e8dde-2331"
age
129444
expires
Fri, 17 Oct 2025 08:12:49 GMT
x-cache
MISS, HIT, MISS, MISS
date
Thu, 17 Oct 2024 20:10:13 GMT
content-type
application/x-javascript
last-modified
Tue, 15 Oct 2024 15:44:30 GMT
x-served-by
cache-chi-klot8100072-CHI, cache-fra-eddf8230046-FRA, cache-fra-eddf8230032-FRA, cache-fra-eddf8230032-FRA
x-cache-hits
0, 1698, 0, 0
vary
Accept-Encoding
strict-transport-security
max-age=31622400; includeSubDomains; preload
cache-control
max-age=31622400
x-timer
S1729195814.537495,VS0,VE22
x-styx-req-id
6ed8f57c-8b96-11ef-a34f-4eb1aae2bc7d
via
1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
accept-ranges
bytes
content-length
3466
server
nginx

Redirect headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
location
https://de.sentinelone.com/wp-includes/js/clipboard.min.js?ver=2.0.11
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=8fAqvd5nZuoP%2BBKtrozO1mb5Sqe9l0NK85fiD5C5gyr0vUr4%2FbNwsnziw%2FJgdEYsYESi6HvavDQVIZzT9x%2Feekqcf9NYpnBoNbrgKE12aJiaPRNvXzCriP14SjEP1N30G7%2FH5TI%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options
nosniff
cf-ray
8d42ee49e8011c97-FRA
content-length
0
date
Thu, 17 Oct 2024 20:10:13 GMT
vary
Accept-Encoding
server
cloudflare
global.min.js
de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/js/
Redirect Chain
  • https://www.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/js/global.min.js?ver=1729074227
  • https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/js/global.min.js?ver=1729074227
29 KB
11 KB
Script
General
Full URL
https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/js/global.min.js?ver=1729074227
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/black-basta-ransomware-attacks-deploy-custom-edr-evasion-tools-tied-to-fin7-threat-actor/
Protocol
H2
Server
2620:12a:8001::2 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
5e43a9e7c42b23467f4766b5dc3a85f8ac62c75c2d5c064dd0c0d6205b287961
Security Headers
Name Value
Strict-Transport-Security max-age=31622400; includeSubDomains; preload

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/

Response headers

x-pantheon-styx-hostname
styx-fe2-a-7648d669f7-5b2t9
content-encoding
gzip
etag
W/"670f9434-739c"
age
121224
expires
Fri, 17 Oct 2025 10:29:48 GMT
x-cache
HIT, HIT, MISS, MISS
date
Thu, 17 Oct 2024 20:10:13 GMT
content-type
application/x-javascript
last-modified
Wed, 16 Oct 2024 10:23:48 GMT
x-served-by
cache-chi-kigq8000103-CHI, cache-fra-eddf8230115-FRA, cache-fra-eddf8230032-FRA, cache-fra-eddf8230032-FRA
x-cache-hits
0, 751, 0, 0
vary
Accept-Encoding
strict-transport-security
max-age=31622400; includeSubDomains; preload
cache-control
max-age=31622400
x-timer
S1729195814.590162,VS0,VE11
x-styx-req-id
9205a6c9-8ba9-11ef-993f-2e4cf1e1667d
via
1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
accept-ranges
bytes
content-length
10668
server
nginx

Redirect headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
location
https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/js/global.min.js?ver=1729074227
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=FY1lT%2BQxsSeYJJBC5o%2Fd0M1ArkUohqCjXkzSshPx0C4hNxhglP6jILf8Yl6x0D1bGqT7KjrnIKjgXlWWkWWm%2FI4%2B83UoX7CUjHhX8mDXwhFkXzmrc9nipOc%2B92EgG9MW0WBXMM0%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options
nosniff
cf-ray
8d42ee4a58e21c97-FRA
content-length
0
date
Thu, 17 Oct 2024 20:10:13 GMT
vary
Accept-Encoding
server
cloudflare
OneSignalSDK.js
cdn.onesignal.com/sdks/
9 KB
3 KB
Script
General
Full URL
https://cdn.onesignal.com/sdks/OneSignalSDK.js?ver=1.0.0
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/black-basta-ransomware-attacks-deploy-custom-edr-evasion-tools-tied-to-fin7-threat-actor/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700::6810:a091 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
ec8b1b07980996f574075e1b7e895d5d47794b9dcf345a68d60fbb17034f7bef
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/

Response headers

strict-transport-security
max-age=15552000; includeSubDomains
cache-control
public, max-age=259200
content-encoding
br
cf-cache-status
HIT
etag
W/"09282956186c8515ef0d208902803581"
age
200
via
1.1 google
cf-ray
8d42ee4a9e2e9079-FRA
expires
Sun, 20 Oct 2024 20:10:13 GMT
alt-svc
h3=":443"; ma=86400
date
Thu, 17 Oct 2024 20:10:13 GMT
content-type
application/javascript
vary
Accept-Encoding
server
cloudflare
access-control-allow-headers
OneSignal-Subscription-Id
ABCWhytePlusVariable.woff2
de.sentinelone.com/wp-content/themes/sentinelone/assets/fonts/whyte/
Redirect Chain
  • https://www.sentinelone.com/wp-content/themes/sentinelone/assets/fonts/whyte/ABCWhytePlusVariable.woff2
  • https://de.sentinelone.com/wp-content/themes/sentinelone/assets/fonts/whyte/ABCWhytePlusVariable.woff2
242 KB
242 KB
Font
General
Full URL
https://de.sentinelone.com/wp-content/themes/sentinelone/assets/fonts/whyte/ABCWhytePlusVariable.woff2
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/black-basta-ransomware-attacks-deploy-custom-edr-evasion-tools-tied-to-fin7-threat-actor/
Protocol
H2
Server
2620:12a:8001::2 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
67418e79f1c8689e34cd9c68f1d5300f627d85e59c22d70abf8cde80b02067b9
Security Headers
Name Value
Strict-Transport-Security max-age=31622400; includeSubDomains; preload

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/

Response headers

x-pantheon-styx-hostname
styx-fe2-b-5b56695d4d-7pjj6
etag
"670e8dd8-3c6a4"
age
129444
expires
Fri, 17 Oct 2025 08:10:34 GMT
x-cache
HIT, HIT, MISS, MISS
date
Thu, 17 Oct 2024 20:10:13 GMT
content-type
font/woff2
last-modified
Tue, 15 Oct 2024 15:44:24 GMT
x-served-by
cache-chi-kigq8000040-CHI, cache-fra-eddf8230126-FRA, cache-fra-eddf8230023-FRA, cache-fra-eddf8230023-FRA
x-cache-hits
1, 3157, 0, 0
strict-transport-security
max-age=31622400; includeSubDomains; preload
cache-control
max-age=31622400
x-timer
S1729195813.330198,VS0,VE9
x-styx-req-id
1e6db4a8-8b96-11ef-988e-269e25c5c827
via
1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
accept-ranges
bytes
access-control-allow-origin
*
content-length
247460
server
nginx

Redirect headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
location
https://de.sentinelone.com/wp-content/themes/sentinelone/assets/fonts/whyte/ABCWhytePlusVariable.woff2
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=bBJIIs5p5Zs3AtPKQN17S0y4A3RG6sIjmyeuLRfEKXKvLvUq8U21T%2BaLaYszWN0eSF42K9PkajVubC0yxPxtDDY7lMk%2BlDY4VqPBPQgrOV62beSZVhBX5vL98sjz64L%2FA8qZSV8%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options
nosniff
cf-ray
8d42ee485dd11c97-FRA
content-length
0
date
Thu, 17 Oct 2024 20:10:13 GMT
vary
Accept-Encoding
server
cloudflare
02ad5672-6494-4b20-a5ae-7d131a0f4f9c.json
cdn.cookielaw.org/consent/02ad5672-6494-4b20-a5ae-7d131a0f4f9c/
5 KB
2 KB
XHR
General
Full URL
https://cdn.cookielaw.org/consent/02ad5672-6494-4b20-a5ae-7d131a0f4f9c/02ad5672-6494-4b20-a5ae-7d131a0f4f9c.json
Requested by
Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:562a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
400b1bd0090434d34677fe377b9f8936edf5c5a8a38088949d4f6a12d723d930
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/

Response headers

content-md5
F3zUIq857iGpcyK5PrUpqQ==
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
content-encoding
gzip
cf-cache-status
HIT
etag
0x8DCDF012D7A954A
age
18522
x-ms-lease-status
unlocked
x-content-type-options
nosniff
x-ms-version
2009-09-19
expires
Fri, 18 Oct 2024 20:10:13 GMT
date
Thu, 17 Oct 2024 20:10:13 GMT
content-type
application/json
last-modified
Fri, 27 Sep 2024 14:32:13 GMT
vary
Accept-Encoding
strict-transport-security
max-age=31536000; includeSubDomains; preload
cache-control
public, max-age=86400
cross-origin-resource-policy
cross-origin, cross-origin
x-ms-request-id
8ba91f3b-601e-00f9-09ea-10596a000000
cf-ray
8d42ee496d07db03-FRA
accept-ranges
bytes
access-control-allow-origin
*
content-length
1781
x-ms-blob-type
BlockBlob
server
cloudflare
location
geolocation.onetrust.com/cookieconsentpub/v1/geo/
59 B
295 B
XHR
General
Full URL
https://geolocation.onetrust.com/cookieconsentpub/v1/geo/location
Requested by
Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:4400::6812:2089 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
2157361193375a79ade3559e960f982daa8d599cf7f4a92d36e3eef257738f16
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
accept
application/json
Referer
https://www.sentinelone.com/

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
content-encoding
gzip
access-control-allow-methods
GET, OPTIONS
cf-ray
8d42ee4a5af5d2ce-FRA
access-control-allow-origin
*
date
Thu, 17 Oct 2024 20:10:13 GMT
content-type
application/json
vary
Accept-Encoding
server
cloudflare
access-control-allow-headers
Content-Type
97ee7348-9176-4a4b-9af2-40711264546b.json
js.knock-ai.com/
326 B
229 B
Fetch
General
Full URL
https://js.knock-ai.com/97ee7348-9176-4a4b-9af2-40711264546b.json
Requested by
Host: js.knock-ai.com
URL: https://js.knock-ai.com/97ee7348-9176-4a4b-9af2-40711264546b.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
34.49.80.229 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
229.80.49.34.bc.googleusercontent.com
Software
UploadServer /
Resource Hash
1c570dd4adca2dfe60c33196ca65c06ecab4a580b494816003e123c7d813d701

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Content-Type
application/json
Referer
https://www.sentinelone.com/

Response headers

x-goog-metageneration
1
access-control-expose-headers
Content-Length, Content-Type, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace
content-encoding
gzip
x-goog-hash
crc32c=uhxSig==, md5=XQTCayw0uJPhFpszoEnnIg==
etag
"5d04c26b2c34b893e1169b33a049e722"
age
0
x-goog-stored-content-encoding
gzip
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-goog-stored-content-length
196
date
Thu, 17 Oct 2024 20:10:13 GMT
last-modified
Tue, 01 Oct 2024 09:16:16 GMT
content-type
application/json
vary
Accept-Encoding
x-guploader-uploadid
AHmUCY3CWR3Uj7HhNgJDA-38G8vlMR6LYDzNk_S87-V2IyijG14O29wqlXyuwmrl5_2P113N7WYiE-1B_w
access-control-allow-headers
*
cache-control
public,max-age=3600
x-goog-storage-class
STANDARD
via
1.1 google
accept-ranges
bytes
access-control-allow-origin
*
x-goog-generation
1727774176677479
content-length
196
server
UploadServer
97ee7348-9176-4a4b-9af2-40711264546b.json
js.knock-ai.com/ Frame
0
0
Preflight
General
Full URL
https://js.knock-ai.com/97ee7348-9176-4a4b-9af2-40711264546b.json
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
34.49.80.229 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
229.80.49.34.bc.googleusercontent.com
Software
UploadServer /
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Headers
content-type
Access-Control-Request-Method
GET
Origin
https://www.sentinelone.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

access-control-allow-headers
*
access-control-allow-methods
DELETE,GET,HEAD,POST,PUT
access-control-allow-origin
*
access-control-max-age
3600
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
private, max-age=0
content-length
0
date
Thu, 17 Oct 2024 20:10:13 GMT
expires
Thu, 17 Oct 2024 20:10:13 GMT
server
UploadServer
via
1.1 google
x-guploader-uploadid
AHmUCY1QQZbElSfphhwhgeozMX5KY2gDf9UMciwocqoEguf3uK0cDcnzN6uny7qCWQ1dwb04YZc
gtm.js
www.googletagmanager.com/
378 KB
119 KB
Script
General
Full URL
https://www.googletagmanager.com/gtm.js?id=GTM-KGGXSJ
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/black-basta-ransomware-attacks-deploy-custom-edr-evasion-tools-tied-to-fin7-threat-actor/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81c::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
020d6d7eb17714f84a3c9f9b64ac17e1ef7a2eedcb9bf6e2158805c57c5d8fce
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/

Response headers

content-encoding
br
report-to
{"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:1080:0"}],}
expires
Thu, 17 Oct 2024 20:10:13 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Thu, 17 Oct 2024 20:10:13 GMT
content-type
application/javascript; charset=UTF-8
vary
Accept-Encoding
last-modified
Thu, 17 Oct 2024 18:00:00 GMT
access-control-allow-headers
Cache-Control
strict-transport-security
max-age=31536000; includeSubDomains
cache-control
private, max-age=900
cross-origin-resource-policy
cross-origin
access-control-allow-credentials
true
content-security-policy-report-only
script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:1080:0
access-control-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to=coop_reporting
content-length
121310
x-xss-protection
0
server
Google Tag Manager
labs-bg-light.png
de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/img/
34 KB
35 KB
Image
General
Full URL
https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/img/labs-bg-light.png
Requested by
Host: de.sentinelone.com
URL: https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/css/style-labs.min.css?ver=1729074227
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2620:12a:8001::2 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
34e435ba7c6172be5ab366a13b6df04fec9078cf076dadd56aac48b54463efff
Security Headers
Name Value
Strict-Transport-Security max-age=31622400; includeSubDomains; preload

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/css/style-labs.min.css?ver=1729074227

Response headers

x-pantheon-styx-hostname
styx-fe2-b-6578554b6-l9jcl
fastly-io-info
ifsz=77240 idim=700x951 ifmt=png ofsz=35196 odim=700x951 ofmt=webp
etag
"7BFksq8xo9eP/64Th905/zC34utiEyPMz7xERifVFYY"
age
2461203
expires
Fri, 05 Sep 2025 04:45:08 GMT
x-cache
MISS, MISS, HIT, MISS
date
Thu, 17 Oct 2024 20:10:13 GMT
content-type
image/webp
x-served-by
cache-ams2100114-AMS, cache-ams2100119-AMS, cache-fra-eddf8230032-FRA, cache-fra-eddf8230032-FRA
x-cache-hits
0, 0, 0, 0
vary
Accept
fastly-stats
io=1
strict-transport-security
max-age=31622400; includeSubDomains; preload
cache-control
max-age=31622400
x-timer
S1729195813.491904,VS0,VE6
x-styx-req-id
762de266-6a78-11ef-b941-b61f05a71aac
via
1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
accept-ranges
bytes
content-length
35196
fastly-io-served-by
vpop-etou8240198
server
nginx
truncated
/
115 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
758b336b8291c58c944b1d40afd4469609c946ac427f33baac4ea0d5c2ed6fdd

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/

Response headers

Content-Type
image/svg+xml
truncated
/
115 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
c3a2f8ef206c54e505719cbdfe2f7c5732d80d4e01ab277b2f869acb3d062497

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/

Response headers

Content-Type
image/svg+xml
truncated
/
117 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
7bfd314ec46e5dc42fbf2037344e20bb95068e0f972aaf26707a4afaaaea6da0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/

Response headers

Content-Type
image/svg+xml
truncated
/
118 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
575eff3e047a9c0474b49fcda2be6d87ae4b9f54a06f021a1be27951e8e6d33c

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/

Response headers

Content-Type
image/svg+xml
truncated
/
117 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
03a716d58d312f56961da36cf9e9bd2694ba3d0fa9b18c5ebe271d7021b82953

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/

Response headers

Content-Type
image/svg+xml
getForm
go.sentinelone.com/index.php/form/
6 KB
2 KB
Script
General
Full URL
https://go.sentinelone.com/index.php/form/getForm?munchkinId=327-MNM-087&form=1985&url=https%3A%2F%2Fwww.sentinelone.com%2Flabs%2Fblack-basta-ransomware-attacks-deploy-custom-edr-evasion-tools-tied-to-fin7-threat-actor%2F&callback=jQuery3710319434459520749_1729195813456&_=1729195813457
Requested by
Host: go.sentinelone.com
URL: https://go.sentinelone.com/js/forms2/js/forms2.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
104.17.74.206 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
015717b702e6dfd080cc346b8b2b5d5b4db7bfe1d9488b75d2dc8d9689721ae1

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/

Response headers

cf-ray
8d42ee4a7db48f3c-FRA
cached
true
content-encoding
gzip
date
Thu, 17 Oct 2024 20:10:13 GMT
content-type
application/javascript; charset=utf-8
vary
Accept-Encoding
server
cloudflare
user-icon.svg
de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/
1 KB
1 KB
Image
General
Full URL
https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/user-icon.svg
Requested by
Host: de.sentinelone.com
URL: https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/css/style-labs.min.css?ver=1729074227
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2620:12a:8001::2 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
ca8e60ba9a281ae41f019d64c681ba7b523d7b9c839db4d41eb042dcbaad8b7a
Security Headers
Name Value
Strict-Transport-Security max-age=31622400; includeSubDomains; preload

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/css/style-labs.min.css?ver=1729074227

Response headers

x-pantheon-styx-hostname
styx-fe2-a-7648d669f7-t47j9
content-encoding
gzip
etag
W/"670e8ddc-556"
age
128434
expires
Fri, 17 Oct 2025 08:29:39 GMT
x-cache
MISS, HIT, MISS, MISS
date
Thu, 17 Oct 2024 20:10:13 GMT
content-type
image/svg+xml
last-modified
Tue, 15 Oct 2024 15:44:28 GMT
x-served-by
cache-chi-kigq8000130-CHI, cache-fra-eddf8230038-FRA, cache-fra-eddf8230032-FRA, cache-fra-eddf8230032-FRA
x-cache-hits
0, 0, 0, 0
vary
Accept-Encoding
strict-transport-security
max-age=31622400; includeSubDomains; preload
cache-control
max-age=31622400
x-timer
S1729195814.503361,VS0,VE11
x-styx-req-id
c8d15399-8b98-11ef-96ee-32831ca7b548
via
1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
accept-ranges
bytes
access-control-allow-origin
*
content-length
775
server
nginx
calendar-icon.svg
de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/
2 KB
1 KB
Image
General
Full URL
https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/calendar-icon.svg
Requested by
Host: de.sentinelone.com
URL: https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/css/style-labs.min.css?ver=1729074227
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2620:12a:8001::2 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
0cfc74f37470c666d6ac10d4d7a933b923c13b29879134c0866c7de7dcee0310
Security Headers
Name Value
Strict-Transport-Security max-age=31622400; includeSubDomains; preload

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/css/style-labs.min.css?ver=1729074227

Response headers

x-pantheon-styx-hostname
styx-fe2-a-7648d669f7-t47j9
content-encoding
gzip
etag
W/"670e8dda-7ae"
age
128434
expires
Fri, 17 Oct 2025 08:29:39 GMT
x-cache
MISS, HIT, MISS, MISS
date
Thu, 17 Oct 2024 20:10:13 GMT
content-type
image/svg+xml
last-modified
Tue, 15 Oct 2024 15:44:26 GMT
x-served-by
cache-chi-klot8100128-CHI, cache-fra-etou8220115-FRA, cache-fra-eddf8230032-FRA, cache-fra-eddf8230032-FRA
x-cache-hits
0, 0, 0, 0
vary
Accept-Encoding
strict-transport-security
max-age=31622400; includeSubDomains; preload
cache-control
max-age=31622400
x-timer
S1729195814.503339,VS0,VE9
x-styx-req-id
c8f02fe7-8b98-11ef-96ee-32831ca7b548
via
1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
accept-ranges
bytes
access-control-allow-origin
*
content-length
847
server
nginx
arrow-left-dark.svg
de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/
835 B
822 B
Image
General
Full URL
https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/arrow-left-dark.svg
Requested by
Host: de.sentinelone.com
URL: https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/css/style-labs.min.css?ver=1729074227
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2620:12a:8001::2 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
adc0e2dacc10d6d2acec5ffc5b5346f30a3424ea0bfccff7b902b6a594878a18
Security Headers
Name Value
Strict-Transport-Security max-age=31622400; includeSubDomains; preload

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/css/style-labs.min.css?ver=1729074227

Response headers

x-pantheon-styx-hostname
styx-fe2-b-5b56695d4d-4dnpw
content-encoding
gzip
etag
W/"670e8de0-343"
age
119835
expires
Fri, 17 Oct 2025 08:29:39 GMT
x-cache
MISS, HIT, MISS, MISS
date
Thu, 17 Oct 2024 20:10:13 GMT
content-type
image/svg+xml
last-modified
Tue, 15 Oct 2024 15:44:32 GMT
x-served-by
cache-chi-klot8100114-CHI, cache-fra-eddf8230054-FRA, cache-fra-eddf8230032-FRA, cache-fra-eddf8230032-FRA
x-cache-hits
0, 0, 0, 0
vary
Accept-Encoding
strict-transport-security
max-age=31622400; includeSubDomains; preload
cache-control
max-age=31622400
x-timer
S1729195814.504783,VS0,VE9
x-styx-req-id
c8f0d391-8b98-11ef-accb-ea4eb053fb02
via
1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
accept-ranges
bytes
access-control-allow-origin
*
content-length
489
server
nginx
arrow-right-dark.svg
de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/
920 B
746 B
Image
General
Full URL
https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/arrow-right-dark.svg
Requested by
Host: de.sentinelone.com
URL: https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/css/style-labs.min.css?ver=1729074227
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2620:12a:8001::2 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
444c83e95470e69f7355fcdb3a370c872025ae298b139090ff9f194ce28dea5b
Security Headers
Name Value
Strict-Transport-Security max-age=31622400; includeSubDomains; preload

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/css/style-labs.min.css?ver=1729074227

Response headers

x-pantheon-styx-hostname
styx-fe2-b-5b56695d4d-9cdv9
content-encoding
gzip
etag
W/"670e8dd8-398"
age
128434
expires
Fri, 17 Oct 2025 08:29:39 GMT
x-cache
MISS, HIT, MISS, MISS
date
Thu, 17 Oct 2024 20:10:13 GMT
content-type
image/svg+xml
last-modified
Tue, 15 Oct 2024 15:44:24 GMT
x-served-by
cache-chi-kigq8000025-CHI, cache-fra-eddf8230142-FRA, cache-fra-eddf8230032-FRA, cache-fra-eddf8230032-FRA
x-cache-hits
0, 0, 0, 0
vary
Accept-Encoding
strict-transport-security
max-age=31622400; includeSubDomains; preload
cache-control
max-age=31622400
x-timer
S1729195814.504897,VS0,VE9
x-styx-req-id
c9081747-8b98-11ef-8219-324c479d206c
via
1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
accept-ranges
bytes
access-control-allow-origin
*
content-length
513
server
nginx
search-icon-white.svg
de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/
681 B
669 B
Image
General
Full URL
https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/search-icon-white.svg
Requested by
Host: de.sentinelone.com
URL: https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/css/style-labs.min.css?ver=1729074227
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2620:12a:8001::2 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
5466092ef0deb16007dc2e8e61eb345b380ab6663bd3ef41808ffb7360abd61a
Security Headers
Name Value
Strict-Transport-Security max-age=31622400; includeSubDomains; preload

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/css/style-labs.min.css?ver=1729074227

Response headers

x-pantheon-styx-hostname
styx-fe2-a-7648d669f7-v5hc5
content-encoding
gzip
etag
W/"670e8ddb-2a9"
age
129410
expires
Fri, 17 Oct 2025 08:13:23 GMT
x-cache
MISS, HIT, MISS, MISS
date
Thu, 17 Oct 2024 20:10:13 GMT
content-type
image/svg+xml
last-modified
Tue, 15 Oct 2024 15:44:27 GMT
x-served-by
cache-chi-kigq8000120-CHI, cache-fra-etou8220073-FRA, cache-fra-eddf8230032-FRA, cache-fra-eddf8230032-FRA
x-cache-hits
0, 9, 0, 0
vary
Accept-Encoding
strict-transport-security
max-age=31622400; includeSubDomains; preload
cache-control
max-age=31622400
x-timer
S1729195814.504982,VS0,VE9
x-styx-req-id
833ba641-8b96-11ef-87c5-aaac9af3cfd2
via
1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
accept-ranges
bytes
access-control-allow-origin
*
content-length
385
server
nginx
Kryptina-Desert-Ftr-150x150.jpg
de.sentinelone.com/wp-content/uploads/2024/09/
Redirect Chain
  • https://www.sentinelone.com/wp-content/uploads/2024/09/Kryptina-Desert-Ftr-150x150.jpg
  • https://de.sentinelone.com/wp-content/uploads/2024/09/Kryptina-Desert-Ftr-150x150.jpg
7 KB
7 KB
Image
General
Full URL
https://de.sentinelone.com/wp-content/uploads/2024/09/Kryptina-Desert-Ftr-150x150.jpg
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/black-basta-ransomware-attacks-deploy-custom-edr-evasion-tools-tied-to-fin7-threat-actor/
Protocol
H2
Server
2620:12a:8001::2 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
c5589064355e3df666b6be1e23c86166dfdac76c7f58d08ed867331fdbb4fe7c
Security Headers
Name Value
Strict-Transport-Security max-age=31622400; includeSubDomains; preload

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/

Response headers

x-pantheon-styx-hostname
styx-fe2-b-547989f88d-k86dx
fastly-io-info
ifsz=7065 idim=150x150 ifmt=jpeg ofsz=6968 odim=150x150 ofmt=webp
etag
"9jg/BLGio6hE+tsz+hq9xGeHuQ5GetpeZLFFfGoSuRw"
age
1679002
expires
Wed, 24 Sep 2025 12:07:07 GMT
x-cache
MISS, MISS, HIT, MISS
date
Thu, 17 Oct 2024 20:10:13 GMT
content-type
image/webp
x-served-by
cache-ams21036-AMS, cache-ams2100113-AMS, cache-fra-eddf8230032-FRA, cache-fra-eddf8230032-FRA
x-cache-hits
0, 0, 0, 0
vary
Accept
fastly-stats
io=1
strict-transport-security
max-age=31622400; includeSubDomains; preload
cache-control
max-age=31622400
x-timer
S1729195814.656015,VS0,VE6
x-styx-req-id
5a666355-79a4-11ef-98f0-a2fef415b75d
via
1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
accept-ranges
bytes
content-length
6968
fastly-io-served-by
img03-europe-west3
server
nginx

Redirect headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
location
https://de.sentinelone.com/wp-content/uploads/2024/09/Kryptina-Desert-Ftr-150x150.jpg
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=oIsvrwbTgveht7qDaxlnqxzCOWhcbBfey87zjc5DelQCoLRSuTKF%2BXXUCvvHmAf1CfvFL2%2FlbghnQzUUIKPtU9vTDCHP6PNWcmsmbNtkchdAFDI%2FNHZ51bHnRAyqSrKiHPGyyQg%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options
nosniff
cf-ray
8d42ee4a895b1c97-FRA
content-length
0
date
Thu, 17 Oct 2024 20:10:13 GMT
vary
Accept-Encoding
server
cloudflare
getForm
go.sentinelone.com/index.php/form/
6 KB
2 KB
Script
General
Full URL
https://go.sentinelone.com/index.php/form/getForm?munchkinId=327-MNM-087&form=2673&url=https%3A%2F%2Fwww.sentinelone.com%2Flabs%2Fblack-basta-ransomware-attacks-deploy-custom-edr-evasion-tools-tied-to-fin7-threat-actor%2F&callback=jQuery3710319434459520749_1729195813458&_=1729195813459
Requested by
Host: go.sentinelone.com
URL: https://go.sentinelone.com/js/forms2/js/forms2.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
104.17.74.206 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
ccaae5e62c78d26325715270ac2020ad20a76efd572c7f4dd9ac8bf1bef7538c

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/

Response headers

cached
false
x-form-service-request-id
7e25#1929c1a2b1e
content-encoding
gzip
cf-cache-status
DYNAMIC
cf-ray
8d42ee4aadef8f3c-FRA
date
Thu, 17 Oct 2024 20:10:14 GMT
content-type
application/javascript; charset=utf-8
vary
Accept-Encoding
x-marketo-source
Form Service
server
cloudflare
calendar-icon-light.svg
de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/
2 KB
1 KB
Image
General
Full URL
https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/calendar-icon-light.svg
Requested by
Host: de.sentinelone.com
URL: https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/css/style-labs.min.css?ver=1729074227
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2620:12a:8001::2 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
de51ba53b38ba54ff68c8d8446802ae1a917d5c456494d88e3bb9d488dc605b9
Security Headers
Name Value
Strict-Transport-Security max-age=31622400; includeSubDomains; preload

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/css/style-labs.min.css?ver=1729074227

Response headers

x-pantheon-styx-hostname
styx-fe2-b-5b56695d4d-7ljh9
content-encoding
gzip
etag
W/"670e8dd8-798"
age
128434
expires
Fri, 17 Oct 2025 08:29:39 GMT
x-cache
MISS, HIT, MISS, MISS
date
Thu, 17 Oct 2024 20:10:13 GMT
content-type
image/svg+xml
last-modified
Tue, 15 Oct 2024 15:44:24 GMT
x-served-by
cache-chi-klot8100021-CHI, cache-fra-etou8220103-FRA, cache-fra-eddf8230032-FRA, cache-fra-eddf8230032-FRA
x-cache-hits
0, 0, 0, 0
vary
Accept-Encoding
strict-transport-security
max-age=31622400; includeSubDomains; preload
cache-control
max-age=31622400
x-timer
S1729195814.528289,VS0,VE17
x-styx-req-id
c9087b25-8b98-11ef-bc5d-86c29a649947
via
1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
accept-ranges
bytes
access-control-allow-origin
*
content-length
842
server
nginx
social-twitter-white.svg
de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/
Redirect Chain
  • https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/social-twitter-white.svg;
  • https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/social-twitter-white.svg
2 KB
1 KB
Image
General
Full URL
https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/social-twitter-white.svg
Requested by
Host: de.sentinelone.com
URL: https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/css/style-labs.min.css?ver=1729074227
Protocol
H2
Server
2620:12a:8001::2 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
7a5d0f939c5224a8efb5b96759dd0509360b5d071774bb702f788f37a00a8426
Security Headers
Name Value
Strict-Transport-Security max-age=31622400; includeSubDomains; preload

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/css/style-labs.min.css?ver=1729074227

Response headers

x-pantheon-styx-hostname
styx-fe2-a-7648d669f7-h7rbn
content-encoding
gzip
etag
W/"670e8ddd-7e1"
age
128433
expires
Fri, 17 Oct 2025 08:29:40 GMT
x-cache
MISS, HIT, MISS, MISS
date
Thu, 17 Oct 2024 20:10:13 GMT
content-type
image/svg+xml
last-modified
Tue, 15 Oct 2024 15:44:29 GMT
x-served-by
cache-chi-kigq8000162-CHI, cache-fra-etou8220133-FRA, cache-fra-eddf8230032-FRA, cache-fra-eddf8230032-FRA
x-cache-hits
0, 0, 0, 0
vary
Accept-Encoding
strict-transport-security
max-age=31622400; includeSubDomains; preload
cache-control
max-age=31622400
x-timer
S1729195814.573795,VS0,VE14
x-styx-req-id
c961e14a-8b98-11ef-a0a8-6e3841428868
via
1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
accept-ranges
bytes
access-control-allow-origin
*
content-length
1036
server
nginx

Redirect headers

x-pantheon-styx-hostname
styx-fe2-a-5466c7c5b8-4wffj
age
1146
x-content-type-options
nosniff
expires
Thu, 17 Oct 2024 20:51:07 GMT
x-cache
MISS, HIT, MISS, MISS
date
Thu, 17 Oct 2024 20:10:13 GMT
content-type
text/html; charset=UTF-8
x-served-by
cache-chi-klot8100133-CHI, cache-fra-etou8220087-FRA, cache-fra-eddf8230032-FRA, cache-fra-eddf8230032-FRA
x-cache-hits
0, 0, 0, 0
x-frame-options
ALLOW-FROM SAMEORIGIN, sentinelone.pathfactory.com, sentinelone.lookbookhq.com, assets.pathfactory.com, go.sentinelone.com, www.sentinelone.com
x-redirect-by
WordPress
strict-transport-security
max-age=31622400; includeSubDomains; preload
vary
Cookie, Cookie
content-security-policy
object-src 'none'; script-src 'unsafe-eval' https://snap.licdn.com/ https://cdn.calibermind.com/ https://a.quora.com/ https://app.cdn.lookbookhq.com/ https://connect.facebook.net/ https://ct.capterra.com/ https://ga.clearbit.com/ https://js.adsrvr.org/ https://munchkin.brightfunnel.com/ https://munchkin.marketo.net/ https://static.ads-twitter.com/ 'unsafe-inline' http://schema.org https://*.cloudfront.net/ https://*.googletagmanager.com https://a.omappapi.com/ https://analytics.twitter.com/ https://bat.bing.com/ https://cdn.abrankings.com https://cdn.abrankings.com/ https://cdn.cookielaw.org/ https://cdn.datatables.net/ https://cdn.jsdelivr.net/ https://cdn.onesignal.com/ https://cdnjs.cloudflare.com/ https://cloud.typography.com/ https://code.jquery.com/ https://collector-5527.tvsquared.com/ https://fonts.googleapis.com/ https://go.sentinelone.com/ https://googleads.g.doubleclick.net/ https://j.6sc.co/ https://js.maxmind.com/ https://js.qualified.com/ https://onesignal.com/ https://pixel-geo.prfct.co/ https://platform-api.sharethis.com/ https://platform.twitter.com/ https://pt.ispot.tv/ https://pubads.g.doubleclick.net/ https://px.spiceworks.com/ https://script.hotjar.com/ https://scripts.demandbase.com/ https://sentinelone.com https://ssl.google-analytics.com https://staging.s1preview.com/ https://static.hotjar.com/ https://tag.marinsm.com/ https://ws.qualified.com/ https://www.clickcease.com/ https://www.google-analytics.com https://www.google-analytics.com/ https://www.google.com/* https://www.googleoptimize.com/ https://www.googletagmanager.com/ https://www.googletagmanager.com/* https://www.redditstatic.com/ https://www.vantajs.com/ https://www.youtube.com/ https://yoast.com/ https://www.google.com/ https://qualified.com/ https://www.vantajs.com/ https://js.maxmind.com/ https://cdn.onesignal.com/ https://cdn.datatables.net/ https://platform-api.sharethis.com/ https://yoast.com/ https://fonts.googleapis.com/ https://cdn.datatables.net/ https://js-agent.newrelic.com/ https://www.sentinelone.com/ https://boards.greenhouse.io/ https://ajax.cloudflare.com/ https://www.googleadservices.com/ https://bam.nr-data.net/ https://cdn.linkedin.oribi.io/ https://fr.sentinelone.com/ https://it.sentinelone.com/ https://jp.sentinelone.com/ https://de.sentinelone.com/ https://it.sentinelone.com/ https://es.sentinelone.com/ https://nl.sentinelone.com/ https://kr.sentinelone.com/ https://www.google.it/ https://www.google.co.jp/ https://www.google.de/ https://ar.sentinelone.com/ https://www.google.es/ https://www.google.fr/ https://www.google.nl/ https://tags.srv.stackadapt.com/ https://qvdt3feo.com/ https://*.googleapis.com https://js.storylane.io/ https://javascript.heeet.io/ https://*.gstatic.com https://px.osbc.com/ https://tag.demandbase.com/ https://www.clarity.ms/ https://js.zi-scripts.com/ https://ws.zoominfo.com/ https://tags.clickagy.com/ blob: https://ws-assets.zoominfo.com/; frame-ancestors 'self' http://sentinelone.lookbookhq.com https://sentinelone.lookbookhq.com http://sentinelone.pathfactory.com https://sentinelone.pathfactory.com http://assets.sentinelone.com https://assets.sentinelone.com;
cache-control
max-age=3600
location
https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/social-twitter-white.svg
x-timer
S1729195814.528828,VS0,VE10
x-styx-req-id
269d4e7b-8cc1-11ef-abbe-f2b03c6e3d3f
referrer-policy
origin-when-cross-origin
via
1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
accept-ranges
bytes
content-length
0
x-xss-protection
1; mode=block
server
nginx
social-linkedin-white.svg
de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/
Redirect Chain
  • https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/social-linkedin-white.svg;
  • https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/social-linkedin-white.svg
2 KB
1 KB
Image
General
Full URL
https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/social-linkedin-white.svg
Requested by
Host: de.sentinelone.com
URL: https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/css/style-labs.min.css?ver=1729074227
Protocol
H2
Server
2620:12a:8001::2 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
eae2c34014a512a5bebe4a87261c00c87807d4d185dfe1bc0cc09eae0592e6ae
Security Headers
Name Value
Strict-Transport-Security max-age=31622400; includeSubDomains; preload

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/css/style-labs.min.css?ver=1729074227

Response headers

x-pantheon-styx-hostname
styx-fe2-a-7648d669f7-t47j9
content-encoding
gzip
etag
W/"670e8ddb-90f"
age
128433
expires
Fri, 17 Oct 2025 08:10:34 GMT
x-cache
HIT, HIT, MISS, MISS
date
Thu, 17 Oct 2024 20:10:13 GMT
content-type
image/svg+xml
last-modified
Tue, 15 Oct 2024 15:44:27 GMT
x-served-by
cache-chi-klot8100042-CHI, cache-fra-eddf8230132-FRA, cache-fra-eddf8230032-FRA, cache-fra-eddf8230032-FRA
x-cache-hits
0, 127, 0, 0
vary
Accept-Encoding
strict-transport-security
max-age=31622400; includeSubDomains; preload
cache-control
max-age=31622400
x-timer
S1729195814.573906,VS0,VE17
x-styx-req-id
1e7a0cad-8b96-11ef-96ee-32831ca7b548
via
1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
accept-ranges
bytes
access-control-allow-origin
*
content-length
993
server
nginx

Redirect headers

x-pantheon-styx-hostname
styx-fe2-a-5466c7c5b8-prs6f
age
1146
x-content-type-options
nosniff
expires
Thu, 17 Oct 2024 20:51:07 GMT
x-cache
MISS, HIT, MISS, MISS
date
Thu, 17 Oct 2024 20:10:13 GMT
content-type
text/html; charset=UTF-8
x-served-by
cache-chi-klot8100130-CHI, cache-fra-eddf8230044-FRA, cache-fra-eddf8230032-FRA, cache-fra-eddf8230032-FRA
x-cache-hits
0, 0, 0, 0
x-frame-options
ALLOW-FROM SAMEORIGIN, sentinelone.pathfactory.com, sentinelone.lookbookhq.com, assets.pathfactory.com, go.sentinelone.com, www.sentinelone.com
x-redirect-by
WordPress
strict-transport-security
max-age=31622400; includeSubDomains; preload
vary
Cookie, Cookie
content-security-policy
object-src 'none'; script-src 'unsafe-eval' https://snap.licdn.com/ https://cdn.calibermind.com/ https://a.quora.com/ https://app.cdn.lookbookhq.com/ https://connect.facebook.net/ https://ct.capterra.com/ https://ga.clearbit.com/ https://js.adsrvr.org/ https://munchkin.brightfunnel.com/ https://munchkin.marketo.net/ https://static.ads-twitter.com/ 'unsafe-inline' http://schema.org https://*.cloudfront.net/ https://*.googletagmanager.com https://a.omappapi.com/ https://analytics.twitter.com/ https://bat.bing.com/ https://cdn.abrankings.com https://cdn.abrankings.com/ https://cdn.cookielaw.org/ https://cdn.datatables.net/ https://cdn.jsdelivr.net/ https://cdn.onesignal.com/ https://cdnjs.cloudflare.com/ https://cloud.typography.com/ https://code.jquery.com/ https://collector-5527.tvsquared.com/ https://fonts.googleapis.com/ https://go.sentinelone.com/ https://googleads.g.doubleclick.net/ https://j.6sc.co/ https://js.maxmind.com/ https://js.qualified.com/ https://onesignal.com/ https://pixel-geo.prfct.co/ https://platform-api.sharethis.com/ https://platform.twitter.com/ https://pt.ispot.tv/ https://pubads.g.doubleclick.net/ https://px.spiceworks.com/ https://script.hotjar.com/ https://scripts.demandbase.com/ https://sentinelone.com https://ssl.google-analytics.com https://staging.s1preview.com/ https://static.hotjar.com/ https://tag.marinsm.com/ https://ws.qualified.com/ https://www.clickcease.com/ https://www.google-analytics.com https://www.google-analytics.com/ https://www.google.com/* https://www.googleoptimize.com/ https://www.googletagmanager.com/ https://www.googletagmanager.com/* https://www.redditstatic.com/ https://www.vantajs.com/ https://www.youtube.com/ https://yoast.com/ https://www.google.com/ https://qualified.com/ https://www.vantajs.com/ https://js.maxmind.com/ https://cdn.onesignal.com/ https://cdn.datatables.net/ https://platform-api.sharethis.com/ https://yoast.com/ https://fonts.googleapis.com/ https://cdn.datatables.net/ https://js-agent.newrelic.com/ https://www.sentinelone.com/ https://boards.greenhouse.io/ https://ajax.cloudflare.com/ https://www.googleadservices.com/ https://bam.nr-data.net/ https://cdn.linkedin.oribi.io/ https://fr.sentinelone.com/ https://it.sentinelone.com/ https://jp.sentinelone.com/ https://de.sentinelone.com/ https://it.sentinelone.com/ https://es.sentinelone.com/ https://nl.sentinelone.com/ https://kr.sentinelone.com/ https://www.google.it/ https://www.google.co.jp/ https://www.google.de/ https://ar.sentinelone.com/ https://www.google.es/ https://www.google.fr/ https://www.google.nl/ https://tags.srv.stackadapt.com/ https://qvdt3feo.com/ https://*.googleapis.com https://js.storylane.io/ https://javascript.heeet.io/ https://*.gstatic.com https://px.osbc.com/ https://tag.demandbase.com/ https://www.clarity.ms/ https://js.zi-scripts.com/ https://ws.zoominfo.com/ https://tags.clickagy.com/ blob: https://ws-assets.zoominfo.com/; frame-ancestors 'self' http://sentinelone.lookbookhq.com https://sentinelone.lookbookhq.com http://sentinelone.pathfactory.com https://sentinelone.pathfactory.com http://assets.sentinelone.com https://assets.sentinelone.com;
cache-control
max-age=3600
location
https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/social-linkedin-white.svg
x-timer
S1729195814.528794,VS0,VE12
x-styx-req-id
269da290-8cc1-11ef-bf17-865bfe08344e
referrer-policy
origin-when-cross-origin
via
1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
accept-ranges
bytes
content-length
0
x-xss-protection
1; mode=block
server
nginx
Zuzana_labscon23-150x150.jpg
de.sentinelone.com/wp-content/uploads/2024/09/
Redirect Chain
  • https://www.sentinelone.com/wp-content/uploads/2024/09/Zuzana_labscon23-150x150.jpg
  • https://de.sentinelone.com/wp-content/uploads/2024/09/Zuzana_labscon23-150x150.jpg
7 KB
7 KB
Image
General
Full URL
https://de.sentinelone.com/wp-content/uploads/2024/09/Zuzana_labscon23-150x150.jpg
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/black-basta-ransomware-attacks-deploy-custom-edr-evasion-tools-tied-to-fin7-threat-actor/
Protocol
H2
Server
2620:12a:8001::2 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
03e377433b486e0c6a44a700671e7fcfbc2d6925a9b2f9753c49976c7ad612d5
Security Headers
Name Value
Strict-Transport-Security max-age=31622400; includeSubDomains; preload

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/

Response headers

x-pantheon-styx-hostname
styx-fe2-b-6578554b6-l9jcl
fastly-io-info
ifsz=9177 idim=150x150 ifmt=jpeg ofsz=6926 odim=150x150 ofmt=webp
etag
"bSzkCWpxflu4YH1bWYBA7zdVHle32O6Mfro8PVsQGFo"
age
2504225
expires
Sat, 06 Sep 2025 16:23:03 GMT
x-cache
MISS, MISS, HIT, MISS
date
Thu, 17 Oct 2024 20:10:13 GMT
content-type
image/webp
x-served-by
cache-ams2100141-AMS, cache-ams2100118-AMS, cache-fra-eddf8230032-FRA, cache-fra-eddf8230032-FRA
x-cache-hits
0, 0, 0, 0
vary
Accept
fastly-stats
io=1
strict-transport-security
max-age=31622400; includeSubDomains; preload
cache-control
max-age=31622400
x-timer
S1729195814.656009,VS0,VE6
x-styx-req-id
1ffbacaf-6ba3-11ef-b941-b61f05a71aac
via
1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
accept-ranges
bytes
content-length
6926
fastly-io-served-by
img04-europe-west3
server
nginx

Redirect headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
location
https://de.sentinelone.com/wp-content/uploads/2024/09/Zuzana_labscon23-150x150.jpg
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=iybni5WXwiudRGnycyuV%2F%2Bx2B2jPoAsIgdrQA%2FCLFK%2Bt4y4ANil2%2FSl3zBVhtSwdk2ukeSSdP%2FkzmjlCwZOJoVdeK3IazEM9vzPKg9Hzm%2Fa1ilBkr%2FSoQU8tW5fT71IVOBOyrvE%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options
nosniff
cf-ray
8d42ee4a998e1c97-FRA
content-length
0
date
Thu, 17 Oct 2024 20:10:13 GMT
vary
Accept-Encoding
server
cloudflare
Exploring-_VT_Bus_ftr-150x150.jpg
de.sentinelone.com/wp-content/uploads/2024/08/
Redirect Chain
  • https://www.sentinelone.com/wp-content/uploads/2024/08/Exploring-_VT_Bus_ftr-150x150.jpg
  • https://de.sentinelone.com/wp-content/uploads/2024/08/Exploring-_VT_Bus_ftr-150x150.jpg
5 KB
5 KB
Image
General
Full URL
https://de.sentinelone.com/wp-content/uploads/2024/08/Exploring-_VT_Bus_ftr-150x150.jpg
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/black-basta-ransomware-attacks-deploy-custom-edr-evasion-tools-tied-to-fin7-threat-actor/
Protocol
H2
Server
2620:12a:8001::2 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
892945e6a4027d08293e591e6faa11e061feec51b40fcb6abe1e5fe7164db47f
Security Headers
Name Value
Strict-Transport-Security max-age=31622400; includeSubDomains; preload

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/

Response headers

x-pantheon-styx-hostname
styx-fe2-b-6578554b6-l5lcb
fastly-io-info
ifsz=5713 idim=150x150 ifmt=jpeg ofsz=4896 odim=150x150 ofmt=webp
etag
"H+sDnHkbO/GehhlanNO7MffP911MFVZ6Ouq15VfaFls"
age
2735675
expires
Fri, 05 Sep 2025 06:13:41 GMT
x-cache
MISS, MISS, HIT, MISS
date
Thu, 17 Oct 2024 20:10:13 GMT
content-type
image/webp
x-served-by
cache-ams21063-AMS, cache-ams21061-AMS, cache-fra-eddf8230032-FRA, cache-fra-eddf8230032-FRA
x-cache-hits
0, 0, 0, 0
vary
Accept
fastly-stats
io=1
strict-transport-security
max-age=31622400; includeSubDomains; preload
cache-control
max-age=31622400
x-timer
S1729195814.701491,VS0,VE5
x-styx-req-id
d5214761-6a84-11ef-9082-86175c9255c4
via
1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
accept-ranges
bytes
content-length
4896
fastly-io-served-by
vpop-etou8240196
server
nginx

Redirect headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
location
https://de.sentinelone.com/wp-content/uploads/2024/08/Exploring-_VT_Bus_ftr-150x150.jpg
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=1dHZsyd073kpSu8LYEmUXzPbOhrEBK1P9IY6fzyhFItu4uTUx9MnPjJbG8Lp17OueJp8GlJuZeG8g2ob9uW3H2B5uAwXdZJbWrSu9pWdo%2BsEowd%2B9uWd%2FDU580uQ6wMrXBLDDxc%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options
nosniff
cf-ray
8d42ee4a99901c97-FRA
content-length
0
date
Thu, 17 Oct 2024 20:10:13 GMT
vary
Accept-Encoding
server
cloudflare
otBannerSdk.js
cdn.cookielaw.org/scripttemplates/202409.1.0/
457 KB
111 KB
Script
General
Full URL
https://cdn.cookielaw.org/scripttemplates/202409.1.0/otBannerSdk.js
Requested by
Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:562a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
81a50b09cb85e4ff68788f763b8dcdc549414cecf42ca228a55ab77c971f1286
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/

Response headers

content-md5
Mq8sWt7aN99kE/VZ97+T8Q==
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
content-encoding
gzip
x-ms-version
2009-09-19
etag
0x8DCECBD4252FE38
x-ms-lease-status
unlocked
cf-cache-status
HIT
age
81012
x-content-type-options
nosniff
date
Thu, 17 Oct 2024 20:10:13 GMT
content-type
application/javascript
last-modified
Tue, 15 Oct 2024 02:01:18 GMT
vary
Accept-Encoding
strict-transport-security
max-age=31536000; includeSubDomains; preload
cache-control
max-age=86400
cross-origin-resource-policy
cross-origin
x-ms-request-id
5f86748c-f01e-00de-1d5a-1fc323000000
cf-ray
8d42ee4acb47dc8e-FRA
accept-ranges
bytes
access-control-allow-origin
*
content-length
113760
x-ms-blob-type
BlockBlob
server
cloudflare
forms2.css
go.sentinelone.com/js/forms2/css/
13 KB
3 KB
Stylesheet
General
Full URL
https://go.sentinelone.com/js/forms2/css/forms2.css
Requested by
Host: go.sentinelone.com
URL: https://go.sentinelone.com/js/forms2/js/forms2.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
104.17.74.206 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
256e42104f48a5fa80b031da12dc56acde224fba3f9810f8f8192b39136d365a
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/

Response headers

cache-control
public, max-age=14400
content-encoding
gzip
cf-cache-status
HIT
etag
"15208a8-3437-62370c030d900"
age
1324
x-content-type-options
nosniff
cf-ray
8d42ee4b3ecf8f3c-FRA
expires
Fri, 18 Oct 2024 00:10:13 GMT
accept-ranges
bytes
content-length
2623
date
Thu, 17 Oct 2024 20:10:13 GMT
content-type
text/css
last-modified
Tue, 01 Oct 2024 21:10:28 GMT
vary
Accept-Encoding
server
cloudflare
forms2-theme-plain.css
go.sentinelone.com/js/forms2/css/
828 B
335 B
Stylesheet
General
Full URL
https://go.sentinelone.com/js/forms2/css/forms2-theme-plain.css
Requested by
Host: go.sentinelone.com
URL: https://go.sentinelone.com/js/forms2/js/forms2.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
104.17.74.206 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
57cd46adbabd6c40823602b4513aecbe89320a769572255272abe9f008de69fa
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/

Response headers

cache-control
public, max-age=14400
content-encoding
gzip
cf-cache-status
HIT
etag
"5c01d7-33c-62370c030d900"
age
6585
x-content-type-options
nosniff
cf-ray
8d42ee4b3ed08f3c-FRA
expires
Fri, 18 Oct 2024 00:10:13 GMT
accept-ranges
bytes
content-length
246
date
Thu, 17 Oct 2024 20:10:13 GMT
content-type
text/css
last-modified
Tue, 01 Oct 2024 21:10:28 GMT
vary
Accept-Encoding
server
cloudflare
iframe_api
www.youtube.com/
993 B
2 KB
Script
General
Full URL
https://www.youtube.com/iframe_api
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/js/global.min.js?ver=1729074227
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80f::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
c3d3036fdbd771d327ee2e9262a86eef41f96c3bffcc7adad2a91a651968923b
Security Headers
Name Value
Content-Security-Policy require-trusted-types-for 'script'
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/

Response headers

content-encoding
br
report-to
{"group":"youtube_main","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube_main"}]}
x-content-type-options
nosniff
origin-trial
AmhMBR6zCLzDDxpW+HfpP67BqwIknWnyMOXOQGfzYswFmJe+fgaI6XZgAzcxOrzNtP7hEDsOo1jdjFnVr2IdxQ4AAAB4eyJvcmlnaW4iOiJodHRwczovL3lvdXR1YmUuY29tOjQ0MyIsImZlYXR1cmUiOiJXZWJWaWV3WFJlcXVlc3RlZFdpdGhEZXByZWNhdGlvbiIsImV4cGlyeSI6MTc1ODA2NzE5OSwiaXNTdWJkb21haW4iOnRydWV9
expires
Thu, 17 Oct 2024 20:10:13 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657?hl=de for more info."
date
Thu, 17 Oct 2024 20:10:13 GMT
content-type
text/javascript; charset=utf-8
vary
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-frame-options
SAMEORIGIN
strict-transport-security
max-age=31536000
content-security-policy
require-trusted-types-for 'script'
cache-control
private, max-age=0
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-resource-policy
cross-origin
permissions-policy
ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
cross-origin-opener-policy-report-only
same-origin; report-to="youtube_main"
x-xss-protection
0
server
ESF
search-icon-white.svg
de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/
Redirect Chain
  • https://www.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/search-icon-white.svg
  • https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/search-icon-white.svg
681 B
0
Image
General
Full URL
https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/search-icon-white.svg
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/black-basta-ransomware-attacks-deploy-custom-edr-evasion-tools-tied-to-fin7-threat-actor/
Protocol
H2
Server
2620:12a:8001::2 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
5466092ef0deb16007dc2e8e61eb345b380ab6663bd3ef41808ffb7360abd61a

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/

Response headers

x-pantheon-styx-hostname
styx-fe2-a-7648d669f7-v5hc5
content-encoding
gzip
etag
W/"670e8ddb-2a9"
age
129410
expires
Fri, 17 Oct 2025 08:13:23 GMT
x-cache
MISS, HIT, MISS, MISS
date
Thu, 17 Oct 2024 20:10:13 GMT
content-type
image/svg+xml
last-modified
Tue, 15 Oct 2024 15:44:27 GMT
x-served-by
cache-chi-kigq8000120-CHI, cache-fra-etou8220073-FRA, cache-fra-eddf8230032-FRA, cache-fra-eddf8230032-FRA
x-cache-hits
0, 9, 0, 0
vary
Accept-Encoding
cache-control
max-age=31622400
x-timer
S1729195814.504982,VS0,VE9
x-styx-req-id
833ba641-8b96-11ef-87c5-aaac9af3cfd2
via
1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
accept-ranges
bytes
access-control-allow-origin
*
content-length
385
server
nginx

Redirect headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
location
https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/search-icon-white.svg
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=CKAAKlNUX7V7nmP6FSZDtX7ZsRJ59aELFvCSGESBjO1FDT6MSL1EkpsKkvqNchZAdrV3GfMwonHym7Q8cA9o8peU4X3gReanNoqjTnBbt7DOSOzRuoODm8zKnN%2FXj11FI%2FLiZV8%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options
nosniff
cf-ray
8d42ee4b5abf1c97-FRA
content-length
0
date
Thu, 17 Oct 2024 20:10:13 GMT
vary
Accept-Encoding
server
cloudflare
SentinelLabs_Logo_RGB_WhitePurp.png
de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/img/
Redirect Chain
  • https://www.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/img/SentinelLabs_Logo_RGB_WhitePurp.png
  • https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/img/SentinelLabs_Logo_RGB_WhitePurp.png
2 KB
3 KB
Image
General
Full URL
https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/img/SentinelLabs_Logo_RGB_WhitePurp.png
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/black-basta-ransomware-attacks-deploy-custom-edr-evasion-tools-tied-to-fin7-threat-actor/
Protocol
H2
Server
2620:12a:8001::2 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
f4aa58ca80a157a7094443dc0eb57a6da3b3b639b8b7df19dd18a874d167ba9d
Security Headers
Name Value
Strict-Transport-Security max-age=31622400; includeSubDomains; preload

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/

Response headers

x-pantheon-styx-hostname
styx-fe2-b-6578554b6-lr8qv
fastly-io-info
ifsz=5631 idim=566x102 ifmt=png ofsz=2400 odim=566x102 ofmt=webp
etag
"RQu1dwEJtFWeuwfGEHe2Efz1p35b1Asg8OLjSirVS3k"
age
2015156
expires
Fri, 05 Sep 2025 04:45:14 GMT
x-cache
MISS, MISS, HIT, MISS
date
Thu, 17 Oct 2024 20:10:13 GMT
content-type
image/webp
x-served-by
cache-ams21071-AMS, cache-ams2100116-AMS, cache-fra-eddf8230032-FRA, cache-fra-eddf8230032-FRA
x-cache-hits
0, 0, 0, 0
vary
Accept
fastly-stats
io=1
strict-transport-security
max-age=31622400; includeSubDomains; preload
cache-control
max-age=31622400
x-timer
S1729195814.770809,VS0,VE6
x-styx-req-id
79f97fba-6a78-11ef-86ee-4aceb6ebe27c
via
1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
accept-ranges
bytes
content-length
2400
fastly-io-served-by
vpop-etou8240196
server
nginx

Redirect headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
location
https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/img/SentinelLabs_Logo_RGB_WhitePurp.png
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=sQqQiGaVs5ApuFCLMmSRB%2BsNEjlOm9e%2B0vgi7nBFZMU5VBWXp0bNj7iIFll6SY7nUK9mmwpON93bq2C%2BEnFDdltf%2BwSA91c0STnWhBzzLlRQi1Azi77CsvsR8Gb4XkUMl%2FZcnQc%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options
nosniff
cf-ray
8d42ee4b5ac11c97-FRA
content-length
0
date
Thu, 17 Oct 2024 20:10:13 GMT
vary
Accept-Encoding
server
cloudflare
Black-Basta-Feature.jpg
de.sentinelone.com/wp-content/uploads/2022/11/
Redirect Chain
  • https://www.sentinelone.com/wp-content/uploads/2022/11/Black-Basta-Feature.jpg
  • https://de.sentinelone.com/wp-content/uploads/2022/11/Black-Basta-Feature.jpg
148 KB
148 KB
Image
General
Full URL
https://de.sentinelone.com/wp-content/uploads/2022/11/Black-Basta-Feature.jpg
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/black-basta-ransomware-attacks-deploy-custom-edr-evasion-tools-tied-to-fin7-threat-actor/
Protocol
H2
Server
2620:12a:8001::2 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
b5580705563824650857de2856ef8469e280ab28a55ab75dbf7c2b45e53ac59c
Security Headers
Name Value
Strict-Transport-Security max-age=31622400; includeSubDomains; preload

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/

Response headers

x-pantheon-styx-hostname
styx-fe2-b-5b56695d4d-ss8qd
fastly-io-info
ifsz=154951 idim=1200x628 ifmt=jpeg ofsz=151297 odim=1200x628 ofmt=jpeg
etag
"u2LSmdF4lSm59QHEJC7kdRhrFO8ECyA27OV6VKbo7uU"
age
577653
expires
Sun, 12 Oct 2025 03:42:40 GMT
x-cache
MISS, MISS, HIT, MISS
date
Thu, 17 Oct 2024 20:10:13 GMT
content-type
image/jpeg
x-served-by
cache-ams2100121-AMS, cache-ams2100139-AMS, cache-fra-eddf8230032-FRA, cache-fra-eddf8230032-FRA
x-cache-hits
0, 0, 5, 0
vary
Accept
fastly-stats
io=1
strict-transport-security
max-age=31622400; includeSubDomains; preload
cache-control
max-age=31622400
fastly-io-warning
Failed to shrink image
x-timer
S1729195814.822726,VS0,VE4
x-styx-req-id
dd53fb87-8782-11ef-8dec-aab69bd9462b
via
1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
accept-ranges
bytes
content-length
151297
fastly-io-served-by
vpop-etou8240198
server
nginx

Redirect headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
location
https://de.sentinelone.com/wp-content/uploads/2022/11/Black-Basta-Feature.jpg
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=mGC6SbandqWeXz0NA7Gwyma5qGf%2FV9NBiXlfSfERIeHTnfFiQpaPiLsuQ0cBB1sTzuE03Iy%2F2v%2FQgX3VW31rXfGA6CL51kP6K3YLhnYHOtYnPFeQF9Tl3Ft8ImZchOOuoL7s008%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options
nosniff
cf-ray
8d42ee4b5ac41c97-FRA
content-length
0
date
Thu, 17 Oct 2024 20:10:13 GMT
vary
Accept-Encoding
server
cloudflare
OneSignalPageSDKES6.js
cdn.onesignal.com/sdks/
284 KB
68 KB
Script
General
Full URL
https://cdn.onesignal.com/sdks/OneSignalPageSDKES6.js?v=151606
Requested by
Host: cdn.onesignal.com
URL: https://cdn.onesignal.com/sdks/OneSignalSDK.js?ver=1.0.0
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700::6810:a091 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
785d3e9ea187b7242e1a4365a48c3fd95dd7a469245d24c6769b8d46c4ef4b81
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/

Response headers

strict-transport-security
max-age=15552000; includeSubDomains
cache-control
public, max-age=259200
content-encoding
br
cf-cache-status
HIT
etag
W/"7e91359b46e1da637080a03b759164fa"
age
3371
via
1.1 google
cf-ray
8d42ee4b5ee89079-FRA
expires
Sun, 20 Oct 2024 20:10:13 GMT
alt-svc
h3=":443"; ma=86400
date
Thu, 17 Oct 2024 20:10:13 GMT
content-type
application/javascript
vary
Accept-Encoding
server
cloudflare
access-control-allow-headers
OneSignal-Subscription-Id
en.json
cdn.cookielaw.org/consent/02ad5672-6494-4b20-a5ae-7d131a0f4f9c/01922fce-8fbf-7161-9ed5-43e67a363ae5/
172 KB
30 KB
Fetch
General
Full URL
https://cdn.cookielaw.org/consent/02ad5672-6494-4b20-a5ae-7d131a0f4f9c/01922fce-8fbf-7161-9ed5-43e67a363ae5/en.json
Requested by
Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/202409.1.0/otBannerSdk.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:562a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
28949ace3235b8211febce28af89ee677531171c3b55897172657102b63592fd
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/

Response headers

content-md5
/FWj+4L8+FmRfDFMhY4pQA==
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
content-encoding
gzip
cf-cache-status
HIT
etag
0x8DCDF012F151491
age
18521
x-ms-lease-status
unlocked
x-content-type-options
nosniff
x-ms-version
2009-09-19
expires
Fri, 18 Oct 2024 20:10:13 GMT
date
Thu, 17 Oct 2024 20:10:13 GMT
content-type
application/json
last-modified
Fri, 27 Sep 2024 14:32:15 GMT
vary
Accept-Encoding
strict-transport-security
max-age=31536000; includeSubDomains; preload
cache-control
public, max-age=86400
cross-origin-resource-policy
cross-origin, cross-origin
x-ms-request-id
fa9b0a8e-a01e-00a0-66ea-105cec000000
cf-ray
8d42ee4b6c9cdb03-FRA
accept-ranges
bytes
access-control-allow-origin
*
content-length
30186
x-ms-blob-type
BlockBlob
server
cloudflare
XDFrame
go.sentinelone.com/index.php/form/ Frame C177
2 KB
872 B
Document
General
Full URL
https://go.sentinelone.com/index.php/form/XDFrame
Requested by
Host: go.sentinelone.com
URL: https://go.sentinelone.com/js/forms2/js/forms2.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
104.17.74.206 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
64d117a5cdaf7b8aa3bc5ff1abeec0e1d98b834782d49f34260c4e1ecc7ec4c2
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://www.sentinelone.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

cache-control
max-age=3600
cf-cache-status
DYNAMIC
cf-ray
8d42ee4befcb8f3c-FRA
content-encoding
gzip
content-type
text/html; charset=utf-8
date
Thu, 17 Oct 2024 20:10:13 GMT
server
cloudflare
vary
Accept-Encoding
x-content-type-options
nosniff
otFlat.json
cdn.cookielaw.org/scripttemplates/202409.1.0/assets/
13 KB
3 KB
Fetch
General
Full URL
https://cdn.cookielaw.org/scripttemplates/202409.1.0/assets/otFlat.json
Requested by
Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/202409.1.0/otBannerSdk.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:562a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
d890abf66010907c7a0a61236d25c3c98bcb7edec34b13dc887f5be122bfef7e
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/

Response headers

content-md5
RGlYb2KBTfdkPpxIxwwu0g==
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
content-encoding
gzip
x-ms-version
2009-09-19
etag
0x8DCED8C8519203B
x-ms-lease-status
unlocked
cf-cache-status
HIT
age
15900
x-content-type-options
nosniff
date
Thu, 17 Oct 2024 20:10:13 GMT
content-type
application/json
last-modified
Wed, 16 Oct 2024 02:44:56 GMT
vary
Accept-Encoding
strict-transport-security
max-age=31536000; includeSubDomains; preload
cache-control
max-age=86400
cross-origin-resource-policy
cross-origin
x-ms-request-id
cfbc84a1-901e-00a3-1c00-205feb000000
cf-ray
8d42ee4bee44db03-FRA
accept-ranges
bytes
access-control-allow-origin
*
content-length
3003
x-ms-blob-type
BlockBlob
server
cloudflare
otPcPanel.json
cdn.cookielaw.org/scripttemplates/202409.1.0/assets/v2/
64 KB
13 KB
Fetch
General
Full URL
https://cdn.cookielaw.org/scripttemplates/202409.1.0/assets/v2/otPcPanel.json
Requested by
Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/202409.1.0/otBannerSdk.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:562a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
f81a622d5550eb9220a609e964745dca5fa20a4b36594863a916a46af58eeb4b
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/

Response headers

content-md5
woYZp0HVhx8yo641nhyLrw==
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
content-encoding
gzip
x-ms-version
2009-09-19
etag
0x8DCED8C868E8C65
x-ms-lease-status
unlocked
cf-cache-status
HIT
age
18519
x-content-type-options
nosniff
date
Thu, 17 Oct 2024 20:10:13 GMT
content-type
application/json
last-modified
Wed, 16 Oct 2024 02:44:58 GMT
vary
Accept-Encoding
strict-transport-security
max-age=31536000; includeSubDomains; preload
cache-control
max-age=86400
cross-origin-resource-policy
cross-origin
x-ms-request-id
5d9905d1-901e-00e7-61da-1f8387000000
cf-ray
8d42ee4bee47db03-FRA
accept-ranges
bytes
access-control-allow-origin
*
content-length
12881
x-ms-blob-type
BlockBlob
server
cloudflare
otCommonStyles.css
cdn.cookielaw.org/scripttemplates/202409.1.0/assets/
24 KB
4 KB
Fetch
General
Full URL
https://cdn.cookielaw.org/scripttemplates/202409.1.0/assets/otCommonStyles.css
Requested by
Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/202409.1.0/otBannerSdk.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:562a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
7c2092048f21074425f3e025db78fb6505f75d6fcf2e121ced055c8d53bcb1b3
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/

Response headers

content-md5
HyPJ72TNHxdfOI82cqKVqA==
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
x-ms-version
2009-09-19
x-ms-lease-status
unlocked
cf-cache-status
HIT
age
15229
content-encoding
gzip
x-content-type-options
nosniff
date
Thu, 17 Oct 2024 20:10:13 GMT
content-type
text/css
last-modified
Wed, 16 Oct 2024 02:45:07 GMT
vary
Accept-Encoding
strict-transport-security
max-age=31536000; includeSubDomains; preload
cache-control
max-age=86400
cross-origin-resource-policy
cross-origin
x-ms-request-id
ccd14207-201e-00ba-19d9-1f7383000000
cf-ray
8d42ee4bee4cdb03-FRA
access-control-allow-origin
*
x-ms-blob-type
BlockBlob
server
cloudflare
destination
www.googletagmanager.com/gtag/
277 KB
95 KB
Script
General
Full URL
https://www.googletagmanager.com/gtag/destination?id=AW-970186784&l=dataLayer&cx=c
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-KGGXSJ
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81c::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
ecc7c26a43679259a01ee94bc695526738ac84a3f4db727ebd7e2cc5b571f853
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/

Response headers

content-encoding
br
report-to
{"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcysghrgc:42:0"}],}
expires
Thu, 17 Oct 2024 20:10:13 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Thu, 17 Oct 2024 20:10:13 GMT
content-type
application/javascript; charset=UTF-8
vary
Accept-Encoding
last-modified
Thu, 17 Oct 2024 18:00:00 GMT
access-control-allow-headers
Cache-Control
strict-transport-security
max-age=31536000; includeSubDomains
cache-control
private, max-age=900
cross-origin-resource-policy
cross-origin
access-control-allow-credentials
true
content-security-policy-report-only
script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcysghrgc:42:0
access-control-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to=coop_reporting
content-length
97185
x-xss-protection
0
server
Google Tag Manager
bat.js
bat.bing.com/
50 KB
15 KB
Script
General
Full URL
https://bat.bing.com/bat.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-KGGXSJ
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2620:1ec:33::10 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
aabc88a6db8b22022f96ca88e4f0a7be426abef2b35169a71515a2d55246402a
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
cache-control
private,max-age=1800
content-encoding
gzip
etag
"028e0691d20db1:0"
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref
Ref A: EA917BED30A6461AB79C6B6CF0E1B2E3 Ref B: FRA31EDGE0110 Ref C: 2024-10-17T20:10:14Z
accept-ranges
bytes
x-cache
CONFIG_NOCACHE
content-length
14570
date
Thu, 17 Oct 2024 20:10:13 GMT
content-type
application/javascript
last-modified
Wed, 16 Oct 2024 22:47:44 GMT
vary
Accept-Encoding
d6076494.min.js
scripts.demandbase.com/
60 KB
17 KB
Script
General
Full URL
https://scripts.demandbase.com/d6076494.min.js
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/black-basta-ransomware-attacks-deploy-custom-edr-evasion-tools-tied-to-fin7-threat-actor/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.245.46.22 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-245-46-22.fra56.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
187392c32fe1b13fb5ff82fb3a06fecc9cb0403ce52c85285840880c55fdd745
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains; preload

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/

Response headers

content-encoding
gzip
x-amz-version-id
zh5pZEN9OJvnC2CgAf9fhsfPsCZz99sW
etag
W/"f1722349926863d8d1925a6aa07f85ce"
age
785
x-cache
Hit from cloudfront
x-amz-cf-id
Ep5lmQZZEzLKnpee2tJoPUsdq_4MpP2QAC1IGdmCCoXcN482lP1pHw==
date
Thu, 17 Oct 2024 19:57:10 GMT
content-type
application/javascript; charset=utf-8
last-modified
Tue, 08 Dec 2020 23:26:24 GMT
vary
Accept-Encoding
strict-transport-security
max-age=63072000; includeSubDomains; preload
cache-control
public, max-age=3600
via
1.1 79d85d2de1f5aa38558ef6bab6274390.cloudfront.net (CloudFront)
permissions-policy
accelerometer=(), camera=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), payment=(), usb=(), interest-cohort=()
x-amz-cf-pop
FRA56-P9
server
AmazonS3
munchkin.js
munchkin.marketo.net/
1 KB
1 KB
Script
General
Full URL
https://munchkin.marketo.net/munchkin.js
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/black-basta-ransomware-attacks-deploy-custom-edr-evasion-tools-tied-to-fin7-threat-actor/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
23.197.137.224 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-197-137-224.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
5206536707c84baa892d3c3231b351985ee828cb8b9c0bd8db42cd3363995fc4

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/

Response headers

Content-Encoding
gzip
ETag
"cb731cc5c2bd9f31d6bfeb19f3c8b1ff:1679016288.730763"
Connection
keep-alive
Accept-Ranges
bytes
P3P
policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR"
Content-Length
729
Date
Thu, 17 Oct 2024 20:10:14 GMT
Content-Type
application/x-javascript
Last-Modified
Fri, 17 Mar 2023 01:24:48 GMT
Server
AkamaiNetStorage
Vary
Accept-Encoding
insight.min.js
snap.licdn.com/li.lms-analytics/
40 KB
14 KB
Script
General
Full URL
https://snap.licdn.com/li.lms-analytics/insight.min.js
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/black-basta-ransomware-attacks-deploy-custom-edr-evasion-tools-tied-to-fin7-threat-actor/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:3500:10::210:a99 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
8a27dc7b44ebe886390bfa0a9beeea36ea5a3f37479f0e0836b6c9b80d9b35ed
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/

Response headers

cache-control
max-age=30405
content-encoding
gzip
x-cdn
AKAM
x-content-type-options
nosniff
accept-ranges
bytes
content-length
14628
date
Thu, 17 Oct 2024 20:10:14 GMT
last-modified
Thu, 22 Aug 2024 10:43:55 GMT
content-type
application/javascript;charset=utf-8
vary
Accept-Encoding
x-amz-server-side-encryption
AES256
qevents.js
a.quora.com/
41 KB
15 KB
Script
General
Full URL
https://a.quora.com/qevents.js
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/black-basta-ransomware-attacks-deploy-custom-edr-evasion-tools-tied-to-fin7-threat-actor/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
162.159.152.17 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
5af5ee0b37b1f0ef31c42932bbf81424e4bb53e95e87a47e058625c1af2245db

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/

Response headers

content-encoding
br
cf-cache-status
HIT
etag
W/"87b5ecaafd0e88097cbbb1bbb7695fe9"
x-amz-version-id
jrgqQn59BHyNBJEhUqaibHl1Lk06.AzO
age
78649
expires
Fri, 18 Oct 2024 00:10:14 GMT
alt-svc
h3=":443"; ma=86400
date
Thu, 17 Oct 2024 20:10:14 GMT
content-type
text/plain
last-modified
Thu, 28 Mar 2024 17:33:19 GMT
vary
Accept-Encoding
x-amz-id-2
V1KqiLEqgavTxZxeOhRwxks/e9Bwov1/UFMqsrtEEzLmoDSbUpr5Gq/SrBc09Cr251D8a88zvXjr2380vgygWiCKDQGX6cFQNHy8wkgu4h4=
cache-control
public, max-age=14400
x-amz-meta-s3cmd-attrs
md5:87b5ecaafd0e88097cbbb1bbb7695fe9
x-amz-request-id
CHBWA4MHHEB4ZTF0
cf-ray
8d42ee4e7f321e0c-FRA
server
cloudflare
x-amz-server-side-encryption
AES256
collect
region1.analytics.google.com/g/
0
0
Fetch
General
Full URL
https://region1.analytics.google.com/g/collect?v=2&tid=G-KJPGLC9EVP&gtm=45je4ag0v889850326za200&_p=1729195813465&_gaz=1&gcd=13l3l3l2l1l1&npa=1&dma_cps=syphamo&dma=1&tag_exp=101686685&cid=2086134053.1729195814&ul=de-de&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&_s=1&sid=1729195813&sct=1&seg=0&dl=https%3A%2F%2Fwww.sentinelone.com%2Flabs%2Fblack-basta-ransomware-attacks-deploy-custom-edr-evasion-tools-tied-to-fin7-threat-actor%2F&dt=Black%20Basta%20Ransomware%20%7C%20Attacks%20Deploy%20Custom%20EDR%20Evasion%20Tools%20Tied%20to%20FIN7%20Threat%20Actor%20-%20SentinelOne&en=page_view&_fv=1&_nsi=1&_ss=1&_ee=1&tfd=2368
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-KJPGLC9EVP
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:4860:4802:34::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/

Response headers

cache-control
no-cache, no-store, must-revalidate
pragma
no-cache
cross-origin-resource-policy
cross-origin
access-control-allow-credentials
true
content-security-policy-report-only
script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:136:0
report-to
{"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:136:0"}],}
expires
Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin
https://www.sentinelone.com
cross-origin-opener-policy-report-only
same-origin; report-to=coop_reporting
content-length
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Thu, 17 Oct 2024 20:10:14 GMT
content-type
text/plain
server
Golfe2
collect
stats.g.doubleclick.net/g/
0
548 B
Ping
General
Full URL
https://stats.g.doubleclick.net/g/collect?v=2&tid=G-KJPGLC9EVP&cid=2086134053.1729195814&gtm=45je4ag0v889850326za200&aip=1&dma=1&dma_cps=syphamo&gcd=13l3l3l2l1l1&npa=1&frm=0&tag_exp=101686685
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-KJPGLC9EVP
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:400c:c00::9c Brussels, Belgium, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/

Response headers

cache-control
no-cache, no-store, must-revalidate
pragma
no-cache
cross-origin-resource-policy
cross-origin
access-control-allow-credentials
true
content-security-policy-report-only
script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:111:0
report-to
{"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:111:0"}],}
expires
Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin
https://www.sentinelone.com
cross-origin-opener-policy-report-only
same-origin; report-to=coop_reporting
content-length
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Thu, 17 Oct 2024 20:10:14 GMT
content-type
text/plain
server
Golfe2
client.js
cdn.abrankings.com/js/
0
0

js
www.googletagmanager.com/gtag/
223 KB
80 KB
Script
General
Full URL
https://www.googletagmanager.com/gtag/js?id=DC-13115870
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-KGGXSJ
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81c::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
2bb77ccea217302a762a4def45fa0e2437fafac19f02bd36465455d6c8ca47c9
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/

Response headers

content-encoding
br
report-to
{"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],}
expires
Thu, 17 Oct 2024 20:10:13 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Thu, 17 Oct 2024 20:10:13 GMT
content-type
application/javascript; charset=UTF-8
vary
Accept-Encoding
last-modified
Thu, 17 Oct 2024 18:00:00 GMT
access-control-allow-headers
Cache-Control
strict-transport-security
max-age=31536000; includeSubDomains
cache-control
private, max-age=900
cross-origin-resource-policy
cross-origin
access-control-allow-credentials
true
content-security-policy-report-only
script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
access-control-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to=coop_reporting
content-length
81677
x-xss-protection
0
server
Google Tag Manager
uwt.js
static.ads-twitter.com/
56 KB
15 KB
Script
General
Full URL
https://static.ads-twitter.com/uwt.js
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/black-basta-ransomware-attacks-deploy-custom-edr-evasion-tools-tied-to-fin7-threat-actor/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
146.75.120.157 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
4d15ff2317e16ccd8ca1d3248fea7d91130e022369bb032824a84ad9967064df

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/

Response headers

vary
Accept-Encoding,Host
cache-control
no-cache
content-encoding
gzip
etag
"bbbcf811d8437a575d796a4c1e5d4fad+gzip+gzip"
accept-ranges
bytes
x-cache
HIT, HIT
p3p
CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
content-length
15412
date
Thu, 17 Oct 2024 20:10:14 GMT
x-tw-cdn
FT
last-modified
Fri, 22 Mar 2024 21:07:24 GMT
content-type
application/javascript; charset=utf-8
x-served-by
cache-iad-kiad7000168-IAD, cache-fra-etou8220050-FRA
x-amz-server-side-encryption
AES256
a.js
cdn.calibermind.com/
213 KB
61 KB
Script
General
Full URL
https://cdn.calibermind.com/a.js
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/black-basta-ransomware-attacks-deploy-custom-edr-evasion-tools-tied-to-fin7-threat-actor/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3037::6815:2d74 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
d0647d8975d5c92ea700e635befca523c5aac18754b8454d954909fe070e68cc
Security Headers
Name Value
Content-Security-Policy default-src 'self'
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/

Response headers

content-encoding
zstd
cf-cache-status
HIT
etag
W/"668efd6c-354c2"
age
83568
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=BePLweBxH09TcVyINSEKitaUy1rvloMji00FRhHn6MB15dvYAnDI1CJkU0N5krMP91skz458QriEtMHxK10CwcAYXzy782uQMZhx4Bfke8y5RU%2B5AqpuALqudwmjwKPTnoEVYX2aegrs9CkgYRHVvhUf"}],"group":"cf-nel","max_age":604800}
x-content-type-options
nosniff
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Thu, 17 Oct 2024 20:10:14 GMT
content-type
application/javascript
last-modified
Wed, 10 Jul 2024 21:30:20 GMT
vary
Accept-Encoding
priority
u=3,i=?0
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-security-policy
default-src 'self'
cache-control
public, max-age=86400, stale-if-error=3600
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray
8d42ee4e09bbd253-FRA
server
cloudflare
identifyEmail.latest.js
cdn.calibermind.com/js/
838 B
1 KB
Script
General
Full URL
https://cdn.calibermind.com/js/identifyEmail.latest.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-KGGXSJ
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3037::6815:2d74 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
cda851ced6071adcde40501c1c09e21fd48be1594567337f82711a6371b9779c
Security Headers
Name Value
Content-Security-Policy default-src 'self'
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/

Response headers

content-encoding
zstd
cf-cache-status
HIT
etag
W/"668efdda-346"
age
8045
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ETRBxCFThz%2FvH6%2B%2FpVrJQ%2F4CrnF%2BOXrdBhHBIAjywX0%2Bqwbh0BENqoUYyd%2FjNS6gJOejxFzZv%2BisKAJyOtd8PPy%2B13Hg3%2F%2FHdtbCHS9v3uR2WV7uI7GLpkt8F0TUjPCE2NbhUOBDhHm4a3rPwBkR%2FCvE"}],"group":"cf-nel","max_age":604800}
x-content-type-options
nosniff
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Thu, 17 Oct 2024 20:10:14 GMT
content-type
application/javascript
last-modified
Wed, 10 Jul 2024 21:32:10 GMT
vary
Accept-Encoding
priority
u=3,i=?0
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-security-policy
default-src 'self'
cache-control
public, max-age=86400, stale-if-error=3600
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray
8d42ee4e09bfd253-FRA
server
cloudflare
events.js
tags.srv.stackadapt.com/
22 KB
8 KB
Script
General
Full URL
https://tags.srv.stackadapt.com/events.js
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/black-basta-ransomware-attacks-deploy-custom-edr-evasion-tools-tied-to-fin7-threat-actor/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
3.127.102.30 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-127-102-30.eu-central-1.compute.amazonaws.com
Software
/
Resource Hash
ec4dbdae992689fd9e8c9112fb4797f7572be845d89a520720f6812fd1250412

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/

Response headers

access-control-allow-origin
*
cache-control
max-age=5
content-encoding
gzip
date
Thu, 17 Oct 2024 20:10:14 GMT
content-type
text/javascript
d16b1fea0b2ed64f.min.js
tag.demandbase.com/
61 KB
18 KB
Script
General
Full URL
https://tag.demandbase.com/d16b1fea0b2ed64f.min.js
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/black-basta-ransomware-attacks-deploy-custom-edr-evasion-tools-tied-to-fin7-threat-actor/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.245.46.22 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-245-46-22.fra56.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
f50dff16f81cf8eefabad78c1bd298fe5e7571e51720cb114575a1b4e8aba26a
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains; preload

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/

Response headers

content-encoding
gzip
x-amz-version-id
N2rb5lMV51RwbNUWzMvxWNf3Nzc5EPqh
etag
W/"1745d7ef3444455a72a3f86e4fb2ad07"
age
785
x-cache
Hit from cloudfront
x-amz-cf-id
lmzKG0ouA_BZDeQSzBxdtaEP-JnEz8nSZHEdW5Cw3j3pm1J_u2EIQg==
date
Thu, 17 Oct 2024 19:57:10 GMT
content-type
application/javascript; charset=utf-8
vary
Accept-Encoding
last-modified
Thu, 17 Oct 2024 13:53:58 GMT
strict-transport-security
max-age=63072000; includeSubDomains; preload
cache-control
public, max-age=3600
via
1.1 79d85d2de1f5aa38558ef6bab6274390.cloudfront.net (CloudFront)
permissions-policy
accelerometer=(), camera=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), payment=(), usb=(), interest-cohort=()
x-amz-cf-pop
FRA56-P9
server
AmazonS3
x-amz-server-side-encryption
AES256
o0e2bgdhqr
www.clarity.ms/tag/
553 B
808 B
Script
General
Full URL
https://www.clarity.ms/tag/o0e2bgdhqr?ref=gtm2
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/black-basta-ransomware-attacks-deploy-custom-edr-evasion-tools-tied-to-fin7-threat-actor/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2620:1ec:29:1::64 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
8ab232d682a75b56499f4fe5e41047ef641a3a493a71c6fac53d97e95eef6a7a

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/

Response headers

cache-control
no-cache, no-store
request-context
appId=cid-v1:3d284f99-f285-495c-ac33-dedd7ecf1ac8
expires
-1
accept-ranges
bytes
x-cache
CONFIG_NOCACHE
content-length
553
date
Thu, 17 Oct 2024 20:10:14 GMT
content-type
application/x-javascript
x-azure-ref
20241017T201014Z-166dfbc8549x82c885teg8rma8000000012000000000a14r
ga-audiences
www.google.de/ads/
42 B
63 B
Image
General
Full URL
https://www.google.de/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&tid=G-KJPGLC9EVP&cid=2086134053.1729195814&gtm=45je4ag0v889850326za200&aip=1&dma=1&dma_cps=syphamo&gcd=13l3l3l2l1l1&npa=1&frm=0&tag_exp=101686685&tag_exp=101686685&z=1601744085
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/black-basta-ransomware-attacks-deploy-custom-edr-evasion-tools-tied-to-fin7-threat-actor/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:809::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/

Response headers

cache-control
no-cache, no-store, must-revalidate
timing-allow-origin
*
pragma
no-cache
cross-origin-resource-policy
cross-origin
x-content-type-options
nosniff
expires
Fri, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length
42
date
Thu, 17 Oct 2024 20:10:14 GMT
x-xss-protection
0
content-type
image/gif
server
cafe
/
attr.ml-api.io/
Redirect Chain
  • https://s.ml-attr.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dwww.sentinelone.com%26pId%3d%24UID
  • https://secure.adnxs.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dwww.sentinelone.com%26pId%3d%24UID
  • https://secure.adnxs.com/bounce?%2Fgetuid%3Fhttps%253a%252f%252fattr.ml-api.io%252f%253fdomain%253dwww.sentinelone.com%2526pId%253d%2524UID
  • https://attr.ml-api.io/?domain=www.sentinelone.com&pId=6035139354339191431
4 B
280 B
Image
General
Full URL
https://attr.ml-api.io/?domain=www.sentinelone.com&pId=6035139354339191431
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/black-basta-ransomware-attacks-deploy-custom-edr-evasion-tools-tied-to-fin7-threat-actor/
Protocol
H2
Server
2600:9000:206f:3000:5:7a81:86c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/

Response headers

via
1.1 120ade321ed0e3697c81eb1eb19b5f62.cloudfront.net (CloudFront)
apigw-requestid
fz5OJgCnIAMESig=
alt-svc
h3=":443"; ma=86400
x-cache
Miss from cloudfront
content-length
4
x-amz-cf-id
jKqbswe3TmzvwsmG7C2DI5PzImXgE-Jf_knGUQZJ8mp2HbpMrkwB7w==
date
Thu, 17 Oct 2024 20:10:15 GMT
content-type
application/json
x-amz-cf-pop
FRA56-C1

Redirect headers

cache-control
no-store, no-cache, private
location
https://attr.ml-api.io/?domain=www.sentinelone.com&pId=6035139354339191431
pragma
no-cache
accept-ch
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials
true
x-proxy-origin
84.19.175.165; 84.19.175.165; 952.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
expires
Sat, 15 Nov 2008 16:00:00 GMT
access-control-allow-origin
*
an-x-request-uuid
1f1dc474-6f4e-44f4-a916-f1c3158e9ae3
content-length
0
p3p
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date
Thu, 17 Oct 2024 20:10:14 GMT
x-xss-protection
0
content-type
text/html; charset=utf-8
server
nginx/1.23.4
rt
tags.srv.stackadapt.com/
43 B
955 B
Image
General
Full URL
https://tags.srv.stackadapt.com/rt?sid=DIQlrAikIjHHohfyFxzIrn
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/black-basta-ransomware-attacks-deploy-custom-edr-evasion-tools-tied-to-fin7-threat-actor/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
3.127.102.30 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-127-102-30.eu-central-1.compute.amazonaws.com
Software
/
Resource Hash
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/

Response headers

date
Thu, 17 Oct 2024 20:10:14 GMT
content-type
image/gif
content-length
43
www-widgetapi.js
www.youtube.com/s/player/606a66b3/www-widgetapi.vflset/
31 KB
10 KB
Script
General
Full URL
https://www.youtube.com/s/player/606a66b3/www-widgetapi.vflset/www-widgetapi.js
Requested by
Host: www.youtube.com
URL: https://www.youtube.com/iframe_api
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80f::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
36cb859be5a639c678f317d76c5c589da1b5e08820fcce41d67c38b517efa959
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/

Response headers

content-encoding
br
age
45708
report-to
{"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]}
x-content-type-options
nosniff
expires
Fri, 17 Oct 2025 07:28:25 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Thu, 17 Oct 2024 07:28:25 GMT
last-modified
Thu, 17 Oct 2024 04:19:32 GMT
content-type
text/javascript
vary
Accept-Encoding, Origin
cache-control
public, max-age=31536000
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
cross-origin-opener-policy-report-only
same-origin; report-to="youtube"
content-length
10417
x-xss-protection
0
server
sffe
web
onesignal.com/api/v1/sync/acaf2329-c613-4dbe-a651-1ed5a45c3762/
3 KB
2 KB
Script
General
Full URL
https://onesignal.com/api/v1/sync/acaf2329-c613-4dbe-a651-1ed5a45c3762/web?callback=__jp0
Requested by
Host: cdn.onesignal.com
URL: https://cdn.onesignal.com/sdks/OneSignalPageSDKES6.js?v=151606
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700::6811:6fdf , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
ee809cafc1d4e863a8db2dc56f31461666e25ced4ca0e639afb284bab4e65787
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/

Response headers

x-request-id
6e6fe611-e674-4723-8b43-89c0f2cf1a7e
content-encoding
br
cf-bgj
minify
etag
W/"7c4e13f819a4814ba54f4177ea65ef2d"
age
334
cf-cache-status
HIT
x-permitted-cross-domain-policies
none
x-content-type-options
nosniff
expires
Thu, 17 Oct 2024 21:10:14 GMT
cf-polished
origSize=3446
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Thu, 17 Oct 2024 20:10:14 GMT
content-type
text/javascript; charset=utf-8
vary
Origin, Accept-Encoding
x-runtime
0.038296
x-frame-options
SAMEORIGIN
access-control-allow-headers
SDK-Version
strict-transport-security
max-age=15552000; includeSubDomains
cache-control
public, max-age=3600
referrer-policy
strict-origin-when-cross-origin
via
1.1 google
x-download-options
noopen
cf-ray
8d42ee4f28cadca4-FRA
access-control-allow-origin
*
x-xss-protection
1; mode=block
server
cloudflare
uid
ca.knock-ai.com/client/an/v1/
50 B
370 B
Fetch
General
Full URL
https://ca.knock-ai.com/client/an/v1/uid
Requested by
Host: js.knock-ai.com
URL: https://js.knock-ai.com/97ee7348-9176-4a4b-9af2-40711264546b.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:828::2013 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Frontend / Express
Resource Hash
5e86a39baf3ced06707f7fd04368c7e5b2bbc223e46678ce65b8de281496cfa8
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/

Response headers

strict-transport-security
max-age=15552000; includeSubDomains
x-request-id
2485e527-d748-4179-9b5c-08618f0ab148
cache-control
private, max-age=31536000, immutable
etag
aa306738a3b3e38a9844d5a14e6024b1
x-content-type-options
nosniff
access-control-allow-origin
*
content-length
50
date
Thu, 17 Oct 2024 20:10:14 GMT
content-type
text/html; charset=utf-8
x-powered-by
Express
server
Google Frontend
x-cloud-trace-context
9282af8a485f4cb9be9c8724b5c33a17
x-frame-options
SAMEORIGIN
ot_close.svg
cdn.cookielaw.org/logos/static/
651 B
601 B
Image
General
Full URL
https://cdn.cookielaw.org/logos/static/ot_close.svg
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/black-basta-ransomware-attacks-deploy-custom-edr-evasion-tools-tied-to-fin7-threat-actor/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:562a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
901bb0e03b8c3c0a1cf4c487a177417328bb7d8c94106ecefceedd7d7f6c4ddc
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/

Response headers

content-md5
pcXWFGpuVeSg/jVnYCseRg==
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
x-ms-version
2009-09-19
x-ms-lease-status
unlocked
cf-cache-status
HIT
age
78471
content-encoding
gzip
x-content-type-options
nosniff
date
Thu, 17 Oct 2024 20:10:13 GMT
content-type
image/svg+xml
last-modified
Wed, 16 Oct 2024 06:37:42 GMT
vary
Accept-Encoding
strict-transport-security
max-age=31536000; includeSubDomains; preload
cache-control
max-age=86400
cross-origin-resource-policy
cross-origin
x-ms-request-id
7b5cf61b-201e-001b-0ce1-1fbd18000000
cf-ray
8d42ee4ca931dc8e-FRA
access-control-allow-origin
*
x-ms-blob-type
BlockBlob
server
cloudflare
ot_guard_logo.svg
cdn.cookielaw.org/logos/static/
497 B
495 B
Fetch
General
Full URL
https://cdn.cookielaw.org/logos/static/ot_guard_logo.svg
Requested by
Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/202409.1.0/otBannerSdk.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:562a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
691dcdb24853a0f5ce4e6597e5713dea66799b57ffe2c2a10f28f98e0b569b19
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/

Response headers

content-md5
tXyZydHjxQshFMbbBT1/8A==
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
x-ms-version
2009-09-19
x-ms-lease-status
unlocked
cf-cache-status
HIT
age
45745
content-encoding
gzip
x-content-type-options
nosniff
date
Thu, 17 Oct 2024 20:10:13 GMT
content-type
image/svg+xml
last-modified
Wed, 16 Oct 2024 06:37:42 GMT
vary
Accept-Encoding
strict-transport-security
max-age=31536000; includeSubDomains; preload
cache-control
max-age=86400
cross-origin-resource-policy
cross-origin
x-ms-request-id
d9dd2877-d01e-0027-6ff5-1f09c3000000
cf-ray
8d42ee4cd90cdb03-FRA
access-control-allow-origin
*
x-ms-blob-type
BlockBlob
server
cloudflare
header-logo-dark.png
cdn.cookielaw.org/logos/32cb4128-496e-485c-a440-c1361261f0b9/01920551-70fc-76a4-a34b-902d0ad63828/1f67f62c-48f1-40a9-a4a9-418df05f10c8/
17 KB
17 KB
Image
General
Full URL
https://cdn.cookielaw.org/logos/32cb4128-496e-485c-a440-c1361261f0b9/01920551-70fc-76a4-a34b-902d0ad63828/1f67f62c-48f1-40a9-a4a9-418df05f10c8/header-logo-dark.png
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/black-basta-ransomware-attacks-deploy-custom-edr-evasion-tools-tied-to-fin7-threat-actor/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:562a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
5b1fc434d56eaa7f42c4d97a9c4b0e106f95d4453b8b7fa0a665ec5b79d7409e
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/

Response headers

content-md5
zP9vNoac0WWOsoM5qHSlqQ==
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
x-ms-version
2009-09-19
x-ms-lease-status
unlocked
etag
0x8DCD7E5B54439DF
age
85173
cf-cache-status
HIT
x-content-type-options
nosniff
date
Thu, 17 Oct 2024 20:10:13 GMT
content-type
mage/png
last-modified
Wed, 18 Sep 2024 13:27:56 GMT
vary
Accept-Encoding
strict-transport-security
max-age=31536000; includeSubDomains; preload
cache-control
max-age=86400
cross-origin-resource-policy
cross-origin
x-ms-request-id
e0125d72-801e-0095-09ce-09f2b9000000
cf-ray
8d42ee4cd9dcdc8e-FRA
accept-ranges
bytes
access-control-allow-origin
*
content-length
17475
x-ms-blob-type
BlockBlob
server
cloudflare
powered_by_logo.svg
cdn.cookielaw.org/logos/static/
5 KB
2 KB
Image
General
Full URL
https://cdn.cookielaw.org/logos/static/powered_by_logo.svg
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/black-basta-ransomware-attacks-deploy-custom-edr-evasion-tools-tied-to-fin7-threat-actor/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:562a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
5fa00d047acd959697b9d7772c31dcd37bec33c70c6fbf80ab8316205d1d286d
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/

Response headers

content-md5
Y+c301RBZNK39PvKQWrIBw==
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
x-ms-version
2009-09-19
x-ms-lease-status
unlocked
cf-cache-status
HIT
age
82334
content-encoding
gzip
x-content-type-options
nosniff
date
Thu, 17 Oct 2024 20:10:13 GMT
content-type
image/svg+xml
last-modified
Wed, 16 Oct 2024 06:37:43 GMT
vary
Accept-Encoding
strict-transport-security
max-age=31536000; includeSubDomains; preload
cache-control
max-age=86400
cross-origin-resource-policy
cross-origin
x-ms-request-id
324d4739-a01e-00a0-6e98-1f5cec000000
cf-ray
8d42ee4cd9dfdc8e-FRA
access-control-allow-origin
*
x-ms-blob-type
BlockBlob
server
cloudflare
forms2.min.js
go.sentinelone.com/js/forms2/js/ Frame C177
199 KB
0
Script
General
Full URL
https://go.sentinelone.com/js/forms2/js/forms2.min.js
Requested by
Host: go.sentinelone.com
URL: https://go.sentinelone.com/index.php/form/XDFrame
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
104.17.74.206 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
0602c4fb1597b7e6e111fe79777e195cacbc73774fcaf233a7835b33372dceae
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://go.sentinelone.com/index.php/form/XDFrame

Response headers

cache-control
public, max-age=14400
content-encoding
gzip
cf-cache-status
HIT
etag
"5c01fe-31b91-62370c030d900"
age
1328
x-content-type-options
nosniff
cf-ray
8d42ee494bfd8f3c-FRA
expires
Fri, 18 Oct 2024 00:10:13 GMT
date
Thu, 17 Oct 2024 20:10:13 GMT
content-type
application/x-javascript
last-modified
Tue, 01 Oct 2024 21:10:28 GMT
vary
Accept-Encoding
server
cloudflare
adsct
t.co/1/i/
43 B
629 B
Image
General
Full URL
https://t.co/1/i/adsct?bci=4&eci=3&event=%7B%7D&event_id=797672ac-2ba3-49b0-b22d-01ed42c407d6&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=cab70bf4-9e36-468b-9bf2-2fde72ae86b6&tw_document_href=https%3A%2F%2Fwww.sentinelone.com%2Flabs%2Fblack-basta-ransomware-attacks-deploy-custom-edr-evasion-tools-tied-to-fin7-threat-actor%2F&tw_iframe_status=0&txn_id=nv1yw&type=javascript&version=2.3.30
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/black-basta-ransomware-attacks-deploy-custom-edr-evasion-tools-tied-to-fin7-threat-actor/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
162.159.140.229 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare tsa_o /
Resource Hash
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
Security Headers
Name Value
Strict-Transport-Security max-age=0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/

Response headers

strict-transport-security
max-age=0
x-transaction-id
15ffa0cf28e31c34
cache-control
no-cache, no-store, max-age=0
x-connection-hash
944ba14bd125b66190b09ba5eb57207a6f716bd96915d8b7416339cd005f74e1
cf-cache-status
DYNAMIC
cf-ray
8d42ee500b4cd27d-FRA
x-response-time
172
content-length
43
date
Thu, 17 Oct 2024 20:10:14 GMT
content-type
image/gif;charset=utf-8
perf
7402827104
server
cloudflare tsa_o
adsct
analytics.twitter.com/1/i/
43 B
722 B
Image
General
Full URL
https://analytics.twitter.com/1/i/adsct?bci=4&eci=3&event=%7B%7D&event_id=797672ac-2ba3-49b0-b22d-01ed42c407d6&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=cab70bf4-9e36-468b-9bf2-2fde72ae86b6&tw_document_href=https%3A%2F%2Fwww.sentinelone.com%2Flabs%2Fblack-basta-ransomware-attacks-deploy-custom-edr-evasion-tools-tied-to-fin7-threat-actor%2F&tw_iframe_status=0&txn_id=nv1yw&type=javascript&version=2.3.30
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/black-basta-ransomware-attacks-deploy-custom-edr-evasion-tools-tied-to-fin7-threat-actor/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.244.42.131 , United States, ASN13414 (TWITTER, US),
Reverse DNS
Software
tsa_o /
Resource Hash
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
Security Headers
Name Value
Strict-Transport-Security max-age=631138519

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/

Response headers

strict-transport-security
max-age=631138519
x-transaction-id
102c95c836f8f0a8
cache-control
no-cache, no-store, max-age=0
x-connection-hash
b258bc44c748257c8c85b0ff59b7bdba1f91100ee62181f0a770b15a76bd2214
x-response-time
171
content-length
43
date
Thu, 17 Oct 2024 20:10:13 GMT
perf
7402827104
content-type
image/gif;charset=utf-8
server
tsa_o
munchkin.js
munchkin.marketo.net/163/
11 KB
5 KB
Script
General
Full URL
https://munchkin.marketo.net/163/munchkin.js
Requested by
Host: munchkin.marketo.net
URL: https://munchkin.marketo.net/munchkin.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
23.197.137.224 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-197-137-224.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
68cc280ce370c6f1f51a4fc5950103fc38df80a429552c549add04ebd8bd3a23

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/

Response headers

Cache-Control
max-age=8640000
Content-Encoding
gzip
ETag
"ea7826f34518d7c2295738f39c7640fa:1672972000.238769"
Connection
keep-alive
Expires
Sat, 25 Jan 2025 20:10:14 GMT
Accept-Ranges
bytes
P3P
policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR"
Content-Length
4741
Date
Thu, 17 Oct 2024 20:10:14 GMT
Content-Type
application/x-javascript
Last-Modified
Fri, 06 Jan 2023 02:26:40 GMT
Server
AkamaiNetStorage
Vary
Accept-Encoding
attribution_trigger
px.ads.linkedin.com/
2 B
1 KB
XHR
General
Full URL
https://px.ads.linkedin.com/attribution_trigger?pid=432890%2C5427652%2C5500618&time=1729195814194&url=https%3A%2F%2Fwww.sentinelone.com%2Flabs%2Fblack-basta-ransomware-attacks-deploy-custom-edr-evasion-tools-tied-to-fin7-threat-actor%2F
Requested by
Host: snap.licdn.com
URL: https://snap.licdn.com/li.lms-analytics/insight.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:21::14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Accept
*
Referer
https://www.sentinelone.com/

Response headers

content-encoding
gzip
x-li-fabric
prod-ltx1
report-to
{"group":"network-errors","max_age":2592000,"endpoints":[{"url":"https://www.linkedin.com/li/rep"}],"include_subdomains":true}
access-control-allow-methods
GET, OPTIONS
x-li-proto
http/2
x-cache
CONFIG_NOCACHE
date
Thu, 17 Oct 2024 20:10:13 GMT
content-type
application/json
access-control-allow-headers
*
x-li-pop
afd-prod-ltx1-x
nel
{"report_to":"network-errors","max_age":1296000,"success_fraction":0.00066,"failure_fraction":1,"include_subdomains":true}
x-fs-uuid
000624b1c64458f9e8b56d3076113be4
x-msedge-ref
Ref A: DC704AF336174892A369C4E2CE16592F Ref B: FRAEDGE1416 Ref C: 2024-10-17T20:10:14Z
x-restli-protocol-version
1.0.0
x-li-uuid
AAYkscZEWPnotW0wdhE75A==
access-control-allow-origin
*
collect
px4.ads.linkedin.com/
Redirect Chain
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=432890%2C5427652%2C5500618&time=1729195814194&url=https%3A%2F%2Fwww.sentinelone.com%2Flabs%2Fblack-basta-ransomware-attacks-deploy-custom-edr-evas...
  • https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=432890%2C5427652%2C5500618&time=1729195814194&url=https%3A%2F%2Fwww.sentinelone.com%2Flabs%2Fblack-basta-ransomware-attacks-deploy-custom-edr-eva...
0
263 B
Image
General
Full URL
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=432890%2C5427652%2C5500618&time=1729195814194&url=https%3A%2F%2Fwww.sentinelone.com%2Flabs%2Fblack-basta-ransomware-attacks-deploy-custom-edr-evasion-tools-tied-to-fin7-threat-actor%2F&e_ipv6=AQJqh03tYUWtiwAAAZKcGi4-QbrbXp39McS-Vc00RQTmTyrZ5NTbwtfaO-jJclTyV9HZ0KUaZ_gdKYBNEUhpj7Zydaa7xw
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/black-basta-ransomware-attacks-deploy-custom-edr-evasion-tools-tied-to-fin7-threat-actor/
Protocol
H2
Server
13.107.42.14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/

Response headers

linkedin-action
1
x-li-pop
afd-prod-ltx1-x
x-msedge-ref
Ref A: FDB330E8784D450CA397A21D1134D625 Ref B: FRAEDGE1106 Ref C: 2024-10-17T20:10:14Z
x-li-fabric
prod-ltx1
x-li-uuid
AAYkscZI62sMIQCDlPqiIA==
x-li-proto
http/2
x-cache
CONFIG_NOCACHE
content-length
0
date
Thu, 17 Oct 2024 20:10:14 GMT
content-type
application/javascript

Redirect headers

linkedin-action
1
x-li-pop
afd-prod-ltx1-x
location
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=432890%2C5427652%2C5500618&time=1729195814194&url=https%3A%2F%2Fwww.sentinelone.com%2Flabs%2Fblack-basta-ransomware-attacks-deploy-custom-edr-evasion-tools-tied-to-fin7-threat-actor%2F&e_ipv6=AQJqh03tYUWtiwAAAZKcGi4-QbrbXp39McS-Vc00RQTmTyrZ5NTbwtfaO-jJclTyV9HZ0KUaZ_gdKYBNEUhpj7Zydaa7xw
x-msedge-ref
Ref A: 0BCD6EF32CB84C3482860A7A7A3C0851 Ref B: DUS30EDGE0817 Ref C: 2024-10-17T20:10:14Z
x-li-fabric
prod-ltx1
x-li-uuid
AAYkscZEiCIcyh3eGz+TRA==
x-li-proto
http/2
x-cache
CONFIG_NOCACHE
content-length
0
date
Thu, 17 Oct 2024 20:10:14 GMT
/
px.ads.linkedin.com/wa/
0
622 B
XHR
General
Full URL
https://px.ads.linkedin.com/wa/
Requested by
Host: snap.licdn.com
URL: https://snap.licdn.com/li.lms-analytics/insight.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:21::14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Accept
*
Content-Type
text/plain;charset=UTF-8

Response headers

linkedin-action
1
x-li-pop
afd-prod-lor1-x
x-msedge-ref
Ref A: 278E85DEDD554DC49B257692029C56A9 Ref B: DUS30EDGE0817 Ref C: 2024-10-17T20:10:14Z
x-li-fabric
prod-lor1
access-control-allow-credentials
true
x-li-uuid
AAYkscZEs2VE6rqJptWitg==
x-li-proto
http/2
access-control-allow-origin
https://www.sentinelone.com
x-cache
CONFIG_NOCACHE
date
Thu, 17 Oct 2024 20:10:14 GMT
vary
Origin
ip.json
api.company-target.com/api/v2/
12 B
513 B
XHR
General
Full URL
https://api.company-target.com/api/v2/ip.json?referrer=&page=https%3A%2F%2Fwww.sentinelone.com%2Flabs%2Fblack-basta-ransomware-attacks-deploy-custom-edr-evasion-tools-tied-to-fin7-threat-actor%2F&page_title=Black%20Basta%20Ransomware%20%7C%20Attacks%20Deploy%20Custom%20EDR%20Evasion%20Tools%20Tied%20to%20FIN7%20Threat%20Actor%20-%20SentinelOne&src=tag&key=2d6b88616246999ce8cfbfe7f68278ba
Requested by
Host: scripts.demandbase.com
URL: https://scripts.demandbase.com/d6076494.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.102.75 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-102-75.fra56.r.cloudfront.net
Software
nginx /
Resource Hash
d089c8a9fc28e4e50223eb38c9409e362521be9380a37341304fbac7a4cd9e5f
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/

Response headers

access-control-max-age
7200
access-control-expose-headers
access-control-allow-methods
GET, POST, OPTIONS
x-content-type-options
nosniff
request-id
d3d29111-d4a4-4ab7-a08e-74627add8f65
x-cache
Error from cloudfront
x-amz-cf-id
iIn3lqqtev53ArUMeZyHX-eVbFNIwY8kpfgxu9_EXPyH3XpLJU8lgw==
date
Thu, 17 Oct 2024 20:10:14 GMT
content-type
text/plain;charset=utf-8
vary
Origin
www-authenticate
DemandBase API
access-control-allow-credentials
true
via
1.1 44b457512f742b4e48fc7f0c87d8ed92.cloudfront.net (CloudFront)
access-control-allow-origin
https://www.sentinelone.com
content-length
12
x-amz-cf-pop
FRA56-P2
server
nginx
demandbase
match.prod.bidr.io/cookie-sync/
Redirect Chain
  • https://match.prod.bidr.io/cookie-sync/demandbase
  • https://match.prod.bidr.io/cookie-sync/demandbase?_bee_ppp=1
27 B
27 B
Image
General
Full URL
https://match.prod.bidr.io/cookie-sync/demandbase?_bee_ppp=1
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/black-basta-ransomware-attacks-deploy-custom-edr-evasion-tools-tied-to-fin7-threat-actor/
Protocol
HTTP/1.1
Server
34.248.126.255 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-34-248-126-255.eu-west-1.compute.amazonaws.com
Software
gunicorn /
Resource Hash
0c3cea978a84b6745af467e270fefbe0436fabfb700cdf2d546f034753e20990
Security Headers
Name Value
Strict-Transport-Security max-age=2592000; includeSubDomains

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/

Response headers

strict-transport-security
max-age=2592000; includeSubDomains
Content-Length
27
Date
Thu, 17 Oct 2024 20:10:14 GMT
content-type
text/plain
Server
gunicorn
Connection
keep-alive

Redirect headers

strict-transport-security
max-age=2592000; includeSubDomains
location
https://match.prod.bidr.io/cookie-sync/demandbase?_bee_ppp=1
Content-Length
0
Date
Thu, 17 Oct 2024 20:10:14 GMT
Server
gunicorn
Connection
keep-alive
464526.gif
id.rlcdn.com/
0
98 B
Image
General
Full URL
https://id.rlcdn.com/464526.gif
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/black-basta-ransomware-attacks-deploy-custom-edr-evasion-tools-tied-to-fin7-threat-actor/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.244.174.68 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
68.174.244.35.bc.googleusercontent.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/

Response headers

via
1.1 google
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
date
Thu, 17 Oct 2024 20:10:14 GMT
134618848.js
bat.bing.com/p/action/
370 B
420 B
Script
General
Full URL
https://bat.bing.com/p/action/134618848.js
Requested by
Host: bat.bing.com
URL: https://bat.bing.com/bat.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2620:1ec:33::10 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
a791796f72eea3c5febcbe84acc17e5e8e434e71036ea481b168dc4f41f12a9c
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
cache-control
private,max-age=1800
content-encoding
br
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref
Ref A: B5E0D53531C54B9BBCD878EA1C2B9230 Ref B: FRA31EDGE0110 Ref C: 2024-10-17T20:10:14Z
x-cache
CONFIG_NOCACHE
date
Thu, 17 Oct 2024 20:10:13 GMT
content-type
application/javascript; charset=utf-8
vary
Accept-Encoding
pixel
q.quora.com/_/ad/ea333f827b114f8cb49ce787666ea90b/
43 B
273 B
Image
General
Full URL
https://q.quora.com/_/ad/ea333f827b114f8cb49ce787666ea90b/pixel?j=1&u=https%3A%2F%2Fwww.sentinelone.com%2Flabs%2Fblack-basta-ransomware-attacks-deploy-custom-edr-evasion-tools-tied-to-fin7-threat-actor%2F&tag=ViewContent&ts=1729195814250
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/black-basta-ransomware-attacks-deploy-custom-edr-evasion-tools-tied-to-fin7-threat-actor/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
162.159.152.17 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains; preload

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/

Response headers

strict-transport-security
max-age=63072000; includeSubDomains; preload
cf-cache-status
DYNAMIC
x-q-stat
,253a5512812f3efcaa812699e7234d52,10.0.0.113,58764,84.19.175.165,,51092086591,1,1729195814.410,0.003,,.,0,0,0.000,0.004,-,0,0,203,137,68,10,34729,,,,,,-,
cf-ray
8d42ee4fa89f1e0c-FRA
alt-svc
h3=":443"; ma=86400
content-length
43
date
Thu, 17 Oct 2024 20:10:14 GMT
content-type
image/gif
server
cloudflare
p
e.calibermind.com/v1/
16 B
622 B
Fetch
General
Full URL
https://e.calibermind.com/v1/p
Requested by
Host: cdn.calibermind.com
URL: https://cdn.calibermind.com/a.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3037::6815:2d74 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
c955e57777ec0d73639dca6748560d00aa5eb8e12f13ebb2ed9656add3908f97
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Content-Type
text/plain
Referer
https://www.sentinelone.com/

Response headers

access-control-max-age
900
x-request-id
af1ac286-7333-4382-b057-8cae99e1e048
cf-cache-status
DYNAMIC
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=TqW1emNTXF7e0fampnZyhPjOoXTFWP2DOOUBDwkzeVuOTGJMKuQJ0ZW8k4aOhs6PqlrehtxjjhZxuNvqBnd7vhwUF0BgSFkQxlnCfJVDiY3Myj2GxCNRr7Npa1KjZfupdOOwdj48Km3qH%2FQD7waj8g%3D%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options
nosniff
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Thu, 17 Oct 2024 20:10:14 GMT
content-type
application/json; charset=utf-8
priority
u=1,i
access-control-allow-headers
Content-Type,Authorization
strict-transport-security
max-age=31536000; includeSubDomains; preload
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray
8d42ee4ffe083a8e-FRA
access-control-allow-origin
*
content-length
16
server
cloudflare
visitWebPage
327-mnm-087.mktoresp.com/webevents/
2 B
318 B
Ping
General
Full URL
https://327-mnm-087.mktoresp.com/webevents/visitWebPage?_mchNc=1729195814268&_mchCn=&_mchId=327-MNM-087&_mchTk=_mch-sentinelone.com-1729195814264-38498&_mchHo=www.sentinelone.com&_mchPo=&_mchRu=%2Flabs%2Fblack-basta-ransomware-attacks-deploy-custom-edr-evasion-tools-tied-to-fin7-threat-actor%2F&_mchPc=https%3A&_mchVr=163&_mchEcid=&_mchHa=&_mchRe=&_mchQp=
Requested by
Host: munchkin.marketo.net
URL: https://munchkin.marketo.net/163/munchkin.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
192.28.144.124 , United States, ASN15224 (OMNITURE, US),
Reverse DNS
Software
nginx/1.20.1 /
Resource Hash
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/

Response headers

Transfer-Encoding
chunked
X-Request-Id
0fe24112-1c6d-402c-8e72-99a73a97e392
Content-Encoding
gzip
Connection
keep-alive
Access-Control-Allow-Origin
*
Date
Thu, 17 Oct 2024 20:10:15 GMT
Content-Type
text/plain; charset=UTF-8
Server
nginx/1.20.1
v1
ca.knock-ai.com/client/an/
0
0
Fetch
General
Full URL
https://ca.knock-ai.com/client/an/v1?clientId=97ee7348-9176-4a4b-9af2-40711264546b&version=1.1.1&revisionNumber=10&userId=2db30310-97f1-43bc-a923-49a8e5d83dc6.1729195814196&sessionId=102b5829-3c20-4cb5-ac41-9358338a8227&prevSessionStartTime=null&sessionStartTime=1729195814309&browser=Mozilla%2F5.0%20(X11%3B%20Linux%20x86_64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F129.0.0.0%20Safari%2F537.36&device=pc&os=Linux&pageNumber=1&pageVisit=https%3A%2F%2Fwww.sentinelone.com%2Flabs%2Fblack-basta-ransomware-attacks-deploy-custom-edr-evasion-tools-tied-to-fin7-threat-actor%2F&prevPageVisitStartTime=null&pageVisitStartTime=1729195814309&prevPageVisitEndTime=null&pageVisitEndTime=null&timestamp=1729195814309&utmSource=&utmMedium=&utmCampaign=&utmTerm=&utmContent=&referrerDomain=&referrerPath=&referrerUrl=Direct
Requested by
Host: js.knock-ai.com
URL: https://js.knock-ai.com/97ee7348-9176-4a4b-9af2-40711264546b.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:828::2013 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

0
bat.bing.com/action/
0
287 B
Image
General
Full URL
https://bat.bing.com/action/0?ti=134618848&tm=gtm002&Ver=2&mid=9bc74743-68b7-49a2-ae01-159e20ec7404&bo=1&sid=d21b1dc08cc311ef8b18f9fd26ce787b&vid=d21b0d508cc311ef9eecc722c6fbeaad&vids=1&msclkid=N&pi=918639831&lg=de-DE&sw=1600&sh=1200&sc=24&tl=Black%20Basta%20Ransomware%20%7C%20Attacks%20Deploy%20Custom%20EDR%20Evasion%20Tools%20Tied%20to%20FIN7%20Threat%20Actor%20-%20SentinelOne&p=https%3A%2F%2Fwww.sentinelone.com%2Flabs%2Fblack-basta-ransomware-attacks-deploy-custom-edr-evasion-tools-tied-to-fin7-threat-actor%2F&r=&lt=2225&evt=pageLoad&sv=1&cdb=AQET&rn=964512
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/black-basta-ransomware-attacks-deploy-custom-edr-evasion-tools-tied-to-fin7-threat-actor/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2620:1ec:33::10 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
cache-control
no-cache, must-revalidate
pragma
no-cache
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref
Ref A: B79FF693B5AC4259A7347C5ECA7E0E7B Ref B: FRA31EDGE0110 Ref C: 2024-10-17T20:10:14Z
expires
Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin
*
x-cache
CONFIG_NOCACHE
date
Thu, 17 Oct 2024 20:10:13 GMT
sa.css
tags.srv.stackadapt.com/
65 B
203 B
Stylesheet
General
Full URL
https://tags.srv.stackadapt.com/sa.css
Requested by
Host: tags.srv.stackadapt.com
URL: https://tags.srv.stackadapt.com/events.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
3.127.102.30 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-127-102-30.eu-central-1.compute.amazonaws.com
Software
/
Resource Hash
8a73c52c8dcf31907b545f1a6d5d8e5618f965017e35847275f7ea387b67304c

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/

Response headers

access-control-allow-origin
*
cache-control
only-if-cached, no-transform, private, max-age=7776000
content-length
65
date
Thu, 17 Oct 2024 20:10:14 GMT
content-type
text/css
sa.jpeg
tags.srv.stackadapt.com/
0
2 KB
Fetch
General
Full URL
https://tags.srv.stackadapt.com/sa.jpeg
Requested by
Host: tags.srv.stackadapt.com
URL: https://tags.srv.stackadapt.com/events.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
3.127.102.30 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-127-102-30.eu-central-1.compute.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/

Response headers

access-control-allow-origin
*
cache-control
only-if-cached, no-transform, private, max-age=7776000
content-length
651
date
Thu, 17 Oct 2024 20:10:14 GMT
content-type
image/jpeg
sa.jpeg
tags.srv.stackadapt.com/
0
0
Fetch
General
Full URL
https://tags.srv.stackadapt.com/sa.jpeg
Requested by
Host: tags.srv.stackadapt.com
URL: https://tags.srv.stackadapt.com/events.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
3.127.102.30 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-127-102-30.eu-central-1.compute.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/

Response headers

access-control-allow-origin
*
cache-control
only-if-cached, no-transform, private, max-age=7776000
content-length
651
date
Thu, 17 Oct 2024 20:10:14 GMT
content-type
image/jpeg
rt
tags.srv.stackadapt.com/
43 B
108 B
Image
General
Full URL
https://tags.srv.stackadapt.com/rt?sid=uQM497B9yR1fPnLLwZZDtK&url=https%3A%2F%2Fwww.sentinelone.com%2Flabs%2Fblack-basta-ransomware-attacks-deploy-custom-edr-evasion-tools-tied-to-fin7-threat-actor%2F&t=Black%20Basta%20Ransomware%20%7C%20Attacks%20Deploy%20Custom%20EDR%20Evasion%20Tools%20Tied%20to%20FIN7%20Threat%20Actor%20-%20SentinelOne&tip=NtELPYzrXF0Sqv9iPrkyM7xVd48WzLiybcLquwdr17w&l_src=&l_src_d=&u_src=&u_src_d=&shop=false
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/black-basta-ransomware-attacks-deploy-custom-edr-evasion-tools-tied-to-fin7-threat-actor/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
3.127.102.30 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-127-102-30.eu-central-1.compute.amazonaws.com
Software
/
Resource Hash
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/

Response headers

date
Thu, 17 Oct 2024 20:10:14 GMT
content-type
image/gif
content-length
43
OneSignalSDKStyles.css
onesignal.com/sdks/
82 KB
9 KB
Stylesheet
General
Full URL
https://onesignal.com/sdks/OneSignalSDKStyles.css?v=2
Requested by
Host: cdn.onesignal.com
URL: https://cdn.onesignal.com/sdks/OneSignalPageSDKES6.js?v=151606
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700::6811:6fdf , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
db7e0b393e175f19922fefbdcaa2866fca209c521d01cc834ae06cbf8d0f91b7
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/

Response headers

content-encoding
br
cf-cache-status
HIT
etag
W/"4e9aaefffd5f8ae7dc83361aa2294190"
age
992
expires
Sat, 16 Nov 2024 20:10:14 GMT
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Thu, 17 Oct 2024 20:10:14 GMT
content-type
text/css
vary
Accept-Encoding
access-control-allow-headers
OneSignal-Subscription-Id
strict-transport-security
max-age=15552000; includeSubDomains
cache-control
public, max-age=2592000
via
1.1 google
cf-ray
8d42ee507cb7dca4-FRA
server
cloudflare
icon
onesignal.com/api/v1/apps/acaf2329-c613-4dbe-a651-1ed5a45c3762/
240 B
809 B
Fetch
General
Full URL
https://onesignal.com/api/v1/apps/acaf2329-c613-4dbe-a651-1ed5a45c3762/icon
Requested by
Host: cdn.onesignal.com
URL: https://cdn.onesignal.com/sdks/OneSignalPageSDKES6.js?v=151606
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700::6811:6fdf , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
c30dc39ff7449779c568ff4e90c170f01eae00486dc5b5e6595656d0c517439a
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/

Response headers

x-request-id
710424ca-f1b4-42ce-ab29-7d83ed1cc524
content-encoding
br
cf-cache-status
REVALIDATED
etag
W/"c30dc39ff7449779c568ff4e90c170f0"
x-permitted-cross-domain-policies
none
x-content-type-options
nosniff
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Thu, 17 Oct 2024 20:10:14 GMT
content-type
application/json; charset=utf-8
vary
Accept, Origin, Accept-Encoding
x-runtime
0.022399
access-control-allow-headers
SDK-Version
x-frame-options
SAMEORIGIN
strict-transport-security
max-age=15552000; includeSubDomains
cache-control
max-age=0, private, must-revalidate
referrer-policy
strict-origin-when-cross-origin
x-download-options
noopen
via
1.1 google
cf-ray
8d42ee511c3c3a7c-FRA
access-control-allow-origin
*
x-xss-protection
1; mode=block
server
cloudflare
saq_pxl
tags.srv.stackadapt.com/
213 B
410 B
XHR
General
Full URL
https://tags.srv.stackadapt.com/saq_pxl?uid=_Cv1ULrV9dssq6yGX6-Dzw&is_js=true&landing_url=https%3A%2F%2Fwww.sentinelone.com%2Flabs%2Fblack-basta-ransomware-attacks-deploy-custom-edr-evasion-tools-tied-to-fin7-threat-actor%2F&t=Black%20Basta%20Ransomware%20%7C%20Attacks%20Deploy%20Custom%20EDR%20Evasion%20Tools%20Tied%20to%20FIN7%20Threat%20Actor%20-%20SentinelOne&tip=NtELPYzrXF0Sqv9iPrkyM7xVd48WzLiybcLquwdr17w&host=https%3A%2F%2Fwww.sentinelone.com&sa_conv_data_css_value=%270-a67ac11d-950b-5c13-7b69-6bf5d760397f%27&sa_conv_data_image_value=ffd8ffe000104a46494600010101006000600000ffdb004300080606070605080707070909080a0c140d0c0b0b0c1912130f141d1a1f1e1d1a1c1c20242e2720222c231c1c2837292c30313434341f27393d38323c2e333432ffdb0043010909090c0b0c180d0d1832211c213232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232ffc00011080001000103012200021101031101ffc4001f0000010501010101010100000000000000000102030405060708090a0bffc400b5100002010303020403050504040000017d01020300041105122131410613516107227114328191a1082342b1c11552d1f02433627282090a161718191a25262728292a3435363738393a434445464748494a535455565758595a636465666768696a737475767778797a838485868788898a92939495969798999aa2a3a4a5a6a7a8a9aab2b3b4b5b6b7b8b9bac2c3c4c5c6c7c8c9cad2d3d4d5d6d7d8d9dae1e2e3e4e5e6e7e8e9eaf1f2f3f4f5f6f7f8f9faffc4001f0100030101010101010101010000000000000102030405060708090a0bffc400b51100020102040403040705040400010277000102031104052131061241510761711322328108144291a1b1c109233352f0156272d10a162434e125f11718191a262728292a35363738393a434445464748494a535455565758595a636465666768696a737475767778797a82838485868788898a92939495969798999aa2a3a4a5a6a7a8a9aab2b3b4b5b6b7b8b9bac2c3c4c5c6c7c8c9cad2d3d4d5d6d7d8d9dae2e3e4e5e6e7e8e9eaf2f3f4f5f6f7f8f9faffda000c03010002110311003f00f7fa28a2803fffd9a67ac11d950b5c137b696bf5d760397f5413afa5&l_src=&l_src_d=&u_src=&u_src_d=&shop=false&sa-user-id-v3=s%253AAQAKIElOXdSZ7By4WPEYVi5UFYA4BZ_Nk0uvFs4tzLYfp2HYENYBGAQgpt7FuAYwAToEQN4Ii0IEe1MS_w.qdhbJJyGn3%252BpZQEWR43JRF7M7hweCJ8fcp0mb6ztosU&sa-user-id-v2=s%253ApnrBHZULXBN7aWv112A5f1QTr6U.U%252F8P9YYW%252FZqVt5V%252BtWaldUFXHq4YLzy%252BZ%252B%252BqpI5oJOA&sa-user-id=s%253A0-a67ac11d-950b-5c13-7b69-6bf5d760397f.vWBp0UfZTSjm3JthhYD60q5jhePTFKXdPmI4qAhLG%252Bc
Requested by
Host: tags.srv.stackadapt.com
URL: https://tags.srv.stackadapt.com/events.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
3.127.102.30 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-127-102-30.eu-central-1.compute.amazonaws.com
Software
/
Resource Hash
8878bfedd760d2b890a0c7979d06850f45090fbcf75faa3cfae8f8787479516b

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/

Response headers

access-control-allow-methods
GET
access-control-allow-origin
https://www.sentinelone.com
content-length
213
date
Thu, 17 Oct 2024 20:10:14 GMT
content-type
text/plain; charset=utf-8
access-control-allow-credentials
true
access-control-allow-headers
*
saq_pxl
tags.srv.stackadapt.com/
213 B
410 B
XHR
General
Full URL
https://tags.srv.stackadapt.com/saq_pxl?uid=_Cv1ULrV9dssq6yGX6-Dzw&is_js=true&landing_url=https%3A%2F%2Fwww.sentinelone.com%2Flabs%2Fblack-basta-ransomware-attacks-deploy-custom-edr-evasion-tools-tied-to-fin7-threat-actor%2F&t=Black%20Basta%20Ransomware%20%7C%20Attacks%20Deploy%20Custom%20EDR%20Evasion%20Tools%20Tied%20to%20FIN7%20Threat%20Actor%20-%20SentinelOne&tip=NtELPYzrXF0Sqv9iPrkyM7xVd48WzLiybcLquwdr17w&host=https%3A%2F%2Fwww.sentinelone.com&sa_conv_data_Event%20Name=mkto.form.success&sa_conv_data_css_value=&sa_conv_data_image_value=ffd8ffe000104a46494600010101006000600000ffdb004300080606070605080707070909080a0c140d0c0b0b0c1912130f141d1a1f1e1d1a1c1c20242e2720222c231c1c2837292c30313434341f27393d38323c2e333432ffdb0043010909090c0b0c180d0d1832211c213232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232ffc00011080001000103012200021101031101ffc4001f0000010501010101010100000000000000000102030405060708090a0bffc400b5100002010303020403050504040000017d01020300041105122131410613516107227114328191a1082342b1c11552d1f02433627282090a161718191a25262728292a3435363738393a434445464748494a535455565758595a636465666768696a737475767778797a838485868788898a92939495969798999aa2a3a4a5a6a7a8a9aab2b3b4b5b6b7b8b9bac2c3c4c5c6c7c8c9cad2d3d4d5d6d7d8d9dae1e2e3e4e5e6e7e8e9eaf1f2f3f4f5f6f7f8f9faffc4001f0100030101010101010101010000000000000102030405060708090a0bffc400b51100020102040403040705040400010277000102031104052131061241510761711322328108144291a1b1c109233352f0156272d10a162434e125f11718191a262728292a35363738393a434445464748494a535455565758595a636465666768696a737475767778797a82838485868788898a92939495969798999aa2a3a4a5a6a7a8a9aab2b3b4b5b6b7b8b9bac2c3c4c5c6c7c8c9cad2d3d4d5d6d7d8d9dae2e3e4e5e6e7e8e9eaf2f3f4f5f6f7f8f9faffda000c03010002110311003f00f7fa28a2803fffd9a67ac11d950b5c137b696bf5d760397f5413afa5&l_src=&l_src_d=&u_src=&u_src_d=&shop=false&sa-user-id-v3=s%253AAQAKIElOXdSZ7By4WPEYVi5UFYA4BZ_Nk0uvFs4tzLYfp2HYENYBGAQgpt7FuAYwAToEQN4Ii0IEe1MS_w.qdhbJJyGn3%252BpZQEWR43JRF7M7hweCJ8fcp0mb6ztosU&sa-user-id-v2=s%253ApnrBHZULXBN7aWv112A5f1QTr6U.U%252F8P9YYW%252FZqVt5V%252BtWaldUFXHq4YLzy%252BZ%252B%252BqpI5oJOA&sa-user-id=s%253A0-a67ac11d-950b-5c13-7b69-6bf5d760397f.vWBp0UfZTSjm3JthhYD60q5jhePTFKXdPmI4qAhLG%252Bc
Requested by
Host: tags.srv.stackadapt.com
URL: https://tags.srv.stackadapt.com/events.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
3.127.102.30 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-127-102-30.eu-central-1.compute.amazonaws.com
Software
/
Resource Hash
8878bfedd760d2b890a0c7979d06850f45090fbcf75faa3cfae8f8787479516b

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/

Response headers

access-control-allow-methods
GET
access-control-allow-origin
https://www.sentinelone.com
content-length
213
date
Thu, 17 Oct 2024 20:10:14 GMT
content-type
text/plain; charset=utf-8
access-control-allow-credentials
true
access-control-allow-headers
*
clarity.js
www.clarity.ms/s/0.7.48/
64 KB
27 KB
Script
General
Full URL
https://www.clarity.ms/s/0.7.48/clarity.js
Requested by
Host: www.clarity.ms
URL: https://www.clarity.ms/tag/o0e2bgdhqr?ref=gtm2
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2620:1ec:29:1::64 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
36b4b4c6757a5d380d22a491759f8a72f54b16791387c3826e69d2546208d4f4

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/

Response headers

x-azure-ref
20241017T201014Z-166dfbc8549x82c885teg8rma8000000012000000000a14u
cache-control
public, max-age=86400
x-ms-version
2018-03-28
content-encoding
br
etag
W/"0x8DCEE2357C4857E"
x-fd-int-roxy-purgeid
51562430
x-ms-request-id
e3cf8459-401e-0078-0425-208d23000000
access-control-allow-origin
*
x-cache
TCP_HIT
date
Thu, 17 Oct 2024 20:10:14 GMT
content-type
application/javascript;charset=utf-8
vary
Accept-Encoding
last-modified
Wed, 16 Oct 2024 20:44:34 GMT
wINUGMVQyKNdKtMTH4Wt_s1.png
img.onesignal.com/permanent/43c3ad2d-0a70-4421-8189-b15392c350e5/
6 KB
7 KB
Image
General
Full URL
https://img.onesignal.com/permanent/43c3ad2d-0a70-4421-8189-b15392c350e5/wINUGMVQyKNdKtMTH4Wt_s1.png
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/black-basta-ransomware-attacks-deploy-custom-edr-evasion-tools-tied-to-fin7-threat-actor/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700::6810:a091 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
fc11ae1919d2e054d5af3535739aaa85f73f873bc49253cfd54ac332fdcfd94f
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/

Response headers

x-goog-metageneration
1
x-goog-hash
crc32c=1QkUUA==, md5=Dj+SUoicGnX7oiG7n37+GQ==
cf-bgj
imgq:85,h2pri
etag
"-CPLdwrW3woQDEAE="
age
3213
cf-cache-status
HIT
x-goog-stored-content-encoding
identity
expires
Sun, 17 Nov 2024 20:10:14 GMT
cf-polished
origSize=11143, status=vary_header_present
alt-svc
h3=":443"; ma=86400
x-goog-stored-content-length
11143
date
Thu, 17 Oct 2024 20:10:14 GMT
content-type
image/png
last-modified
Fri, 23 Feb 2024 21:44:25 GMT
vary
Origin, Accept-Encoding
x-guploader-uploadid
ACJd0Nr8tSiz3DerHL1t9Wk5lUUY2CKQgXUOacmnmMzVybyyZ1wC89j4uhK6KUvhNvF8d1ed1_IpiPuJsg
strict-transport-security
max-age=15552000; includeSubDomains
cache-control
public, max-age=2678400
pragma
no-cache
x-goog-storage-class
STANDARD
cf-ray
8d42ee51dd609079-FRA
x-goog-encryption-kms-key-name
projects/core-infra-onesignal/locations/europe-west4/keyRings/keyring-kms-onesignal/cryptoKeys/img-persistence-bucket-onesignal/cryptoKeyVersions/1
accept-ranges
bytes
x-goog-generation
1708724665233138
content-length
6492
server
cloudflare
collect
z.clarity.ms/
0
283 B
XHR
General
Full URL
https://z.clarity.ms/collect
Requested by
Host: www.clarity.ms
URL: https://www.clarity.ms/s/0.7.48/clarity.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
20.10.16.51 Boydton, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Accept
application/x-clarity-gzip
Referer
https://www.sentinelone.com/

Response headers

Request-Context
appId=cid-v1:67bc0b23-8423-4b52-b1ca-6a87709ceaa2
Access-Control-Allow-Origin
https://www.sentinelone.com
Date
Thu, 17 Oct 2024 20:10:15 GMT
Vary
Origin
Server
nginx
Connection
keep-alive
Access-Control-Allow-Credentials
true
/
www.googleadservices.com/pagead/conversion/970186784/
5 KB
3 KB
Script
General
Full URL
https://www.googleadservices.com/pagead/conversion/970186784/?random=1729195818964&cv=11&fst=1729195818964&bg=ffffff&guid=ON&async=1&gtm=45be4ag0v890159661z871208095za201zb71208095&gcd=13l3l3l2l1l1&dma_cps=syphamo&dma=1&tag_exp=101686685&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.sentinelone.com%2Flabs%2Fblack-basta-ransomware-attacks-deploy-custom-edr-evasion-tools-tied-to-fin7-threat-actor%2F&label=P7U6CJqLydsBEKDAz84D&hn=www.googleadservices.com&frm=0&tiba=Black%20Basta%20Ransomware%20%7C%20Attacks%20Deploy%20Custom%20EDR%20Evasion%20Tools%20Tied%20to%20FIN7%20Threat%20Actor%20-%20SentinelOne&value=0&bttype=purchase&npa=1&pscdl=noapi&auid=1238549638.1729195814&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fdr=CA&capi=1&rfmt=3&fmt=4
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/destination?id=AW-970186784&l=dataLayer&cx=c
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.181.226 -, , ASN (),
Reverse DNS
Software
cafe /
Resource Hash
0664732f3ec8bfcc4892bf8f698e48540e22ea358b44d8a2b6ed44da0ab13243
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/

Response headers

cache-control
no-cache, must-revalidate
timing-allow-origin
*
content-encoding
br
pragma
no-cache
cross-origin-resource-policy
cross-origin
x-content-type-options
nosniff
expires
Fri, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length
2786
date
Thu, 17 Oct 2024 20:10:19 GMT
x-xss-protection
0
content-type
text/javascript; charset=UTF-8
content-disposition
attachment; filename="f.txt"
server
cafe
activityi;dc_pre=CLuQr7SclokDFbqHgwcd4voGcQ;src=13115870;type=pagev0;cat=reque0;ord=%5BSessionID%5D;npa=1;auiddc=1238549638.1729195814;ps=1;pcor=165679221;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;ua...
13115870.fls.doubleclick.net/ Frame 1177
Redirect Chain
  • https://13115870.fls.doubleclick.net/activityi;src=13115870;type=pagev0;cat=reque0;ord=%5BSessionID%5D;npa=1;auiddc=1238549638.1729195814;ps=1;pcor=165679221;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=...
  • https://13115870.fls.doubleclick.net/activityi;dc_pre=CLuQr7SclokDFbqHgwcd4voGcQ;src=13115870;type=pagev0;cat=reque0;ord=%5BSessionID%5D;npa=1;auiddc=1238549638.1729195814;ps=1;pcor=165679221;uaa=;...
0
0
Document
General
Full URL
https://13115870.fls.doubleclick.net/activityi;dc_pre=CLuQr7SclokDFbqHgwcd4voGcQ;src=13115870;type=pagev0;cat=reque0;ord=%5BSessionID%5D;npa=1;auiddc=1238549638.1729195814;ps=1;pcor=165679221;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=noapi;frm=0;gtm=45fe4ag0v9135076156za200;gcd=13l3l3l2l1l1;dma_cps=syphamo;dma=1;tag_exp=101686685;epver=2;~oref=https%3A%2F%2Fwww.sentinelone.com%2Flabs%2Fblack-basta-ransomware-attacks-deploy-custom-edr-evasion-tools-tied-to-fin7-threat-actor%2F?
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=DC-13115870
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.185.198 -, , ASN (),
Reverse DNS
Software
cafe /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=21600
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.sentinelone.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
private, max-age=0
content-encoding
br
content-length
413
content-type
text/html; charset=UTF-8
cross-origin-resource-policy
cross-origin
date
Thu, 17 Oct 2024 20:10:19 GMT
expires
Thu, 17 Oct 2024 20:10:19 GMT
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server
cafe
strict-transport-security
max-age=21600
timing-allow-origin
*
x-content-type-options
nosniff
x-xss-protection
0

Redirect headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
no-cache, must-revalidate
content-length
0
content-type
text/html; charset=UTF-8
cross-origin-resource-policy
cross-origin
date
Thu, 17 Oct 2024 20:10:19 GMT
expires
Fri, 01 Jan 1990 00:00:00 GMT
follow-only-when-prerender-shown
1
location
https://13115870.fls.doubleclick.net/activityi;dc_pre=CLuQr7SclokDFbqHgwcd4voGcQ;src=13115870;type=pagev0;cat=reque0;ord=%5BSessionID%5D;npa=1;auiddc=1238549638.1729195814;ps=1;pcor=165679221;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=noapi;frm=0;gtm=45fe4ag0v9135076156za200;gcd=13l3l3l2l1l1;dma_cps=syphamo;dma=1;tag_exp=101686685;epver=2;~oref=https%3A%2F%2Fwww.sentinelone.com%2Flabs%2Fblack-basta-ransomware-attacks-deploy-custom-edr-evasion-tools-tied-to-fin7-threat-actor%2F?
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma
no-cache
server
cafe
strict-transport-security
max-age=21600
timing-allow-origin
*
x-content-type-options
nosniff
x-xss-protection
0
/
px4.ads.linkedin.com/collect/
Redirect Chain
  • https://px.ads.linkedin.com/collect/?pid=432890&conversionId=2402852&fmt=gif
  • https://px4.ads.linkedin.com/collect/?pid=432890&conversionId=2402852&fmt=gif&e_ipv6=AQI5tqhfRMih6QAAAZKcGkBM_yzA3pRPHF4q-DwrSeMSnWAzeZspvnTtNuuUJTLs9oLLTDpZJr-JmnuEJflE6_lPZ8YH-Q
43 B
483 B
Image
General
Full URL
https://px4.ads.linkedin.com/collect/?pid=432890&conversionId=2402852&fmt=gif&e_ipv6=AQI5tqhfRMih6QAAAZKcGkBM_yzA3pRPHF4q-DwrSeMSnWAzeZspvnTtNuuUJTLs9oLLTDpZJr-JmnuEJflE6_lPZ8YH-Q
Protocol
H2
Server
13.107.42.14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/

Response headers

linkedin-action
1
x-li-pop
afd-prod-lor1-x
nel
{"report_to":"network-errors","max_age":1296000,"success_fraction":0.00066,"failure_fraction":1,"include_subdomains":true}
content-encoding
gzip
x-msedge-ref
Ref A: 991682DE76874AA2B9D0E9D7661F5BDD Ref B: FRAEDGE1106 Ref C: 2024-10-17T20:10:19Z
x-li-fabric
prod-lor1
report-to
{"group":"network-errors","max_age":2592000,"endpoints":[{"url":"https://www.linkedin.com/li/rep"}],"include_subdomains":true}
x-li-uuid
AAYkscaOAKdr7RYZmOf3NA==
x-li-proto
http/2
x-cache
CONFIG_NOCACHE
content-length
65
date
Thu, 17 Oct 2024 20:10:18 GMT
content-type
image/gif
vary
Accept-Encoding

Redirect headers

linkedin-action
1
x-li-pop
afd-prod-lor1-x
nel
{"report_to":"network-errors","max_age":1296000,"success_fraction":0.00066,"failure_fraction":1,"include_subdomains":true}
location
https://px4.ads.linkedin.com/collect/?pid=432890&conversionId=2402852&fmt=gif&e_ipv6=AQI5tqhfRMih6QAAAZKcGkBM_yzA3pRPHF4q-DwrSeMSnWAzeZspvnTtNuuUJTLs9oLLTDpZJr-JmnuEJflE6_lPZ8YH-Q
x-msedge-ref
Ref A: 4453114F73794E798D84706547CE6907 Ref B: DUS30EDGE0817 Ref C: 2024-10-17T20:10:18Z
x-li-fabric
prod-lor1
report-to
{"group":"network-errors","max_age":2592000,"endpoints":[{"url":"https://www.linkedin.com/li/rep"}],"include_subdomains":true}
x-li-uuid
AAYkscaLDCZCAeNaIzM91w==
x-li-proto
http/2
x-cache
CONFIG_NOCACHE
content-length
0
date
Thu, 17 Oct 2024 20:10:18 GMT
activity;register_conversion=1;src=13115870;type=pagev0;cat=reque0;ord=%5BSessionID%5D;npa=1;auiddc=1238549638.1729195814;ps=1;pcor=165679221;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=noa...
ad.doubleclick.net/
0
23 B
Image
General
Full URL
https://ad.doubleclick.net/activity;register_conversion=1;src=13115870;type=pagev0;cat=reque0;ord=%5BSessionID%5D;npa=1;auiddc=1238549638.1729195814;ps=1;pcor=165679221;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=noapi;frm=0;gtm=45fe4ag0v9135076156za200;gcd=13l3l3l2l1l1;dma_cps=syphamo;dma=1;tag_exp=101686685;epver=2;~oref=https%3A%2F%2Fwww.sentinelone.com%2Flabs%2Fblack-basta-ransomware-attacks-deploy-custom-edr-evasion-tools-tied-to-fin7-threat-actor%2F?
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.185.102 -, , ASN (),
Reverse DNS
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/

Response headers

cache-control
no-cache, must-revalidate
timing-allow-origin
*
pragma
no-cache
cross-origin-resource-policy
cross-origin
x-content-type-options
nosniff
expires
Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length
0
date
Thu, 17 Oct 2024 20:10:19 GMT
attribution-reporting-register-trigger
{"aggregatable_deduplication_keys":[{"deduplication_key":"15109324674213337774"}],"aggregatable_trigger_data":[{"filters":[{"14":["14055451"]}],"key_piece":"0x812407c2a617327a","source_keys":["12","13","14","15","16","17","18","19","20","21"]},{"key_piece":"0xc230a7493740b9f3","not_filters":{"14":["14055451"]},"source_keys":["12","13","14","15","16","17","18","19","20","21"]}],"aggregatable_values":{"12":65,"13":65,"14":65,"15":6356,"16":65,"17":65,"18":6356,"19":65,"20":65,"21":6356},"aggregation_coordinator_origin":"https://publickeyservice.msmt.aws.privacysandboxservices.com","debug_key":"12342748117749315930","debug_reporting":true,"event_trigger_data":[{"deduplication_key":"15109324674213337774","filters":[{"14":["14055451"],"source_type":["event"]}],"priority":"10","trigger_data":"1"},{"deduplication_key":"15109324674213337774","filters":[{"14":["14055451"],"source_type":["navigation"]}],"priority":"10","trigger_data":"6"},{"deduplication_key":"15109324674213337774","filters":[{"source_type":["event"]}],"priority":"0","trigger_data":"0"},{"deduplication_key":"15109324674213337774","filters":[{"source_type":["navigation"]}],"priority":"0","trigger_data":"7"}],"filters":{"8":["13115870"]}}
content-type
image/png
x-xss-protection
0
server
cafe
0
bat.bing.com/action/
0
237 B
Image
General
Full URL
https://bat.bing.com/action/0?ti=134618848&tm=gtm002&Ver=2&mid=9bc74743-68b7-49a2-ae01-159e20ec7404&bo=2&sid=d21b1dc08cc311ef8b18f9fd26ce787b&vid=d21b0d508cc311ef9eecc722c6fbeaad&vids=0&msclkid=N&el=Submit%20lead%20form&gc=USD&tpp=1&ea=resource_lead&en=Y&p=https%3A%2F%2Fwww.sentinelone.com%2Flabs%2Fblack-basta-ransomware-attacks-deploy-custom-edr-evasion-tools-tied-to-fin7-threat-actor%2F&sw=1600&sh=1200&sc=24&evt=custom&cdb=AQET&rn=829061
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2620:1ec:33::10 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
cache-control
no-cache, must-revalidate
pragma
no-cache
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref
Ref A: D5BD89B99DF64FA286A7837A89F454BB Ref B: FRA31EDGE0110 Ref C: 2024-10-17T20:10:19Z
expires
Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin
*
x-cache
CONFIG_NOCACHE
date
Thu, 17 Oct 2024 20:10:18 GMT
/
www.google.de/pagead/1p-conversion/970186784/
Redirect Chain
  • https://googleads.g.doubleclick.net/pagead/viewthroughconversion/970186784/?random=250992568&cv=11&fst=1729195818964&bg=ffffff&guid=ON&async=1&gtm=45be4ag0v890159661z871208095za201zb71208095&gcd=13...
  • https://www.google.com/pagead/1p-conversion/970186784/?random=250992568&cv=11&fst=1729195818964&bg=ffffff&guid=ON&async=1&gtm=45be4ag0v890159661z871208095za201zb71208095&gcd=13l3l3l2l1l1&dma_cps=sy...
  • https://www.google.de/pagead/1p-conversion/970186784/?random=250992568&cv=11&fst=1729195818964&bg=ffffff&guid=ON&async=1&gtm=45be4ag0v890159661z871208095za201zb71208095&gcd=13l3l3l2l1l1&dma_cps=syp...
42 B
64 B
Image
General
Full URL
https://www.google.de/pagead/1p-conversion/970186784/?random=250992568&cv=11&fst=1729195818964&bg=ffffff&guid=ON&async=1&gtm=45be4ag0v890159661z871208095za201zb71208095&gcd=13l3l3l2l1l1&dma_cps=syphamo&dma=1&tag_exp=101686685&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.sentinelone.com%2Flabs%2Fblack-basta-ransomware-attacks-deploy-custom-edr-evasion-tools-tied-to-fin7-threat-actor%2F&label=P7U6CJqLydsBEKDAz84D&hn=www.googleadservices.com&frm=0&tiba=Black%20Basta%20Ransomware%20%7C%20Attacks%20Deploy%20Custom%20EDR%20Evasion%20Tools%20Tied%20to%20FIN7%20Threat%20Actor%20-%20SentinelOne&value=0&npa=1&pscdl=noapi&auid=1238549638.1729195814&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fdr=CA&capi=1&fmt=3&ct_cookie_present=false&crd=CLHBsQIIsMGxAgi5wbECCLHDsQIIisWxAgjCybECCMPJsQJKFXRyaWdnZXIsIGV2ZW50LXNvdXJjZVoDCgEBYgQKAgID&pscrd=IhMIpNyutJyWiQMVRIeDBx1qWiPZMgIIAzICCAQyAggHMgIICDICCAkyAggKMgIIAjICCAsyAggVMgIIHzICCBMyAggSOhxodHRwczovL3d3dy5zZW50aW5lbG9uZS5jb20vQlZDaEFJOE92Q3VBWVF6WW5QcS1Pcng5RkVFaXdBc3ROaXFCMVVUY1VfTU94ZGRVNFFEMXJ3cFM3ZUZlQzllMXM2NnVLVE5POWR6aW11clB4cGxWQkx4Zw&is_vtc=1&cid=CAQSGwDpaXnfEAIK7TuxMqplHHKcV0LFAL2rTTyVXA&eitems=ChAI8OvCuAYQ7_LO19D0loACEh0AesaD7zb2T9JBhpXSc8P3cdJRpAfyIM0fgo-z5Q&random=3874956410&ipr=y
Protocol
H3
Server
2a00:1450:4001:809::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/

Response headers

content-security-policy
script-src 'none'; object-src 'none'
cache-control
no-cache, no-store, must-revalidate
timing-allow-origin
*
pragma
no-cache
cross-origin-resource-policy
cross-origin
x-content-type-options
nosniff
expires
Fri, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length
42
date
Thu, 17 Oct 2024 20:10:19 GMT
x-xss-protection
0
content-type
image/gif
server
cafe

Redirect headers

content-security-policy
script-src 'none'; object-src 'none'
cache-control
no-cache, no-store, must-revalidate
timing-allow-origin
*
location
https://www.google.de/pagead/1p-conversion/970186784/?random=250992568&cv=11&fst=1729195818964&bg=ffffff&guid=ON&async=1&gtm=45be4ag0v890159661z871208095za201zb71208095&gcd=13l3l3l2l1l1&dma_cps=syphamo&dma=1&tag_exp=101686685&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.sentinelone.com%2Flabs%2Fblack-basta-ransomware-attacks-deploy-custom-edr-evasion-tools-tied-to-fin7-threat-actor%2F&label=P7U6CJqLydsBEKDAz84D&hn=www.googleadservices.com&frm=0&tiba=Black%20Basta%20Ransomware%20%7C%20Attacks%20Deploy%20Custom%20EDR%20Evasion%20Tools%20Tied%20to%20FIN7%20Threat%20Actor%20-%20SentinelOne&value=0&npa=1&pscdl=noapi&auid=1238549638.1729195814&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fdr=CA&capi=1&fmt=3&ct_cookie_present=false&crd=CLHBsQIIsMGxAgi5wbECCLHDsQIIisWxAgjCybECCMPJsQJKFXRyaWdnZXIsIGV2ZW50LXNvdXJjZVoDCgEBYgQKAgID&pscrd=IhMIpNyutJyWiQMVRIeDBx1qWiPZMgIIAzICCAQyAggHMgIICDICCAkyAggKMgIIAjICCAsyAggVMgIIHzICCBMyAggSOhxodHRwczovL3d3dy5zZW50aW5lbG9uZS5jb20vQlZDaEFJOE92Q3VBWVF6WW5QcS1Pcng5RkVFaXdBc3ROaXFCMVVUY1VfTU94ZGRVNFFEMXJ3cFM3ZUZlQzllMXM2NnVLVE5POWR6aW11clB4cGxWQkx4Zw&is_vtc=1&cid=CAQSGwDpaXnfEAIK7TuxMqplHHKcV0LFAL2rTTyVXA&eitems=ChAI8OvCuAYQ7_LO19D0loACEh0AesaD7zb2T9JBhpXSc8P3cdJRpAfyIM0fgo-z5Q&random=3874956410&ipr=y
pragma
no-cache
cross-origin-resource-policy
cross-origin
x-content-type-options
nosniff
expires
Fri, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length
42
date
Thu, 17 Oct 2024 20:10:19 GMT
x-xss-protection
0
content-type
image/gif
server
cafe
collect
z.clarity.ms/
0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
cdn.abrankings.com
URL
https://cdn.abrankings.com/js/client.js
Domain
z.clarity.ms
URL
https://z.clarity.ms/collect

Verdicts & Comments Add Verdict or Comment

100 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| 1 object| 2 object| NREUM object| webpackChunk:NRBA-1.268.0.PROD object| newrelic function| FontFaceObserver function| OptanonWrapper object| OtTrustedType function| $ function| jQuery object| MktoForms2 function| documentInitOneSignal function| OneSignal function| gtag object| dataLayer string| OnetrustActiveGroups string| OptanonActiveGroups object| otStubData function| ClipboardJS object| lazyLoadInstance function| checkPageScroll function| LazyLoad function| WOW object| Apologetic object| Autopop object| FormGCLID object| GlobalMediaViewer object| PathFactoryUtils object| UtmLinks object| wow object| swiper object| hljs object| MarkerAnimation function| Swiper object| AmazonPolly object| Highlighter object| Magnifier object| TableOfContents object| Tooltip function| addCaptchaScript object| Optanon object| OneTrust object| google_tag_manager object| google_tag_data object| Cookies object| freeEditElems string| _linkedin_partner_id object| _linkedin_data_partner_ids function| qp function| onYouTubeIframeAPIReady object| gaGlobal number| abr_id function| twq object| analytics function| saq function| _saq function| lintrk function| clarity object| zi string| ZIProjectKey object| scriptUrl object| ttPolicy object| YT object| YTConfig function| onYTReady object| expireIn number| __oneSignalSdkLoadCount object| _oneSignalInitOptions function| __jp0 number| __knock_is_running object| regeneratorRuntime object| twttr function| mktoMunchkinFunction object| Munchkin function| mktoMunchkin boolean| _already_called_lintrk object| ORIBILI function| __extends object| Demandbase object| __db function| DBSegment function| ga function| UET function| UET_init function| UET_push object| webpackChunk_ion_builder_server object| __SEGMENT_INSPECTOR__ object| ueto_4da10f9244 object| uetq object| qevents object| MunchkinTracker string| res string| current_window_url_param object| saCookies object| GooglebQhCsO object| regexThatChecksForEmail function| calibermindCaptureSubmit function| calibermindAddFormListener number| r

39 Cookies

Domain/Path Name / Value
.sentinelone.com/ Name: __cfredirector_sm
Value: DE
.go.sentinelone.com/ Name: __cf_bm
Value: cslJbqICygw0uCaEVLfWrlyWy3945q4W1V748nQYgc0-1729195813-1.0.1.1-unTsgNyTj17FwhuUCjymPnNG1aConln2aZKvuaP9Rs._Eci.c6vPbZYQW3CSB3ps9DgpMdEe7oshh4MFWosv_A
.onesignal.com/ Name: __cf_bm
Value: yy6eO3FnFwXWzwtxjz71OgNTucXQ13fY5qnRyl8ikwc-1729195813-1.0.1.1-UyDuAwVxv1kkb0fTUjSPVXRZLyBRymFlvxR23ese77deD3OMzejsr95Va8DQkx1iD3ILPz361zz48BYEZgTIzw
.youtube.com/ Name: YSC
Value: PzNja6Q8rek
.youtube.com/ Name: VISITOR_INFO1_LIVE
Value: Af6ujWTQr-s
.youtube.com/ Name: VISITOR_PRIVACY_METADATA
Value: CgJERRIEEgAgQw%3D%3D
.sentinelone.com/ Name: _gcl_au
Value: 1.1.1238549638.1729195814
.sentinelone.com/ Name: _ga_KJPGLC9EVP
Value: GS1.1.1729195813.1.0.1729195813.60.0.0
.sentinelone.com/ Name: _ga
Value: GA1.1.2086134053.1729195814
.sentinelone.com/ Name: OptanonConsent
Value: isGpcEnabled=0&datestamp=Thu+Oct+17+2024+22%3A10%3A13+GMT%2B0200+(Mitteleurop%C3%A4ische+Sommerzeit)&version=202409.1.0&browserGpcFlag=0&isIABGlobal=false&hosts=&landingPath=https%3A%2F%2Fwww.sentinelone.com%2Flabs%2Fblack-basta-ransomware-attacks-deploy-custom-edr-evasion-tools-tied-to-fin7-threat-actor%2F&groups=C0003%3A0%2CC0001%3A1%2CC0002%3A0%2CC0004%3A0
.sentinelone.com/ Name: ajs_anonymous_id
Value: d72542a8-06b0-4b32-931d-447d53651e40
tags.srv.stackadapt.com/ Name: sa-user-id
Value: s%3A0-a67ac11d-950b-5c13-7b69-6bf5d760397f.vWBp0UfZTSjm3JthhYD60q5jhePTFKXdPmI4qAhLG%2Bc
.srv.stackadapt.com/ Name: sa-user-id
Value: s%3A0-a67ac11d-950b-5c13-7b69-6bf5d760397f.vWBp0UfZTSjm3JthhYD60q5jhePTFKXdPmI4qAhLG%2Bc
tags.srv.stackadapt.com/ Name: sa-user-id-v2
Value: s%3ApnrBHZULXBN7aWv112A5f1QTr6U.U%2F8P9YYW%2FZqVt5V%2BtWaldUFXHq4YLzy%2BZ%2B%2BqpI5oJOA
.srv.stackadapt.com/ Name: sa-user-id-v2
Value: s%3ApnrBHZULXBN7aWv112A5f1QTr6U.U%2F8P9YYW%2FZqVt5V%2BtWaldUFXHq4YLzy%2BZ%2B%2BqpI5oJOA
.sentinelone.com/ Name: _mkto_trk
Value: id:327-MNM-087&token:_mch-sentinelone.com-1729195814264-38498
go.sentinelone.com/ Name: BIGipServerab14web-nginx-app_https
Value: !qUxrYxAkQ3AAommwZJ6CmE6tjLF6/8kl3tuL42lDjxnofSZjrOGmA6I5fnq834jq36AMFMLQdjL5hLI=
tags.srv.stackadapt.com/ Name: sa-user-id-v3
Value: s%3AAQAKIElOXdSZ7By4WPEYVi5UFYA4BZ_Nk0uvFs4tzLYfp2HYENYBGAQgpt7FuAYwAToEQN4Ii0IEe1MS_w.qdhbJJyGn3%2BpZQEWR43JRF7M7hweCJ8fcp0mb6ztosU
.srv.stackadapt.com/ Name: sa-user-id-v3
Value: s%3AAQAKIElOXdSZ7By4WPEYVi5UFYA4BZ_Nk0uvFs4tzLYfp2HYENYBGAQgpt7FuAYwAToEQN4Ii0IEe1MS_w.qdhbJJyGn3%2BpZQEWR43JRF7M7hweCJ8fcp0mb6ztosU
.sentinelone.com/ Name: _uetsid
Value: d21b1dc08cc311ef8b18f9fd26ce787b
.sentinelone.com/ Name: _uetvid
Value: d21b0d508cc311ef9eecc722c6fbeaad
www.sentinelone.com/ Name: sa-user-id
Value: s%253A0-a67ac11d-950b-5c13-7b69-6bf5d760397f.vWBp0UfZTSjm3JthhYD60q5jhePTFKXdPmI4qAhLG%252Bc
www.sentinelone.com/ Name: sa-user-id-v2
Value: s%253ApnrBHZULXBN7aWv112A5f1QTr6U.U%252F8P9YYW%252FZqVt5V%252BtWaldUFXHq4YLzy%252BZ%252B%252BqpI5oJOA
www.sentinelone.com/ Name: sa-user-id-v3
Value: s%253AAQAKIElOXdSZ7By4WPEYVi5UFYA4BZ_Nk0uvFs4tzLYfp2HYENYBGAQgpt7FuAYwAToEQN4Ii0IEe1MS_w.qdhbJJyGn3%252BpZQEWR43JRF7M7hweCJ8fcp0mb6ztosU
.bing.com/ Name: MUID
Value: 3608E3DF78B36054174AF6C4791F6174
.linkedin.com/ Name: bcookie
Value: "v=2&512fb9cc-d722-419a-8d7b-199668b7a2b5"
.linkedin.com/ Name: li_gc
Value: MTswOzE3MjkxOTU4MTQ7MjswMjEYlyebJx0+SBWbfB+MRcxNLT5dVgD7ORDatcHD8M+gNg==
.linkedin.com/ Name: lidc
Value: "b=OGST06:s=O:r=O:a=O:p=O:g=3105:u=1:x=1:i=1729195814:t=1729282214:v=2:sig=AQGbu_HTb-rYQY7VcAQxFUxtfO5wmf-y"
.twitter.com/ Name: guest_id_marketing
Value: v1%3A172919581443628936
.twitter.com/ Name: guest_id_ads
Value: v1%3A172919581443628936
.twitter.com/ Name: personalization_id
Value: "v1_mMJ2COZuUzRVyzezB3m8Gw=="
.twitter.com/ Name: guest_id
Value: v1%3A172919581443628936
.t.co/ Name: muc_ads
Value: c6d34fd0-7c09-487c-b62e-5f7a2d4aead4
.t.co/ Name: __cf_bm
Value: 16l.PzxVkxBLgdK7KEIODvmP54xiKG5pEzbhG8n211k-1729195814-1.0.1.1-SQVTbAqXZxzSqBAeFWYWYMVMymjGXKAvFjSLNrtPD3oJsqYHuk1dmYXqm6zcDT9KKg8GjuOFfgoeFk6TQnLLXA
.bidr.io/ Name: bito
Value: AACtzk7OIt4AABWT9C60JQ
.bidr.io/ Name: bitoIsSecure
Value: ok
.adnxs.com/ Name: XANDR_PANID
Value: q5mKAH-JCgwCmDtk12RccWFeocTcCo84o46AatgrXLYfflG-q4dWTi5o3S2xUOrXecUf746yYX1eDqqVoW-2d-WNBZgQ5pe7235Us-lCBTU.
.adnxs.com/ Name: receive-cookie-deprecation
Value: 1
.adnxs.com/ Name: uuid2
Value: 6035139354339191431

3 Console Messages

Source Level URL
Text
network error URL: https://id.rlcdn.com/464526.gif
Message:
Failed to load resource: the server responded with a status of 451 ()
network error URL: https://api.company-target.com/api/v2/ip.json?referrer=&page=https%3A%2F%2Fwww.sentinelone.com%2Flabs%2Fblack-basta-ransomware-attacks-deploy-custom-edr-evasion-tools-tied-to-fin7-threat-actor%2F&page_title=Black%20Basta%20Ransomware%20%7C%20Attacks%20Deploy%20Custom%20EDR%20Evasion%20Tools%20Tied%20to%20FIN7%20Threat%20Actor%20-%20SentinelOne&src=tag&key=2d6b88616246999ce8cfbfe7f68278ba
Message:
Failed to load resource: the server responded with a status of 401 ()
network error URL: https://match.prod.bidr.io/cookie-sync/demandbase?_bee_ppp=1
Message:
Failed to load resource: the server responded with a status of 400 (Bad Request)

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Content-Security-Policy object-src 'none'; script-src 'unsafe-eval' https://snap.licdn.com/ https://cdn.calibermind.com/ https://a.quora.com/ https://app.cdn.lookbookhq.com/ https://connect.facebook.net/ https://ct.capterra.com/ https://ga.clearbit.com/ https://js.adsrvr.org/ https://munchkin.brightfunnel.com/ https://munchkin.marketo.net/ https://static.ads-twitter.com/ 'unsafe-inline' http://schema.org https://*.cloudfront.net/ https://*.googletagmanager.com https://a.omappapi.com/ https://analytics.twitter.com/ https://bat.bing.com/ https://cdn.abrankings.com https://cdn.abrankings.com/ https://cdn.cookielaw.org/ https://cdn.datatables.net/ https://cdn.jsdelivr.net/ https://cdn.onesignal.com/ https://cdnjs.cloudflare.com/ https://cloud.typography.com/ https://code.jquery.com/ https://collector-5527.tvsquared.com/ https://fonts.googleapis.com/ https://go.sentinelone.com/ https://googleads.g.doubleclick.net/ https://j.6sc.co/ https://js.maxmind.com/ https://js.qualified.com/ https://onesignal.com/ https://pixel-geo.prfct.co/ https://platform-api.sharethis.com/ https://platform.twitter.com/ https://pt.ispot.tv/ https://pubads.g.doubleclick.net/ https://px.spiceworks.com/ https://script.hotjar.com/ https://scripts.demandbase.com/ https://sentinelone.com https://ssl.google-analytics.com https://staging.s1preview.com/ https://static.hotjar.com/ https://tag.marinsm.com/ https://ws.qualified.com/ https://www.clickcease.com/ https://www.google-analytics.com https://www.google-analytics.com/ https://www.google.com/* https://www.googleoptimize.com/ https://www.googletagmanager.com/ https://www.googletagmanager.com/* https://www.redditstatic.com/ https://www.vantajs.com/ https://www.youtube.com/ https://yoast.com/ https://www.google.com/ https://qualified.com/ https://www.vantajs.com/ https://js.maxmind.com/ https://cdn.onesignal.com/ https://cdn.datatables.net/ https://platform-api.sharethis.com/ https://yoast.com/ https://fonts.googleapis.com/ https://cdn.datatables.net/ https://js-agent.newrelic.com/ https://www.sentinelone.com/ https://boards.greenhouse.io/ https://ajax.cloudflare.com/ https://www.googleadservices.com/ https://bam.nr-data.net/ https://cdn.linkedin.oribi.io/ https://fr.sentinelone.com/ https://it.sentinelone.com/ https://jp.sentinelone.com/ https://de.sentinelone.com/ https://it.sentinelone.com/ https://es.sentinelone.com/ https://nl.sentinelone.com/ https://kr.sentinelone.com/ https://www.google.it/ https://www.google.co.jp/ https://www.google.de/ https://ar.sentinelone.com/ https://www.google.es/ https://www.google.fr/ https://www.google.nl/ https://sonix.ai https://bam.nr-data.net/ https://docs.google.com/ https://apis.google.com/js/api.js/ https://accounts.google.com/ https://*.googleapis.com *.google.com https://*.gstatic.com https://sheets.googleapis.com/ https://tags.srv.stackadapt.com/events.js https://js.storylane.io/ https://qvdt3feo.com/ https://javascript.heeet.io/ https://api.brightfunnel.com https://a23gjzphzj.execute-api.us-east-1.amazonaws.com/ https://geolocation.onetrust.com/ https://js-agent.newrelic.com/ https://www.gstatic.com/ https://tag.demandbase.com/ https://cdnjs.com/libraries/Chart.js js.knock-ai.com https://www.clarity.ms https://js.zi-scripts.com/ https://ws.zoominfo.com/ https://tags.clickagy.com/ blob: https://ws-assets.zoominfo.com/ https://app.optimizely.com/ https://cdn.optimizely.com/ https://logx.optimizely.com/; frame-ancestors 'self' http://sentinelone.lookbookhq.com https://sentinelone.lookbookhq.com http://sentinelone.pathfactory.com https://sentinelone.pathfactory.com http://assets.sentinelone.com https://assets.sentinelone.com https://app.scalyr.com https://app.eu.scalyr.com localhost https://a23gjzphzj.execute-api.us-east-1.amazonaws.com/;
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

13115870.fls.doubleclick.net
327-mnm-087.mktoresp.com
a.quora.com
ad.doubleclick.net
ajax.googleapis.com
analytics.twitter.com
api.company-target.com
attr.ml-api.io
bat.bing.com
ca.knock-ai.com
cdn.abrankings.com
cdn.calibermind.com
cdn.cookielaw.org
cdn.onesignal.com
de.sentinelone.com
e.calibermind.com
geolocation.onetrust.com
go.sentinelone.com
googleads.g.doubleclick.net
id.rlcdn.com
img.onesignal.com
js.knock-ai.com
match.prod.bidr.io
munchkin.marketo.net
onesignal.com
px.ads.linkedin.com
px4.ads.linkedin.com
q.quora.com
region1.analytics.google.com
s.ml-attr.com
s1.ai
scripts.demandbase.com
secure.adnxs.com
snap.licdn.com
static.ads-twitter.com
stats.g.doubleclick.net
t.co
tag.demandbase.com
tags.srv.stackadapt.com
www.clarity.ms
www.google.com
www.google.de
www.googleadservices.com
www.googletagmanager.com
www.sentinelone.com
www.youtube.com
z.clarity.ms
cdn.abrankings.com
z.clarity.ms
104.17.74.206
104.244.42.131
13.107.42.14
142.250.181.226
142.250.185.102
142.250.185.198
146.75.120.157
162.159.140.229
162.159.152.17
172.67.74.101
18.245.46.22
18.66.102.75
185.89.210.82
192.28.144.124
20.10.16.51
2001:4860:4802:34::36
23.197.137.224
2600:9000:206f:3000:5:7a81:86c0:93a1
2606:4700:3037::6815:2d74
2606:4700:4400::6812:2089
2606:4700::6810:a091
2606:4700::6811:6fdf
2606:4700::6812:562a
2620:12a:8001::2
2620:1ec:21::14
2620:1ec:29:1::64
2620:1ec:33::10
2a00:1450:4001:809::2003
2a00:1450:4001:80b::2004
2a00:1450:4001:80f::200e
2a00:1450:4001:810::2002
2a00:1450:4001:81c::2008
2a00:1450:4001:828::200a
2a00:1450:4001:828::2013
2a00:1450:400c:c00::9c
2a02:26f0:3500:10::210:a99
3.127.102.30
34.248.126.255
34.49.80.229
35.244.174.68
52.72.49.79
68.67.153.60
015717b702e6dfd080cc346b8b2b5d5b4db7bfe1d9488b75d2dc8d9689721ae1
020d6d7eb17714f84a3c9f9b64ac17e1ef7a2eedcb9bf6e2158805c57c5d8fce
03a716d58d312f56961da36cf9e9bd2694ba3d0fa9b18c5ebe271d7021b82953
03e377433b486e0c6a44a700671e7fcfbc2d6925a9b2f9753c49976c7ad612d5
0602c4fb1597b7e6e111fe79777e195cacbc73774fcaf233a7835b33372dceae
0664732f3ec8bfcc4892bf8f698e48540e22ea358b44d8a2b6ed44da0ab13243
0c3cea978a84b6745af467e270fefbe0436fabfb700cdf2d546f034753e20990
0cfc74f37470c666d6ac10d4d7a933b923c13b29879134c0866c7de7dcee0310
137d9e5a6f1b7e9290a7d0962fc1690b6d0c76532b741e8fb15174f1a19b4432
187392c32fe1b13fb5ff82fb3a06fecc9cb0403ce52c85285840880c55fdd745
1c570dd4adca2dfe60c33196ca65c06ecab4a580b494816003e123c7d813d701
2157361193375a79ade3559e960f982daa8d599cf7f4a92d36e3eef257738f16
256e42104f48a5fa80b031da12dc56acde224fba3f9810f8f8192b39136d365a
2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8
28949ace3235b8211febce28af89ee677531171c3b55897172657102b63592fd
2bb77ccea217302a762a4def45fa0e2437fafac19f02bd36465455d6c8ca47c9
34e435ba7c6172be5ab366a13b6df04fec9078cf076dadd56aac48b54463efff
36b4b4c6757a5d380d22a491759f8a72f54b16791387c3826e69d2546208d4f4
36cb859be5a639c678f317d76c5c589da1b5e08820fcce41d67c38b517efa959
400b1bd0090434d34677fe377b9f8936edf5c5a8a38088949d4f6a12d723d930
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
444c83e95470e69f7355fcdb3a370c872025ae298b139090ff9f194ce28dea5b
4d15ff2317e16ccd8ca1d3248fea7d91130e022369bb032824a84ad9967064df
5206536707c84baa892d3c3231b351985ee828cb8b9c0bd8db42cd3363995fc4
5466092ef0deb16007dc2e8e61eb345b380ab6663bd3ef41808ffb7360abd61a
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3
575eff3e047a9c0474b49fcda2be6d87ae4b9f54a06f021a1be27951e8e6d33c
57cd46adbabd6c40823602b4513aecbe89320a769572255272abe9f008de69fa
5af5ee0b37b1f0ef31c42932bbf81424e4bb53e95e87a47e058625c1af2245db
5b1fc434d56eaa7f42c4d97a9c4b0e106f95d4453b8b7fa0a665ec5b79d7409e
5e43a9e7c42b23467f4766b5dc3a85f8ac62c75c2d5c064dd0c0d6205b287961
5e86a39baf3ced06707f7fd04368c7e5b2bbc223e46678ce65b8de281496cfa8
5fa00d047acd959697b9d7772c31dcd37bec33c70c6fbf80ab8316205d1d286d
64d117a5cdaf7b8aa3bc5ff1abeec0e1d98b834782d49f34260c4e1ecc7ec4c2
67418e79f1c8689e34cd9c68f1d5300f627d85e59c22d70abf8cde80b02067b9
68cc280ce370c6f1f51a4fc5950103fc38df80a429552c549add04ebd8bd3a23
691dcdb24853a0f5ce4e6597e5713dea66799b57ffe2c2a10f28f98e0b569b19
700c8bd73d93522ca53cdc35e2a71e96caf7c344bc7a8391f3af90c10b917033
758b336b8291c58c944b1d40afd4469609c946ac427f33baac4ea0d5c2ed6fdd
785d3e9ea187b7242e1a4365a48c3fd95dd7a469245d24c6769b8d46c4ef4b81
7a5d0f939c5224a8efb5b96759dd0509360b5d071774bb702f788f37a00a8426
7bfd314ec46e5dc42fbf2037344e20bb95068e0f972aaf26707a4afaaaea6da0
7c2092048f21074425f3e025db78fb6505f75d6fcf2e121ced055c8d53bcb1b3
81a50b09cb85e4ff68788f763b8dcdc549414cecf42ca228a55ab77c971f1286
8878bfedd760d2b890a0c7979d06850f45090fbcf75faa3cfae8f8787479516b
892945e6a4027d08293e591e6faa11e061feec51b40fcb6abe1e5fe7164db47f
89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7
8a27dc7b44ebe886390bfa0a9beeea36ea5a3f37479f0e0836b6c9b80d9b35ed
8a73c52c8dcf31907b545f1a6d5d8e5618f965017e35847275f7ea387b67304c
8ab232d682a75b56499f4fe5e41047ef641a3a493a71c6fac53d97e95eef6a7a
901bb0e03b8c3c0a1cf4c487a177417328bb7d8c94106ecefceedd7d7f6c4ddc
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7
a7612cda562abb7a2e8ba8ff60d66230e02077e218980f4293422ce4c8e0369c
a791796f72eea3c5febcbe84acc17e5e8e434e71036ea481b168dc4f41f12a9c
a8242b675ce39cfb1121740543c6e812490465c7c63858f7c77bcf217fcd4433
aabc88a6db8b22022f96ca88e4f0a7be426abef2b35169a71515a2d55246402a
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
adc0e2dacc10d6d2acec5ffc5b5346f30a3424ea0bfccff7b902b6a594878a18
b5580705563824650857de2856ef8469e280ab28a55ab75dbf7c2b45e53ac59c
c30dc39ff7449779c568ff4e90c170f01eae00486dc5b5e6595656d0c517439a
c3a2f8ef206c54e505719cbdfe2f7c5732d80d4e01ab277b2f869acb3d062497
c3d3036fdbd771d327ee2e9262a86eef41f96c3bffcc7adad2a91a651968923b
c5589064355e3df666b6be1e23c86166dfdac76c7f58d08ed867331fdbb4fe7c
c955e57777ec0d73639dca6748560d00aa5eb8e12f13ebb2ed9656add3908f97
ca8e60ba9a281ae41f019d64c681ba7b523d7b9c839db4d41eb042dcbaad8b7a
ccaae5e62c78d26325715270ac2020ad20a76efd572c7f4dd9ac8bf1bef7538c
cda851ced6071adcde40501c1c09e21fd48be1594567337f82711a6371b9779c
d0647d8975d5c92ea700e635befca523c5aac18754b8454d954909fe070e68cc
d089c8a9fc28e4e50223eb38c9409e362521be9380a37341304fbac7a4cd9e5f
d890abf66010907c7a0a61236d25c3c98bcb7edec34b13dc887f5be122bfef7e
d8f9afbf492e4c139e9d2bcb9ba6ef7c14921eb509fb703bc7a3f911b774eff8
db7e0b393e175f19922fefbdcaa2866fca209c521d01cc834ae06cbf8d0f91b7
de51ba53b38ba54ff68c8d8446802ae1a917d5c456494d88e3bb9d488dc605b9
e37e43924f0555458b8962330df115f258eafd68b9bed969938e0331f998c014
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e7db3ac042c15868e3c056ca476b6796182d2a7e752ae60aebf4ba300311777e
eae2c34014a512a5bebe4a87261c00c87807d4d185dfe1bc0cc09eae0592e6ae
ebdc7e18fd394f6ad9ab51f71d49a95c2f1aaa12c35167862ca6ab05dc39565e
ec4dbdae992689fd9e8c9112fb4797f7572be845d89a520720f6812fd1250412
ec8b1b07980996f574075e1b7e895d5d47794b9dcf345a68d60fbb17034f7bef
ecc7c26a43679259a01ee94bc695526738ac84a3f4db727ebd7e2cc5b571f853
ee809cafc1d4e863a8db2dc56f31461666e25ced4ca0e639afb284bab4e65787
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
efad755939e511f2bc1feb0d58d6014006e8598a4d431f27a66dd59e14fc19cb
f4aa58ca80a157a7094443dc0eb57a6da3b3b639b8b7df19dd18a874d167ba9d
f50dff16f81cf8eefabad78c1bd298fe5e7571e51720cb114575a1b4e8aba26a
f81a622d5550eb9220a609e964745dca5fa20a4b36594863a916a46af58eeb4b
f97c33a0d47b04256842d5e0fe975b4d6a6dd91ad35de032f9df63d0dbef1816
fc11ae1919d2e054d5af3535739aaa85f73f873bc49253cfd54ac332fdcfd94f