www.cybereason.com Open in urlscan Pro
45.60.64.106 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://www.cybereason.com/blog/cuckoo-spear-pt2-threat-actor-arsenal
Submission Tags: @nominet_threat_intel feedly-filtered-v1.0 reference_article_link confidence_null cluster_37144552 Search All
Submission: On October 05 via api (October 5th 2024, 3:46:53 pm UTC) from GB — Scanned from GB

Summary HTTP 155 Redirects Links 14 Behaviour Indicators

Summary

This website contacted 49 IPs in 5 countries across 37 domains to perform 155 HTTP transactions. The main IP is 45.60.64.106, located in United States and belongs to INCAPSULA, US. The main domain is www.cybereason.com.
TLS certificate: Issued by GeoTrust TLS RSA CA G1 on May 2nd 2024. Valid for: a year.

This is the only time www.cybereason.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
32	45.60.64.106 45.60.64.106	19551 (INCAPSULA) (INCAPSULA)
27	104.18.91.62 104.18.91.62	13335 (CLOUDFLAR...) (CLOUDFLARENET)
9	2a02:26f0:350... 2a02:26f0:3500:16::215:148f	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	2a00:1450:400... 2a00:1450:4001:831::200a	15169 (GOOGLE) (GOOGLE)
1	2606:2800:233... 2606:2800:233:66b5:799a:7cd3:f74d:7071	15133 (EDGECAST) (EDGECAST)
1	2606:4700:440... 2606:4700:4400::6812:297c	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	2606:4700::68... 2606:4700::6811:190e	13335 (CLOUDFLAR...) (CLOUDFLARENET)
4	2a00:1450:400... 2a00:1450:4001:830::200a	15169 (GOOGLE) (GOOGLE)
1	2606:4700::68... 2606:4700::6811:ad5b	13335 (CLOUDFLAR...) (CLOUDFLARENET)
8	142.250.181.227 142.250.181.227	15169 (GOOGLE) (GOOGLE)
2	157.240.0.6 157.240.0.6	32934 (FACEBOOK) (FACEBOOK)
3	146.75.52.157 146.75.52.157	54113 (FASTLY) (FASTLY)
2	2606:4700:440... 2606:4700:4400::6812:28f0	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700::68... 2606:4700::6812:8a11	13335 (CLOUDFLAR...) (CLOUDFLARENET)
5	2606:4700::68... 2606:4700::6810:7674	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700::68... 2606:4700::6810:a0a8	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	104.18.80.204 104.18.80.204	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a02:26f0:350... 2a02:26f0:3500:16::215:148b	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
5	2a00:1450:400... 2a00:1450:4001:81c::2008	15169 (GOOGLE) (GOOGLE)
9	2606:4700::68... 2606:4700::6812:562a	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700::68... 2606:4700::6810:89d1	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700:440... 2606:4700:4400::ac40:9b77	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a02:26f0:350... 2a02:26f0:3500:10::210:a9a	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	2606:4700::68... 2606:4700::6812:1347	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	18.245.86.87 18.245.86.87	16509 (AMAZON-02) (AMAZON-02)
1	2a04:4e42:600... 2a04:4e42:600::644	54113 (FASTLY) (FASTLY)
1	18.245.46.22 18.245.46.22	16509 (AMAZON-02) (AMAZON-02)
1	18.172.103.101 18.172.103.101	16509 (AMAZON-02) (AMAZON-02)
1	18.66.192.39 18.66.192.39	16509 (AMAZON-02) (AMAZON-02)
2	95.101.111.153 95.101.111.153	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
3	172.64.150.44 172.64.150.44	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1 3	2620:1ec:21::14 2620:1ec:21::14	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	13.107.42.14 13.107.42.14	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	162.159.140.229 162.159.140.229	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	104.244.42.67 104.244.42.67	13414 (TWITTER) (TWITTER)
2	34.111.208.231 34.111.208.231	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1	13.32.27.21 13.32.27.21	16509 (AMAZON-02) (AMAZON-02)
1	54.73.193.221 54.73.193.221	16509 (AMAZON-02) (AMAZON-02)
1	34.96.71.22 34.96.71.22	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1	35.244.174.68 35.244.174.68	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
2	18.66.102.75 18.66.102.75	16509 (AMAZON-02) (AMAZON-02)
2	18.245.86.77 18.245.86.77	16509 (AMAZON-02) (AMAZON-02)
1	2600:9000:272... 2600:9000:2724:c00:1d:8d6d:3b40:93a1	16509 (AMAZON-02) (AMAZON-02)
2	2001:4860:480... 2001:4860:4802:34::36	15169 (GOOGLE) (GOOGLE)
1 2	216.58.206.66 216.58.206.66	15169 (GOOGLE) (GOOGLE)
1	142.250.185.194 142.250.185.194	15169 (GOOGLE) (GOOGLE)
2	104.16.117.43 104.16.117.43	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	52.223.40.198 52.223.40.198	16509 (AMAZON-02) (AMAZON-02)
155	49

32 45.60.64.106 (United States)

ASN19551 (INCAPSULA, US)

www.cybereason.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

27 104.18.91.62 (None, )

ASN13335 (CLOUDFLARENET, US)

cdn2.hubspot.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 2a02:26f0:3500:16::215:148f (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)

use.typekit.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:831::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

ajax.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:2800:233:66b5:799a:7cd3:f74d:7071 (United States)

ASN15133 (EDGECAST, US)

platform.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:4400::6812:297c (United States)

ASN13335 (CLOUDFLARENET, US)

7052064.fs1.hubspotusercontent-na1.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700::6811:190e (United States)

ASN13335 (CLOUDFLARENET, US)

cdnjs.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:830::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6811:ad5b (United States)

ASN13335 (CLOUDFLARENET, US)

static.hsappstatic.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 142.250.181.227 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s56-in-f3.1e100.net

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 157.240.0.6 (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)
PTR: xx-fbcdn-shv-02-fra3.fbcdn.net

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 146.75.52.157 (Milan, Italy)

ASN54113 (FASTLY, US)

platform.twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
static.ads-twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700:4400::6812:28f0 (United States)

ASN13335 (CLOUDFLARENET, US)

js.hs-banner.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6812:8a11 (United States)

ASN13335 (CLOUDFLARENET, US)

js.hsleadflows.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2606:4700::6810:7674 (United States)

ASN13335 (CLOUDFLARENET, US)

js.hubspot.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
app.hubspot.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
cta-service-cms2.hubspot.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
track.hubspot.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
forms.hubspot.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6810:a0a8 (United States)

ASN13335 (CLOUDFLARENET, US)

js.hs-analytics.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.18.80.204 (None, )

ASN13335 (CLOUDFLARENET, US)

perf-na1.hsforms.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:26f0:3500:16::215:148b (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)

p.typekit.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2a00:1450:4001:81c::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 2606:4700::6812:562a (United States)

ASN13335 (CLOUDFLARENET, US)

cdn.cookielaw.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6810:89d1 (United States)

ASN13335 (CLOUDFLARENET, US)

js.hs-scripts.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:4400::ac40:9b77 (United States)

ASN13335 (CLOUDFLARENET, US)

geolocation.onetrust.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:26f0:3500:10::210:a9a (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)

snap.licdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6812:1347 (United States)

ASN13335 (CLOUDFLARENET, US)

trk.techtarget.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.245.86.87 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-245-86-87.fra60.r.cloudfront.net

js.driftt.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a04:4e42:600::644 (United States)

ASN54113 (FASTLY, US)

fast.wistia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.245.46.22 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-245-46-22.fra56.r.cloudfront.net

tag.demandbase.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.172.103.101 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-172-103-101.fra60.r.cloudfront.net

js.adsrvr.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.66.192.39 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-66-192-39.muc50.r.cloudfront.net

static.hotjar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 95.101.111.153 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)
PTR: a95-101-111-153.deploy.static.akamaitechnologies.com

analytics.o11.tech	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 172.64.150.44 (San Francisco, United States)

ASN13335 (CLOUDFLARENET, US)

js.zi-scripts.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2620:1ec:21::14 (United States) 1 redirects

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

px.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.107.42.14 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

px4.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 162.159.140.229 (None, )

ASN13335 (CLOUDFLARENET, US)

t.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.244.42.67 (United States)

ASN13414 (TWITTER, US)

analytics.twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 34.111.208.231 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 231.208.111.34.bc.googleusercontent.com

ibc-flow.techtarget.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.32.27.21 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-32-27-21.fra56.r.cloudfront.net

script.hotjar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 54.73.193.221 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-54-73-193-221.eu-west-1.compute.amazonaws.com

content.hotjar.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.96.71.22 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 22.71.96.34.bc.googleusercontent.com

s.company-target.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.244.174.68 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 68.174.244.35.bc.googleusercontent.com

id.rlcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 18.66.102.75 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-66-102-75.fra56.r.cloudfront.net

api.company-target.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 18.245.86.77 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-245-86-77.fra60.r.cloudfront.net

js.driftt.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:2724:c00:1d:8d6d:3b40:93a1 (United States)

ASN16509 (AMAZON-02, US)

tag-logger.demandbase.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2001:4860:4802:34::36 (United States)

ASN15169 (GOOGLE, US)

region1.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 216.58.206.66 (United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: tzfraa-aa-in-f2.1e100.net

ade.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.185.194 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s52-in-f2.1e100.net

pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 104.16.117.43 (None, )

ASN13335 (CLOUDFLARENET, US)

ws.zoominfo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.223.40.198 (United States)

ASN16509 (AMAZON-02, US)
PTR: a6370ebea231e0c9a.awsglobalaccelerator.com

insight.adsrvr.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
32	cybereason.com www.cybereason.com	2 MB
27	hubspot.net cdn2.hubspot.net — Cisco Umbrella Rank: 8959	82 KB
10	typekit.net use.typekit.net — Cisco Umbrella Rank: 455 p.typekit.net — Cisco Umbrella Rank: 561	142 KB
9	cookielaw.org cdn.cookielaw.org — Cisco Umbrella Rank: 326	148 KB
8	gstatic.com fonts.gstatic.com	247 KB
5	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 39	491 KB
5	hubspot.com js.hubspot.com — Cisco Umbrella Rank: 3554 app.hubspot.com — Cisco Umbrella Rank: 5859 cta-service-cms2.hubspot.com — Cisco Umbrella Rank: 3687 track.hubspot.com — Cisco Umbrella Rank: 2324 forms.hubspot.com — Cisco Umbrella Rank: 5962	28 KB
5	linkedin.com 1 redirects platform.linkedin.com — Cisco Umbrella Rank: 3841 px.ads.linkedin.com — Cisco Umbrella Rank: 321 px4.ads.linkedin.com — Cisco Umbrella Rank: 6828	163 KB
5	googleapis.com ajax.googleapis.com — Cisco Umbrella Rank: 412 fonts.googleapis.com — Cisco Umbrella Rank: 30	37 KB
3	googlesyndication.com 1 redirects ade.googlesyndication.com — Cisco Umbrella Rank: 365 pagead2.googlesyndication.com — Cisco Umbrella Rank: 116	903 B
3	company-target.com s.company-target.com — Cisco Umbrella Rank: 1520 api.company-target.com — Cisco Umbrella Rank: 4087	2 KB
3	zi-scripts.com js.zi-scripts.com — Cisco Umbrella Rank: 5671	4 KB
3	driftt.com js.driftt.com — Cisco Umbrella Rank: 6590	62 KB
3	techtarget.com trk.techtarget.com — Cisco Umbrella Rank: 25487 ibc-flow.techtarget.com — Cisco Umbrella Rank: 23670	2 KB
3	twitter.com platform.twitter.com — Cisco Umbrella Rank: 1472 analytics.twitter.com — Cisco Umbrella Rank: 962	28 KB
2	zoominfo.com ws.zoominfo.com — Cisco Umbrella Rank: 4482	2 KB
2	google-analytics.com region1.google-analytics.com — Cisco Umbrella Rank: 3643
2	o11.tech analytics.o11.tech — Cisco Umbrella Rank: 119813	2 KB
2	hotjar.com static.hotjar.com — Cisco Umbrella Rank: 877 script.hotjar.com — Cisco Umbrella Rank: 1177	61 KB
2	adsrvr.org js.adsrvr.org — Cisco Umbrella Rank: 1442 insight.adsrvr.org — Cisco Umbrella Rank: 945	12 KB
2	demandbase.com tag.demandbase.com — Cisco Umbrella Rank: 5931 tag-logger.demandbase.com — Cisco Umbrella Rank: 5266	18 KB
2	hs-banner.com js.hs-banner.com — Cisco Umbrella Rank: 2172	27 KB
2	facebook.net connect.facebook.net — Cisco Umbrella Rank: 180	83 KB
2	cloudflare.com cdnjs.cloudflare.com — Cisco Umbrella Rank: 220	11 KB
1	rlcdn.com id.rlcdn.com — Cisco Umbrella Rank: 812	98 B
1	hotjar.io content.hotjar.io — Cisco Umbrella Rank: 6755	171 B
1	t.co t.co — Cisco Umbrella Rank: 859	629 B
1	wistia.com fast.wistia.com — Cisco Umbrella Rank: 4693	142 KB
1	ads-twitter.com static.ads-twitter.com — Cisco Umbrella Rank: 960	15 KB
1	licdn.com snap.licdn.com — Cisco Umbrella Rank: 784	14 KB
1	onetrust.com geolocation.onetrust.com — Cisco Umbrella Rank: 498	305 B
1	hs-scripts.com js.hs-scripts.com — Cisco Umbrella Rank: 2500	882 B
1	hsforms.com perf-na1.hsforms.com — Cisco Umbrella Rank: 3796	908 B
1	hs-analytics.net js.hs-analytics.net — Cisco Umbrella Rank: 2191	25 KB
1	hsleadflows.net js.hsleadflows.net — Cisco Umbrella Rank: 5740	92 KB
1	hsappstatic.net static.hsappstatic.net — Cisco Umbrella Rank: 5807	5 KB
1	hubspotusercontent-na1.net 7052064.fs1.hubspotusercontent-na1.net	2 KB
155	37

	Domain	Requested by
32	www.cybereason.com	www.cybereason.com cdn2.hubspot.net
27	cdn2.hubspot.net	www.cybereason.com
9	cdn.cookielaw.org	www.googletagmanager.com cdn.cookielaw.org
9	use.typekit.net	www.cybereason.com
8	fonts.gstatic.com	fonts.googleapis.com
5	www.googletagmanager.com	www.cybereason.com www.googletagmanager.com
4	fonts.googleapis.com	www.cybereason.com cdn2.hubspot.net
3	px.ads.linkedin.com	1 redirects snap.licdn.com
3	js.zi-scripts.com	www.cybereason.com js.zi-scripts.com
3	js.driftt.com	www.cybereason.com js.driftt.com
2	ws.zoominfo.com	js.zi-scripts.com
2	ade.googlesyndication.com	1 redirects
2	region1.google-analytics.com	www.googletagmanager.com
2	api.company-target.com	tag.demandbase.com js.driftt.com
2	ibc-flow.techtarget.com	trk.techtarget.com
2	analytics.o11.tech	www.cybereason.com analytics.o11.tech
2	js.hs-banner.com	www.cybereason.com js.hs-banner.com
2	platform.twitter.com	www.cybereason.com platform.twitter.com
2	connect.facebook.net	www.cybereason.com connect.facebook.net
2	cdnjs.cloudflare.com	www.cybereason.com cdn2.hubspot.net
1	insight.adsrvr.org	js.adsrvr.org
1	pagead2.googlesyndication.com	www.googletagmanager.com
1	tag-logger.demandbase.com	tag.demandbase.com
1	id.rlcdn.com
1	s.company-target.com	tag.demandbase.com
1	content.hotjar.io	script.hotjar.com
1	script.hotjar.com	static.hotjar.com
1	analytics.twitter.com
1	t.co
1	px4.ads.linkedin.com
1	static.hotjar.com	www.cybereason.com
1	js.adsrvr.org	www.googletagmanager.com
1	tag.demandbase.com	www.cybereason.com
1	fast.wistia.com	www.googletagmanager.com
1	trk.techtarget.com	www.cybereason.com
1	static.ads-twitter.com	www.googletagmanager.com
1	snap.licdn.com	www.googletagmanager.com
1	geolocation.onetrust.com	cdn.cookielaw.org
1	forms.hubspot.com	js.hsleadflows.net
1	track.hubspot.com
1	js.hs-scripts.com	www.googletagmanager.com
1	p.typekit.net	www.cybereason.com
1	perf-na1.hsforms.com	www.cybereason.com
1	cta-service-cms2.hubspot.com	js.hubspot.com
1	app.hubspot.com	www.cybereason.com
1	js.hs-analytics.net	www.cybereason.com
1	js.hubspot.com	www.cybereason.com
1	js.hsleadflows.net	www.cybereason.com
1	static.hsappstatic.net	www.cybereason.com
1	7052064.fs1.hubspotusercontent-na1.net	www.cybereason.com
1	platform.linkedin.com	www.cybereason.com
1	ajax.googleapis.com	www.cybereason.com
155	52

This site contains links to these domains. Also see Links.

Domain
j00ru.vexillium.org
docs.google.com
lolbas-project.github.io
jsac.jpcert.or.jp
twitter.com
www.facebook.com
www.linkedin.com
www.youtube.com
www.instagram.com
cookiepedia.co.uk
www.onetrust.com

Subject Issuer	Validity	Valid
*.cybereason.com GeoTrust TLS RSA CA G1	`2024-05-02` - `2025-05-17`	a year	crt.sh
hubspot.net Cloudflare Inc ECC CA-3	`2024-03-06` - `2024-12-31`	10 months	crt.sh
use.typekit.net DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2024-08-27` - `2025-09-27`	a year	crt.sh
upload.video.google.com WR2	`2024-09-16` - `2024-12-09`	3 months	crt.sh
platform.linkedin.com DigiCert SHA2 Secure Server CA	`2024-06-13` - `2025-06-13`	a year	crt.sh
hubspotusercontent-na1.net WE1	`2024-08-29` - `2024-11-28`	3 months	crt.sh
cdnjs.cloudflare.com WE1	`2024-09-28` - `2024-12-27`	3 months	crt.sh
hsappstatic.net WE1	`2024-09-06` - `2024-12-05`	3 months	crt.sh
*.gstatic.com WR2	`2024-09-16` - `2024-12-09`	3 months	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2024-07-14` - `2024-10-12`	3 months	crt.sh
*.twimg.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2024-06-24` - `2025-07-25`	a year	crt.sh
hs-banner.com WE1	`2024-09-24` - `2024-12-23`	3 months	crt.sh
hsleadflows.net WE1	`2024-09-29` - `2024-12-28`	3 months	crt.sh
hubspot.com WE1	`2024-10-03` - `2025-01-01`	3 months	crt.sh
hs-analytics.net WE1	`2024-08-09` - `2024-11-07`	3 months	crt.sh
hsforms.com WE1	`2024-08-12` - `2024-11-10`	3 months	crt.sh
*.google-analytics.com WR2	`2024-09-16` - `2024-12-09`	3 months	crt.sh
cookielaw.org WE1	`2024-08-13` - `2024-11-11`	3 months	crt.sh
hs-scripts.com WE1	`2024-09-26` - `2024-12-25`	3 months	crt.sh
geolocation.onetrust.com WE1	`2024-08-13` - `2024-11-11`	3 months	crt.sh
snap.licdn.com DigiCert SHA2 Secure Server CA	`2023-12-13` - `2024-12-12`	a year	crt.sh
ads-twitter.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2024-06-25` - `2025-06-24`	a year	crt.sh
trk.techtarget.com WE1	`2024-09-20` - `2024-12-19`	3 months	crt.sh
drift.com Amazon RSA 2048 M03	`2024-07-30` - `2025-08-27`	a year	crt.sh
fast.wistia.com GlobalSign Atlas R3 DV TLS CA 2024 Q1	`2024-04-04` - `2025-05-06`	a year	crt.sh
tag.demandbase.com Go Daddy Secure Certificate Authority - G2	`2024-08-27` - `2025-09-28`	a year	crt.sh
*.adsrvr.org GlobalSign GCC R3 DV TLS CA 2020	`2024-04-23` - `2025-05-25`	a year	crt.sh
*.hotjar.com Amazon RSA 2048 M03	`2024-05-22` - `2025-06-20`	a year	crt.sh
cert1-prod.aut.a24365.net R11	`2024-09-25` - `2024-12-24`	3 months	crt.sh
zi-scripts.com WE1	`2024-09-22` - `2024-12-21`	3 months	crt.sh
www.linkedin.com DigiCert SHA2 Secure Server CA	`2024-09-11` - `2025-03-11`	6 months	crt.sh
t.co E5	`2024-09-28` - `2024-12-27`	3 months	crt.sh
*.twitter.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2024-08-19` - `2025-08-18`	a year	crt.sh
ibc-flow.techtarget.com WR3	`2024-08-28` - `2024-11-26`	3 months	crt.sh
*.hotjar.io Amazon ECDSA 256 M02	`2024-01-31` - `2025-03-01`	a year	crt.sh
*.company-target.com R11	`2024-08-15` - `2024-11-13`	3 months	crt.sh
*.rlcdn.com Sectigo RSA Domain Validation Secure Server CA	`2024-02-06` - `2025-03-05`	a year	crt.sh
api.demandbase.com Go Daddy Secure Certificate Authority - G2	`2024-08-13` - `2025-09-14`	a year	crt.sh
*.demandbase.com Amazon RSA 2048 M02	`2024-06-10` - `2025-07-08`	a year	crt.sh
*.g.doubleclick.net WR2	`2024-09-16` - `2024-12-09`	3 months	crt.sh
zoominfo.com E5	`2024-09-14` - `2024-12-13`	3 months	crt.sh

This page contains 7 frames:

Primary Page: https://www.cybereason.com/blog/cuckoo-spear-pt2-threat-actor-arsenal
Frame ID: 5ACD7358ABA5D60ABCC13F6777388B3E
Requests: 147 HTTP requests in this frame

Frame: https://platform.twitter.com/widgets/widget_iframe.2f70fb173b9000da126c79afe2098f02.html?origin=https%3A%2F%2Fwww.cybereason.com
Frame ID: 5822D63BB2B9F8266BBF3D8019145F1D
Requests: 1 HTTP requests in this frame

Frame: https://analytics.o11.tech/a/ts_.htm?ver=1.1550.102&cid=c076
Frame ID: A8CBD1BEC7A5557F05562CB5125229A7
Requests: 1 HTTP requests in this frame

Frame: https://s.company-target.com/s/sync?exc=lr
Frame ID: 3C3A20150705234C011A45A81B4C6B0C
Requests: 1 HTTP requests in this frame

Frame: https://js.driftt.com/core?d=1&embedId=zdcd6x8yhg85&eId=zdcd6x8yhg85&region=US&forceShow=false&skipCampaigns=false&sessionId=ca3b825f-22da-4169-bea9-486a4ba157da&sessionStarted=1728143207.797&campaignRefreshToken=d2a27962-d665-4271-8903-19b503d19082&hideController=false&pageLoadStartTime=1728143205330&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.cybereason.com%2Fblog%2Fcuckoo-spear-pt2-threat-actor-arsenal
Frame ID: 73C2F98578D16B7184343D776ECF1EFD
Requests: 1 HTTP requests in this frame

Frame: https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1728143205330
Frame ID: D181DCBB76843BDD4CA4FE869E838132
Requests: 1 HTTP requests in this frame

Frame: https://insight.adsrvr.org/track/up?adv=ahlj4b0&ref=https%3A%2F%2Fwww.cybereason.com%2Fblog%2Fcuckoo-spear-pt2-threat-actor-arsenal&upid=l8ht5d1&upv=1.1.0&paapi=1
Frame ID: 54563EEA03E4D34B32A6624D1A9F8B78
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

(2) New Messages!

Detected technologies

AMP (JavaScript frameworks) Expand

Overall confidence: 100%
Detected patterns

<link rel="amphtml"

Facebook (Widgets) Expand

Overall confidence: 100%
Detected patterns

//connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js

Font Awesome (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)

Google AdSense (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

googlesyndication\.com/

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtm\.js
googletagmanager\.com/gtag/js

Hotjar (Analytics) Expand

Overall confidence: 100%
Detected patterns

//static\.hotjar\.com/

HubSpot Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

js\.hs-analytics\.net/analytics

Imperva (Security) Expand

Overall confidence: 100%
Detected patterns

/_Incapsula_Resource

Linkedin (Widgets) Expand

Overall confidence: 100%
Detected patterns

//platform\.linkedin\.com/in\.js

Linkedin Insight Tag (Analytics) Expand

Overall confidence: 100%
Detected patterns

snap\.licdn\.com/li\.lms-analytics/insight\.min\.js

OneTrust (Cookie compliance) Expand

Overall confidence: 100%
Detected patterns

cdn\.cookielaw\.org
otSDKStub\.js

Twitter (Widgets) Expand

Overall confidence: 100%
Detected patterns

//platform\.twitter\.com/widgets\.js

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

/([\d.]+)/jquery(?:\.min)?\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

155
Requests

97 %
HTTPS

46 %
IPv6

37
Domains

52
Subdomains

49
IPs

5
Countries

4397 kB
Transfer

9363 kB
Size

46
Cookies

14 Outgoing links

These are links going to different origins than the main page.

URL: https://j00ru.vexillium.org/syscalls/nt/64/
Title: Windows 64-bit Syscall Table

Search URL Search Domain Scan URL

URL: https://docs.google.com/document/d/1LbDaVf_mbPmUvIpBoJu6mO6YdqIoxwcgRMIU8dvu-18/edit#heading=h.kliom7vjjjn7

Search URL Search Domain Scan URL

URL: https://lolbas-project.github.io/lolbas/Binaries/Msbuild/
Title: LOLBin msbuild.exe

Search URL Search Domain Scan URL

URL: https://jsac.jpcert.or.jp/archive/2024/pdf/JSAC2024_2_8_Breitenbacher_en.pdf
Title: https://jsac.jpcert.or.jp/archive/2024/pdf/JSAC2024_2_8_Breitenbacher_en.pdf

Search URL Search Domain Scan URL

URL: https://twitter.com/intent/tweet?original_referer=https://www.cybereason.com/blog/cuckoo-spear-pt2-threat-actor-arsenal&utm_medium=social&utm_source=twitter&url=https://www.cybereason.com/blog/cuckoo-spear-pt2-threat-actor-arsenal&utm_medium=social&utm_source=twitter&source=tweetbutton&text=

Search URL Search Domain Scan URL

URL: http://www.facebook.com/share.php?u=https://www.cybereason.com/blog/cuckoo-spear-pt2-threat-actor-arsenal&utm_medium=social&utm_source=facebook

Search URL Search Domain Scan URL

URL: http://www.linkedin.com/shareArticle?mini=true&url=https://www.cybereason.com/blog/cuckoo-spear-pt2-threat-actor-arsenal&utm_medium=social&utm_source=linkedin

Search URL Search Domain Scan URL

URL: https://www.facebook.com/Cybereason/

Search URL Search Domain Scan URL

URL: https://twitter.com/cybereason

Search URL Search Domain Scan URL

URL: https://www.youtube.com/channel/UCOm7AaB0HiNH4Phe66sK0Ew

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/company/cybereason

Search URL Search Domain Scan URL

URL: https://www.instagram.com/cybereason

Search URL Search Domain Scan URL

URL: https://cookiepedia.co.uk/giving-consent-to-cookies
Title: More information

Search URL Search Domain Scan URL

URL: https://www.onetrust.com/products/cookie-consent/

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 129

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=3885972%2C4030924%2C72596&time=1728143207277&url=https%3A%2F%2Fwww.cybereason.com%2Fblog%2Fcuckoo-spear-pt2-threat-actor-arsenal&tm=gtmv2 HTTP 302
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=3885972%2C4030924%2C72596&time=1728143207277&url=https%3A%2F%2Fwww.cybereason.com%2Fblog%2Fcuckoo-spear-pt2-threat-actor-arsenal&tm=gtmv2&e_ipv6=AQJu7j2kFikcegAAAZJdXKwIFYhb6XQVkMLxc1xON1YxCS3KFz59NsZzLPbXkFmQ9WCs

Request Chain 147

https://ade.googlesyndication.com/ddm/activity/src=10428681;type=cyber0;cat=cyber0;ord=890413546279;npa=1;gdid=dZTQ1Zm.dYWJhMj;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=denied;frm=0;gtm=45fe4a20v9181802817z8830287785za201zb830287785;gcs=G100;gcd=13p3p3p3p5l1;dma_cps=-;dma=0;tag_exp=101533421~101671035~101747727;epver=2;~oref=https%3A%2F%2Fwww.cybereason.com%2Fblog%2Fcuckoo-spear-pt2-threat-actor-arsenal HTTP 302
https://ade.googlesyndication.com/ddm/activity/src=10428681;dc_pre=CLyswJDL94gDFYb0OwId7ksyXg;type=cyber0;cat=cyber0;ord=890413546279;npa=1;gdid=dZTQ1Zm.dYWJhMj;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=denied;frm=0;gtm=45fe4a20v9181802817z8830287785za201zb830287785;gcs=G100;gcd=13p3p3p3p5l1;dma_cps=-;dma=0;tag_exp=101533421~101671035~101747727;epver=2;~oref=https%3A%2F%2Fwww.cybereason.com%2Fblog%2Fcuckoo-spear-pt2-threat-actor-arsenal

155 HTTP transactions
1 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request cuckoo-spear-pt2-threat-actor-arsenal Show response
www.cybereason.com/blog/ 145 KB
30 KB 375ms
243ms Document
text/html 45.60.64.106
INCAPSULA

General

Check archive.org

Show headers Download Go to

Full URL

https://www.cybereason.com/blog/cuckoo-spear-pt2-threat-actor-arsenal

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

45.60.64.106 , United States, ASN19551 (INCAPSULA, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0ee74aaadfb29cd478645c275a4dc5c13a4c81b2f5ec9af6d6dd1bad3b2908a0

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	deny

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

cache-control: s-maxage=10800, max-age=0
cf-ray: 8cde8bd7ced69242-MUC
content-encoding: gzip
content-security-policy: upgrade-insecure-requests
content-type: text/html; charset=UTF-8
date: Sat, 05 Oct 2024 15:46:45 GMT
edge-cache-tag: CT-175896343570,CT-178628451426,CT-92241867548,CG-3354902,CG-5272851739,P-3354902,L-42870461961,CW-34473990280,CW-41681847227,CW-41682410610,CW-42867014566,CW-43300360745,CW-44252461159,CW-86933076631,E-34470223313,E-34470224480,E-34470477360,E-35275979682,E-35291999472,E-42363645447,E-42507089303,E-42507091846,E-42760289143,PGS-ALL,SW-0,B-5272851739,GC-36042052587
last-modified: Fri, 04 Oct 2024 20:19:21 GMT
link: </hs/hsstatic/cos-i18n/static-1.53/bundles/project.js>; rel=preload; as=script
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
referrer-policy: no-referrer-when-downgrade
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=R120TsVTgNt8Qqx395oDe8pMItG61EDBq6Jz%2BBXjzsyqRU%2F%2FK%2BdsH9rUnJH0pGtH6%2BFfevGrxrYWx2UyjCtBdN6ypoaNBwm3RpnJUN%2B3gTBZTOHLY1q26UEzq1qC2XbLS3%2Bl3w%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
strict-transport-security: max-age=31536000; includeSubDomains
vary: Accept-Encoding
x-cdn: Imperva
x-content-type-options: nosniff
x-frame-options: deny
x-hs-cache-config: BrowserCache-5s-EdgeCache-180s
x-hs-cache-control: s-maxage=10800, max-age=0
x-hs-cf-cache-status: REVALIDATED
x-hs-content-campaign-id: cc48f9df-345d-4e45-a2a3-9ab7fab8275a
x-hs-content-id: 178628451426
x-hs-hub-id: 3354902
x-hs-prerendered: Fri, 04 Oct 2024 20:19:21 GMT
x-iinfo: 5-10290491-10290493 NNNN CT(6 17 0) RT(1728143204667 46) q(0 0 0 0) r(2 2) U12

GET
H2 200 project.js Show response
www.cybereason.com/hs/hsstatic/cos-i18n/static-1.53/bundles/ 1 KB
782 B 47ms
45ms Script
application/javascript 45.60.64.106
INCAPSULA

General

Check archive.org

Show headers Download Go to

Full URL

https://www.cybereason.com/hs/hsstatic/cos-i18n/static-1.53/bundles/project.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

45.60.64.106 , United States, ASN19551 (INCAPSULA, US),

Reverse DNS

Software

Resource Hash

8da927b6b1240ffca4323fbb2a12c8e5abb541040965c2bc5b7d09a2eb963b02

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.cybereason.com/blog/cuckoo-spear-pt2-threat-actor-arsenal

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
x-iinfo: 5-10290491-0 0CNN RT(1728143204667 296) q(0 -1 -1 -1) r(0 -1)
cache-control: max-age=27203159, public
content-encoding: gzip
etag: W/"61ca66de658cab9587e4636894680d5d"
x-cdn: Imperva
expires: Sat, 16 Aug 2025 12:12:43 GMT
content-length: 562
date: Sat, 05 Oct 2024 15:46:44 GMT
last-modified: Tue, 09 Nov 2021 16:12:42 GMT
content-type: application/javascript

GET
H3 200 module_41681847227_CR_-_Malicious_Life_Network_--_Tier_One_Header.min.css
cdn2.hubspot.net/hub/3354902/hub_generated/module_assets/41681847227/1644941386203/ 3 KB
2 KB 327ms
287ms Stylesheet
text/css 104.18.91.62
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn2.hubspot.net/hub/3354902/hub_generated/module_assets/41681847227/1644941386203/module_41681847227_CR_-_Malicious_Life_Network_--_Tier_One_Header.min.css
Requested by: Host: www.cybereason.com
URL: https://www.cybereason.com/blog/cuckoo-spear-pt2-threat-actor-arsenal
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.91.62 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9cec59b071d9d61e74c42ac4db8d2815aaace7e51983afe2481c14b97f332258

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.cybereason.com/blog/cuckoo-spear-pt2-threat-actor-arsenal

Response headers

x-evy-trace-virtual-host: all
x-hs-cf-lambda: us-east-1.EnforceAclForReads 3
x-request-id: f2d419b0-d800-4021-b40a-223eeaf53a25
content-encoding: gzip
cf-cache-status: HIT
etag: W/"38a0b2ad68cbd188720dcc11cc435ad6"
age: 1797568
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=5I4uKXUr0YDZBoVlIdHkMlMztSKPSPExup5UQlKsJcMnwFUR5%2FAIdvy2MX3FQo7lOCq7UlQd1mBHCno7rOFx9GCSnkZT2IIje5RV1M%2Fn6C255p7xWu3plsVOeUqcvyF02Pw%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-methods: GET
x-evy-trace-listener: listener_https
date: Sat, 05 Oct 2024 15:46:45 GMT
x-hubspot-correlation-id: f2d419b0-d800-4021-b40a-223eeaf53a25
content-type: text/css
last-modified: Tue, 15 Feb 2022 16:09:47 GMT
vary: Accept-Encoding
x-amz-replication-status: COMPLETED
x-evy-trace-route-service-name: envoyset-translator
cache-control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900
timing-allow-origin: cdn2.hubspot.net
x-evy-trace-served-by-pod: iad02/cms-cdn2-td/envoy-proxy-c8b596779-fckn5
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-envoy-upstream-service-time: 150
cf-ray: 8cde8bd95bec413a-LHR
x-hs-cf-lambda-enforce: us-east-1.EnforceAclForReads 3
access-control-allow-origin: *
x-evy-trace-route-configuration: listener_https/all
x-amz-cf-pop: IAD89-C1
x-hs-alternate-content-type: text/plain
server: cloudflare
x-amz-meta-created-unix-time-millis: 1644941386203
x-amz-server-side-encryption: AES256

GET
H3 200 module_41682410610_CR_-_Malicious_Life_Network_--_Main_Hero.min.css
cdn2.hubspot.net/hub/3354902/hub_generated/module_assets/41682410610/1644941443237/ 6 KB
3 KB 272ms
232ms Stylesheet
text/css 104.18.91.62
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn2.hubspot.net/hub/3354902/hub_generated/module_assets/41682410610/1644941443237/module_41682410610_CR_-_Malicious_Life_Network_--_Main_Hero.min.css
Requested by: Host: www.cybereason.com
URL: https://www.cybereason.com/blog/cuckoo-spear-pt2-threat-actor-arsenal
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.91.62 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b6c9f9a48bd0a163671773a199c876dc64d66947d47ac509c95e29177046c9a3

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.cybereason.com/blog/cuckoo-spear-pt2-threat-actor-arsenal

Response headers

x-evy-trace-virtual-host: all
x-hs-cf-lambda: us-east-1.EnforceAclForReads 3
x-request-id: 1a98f61e-aa0a-437a-9bc0-1303876b7916
content-encoding: gzip
cf-cache-status: HIT
etag: W/"af924b62631098b8dc817f28551a6908"
age: 1752266
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=3FxkHFUZEjkcwg1sIag9aS%2FotwyaaJimrcSzzCZ39VL47S7YCOKL72%2FPvTgCU2QONh0rsAkD1aXjZ%2FR7lxqEBgJ%2Bd8%2F2XLTwZ5UIgsYeG0A3xTIgg7AVsDWq%2Fwosp7xTE2E%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-methods: GET
x-evy-trace-listener: listener_https
date: Sat, 05 Oct 2024 15:46:45 GMT
x-hubspot-correlation-id: 1a98f61e-aa0a-437a-9bc0-1303876b7916
content-type: text/css
last-modified: Tue, 15 Feb 2022 16:10:44 GMT
vary: Accept-Encoding
x-amz-replication-status: COMPLETED
x-evy-trace-route-service-name: envoyset-translator
cache-control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900
timing-allow-origin: cdn2.hubspot.net
x-evy-trace-served-by-pod: iad02/cms-cdn2-td/envoy-proxy-64d59778d6-jrv7z
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-envoy-upstream-service-time: 214
cf-ray: 8cde8bd95bed413a-LHR
x-hs-cf-lambda-enforce: us-east-1.EnforceAclForReads 3
access-control-allow-origin: *
x-evy-trace-route-configuration: listener_https/all
x-amz-cf-pop: IAD89-C1
x-hs-alternate-content-type: text/plain
server: cloudflare
x-amz-meta-created-unix-time-millis: 1644941443237
x-amz-server-side-encryption: AES256

GET
H3 200 module_43300360745_CR_-_Malicious_Life_Network_--_Related_Posts.min.css
cdn2.hubspot.net/hub/3354902/hub_generated/module_assets/43300360745/1724042214535/ 1 KB
1 KB 272ms
233ms Stylesheet
text/css 104.18.91.62
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn2.hubspot.net/hub/3354902/hub_generated/module_assets/43300360745/1724042214535/module_43300360745_CR_-_Malicious_Life_Network_--_Related_Posts.min.css
Requested by: Host: www.cybereason.com
URL: https://www.cybereason.com/blog/cuckoo-spear-pt2-threat-actor-arsenal
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.91.62 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9eb7fabe6f662e9e026fb996288d6e4e5b4fd739c45b260269a73b15eabcb7a3

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.cybereason.com/blog/cuckoo-spear-pt2-threat-actor-arsenal

Response headers

x-request-id: 2e3b35a8-4d70-4340-b97b-59c18b04467d
content-encoding: gzip
cf-cache-status: HIT
etag: W/"61ee919ce8359cd4e8e49b3aa0fa2d4c"
age: 1500553
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=OtqZ6uScBnMe%2BLMDzCxnG5NB6xxLoJkawimywZIzlLrOKU%2F3ATqPvfOGw8fOpQS4t1T%2FuhEPF70Ma1vzZin%2Bx5mYdCJco4RzhINmFwmLH%2Bf1X6%2FpAkuIz%2FwEoxiZUEE6waY%3D"}],"group":"cf-nel","max_age":604800}
x-evy-trace-listener: listener_https
x-hubspot-correlation-id: 2e3b35a8-4d70-4340-b97b-59c18b04467d
content-type: text/css
last-modified: Mon, 19 Aug 2024 04:36:55 GMT
x-amz-replication-status: COMPLETED
x-evy-trace-route-service-name: envoyset-translator
cache-control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900
x-evy-trace-served-by-pod: iad02/cms-cdn2-td/envoy-proxy-6748d4cfc8-b44gw
x-envoy-upstream-service-time: 144
x-hs-cf-lambda-enforce: us-east-1.EnforceAclForReads 3
x-hs-alternate-content-type: text/plain
server: cloudflare
x-evy-trace-virtual-host: all
x-hs-cf-lambda: us-east-1.EnforceAclForReads 3
x-amz-server-side-encryption: AES256
access-control-allow-methods: GET
x-amz-storage-class: INTELLIGENT_TIERING
date: Sat, 05 Oct 2024 15:46:45 GMT
vary: Accept-Encoding
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
timing-allow-origin: cdn2.hubspot.net
cf-ray: 8cde8bd95bef413a-LHR
access-control-allow-origin: *
x-evy-trace-route-configuration: listener_https/all
x-amz-cf-pop: IAD89-C1
x-amz-meta-created-unix-time-millis: 1724042214535

GET
H3 200 module_86933076631_CR_-_Sticky_CTA_Bar.css
cdn2.hubspot.net/hub/3354902/hub_generated/module_assets/1669911113479/ 2 KB
2 KB 329ms
289ms Stylesheet
text/css 104.18.91.62
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn2.hubspot.net/hub/3354902/hub_generated/module_assets/1669911113479/module_86933076631_CR_-_Sticky_CTA_Bar.css
Requested by: Host: www.cybereason.com
URL: https://www.cybereason.com/blog/cuckoo-spear-pt2-threat-actor-arsenal
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.91.62 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3a9e725bae41656623ccda8be25cbdd295ee1c73c8d3016023549a83c261a3ab

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.cybereason.com/blog/cuckoo-spear-pt2-threat-actor-arsenal

Response headers

x-request-id: c0c523dc-7524-4592-b682-27736395e244
content-encoding: gzip
cf-cache-status: HIT
etag: W/"c21ee1fe9f984d7f96a03cbd5dffeba0"
age: 1328592
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ncj2%2B%2FTDqrucen1KwkgADsInr%2Fr9x%2FKhBaSQk%2F6zEO1QCyWZ%2FZQmr%2BO8Jt3mgF0iq34VRrlaSGReHqY8K39jQ8ltsLq4Z7oBfZ35r3tmOnQw6Tqv2JMqZPBVIVEi%2BPwW0yU%3D"}],"group":"cf-nel","max_age":604800}
x-evy-trace-listener: listener_https
x-hubspot-correlation-id: c0c523dc-7524-4592-b682-27736395e244
content-type: text/css
last-modified: Thu, 01 Dec 2022 16:11:54 GMT
x-amz-replication-status: COMPLETED
x-evy-trace-route-service-name: envoyset-translator
cache-control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900
x-evy-trace-served-by-pod: iad02/cms-cdn2-td/envoy-proxy-6f9f79465b-4f62g
x-envoy-upstream-service-time: 172
x-hs-cf-lambda-enforce: us-east-1.EnforceAclForReads 3
x-hs-alternate-content-type: text/plain
server: cloudflare
x-evy-trace-virtual-host: all
x-hs-cf-lambda: us-east-1.EnforceAclForReads 3
x-amz-server-side-encryption: AES256
access-control-allow-methods: GET
x-amz-storage-class: INTELLIGENT_TIERING
date: Sat, 05 Oct 2024 15:46:45 GMT
vary: Accept-Encoding
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
timing-allow-origin: cdn2.hubspot.net
cf-ray: 8cde8bd95bf0413a-LHR
access-control-allow-origin: *
x-evy-trace-route-configuration: listener_https/all
x-amz-cf-pop: IAD89-C1
x-amz-meta-created-unix-time-millis: 1669911113479

GET
H3 200 module_34473990280_CR_-_Footer_Full__en_US.min.css
cdn2.hubspot.net/hub/3354902/hub_generated/module_assets/34473990280/1704383554067/ 3 KB
2 KB 239ms
200ms Stylesheet
text/css 104.18.91.62
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn2.hubspot.net/hub/3354902/hub_generated/module_assets/34473990280/1704383554067/module_34473990280_CR_-_Footer_Full__en_US.min.css
Requested by: Host: www.cybereason.com
URL: https://www.cybereason.com/blog/cuckoo-spear-pt2-threat-actor-arsenal
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.91.62 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: abb03b2160dd9f75fa8eb557ca242d7cd93f159d53708c58f4d2887bd4f05ead

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.cybereason.com/blog/cuckoo-spear-pt2-threat-actor-arsenal

Response headers

x-request-id: c843b240-bca2-4cb3-b14a-9589fed5ac9b
content-encoding: gzip
cf-cache-status: HIT
etag: W/"2d832f69213af1582ea19a1326d20337"
age: 1752266
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=LtZB2DsIRgiIftPb0h6G1ZTVHD8pm2B5HB74x6IpeL22NDmaT%2BHUk%2FjRyYq95GH3KTv5TVO3nTzoFJscBA3xKI9w4T6bpLOPQa7NKgT7WYr3hKdVdkTCmY1NfEF0hS%2FCpv8%3D"}],"group":"cf-nel","max_age":604800}
x-evy-trace-listener: listener_https
x-hubspot-correlation-id: c843b240-bca2-4cb3-b14a-9589fed5ac9b
content-type: text/css
last-modified: Thu, 04 Jan 2024 15:52:35 GMT
x-amz-replication-status: COMPLETED
x-evy-trace-route-service-name: envoyset-translator
cache-control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900
x-evy-trace-served-by-pod: iad02/cms-cdn2-td/envoy-proxy-64d59778d6-f6gc6
x-envoy-upstream-service-time: 124
x-hs-cf-lambda-enforce: us-east-1.EnforceAclForReads 3
x-hs-alternate-content-type: text/plain
server: cloudflare
x-evy-trace-virtual-host: all
x-hs-cf-lambda: us-east-1.EnforceAclForReads 3
x-amz-server-side-encryption: AES256
access-control-allow-methods: GET
x-amz-storage-class: INTELLIGENT_TIERING
date: Sat, 05 Oct 2024 15:46:45 GMT
vary: Accept-Encoding
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
timing-allow-origin: cdn2.hubspot.net
cf-ray: 8cde8bd95be5413a-LHR
access-control-allow-origin: *
x-evy-trace-route-configuration: listener_https/all
x-amz-cf-pop: IAD89-C1
x-amz-meta-created-unix-time-millis: 1704383554067

GET
H2 200 vyv2ljd.js Show response
use.typekit.net/ 19 KB
7 KB 195ms
53ms Script
text/javascript 2a02:26f0:3500:16::215:148f
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://use.typekit.net/vyv2ljd.js

Requested by

Host: www.cybereason.com
URL: https://www.cybereason.com/blog/cuckoo-spear-pt2-threat-actor-arsenal

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:3500:16::215:148f Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

nginx /

Resource Hash

458235328e4f7da4ccbe1e308d9f688e6cc5079212285f307cfa43e076c1dbee

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.cybereason.com/blog/cuckoo-spear-pt2-threat-actor-arsenal

Response headers

strict-transport-security: max-age=31536000; includeSubDomains;
cache-control: public, max-age=600, stale-while-revalidate=604800
timing-allow-origin: *
content-encoding: gzip
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 6894
date: Sat, 05 Oct 2024 15:46:45 GMT
content-type: text/javascript;charset=utf-8
vary: Accept-Encoding
server: nginx

GET
H2 200 jquery.min.js Show response
ajax.googleapis.com/ajax/libs/jquery/3.5.1/ 87 KB
31 KB 143ms
44ms Script
text/javascript 2a00:1450:4001:831::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.googleapis.com/ajax/libs/jquery/3.5.1/jquery.min.js

Requested by

Host: www.cybereason.com
URL: https://www.cybereason.com/blog/cuckoo-spear-pt2-threat-actor-arsenal

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.cybereason.com/blog/cuckoo-spear-pt2-threat-actor-arsenal

Response headers

content-encoding: gzip
age: 61155
report-to: {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
x-content-type-options: nosniff
expires: Sat, 04 Oct 2025 22:47:30 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 04 Oct 2024 22:47:30 GMT
last-modified: Fri, 08 May 2020 07:05:03 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
timing-allow-origin: *
cross-origin-opener-policy: same-origin; report-to="hosted-libraries-pushers"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
accept-ranges: bytes
access-control-allow-origin: *
content-length: 31021
x-xss-protection: 0
server: sffe

GET
H2 200 ionicons.eot
www.cybereason.com/hubfs/__dam/fonts/ 118 KB
67 KB 64ms
61ms Font
application/vnd.ms-fontobject 45.60.64.106
INCAPSULA

General

Check archive.org

Show headers Download Go to

Full URL

https://www.cybereason.com/hubfs/__dam/fonts/ionicons.eot

Requested by

Host: www.cybereason.com
URL: https://www.cybereason.com/blog/cuckoo-spear-pt2-threat-actor-arsenal

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

45.60.64.106 , United States, ASN19551 (INCAPSULA, US),

Reverse DNS

Software

Resource Hash

a4803d7bdeb478a5b9238fe74d8aaa98dafe2e8e68fccbd0e3f4dced823f27f0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Origin: https://www.cybereason.com
Referer: https://www.cybereason.com/blog/cuckoo-spear-pt2-threat-actor-arsenal

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
x-iinfo: 5-10290491-0 0CNN RT(1728143204667 309) q(0 -1 -1 -1) r(0 -1)
cache-control: max-age=748240, s-maxage=2130640, public
content-encoding: gzip
etag: W/"2c2ae068be3b089e0a5b59abb1831550"
x-cdn: Imperva
content-length: 68889
date: Sat, 05 Oct 2024 15:46:44 GMT
last-modified: Fri, 25 Sep 2020 09:38:01 GMT
content-type: application/vnd.ms-fontobject

GET
H2 200 Criteria-CF-Regular.woff2
www.cybereason.com/hubfs/dam/fonts/criteria/ 14 KB
14 KB 107ms
104ms Font
application/font-woff2 45.60.64.106
INCAPSULA

General

Check archive.org

Show headers Download Go to

Full URL

https://www.cybereason.com/hubfs/dam/fonts/criteria/Criteria-CF-Regular.woff2

Requested by

Host: www.cybereason.com
URL: https://www.cybereason.com/blog/cuckoo-spear-pt2-threat-actor-arsenal

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

45.60.64.106 , United States, ASN19551 (INCAPSULA, US),

Reverse DNS

Software

Resource Hash

fcba0ef5c17fd435aaa6cfac66375e7bfae52f5116b7a6e126c8b0f38b841613

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Origin: https://www.cybereason.com
Referer: https://www.cybereason.com/blog/cuckoo-spear-pt2-threat-actor-arsenal

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
x-iinfo: 5-10290491-0 0CNN RT(1728143204667 315) q(0 -1 -1 -1) r(0 -1)
cache-control: max-age=748240, s-maxage=2130640, public
etag: "8c4e317165d35f99602a1c625d63a040"
x-cdn: Imperva
content-length: 14572
date: Sat, 05 Oct 2024 15:46:44 GMT
last-modified: Thu, 13 Jan 2022 17:33:57 GMT
content-type: application/font-woff2

GET
H2 200 Criteria-CF-Medium.woff2
www.cybereason.com/hubfs/dam/fonts/criteria/ 14 KB
15 KB 108ms
105ms Font
application/font-woff2 45.60.64.106
INCAPSULA

General

Check archive.org

Show headers Download Go to

Full URL

https://www.cybereason.com/hubfs/dam/fonts/criteria/Criteria-CF-Medium.woff2

Requested by

Host: www.cybereason.com
URL: https://www.cybereason.com/blog/cuckoo-spear-pt2-threat-actor-arsenal

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

45.60.64.106 , United States, ASN19551 (INCAPSULA, US),

Reverse DNS

Software

Resource Hash

f24560f5b81158a42b8d38ffe5795d9959eb2308ee6780ea912a6594bb999d1e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Origin: https://www.cybereason.com
Referer: https://www.cybereason.com/blog/cuckoo-spear-pt2-threat-actor-arsenal

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
x-iinfo: 5-10290491-0 0CNN RT(1728143204667 319) q(0 -1 -1 -1) r(0 -1)
cache-control: max-age=748240, s-maxage=2130640, public
etag: "32457643e2ecf8bcf7fdba1110db901c"
x-cdn: Imperva
content-length: 14772
date: Sat, 05 Oct 2024 15:46:44 GMT
last-modified: Thu, 13 Jan 2022 17:33:57 GMT
content-type: application/font-woff2

GET
H2 200 Peristyle-Black.woff2
www.cybereason.com/hubfs/dam/fonts/peristyle/ 14 KB
14 KB 110ms
107ms Font
application/font-woff2 45.60.64.106
INCAPSULA

General

Check archive.org

Show headers Download Go to

Full URL

https://www.cybereason.com/hubfs/dam/fonts/peristyle/Peristyle-Black.woff2

Requested by

Host: www.cybereason.com
URL: https://www.cybereason.com/blog/cuckoo-spear-pt2-threat-actor-arsenal

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

45.60.64.106 , United States, ASN19551 (INCAPSULA, US),

Reverse DNS

Software

Resource Hash

9d943fe5fde08d5b742d383b625031f75e3e89035369f2cde2778f4c6cf5c119

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Origin: https://www.cybereason.com
Referer: https://www.cybereason.com/blog/cuckoo-spear-pt2-threat-actor-arsenal

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
x-iinfo: 5-10290491-0 0CNN RT(1728143204667 321) q(0 -1 -1 -1) r(0 -1)
cache-control: max-age=748240, s-maxage=2130640, public
etag: "a17b2e1c032fa4a5eea1eeb1416eb385"
x-cdn: Imperva
content-length: 14136
date: Sat, 05 Oct 2024 15:46:44 GMT
last-modified: Fri, 15 Oct 2021 16:32:36 GMT
content-type: application/font-woff2

GET
H2 200 in.js Show response
platform.linkedin.com/ 510 KB
160 KB 242ms
53ms Script
text/javascript 2606:2800:233:66b5:799a:7cd3:f74d:7071
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL

https://platform.linkedin.com/in.js

Requested by

Host: www.cybereason.com
URL: https://www.cybereason.com/blog/cuckoo-spear-pt2-threat-actor-arsenal

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2606:2800:233:66b5:799a:7cd3:f74d:7071 , United States, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECAcc (ama/48B6) /

Resource Hash

87d049fc6d16da1f81063235c0e3d31a4656800cbbdca8277d6ae56614a52aba

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.cybereason.com/blog/cuckoo-spear-pt2-threat-actor-arsenal

Response headers

content-encoding: gzip
age: 1646
x-cdn-proto: HTTP2
x-li-fabric: prod-lva1
x-content-type-options: nosniff
expires: Sat, 5 Oct 2024 16:19:19 GMT
x-li-proto: http/1.1
x-cache: HIT
date: Sat, 05 Oct 2024 15:46:45 GMT
content-type: text/javascript; charset=UTF-8
x-cdn-client-ip-version: IPV6
vary: Accept-Encoding
last-modified: Sat, 05 Oct 2024 15:19:19 GMT
x-li-pop: prod-lva1-x
cache-control: public, max-age=3600
x-cdn: ECST
x-li-uuid: AAYjvE/AdvN5iVX6TcKmgQ==
accept-ranges: bytes
content-length: 163630
server: ECAcc (ama/48B6)

GET
H2 200 layout.min.css
7052064.fs1.hubspotusercontent-na1.net/hub/7052064/hub_generated/template_assets/1728064268256/hubspot/hubspot_default/shared/responsive/ 4 KB
2 KB 145ms
65ms Stylesheet
text/css 2606:4700:4400::6812:297c
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://7052064.fs1.hubspotusercontent-na1.net/hub/7052064/hub_generated/template_assets/1728064268256/hubspot/hubspot_default/shared/responsive/layout.min.css
Requested by: Host: www.cybereason.com
URL: https://www.cybereason.com/blog/cuckoo-spear-pt2-threat-actor-arsenal
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:4400::6812:297c , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 356bb4bf2245a68ee5de5732b5574260dd2016a2c3987e17ad97fb2586a883d1

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.cybereason.com/blog/cuckoo-spear-pt2-threat-actor-arsenal

Response headers

x-evy-trace-virtual-host: all
x-hs-cf-lambda: us-east-1.EnforceAclForReads 3
x-request-id: ee41d382-f86f-4c2a-b05e-18e7bdd32d8d
content-encoding: gzip
cf-cache-status: HIT
etag: W/"fda5882b24ca5a84d04d090722dc713b"
age: 78885
access-control-allow-methods: GET
x-amz-storage-class: INTELLIGENT_TIERING
x-evy-trace-listener: listener_https
date: Sat, 05 Oct 2024 15:46:45 GMT
x-hubspot-correlation-id: ee41d382-f86f-4c2a-b05e-18e7bdd32d8d
content-type: text/css
last-modified: Fri, 04 Oct 2024 17:51:10 GMT
vary: Accept-Encoding
x-amz-replication-status: COMPLETED
x-evy-trace-route-service-name: envoyset-translator
cache-control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900
timing-allow-origin: 7052064.fs1.hubspotusercontent-na1.net
x-evy-trace-served-by-pod: iad02/cms-cdn2-td/envoy-proxy-7dc48645dd-jbv7p
x-envoy-upstream-service-time: 201
cf-ray: 8cde8bd9b8d871c0-LHR
x-hs-cf-lambda-enforce: us-east-1.EnforceAclForReads 3
access-control-allow-origin: *
x-evy-trace-route-configuration: listener_https/all
x-amz-cf-pop: IAD89-C1
x-hs-alternate-content-type: text/plain
server: cloudflare
x-amz-meta-created-unix-time-millis: 1728064269033
x-amz-server-side-encryption: AES256

GET
H3 200 cr-master__cta.min.css
cdn2.hubspot.net/hub/3354902/hub_generated/template_assets/34470223313/1696396395659/__CR_Web_Platform/CSS/ 3 KB
2 KB 260ms
233ms Stylesheet
text/css 104.18.91.62
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn2.hubspot.net/hub/3354902/hub_generated/template_assets/34470223313/1696396395659/__CR_Web_Platform/CSS/cr-master__cta.min.css
Requested by: Host: www.cybereason.com
URL: https://www.cybereason.com/blog/cuckoo-spear-pt2-threat-actor-arsenal
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.91.62 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0c33072c2e37faa2b2acd3f76a15c44139cadb7999ec9405382b67eab4161003

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.cybereason.com/blog/cuckoo-spear-pt2-threat-actor-arsenal

Response headers

x-request-id: 4b6f05b0-d7ed-4d8a-a1c1-76540cfbbc9d
content-encoding: gzip
cf-cache-status: HIT
etag: W/"008f2c66892c6d50330665f22668fc4b"
age: 1497115
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ziAbRA5RFbSiFgmXbY3L9evpUAVV85rcRJGCuJcUNsvoTStKFWVbqznDYXx4krSPG%2Fq7WVr7G%2F7h9vsNEsgZ4KZV53ja%2FsJfJPGTpPi1SxSXizgHUbVtrhqt2Opa3erqUBo%3D"}],"group":"cf-nel","max_age":604800}
x-evy-trace-listener: listener_https
x-hubspot-correlation-id: 4b6f05b0-d7ed-4d8a-a1c1-76540cfbbc9d
content-type: text/css
last-modified: Wed, 04 Oct 2023 05:13:17 GMT
x-amz-replication-status: COMPLETED
x-evy-trace-route-service-name: envoyset-translator
cache-control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900
x-evy-trace-served-by-pod: iad02/cms-cdn2-td/envoy-proxy-fbf687555-q8s24
x-envoy-upstream-service-time: 164
x-hs-cf-lambda-enforce: us-east-1.EnforceAclForReads 3
x-hs-alternate-content-type: text/plain
server: cloudflare
x-evy-trace-virtual-host: all
x-hs-cf-lambda: us-east-1.EnforceAclForReads 3
x-amz-server-side-encryption: AES256
access-control-allow-methods: GET
x-amz-storage-class: INTELLIGENT_TIERING
date: Sat, 05 Oct 2024 15:46:45 GMT
vary: Accept-Encoding
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
timing-allow-origin: cdn2.hubspot.net
cf-ray: 8cde8bd95bf1413a-LHR
access-control-allow-origin: *
x-evy-trace-route-configuration: listener_https/all
x-amz-cf-pop: IAD89-C1
x-amz-meta-created-unix-time-millis: 1696396396421

GET
H3 200 cr-master__main.min.css
cdn2.hubspot.net/hub/3354902/hub_generated/template_assets/34470477360/1710134689941/__CR_Web_Platform/CSS/ 49 KB
12 KB 260ms
233ms Stylesheet
text/css 104.18.91.62
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn2.hubspot.net/hub/3354902/hub_generated/template_assets/34470477360/1710134689941/__CR_Web_Platform/CSS/cr-master__main.min.css
Requested by: Host: www.cybereason.com
URL: https://www.cybereason.com/blog/cuckoo-spear-pt2-threat-actor-arsenal
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.91.62 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 09edf98c454b11870a1a667cacab183aaf34e51f53dedb3fa735b9afac34f402

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.cybereason.com/blog/cuckoo-spear-pt2-threat-actor-arsenal

Response headers

x-request-id: e3daf319-860f-438d-b623-077d57463c13
content-encoding: gzip
cf-cache-status: HIT
etag: W/"c7c193ff64da90ae6964f13804257f02"
age: 1797568
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=0X4wBW8xBNPDpmC7APqiB6dex3fxww8CrwxIHh47U3nWgFNURA9d72ztAN0jHi8GxAAGZaOA9G1MWHjYcNRgkkvtGm4sy%2FmUTnmmONtR9UXrE%2F4xxT7hK2ptRppig9hKpNM%3D"}],"group":"cf-nel","max_age":604800}
x-evy-trace-listener: listener_https
x-hubspot-correlation-id: e3daf319-860f-438d-b623-077d57463c13
content-type: text/css
last-modified: Mon, 11 Mar 2024 05:24:51 GMT
x-amz-replication-status: COMPLETED
x-evy-trace-route-service-name: envoyset-translator
cache-control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900
x-evy-trace-served-by-pod: iad02/cms-cdn2-td/envoy-proxy-64d59778d6-f6gc6
x-envoy-upstream-service-time: 177
x-hs-cf-lambda-enforce: us-east-1.EnforceAclForReads 3
x-hs-alternate-content-type: text/plain
server: cloudflare
x-evy-trace-virtual-host: all
x-hs-cf-lambda: us-east-1.EnforceAclForReads 3
x-amz-server-side-encryption: AES256
access-control-allow-methods: GET
x-amz-storage-class: INTELLIGENT_TIERING
date: Sat, 05 Oct 2024 15:46:45 GMT
vary: Accept-Encoding
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
timing-allow-origin: cdn2.hubspot.net
cf-ray: 8cde8bd95bf3413a-LHR
access-control-allow-origin: *
x-evy-trace-route-configuration: listener_https/all
x-amz-cf-pop: IAD61-P1
x-amz-meta-created-unix-time-millis: 1710134690758

GET
H3 200 ionicons.min.css
cdn2.hubspot.net/hub/3354902/hub_generated/template_assets/35275979682/1642096258129/__CR_Web_Platform/CSS/ 50 KB
11 KB 227ms
200ms Stylesheet
text/css 104.18.91.62
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn2.hubspot.net/hub/3354902/hub_generated/template_assets/35275979682/1642096258129/__CR_Web_Platform/CSS/ionicons.min.css
Requested by: Host: www.cybereason.com
URL: https://www.cybereason.com/blog/cuckoo-spear-pt2-threat-actor-arsenal
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.91.62 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 72fe18777ebf37b44d58c82be9b67edceefb88c2c6984c614c72991d6e3b8853

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.cybereason.com/blog/cuckoo-spear-pt2-threat-actor-arsenal

Response headers

x-evy-trace-virtual-host: all
x-hs-cf-lambda: us-east-1.EnforceAclForReads 3
x-request-id: 36ee93fa-d93d-4482-b55b-55ab8cc53a0f
content-encoding: gzip
cf-cache-status: HIT
etag: W/"71c8c946791f3411c42a4cb1e9cdb5ed"
age: 1497115
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=h6xIFIAlHSxYS8C%2F7O0b7CzLSxSUvHDACq7DOIsN0Zjn644flBJL7h9r4WZa9GpWpcrp%2Fby7wwb0wRpgFgscSUqEN8o4CilizyWUDxraNGtJMrdvuDfRaMfuEeWG4M9bxbo%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-methods: GET
x-evy-trace-listener: listener_https
date: Sat, 05 Oct 2024 15:46:45 GMT
x-hubspot-correlation-id: 36ee93fa-d93d-4482-b55b-55ab8cc53a0f
content-type: text/css
last-modified: Thu, 13 Jan 2022 17:50:59 GMT
vary: Accept-Encoding
x-amz-replication-status: COMPLETED
x-evy-trace-route-service-name: envoyset-translator
cache-control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900
timing-allow-origin: cdn2.hubspot.net
x-evy-trace-served-by-pod: iad02/cms-cdn2-td/envoy-proxy-64786dc485-64hnd
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-envoy-upstream-service-time: 239
cf-ray: 8cde8bd95be9413a-LHR
x-hs-cf-lambda-enforce: us-east-1.EnforceAclForReads 3
access-control-allow-origin: *
x-evy-trace-route-configuration: listener_https/all
x-amz-cf-pop: IAD89-C1
x-hs-alternate-content-type: text/plain
server: cloudflare
x-amz-meta-created-unix-time-millis: 1642096258332
x-amz-server-side-encryption: AES256

GET
H3 200 cr-mln__build.min.css
cdn2.hubspot.net/hub/3354902/hub_generated/template_assets/42760289143/1724041950600/__CR_Web_Platform/CSS/ 23 KB
6 KB 261ms
233ms Stylesheet
text/css 104.18.91.62
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn2.hubspot.net/hub/3354902/hub_generated/template_assets/42760289143/1724041950600/__CR_Web_Platform/CSS/cr-mln__build.min.css
Requested by: Host: www.cybereason.com
URL: https://www.cybereason.com/blog/cuckoo-spear-pt2-threat-actor-arsenal
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.91.62 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 510835fe8939dd32b7388d00f583d2f080f9d6bcfc2c9d21098407d000065c22

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.cybereason.com/blog/cuckoo-spear-pt2-threat-actor-arsenal

Response headers

x-request-id: a2e312ab-405b-4f4f-b11b-6ceb5a757cc5
content-encoding: gzip
cf-cache-status: HIT
etag: W/"fc8b84a5028f90fd340e1c6e0dc5ef52"
age: 1500553
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=VcE6n0pLZCilqjFFS4Cpos316ezMMBEQEPNGJYZM%2B8FJVxaN2yaCJ14srGJa2s%2F6VtrsEKlTKULJggmxTLgls456jIlIjDu7zrqPBma0t0RX1I5IVihNFHNI%2Ba5mgEFmVIw%3D"}],"group":"cf-nel","max_age":604800}
x-evy-trace-listener: listener_https
x-hubspot-correlation-id: a2e312ab-405b-4f4f-b11b-6ceb5a757cc5
content-type: text/css
last-modified: Mon, 19 Aug 2024 04:32:32 GMT
x-amz-replication-status: PENDING
x-evy-trace-route-service-name: envoyset-translator
cache-control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900
x-evy-trace-served-by-pod: iad02/cms-cdn2-td/envoy-proxy-6748d4cfc8-dwjx9
x-envoy-upstream-service-time: 160
x-hs-cf-lambda-enforce: us-east-1.EnforceAclForReads 3
x-hs-alternate-content-type: text/plain
server: cloudflare
x-evy-trace-virtual-host: all
x-hs-cf-lambda: us-east-1.EnforceAclForReads 3
x-amz-server-side-encryption: AES256
access-control-allow-methods: GET
x-amz-storage-class: INTELLIGENT_TIERING
date: Sat, 05 Oct 2024 15:46:45 GMT
vary: Accept-Encoding
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
timing-allow-origin: cdn2.hubspot.net
cf-ray: 8cde8bd95bf5413a-LHR
access-control-allow-origin: *
x-evy-trace-route-configuration: listener_https/all
x-amz-cf-pop: IAD89-C1
x-amz-meta-created-unix-time-millis: 1724041951446

GET
H3 200 cr-framework__bulma-columns.min.css
cdn2.hubspot.net/hub/3354902/hub_generated/template_assets/34470224480/1635957556830/__CR_Web_Platform/CSS/bulma/ 19 KB
4 KB 261ms
234ms Stylesheet
text/css 104.18.91.62
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn2.hubspot.net/hub/3354902/hub_generated/template_assets/34470224480/1635957556830/__CR_Web_Platform/CSS/bulma/cr-framework__bulma-columns.min.css
Requested by: Host: www.cybereason.com
URL: https://www.cybereason.com/blog/cuckoo-spear-pt2-threat-actor-arsenal
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.91.62 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 81c836c05ab1f2d37b7aa60d509a656c7a441e2a4fabf035c1b0666a4daa50fa

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.cybereason.com/blog/cuckoo-spear-pt2-threat-actor-arsenal

Response headers

x-evy-trace-virtual-host: all
x-hs-cf-lambda: us-east-1.EnforceAclForReads 3
x-request-id: 543654a4-47bc-4cbe-aeab-93f119b139ca
content-encoding: gzip
cf-cache-status: HIT
etag: W/"636c18615b58fca9536b2e1c578c6db7"
age: 2395861
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=2P9jT0JEohgMaxRjvI7AC9iB7FtLDhyYHc%2FdZNFpTC2SA1Dh35VBwh1d8bFHkda5lt6u4HiAT6itjlpidSQD8RzGt72ztsUXI7kpHcA4oCtNcjnoOkgTQPdUdJkeB5hJbds%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-methods: GET
x-evy-trace-listener: listener_https
date: Sat, 05 Oct 2024 15:46:45 GMT
x-hubspot-correlation-id: 543654a4-47bc-4cbe-aeab-93f119b139ca
content-type: text/css
last-modified: Wed, 03 Nov 2021 16:39:17 GMT
vary: Accept-Encoding
x-amz-replication-status: COMPLETED
x-evy-trace-route-service-name: envoyset-translator
cache-control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900
timing-allow-origin: cdn2.hubspot.net
x-evy-trace-served-by-pod: iad02/cms-cdn2-td/envoy-proxy-7bc58b7fb6-49c4c
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-envoy-upstream-service-time: 177
cf-ray: 8cde8bd95bf7413a-LHR
x-hs-cf-lambda-enforce: us-east-1.EnforceAclForReads 3
access-control-allow-origin: *
x-evy-trace-route-configuration: listener_https/all
x-amz-cf-pop: IAD89-C1
x-hs-alternate-content-type: text/plain
server: cloudflare
x-amz-meta-created-unix-time-millis: 1635957556893
x-amz-server-side-encryption: AES256

GET
H3 200 cr-framework__bulma.min.css
cdn2.hubspot.net/hub/3354902/hub_generated/template_assets/35291999472/1696396871390/__CR_Web_Platform/CSS/bulma/ 62 KB
12 KB 195ms
168ms Stylesheet
text/css 104.18.91.62
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn2.hubspot.net/hub/3354902/hub_generated/template_assets/35291999472/1696396871390/__CR_Web_Platform/CSS/bulma/cr-framework__bulma.min.css
Requested by: Host: www.cybereason.com
URL: https://www.cybereason.com/blog/cuckoo-spear-pt2-threat-actor-arsenal
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.91.62 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 85ce42d99ae7d93a9df2304eedc16e1b26d492c38f5b9d034ea5c09c8a996c8f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.cybereason.com/blog/cuckoo-spear-pt2-threat-actor-arsenal

Response headers

x-request-id: ed617e63-b4b4-43bf-8d6c-8084c1d0a9bd
content-encoding: gzip
cf-cache-status: HIT
etag: W/"d320036a903c067c37b9ccf5619f0cb2"
age: 370096
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=r8skS4T5BUWC1UburQ8LyEORrDcn9lhHF4yGIroMv%2FLRAUJU%2BGTHhV3%2BY8m8rf7Yn7dlDuNN8PkM1gTFAlGbV6%2FIFZNyKgnCOZe8rGGUYL0J5B0dTkT97G5dmIU1sJqCW88%3D"}],"group":"cf-nel","max_age":604800}
x-evy-trace-listener: listener_https
x-hubspot-correlation-id: ed617e63-b4b4-43bf-8d6c-8084c1d0a9bd
content-type: text/css
last-modified: Wed, 04 Oct 2023 05:21:13 GMT
x-amz-replication-status: COMPLETED
x-evy-trace-route-service-name: envoyset-translator
cache-control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900
x-evy-trace-served-by-pod: iad02/cms-cdn2-td/envoy-proxy-7bc58b7fb6-9fg76
x-envoy-upstream-service-time: 215
x-hs-cf-lambda-enforce: us-east-1.EnforceAclForReads 3
x-hs-alternate-content-type: text/plain
server: cloudflare
x-evy-trace-virtual-host: all
x-hs-cf-lambda: us-east-1.EnforceAclForReads 3
x-amz-server-side-encryption: AES256
access-control-allow-methods: GET
x-amz-storage-class: INTELLIGENT_TIERING
date: Sat, 05 Oct 2024 15:46:45 GMT
vary: Accept-Encoding
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
timing-allow-origin: cdn2.hubspot.net
cf-ray: 8cde8bd95bf8413a-LHR
access-control-allow-origin: *
x-evy-trace-route-configuration: listener_https/all
x-amz-cf-pop: IAD89-C1
x-amz-meta-created-unix-time-millis: 1696396872359

GET
H3 200 hamburger-animation.min.css
cdn2.hubspot.net/hub/3354902/hub_generated/template_assets/42363645447/1635957556555/__CR_Web_Platform/CSS/ 22 KB
4 KB 227ms
200ms Stylesheet
text/css 104.18.91.62
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn2.hubspot.net/hub/3354902/hub_generated/template_assets/42363645447/1635957556555/__CR_Web_Platform/CSS/hamburger-animation.min.css
Requested by: Host: www.cybereason.com
URL: https://www.cybereason.com/blog/cuckoo-spear-pt2-threat-actor-arsenal
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.91.62 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c9130ee8c979a74ab038cf5e8a06db5cb94253eab35ea5242f515d605f4781ad

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.cybereason.com/blog/cuckoo-spear-pt2-threat-actor-arsenal

Response headers

x-evy-trace-virtual-host: all
x-hs-cf-lambda: us-east-1.EnforceAclForReads 3
x-request-id: 0e4c0d4d-64a5-4350-9fde-08a0b0a770c5
content-encoding: gzip
cf-cache-status: HIT
etag: W/"a0b451fd96744fa455495e022542ab86"
age: 1797568
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ZcqfsD3D08zCn5ghV4d4freTxRVPBLWbMOTZoD27Fux826qbkPH5n4BormBImdlzd%2BcEcxPfko9FL5rA4fxwBKb98ciB7E9P4BuLBWIjc%2FviAUIxLvpGZ8GQwfar%2FDEcZOM%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-methods: GET
x-evy-trace-listener: listener_https
date: Sat, 05 Oct 2024 15:46:45 GMT
x-hubspot-correlation-id: 0e4c0d4d-64a5-4350-9fde-08a0b0a770c5
content-type: text/css
last-modified: Wed, 03 Nov 2021 16:39:17 GMT
vary: Accept-Encoding
x-amz-replication-status: COMPLETED
x-evy-trace-route-service-name: envoyset-translator
cache-control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900
timing-allow-origin: cdn2.hubspot.net
x-evy-trace-served-by-pod: iad02/cms-cdn2-td/envoy-proxy-64d59778d6-jrv7z
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-envoy-upstream-service-time: 235
cf-ray: 8cde8bd95be7413a-LHR
x-hs-cf-lambda-enforce: us-east-1.EnforceAclForReads 3
access-control-allow-origin: *
x-evy-trace-route-configuration: listener_https/all
x-amz-cf-pop: IAD61-P1
x-hs-alternate-content-type: text/plain
server: cloudflare
x-amz-meta-created-unix-time-millis: 1635957556622
x-amz-server-side-encryption: AES256

GET
H3 200 animate.min.css
cdn2.hubspot.net/hub/3354902/hub_generated/template_assets/42507091846/1635957557027/__CR_Web_Platform/CSS/ 52 KB
6 KB 229ms
203ms Stylesheet
text/css 104.18.91.62
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn2.hubspot.net/hub/3354902/hub_generated/template_assets/42507091846/1635957557027/__CR_Web_Platform/CSS/animate.min.css
Requested by: Host: www.cybereason.com
URL: https://www.cybereason.com/blog/cuckoo-spear-pt2-threat-actor-arsenal
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.91.62 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b48f9a7031474a0f73f92f2e6cbbfad730b5466cda96d86a4459c06efc986173

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.cybereason.com/blog/cuckoo-spear-pt2-threat-actor-arsenal

Response headers

x-evy-trace-virtual-host: all
x-hs-cf-lambda: us-east-1.EnforceAclForReads 3
x-request-id: a8a7872d-3e2b-4216-b8b8-465b48e8dd51
content-encoding: gzip
cf-cache-status: HIT
etag: W/"55009d64191e6f9e712a841773ee6611"
age: 1325700
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=yNo9kgbt8PYodAxLEz9r996v26TTSf5yVyH1Ba3k5hL5J2P2bu7bilN%2Fs9PiAPSYSO97n3y1HdP1Hmgk6kja9PO7z0FVdDpBBePnJxzfI%2FZAbnseCwcXjmh99taiCEooqV8%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-methods: GET
x-evy-trace-listener: listener_https
date: Sat, 05 Oct 2024 15:46:45 GMT
x-hubspot-correlation-id: a8a7872d-3e2b-4216-b8b8-465b48e8dd51
content-type: text/css
last-modified: Wed, 03 Nov 2021 16:39:18 GMT
vary: Accept-Encoding
x-amz-replication-status: COMPLETED
x-evy-trace-route-service-name: envoyset-translator
cache-control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900
timing-allow-origin: cdn2.hubspot.net
x-evy-trace-served-by-pod: iad02/cms-cdn2-td/envoy-proxy-c8b596779-qb4kw
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-envoy-upstream-service-time: 161
cf-ray: 8cde8bd95bea413a-LHR
x-hs-cf-lambda-enforce: us-east-1.EnforceAclForReads 3
access-control-allow-origin: *
x-evy-trace-route-configuration: listener_https/all
x-amz-cf-pop: IAD89-C1
x-hs-alternate-content-type: text/plain
server: cloudflare
x-amz-meta-created-unix-time-millis: 1635957557027
x-amz-server-side-encryption: AES256

GET
H2 200 font-awesome.min.css
cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/css/ 30 KB
6 KB 122ms
52ms Stylesheet
text/css 2606:4700::6811:190e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/css/font-awesome.min.css

Requested by

Host: www.cybereason.com
URL: https://www.cybereason.com/blog/cuckoo-spear-pt2-threat-actor-arsenal

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:190e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.cybereason.com/blog/cuckoo-spear-pt2-threat-actor-arsenal

Response headers

cf-cdnjs-via: cfworker/kv
content-encoding: br
cf-cache-status: HIT
etag: "5eb03e5f-7918"
age: 137975
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=YMp1fpSL2hfQ9WD0aaNGhhPKEDPMNL2zBuSoEnZclZXFJVklcL8UDh9y0KHhrmiUH54C3IKRyz%2FfRgrDbuC22Oi%2BTSBzG6qAUDrq%2FS%2BGldPXwRq9uM5j49FzkAcGeAZ2ZxKLgx%2FOZaE1HvGvbTeiGw8Q"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
expires: Thu, 25 Sep 2025 15:46:45 GMT
date: Sat, 05 Oct 2024 15:46:45 GMT
content-type: text/css; charset=utf-8
last-modified: Mon, 04 May 2020 16:10:07 GMT
vary: Accept-Encoding
strict-transport-security: max-age=15780000
cache-control: public, max-age=30672000
timing-allow-origin: *
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
cross-origin-resource-policy: cross-origin
cf-ray: 8cde8bd9ae256519-LHR
accept-ranges: bytes
access-control-allow-origin: *
content-length: 5631
server: cloudflare

GET
H2 200 css2
fonts.googleapis.com/ 21 KB
1 KB 149ms
53ms Stylesheet
text/css 2a00:1450:4001:830::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Inter:wght@100;200;300;400;500;600;700;800;900&display=swap

Requested by

Host: www.cybereason.com
URL: https://www.cybereason.com/blog/cuckoo-spear-pt2-threat-actor-arsenal

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

fb121c45f498cba0f88de6e2235d95cf3307bb9ed5376f6a793b8253a520592f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.cybereason.com/blog/cuckoo-spear-pt2-threat-actor-arsenal

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Sat, 05 Oct 2024 15:46:45 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 05 Oct 2024 15:46:45 GMT
content-type: text/css; charset=utf-8
last-modified: Sat, 05 Oct 2024 13:51:42 GMT
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
cross-origin-opener-policy: same-origin-allow-popups
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
x-xss-protection: 0
server: ESF

GET
H2 200 marker-animation.js Show response
www.cybereason.com/hubfs/dam/plugins/ 6 KB
3 KB 112ms
111ms Script
application/javascript 45.60.64.106
INCAPSULA

General

Check archive.org

Show headers Download Go to

Full URL

https://www.cybereason.com/hubfs/dam/plugins/marker-animation.js

Requested by

Host: www.cybereason.com
URL: https://www.cybereason.com/blog/cuckoo-spear-pt2-threat-actor-arsenal

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

45.60.64.106 , United States, ASN19551 (INCAPSULA, US),

Reverse DNS

Software

Resource Hash

843803aeba82f94da6f1cbe1f853ccd12f5d7cc6a3afa20923e57e5df60c412d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.cybereason.com/blog/cuckoo-spear-pt2-threat-actor-arsenal

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
x-iinfo: 5-10290491-0 0CNN RT(1728143204667 323) q(0 -1 -1 -1) r(0 -1)
cache-control: max-age=786115, s-maxage=2168515, public
content-encoding: gzip
etag: W/"c789451d244987df6815383a74c748e9"
x-cdn: Imperva
content-length: 2419
date: Sat, 05 Oct 2024 15:46:44 GMT
last-modified: Tue, 27 Oct 2020 17:09:14 GMT
content-type: application/javascript

GET
H2 200 cr-logo-inline--primary-black.png
www.cybereason.com/hubfs/dam/images/images-web/logos/cr-brand/ 4 KB
4 KB 110ms
109ms Image
image/webp 45.60.64.106
INCAPSULA

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.cybereason.com/hubfs/dam/images/images-web/logos/cr-brand/cr-logo-inline--primary-black.png

Requested by

Host: www.cybereason.com
URL: https://www.cybereason.com/blog/cuckoo-spear-pt2-threat-actor-arsenal

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

45.60.64.106 , United States, ASN19551 (INCAPSULA, US),

Reverse DNS

Software

Resource Hash

20e041cb509df34abb6a3ac62c3702931561a0dcbc2d683a5ad85adae7b88f15

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.cybereason.com/blog/cuckoo-spear-pt2-threat-actor-arsenal

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
x-iinfo: 5-10290491-0 0CNN RT(1728143204667 324) q(0 -1 -1 -1) r(0 -1)
cache-control: max-age=859496, s-maxage=2241896, public
etag: "0200a44af913040fda048d2ccd029463"
x-cdn: Imperva
content-length: 3988
date: Sat, 05 Oct 2024 15:46:44 GMT
last-modified: Fri, 03 Dec 2021 18:08:59 GMT
content-type: image/webp

GET
H2 200 cr-malicious-life-logo-v2.png
www.cybereason.com/hubfs/dam/images/images-web/logos/cr-brand/ 35 KB
35 KB 111ms
110ms Image
image/png 45.60.64.106
INCAPSULA

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.cybereason.com/hubfs/dam/images/images-web/logos/cr-brand/cr-malicious-life-logo-v2.png

Requested by

Host: www.cybereason.com
URL: https://www.cybereason.com/blog/cuckoo-spear-pt2-threat-actor-arsenal

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

45.60.64.106 , United States, ASN19551 (INCAPSULA, US),

Reverse DNS

Software

Resource Hash

1ef8b59b832109ecbec2f9ed52e8073e2ab73862fa5e6697e1fe05d1c8358a02

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.cybereason.com/blog/cuckoo-spear-pt2-threat-actor-arsenal

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
x-iinfo: 5-10290491-0 0CNN RT(1728143204667 325) q(0 -1 -1 -1) r(0 -1)
cache-control: max-age=690919, s-maxage=2073319, public
etag: "4f8f695cfdda0e2a9e41271fd3ef4840"
x-cdn: Imperva
content-length: 35653
date: Sat, 05 Oct 2024 15:46:44 GMT
last-modified: Wed, 15 Dec 2021 18:41:35 GMT
content-type: image/png

GET
H2 200 cr-blog-icon--search-dark-gray.png
www.cybereason.com/hubfs/dam/images/images-web/blog-images/template-images/ 440 B
595 B 44ms
44ms Image
image/png 45.60.64.106
INCAPSULA

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.cybereason.com/hubfs/dam/images/images-web/blog-images/template-images/cr-blog-icon--search-dark-gray.png

Requested by

Host: www.cybereason.com
URL: https://www.cybereason.com/blog/cuckoo-spear-pt2-threat-actor-arsenal

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

45.60.64.106 , United States, ASN19551 (INCAPSULA, US),

Reverse DNS

Software

Resource Hash

e90344957225c9e0caa52e2591fd6066740e0650bc100c422435762160fb2e33

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.cybereason.com/blog/cuckoo-spear-pt2-threat-actor-arsenal

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
x-iinfo: 5-10290491-0 0CNN RT(1728143204667 422) q(0 -1 -1 -1) r(0 -1)
cache-control: max-age=690919, s-maxage=2073319, public
etag: "5285e68f20ece59da650da19c81751e2"
x-cdn: Imperva
content-length: 440
date: Sat, 05 Oct 2024 15:46:45 GMT
last-modified: Wed, 03 Mar 2021 03:19:57 GMT
content-type: image/png

GET
H2 200 cuckoo-spear-pt-2-featured.png
www.cybereason.com/hubfs/dam/images/images-web/featured-images/ 435 KB
436 KB 45ms
45ms Image
image/png 45.60.64.106
INCAPSULA

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.cybereason.com/hubfs/dam/images/images-web/featured-images/cuckoo-spear-pt-2-featured.png

Requested by

Host: www.cybereason.com
URL: https://www.cybereason.com/blog/cuckoo-spear-pt2-threat-actor-arsenal

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

45.60.64.106 , United States, ASN19551 (INCAPSULA, US),

Reverse DNS

Software

Resource Hash

1881e98c1d0475105f722991f9f574e5fd0e0c1da957e4b6efa0e5e1a870c7d1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.cybereason.com/blog/cuckoo-spear-pt2-threat-actor-arsenal

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
x-iinfo: 5-10290491-0 0CNN RT(1728143204667 454) q(0 -1 -1 -1) r(0 -1)
cache-control: max-age=180068, s-maxage=1562468, public
etag: "55704cea54d58a6c65d929037e136311"
x-cdn: Imperva
content-length: 445602
date: Sat, 05 Oct 2024 15:46:45 GMT
last-modified: Mon, 23 Sep 2024 17:47:46 GMT
content-type: image/png

GET
H2 200 twitter-gray.svg
www.cybereason.com/hubfs/dam/images/images-web/blog-images/template-images/ 749 B
617 B 75ms
75ms Image
image/svg+xml 45.60.64.106
INCAPSULA

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.cybereason.com/hubfs/dam/images/images-web/blog-images/template-images/twitter-gray.svg

Requested by

Host: www.cybereason.com
URL: https://www.cybereason.com/blog/cuckoo-spear-pt2-threat-actor-arsenal

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

45.60.64.106 , United States, ASN19551 (INCAPSULA, US),

Reverse DNS

Software

Resource Hash

f9db6465a204cc4186368b72a0ba4f063e64569aa4fc96e0f40c7ac69423121b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.cybereason.com/blog/cuckoo-spear-pt2-threat-actor-arsenal

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
x-iinfo: 5-10290491-0 0CNN RT(1728143204667 467) q(0 -1 -1 -1) r(0 -1)
cache-control: max-age=761976, s-maxage=2144376, public
content-encoding: gzip
etag: W/"5c103d0cd978b3a8d7ccab6bff714599"
x-cdn: Imperva
content-length: 438
date: Sat, 05 Oct 2024 15:46:45 GMT
last-modified: Thu, 01 Apr 2021 02:23:43 GMT
content-type: image/svg+xml

GET
H2 200 facebook-gray.svg
www.cybereason.com/hubfs/dam/images/images-web/blog-images/template-images/ 372 B
411 B 49ms
46ms Image
image/svg+xml 45.60.64.106
INCAPSULA

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.cybereason.com/hubfs/dam/images/images-web/blog-images/template-images/facebook-gray.svg

Requested by

Host: www.cybereason.com
URL: https://www.cybereason.com/blog/cuckoo-spear-pt2-threat-actor-arsenal

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

45.60.64.106 , United States, ASN19551 (INCAPSULA, US),

Reverse DNS

Software

Resource Hash

d82231820461c83d1b0966caae71bd2732bd89e9a910fdb90d193c3dca16dbc7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.cybereason.com/blog/cuckoo-spear-pt2-threat-actor-arsenal

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
x-iinfo: 5-10290491-0 0CNN RT(1728143204667 778) q(0 -1 -1 -1) r(0 -1)
cache-control: max-age=761976, s-maxage=2144376, public
content-encoding: gzip
etag: W/"8c22d0d78005c386bf29edacfdd2360d"
x-cdn: Imperva
content-length: 299
date: Sat, 05 Oct 2024 15:46:45 GMT
last-modified: Thu, 01 Apr 2021 02:23:43 GMT
content-type: image/svg+xml

GET
H2 200 linkedin-gray.svg
www.cybereason.com/hubfs/dam/images/images-web/blog-images/template-images/ 742 B
797 B 51ms
50ms Image
image/svg+xml 45.60.64.106
INCAPSULA

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.cybereason.com/hubfs/dam/images/images-web/blog-images/template-images/linkedin-gray.svg

Requested by

Host: www.cybereason.com
URL: https://www.cybereason.com/blog/cuckoo-spear-pt2-threat-actor-arsenal

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

45.60.64.106 , United States, ASN19551 (INCAPSULA, US),

Reverse DNS

Software

Resource Hash

12127e3110351f54262db955bafe353593dd58c89c7f6b6fc159c10515e93c61

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.cybereason.com/blog/cuckoo-spear-pt2-threat-actor-arsenal

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
x-iinfo: 5-10290491-0 0CNN RT(1728143204667 780) q(0 -1 -1 -1) r(0 -1)
cache-control: max-age=761975, s-maxage=2144375, public
content-encoding: gzip
etag: W/"446340b1a8e73ee28b1a47837a13fdf3"
x-cdn: Imperva
content-length: 630
date: Sat, 05 Oct 2024 15:46:45 GMT
last-modified: Wed, 07 Apr 2021 01:13:30 GMT
content-type: image/svg+xml

GET
H2 200 Cybereason%20Logo-1.png
www.cybereason.com/hubfs/Cybereason%20Logos/ 20 KB
20 KB 62ms
60ms Image
image/png 45.60.64.106
INCAPSULA

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.cybereason.com/hubfs/Cybereason%20Logos/Cybereason%20Logo-1.png

Requested by

Host: www.cybereason.com
URL: https://www.cybereason.com/blog/cuckoo-spear-pt2-threat-actor-arsenal

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

45.60.64.106 , United States, ASN19551 (INCAPSULA, US),

Reverse DNS

Software

Resource Hash

95d5bb11fee6ddf9b6af49e5c0621d6dd3b84fdc5798795e38254ff8bbaace63

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.cybereason.com/blog/cuckoo-spear-pt2-threat-actor-arsenal

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
x-iinfo: 5-10290491-10275526 2CNN RT(1728143204667 783) q(0 0 0 -1) r(0 0) U18
cache-control: max-age=838101, s-maxage=2220501, public
etag: "bb8af0e3289ae9b68724e089579b56f2"
x-cdn: Imperva
content-length: 20589
date: Sat, 05 Oct 2024 15:46:45 GMT
last-modified: Thu, 04 Aug 2022 15:52:18 GMT
content-type: image/png

GET
H2 200 cuckoo-spear-part-1-analysis-blog-analysis-featured.png
www.cybereason.com/hubfs/dam/images/images-web/featured-images/ 441 KB
441 KB 55ms
53ms Image
image/png 45.60.64.106
INCAPSULA

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.cybereason.com/hubfs/dam/images/images-web/featured-images/cuckoo-spear-part-1-analysis-blog-analysis-featured.png

Requested by

Host: www.cybereason.com
URL: https://www.cybereason.com/blog/cuckoo-spear-pt2-threat-actor-arsenal

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

45.60.64.106 , United States, ASN19551 (INCAPSULA, US),

Reverse DNS

Software

Resource Hash

dff757e0f7208bd207eec7d4d78e52d0c6df01ccbec7914c431f9647d4ab7fdd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.cybereason.com/blog/cuckoo-spear-pt2-threat-actor-arsenal

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
x-iinfo: 5-10290491-0 0CNN RT(1728143204667 784) q(0 -1 -1 -1) r(0 -1)
cache-control: max-age=0, s-maxage=703498, public
etag: "e32b61c767637beab85fc664923f28e4"
x-cdn: Imperva
content-length: 451302
date: Sat, 05 Oct 2024 15:46:45 GMT
last-modified: Fri, 13 Sep 2024 19:11:23 GMT
content-type: image/png

GET
H2 200 Black%20Basta%20Threat%20Alert.png
www.cybereason.com/hubfs/ 268 KB
270 KB 66ms
64ms Image
image/png 45.60.64.106
INCAPSULA

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.cybereason.com/hubfs/Black%20Basta%20Threat%20Alert.png

Requested by

Host: www.cybereason.com
URL: https://www.cybereason.com/blog/cuckoo-spear-pt2-threat-actor-arsenal

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

45.60.64.106 , United States, ASN19551 (INCAPSULA, US),

Reverse DNS

Software

Resource Hash

dcd1c4f42f60b4b47c4e548e2b2623d3c9d2acebd088c4be52defd5279f413e3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.cybereason.com/blog/cuckoo-spear-pt2-threat-actor-arsenal

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
x-iinfo: 5-10290491-10281200 2CNN RT(1728143204667 787) q(0 0 0 -1) r(0 0) U18
cache-control: max-age=69449, s-maxage=1451849, public
etag: "5b6aa8f43d016e740e4ee0a84f1e75da"
x-cdn: Imperva
content-length: 274862
date: Sat, 05 Oct 2024 15:46:45 GMT
last-modified: Mon, 21 Nov 2022 13:44:00 GMT
content-type: image/png

GET
H2 200 cr-logo-inline--primary-white.png
www.cybereason.com/hubfs/dam/images/images-web/logos/cr-brand/ 5 KB
5 KB 60ms
58ms Image
image/png 45.60.64.106
INCAPSULA

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.cybereason.com/hubfs/dam/images/images-web/logos/cr-brand/cr-logo-inline--primary-white.png

Requested by

Host: www.cybereason.com
URL: https://www.cybereason.com/blog/cuckoo-spear-pt2-threat-actor-arsenal

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

45.60.64.106 , United States, ASN19551 (INCAPSULA, US),

Reverse DNS

Software

Resource Hash

8f657cd3617d00d51bbc4dee693b71bde939c80310034a8d82641804d4eb7e16

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.cybereason.com/blog/cuckoo-spear-pt2-threat-actor-arsenal

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
x-iinfo: 5-10290491-0 0CNN RT(1728143204667 789) q(0 -1 -1 -1) r(0 -1)
cache-control: max-age=0, s-maxage=706552, public
etag: "9fa007f86be3dd9a921a2d00bf86f36e"
x-cdn: Imperva
content-length: 4953
date: Sat, 05 Oct 2024 15:46:45 GMT
last-modified: Fri, 03 Dec 2021 18:09:12 GMT
content-type: image/png

GET
H2 200 embed.js Show response
static.hsappstatic.net/content-cwv-embed/static-1.1293/ 13 KB
5 KB 131ms
52ms Script
application/javascript 2606:4700::6811:ad5b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://static.hsappstatic.net/content-cwv-embed/static-1.1293/embed.js

Requested by

Host: www.cybereason.com
URL: https://www.cybereason.com/blog/cuckoo-spear-pt2-threat-actor-arsenal

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:ad5b , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

cb5224674e43d02db0037517f4aa29ba5ce9ddd0672e513cc7289714ba657522

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.cybereason.com/blog/cuckoo-spear-pt2-threat-actor-arsenal

Response headers

content-encoding: gzip
cf-cache-status: HIT
x-amz-version-id: AFGFBaAC1397GFbOapH2DRIkjQ_NaZzY
etag: W/"f667e53d5752ee2e5759f3dfaf20d330"
age: 127595
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=YO7XtL8qnpMvcs9zv8tgF%2F9SOXEJK1zj45hIfQLyVxHQ%2F%2B8nsM5UlYFeLAxg3NOWiay134v6rNwCWTlTpG5ivhtl83ySygcUQrQAHIeSVXjtZzbeDhmeFxVMXPwzCRykK1yrmNWehzcCEglaLHx7X2vmWDs%3D"}],"group":"cf-nel","max_age":604800}
expires: Sun, 05 Oct 2025 15:46:45 GMT
x-cache: Miss from cloudfront
x-amz-cf-id: ialkeDDsQ4J9oa8KWkuPKZsIg-It7KMCt_nJlOdWvq2De-ujET_f7A==
date: Sat, 05 Oct 2024 15:46:45 GMT
content-type: application/javascript
last-modified: Mon, 23 Sep 2024 19:59:06 GMT
vary: Origin,Accept-Encoding,Access-Control-Request-Headers,Access-Control-Request-Method
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-amz-replication-status: COMPLETED
cache-control: public, max-age=31536000
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
via: 1.1 0316c07369e8911f4fffe6ae5475e30c.cloudfront.net (CloudFront)
cf-ray: 8cde8bdc9f38beda-LHR
x-amz-cf-pop: LHR50-P6
server: cloudflare
x-amz-server-side-encryption: AES256

GET
H3 200 animatedModal.min.js Show response
cdn2.hubspot.net/hub/3354902/hub_generated/template_assets/42507089303/1644440411417/__CR_Web_Platform/JS/animatedModal/ 2 KB
2 KB 152ms
152ms Script
application/javascript 104.18.91.62
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn2.hubspot.net/hub/3354902/hub_generated/template_assets/42507089303/1644440411417/__CR_Web_Platform/JS/animatedModal/animatedModal.min.js
Requested by: Host: www.cybereason.com
URL: https://www.cybereason.com/blog/cuckoo-spear-pt2-threat-actor-arsenal
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.91.62 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0f94c946a13b9ebe43281550b7d0c00edf4694ad06bcb4c8679bee6d48df5115

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.cybereason.com/blog/cuckoo-spear-pt2-threat-actor-arsenal

Response headers

x-evy-trace-virtual-host: all
x-hs-cf-lambda: us-east-1.EnforceAclForReads 3
x-request-id: c96bd0b6-8507-47cd-b86c-1f5f5f70319f
content-encoding: br
cf-cache-status: HIT
etag: W/"690ad93d1d2a9fc11f9df295692413fe"
age: 1797568
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=18xFa9%2Bu6xqo9%2FGe9UFvIF%2FfBdy8yuVzHwREiO9U0bpbhq8zzwhtiPYvnpG3kxH9QeNCIJhWcKioH3NySlUaLqgN0wNidcVVbE6kMtTzVsr10O9XaxsZ5mhyex7GFMTg3zE%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-methods: GET
x-evy-trace-listener: listener_https
date: Sat, 05 Oct 2024 15:46:45 GMT
x-hubspot-correlation-id: c96bd0b6-8507-47cd-b86c-1f5f5f70319f
content-type: application/javascript; charset=utf-8
last-modified: Wed, 09 Feb 2022 21:00:12 GMT
vary: Accept-Encoding
x-amz-replication-status: COMPLETED
x-evy-trace-route-service-name: envoyset-translator
cache-control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900
timing-allow-origin: cdn2.hubspot.net
x-evy-trace-served-by-pod: iad02/cms-cdn2-td/envoy-proxy-64d59778d6-jrv7z
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-envoy-upstream-service-time: 734
cf-ray: 8cde8bdb6eeb413a-LHR
x-hs-cf-lambda-enforce: us-east-1.EnforceAclForReads 3
access-control-allow-origin: *
x-evy-trace-route-configuration: listener_https/all
x-amz-cf-pop: IAD61-P1
x-hs-alternate-content-type: text/plain
server: cloudflare
x-amz-meta-created-unix-time-millis: 1644440411792
x-amz-server-side-encryption: AES256

GET
H3 200 module_41681847227_CR_-_Malicious_Life_Network_--_Tier_One_Header.min.js Show response
cdn2.hubspot.net/hub/3354902/hub_generated/module_assets/41681847227/1644941386128/ 374 B
1 KB 133ms
132ms Script
application/javascript 104.18.91.62
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn2.hubspot.net/hub/3354902/hub_generated/module_assets/41681847227/1644941386128/module_41681847227_CR_-_Malicious_Life_Network_--_Tier_One_Header.min.js
Requested by: Host: www.cybereason.com
URL: https://www.cybereason.com/blog/cuckoo-spear-pt2-threat-actor-arsenal
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.91.62 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 119bf322a2ce6d2a82422b51404bc54b375c881f12a120205598d1691fa48820

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.cybereason.com/blog/cuckoo-spear-pt2-threat-actor-arsenal

Response headers

x-evy-trace-virtual-host: all
x-hs-cf-lambda: us-east-1.EnforceAclForReads 3
x-request-id: e77e5727-b408-4997-9a6a-e88d798bbd10
content-encoding: br
cf-cache-status: HIT
etag: W/"1d7f81aaf24568ea5d90a82b829960fd"
age: 1493015
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=tSlo8jdlkKHQSEPBdwziWL5axWMgN%2FMy0MdPeJ%2FlHLjKrFdXz8sUjm4AH%2FE%2FyIazENzdLhnOfOnTw1H%2BFXiozIGYXQQIiG4K4JzSBBMnLaVkouw8f8ehDnYrjp1hPENL0i4%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-methods: GET
x-evy-trace-listener: listener_https
date: Sat, 05 Oct 2024 15:46:45 GMT
x-hubspot-correlation-id: e77e5727-b408-4997-9a6a-e88d798bbd10
content-type: application/javascript; charset=utf-8
last-modified: Tue, 15 Feb 2022 16:09:47 GMT
vary: Accept-Encoding
x-amz-replication-status: COMPLETED
x-evy-trace-route-service-name: envoyset-translator
cache-control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900
timing-allow-origin: cdn2.hubspot.net
x-evy-trace-served-by-pod: iad02/cms-cdn2-td/envoy-proxy-64d59778d6-f6gc6
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-envoy-upstream-service-time: 161
cf-ray: 8cde8bdb3eaa413a-LHR
x-hs-cf-lambda-enforce: us-east-1.EnforceAclForReads 3
access-control-allow-origin: *
x-evy-trace-route-configuration: listener_https/all
x-amz-cf-pop: IAD61-P1
x-hs-alternate-content-type: text/plain
server: cloudflare
x-amz-meta-created-unix-time-millis: 1644941386128
x-amz-server-side-encryption: AES256

GET
H3 200 module_41682410610_CR_-_Malicious_Life_Network_--_Main_Hero.min.js Show response
cdn2.hubspot.net/hub/3354902/hub_generated/module_assets/41682410610/1644941443113/ 305 B
1 KB 60ms
60ms Script
application/javascript 104.18.91.62
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn2.hubspot.net/hub/3354902/hub_generated/module_assets/41682410610/1644941443113/module_41682410610_CR_-_Malicious_Life_Network_--_Main_Hero.min.js
Requested by: Host: www.cybereason.com
URL: https://www.cybereason.com/blog/cuckoo-spear-pt2-threat-actor-arsenal
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.91.62 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 66ba9d76c09ad6dd52135d52c368f6d87ac40b5b4ce418e41a105fb221c7e470

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.cybereason.com/blog/cuckoo-spear-pt2-threat-actor-arsenal

Response headers

x-evy-trace-virtual-host: all
x-hs-cf-lambda: us-east-1.EnforceAclForReads 3
x-request-id: 6e8e632d-830a-47ce-a2b9-77d29be962a3
content-encoding: br
cf-cache-status: HIT
etag: W/"86f1ecf1077302d6bd359676a0142438"
age: 1399149
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=zmIQX0GHa4b9a%2FWbyqEuH4fBVhZb9ERPiPwpE5newYJkx%2BIuKzhUDBoF2tYcmokQ0LvSSDtSlfIHs9ichIFbwlrGxo8t12jH0XSqxD%2BrOeuUj%2FeXrbx2bK03G3wHmx3AO%2Bk%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-methods: GET
x-evy-trace-listener: listener_https
date: Sat, 05 Oct 2024 15:46:45 GMT
x-hubspot-correlation-id: 6e8e632d-830a-47ce-a2b9-77d29be962a3
content-type: application/javascript; charset=utf-8
last-modified: Tue, 15 Feb 2022 16:10:44 GMT
vary: Accept-Encoding
x-amz-replication-status: COMPLETED
x-evy-trace-route-service-name: envoyset-translator
cache-control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900
timing-allow-origin: cdn2.hubspot.net
x-evy-trace-served-by-pod: iad02/cms-cdn2-td/envoy-proxy-6f9f79465b-qd96f
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-envoy-upstream-service-time: 230
cf-ray: 8cde8bdbdf71413a-LHR
x-hs-cf-lambda-enforce: us-east-1.EnforceAclForReads 3
access-control-allow-origin: *
x-evy-trace-route-configuration: listener_https/all
x-amz-cf-pop: IAD89-C1
x-hs-alternate-content-type: text/plain
server: cloudflare
x-amz-meta-created-unix-time-millis: 1644941443113
x-amz-server-side-encryption: AES256

GET
H3 200 module_43300360745_CR_-_Malicious_Life_Network_--_Related_Posts.min.js Show response
cdn2.hubspot.net/hub/3354902/hub_generated/module_assets/43300360745/1724042213858/ 224 B
1 KB 87ms
86ms Script
application/javascript 104.18.91.62
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn2.hubspot.net/hub/3354902/hub_generated/module_assets/43300360745/1724042213858/module_43300360745_CR_-_Malicious_Life_Network_--_Related_Posts.min.js
Requested by: Host: www.cybereason.com
URL: https://www.cybereason.com/blog/cuckoo-spear-pt2-threat-actor-arsenal
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.91.62 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8fb95734be01fd3e163c6ebfb1c8d8d3f60e9339c7e4ec6a3040611cb1ed022c

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.cybereason.com/blog/cuckoo-spear-pt2-threat-actor-arsenal

Response headers

x-request-id: 3ae20dc9-76b5-483d-a73e-a7c7059601a3
content-encoding: br
cf-cache-status: HIT
etag: W/"ab8f6ede36e2a420f76e425adc28e107"
age: 1507710
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=MtFpuqUIi4kv1QelTS3pONb01KCPT9oJFVLycIBSKgEy0OOT0F4nokvbZ%2FSi6l9opbb%2B1gFc2RQzbjQX8%2F5Xja%2BqPS3qe3ULpzurk%2FdDO6OLOJqaPji1hBo1SJ4t1XX5QPs%3D"}],"group":"cf-nel","max_age":604800}
x-evy-trace-listener: listener_https
x-hubspot-correlation-id: 3ae20dc9-76b5-483d-a73e-a7c7059601a3
content-type: application/javascript; charset=utf-8
last-modified: Mon, 19 Aug 2024 04:36:54 GMT
x-amz-replication-status: COMPLETED
x-evy-trace-route-service-name: envoyset-translator
cache-control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900
x-evy-trace-served-by-pod: iad02/cms-cdn2-td/envoy-proxy-6748d4cfc8-b44gw
x-envoy-upstream-service-time: 174
x-hs-cf-lambda-enforce: us-east-1.EnforceAclForReads 3
x-hs-alternate-content-type: text/plain
server: cloudflare
x-evy-trace-virtual-host: all
x-hs-cf-lambda: us-east-1.EnforceAclForReads 3
x-amz-server-side-encryption: AES256
access-control-allow-methods: GET
x-amz-storage-class: INTELLIGENT_TIERING
date: Sat, 05 Oct 2024 15:46:45 GMT
vary: Accept-Encoding
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
timing-allow-origin: cdn2.hubspot.net
cf-ray: 8cde8bdbff9a413a-LHR
access-control-allow-origin: *
x-evy-trace-route-configuration: listener_https/all
x-amz-cf-pop: IAD89-C1
x-amz-meta-created-unix-time-millis: 1724042213858

GET
H3 200 module_86933076631_CR_-_Sticky_CTA_Bar.min.js Show response
cdn2.hubspot.net/hub/3354902/hub_generated/module_assets/86933076631/1669911113440/ 694 B
1 KB 76ms
75ms Script
application/javascript 104.18.91.62
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn2.hubspot.net/hub/3354902/hub_generated/module_assets/86933076631/1669911113440/module_86933076631_CR_-_Sticky_CTA_Bar.min.js
Requested by: Host: www.cybereason.com
URL: https://www.cybereason.com/blog/cuckoo-spear-pt2-threat-actor-arsenal
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.91.62 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 65a923b747d84787bc4e01270fa29f4314d3d36df432cd3eb801c30f8adfd466

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.cybereason.com/blog/cuckoo-spear-pt2-threat-actor-arsenal

Response headers

x-request-id: eb95ccea-1f68-4200-accd-0d6a4379ab20
content-encoding: br
cf-cache-status: HIT
etag: W/"de347f1a06cbb5270942bfc43d48cf48"
age: 1278463
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=6iVZv4KkTuuJNEMXg%2FJmXYLvknCZ3Hehv4VViHRsJm4dzs%2FEFNr%2F4Gfj3kkiHtPg8tskOcu7jZLNpc9VZe9%2B4oimSvRdUg%2F6fLI2vAzQDTqYfZdbJZ0gpWIZDJclNEnUgBQ%3D"}],"group":"cf-nel","max_age":604800}
x-evy-trace-listener: listener_https
x-hubspot-correlation-id: eb95ccea-1f68-4200-accd-0d6a4379ab20
content-type: application/javascript; charset=utf-8
last-modified: Thu, 01 Dec 2022 16:11:54 GMT
x-amz-replication-status: COMPLETED
x-evy-trace-route-service-name: envoyset-translator
cache-control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900
x-evy-trace-served-by-pod: iad02/cms-cdn2-td/envoy-proxy-6748d4cfc8-b44gw
x-envoy-upstream-service-time: 158
x-hs-cf-lambda-enforce: us-east-1.EnforceAclForReads 3
x-hs-alternate-content-type: text/plain
server: cloudflare
x-evy-trace-virtual-host: all
x-hs-cf-lambda: us-east-1.EnforceAclForReads 3
x-amz-server-side-encryption: AES256
access-control-allow-methods: GET
x-amz-storage-class: INTELLIGENT_TIERING
date: Sat, 05 Oct 2024 15:46:45 GMT
vary: Accept-Encoding
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
timing-allow-origin: cdn2.hubspot.net
cf-ray: 8cde8bdc1fc9413a-LHR
access-control-allow-origin: *
x-evy-trace-route-configuration: listener_https/all
x-amz-cf-pop: IAD89-C1
x-amz-meta-created-unix-time-millis: 1669911113440

GET
H2 200 3354902.js Show response
www.cybereason.com/hs/scriptloader/ 2 KB
823 B 72ms
71ms Script
application/javascript 45.60.64.106
INCAPSULA

General

Check archive.org

Show headers Download Go to

Full URL

https://www.cybereason.com/hs/scriptloader/3354902.js

Requested by

Host: www.cybereason.com
URL: https://www.cybereason.com/blog/cuckoo-spear-pt2-threat-actor-arsenal

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

45.60.64.106 , United States, ASN19551 (INCAPSULA, US),

Reverse DNS

Software

Resource Hash

2e497e2756df72cc07a32f2d68865371a1730c7e4aefe5120e5ee5a86f0b8a4b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.cybereason.com/blog/cuckoo-spear-pt2-threat-actor-arsenal

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
x-iinfo: 5-10290491-10266202 2CNN RT(1728143204667 792) q(0 0 0 -1) r(0 0)
cache-control: max-age=38, public
content-encoding: gzip
etag: "cba0f248"
x-cdn: Imperva
expires: Sat, 05 Oct 2024 15:47:23 GMT
content-length: 638
date: Sat, 05 Oct 2024 15:46:45 GMT
last-modified: Sat, 05 Oct 2024 15:45:54 GMT
content-type: application/javascript;charset=utf-8

GET
H2 200 index.js Show response
www.cybereason.com/hs/hsstatic/HubspotToolsMenu/static-1.354/js/ 12 KB
4 KB 63ms
62ms Script
application/javascript 45.60.64.106
INCAPSULA

General

Check archive.org

Show headers Download Go to

Full URL

https://www.cybereason.com/hs/hsstatic/HubspotToolsMenu/static-1.354/js/index.js

Requested by

Host: www.cybereason.com
URL: https://www.cybereason.com/blog/cuckoo-spear-pt2-threat-actor-arsenal

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

45.60.64.106 , United States, ASN19551 (INCAPSULA, US),

Reverse DNS

Software

Resource Hash

42c7e51d284cd7256caf3bfebf641141876657ea0d6e5588ac7e69dce1e9cf7e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.cybereason.com/blog/cuckoo-spear-pt2-threat-actor-arsenal

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
x-iinfo: 5-10290491-0 0CNN RT(1728143204667 794) q(0 -1 -1 -1) r(0 -1)
cache-control: max-age=27747126, public
content-encoding: gzip
etag: W/"3ef0deda0631561665e95645daf500a2"
x-cdn: Imperva
expires: Fri, 22 Aug 2025 19:18:51 GMT
content-length: 4369
date: Sat, 05 Oct 2024 15:46:45 GMT
last-modified: Wed, 21 Aug 2024 20:24:20 GMT
content-type: application/javascript

GET
H2 200 _Incapsula_Resource Show response
www.cybereason.com/ 81 KB
19 KB 69ms
68ms Script
application/javascript 45.60.64.106
INCAPSULA

General

Check archive.org

Show headers Download Go to

Full URL

https://www.cybereason.com/_Incapsula_Resource?SWJIYLWA=719d34d31c8e3a6e6fffd425f7e032f3&ns=1&cb=1210769897

Requested by

Host: www.cybereason.com
URL: https://www.cybereason.com/blog/cuckoo-spear-pt2-threat-actor-arsenal

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

45.60.64.106 , United States, ASN19551 (INCAPSULA, US),

Reverse DNS

Software

Resource Hash

ec1857dc06172ece7a701e3ff295788e6693551ff5bdb55ce76280415aa52d60

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.cybereason.com/blog/cuckoo-spear-pt2-threat-actor-arsenal

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
x-robots-tag: noindex
cache-control: no-cache, no-store
content-encoding: gzip
content-length: 19574
content-type: application/javascript

GET
H2 200 animate.min.css
cdnjs.cloudflare.com/ajax/libs/animate.css/4.1.1/ 70 KB
4 KB 46ms
45ms Stylesheet
text/css 2606:4700::6811:190e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/animate.css/4.1.1/animate.min.css

Requested by

Host: cdn2.hubspot.net
URL: https://cdn2.hubspot.net/hub/3354902/hub_generated/template_assets/34470477360/1710134689941/__CR_Web_Platform/CSS/cr-master__main.min.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:190e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5fbaeb9f8e25d7e0143bae61d4b1802c16ce7390b96ceb2d498b0d96ff4c853f

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://cdn2.hubspot.net/hub/3354902/hub_generated/template_assets/34470477360/1710134689941/__CR_Web_Platform/CSS/cr-master__main.min.css

Response headers

cf-cdnjs-via: cfworker/kv
content-encoding: br
cf-cache-status: HIT
etag: "5f5628a2-11846"
age: 430973
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=DlhM7Dm8n%2BeIRC1ir6lLLFSDpfPIbhMGqIgqYlLO%2BV9sqApn3%2F4tRnEr9JQ2YPe5sNooB3uWVkK4RTeKOgNJ%2FTZMubdq8Ms1GuZEHdYdX4KXccolrfvZbXelj0rvzBkAve8sefecx0bc8U82DJAPfxS4"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
expires: Thu, 25 Sep 2025 15:46:45 GMT
date: Sat, 05 Oct 2024 15:46:45 GMT
content-type: text/css; charset=utf-8
last-modified: Mon, 07 Sep 2020 12:33:38 GMT
vary: Accept-Encoding
strict-transport-security: max-age=15780000
cache-control: public, max-age=30672000
timing-allow-origin: *
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
cross-origin-resource-policy: cross-origin
cf-ray: 8cde8bdba9716519-LHR
accept-ranges: bytes
access-control-allow-origin: *
content-length: 4216
server: cloudflare

GET
H2 200 css2
fonts.googleapis.com/ 21 KB
984 B 53ms
53ms Stylesheet
text/css 2a00:1450:4001:830::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Barlow:ital,wght@0,100;0,200;0,300;0,400;0,500;0,600;0,700;0,800;0,900;1,100;1,200;1,300;1,400;1,500;1,600;1,700;1,800;1,900&display=swap

Requested by

Host: cdn2.hubspot.net
URL: https://cdn2.hubspot.net/hub/3354902/hub_generated/template_assets/34470477360/1710134689941/__CR_Web_Platform/CSS/cr-master__main.min.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

0f62e3e5f677efe75860052589b895e2252887cb0831bec361b5130ea2a67bc0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://cdn2.hubspot.net/hub/3354902/hub_generated/template_assets/34470477360/1710134689941/__CR_Web_Platform/CSS/cr-master__main.min.css

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Sat, 05 Oct 2024 15:46:45 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 05 Oct 2024 15:46:45 GMT
content-type: text/css; charset=utf-8
last-modified: Sat, 05 Oct 2024 14:27:46 GMT
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
cross-origin-opener-policy: same-origin-allow-popups
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
x-xss-protection: 0
server: ESF

GET
H2 200 css2
fonts.googleapis.com/ 22 KB
1006 B 62ms
62ms Stylesheet
text/css 2a00:1450:4001:830::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Barlow+Condensed:ital,wght@0,100;0,200;0,300;0,400;0,500;0,600;0,700;0,800;0,900;1,100;1,200;1,300;1,400;1,500;1,600;1,700;1,800;1,900&display=swap

Requested by

Host: cdn2.hubspot.net
URL: https://cdn2.hubspot.net/hub/3354902/hub_generated/template_assets/34470477360/1710134689941/__CR_Web_Platform/CSS/cr-master__main.min.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

b66b9b351cf699e4269a636d7dc515b51aaadbcf14af4a756d8a00b1929e9fe0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://cdn2.hubspot.net/hub/3354902/hub_generated/template_assets/34470477360/1710134689941/__CR_Web_Platform/CSS/cr-master__main.min.css

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Sat, 05 Oct 2024 15:46:45 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 05 Oct 2024 15:46:45 GMT
content-type: text/css; charset=utf-8
last-modified: Sat, 05 Oct 2024 15:22:13 GMT
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
cross-origin-opener-policy: same-origin-allow-popups
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
x-xss-protection: 0
server: ESF

GET
H2 200 css2
fonts.googleapis.com/ 78 KB
3 KB 66ms
66ms Stylesheet
text/css 2a00:1450:4001:830::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Barlow:ital,wght@0,100;0,200;0,300;0,400;0,500;0,600;0,700;0,800;0,900;1,100;1,200;1,300;1,400;1,500;1,600;1,700;1,800;1,900&family=Open+Sans:ital,wght@0,300;0,400;0,600;0,700;0,800;1,300;1,400;1,600;1,700;1,800&display=swap

Requested by

Host: cdn2.hubspot.net
URL: https://cdn2.hubspot.net/hub/3354902/hub_generated/template_assets/34470477360/1710134689941/__CR_Web_Platform/CSS/cr-master__main.min.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

d2733f3936960eead81ec9f71738a38869367d6711831096d3aad134338c2795

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://cdn2.hubspot.net/hub/3354902/hub_generated/template_assets/34470477360/1710134689941/__CR_Web_Platform/CSS/cr-master__main.min.css

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Sat, 05 Oct 2024 15:46:45 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 05 Oct 2024 15:46:45 GMT
content-type: text/css; charset=utf-8
last-modified: Sat, 05 Oct 2024 15:46:45 GMT
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
cross-origin-opener-policy: same-origin-allow-popups
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
x-xss-protection: 0
server: ESF

GET
H3 200 cr-master__cta.min.css
cdn2.hubspot.net/hub/3354902/hub_generated/template_assets/34470223313/1696396395659/__CR_Web_Platform/CSS/ 3 KB
1 KB 86ms
85ms Other
text/css 104.18.91.62
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn2.hubspot.net/hub/3354902/hub_generated/template_assets/34470223313/1696396395659/__CR_Web_Platform/CSS/cr-master__cta.min.css
Requested by: Host: www.cybereason.com
URL: https://www.cybereason.com/blog/cuckoo-spear-pt2-threat-actor-arsenal
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.91.62 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0c33072c2e37faa2b2acd3f76a15c44139cadb7999ec9405382b67eab4161003

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.cybereason.com/blog/cuckoo-spear-pt2-threat-actor-arsenal

Response headers

x-request-id: 4b6f05b0-d7ed-4d8a-a1c1-76540cfbbc9d
content-encoding: gzip
cf-cache-status: HIT
etag: W/"008f2c66892c6d50330665f22668fc4b"
age: 1497115
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=c8fYo45ACFZujEOUEdkUARUiPMC4cuwka%2Bcn8PArLKYF%2B6%2F0sYHTHWBrMBziMVBLvOTLMOVEV4HiR8yzFhPgDGgtTQ0EB6ZmtivFbUnkR6f8eyr2%2BqcjiSbY%2F4YNwzOJOu8%3D"}],"group":"cf-nel","max_age":604800}
x-evy-trace-listener: listener_https
x-hubspot-correlation-id: 4b6f05b0-d7ed-4d8a-a1c1-76540cfbbc9d
last-modified: Wed, 04 Oct 2023 05:13:17 GMT
content-type: text/css
x-amz-replication-status: COMPLETED
x-evy-trace-route-service-name: envoyset-translator
cache-control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900
x-evy-trace-served-by-pod: iad02/cms-cdn2-td/envoy-proxy-fbf687555-q8s24
x-envoy-upstream-service-time: 164
x-hs-cf-lambda-enforce: us-east-1.EnforceAclForReads 3
x-hs-alternate-content-type: text/plain
server: cloudflare
x-evy-trace-virtual-host: all
x-hs-cf-lambda: us-east-1.EnforceAclForReads 3
x-amz-server-side-encryption: AES256
access-control-allow-methods: GET
x-amz-storage-class: INTELLIGENT_TIERING
date: Sat, 05 Oct 2024 15:46:45 GMT
vary: Accept-Encoding
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
timing-allow-origin: cdn2.hubspot.net
cf-ray: 8cde8bdc2fd3413a-LHR
access-control-allow-origin: *
x-evy-trace-route-configuration: listener_https/all
x-amz-cf-pop: IAD89-C1
x-amz-meta-created-unix-time-millis: 1696396396421

GET
H3 200 cr-master__main.min.css
cdn2.hubspot.net/hub/3354902/hub_generated/template_assets/34470477360/1710134689941/__CR_Web_Platform/CSS/ 49 KB
1 KB 123ms
122ms Other
text/css 104.18.91.62
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn2.hubspot.net/hub/3354902/hub_generated/template_assets/34470477360/1710134689941/__CR_Web_Platform/CSS/cr-master__main.min.css
Requested by: Host: www.cybereason.com
URL: https://www.cybereason.com/blog/cuckoo-spear-pt2-threat-actor-arsenal
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.91.62 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e5c7050c3c28b5afcab7a60b4865bcd6f8d8027a642302fa10be82efbae70b06

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.cybereason.com/blog/cuckoo-spear-pt2-threat-actor-arsenal

Response headers

x-request-id: e3daf319-860f-438d-b623-077d57463c13
content-encoding: gzip
cf-cache-status: HIT
etag: W/"c7c193ff64da90ae6964f13804257f02"
age: 1797568
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=A8SGjMZ3vPewtv0mROxDD6LDqSFgEMj9T0koGf0arn5qchk0r4aJyIIgy01YbRary0rdeavG7UMkoZYlpw92Z3wjJVZp7sHGDNyIcLIklGXut7fjQA5uKeGkwnOlf9aiCjo%3D"}],"group":"cf-nel","max_age":604800}
x-evy-trace-listener: listener_https
x-hubspot-correlation-id: e3daf319-860f-438d-b623-077d57463c13
last-modified: Mon, 11 Mar 2024 05:24:51 GMT
content-type: text/css
x-amz-replication-status: COMPLETED
x-evy-trace-route-service-name: envoyset-translator
cache-control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900
x-evy-trace-served-by-pod: iad02/cms-cdn2-td/envoy-proxy-64d59778d6-f6gc6
x-envoy-upstream-service-time: 177
x-hs-cf-lambda-enforce: us-east-1.EnforceAclForReads 3
x-hs-alternate-content-type: text/plain
server: cloudflare
x-evy-trace-virtual-host: all
x-hs-cf-lambda: us-east-1.EnforceAclForReads 3
x-amz-server-side-encryption: AES256
access-control-allow-methods: GET
x-amz-storage-class: INTELLIGENT_TIERING
date: Sat, 05 Oct 2024 15:46:45 GMT
vary: Accept-Encoding
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
timing-allow-origin: cdn2.hubspot.net
cf-ray: 8cde8bdc2fd8413a-LHR
access-control-allow-origin: *
x-evy-trace-route-configuration: listener_https/all
x-amz-cf-pop: IAD61-P1
x-amz-meta-created-unix-time-millis: 1710134690758

GET
H3 200 ionicons.min.css
cdn2.hubspot.net/hub/3354902/hub_generated/template_assets/35275979682/1642096258129/__CR_Web_Platform/CSS/ 50 KB
997 B 87ms
87ms Other
text/css 104.18.91.62
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn2.hubspot.net/hub/3354902/hub_generated/template_assets/35275979682/1642096258129/__CR_Web_Platform/CSS/ionicons.min.css
Requested by: Host: www.cybereason.com
URL: https://www.cybereason.com/blog/cuckoo-spear-pt2-threat-actor-arsenal
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.91.62 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 28d99ad8103f148a1cf63a25d1369e0bd7d220f97ca36ac12cf8a8c7b2060fcc

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.cybereason.com/blog/cuckoo-spear-pt2-threat-actor-arsenal

Response headers

x-evy-trace-virtual-host: all
x-hs-cf-lambda: us-east-1.EnforceAclForReads 3
x-request-id: 36ee93fa-d93d-4482-b55b-55ab8cc53a0f
content-encoding: gzip
cf-cache-status: HIT
etag: W/"71c8c946791f3411c42a4cb1e9cdb5ed"
age: 1497115
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=T5gDnfRwooMe8XYCUjn1Q4O7gfM899HrY0YDGJ3VQxHPTHrmhbZMIxmHdownkB5jBOqNsQyurleGwynLXR3NOU7AABujDE4l33rU3S%2BlQcSL%2FugqImrWNsW%2Fn%2FAHHp7B5Oc%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-methods: GET
x-evy-trace-listener: listener_https
date: Sat, 05 Oct 2024 15:46:45 GMT
x-hubspot-correlation-id: 36ee93fa-d93d-4482-b55b-55ab8cc53a0f
last-modified: Thu, 13 Jan 2022 17:50:59 GMT
vary: Accept-Encoding
content-type: text/css
x-amz-replication-status: COMPLETED
x-evy-trace-route-service-name: envoyset-translator
cache-control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-evy-trace-served-by-pod: iad02/cms-cdn2-td/envoy-proxy-64786dc485-64hnd
x-envoy-upstream-service-time: 239
timing-allow-origin: cdn2.hubspot.net
cf-ray: 8cde8bdc2fd9413a-LHR
x-hs-cf-lambda-enforce: us-east-1.EnforceAclForReads 3
access-control-allow-origin: *
x-evy-trace-route-configuration: listener_https/all
x-amz-cf-pop: IAD89-C1
x-hs-alternate-content-type: text/plain
server: cloudflare
x-amz-meta-created-unix-time-millis: 1642096258332
x-amz-server-side-encryption: AES256

GET
H3 200 cr-mln__build.min.css
cdn2.hubspot.net/hub/3354902/hub_generated/template_assets/42760289143/1724041950600/__CR_Web_Platform/CSS/ 23 KB
1 KB 68ms
67ms Other
text/css 104.18.91.62
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn2.hubspot.net/hub/3354902/hub_generated/template_assets/42760289143/1724041950600/__CR_Web_Platform/CSS/cr-mln__build.min.css
Requested by: Host: www.cybereason.com
URL: https://www.cybereason.com/blog/cuckoo-spear-pt2-threat-actor-arsenal
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.91.62 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 510835fe8939dd32b7388d00f583d2f080f9d6bcfc2c9d21098407d000065c22

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.cybereason.com/blog/cuckoo-spear-pt2-threat-actor-arsenal

Response headers

x-request-id: a2e312ab-405b-4f4f-b11b-6ceb5a757cc5
content-encoding: gzip
cf-cache-status: HIT
etag: W/"fc8b84a5028f90fd340e1c6e0dc5ef52"
age: 1500553
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=SdH%2FFEElFCeAgAUs1eD5cp%2BEL2q7ttnPwJZPrXmnGusLWD7UV9cl5v1JUK41%2B5InEK%2F8aZIW8BXs7n0FTPJZJR5i6L%2BqEnK9THPYV5HKBQ6TgOlYYVCv0GqQDgYYGn%2F3siE%3D"}],"group":"cf-nel","max_age":604800}
x-evy-trace-listener: listener_https
x-hubspot-correlation-id: a2e312ab-405b-4f4f-b11b-6ceb5a757cc5
last-modified: Mon, 19 Aug 2024 04:32:32 GMT
content-type: text/css
x-amz-replication-status: PENDING
x-evy-trace-route-service-name: envoyset-translator
cache-control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900
x-evy-trace-served-by-pod: iad02/cms-cdn2-td/envoy-proxy-6748d4cfc8-dwjx9
x-envoy-upstream-service-time: 160
x-hs-cf-lambda-enforce: us-east-1.EnforceAclForReads 3
x-hs-alternate-content-type: text/plain
server: cloudflare
x-evy-trace-virtual-host: all
x-hs-cf-lambda: us-east-1.EnforceAclForReads 3
x-amz-server-side-encryption: AES256
access-control-allow-methods: GET
x-amz-storage-class: INTELLIGENT_TIERING
date: Sat, 05 Oct 2024 15:46:45 GMT
vary: Accept-Encoding
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
timing-allow-origin: cdn2.hubspot.net
cf-ray: 8cde8bdc3803413a-LHR
access-control-allow-origin: *
x-evy-trace-route-configuration: listener_https/all
x-amz-cf-pop: IAD89-C1
x-amz-meta-created-unix-time-millis: 1724041951446

GET
H3 200 cr-framework__bulma-columns.min.css
cdn2.hubspot.net/hub/3354902/hub_generated/template_assets/34470224480/1635957556830/__CR_Web_Platform/CSS/bulma/ 19 KB
997 B 78ms
78ms Other
text/css 104.18.91.62
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn2.hubspot.net/hub/3354902/hub_generated/template_assets/34470224480/1635957556830/__CR_Web_Platform/CSS/bulma/cr-framework__bulma-columns.min.css
Requested by: Host: www.cybereason.com
URL: https://www.cybereason.com/blog/cuckoo-spear-pt2-threat-actor-arsenal
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.91.62 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 81c836c05ab1f2d37b7aa60d509a656c7a441e2a4fabf035c1b0666a4daa50fa

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.cybereason.com/blog/cuckoo-spear-pt2-threat-actor-arsenal

Response headers

x-evy-trace-virtual-host: all
x-hs-cf-lambda: us-east-1.EnforceAclForReads 3
x-request-id: 543654a4-47bc-4cbe-aeab-93f119b139ca
content-encoding: gzip
cf-cache-status: HIT
etag: W/"636c18615b58fca9536b2e1c578c6db7"
age: 2395861
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=SBxZYq6OHERsEpwdydeRhC%2F49p0coU9FYs6QyRk2tKOlttgoJLMhlRegZo6Vl%2ByNKT9O9XxslY4EeTpVL7eZkI5sCb%2B%2FpxEI6yVDmokzSfVBh0QrDBnpymLwJq83TJwHCvI%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-methods: GET
x-evy-trace-listener: listener_https
date: Sat, 05 Oct 2024 15:46:45 GMT
x-hubspot-correlation-id: 543654a4-47bc-4cbe-aeab-93f119b139ca
last-modified: Wed, 03 Nov 2021 16:39:17 GMT
vary: Accept-Encoding
content-type: text/css
x-amz-replication-status: COMPLETED
x-evy-trace-route-service-name: envoyset-translator
cache-control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-evy-trace-served-by-pod: iad02/cms-cdn2-td/envoy-proxy-7bc58b7fb6-49c4c
x-envoy-upstream-service-time: 177
timing-allow-origin: cdn2.hubspot.net
cf-ray: 8cde8bdc987f413a-LHR
x-hs-cf-lambda-enforce: us-east-1.EnforceAclForReads 3
access-control-allow-origin: *
x-evy-trace-route-configuration: listener_https/all
x-amz-cf-pop: IAD89-C1
x-hs-alternate-content-type: text/plain
server: cloudflare
x-amz-meta-created-unix-time-millis: 1635957556893
x-amz-server-side-encryption: AES256

GET
H3 200 hamburger-animation.min.css
cdn2.hubspot.net/hub/3354902/hub_generated/template_assets/42363645447/1635957556555/__CR_Web_Platform/CSS/ 22 KB
996 B 67ms
67ms Other
text/css 104.18.91.62
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn2.hubspot.net/hub/3354902/hub_generated/template_assets/42363645447/1635957556555/__CR_Web_Platform/CSS/hamburger-animation.min.css
Requested by: Host: www.cybereason.com
URL: https://www.cybereason.com/blog/cuckoo-spear-pt2-threat-actor-arsenal
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.91.62 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c9130ee8c979a74ab038cf5e8a06db5cb94253eab35ea5242f515d605f4781ad

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.cybereason.com/blog/cuckoo-spear-pt2-threat-actor-arsenal

Response headers

x-evy-trace-virtual-host: all
x-hs-cf-lambda: us-east-1.EnforceAclForReads 3
x-request-id: 0e4c0d4d-64a5-4350-9fde-08a0b0a770c5
content-encoding: gzip
cf-cache-status: HIT
etag: W/"a0b451fd96744fa455495e022542ab86"
age: 1797568
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=MhuWbTJTtJ0MnWG0vEhh0LT0ogO5LUB7YM3J8E8D7fT6fNIdMq0C07RS%2FJTtQUyGBM0IPHo6xLyd10bl6mvjPqonTDqnKFmg1mPedF6rTzV3wKU%2Bgqr0%2FQwF4QQLq3oPb8I%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-methods: GET
x-evy-trace-listener: listener_https
date: Sat, 05 Oct 2024 15:46:45 GMT
x-hubspot-correlation-id: 0e4c0d4d-64a5-4350-9fde-08a0b0a770c5
last-modified: Wed, 03 Nov 2021 16:39:17 GMT
vary: Accept-Encoding
content-type: text/css
x-amz-replication-status: COMPLETED
x-evy-trace-route-service-name: envoyset-translator
cache-control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-evy-trace-served-by-pod: iad02/cms-cdn2-td/envoy-proxy-64d59778d6-jrv7z
x-envoy-upstream-service-time: 235
timing-allow-origin: cdn2.hubspot.net
cf-ray: 8cde8bdc988c413a-LHR
x-hs-cf-lambda-enforce: us-east-1.EnforceAclForReads 3
access-control-allow-origin: *
x-evy-trace-route-configuration: listener_https/all
x-amz-cf-pop: IAD61-P1
x-hs-alternate-content-type: text/plain
server: cloudflare
x-amz-meta-created-unix-time-millis: 1635957556622
x-amz-server-side-encryption: AES256

GET
H3 200 animate.min.css
cdn2.hubspot.net/hub/3354902/hub_generated/template_assets/42507091846/1635957557027/__CR_Web_Platform/CSS/ 52 KB
994 B 79ms
79ms Other
text/css 104.18.91.62
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn2.hubspot.net/hub/3354902/hub_generated/template_assets/42507091846/1635957557027/__CR_Web_Platform/CSS/animate.min.css
Requested by: Host: www.cybereason.com
URL: https://www.cybereason.com/blog/cuckoo-spear-pt2-threat-actor-arsenal
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.91.62 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b48f9a7031474a0f73f92f2e6cbbfad730b5466cda96d86a4459c06efc986173

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.cybereason.com/blog/cuckoo-spear-pt2-threat-actor-arsenal

Response headers

x-evy-trace-virtual-host: all
x-hs-cf-lambda: us-east-1.EnforceAclForReads 3
x-request-id: a8a7872d-3e2b-4216-b8b8-465b48e8dd51
content-encoding: gzip
cf-cache-status: HIT
etag: W/"55009d64191e6f9e712a841773ee6611"
age: 1325700
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=uigk2V3xinCD2yIA3hPG33frvNNVBeB%2B1nYUXGs1PD4Zt48Hm6Jiu5LGgWmIeZvZLaf6Jkp%2B%2FFsrXQPMnJl6wEUW4BIl209CHx2%2BkLdJFAKhr0G9Y6eRiTOkC3RMShY91As%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-methods: GET
x-evy-trace-listener: listener_https
date: Sat, 05 Oct 2024 15:46:45 GMT
x-hubspot-correlation-id: a8a7872d-3e2b-4216-b8b8-465b48e8dd51
last-modified: Wed, 03 Nov 2021 16:39:18 GMT
vary: Accept-Encoding
content-type: text/css
x-amz-replication-status: COMPLETED
x-evy-trace-route-service-name: envoyset-translator
cache-control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-evy-trace-served-by-pod: iad02/cms-cdn2-td/envoy-proxy-c8b596779-qb4kw
x-envoy-upstream-service-time: 161
timing-allow-origin: cdn2.hubspot.net
cf-ray: 8cde8bdce8ec413a-LHR
x-hs-cf-lambda-enforce: us-east-1.EnforceAclForReads 3
access-control-allow-origin: *
x-evy-trace-route-configuration: listener_https/all
x-amz-cf-pop: IAD89-C1
x-hs-alternate-content-type: text/plain
server: cloudflare
x-amz-meta-created-unix-time-millis: 1635957557027
x-amz-server-side-encryption: AES256

GET
H2 200 cr-blog-hero-owl-transparent.png
www.cybereason.com/hubfs/dam/images/images-web/blog-images/template-images/ 670 KB
670 KB 63ms
62ms Image
image/png 45.60.64.106
INCAPSULA

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.cybereason.com/hubfs/dam/images/images-web/blog-images/template-images/cr-blog-hero-owl-transparent.png

Requested by

Host: cdn2.hubspot.net
URL: https://cdn2.hubspot.net/hub/3354902/hub_generated/module_assets/41682410610/1644941443237/module_41682410610_CR_-_Malicious_Life_Network_--_Main_Hero.min.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

45.60.64.106 , United States, ASN19551 (INCAPSULA, US),

Reverse DNS

Software

Resource Hash

266d85b7ad351501b8651b0e659d6d74fbe07085d3226cd3f7601f6522fbdf97

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://cdn2.hubspot.net/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
x-iinfo: 5-10290491-0 0CNN RT(1728143204667 803) q(0 -1 -1 -1) r(0 -1)
cache-control: max-age=691074, s-maxage=2073474, public
etag: "cd208635457bf65f33aa7c8849efcf21"
x-cdn: Imperva
content-length: 685987
date: Sat, 05 Oct 2024 15:46:45 GMT
last-modified: Fri, 19 Feb 2021 04:27:31 GMT
content-type: image/png

GET
H2 200 cr-ml-sidebar-subscribe-bg.jpg
www.cybereason.com/hubfs/dam/images/images-web/backgrounds/ 34 KB
34 KB 86ms
85ms Image
image/jpeg 45.60.64.106
INCAPSULA

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.cybereason.com/hubfs/dam/images/images-web/backgrounds/cr-ml-sidebar-subscribe-bg.jpg

Requested by

Host: cdn2.hubspot.net
URL: https://cdn2.hubspot.net/hub/3354902/hub_generated/template_assets/42760289143/1724041950600/__CR_Web_Platform/CSS/cr-mln__build.min.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

45.60.64.106 , United States, ASN19551 (INCAPSULA, US),

Reverse DNS

Software

Resource Hash

9967a27efc89a8cefe9665100ec51cded3a8c89f95cdca1285bfce207666cd11

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://cdn2.hubspot.net/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
x-iinfo: 5-10290491-0 0CNN RT(1728143204667 821) q(0 -1 -1 -1) r(0 -1)
cache-control: max-age=691300, s-maxage=2073700, public
etag: "c2444af5dedceb18b268a01a640beb72"
x-cdn: Imperva
content-length: 34358
date: Sat, 05 Oct 2024 15:46:45 GMT
last-modified: Thu, 31 Mar 2022 18:30:54 GMT
content-type: image/jpeg

GET
H2 200 cr-mln-network__footer-subscribe-bg.png
www.cybereason.com/hubfs/dam/images/images-web/blog-images/template-images/ 38 KB
38 KB 86ms
86ms Image
image/png 45.60.64.106
INCAPSULA

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.cybereason.com/hubfs/dam/images/images-web/blog-images/template-images/cr-mln-network__footer-subscribe-bg.png

Requested by

Host: cdn2.hubspot.net
URL: https://cdn2.hubspot.net/hub/3354902/hub_generated/template_assets/42760289143/1724041950600/__CR_Web_Platform/CSS/cr-mln__build.min.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

45.60.64.106 , United States, ASN19551 (INCAPSULA, US),

Reverse DNS

Software

Resource Hash

38b5fa249791d286db654d516dfb6173cc332a8d725c41b58d08c642b26bc641

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://cdn2.hubspot.net/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
x-iinfo: 5-10290491-0 0CNN RT(1728143204667 822) q(0 -1 -1 -1) r(0 -1)
cache-control: max-age=691160, s-maxage=2073560, public
etag: "c28026bc6a6d55f395e2227b7b19c8c9"
x-cdn: Imperva
content-length: 38595
date: Sat, 05 Oct 2024 15:46:45 GMT
last-modified: Wed, 10 Mar 2021 19:10:18 GMT
content-type: image/png

GET
H2 200 ionicons.ttf
www.cybereason.com/hubfs/__dam/fonts/ 184 KB
107 KB 60ms
59ms Font
font/ttf 45.60.64.106
INCAPSULA

General

Check archive.org

Show headers Download Go to

Full URL

https://www.cybereason.com/hubfs/__dam/fonts/ionicons.ttf

Requested by

Host: cdn2.hubspot.net
URL: https://cdn2.hubspot.net/hub/3354902/hub_generated/template_assets/35275979682/1642096258129/__CR_Web_Platform/CSS/ionicons.min.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

45.60.64.106 , United States, ASN19551 (INCAPSULA, US),

Reverse DNS

Software

Resource Hash

2ba7f20b1d8990e17a47fe3d88e4c766628aaa2baf1dd30fca0a0db59836f5f9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Origin: https://www.cybereason.com
Referer: https://cdn2.hubspot.net/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
x-iinfo: 5-10290491-0 0CNN RT(1728143204667 826) q(0 -1 -1 -1) r(0 -1)
cache-control: max-age=748240, s-maxage=2130640, public
content-encoding: gzip
etag: W/"24712f6c47821394fba7942fbb52c3b2"
x-cdn: Imperva
content-length: 109543
date: Sat, 05 Oct 2024 15:46:45 GMT
last-modified: Fri, 25 Sep 2020 09:38:00 GMT
content-type: font/ttf

GET
H2 200 Criteria-CF-Bold.woff2
www.cybereason.com/hubfs/dam/fonts/criteria/ 14 KB
14 KB 62ms
60ms Font
application/font-woff2 45.60.64.106
INCAPSULA

General

Check archive.org

Show headers Download Go to

Full URL

https://www.cybereason.com/hubfs/dam/fonts/criteria/Criteria-CF-Bold.woff2

Requested by

Host: cdn2.hubspot.net
URL: https://cdn2.hubspot.net/hub/3354902/hub_generated/template_assets/34470477360/1710134689941/__CR_Web_Platform/CSS/cr-master__main.min.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

45.60.64.106 , United States, ASN19551 (INCAPSULA, US),

Reverse DNS

Software

Resource Hash

17a31aae550a664382ab9d8085efc03a10a4548985f33ac4e5a533d5ab5e9339

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Origin: https://www.cybereason.com
Referer: https://cdn2.hubspot.net/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
x-iinfo: 5-10290491-0 0CNN RT(1728143204667 828) q(0 -1 -1 -1) r(0 -1)
cache-control: max-age=748239, s-maxage=2130639, public
etag: "ba487b98622054117d0be2f92f3f45b2"
x-cdn: Imperva
content-length: 14332
date: Sat, 05 Oct 2024 15:46:45 GMT
last-modified: Thu, 13 Jan 2022 17:33:57 GMT
content-type: application/font-woff2

GET
H3 200 UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa1ZL7.woff2
fonts.gstatic.com/s/inter/v18/ 47 KB
47 KB 196ms
144ms Font
font/woff2 142.250.181.227
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/inter/v18/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa1ZL7.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Inter:wght@100;200;300;400;500;600;700;800;900&display=swap

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.181.227 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s56-in-f3.1e100.net

Software

sffe /

Resource Hash

f052ee44c3728dfd23aba8a4567150bc314d23903026fbb6ad089422c2df56af

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Origin: https://www.cybereason.com
Referer: https://fonts.googleapis.com/

Response headers

age: 85198
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
x-content-type-options: nosniff
expires: Sat, 04 Oct 2025 16:06:47 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 04 Oct 2024 16:06:47 GMT
last-modified: Mon, 29 Jul 2024 22:51:01 GMT
content-type: font/woff2
cache-control: public, max-age=31536000
timing-allow-origin: *
cross-origin-opener-policy: same-origin; report-to="apps-themes"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
accept-ranges: bytes
access-control-allow-origin: *
content-length: 48444
x-xss-protection: 0
server: sffe

GET
H2 200 FlamCondBook.woff2
www.cybereason.com/hubfs/dam/fonts/flama/ 14 KB
14 KB 63ms
62ms Font
application/font-woff2 45.60.64.106
INCAPSULA

General

Check archive.org

Show headers Download Go to

Full URL

https://www.cybereason.com/hubfs/dam/fonts/flama/FlamCondBook.woff2

Requested by

Host: cdn2.hubspot.net
URL: https://cdn2.hubspot.net/hub/3354902/hub_generated/template_assets/34470477360/1710134689941/__CR_Web_Platform/CSS/cr-master__main.min.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

45.60.64.106 , United States, ASN19551 (INCAPSULA, US),

Reverse DNS

Software

Resource Hash

2ca281bdcd543e2e3559e6505c323c8d64df73f2a594a043780df3007e16d161

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Origin: https://www.cybereason.com
Referer: https://cdn2.hubspot.net/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
x-iinfo: 5-10290491-0 0CNN RT(1728143204667 829) q(0 -1 -1 -1) r(0 -1)
cache-control: max-age=748238, s-maxage=2130638, public
etag: "9b97cc4b573f2e8b6ead12339a15b141"
x-cdn: Imperva
content-length: 14544
date: Sat, 05 Oct 2024 15:46:45 GMT
last-modified: Fri, 10 Dec 2021 14:25:11 GMT
content-type: application/font-woff2

GET
H3 200 HTx3L3I-JCGChYJ8VI-L6OO_au7B6xHT2g.woff2
fonts.gstatic.com/s/barlowcondensed/v12/ 20 KB
20 KB 152ms
101ms Font
font/woff2 142.250.181.227
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/barlowcondensed/v12/HTx3L3I-JCGChYJ8VI-L6OO_au7B6xHT2g.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Barlow+Condensed:ital,wght@0,100;0,200;0,300;0,400;0,500;0,600;0,700;0,800;0,900;1,100;1,200;1,300;1,400;1,500;1,600;1,700;1,800;1,900&display=swap

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.181.227 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s56-in-f3.1e100.net

Software

sffe /

Resource Hash

af91213cd670d6270b32ebdeb00a09625f6b74ccd780d12ff6724a14ea1efaff

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Origin: https://www.cybereason.com
Referer: https://fonts.googleapis.com/

Response headers

age: 39043
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
x-content-type-options: nosniff
expires: Sun, 05 Oct 2025 04:56:02 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 05 Oct 2024 04:56:02 GMT
last-modified: Tue, 19 Apr 2022 18:28:11 GMT
content-type: font/woff2
cache-control: public, max-age=31536000
timing-allow-origin: *
cross-origin-opener-policy: same-origin; report-to="apps-themes"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
accept-ranges: bytes
access-control-allow-origin: *
content-length: 20200
x-xss-protection: 0
server: sffe

GET
H3 200 memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2
fonts.gstatic.com/s/opensans/v40/ 47 KB
47 KB 136ms
84ms Font
font/woff2 142.250.181.227
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Barlow:ital,wght@0,100;0,200;0,300;0,400;0,500;0,600;0,700;0,800;0,900;1,100;1,200;1,300;1,400;1,500;1,600;1,700;1,800;1,900&family=Open+Sans:ital,wght@0,300;0,400;0,600;0,700;0,800;1,300;1,400;1,600;1,700;1,800&display=swap

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.181.227 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s56-in-f3.1e100.net

Software

sffe /

Resource Hash

3c4d6a1421c7ddb7e404521fe8c4cd5be5af446d7689cd880be26612eaad3cfa

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Origin: https://www.cybereason.com
Referer: https://fonts.googleapis.com/

Response headers

age: 99243
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
x-content-type-options: nosniff
expires: Sat, 04 Oct 2025 12:12:42 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 04 Oct 2024 12:12:42 GMT
last-modified: Thu, 14 Dec 2023 02:08:40 GMT
content-type: font/woff2
cache-control: public, max-age=31536000
timing-allow-origin: *
cross-origin-opener-policy: same-origin; report-to="apps-themes"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
accept-ranges: bytes
access-control-allow-origin: *
content-length: 48236
x-xss-protection: 0
server: sffe

GET
H3 200 memtYaGs126MiZpBA-UFUIcVXSCEkx2cmqvXlWqWuU6F.woff2
fonts.gstatic.com/s/opensans/v40/ 49 KB
49 KB 103ms
51ms Font
font/woff2 142.250.181.227
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v40/memtYaGs126MiZpBA-UFUIcVXSCEkx2cmqvXlWqWuU6F.woff2

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.181.227 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s56-in-f3.1e100.net

Software

sffe /

Resource Hash

0d8601a776b7dc777cd23bc42392d05a43df0d6402328e8913b58811083b513d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Origin: https://www.cybereason.com
Referer: https://fonts.googleapis.com/

Response headers

age: 381416
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
x-content-type-options: nosniff
expires: Wed, 01 Oct 2025 05:49:49 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Tue, 01 Oct 2024 05:49:49 GMT
last-modified: Thu, 14 Dec 2023 02:10:01 GMT
content-type: font/woff2
cache-control: public, max-age=31536000
timing-allow-origin: *
cross-origin-opener-policy: same-origin; report-to="apps-themes"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
accept-ranges: bytes
access-control-allow-origin: *
content-length: 50296
x-xss-protection: 0
server: sffe

GET
H3 200 HTxwL3I-JCGChYJ8VI-L6OO_au7B4-Lwz3bWuQ.woff2
fonts.gstatic.com/s/barlowcondensed/v12/ 20 KB
20 KB 187ms
136ms Font
font/woff2 142.250.181.227
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/barlowcondensed/v12/HTxwL3I-JCGChYJ8VI-L6OO_au7B4-Lwz3bWuQ.woff2

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.181.227 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s56-in-f3.1e100.net

Software

sffe /

Resource Hash

2d2c4912162eaa41299aaf5063ecb92a26d76071fe6d1f77742b32c833daab99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Origin: https://www.cybereason.com
Referer: https://fonts.googleapis.com/

Response headers

age: 43569
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
x-content-type-options: nosniff
expires: Sun, 05 Oct 2025 03:40:36 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 05 Oct 2024 03:40:36 GMT
last-modified: Tue, 19 Apr 2022 18:38:09 GMT
content-type: font/woff2
cache-control: public, max-age=31536000
timing-allow-origin: *
cross-origin-opener-policy: same-origin; report-to="apps-themes"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
accept-ranges: bytes
access-control-allow-origin: *
content-length: 20432
x-xss-protection: 0
server: sffe

GET
H3 200 HTxwL3I-JCGChYJ8VI-L6OO_au7B4873z3bWuQ.woff2
fonts.gstatic.com/s/barlowcondensed/v12/ 21 KB
21 KB 120ms
69ms Font
font/woff2 142.250.181.227
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/barlowcondensed/v12/HTxwL3I-JCGChYJ8VI-L6OO_au7B4873z3bWuQ.woff2

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.181.227 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s56-in-f3.1e100.net

Software

sffe /

Resource Hash

0b281bf2f4179c06ba68f0a427f2341287c41eacc2ce9d534c6f5c513ac633fb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Origin: https://www.cybereason.com
Referer: https://fonts.googleapis.com/

Response headers

age: 57055
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
x-content-type-options: nosniff
expires: Sat, 04 Oct 2025 23:55:50 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 04 Oct 2024 23:55:50 GMT
last-modified: Tue, 19 Apr 2022 18:30:34 GMT
content-type: font/woff2
cache-control: public, max-age=31536000
timing-allow-origin: *
cross-origin-opener-policy: same-origin; report-to="apps-themes"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
accept-ranges: bytes
access-control-allow-origin: *
content-length: 21352
x-xss-protection: 0
server: sffe

GET
H3 200 7cHqv4kjgoGqM7E30-8s51os.woff2
fonts.gstatic.com/s/barlow/v12/ 21 KB
21 KB 183ms
132ms Font
font/woff2 142.250.181.227
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/barlow/v12/7cHqv4kjgoGqM7E30-8s51os.woff2

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.181.227 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s56-in-f3.1e100.net

Software

sffe /

Resource Hash

2b14e8397d552f351a4396dec25ec5da1348865683100e94c4ab0faea4a9a254

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Origin: https://www.cybereason.com
Referer: https://fonts.googleapis.com/

Response headers

age: 85190
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
x-content-type-options: nosniff
expires: Sat, 04 Oct 2025 16:06:55 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 04 Oct 2024 16:06:55 GMT
last-modified: Tue, 19 Apr 2022 19:35:19 GMT
content-type: font/woff2
cache-control: public, max-age=31536000
timing-allow-origin: *
cross-origin-opener-policy: same-origin; report-to="apps-themes"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
accept-ranges: bytes
access-control-allow-origin: *
content-length: 21796
x-xss-protection: 0
server: sffe

GET
H3 200 7cHqv4kjgoGqM7E3t-4s51os.woff2
fonts.gstatic.com/s/barlow/v12/ 21 KB
21 KB 168ms
117ms Font
font/woff2 142.250.181.227
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/barlow/v12/7cHqv4kjgoGqM7E3t-4s51os.woff2

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.181.227 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s56-in-f3.1e100.net

Software

sffe /

Resource Hash

65a47caa5183b035bf78d0f93adbe5cea500333410259c54abf2de356740df7e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Origin: https://www.cybereason.com
Referer: https://fonts.googleapis.com/

Response headers

age: 148473
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
x-content-type-options: nosniff
expires: Fri, 03 Oct 2025 22:32:12 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 03 Oct 2024 22:32:12 GMT
last-modified: Tue, 19 Apr 2022 19:29:44 GMT
content-type: font/woff2
cache-control: public, max-age=31536000
timing-allow-origin: *
cross-origin-opener-policy: same-origin; report-to="apps-themes"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
accept-ranges: bytes
access-control-allow-origin: *
content-length: 21724
x-xss-protection: 0
server: sffe

GET
H2 200 HOSP.woff2
www.cybereason.com/hubfs/dam/fonts/hsop/ 154 KB
154 KB 66ms
65ms Font
application/font-woff2 45.60.64.106
INCAPSULA

General

Check archive.org

Show headers Download Go to

Full URL

https://www.cybereason.com/hubfs/dam/fonts/hsop/HOSP.woff2

Requested by

Host: cdn2.hubspot.net
URL: https://cdn2.hubspot.net/hub/3354902/hub_generated/template_assets/34470477360/1710134689941/__CR_Web_Platform/CSS/cr-master__main.min.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

45.60.64.106 , United States, ASN19551 (INCAPSULA, US),

Reverse DNS

Software

Resource Hash

a6728e3326fe3805e12f697731cbc97f2a5b773533c1cb4be0c56da998a94db6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Origin: https://www.cybereason.com
Referer: https://cdn2.hubspot.net/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
x-iinfo: 5-10290491-0 0CNN RT(1728143204667 836) q(0 -1 -1 -1) r(0 -1)
cache-control: max-age=761977, s-maxage=2144377, public
etag: "2ffd5c598df2d32b13ebd689e6daa668"
x-cdn: Imperva
content-length: 157664
date: Sat, 05 Oct 2024 15:46:45 GMT
last-modified: Fri, 11 Feb 2022 15:12:37 GMT
content-type: application/font-woff2

GET
H2 200 noopdoor-blog-18.png
www.cybereason.com/hs-fs/hubfs/dam/images/images-web/blog-images/ 14 KB
14 KB 64ms
64ms Image
image/webp 45.60.64.106
INCAPSULA

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.cybereason.com/hs-fs/hubfs/dam/images/images-web/blog-images/noopdoor-blog-18.png?width=375&height=389&name=noopdoor-blog-18.png

Requested by

Host: www.cybereason.com
URL: https://www.cybereason.com/blog/cuckoo-spear-pt2-threat-actor-arsenal

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

45.60.64.106 , United States, ASN19551 (INCAPSULA, US),

Reverse DNS

Software

Resource Hash

8de5d2a9505e1e8cda39b4b6da5deb50c8f03dd5048f60bc51094e00958a4cc0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.cybereason.com/blog/cuckoo-spear-pt2-threat-actor-arsenal

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
x-iinfo: 5-10290491-10278246 2CNN RT(1728143204667 824) q(0 0 0 -1) r(1 1) U18
cache-control: max-age=179755, s-maxage=1562155, public
etag: "cfjgf9txLHheLtlAMkxfvtcnSN1sg2scYo6pDm-YkKDQ:b12c16ca2995af5f8b5976561444df21"
x-cdn: Imperva
content-length: 13964
date: Sat, 05 Oct 2024 15:46:45 GMT
last-modified: Tue, 17 Sep 2024 19:49:08 GMT
content-type: image/webp

GET
H2 200 noopdoor-blog-19.png
www.cybereason.com/hs-fs/hubfs/dam/images/images-web/blog-images/ 16 KB
16 KB 65ms
65ms Image
image/webp 45.60.64.106
INCAPSULA

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.cybereason.com/hs-fs/hubfs/dam/images/images-web/blog-images/noopdoor-blog-19.png?width=424&height=386&name=noopdoor-blog-19.png

Requested by

Host: www.cybereason.com
URL: https://www.cybereason.com/blog/cuckoo-spear-pt2-threat-actor-arsenal

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

45.60.64.106 , United States, ASN19551 (INCAPSULA, US),

Reverse DNS

Software

Resource Hash

30ab6527385008d2f7c64691b0dbd29102f2fd6b1f2af518fe570efc7bef9e24

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.cybereason.com/blog/cuckoo-spear-pt2-threat-actor-arsenal

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
x-iinfo: 5-10290491-10280284 2CNN RT(1728143204667 825) q(0 0 0 -1) r(1 1) U18
cache-control: max-age=179755, s-maxage=1562155, public
etag: "cfokHbJzHKV2gUWy97CFQau4ANLZElcdR-rjihmWt3DQ:705a74957dfe8401514dee24c95ff06e"
x-cdn: Imperva
content-length: 16146
date: Sat, 05 Oct 2024 15:46:45 GMT
last-modified: Tue, 17 Sep 2024 19:49:08 GMT
content-type: image/webp

GET
H3 200 animatedModal.min.js
cdn2.hubspot.net/hub/3354902/hub_generated/template_assets/42507089303/1644440411417/__CR_Web_Platform/JS/animatedModal/ 2 KB
994 B 59ms
58ms Other
application/javascript 104.18.91.62
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn2.hubspot.net/hub/3354902/hub_generated/template_assets/42507089303/1644440411417/__CR_Web_Platform/JS/animatedModal/animatedModal.min.js
Requested by: Host: www.cybereason.com
URL: https://www.cybereason.com/blog/cuckoo-spear-pt2-threat-actor-arsenal
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.91.62 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0f94c946a13b9ebe43281550b7d0c00edf4694ad06bcb4c8679bee6d48df5115

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.cybereason.com/blog/cuckoo-spear-pt2-threat-actor-arsenal

Response headers

x-evy-trace-virtual-host: all
x-hs-cf-lambda: us-east-1.EnforceAclForReads 3
x-request-id: c96bd0b6-8507-47cd-b86c-1f5f5f70319f
content-encoding: br
cf-cache-status: HIT
etag: W/"690ad93d1d2a9fc11f9df295692413fe"
age: 1797568
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=rlvKy0cjTfx5Xo7gbAs9B891dlVV57o3hu7iOB4%2FmleCUiSdEaa6%2B1%2B9f374pbZU8y4XVM1WIUveQdhlYXj5alVkWZr6XRdMLVo%2F4obKj13gyih%2FB38dpyZ9pHKml23EGAc%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-methods: GET
x-evy-trace-listener: listener_https
date: Sat, 05 Oct 2024 15:46:45 GMT
x-hubspot-correlation-id: c96bd0b6-8507-47cd-b86c-1f5f5f70319f
last-modified: Wed, 09 Feb 2022 21:00:12 GMT
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
x-amz-replication-status: COMPLETED
x-evy-trace-route-service-name: envoyset-translator
cache-control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-evy-trace-served-by-pod: iad02/cms-cdn2-td/envoy-proxy-64d59778d6-jrv7z
x-envoy-upstream-service-time: 734
timing-allow-origin: cdn2.hubspot.net
cf-ray: 8cde8bdcf8fe413a-LHR
x-hs-cf-lambda-enforce: us-east-1.EnforceAclForReads 3
access-control-allow-origin: *
x-evy-trace-route-configuration: listener_https/all
x-amz-cf-pop: IAD61-P1
x-hs-alternate-content-type: text/plain
server: cloudflare
x-amz-meta-created-unix-time-millis: 1644440411792
x-amz-server-side-encryption: AES256

GET
H3 200 module_41681847227_CR_-_Malicious_Life_Network_--_Tier_One_Header.min.js
cdn2.hubspot.net/hub/3354902/hub_generated/module_assets/41681847227/1644941386128/ 374 B
991 B 166ms
166ms Other
application/javascript 104.18.91.62
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn2.hubspot.net/hub/3354902/hub_generated/module_assets/41681847227/1644941386128/module_41681847227_CR_-_Malicious_Life_Network_--_Tier_One_Header.min.js
Requested by: Host: www.cybereason.com
URL: https://www.cybereason.com/blog/cuckoo-spear-pt2-threat-actor-arsenal
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.91.62 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 119bf322a2ce6d2a82422b51404bc54b375c881f12a120205598d1691fa48820

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.cybereason.com/blog/cuckoo-spear-pt2-threat-actor-arsenal

Response headers

x-evy-trace-virtual-host: all
x-hs-cf-lambda: us-east-1.EnforceAclForReads 3
x-request-id: e77e5727-b408-4997-9a6a-e88d798bbd10
content-encoding: br
cf-cache-status: HIT
etag: W/"1d7f81aaf24568ea5d90a82b829960fd"
age: 1493015
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=B%2BKfhcAdGu%2FTnmRYYXYPKtS2XTs7V9enAmXXJTIbuMAlu5UR7EasvKaBK1uan2ThdEMl2hG76VnIhmf3%2BFAW4yqDAYttVtlcZcGDwEwj9SME6C5sMYyoiZT7drF9gxhgFq4%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-methods: GET
x-evy-trace-listener: listener_https
date: Sat, 05 Oct 2024 15:46:45 GMT
x-hubspot-correlation-id: e77e5727-b408-4997-9a6a-e88d798bbd10
last-modified: Tue, 15 Feb 2022 16:09:47 GMT
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
x-amz-replication-status: COMPLETED
x-evy-trace-route-service-name: envoyset-translator
cache-control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-evy-trace-served-by-pod: iad02/cms-cdn2-td/envoy-proxy-64d59778d6-f6gc6
x-envoy-upstream-service-time: 161
timing-allow-origin: cdn2.hubspot.net
cf-ray: 8cde8bdd0914413a-LHR
x-hs-cf-lambda-enforce: us-east-1.EnforceAclForReads 3
access-control-allow-origin: *
x-evy-trace-route-configuration: listener_https/all
x-amz-cf-pop: IAD61-P1
x-hs-alternate-content-type: text/plain
server: cloudflare
x-amz-meta-created-unix-time-millis: 1644941386128
x-amz-server-side-encryption: AES256

GET
H3 200 sdk.js Show response
connect.facebook.net/en_GB/ 3 KB
2 KB 89ms
44ms Script
application/x-javascript 157.240.0.6
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_GB/sdk.js

Requested by

Host: www.cybereason.com
URL: https://www.cybereason.com/blog/cuckoo-spear-pt2-threat-actor-arsenal

Protocol

Security

QUIC, , AES_128_GCM

Server

157.240.0.6 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

xx-fbcdn-shv-02-fra3.fbcdn.net

Software

Resource Hash

7c152f38b97c00d547b1068c56a5d9cf38e5da19b76010bed69f656b3a9c5553

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.cybereason.com/blog/cuckoo-spear-pt2-threat-actor-arsenal

Response headers

content-md5: b+MBITMwWKg9JADkWlR4Xw==
access-control-expose-headers: X-FB-Content-MD5
content-encoding: gzip
etag: "7151e4e67b050170a0eac5afb07c495f"
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
x-content-type-options: nosniff
expires: Sat, 05 Oct 2024 15:51:55 GMT
alt-svc: h3=":443"; ma=86400
edge-control: cache-maxage=1200s
date: Sat, 05 Oct 2024 15:46:45 GMT
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
priority: u=3,i
x-frame-options: DENY
strict-transport-security: max-age=31536000; preload; includeSubDomains
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
x-fb-content-md5: a7e15e84cfaad2e98b40ed43b399bf61
cache-control: public,max-age=1200,stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-opener-policy: same-origin-allow-popups
x-fb-connection-quality: EXCELLENT; q=0.9, rtt=41, rtx=0, c=23, mss=1232, tbw=4424, tp=9, tpl=0, uplat=0, ullat=-1
x-fb-debug: nuk6MTLeYcMlPgc04Anxh6o2YR1a+cXI5s/tgNloGdeDSvmCF4OLSCRoNABKYsAv8w8xJxov8yGJ274/oMzM/w==
cross-origin-resource-policy: cross-origin
permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
document-policy: force-load-at-top
access-control-allow-origin: *
content-length: 1686
origin-agent-cluster: ?0

GET
H2 200 widgets.js Show response
platform.twitter.com/ 91 KB
27 KB 195ms
54ms Script
application/javascript 146.75.52.157
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/widgets.js
Requested by: Host: www.cybereason.com
URL: https://www.cybereason.com/blog/cuckoo-spear-pt2-threat-actor-arsenal
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 146.75.52.157 Milan, Italy, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 173460e89e6a7244218badae2016f65c48a3eae9d400802273eeca18b07336f1

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.cybereason.com/blog/cuckoo-spear-pt2-threat-actor-arsenal

Response headers

content-encoding: gzip
etag: "824beb891744db98ccbd3a456e59e0f7+gzip"
access-control-allow-methods: GET
x-cache: HIT, HIT
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
date: Sat, 05 Oct 2024 15:46:46 GMT
last-modified: Mon, 11 Dec 2023 17:20:28 GMT
vary: Accept-Encoding
x-served-by: cache-iad-kcgs7200137-IAD, cache-lin1730061-LIN
content-type: application/javascript; charset=utf-8
cache-control: public, max-age=1800
tw-cdn: FT
accept-ranges: bytes
access-control-allow-origin: *
content-length: 27597
x-amz-server-side-encryption: AES256

GET
H2 200 banner.js Show response
js.hs-banner.com/v2/3354902/ 72 KB
26 KB 402ms
323ms Script
text/javascript 2606:4700:4400::6812:28f0
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js.hs-banner.com/v2/3354902/banner.js
Requested by: Host: www.cybereason.com
URL: https://www.cybereason.com/hs/scriptloader/3354902.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:4400::6812:28f0 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: cef073e9d2b0a3c33807cde69c66d9b20d3b20be5255901bbb4ae666271506e0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.cybereason.com/blog/cuckoo-spear-pt2-threat-actor-arsenal

Response headers

x-evy-trace-virtual-host: all
access-control-max-age: 604800
x-request-id: 8b6e5494-c14e-4927-a279-6624ee39870e
access-control-expose-headers: x-last-modified-timestamp, X-HubSpot-NotFound, X-HS-User-Request, Link, Server-Timing
content-encoding: gzip
cf-cache-status: REVALIDATED
etag: W/"d07cad159aec4252901b89682e263f46"
x-amz-version-id: tVMMEGHtsbiem9ZjwaBeayUZEo8_kl0B
access-control-allow-methods: GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD
expires: Sat, 05 Oct 2024 15:51:46 GMT
x-evy-trace-listener: listener_https
date: Sat, 05 Oct 2024 15:46:46 GMT
x-hubspot-correlation-id: 8b6e5494-c14e-4927-a279-6624ee39870e
content-type: text/javascript; charset=UTF-8
last-modified: Fri, 23 Aug 2024 10:18:51 GMT
vary: origin, Accept-Encoding
x-amz-id-2: VupDTJl81m3G89ZypYBuzGY+HMr028/4vVCNYap89p5pdFZ+lwC24BIBDH1Z0z0nkdQ4Nu29Qxw=
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Accept-Charset, Accept-Encoding, X-Override-Internal-Permissions, X-Properties-Source, X-Properties-SourceId, X-Properties-Flag, X-Hubspot-User-Id, X-Hubspot-Trace, X-Hubspot-Callee, X-Hubspot-Offset, X-Hubspot-No-Trace, X-HubSpot-Static-App-Info, X-HubSpot-Messages-Uri, X-HubSpot-Request-Source, X-HubSpot-Request-Reason, Subscription-Billing-Auth-Token, X-App-CSRF, X-Tools-CSRF, Online-Payment-Signing-UUID, X-Source, X-SourceId, X-Origin-UserId, X-Biden-Request-Source, X-HubSpot-CSRF-hubspotapi, X-Force-Cookie-Refresh, X-Force-Cookie-Refresh-No-Cache, X-HS-User-Request, X-Application-Id, X-HS-Referer, X-HubSpot-Correlation-Id
x-evy-trace-route-service-name: envoyset-translator
cache-control: max-age=300,public
timing-allow-origin: *
x-evy-trace-served-by-pod: iad02/analytics-js-proxy-td/envoy-proxy-6895b58fd6-gfff7
x-envoy-upstream-service-time: 30
access-control-allow-credentials: true
x-amz-request-id: 3CHKT2MKMBBPFHQW
cf-ray: 8cde8bdd1d0d94aa-LHR
access-control-allow-origin: https://www.cybereason.com
x-evy-trace-route-configuration: listener_https/all
server: cloudflare
x-amz-server-side-encryption: AES256

GET
H2 200 leadflows.js Show response
js.hsleadflows.net/ 551 KB
92 KB 146ms
62ms Script
application/javascript 2606:4700::6812:8a11
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://js.hsleadflows.net/leadflows.js

Requested by

Host: www.cybereason.com
URL: https://www.cybereason.com/hs/scriptloader/3354902.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:8a11 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c1233a49c4ecec12fed969bc83cd6ba59d8b2b88bef31988d9384f7e54c42e20

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Origin: https://www.cybereason.com
Referer: https://www.cybereason.com/blog/cuckoo-spear-pt2-threat-actor-arsenal

Response headers

x-request-id: 845b4e42-6187-476a-b2e2-b7a5c1bfec85
content-encoding: gzip
cf-cache-status: HIT
etag: W/"7d65c542c3a53442feef1a0f44071183"
x-amz-version-id: WgPQEOT.QDI5zKnRYhaKsuHqDz44RIEz
cache-tag: staticjsapp-lead-flows-cloudflare-web-prod,staticjsapp-prod
x-content-type-options: nosniff
x-cache: Miss from cloudfront
x-evy-trace-listener: listener_https
x-amz-cf-id: u8xE4R3_aGOEyerILSgkgRehb5SOIamIRCpfBV5t5LvsvXLl-NS_FA==
x-hubspot-correlation-id: 845b4e42-6187-476a-b2e2-b7a5c1bfec85
content-type: application/javascript; charset=utf-8
last-modified: Thu, 12 Sep 2024 08:49:54 UTC
x-amz-replication-status: COMPLETED
x-evy-trace-route-service-name: envoyset-translator
cache-control: s-maxage=86400, max-age=0
x-evy-trace-served-by-pod: iad02/app-td/envoy-proxy-6c6dd6864-xnv54
x-envoy-upstream-service-time: 63
x-hs-target-asset: lead-flows-js/static-1.1627/bundle/main/lead-flows-release.js
server: cloudflare
x-evy-trace-virtual-host: all
x-amz-server-side-encryption: AES256
access-control-max-age: 3000
access-control-allow-methods: GET
x-hs-cache-status: MISS
date: Sat, 05 Oct 2024 15:46:45 GMT
vary: Accept-Encoding,Origin,Access-Control-Request-Headers,Access-Control-Request-Method
content-security-policy-report-only: frame-ancestors 'self'; report-uri https://send.hsbrowserreports.com/csp/report?resource=lead-flows-js/static-1.1627/bundle/main/lead-flows-release.js&cfRay=8cbda794bd422dd5-CDG
via: 1.1 1f1067e4f193aaabd2c24b99bcdc4e88.cloudfront.net (CloudFront)
cf-ray: 8cde8bdd29dbcd46-LHR
access-control-allow-origin: *
x-evy-trace-route-configuration: listener_https/all
x-amz-cf-pop: IAD12-P3

GET
H2 200 web-interactives-embed.js Show response
js.hubspot.com/ 83 KB
25 KB 135ms
67ms Script
application/javascript 2606:4700::6810:7674
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://js.hubspot.com/web-interactives-embed.js

Requested by

Host: www.cybereason.com
URL: https://www.cybereason.com/hs/scriptloader/3354902.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7674 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6b0fdaa32feffbdbd15bda3619624e0aa8e1d647fd720e31b7645654e7fb551e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Origin: https://www.cybereason.com
Referer: https://www.cybereason.com/blog/cuckoo-spear-pt2-threat-actor-arsenal

Response headers

x-request-id: 87cd4399-7da1-4450-b1c8-d94eca6fd0ef
content-encoding: gzip
cf-cache-status: HIT
etag: W/"6b513baaf4c77cddc702f596c3dd62d9"
x-amz-version-id: ntxqQzn.1wWRtdFp_E4nJAhKHFNI4WSr
cache-tag: staticjsapp-web-interactives-embed-web-prod,staticjsapp-prod
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=kD%2Fbd7kvat7Yed8sL7EsWSDvIzRk71XbH47KjuXWTKiNQuScMkacymxOXM%2FzR%2BFNFJcojGaOngTH7hAPZk7AVhq76P9xtzM5QNkJ%2B%2FJfJhqKDOnHldvQwBf3537e2t8g%2F6fprZNDofh9El6M"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
x-cache: Hit from cloudfront
x-evy-trace-listener: listener_https
x-amz-cf-id: Ix-c3Z3_2QZbId73lK-N-i3KwFJhQ4DHBseYj_2Vx_ny-7s1xXL0CA==
x-hubspot-correlation-id: 87cd4399-7da1-4450-b1c8-d94eca6fd0ef
content-type: application/javascript; charset=utf-8
last-modified: Fri, 04 Oct 2024 11:58:06 UTC
x-amz-replication-status: COMPLETED
x-evy-trace-route-service-name: envoyset-translator
cache-control: max-age=600
x-evy-trace-served-by-pod: iad02/app-td/envoy-proxy-6c6dd6864-sqxn4
x-envoy-upstream-service-time: 6
x-hs-target-asset: web-interactives-embed/static-2.1554/bundles/project.js
server: cloudflare
x-evy-trace-virtual-host: all
x-amz-server-side-encryption: AES256
access-control-max-age: 3000
access-control-allow-methods: GET
x-hs-cache-status: MISS
date: Sat, 05 Oct 2024 15:46:45 GMT
vary: Accept-Encoding,Origin,Access-Control-Request-Headers,Access-Control-Request-Method
strict-transport-security: max-age=31536000; includeSubDomains; preload
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
content-security-policy-report-only: frame-ancestors 'self'; report-uri https://send.hsbrowserreports.com/csp/report?resource=web-interactives-embed/static-2.1554/bundles/project.js&cfRay=8cd53ef8ba5294c6-CDG
via: 1.1 caafbc8a9aa04b09dd564a3ddef60622.cloudfront.net (CloudFront)
cf-ray: 8cde8bdd1f6363f1-LHR
access-control-allow-origin: *
x-evy-trace-route-configuration: listener_https/all
x-amz-cf-pop: IAD12-P3

GET
H2 200 3354902.js Show response
js.hs-analytics.net/analytics/1728143100000/ 69 KB
25 KB 313ms
236ms Script
text/javascript 2606:4700::6810:a0a8
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js.hs-analytics.net/analytics/1728143100000/3354902.js
Requested by: Host: www.cybereason.com
URL: https://www.cybereason.com/hs/scriptloader/3354902.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6810:a0a8 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 88a9bb80d6a834eb8ba22c53c171e797474b21a5dbc09ff7e736aabb0578fa15

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.cybereason.com/blog/cuckoo-spear-pt2-threat-actor-arsenal

Response headers

x-amz-server-side-encryption: AES256
x-request-id: 1a4816f2-1519-482e-a914-20d15d77a602
content-encoding: gzip
cf-cache-status: MISS
etag: W/"ac888b319caa5b516a7ef122b8a6697e"
x-amz-version-id: null
expires: Sat, 05 Oct 2024 15:51:46 GMT
x-evy-trace-listener: listener_https
date: Sat, 05 Oct 2024 15:46:46 GMT
x-hubspot-correlation-id: 1a4816f2-1519-482e-a914-20d15d77a602
content-type: text/javascript
last-modified: Tue, 01 Oct 2024 15:30:42 GMT
vary: origin, Accept-Encoding
x-amz-id-2: wtjD223ywCdBrafoqvJCVh77trkRACz8jIMtE1nFxv7m9/twK64y2EEQFkGuK9a/w34dx0kolZBdguBgi2i3cFD5an9fS0CEeM8zclmB2Oo=
x-evy-trace-route-service-name: envoyset-translator
cache-control: max-age=300,public
x-evy-trace-served-by-pod: iad02/analytics-js-proxy-td/envoy-proxy-75d7846cb8-gcq5k
x-envoy-upstream-service-time: 21
access-control-allow-credentials: false
x-amz-request-id: 0PZQKY3W5KWSNDXX
cf-ray: 8cde8bdd2b4f7691-LHR
x-evy-trace-route-configuration: listener_https/all
server: cloudflare
x-evy-trace-virtual-host: all

GET
H2 200 _Incapsula_Resource
www.cybereason.com/ 1 B
36 B 44ms
44ms Image
text/plain 45.60.64.106
INCAPSULA

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.cybereason.com/_Incapsula_Resource?SWKMTFSR=1&e=0.9233744037562273

Requested by

Host: www.cybereason.com
URL: https://www.cybereason.com/blog/cuckoo-spear-pt2-threat-actor-arsenal

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

45.60.64.106 , United States, ASN19551 (INCAPSULA, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.cybereason.com/blog/cuckoo-spear-pt2-threat-actor-arsenal

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
x-robots-tag: noindex
cache-control: no-cache, no-store
content-length: 1
content-type: text/plain

GET
H2 204 has-permission-json Show response
app.hubspot.com/content-tools-menu/api/v1/tools-menu/ 0
1 KB 326ms
250ms XHR
text/plain 2606:4700::6810:7674
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://app.hubspot.com/content-tools-menu/api/v1/tools-menu/has-permission-json?portalId=3354902

Requested by

Host: www.cybereason.com
URL: https://www.cybereason.com/hs/hsstatic/HubspotToolsMenu/static-1.354/js/index.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7674 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	no-sniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.cybereason.com/blog/cuckoo-spear-pt2-threat-actor-arsenal

Response headers

x-request-id: a35deb64-2fa1-4076-ade7-713e57dd2d7d
cf-cache-status: DYNAMIC
x-hs-worker-debug-mode: false
report-to: {"group":"default","max_age":86400,"endpoints":[{"url":"https://send.hsbrowserreports.com/csp/reports"}]}
access-control-allow-methods: GET
x-content-type-options: no-sniff
x-evy-trace-listener: listener_https
date: Sat, 05 Oct 2024 15:46:46 GMT
x-hubspot-correlation-id: a35deb64-2fa1-4076-ade7-713e57dd2d7d
vary: origin, Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
reporting-endpoints: default="https://send.hsbrowserreports.com/csp/reports?cfRay=8cde8bdd7c987775&resource=unknown"
x-evy-trace-route-service-name: envoyset-translator
cache-control: max-age=0
x-evy-trace-served-by-pod: iad02/app-td/envoy-proxy-6c6dd6864-8qwxx
x-envoy-upstream-service-time: 2
access-control-allow-credentials: true
cf-ray: 8cde8bdd7c987775-LHR
access-control-allow-origin: https://www.cybereason.com
x-evy-trace-route-configuration: listener_https/all
server: cloudflare
x-evy-trace-virtual-host: all

GET
H2 200 l
use.typekit.net/af/343335/00000000000000003b9b0ad0/27/ 16 KB
16 KB 193ms
55ms Font
application/font-woff2 2a02:26f0:3500:16::215:148f
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://use.typekit.net/af/343335/00000000000000003b9b0ad0/27/l?primer=7cdcb44be4a7db8877ffa5c0007b8dd865b3bbc383831fe2ea177f62257a9191&fvd=n3&v=3
Requested by: Host: www.cybereason.com
URL: https://www.cybereason.com/blog/cuckoo-spear-pt2-threat-actor-arsenal
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:3500:16::215:148f Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: nginx /
Resource Hash: 599dd661a1d9e0af96d614fab0ea7396bf06de4265029166a265c2b10cc1a1b0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Origin: https://www.cybereason.com
Referer: https://www.cybereason.com/

Response headers

cache-control: public, max-age=31536000
timing-allow-origin: *
etag: "eedb93b5a9ba82f97df21a2548066c304a8baad8"
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 16112
date: Sat, 05 Oct 2024 15:46:46 GMT
content-type: application/font-woff2
server: nginx

GET
H2 200 l
use.typekit.net/af/4b34d2/00000000000000003b9b0acf/27/ 16 KB
16 KB 184ms
46ms Font
application/font-woff2 2a02:26f0:3500:16::215:148f
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://use.typekit.net/af/4b34d2/00000000000000003b9b0acf/27/l?primer=7cdcb44be4a7db8877ffa5c0007b8dd865b3bbc383831fe2ea177f62257a9191&fvd=i4&v=3
Requested by: Host: www.cybereason.com
URL: https://www.cybereason.com/blog/cuckoo-spear-pt2-threat-actor-arsenal
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:3500:16::215:148f Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: nginx /
Resource Hash: f3f2822ba3d24c1f7f53bff8959801c644b2c1c556eb8c15ca36a86717f1ae7d

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Origin: https://www.cybereason.com
Referer: https://www.cybereason.com/

Response headers

cache-control: public, max-age=31536000
timing-allow-origin: *
etag: "2d91046573f0e4458e7737f18f00bb9c13388e11"
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 16256
date: Sat, 05 Oct 2024 15:46:46 GMT
content-type: application/font-woff2
server: nginx

GET
H2 200 l
use.typekit.net/af/cb6232/00000000000000003b9b0ad8/27/ 15 KB
15 KB 197ms
59ms Font
application/font-woff2 2a02:26f0:3500:16::215:148f
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://use.typekit.net/af/cb6232/00000000000000003b9b0ad8/27/l?primer=7cdcb44be4a7db8877ffa5c0007b8dd865b3bbc383831fe2ea177f62257a9191&fvd=n4&v=3
Requested by: Host: www.cybereason.com
URL: https://www.cybereason.com/blog/cuckoo-spear-pt2-threat-actor-arsenal
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:3500:16::215:148f Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: nginx /
Resource Hash: f64368e7be69abe40585911860d83acfa8b14179d3008b2594166ae4c10ec0fd

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Origin: https://www.cybereason.com
Referer: https://www.cybereason.com/

Response headers

cache-control: public, max-age=31536000
timing-allow-origin: *
etag: "865da7d2ecc4da3cb6bd5574f01738cfc5c8bb11"
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 15452
date: Sat, 05 Oct 2024 15:46:46 GMT
content-type: application/font-woff2
server: nginx

GET
H2 200 l
use.typekit.net/af/abc1c3/00000000000000003b9b0ac9/27/ 16 KB
16 KB 237ms
99ms Font
application/font-woff2 2a02:26f0:3500:16::215:148f
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://use.typekit.net/af/abc1c3/00000000000000003b9b0ac9/27/l?primer=7cdcb44be4a7db8877ffa5c0007b8dd865b3bbc383831fe2ea177f62257a9191&fvd=n6&v=3
Requested by: Host: www.cybereason.com
URL: https://www.cybereason.com/blog/cuckoo-spear-pt2-threat-actor-arsenal
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:3500:16::215:148f Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: nginx /
Resource Hash: 72493a3f42ed0260f03b6ffd3ea131be38a1070845bfae24927f643a3fcf3255

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Origin: https://www.cybereason.com
Referer: https://www.cybereason.com/

Response headers

cache-control: public, max-age=31536000
timing-allow-origin: *
etag: "8c3ee2b4e977df4e0f73e1b985c24fba9611fc49"
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 16660
date: Sat, 05 Oct 2024 15:46:46 GMT
content-type: application/font-woff2
server: nginx

GET
H2 200 l
use.typekit.net/af/62203f/00000000000000003b9b0ac8/27/ 17 KB
17 KB 237ms
99ms Font
application/font-woff2 2a02:26f0:3500:16::215:148f
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://use.typekit.net/af/62203f/00000000000000003b9b0ac8/27/l?primer=7cdcb44be4a7db8877ffa5c0007b8dd865b3bbc383831fe2ea177f62257a9191&fvd=i7&v=3
Requested by: Host: www.cybereason.com
URL: https://www.cybereason.com/blog/cuckoo-spear-pt2-threat-actor-arsenal
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:3500:16::215:148f Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: nginx /
Resource Hash: 5c8d63abd4075c4ebd692fbd02e35fb72950f214a6486607c1819d4279ad526f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Origin: https://www.cybereason.com
Referer: https://www.cybereason.com/

Response headers

cache-control: public, max-age=31536000
timing-allow-origin: *
etag: "7b5be73a29b093f7ae3c099f5a521c9274f6db28"
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 17152
date: Sat, 05 Oct 2024 15:46:46 GMT
content-type: application/font-woff2
server: nginx

GET
H2 200 l
use.typekit.net/af/19a2f0/00000000000000003b9b0ac7/27/ 16 KB
16 KB 188ms
50ms Font
application/font-woff2 2a02:26f0:3500:16::215:148f
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://use.typekit.net/af/19a2f0/00000000000000003b9b0ac7/27/l?primer=7cdcb44be4a7db8877ffa5c0007b8dd865b3bbc383831fe2ea177f62257a9191&fvd=n7&v=3
Requested by: Host: www.cybereason.com
URL: https://www.cybereason.com/blog/cuckoo-spear-pt2-threat-actor-arsenal
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:3500:16::215:148f Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: nginx /
Resource Hash: dd8ce52adc4b0ab60f82c29ba12f25e2f6446245fc8c0b5f4bd6dab3146f9ef7

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Origin: https://www.cybereason.com
Referer: https://www.cybereason.com/

Response headers

cache-control: public, max-age=31536000
timing-allow-origin: *
etag: "b9e1ecdf0fe601a7e9dfc362b400290203e7b31c"
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 16464
date: Sat, 05 Oct 2024 15:46:46 GMT
content-type: application/font-woff2
server: nginx

GET
H2 200 l
use.typekit.net/af/cfbead/0000000000000000000146b3/27/ 23 KB
23 KB 192ms
54ms Font
application/font-woff2 2a02:26f0:3500:16::215:148f
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://use.typekit.net/af/cfbead/0000000000000000000146b3/27/l?primer=7cdcb44be4a7db8877ffa5c0007b8dd865b3bbc383831fe2ea177f62257a9191&fvd=n4&v=3
Requested by: Host: www.cybereason.com
URL: https://www.cybereason.com/blog/cuckoo-spear-pt2-threat-actor-arsenal
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:3500:16::215:148f Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: nginx /
Resource Hash: 875f8e591b4fbc6567e2b33553bea9ca2d0e18593bd857783a569fe7bf4ba097

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Origin: https://www.cybereason.com
Referer: https://www.cybereason.com/

Response headers

cache-control: public, max-age=31536000
timing-allow-origin: *
etag: "122498e3424e674610da39fb441d661549879239"
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 23244
date: Sat, 05 Oct 2024 15:46:46 GMT
content-type: application/font-woff2
server: nginx

GET
H2 200 l
use.typekit.net/af/f50d41/00000000000000003b9b2c84/27/ 15 KB
15 KB 275ms
138ms Font
application/font-woff2 2a02:26f0:3500:16::215:148f
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://use.typekit.net/af/f50d41/00000000000000003b9b2c84/27/l?primer=7cdcb44be4a7db8877ffa5c0007b8dd865b3bbc383831fe2ea177f62257a9191&fvd=n3&v=3
Requested by: Host: www.cybereason.com
URL: https://www.cybereason.com/blog/cuckoo-spear-pt2-threat-actor-arsenal
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:3500:16::215:148f Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: nginx /
Resource Hash: 0b454edb897d49bf8a73b07627b670a55f0972988094770495a308e5a5e39d1b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Origin: https://www.cybereason.com
Referer: https://www.cybereason.com/

Response headers

cache-control: public, max-age=31536000
timing-allow-origin: *
etag: "13c2813ff67959226aaa4eccfcdd1399bd756b8d"
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 15336
date: Sat, 05 Oct 2024 15:46:46 GMT
content-type: application/font-woff2
server: nginx

GET
H3 200 sdk.js Show response
connect.facebook.net/en_GB/ 283 KB
81 KB 86ms
43ms Script
application/x-javascript 157.240.0.6
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_GB/sdk.js?hash=4da529351e1fcab91d9abf9011f8c4a2

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_GB/sdk.js

Protocol

Security

QUIC, , AES_128_GCM

Server

157.240.0.6 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

xx-fbcdn-shv-02-fra3.fbcdn.net

Software

Resource Hash

33ec52ebf1d0e926879a2d1c1521b2de1e8e49d220ce284adc0c021e4a2017f8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Origin: https://www.cybereason.com
Referer: https://www.cybereason.com/blog/cuckoo-spear-pt2-threat-actor-arsenal

Response headers

content-md5: /EuYJoH0fnAsmUcadEc7Zg==
access-control-expose-headers: X-FB-Content-MD5
content-encoding: gzip
etag: "30c89ea5a3eeb6149df61f3eba8c32e3"
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
x-content-type-options: nosniff
expires: Sun, 05 Oct 2025 14:39:53 GMT
alt-svc: h3=":443"; ma=86400
date: Sat, 05 Oct 2024 15:46:45 GMT
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
priority: u=3,i
x-frame-options: DENY
strict-transport-security: max-age=31536000; preload; includeSubDomains
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
x-fb-content-md5: 073770d68084f1514e74e66523d47f49
cache-control: public,max-age=31536000,stale-while-revalidate=3600,immutable
timing-allow-origin: *
cross-origin-opener-policy: same-origin-allow-popups
x-fb-connection-quality: EXCELLENT; q=0.9, rtt=41, rtx=0, c=23, mss=1232, tbw=4424, tp=9, tpl=0, uplat=1, ullat=-1
x-fb-debug: EV6RQN501hZfinH7EEU9KkkBbG4PEyQa+GqDUAQMW8uYFuwFHQt/CocDoxfSZwB3wq+Va9ybsM5bJoXSBNljvg==
cross-origin-resource-policy: cross-origin
permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
x-fb-optimizer: 1
document-policy: force-load-at-top
access-control-allow-origin: *
content-length: 82686

GET
H2 200 combinedConfigs Show response
cta-service-cms2.hubspot.com/web-interactives/public/v1/embed/ 95 B
1 KB 137ms
136ms Fetch
application/json 2606:4700::6810:7674
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cta-service-cms2.hubspot.com/web-interactives/public/v1/embed/combinedConfigs?portalId=3354902&currentUrl=https%3A%2F%2Fwww.cybereason.com%2Fblog%2Fcuckoo-spear-pt2-threat-actor-arsenal&contentId=178628451426

Requested by

Host: js.hubspot.com
URL: https://js.hubspot.com/web-interactives-embed.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7674 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f212e942ac33fd93669f03a55e2c0192224cdb6870b376fac8d3c5255cd01225

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.cybereason.com/blog/cuckoo-spear-pt2-threat-actor-arsenal

Response headers

x-robots-tag: noindex, follow
access-control-max-age: 180
x-request-id: 08b663aa-46ae-4e59-bfd4-2685bcfcefc2
content-encoding: br
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=bnSr0sDDY%2BYLFOfke3pp19LmKM8%2BqM34N0N5Mqcl5LInNFOnmeuMO581g0skyDd9Jp6Em9hiCRK76MLfJEwXIUeMATQEXJ2AfJoD13FKUgUzxMlt8Z1UqJx%2BAeS9JNTBXxONKykodKCoOxhTkXqBdNH8ipi6dYah%2FXI%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
access-control-allow-methods: OPTIONS, GET
x-evy-trace-listener: listener_https
date: Sat, 05 Oct 2024 15:46:46 GMT
x-hubspot-correlation-id: 08b663aa-46ae-4e59-bfd4-2685bcfcefc2
content-type: application/json;charset=utf-8
vary: origin
access-control-allow-headers: Accept, Accept-Charset, Accept-Encoding, Accept-Language, Content-Type, Host, Origin, Referer, User-Agent
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-evy-trace-route-service-name: envoyset-translator
cache-control: max-age=0, no-cache, no-store
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-evy-trace-served-by-pod: iad02/star-hubspot-td/envoy-proxy-5485db5487-sr42p
x-envoy-upstream-service-time: 6
access-control-allow-credentials: true
cf-ray: 8cde8bddc8ce63f1-LHR
access-control-allow-origin: https://www.cybereason.com
x-evy-trace-route-configuration: listener_https/all
server: cloudflare
x-evy-trace-virtual-host: all

GET
H2 200 widget_iframe.2f70fb173b9000da126c79afe2098f02.html
platform.twitter.com/widgets/ Frame 5822 0
0 163ms
54ms Document
text/html 146.75.52.157
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/widgets/widget_iframe.2f70fb173b9000da126c79afe2098f02.html?origin=https%3A%2F%2Fwww.cybereason.com
Requested by: Host: platform.twitter.com
URL: https://platform.twitter.com/widgets.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 146.75.52.157 Milan, Italy, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: https://www.cybereason.com/blog/cuckoo-spear-pt2-threat-actor-arsenal
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
access-control-allow-methods: GET
access-control-allow-origin: *
cache-control: public, max-age=315360000
content-encoding: gzip
content-length: 105429
content-type: text/html; charset=utf-8
date: Sat, 05 Oct 2024 15:46:46 GMT
etag: "81267302efdfb3e4524a22631a8fc99e+gzip"
last-modified: Mon, 11 Dec 2023 17:19:49 GMT
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
tw-cdn: FT
vary: Accept-Encoding
x-amz-server-side-encryption: AES256
x-cache: HIT, HIT
x-served-by: cache-iad-kiad7000164-IAD, cache-lin1730035-LIN

GET
H3 200 counters.gif
perf-na1.hsforms.com/embed/v3/ 35 B
908 B 193ms
155ms Image
image/gif 104.18.80.204
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://perf-na1.hsforms.com/embed/v3/counters.gif?key=config-loaded-success&value=1

Requested by

Host: www.cybereason.com
URL: https://www.cybereason.com/blog/cuckoo-spear-pt2-threat-actor-arsenal

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.80.204 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.cybereason.com/blog/cuckoo-spear-pt2-threat-actor-arsenal

Response headers

x-robots-tag: none
x-request-id: 95ab24db-8912-44b8-9a72-56b2c541adcc
access-control-expose-headers: X-Origin-Hublet
cf-cache-status: MISS
x-content-type-options: nosniff
x-evy-trace-listener: listener_https
date: Sat, 05 Oct 2024 15:46:46 GMT
x-hubspot-correlation-id: 95ab24db-8912-44b8-9a72-56b2c541adcc
content-type: image/gif
vary: origin, Accept-Encoding
last-modified: Sat, 05 Oct 2024 15:46:46 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-evy-trace-route-service-name: envoyset-translator
cache-control: max-age=0, no-cache, no-store
x-evy-trace-served-by-pod: iad02/star-hubspot-td/envoy-proxy-5485db5487-rt5qf
x-envoy-upstream-service-time: 1
access-control-allow-credentials: false
cf-ray: 8cde8bdeffde6334-LHR
accept-ranges: bytes
x-evy-trace-route-configuration: listener_https/all
content-length: 35
server: cloudflare
x-evy-trace-virtual-host: all

GET
H2 200 p.gif
p.typekit.net/ 35 B
205 B 190ms
47ms Image
image/gif 2a02:26f0:3500:16::215:148b
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://p.typekit.net/p.gif?s=1&k=vyv2ljd&ht=tk&h=www.cybereason.com&f=32224.32226.32227.32228.32230.32231.10875.32265&a=657783&js=1.21.0&app=typekit&e=js&_=1728143206200
Requested by: Host: www.cybereason.com
URL: https://www.cybereason.com/blog/cuckoo-spear-pt2-threat-actor-arsenal
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:3500:16::215:148b Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: nginx /
Resource Hash: 9b9265c69a5cc295d1ab0d04e0273b3677db1a6216ce2ccf4efc8c277ed84b39

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.cybereason.com/blog/cuckoo-spear-pt2-threat-actor-arsenal

Response headers

cache-control: public, max-age=604800
etag: "64c3b732-23"
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
access-control-allow-origin: *
content-length: 35
date: Sat, 05 Oct 2024 15:46:46 GMT
content-type: image/gif
last-modified: Fri, 28 Jul 2023 12:40:18 GMT
server: nginx

GET
H2 200 cf-location Show response
js.hs-banner.com/v2/ 6 B
149 B 108ms
43ms Fetch
text/plain 2606:4700:4400::6812:28f0
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js.hs-banner.com/v2/cf-location
Requested by: Host: js.hs-banner.com
URL: https://js.hs-banner.com/v2/3354902/banner.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:4400::6812:28f0 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d61bc5a683625b3980e8f48b9141dfb2dfea199059f0df327c8e3a92bcb57f97

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.cybereason.com/blog/cuckoo-spear-pt2-threat-actor-arsenal

Response headers

cache-control: private, max-age=1500
cf-ray: 8cde8bdf8c9cbe9b-LHR
access-control-allow-origin: *
content-length: 6
date: Sat, 05 Oct 2024 15:46:46 GMT
content-type: text/plain;charset=UTF-8
vary: Accept-Encoding
server: cloudflare

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 425 KB
124 KB 170ms
76ms Script
application/javascript 2a00:1450:4001:81c::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-TJVVB7C

Requested by

Host: www.cybereason.com
URL: https://www.cybereason.com/blog/cuckoo-spear-pt2-threat-actor-arsenal

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

401e5a188c00ddf1fc3a3ba85a63d419cb7d63d280eb436ee5efa39ee8fdff99

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.cybereason.com/blog/cuckoo-spear-pt2-threat-actor-arsenal

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:1080:0"}],}
expires: Sat, 05 Oct 2024 15:46:46 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 05 Oct 2024 15:46:46 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Sat, 05 Oct 2024 15:00:00 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:1080:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 126729
x-xss-protection: 0
server: Google Tag Manager

GET
H2 200 otSDKStub.js Show response
cdn.cookielaw.org/scripttemplates/ 22 KB
8 KB 127ms
59ms Script
application/javascript 2606:4700::6812:562a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/otSDKStub.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TJVVB7C

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:562a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

efad755939e511f2bc1feb0d58d6014006e8598a4d431f27a66dd59e14fc19cb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.cybereason.com/blog/cuckoo-spear-pt2-threat-actor-arsenal

Response headers

content-md5: uiXk8gw/ehyoMvZ3GeQiaQ==
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
content-encoding: gzip
x-ms-version: 2009-09-19
etag: 0x8DCE3E0C241C63A
x-ms-lease-status: unlocked
cf-cache-status: HIT
age: 10
x-content-type-options: nosniff
expires: Sun, 06 Oct 2024 15:46:46 GMT
date: Sat, 05 Oct 2024 15:46:46 GMT
content-type: application/javascript
last-modified: Thu, 03 Oct 2024 19:22:45 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
x-ms-request-id: 61ecba25-801e-0016-2462-165214000000
cf-ray: 8cde8be19fdb9484-LHR
accept-ranges: bytes
access-control-allow-origin: *
content-length: 7214
x-ms-blob-type: BlockBlob
server: cloudflare

GET
H2 200 3354902.js Show response
js.hs-scripts.com/ 2 KB
882 B 152ms
74ms Script
application/javascript 2606:4700::6810:89d1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://js.hs-scripts.com/3354902.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TJVVB7C

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:89d1 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d33307c095bc94921f4f3be5daacd40022c008168cf2829bebc5021921c3093c

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.cybereason.com/blog/cuckoo-spear-pt2-threat-actor-arsenal

Response headers

access-control-max-age: 3600
content-encoding: br
cf-bgj: minify
cf-cache-status: HIT
x-content-type-options: nosniff
expires: Sat, 05 Oct 2024 15:48:16 GMT
cf-polished: origSize=2026
date: Sat, 05 Oct 2024 15:46:46 GMT
x-hubspot-correlation-id: 50462b2a-4192-46a3-80d9-20a7457bd943
content-type: application/javascript;charset=utf-8
vary: origin, Accept-Encoding
last-modified: Sat, 05 Oct 2024 15:45:54 GMT
cache-control: public, max-age=90
access-control-allow-credentials: true
cf-ray: 8cde8be1aa3948b0-LHR
access-control-allow-origin: https://www.cybereason.com
server: cloudflare

GET
H2 200 26b02624-42c7-456d-82c2-9669db762671.json Show response
cdn.cookielaw.org/consent/26b02624-42c7-456d-82c2-9669db762671/ 5 KB
2 KB 122ms
57ms XHR
application/json 2606:4700::6812:562a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/consent/26b02624-42c7-456d-82c2-9669db762671/26b02624-42c7-456d-82c2-9669db762671.json

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:562a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0dfb22afe7173c577144301206aee5fa3939268bfefb7adb44906fa81cb7a1d2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.cybereason.com/blog/cuckoo-spear-pt2-threat-actor-arsenal

Response headers

content-md5: IGr7iWost09FKtc8kbZS7g==
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
content-encoding: gzip
cf-cache-status: HIT
etag: 0x8DC83D7788B18D7
age: 23360
x-ms-lease-status: unlocked
x-content-type-options: nosniff
x-ms-version: 2009-09-19
expires: Sun, 06 Oct 2024 15:46:46 GMT
date: Sat, 05 Oct 2024 15:46:46 GMT
content-type: application/json
last-modified: Mon, 03 Jun 2024 14:14:24 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin, cross-origin
x-ms-request-id: 92a7e383-601e-0054-64c0-b5abe3000000
cf-ray: 8cde8be2695a88c2-LHR
accept-ranges: bytes
access-control-allow-origin: *
content-length: 1798
x-ms-blob-type: BlockBlob
server: cloudflare

GET
H2 200 __ptq.gif
track.hubspot.com/ 45 B
587 B 150ms
141ms Image
image/gif 2606:4700::6810:7674
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://track.hubspot.com/__ptq.gif?k=1&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=en-gb&bfp=3754766307&v=1.1&a=3354902&pi=178628451426&ct=blog-post&ccu=https%3A%2F%2Fwww.cybereason.com%2Fblog%2Fcuckoo-spear-pt2-threat-actor-arsenal&cpi=178628451426&cgi=5272851739&lpi=178628451426&lvi=178628451426&lvc=en&pu=https%3A%2F%2Fwww.cybereason.com%2Fblog%2Fcuckoo-spear-pt2-threat-actor-arsenal&t=CUCKOO+SPEAR+Part+2%3A+Threat+Actor+Arsenal&cts=1728143206738&vi=d60ee04feffed21d44dc7f8f0aa53c91&nc=true&u=85683782.d60ee04feffed21d44dc7f8f0aa53c91.1728143206737.1728143206737.1728143206737.1&b=85683782.1.1728143206737&cc=15

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7674 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.cybereason.com/blog/cuckoo-spear-pt2-threat-actor-arsenal

Response headers

x-robots-tag: none
x-request-id: 06501623-8935-4105-a7d2-3f3c159a8f34
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=6O4gJ32sM2qrIx%2FUOJYj7tTc2oKCDl%2F79lwS9sRD8PcBMu5degr3P3Xg0QywDfpbSCRTdDjeFA4QTc6f8dDp%2FYw8beiGD0dF0ogppYQBrfEF0Y2RIUaJenDzLDCeS5P9AdeUUschCJTfP2EreD%2FD"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
x-evy-trace-listener: listener_https
p3p: CP="NOI CUR ADM OUR NOR STA NID"
date: Sat, 05 Oct 2024 15:46:46 GMT
x-hubspot-correlation-id: 06501623-8935-4105-a7d2-3f3c159a8f34
content-type: image/gif
vary: origin, Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-evy-trace-route-service-name: envoyset-translator
cache-control: no-cache, no-store, no-transform
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-evy-trace-served-by-pod: iad02/analytics-tracking-td/envoy-proxy-689db97f95-kk9h8
x-envoy-upstream-service-time: 4
access-control-allow-credentials: false
cf-ray: 8cde8be239ec7775-LHR
x-evy-trace-route-configuration: listener_https/all
content-length: 45
server: cloudflare
x-evy-trace-virtual-host: all

GET
H2 200 cr-favicon-1.png
www.cybereason.com/hubfs/ 3 KB
3 KB 55ms
55ms Other
image/png 45.60.64.106
INCAPSULA

General

Check archive.org

Show headers Download Go to

Full URL

https://www.cybereason.com/hubfs/cr-favicon-1.png

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

45.60.64.106 , United States, ASN19551 (INCAPSULA, US),

Reverse DNS

Software

Resource Hash

33ff6b6486bdc5883c2c63e8278e8a547ca86b1f6026667f7733fec6b52a1303

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.cybereason.com/blog/cuckoo-spear-pt2-threat-actor-arsenal

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
x-iinfo: 5-10290491-0 0CNN RT(1728143204667 1748) q(0 -1 -1 -1) r(0 -1)
cache-control: max-age=803348, s-maxage=2185748, public
etag: "191c614ca975bba9737fcf4fc024f8e7"
x-cdn: Imperva
content-length: 3186
date: Sat, 05 Oct 2024 15:46:46 GMT
last-modified: Fri, 10 Dec 2021 18:39:27 GMT
content-type: image/png

GET
H2 200 json Show response
forms.hubspot.com/lead-flows-config/v1/config/ 178 B
910 B 187ms
177ms XHR
application/json 2606:4700::6810:7674
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://forms.hubspot.com/lead-flows-config/v1/config/json?portalId=3354902&utk=d60ee04feffed21d44dc7f8f0aa53c91&__hstc=85683782.d60ee04feffed21d44dc7f8f0aa53c91.1728143206737.1728143206737.1728143206737.1&__hssc=85683782.1.1728143206737&contentId=178628451426&currentUrl=https%3A%2F%2Fwww.cybereason.com%2Fblog%2Fcuckoo-spear-pt2-threat-actor-arsenal

Requested by

Host: js.hsleadflows.net
URL: https://js.hsleadflows.net/leadflows.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7674 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2ea67d47ba2486d31cf12a043b8d710b694ae26f952431e684c166810c09699e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.cybereason.com/blog/cuckoo-spear-pt2-threat-actor-arsenal

Response headers

x-robots-tag: none
access-control-max-age: 180
x-request-id: f97e246a-3780-4910-a48a-60f7fe8425e2
content-encoding: br
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2B%2Fs%2FwrxYvkDu19Dmh5eXb%2BADK1jRwCSA%2BxpwIQLPxdEi1TwW4VLzcZb3ou%2FQlENu3SaMh5hOZl7EDIV2EJjYOw%2Fjqmuf2E7ad76Suhn%2FduawySnEFguEOQTfZ4RNDmZDGrtmc1B96fwPLxTBxSgF"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
access-control-allow-methods: GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD
x-evy-trace-listener: listener_https
date: Sat, 05 Oct 2024 15:46:46 GMT
x-hubspot-correlation-id: f97e246a-3780-4910-a48a-60f7fe8425e2
content-type: application/json;charset=utf-8
vary: origin
access-control-allow-headers: Accept, Accept-Charset, Accept-Encoding, Accept-Language, Content-Type, Host, Origin, Referer, User-Agent
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-evy-trace-route-service-name: envoyset-translator
cache-control: max-age=0, no-cache, no-store
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-evy-trace-served-by-pod: iad02/star-hubspot-td/envoy-proxy-5485db5487-bvdgh
x-envoy-upstream-service-time: 43
access-control-allow-credentials: false
cf-ray: 8cde8be2884e63f1-LHR
access-control-allow-origin: https://www.cybereason.com
x-evy-trace-route-configuration: listener_https/all
server: cloudflare
x-evy-trace-virtual-host: all

GET
H2 200 location Show response
geolocation.onetrust.com/cookieconsentpub/v1/geo/ 69 B
305 B 118ms
51ms XHR
application/json 2606:4700:4400::ac40:9b77
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://geolocation.onetrust.com/cookieconsentpub/v1/geo/location

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::ac40:9b77 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

26e34b9fbbd2ecafe25af980f19ddc63342ffad01477b0fe851ac8c35bfea847

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
accept: application/json
Referer: https://www.cybereason.com/blog/cuckoo-spear-pt2-threat-actor-arsenal

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
access-control-allow-methods: GET, OPTIONS
cf-ray: 8cde8be33883407e-LHR
access-control-allow-origin: *
date: Sat, 05 Oct 2024 15:46:46 GMT
content-type: application/json
vary: Accept-Encoding
server: cloudflare
access-control-allow-headers: Content-Type

GET
H2 200 otBannerSdk.js Show response
cdn.cookielaw.org/scripttemplates/6.38.0/ 369 KB
88 KB 46ms
45ms Script
application/javascript 2606:4700::6812:562a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/6.38.0/otBannerSdk.js

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:562a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

42b2b9d16fbf8d3c6be72420699360790966e58fe30d8794fd90a71c8aef122d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.cybereason.com/blog/cuckoo-spear-pt2-threat-actor-arsenal

Response headers

content-md5: jz950M8ZW7RakPP2zlLHZQ==
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
content-encoding: gzip
x-ms-version: 2009-09-19
etag: 0x8DA6AE29E465D1D
x-ms-lease-status: unlocked
cf-cache-status: HIT
age: 40906
x-content-type-options: nosniff
date: Sat, 05 Oct 2024 15:46:46 GMT
content-type: application/javascript
last-modified: Thu, 21 Jul 2022 06:31:17 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: max-age=86400
cross-origin-resource-policy: cross-origin
x-ms-request-id: 2a624a05-701e-001a-6a08-7c585c000000
cf-ray: 8cde8be38ae39484-LHR
accept-ranges: bytes
access-control-allow-origin: *
content-length: 89624
x-ms-blob-type: BlockBlob
server: cloudflare

GET
H2 200 en.json Show response
cdn.cookielaw.org/consent/26b02624-42c7-456d-82c2-9669db762671/018fde6f-69f2-7da5-b5d1-0530c6ea4dc2/ 149 KB
25 KB 54ms
54ms Fetch
application/json 2606:4700::6812:562a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/consent/26b02624-42c7-456d-82c2-9669db762671/018fde6f-69f2-7da5-b5d1-0530c6ea4dc2/en.json

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/6.38.0/otBannerSdk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:562a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

594b91ae8f514c76d055bc50825da7f35b28fe6e7b65ee51594b1b3e549c89ca

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.cybereason.com/blog/cuckoo-spear-pt2-threat-actor-arsenal

Response headers

content-md5: Y7HPiZK2Mz0F2NkzeKS1XA==
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
content-encoding: gzip
cf-cache-status: HIT
etag: 0x8DC83D77D75FE64
age: 17563
x-ms-lease-status: unlocked
x-content-type-options: nosniff
x-ms-version: 2009-09-19
expires: Sun, 06 Oct 2024 15:46:47 GMT
date: Sat, 05 Oct 2024 15:46:47 GMT
content-type: application/json
last-modified: Mon, 03 Jun 2024 14:14:32 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin, cross-origin
x-ms-request-id: c948b691-201e-0053-59c0-b55d66000000
cf-ray: 8cde8be41b1388c2-LHR
accept-ranges: bytes
access-control-allow-origin: *
content-length: 25735
x-ms-blob-type: BlockBlob
server: cloudflare

GET
H2 200 otFlat.json Show response
cdn.cookielaw.org/scripttemplates/6.38.0/assets/ 13 KB
3 KB 48ms
47ms Fetch
application/json 2606:4700::6812:562a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/6.38.0/assets/otFlat.json

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/6.38.0/otBannerSdk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:562a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

14e4d1596c6b58896dfce1fc1ec45372bab4d2259ba82828fa3f96cc4f859fc4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.cybereason.com/blog/cuckoo-spear-pt2-threat-actor-arsenal

Response headers

content-md5: l8TaFfqEBdbGRIscoE5PLQ==
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
content-encoding: gzip
x-ms-version: 2009-09-19
etag: 0x8DA6AE29925C8FF
x-ms-lease-status: unlocked
cf-cache-status: HIT
age: 85318
x-content-type-options: nosniff
date: Sat, 05 Oct 2024 15:46:47 GMT
content-type: application/json
last-modified: Thu, 21 Jul 2022 06:31:09 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: max-age=86400
cross-origin-resource-policy: cross-origin
x-ms-request-id: 1af94859-c01e-00b0-5a5f-0f6a0a000000
cf-ray: 8cde8be48b8b88c2-LHR
accept-ranges: bytes
access-control-allow-origin: *
content-length: 3007
x-ms-blob-type: BlockBlob
server: cloudflare

GET
H2 200 otPcCenter.json Show response
cdn.cookielaw.org/scripttemplates/6.38.0/assets/v2/ 62 KB
13 KB 49ms
48ms Fetch
application/json 2606:4700::6812:562a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/6.38.0/assets/v2/otPcCenter.json

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/6.38.0/otBannerSdk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:562a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c0c36470d3b6f534495768bdd7ed92dbb0d6d8d1f3b7b69adba7153b68b90f35

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.cybereason.com/blog/cuckoo-spear-pt2-threat-actor-arsenal

Response headers

content-md5: JtD7zjxzBe/apQLaCwCdaw==
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
content-encoding: gzip
x-ms-version: 2009-09-19
etag: 0x8DA6AE29A87E4A6
x-ms-lease-status: unlocked
cf-cache-status: HIT
age: 22298
x-content-type-options: nosniff
date: Sat, 05 Oct 2024 15:46:47 GMT
content-type: application/json
last-modified: Thu, 21 Jul 2022 06:31:11 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: max-age=86400
cross-origin-resource-policy: cross-origin
x-ms-request-id: b9745df0-c01e-0077-346d-cd16cb000000
cf-ray: 8cde8be48b8e88c2-LHR
accept-ranges: bytes
access-control-allow-origin: *
content-length: 13258
x-ms-blob-type: BlockBlob
server: cloudflare

GET
H2 200 otCookieSettingsButton.json Show response
cdn.cookielaw.org/scripttemplates/6.38.0/assets/ 5 KB
2 KB 64ms
64ms Fetch
application/json 2606:4700::6812:562a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/6.38.0/assets/otCookieSettingsButton.json

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/6.38.0/otBannerSdk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:562a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a09d0f89e99cf5a081315ff701187632005dabd23f3ca116a75790003faa7e8f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.cybereason.com/blog/cuckoo-spear-pt2-threat-actor-arsenal

Response headers

content-md5: keZk8SpZZgHvyFwdMFhvhQ==
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
content-encoding: gzip
x-ms-version: 2009-09-19
etag: 0x8DA6AE29A3CDCC9
x-ms-lease-status: unlocked
cf-cache-status: HIT
age: 27518
x-content-type-options: nosniff
date: Sat, 05 Oct 2024 15:46:47 GMT
content-type: application/json
last-modified: Thu, 21 Jul 2022 06:31:10 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: max-age=86400
cross-origin-resource-policy: cross-origin
x-ms-request-id: 6737bcb4-201e-001c-0647-ac997e000000
cf-ray: 8cde8be48b8f88c2-LHR
accept-ranges: bytes
access-control-allow-origin: *
content-length: 1767
x-ms-blob-type: BlockBlob
server: cloudflare

GET
H2 200 otCommonStyles.css Show response
cdn.cookielaw.org/scripttemplates/6.38.0/assets/ 22 KB
5 KB 49ms
49ms Fetch
text/css 2606:4700::6812:562a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/6.38.0/assets/otCommonStyles.css

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/6.38.0/otBannerSdk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:562a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

17770d05051a8a4f270ba5bdf049b90cc166ac42bd4513f419308a5804d7a161

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.cybereason.com/blog/cuckoo-spear-pt2-threat-actor-arsenal

Response headers

content-md5: TLLtdkuMahUQRVIfmZNHNw==
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
x-ms-version: 2009-09-19
x-ms-lease-status: unlocked
cf-cache-status: HIT
age: 24938
content-encoding: gzip
x-content-type-options: nosniff
date: Sat, 05 Oct 2024 15:46:47 GMT
content-type: text/css
last-modified: Thu, 21 Jul 2022 06:31:23 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: max-age=86400
cross-origin-resource-policy: cross-origin
x-ms-request-id: f9d88031-001e-0000-3e08-7c3983000000
cf-ray: 8cde8be48b9088c2-LHR
access-control-allow-origin: *
x-ms-blob-type: BlockBlob
server: cloudflare

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 362 KB
113 KB 81ms
79ms Script
application/javascript 2a00:1450:4001:81c::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-PZ3FE06790&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TJVVB7C

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

512a1cee111dc4ffd6894ffdc978346708aaae7aa654981d93dbc5cddfcd60a4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.cybereason.com/blog/cuckoo-spear-pt2-threat-actor-arsenal

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],}
expires: Sat, 05 Oct 2024 15:46:47 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 05 Oct 2024 15:46:47 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 115056
x-xss-protection: 0
server: Google Tag Manager

GET
H2 200 destination Show response
www.googletagmanager.com/gtag/ 248 KB
88 KB 130ms
129ms Script
application/javascript 2a00:1450:4001:81c::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/destination?id=AW-934771702&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TJVVB7C

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

4da5f291444be7904d482692a15149cffbeeb170eef7103e5d9c7d45918586eb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.cybereason.com/blog/cuckoo-spear-pt2-threat-actor-arsenal

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcysghrgc:42:0"}],}
expires: Sat, 05 Oct 2024 15:46:47 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 05 Oct 2024 15:46:47 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Sat, 05 Oct 2024 15:00:00 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcysghrgc:42:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 89669
x-xss-protection: 0
server: Google Tag Manager

GET
H2 200 destination Show response
www.googletagmanager.com/gtag/ 245 KB
87 KB 62ms
61ms Script
application/javascript 2a00:1450:4001:81c::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/destination?id=AW-401574334&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TJVVB7C

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

4818b055ad8fa3c21287632e967a1a62be06b93cd1e9b372fdfc33c11477ef26

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.cybereason.com/blog/cuckoo-spear-pt2-threat-actor-arsenal

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcysghrgc:42:0"}],}
expires: Sat, 05 Oct 2024 15:46:47 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 05 Oct 2024 15:46:47 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Sat, 05 Oct 2024 15:00:00 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcysghrgc:42:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 89107
x-xss-protection: 0
server: Google Tag Manager

GET
H2 200 destination Show response
www.googletagmanager.com/gtag/ 221 KB
79 KB 73ms
73ms Script
application/javascript 2a00:1450:4001:81c::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/destination?id=DC-10428681&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TJVVB7C

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

1c2a954cb77231d3d9a46cf23119222b85c72b17a0cc4cac72b9eec7a03e6641

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.cybereason.com/blog/cuckoo-spear-pt2-threat-actor-arsenal

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcysghrgc:42:0"}],}
expires: Sat, 05 Oct 2024 15:46:47 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 05 Oct 2024 15:46:47 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Sat, 05 Oct 2024 15:00:00 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcysghrgc:42:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 80721
x-xss-protection: 0
server: Google Tag Manager

GET
H2 200 insight.min.js Show response
snap.licdn.com/li.lms-analytics/ 40 KB
14 KB 142ms
47ms Script
application/javascript 2a02:26f0:3500:10::210:a9a
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://snap.licdn.com/li.lms-analytics/insight.min.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TJVVB7C

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:3500:10::210:a9a Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Resource Hash

8a27dc7b44ebe886390bfa0a9beeea36ea5a3f37479f0e0836b6c9b80d9b35ed

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.cybereason.com/blog/cuckoo-spear-pt2-threat-actor-arsenal

Response headers

cache-control: max-age=71902
content-encoding: gzip
x-cdn: AKAM
x-content-type-options: nosniff
accept-ranges: bytes
content-length: 14628
date: Sat, 05 Oct 2024 15:46:47 GMT
last-modified: Thu, 22 Aug 2024 10:43:55 GMT
content-type: application/javascript;charset=utf-8
vary: Accept-Encoding
x-amz-server-side-encryption: AES256

GET
H2 200 uwt.js Show response
static.ads-twitter.com/ 56 KB
15 KB 170ms
53ms Script
application/javascript 146.75.52.157
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://static.ads-twitter.com/uwt.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TJVVB7C
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 146.75.52.157 Milan, Italy, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 4d15ff2317e16ccd8ca1d3248fea7d91130e022369bb032824a84ad9967064df

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.cybereason.com/blog/cuckoo-spear-pt2-threat-actor-arsenal

Response headers

vary: Accept-Encoding,Host
cache-control: no-cache
content-encoding: gzip
etag: "bbbcf811d8437a575d796a4c1e5d4fad+gzip+gzip"
accept-ranges: bytes
x-cache: HIT, HIT
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
content-length: 15412
date: Sat, 05 Oct 2024 15:46:47 GMT
x-tw-cdn: FT
last-modified: Fri, 22 Mar 2024 21:07:24 GMT
content-type: application/javascript; charset=utf-8
x-served-by: cache-iad-kiad7000168-IAD, cache-lin1730048-LIN
x-amz-server-side-encryption: AES256

GET
H2 200 tracking.js Show response
trk.techtarget.com/ 3 KB
2 KB 204ms
110ms Script
text/javascript 2606:4700::6812:1347
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://trk.techtarget.com/tracking.js

Requested by

Host: www.cybereason.com
URL: https://www.cybereason.com/blog/cuckoo-spear-pt2-threat-actor-arsenal

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:1347 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0c07b854855b0e2bd7839c3659defa45307e96e281b3c00571d09f213eb6a76e

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.cybereason.com/blog/cuckoo-spear-pt2-threat-actor-arsenal

Response headers

strict-transport-security: max-age=0; includeSubDomains; preload
cache-control: public, max-age=1200
content-encoding: br
cf-bgj: minify
cf-cache-status: HIT
age: 86059
via: 1.1 google
cf-ray: 8cde8be53dec9488-LHR
expires: Sat, 05 Oct 2024 16:06:47 GMT
date: Sat, 05 Oct 2024 15:46:47 GMT
content-type: text/javascript
last-modified: Tue, 13 Dec 2022 15:01:39 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 zdcd6x8yhg85.js Show response
js.driftt.com/include/1728143400000/ 221 KB
62 KB 379ms
266ms Script
application/javascript 18.245.86.87
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/include/1728143400000/zdcd6x8yhg85.js

Requested by

Host: www.cybereason.com
URL: https://www.cybereason.com/blog/cuckoo-spear-pt2-threat-actor-arsenal

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.245.86.87 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-245-86-87.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

8ae2c031d4437921725504cc0dde011afa318561961ad23d28d64bc61de45341

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.cybereason.com/blog/cuckoo-spear-pt2-threat-actor-arsenal

Response headers

content-encoding: gzip
x-amz-version-id: tUmK.kR2Jowc3KVwRScW12F642xwrRdS
etag: W/"4a6f52850f5fd988a7cfd6d88229e754"
access-control-allow-methods: GET, POST, OPTIONS
x-cache: Miss from cloudfront
x-amz-cf-id: I-LiY7oKCaGyJyWvNrOgPTf_HpXd9aevyFMP92Kit42x26wjuEMqhw==
date: Sat, 05 Oct 2024 15:46:47 GMT
content-type: application/javascript; charset=utf-8
vary: Accept-Encoding
last-modified: Thu, 03 Oct 2024 17:04:14 GMT
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: no-cache
x-envoy-upstream-service-time: 31
access-control-allow-credentials: true
via: 1.1 57bc54093a2e2c99ca194f2955ba3d1c.cloudfront.net (CloudFront)
access-control-allow-origin: *
x-amz-cf-pop: FRA60-P6
server: istio-envoy
x-amz-server-side-encryption: AES256

GET
H2 200 E-v1.js Show response
fast.wistia.com/assets/external/ 835 KB
142 KB 558ms
156ms Script
text/javascript 2a04:4e42:600::644
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://fast.wistia.com/assets/external/E-v1.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TJVVB7C

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:4e42:600::644 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

9678aa8bcf6755f11c34fa207e763cbfcc33a5756bea8cb706f1bd1af567b0a3

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.cybereason.com/blog/cuckoo-spear-pt2-threat-actor-arsenal

Response headers

content-encoding: br
etag: "9851ce3b25300e9a73e499fc8b4fca2e"
age: 1354
x-cache: HIT, HIT
date: Sat, 05 Oct 2024 15:46:47 GMT
last-modified: Fri, 04 Oct 2024 18:23:28 GMT
x-served-by: cache-iad-kjyo7100042-IAD, cache-man4124-MAN
x-cache-hits: 28, 35
content-type: text/javascript
vary: Accept-Encoding
strict-transport-security: max-age=0
cache-control: public, max-age=3600
timing-allow-origin: *
x-timer: S1728143208.537472,VS0,VE0
via: 1.1 varnish, 1.1 varnish
x-browser: chrome
x-ecma-v: modern
x-browser-version: 129
accept-ranges: bytes
access-control-allow-origin: *
content-length: 145406
asset-version: 36e4d5cd06eece0b177d670bf3cfba855f61e261
server: AmazonS3
x-amz-server-side-encryption: AES256

GET
H2 200 6e1424cff90e9cd4.min.js Show response
tag.demandbase.com/ 61 KB
18 KB 560ms
450ms Script
application/javascript 18.245.46.22
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://tag.demandbase.com/6e1424cff90e9cd4.min.js

Requested by

Host: www.cybereason.com
URL: https://www.cybereason.com/blog/cuckoo-spear-pt2-threat-actor-arsenal

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.245.46.22 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-245-46-22.fra56.r.cloudfront.net

Software

AmazonS3 /

Resource Hash

c7487308ed9b62d88a038230040fc84aa6d4e9de5848e226b8a98c21306551fe

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.cybereason.com/blog/cuckoo-spear-pt2-threat-actor-arsenal

Response headers

content-encoding: gzip
x-amz-version-id: XZaFCULLkSy4COeiBOiEOmztVeX8EW96
etag: W/"e34d32211027a62e0e0d97ecc6fa86e2"
x-cache: RefreshHit from cloudfront
x-amz-cf-id: bL9xz09-xvPjDDyFBLERVw1DC1atCC5iKRxIC9BRVgiEOk2HnzPB5Q==
date: Sat, 05 Oct 2024 15:46:48 GMT
content-type: application/javascript; charset=utf-8
vary: Accept-Encoding
last-modified: Fri, 04 Oct 2024 15:07:50 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
cache-control: public, max-age=3600
via: 1.1 ae80ccab7109b5d2f1c1ee784af203a6.cloudfront.net (CloudFront)
permissions-policy: accelerometer=(), camera=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), payment=(), usb=(), interest-cohort=()
x-amz-cf-pop: FRA56-P9
server: AmazonS3
x-amz-server-side-encryption: AES256

GET
H/1.1 200
OK up_loader.1.1.0.js Show response
js.adsrvr.org/ 49 KB
12 KB 163ms
51ms Script
application/x-javascript 18.172.103.101
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://js.adsrvr.org/up_loader.1.1.0.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TJVVB7C
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 18.172.103.101 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-172-103-101.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 8b9d0d77fab58e1e1ec4fd77f06ecebedf37e54ad7b3a3f0d6641de0204fcaa9

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.cybereason.com/blog/cuckoo-spear-pt2-threat-actor-arsenal

Response headers

Transfer-Encoding: chunked
Vary: Accept-Encoding
Content-Encoding: gzip
ETag: W/"6456d197d494e7ee00da27310d2f1993"
Age: 35897
Connection: keep-alive
Via: 1.1 db38c5279288cd1c6aea4fa2c0409120.cloudfront.net (CloudFront)
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: Z__RetPBJ0DrgsnmQkI3MecwljfMSzSghxbyZK7t8AezVV3FLKYfVA==
Date: Sat, 05 Oct 2024 05:48:31 GMT
Content-Type: application/x-javascript
Last-Modified: Thu, 03 Oct 2024 02:53:02 GMT
Server: AmazonS3
X-Amz-Cf-Pop: FRA60-P8
x-amz-server-side-encryption: AES256

GET
H2 200 hotjar-704918.js Show response
static.hotjar.com/c/ 13 KB
6 KB 209ms
89ms Script
application/javascript 18.66.192.39
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://static.hotjar.com/c/hotjar-704918.js?sv=6

Requested by

Host: www.cybereason.com
URL: https://www.cybereason.com/blog/cuckoo-spear-pt2-threat-actor-arsenal

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.66.192.39 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-66-192-39.muc50.r.cloudfront.net

Software

Resource Hash

64567dded855d508db3d27ca19fb1e2e55412e9922a1dd7ac593830eda89c7a0

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.cybereason.com/blog/cuckoo-spear-pt2-threat-actor-arsenal

Response headers

strict-transport-security: max-age=2592000; includeSubDomains
cache-control: max-age=60
content-encoding: br
etag: W/bc22e744ae4017de647cac9d3965c257
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
x-cache-hit: 1
via: 1.1 ec12d3de4ccd821a7e749609dcc62010.cloudfront.net (CloudFront)
access-control-allow-origin: *
x-cache: Miss from cloudfront
x-amz-cf-id: 6GEjQrXczcDHGXeXBkCd7k5uy_t7EtQfbOw3nquL2XvEX4PD_VkH1A==
date: Sat, 05 Oct 2024 15:46:47 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
x-amz-cf-pop: MUC50-P1

GET
H/1.1 200
OK tcs.dhj Show response
analytics.o11.tech/1/e/ 2 KB
2 KB 234ms
54ms Script
application/javascript 95.101.111.153
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://analytics.o11.tech/1/e/tcs.dhj?pubid=790a6047c49abfbb31072012ce13ae60&evid=89ef6faa-3a52-4102-b7c8-390925a30ff1&dmn=www.cybereason.com

Requested by

Host: www.cybereason.com
URL: https://www.cybereason.com/blog/cuckoo-spear-pt2-threat-actor-arsenal

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

95.101.111.153 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a95-101-111-153.deploy.static.akamaitechnologies.com

Software

Resource Hash

08190a325d7e937d066f7ff1adfc9d3a1debfc7efe6316006191ab6230a5c988

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.cybereason.com/blog/cuckoo-spear-pt2-threat-actor-arsenal

Response headers

X-Robots-Tag: noindex, nofollow
Cache-Control: private, max-age=3600
Content-Encoding: gzip
Connection: keep-alive
X-Content-Type-Options: nosniff
Expires: Sat, 05 Oct 2024 16:46:47 GMT
Content-Length: 1460
Date: Sat, 05 Oct 2024 15:46:47 GMT
Content-Type: application/javascript
Vary: Accept-Encoding

GET
H3 200 zi-tag.js Show response
js.zi-scripts.com/ 9 KB
3 KB 385ms
290ms Script
application/javascript 172.64.150.44
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js.zi-scripts.com/zi-tag.js
Requested by: Host: www.cybereason.com
URL: https://www.cybereason.com/blog/cuckoo-spear-pt2-threat-actor-arsenal
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.64.150.44 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e779904e434d50e426e79dfac680cdb8a04564e67121c257974278a02979e407

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.cybereason.com/blog/cuckoo-spear-pt2-threat-actor-arsenal

Response headers

server: cloudflare
content-encoding: gzip
cf-cache-status: DYNAMIC
x-amz-version-id: PTl7rnF_EEhUwyN5J882FhdYw1E0brGf
etag: W/"b2877da906a3216c4f3fc4030b205e54"
age: 51678
via: 1.1 0932b0f7b83052f195bba4d87316beaa.cloudfront.net (CloudFront)
cf-ray: 8cde8be6ad508926-LHR
x-cache: Hit from cloudfront
x-amz-cf-id: XHdz6TVOKl618J0FxcMaxaXkz0AvQNFD2agEQusSjgCcWvZhixAGeQ==
date: Sat, 05 Oct 2024 15:46:47 GMT
content-type: application/javascript
last-modified: Thu, 18 Jul 2024 08:13:46 GMT
vary: Accept-Encoding
x-amz-cf-pop: LHR62-C2

GET
DATA 200
OK truncated
/ 817 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: db311174b0e3c340727b63c055cfb5b317808e909503e1bda11cc58af444f12b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/svg+xml

GET
H2 200 powered_by_logo.svg
cdn.cookielaw.org/logos/static/ 5 KB
2 KB 48ms
47ms Image
image/svg+xml 2606:4700::6812:562a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cdn.cookielaw.org/logos/static/powered_by_logo.svg

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:562a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5fa00d047acd959697b9d7772c31dcd37bec33c70c6fbf80ab8316205d1d286d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.cybereason.com/blog/cuckoo-spear-pt2-threat-actor-arsenal

Response headers

content-md5: Y+c301RBZNK39PvKQWrIBw==
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
x-ms-version: 2009-09-19
x-ms-lease-status: unlocked
cf-cache-status: HIT
age: 70879
content-encoding: gzip
x-content-type-options: nosniff
date: Sat, 05 Oct 2024 15:46:47 GMT
content-type: image/svg+xml
last-modified: Thu, 03 Oct 2024 19:22:48 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: max-age=86400
cross-origin-resource-policy: cross-origin
x-ms-request-id: b155f26a-401e-0083-64cf-153327000000
cf-ray: 8cde8be51d2a9484-LHR
access-control-allow-origin: *
x-ms-blob-type: BlockBlob
server: cloudflare

POST
H2 204 / Show response
px.ads.linkedin.com/wa/ 0
626 B 323ms
249ms XHR
text/plain 2620:1ec:21::14
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://px.ads.linkedin.com/wa/
Requested by: Host: snap.licdn.com
URL: https://snap.licdn.com/li.lms-analytics/insight.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:21::14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.cybereason.com/blog/cuckoo-spear-pt2-threat-actor-arsenal
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Accept: *
Content-Type: text/plain;charset=UTF-8

Response headers

linkedin-action: 1
x-li-pop: afd-prod-lor1-x
x-msedge-ref: Ref A: CD774ABCF5E24C61953F521C26D85526 Ref B: LON04EDGE1119 Ref C: 2024-10-05T15:46:47Z
x-li-fabric: prod-lor1
access-control-allow-credentials: true
x-li-uuid: AAYjvLIADMV9WjrOlMEJ6g==
x-li-proto: http/2
access-control-allow-origin: https://www.cybereason.com
x-cache: CONFIG_NOCACHE
date: Sat, 05 Oct 2024 15:46:46 GMT
vary: Origin

GET
H2 200 attribution_trigger Show response
px.ads.linkedin.com/ 2 B
815 B 360ms
172ms XHR
application/json 2620:1ec:21::14
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://px.ads.linkedin.com/attribution_trigger?pid=3885972%2C4030924%2C72596&time=1728143207277&url=https%3A%2F%2Fwww.cybereason.com%2Fblog%2Fcuckoo-spear-pt2-threat-actor-arsenal&tm=gtmv2
Requested by: Host: snap.licdn.com
URL: https://snap.licdn.com/li.lms-analytics/insight.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:21::14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Accept: *
Referer: https://www.cybereason.com/blog/cuckoo-spear-pt2-threat-actor-arsenal

Response headers

x-li-pop: afd-prod-lva1-x
content-encoding: gzip
x-fs-uuid: 000623bcb2020ef1665568b74dc8f777
x-msedge-ref: Ref A: A2F990D096164D77B1146EA5E0A13B4C Ref B: LON04EDGE0721 Ref C: 2024-10-05T15:46:47Z
x-li-fabric: prod-lva1
x-restli-protocol-version: 1.0.0
access-control-allow-methods: GET, OPTIONS
x-li-uuid: AAYjvLICDvFmVWi3Tcj3dw==
x-li-proto: http/2
access-control-allow-origin: *
x-cache: CONFIG_NOCACHE
date: Sat, 05 Oct 2024 15:46:46 GMT
content-type: application/json
access-control-allow-headers: *

GET
H2

200

collect
px4.ads.linkedin.com/
Redirect Chain

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=3885972%2C4030924%2C72596&time=1728143207277&url=https%3A%2F%2Fwww.cybereason.com%2Fblog%2Fcuckoo-spear-pt2-threat-actor-arsenal&tm=gtmv2
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=3885972%2C4030924%2C72596&time=1728143207277&url=https%3A%2F%2Fwww.cybereason.com%2Fblog%2Fcuckoo-spear-pt2-threat-actor-arsenal&tm=gtmv2&e_ipv6=...

0
265 B

229ms
163ms

Image
application/javascript

13.107.42.14
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=3885972%2C4030924%2C72596&time=1728143207277&url=https%3A%2F%2Fwww.cybereason.com%2Fblog%2Fcuckoo-spear-pt2-threat-actor-arsenal&tm=gtmv2&e_ipv6=AQJu7j2kFikcegAAAZJdXKwIFYhb6XQVkMLxc1xON1YxCS3KFz59NsZzLPbXkFmQ9WCs
Protocol: H2
Server: 13.107.42.14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.cybereason.com/blog/cuckoo-spear-pt2-threat-actor-arsenal

Response headers

linkedin-action: 1
x-li-pop: afd-prod-ltx1-x
x-msedge-ref: Ref A: D0C7057AEB45439BBDF3218186C1750A Ref B: LTSEDGE1217 Ref C: 2024-10-05T15:46:47Z
x-li-fabric: prod-ltx1
x-li-uuid: AAYjvLIDf2FzP4ZaD9n6fw==
x-li-proto: http/2
x-cache: CONFIG_NOCACHE
content-length: 0
date: Sat, 05 Oct 2024 15:46:47 GMT
content-type: application/javascript

Redirect headers

linkedin-action: 1
x-li-pop: afd-prod-ltx1-x
nel: {"report_to":"network-errors","max_age":1296000,"success_fraction":0.00066,"failure_fraction":1,"include_subdomains":true}
location: https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=3885972%2C4030924%2C72596&time=1728143207277&url=https%3A%2F%2Fwww.cybereason.com%2Fblog%2Fcuckoo-spear-pt2-threat-actor-arsenal&tm=gtmv2&e_ipv6=AQJu7j2kFikcegAAAZJdXKwIFYhb6XQVkMLxc1xON1YxCS3KFz59NsZzLPbXkFmQ9WCs
x-msedge-ref: Ref A: E4865320293843B097B131A9D3BE51DD Ref B: LON04EDGE1119 Ref C: 2024-10-05T15:46:47Z
x-li-fabric: prod-ltx1
report-to: {"group":"network-errors","max_age":2592000,"endpoints":[{"url":"https://www.linkedin.com/li/rep"}],"include_subdomains":true}
x-li-uuid: AAYjvLH/6BEVnw1+U3Ngfg==
x-li-proto: http/2
x-cache: CONFIG_NOCACHE
content-length: 0
date: Sat, 05 Oct 2024 15:46:46 GMT

GET
H2 200 adsct
t.co/1/i/ 43 B
629 B 566ms
229ms Image
image/gif 162.159.140.229
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://t.co/1/i/adsct?bci=4&eci=3&event=%7B%7D&event_id=071b5c39-8e98-4cb0-81e2-44b9c42c56e9&integration=gtm&p_id=Twitter&p_user_id=0&pl_id=aaff21ca-7510-4d27-bad8-4530001ad4a2&tw_document_href=https%3A%2F%2Fwww.cybereason.com%2Fblog%2Fcuckoo-spear-pt2-threat-actor-arsenal&tw_iframe_status=0&txn_id=o9na6&type=javascript&version=2.3.30

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.159.140.229 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare tsa_f /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.cybereason.com/blog/cuckoo-spear-pt2-threat-actor-arsenal

Response headers

strict-transport-security: max-age=0
x-transaction-id: 324358d4f7bb33b0
cache-control: no-cache, no-store, max-age=0
x-connection-hash: e5ac6e3579f131d4197b7fcd1da46389050de458395cc0b95fea9ab2eebcd52e
cf-cache-status: DYNAMIC
cf-ray: 8cde8be7e90b7738-LHR
x-response-time: 180
content-length: 43
date: Sat, 05 Oct 2024 15:46:47 GMT
content-type: image/gif;charset=utf-8
perf: 7402827104
server: cloudflare tsa_f

GET
H2 200 adsct
analytics.twitter.com/1/i/ 43 B
724 B 370ms
249ms Image
image/gif 104.244.42.67
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://analytics.twitter.com/1/i/adsct?bci=4&eci=3&event=%7B%7D&event_id=071b5c39-8e98-4cb0-81e2-44b9c42c56e9&integration=gtm&p_id=Twitter&p_user_id=0&pl_id=aaff21ca-7510-4d27-bad8-4530001ad4a2&tw_document_href=https%3A%2F%2Fwww.cybereason.com%2Fblog%2Fcuckoo-spear-pt2-threat-actor-arsenal&tw_iframe_status=0&txn_id=o9na6&type=javascript&version=2.3.30

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.244.42.67 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_f /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.cybereason.com/blog/cuckoo-spear-pt2-threat-actor-arsenal

Response headers

strict-transport-security: max-age=631138519
x-transaction-id: 97a0f9bbc16b6f23
cache-control: no-cache, no-store, max-age=0
x-connection-hash: d1cc9e7a34135a9b07db422fd246dd578de032c3ef0a8eb1d2823c27c8856925
x-response-time: 192
content-length: 43
date: Sat, 05 Oct 2024 15:46:47 GMT
perf: 7402827104
content-type: image/gif;charset=utf-8
server: tsa_f

GET
H2 200 gif.gif Show response
ibc-flow.techtarget.com/a/ 43 B
441 B 141ms
141ms XHR
image/gif 34.111.208.231
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://ibc-flow.techtarget.com/a/gif.gif?actTypeId=31&cid=16570449&r=1728143207333&ref=https%3A%2F%2Fwww.cybereason.com%2Fblog%2Fcuckoo-spear-pt2-threat-actor-arsenal&version=2.4
Requested by: Host: trk.techtarget.com
URL: https://trk.techtarget.com/tracking.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.111.208.231 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 231.208.111.34.bc.googleusercontent.com
Software: nginx/1.20.2 /
Resource Hash: 2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
ibc_rate_tier: 16570449
Referer: https://www.cybereason.com/blog/cuckoo-spear-pt2-threat-actor-arsenal

Response headers

x-goog-metageneration: 1
x-goog-hash: crc32c=7uenZA==, md5=/JT7DD7YqPkJ28djCgmH/w==
etag: "fc94fb0c3ed8a8f909dbc7630a0987ff"
access-control-allow-methods: GET, POST, OPTIONS
x-goog-stored-content-encoding: identity
expires: Sat, 05 Oct 2024 16:46:47 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-goog-stored-content-length: 43
date: Sat, 05 Oct 2024 15:46:47 GMT
content-type: image/gif
last-modified: Thu, 08 Dec 2022 21:19:29 GMT
vary: Origin
x-guploader-uploadid: AD-8ljsr_OVpIhFziMZVX5a5a-gRr_Dv_IyF3m4uMrumEQO9b69-UJCEu-lQUcUEtIBezfy3kmo
access-control-allow-headers: ibc_header,ibc_rate_tier,User-Agent,X-Requested-With,Cache-Control,Content-Type,Range
cache-control: public, max-age=3600
x-goog-storage-class: STANDARD
via: 1.1 google
accept-ranges: bytes
access-control-allow-origin: *
x-goog-generation: 1670534369365034
content-length: 43
server: nginx/1.20.2

OPTIONS
H2 200 gif.gif
ibc-flow.techtarget.com/a/ Frame 0
0 199ms
119ms Preflight
text/html 34.111.208.231
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://ibc-flow.techtarget.com/a/gif.gif?actTypeId=31&cid=16570449&r=1728143207333&ref=https%3A%2F%2Fwww.cybereason.com%2Fblog%2Fcuckoo-spear-pt2-threat-actor-arsenal&version=2.4
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.111.208.231 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 231.208.111.34.bc.googleusercontent.com
Software: nginx/1.20.2 /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: ibc_rate_tier
Access-Control-Request-Method: GET
Origin: https://www.cybereason.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

access-control-allow-headers: ibc_header,ibc_rate_tier,User-Agent,X-Requested-With,Cache-Control,Content-Type,Range
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=0
content-length: 0
content-type: text/html; charset=UTF-8
date: Sat, 05 Oct 2024 15:46:47 GMT
expires: Sat, 05 Oct 2024 15:46:47 GMT
server: nginx/1.20.2
vary: Origin
via: 1.1 google
x-guploader-uploadid: AD-8ljuQLL6ycF5UKVBbTbUMOe65XPlUY3X1thtsy-0r05wT0SiRbVc2uIK4p-OIU0odMQdDrdE

GET
H2 200 modules.ca70bc16369dcd35d4ef.js Show response
script.hotjar.com/ 224 KB
56 KB 144ms
50ms Script
application/javascript 13.32.27.21
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://script.hotjar.com/modules.ca70bc16369dcd35d4ef.js

Requested by

Host: static.hotjar.com
URL: https://static.hotjar.com/c/hotjar-704918.js?sv=6

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.32.27.21 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-32-27-21.fra56.r.cloudfront.net

Software

Resource Hash

1b49717ee4566c527ce824a1f6db23dc4b1ceb5d539c0a249cc16010af88c096

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.cybereason.com/blog/cuckoo-spear-pt2-threat-actor-arsenal

Response headers

x-robots-tag: none
content-encoding: br
etag: "af93a606d2b26fbc80fccfd902e26cd3"
age: 96520
x-content-type-options: nosniff
x-cache: Hit from cloudfront
x-amz-cf-id: zZrWYi0AMwt3WraT__ZYGEHYlTxIfR31VN9cRrAzDqf5gWybHWWJFg==
date: Fri, 04 Oct 2024 12:58:07 GMT
content-type: application/javascript; charset=utf-8
last-modified: Fri, 04 Oct 2024 12:57:44 GMT
vary: Accept-Encoding
strict-transport-security: max-age=2592000; includeSubDomains
cache-control: max-age=31536000
cross-origin-resource-policy: cross-origin
via: 1.1 3298c44116035984c2fac24b89183c4e.cloudfront.net (CloudFront)
accept-ranges: bytes
access-control-allow-origin: *
content-length: 56592
x-amz-cf-pop: FRA56-C2

GET
H/1.1 200
OK ts_.htm
analytics.o11.tech/a/ Frame A8CB 0
0 177ms
54ms Document
text/html 95.101.111.153
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://analytics.o11.tech/a/ts_.htm?ver=1.1550.102&cid=c076
Requested by: Host: analytics.o11.tech
URL: https://analytics.o11.tech/1/e/tcs.dhj?pubid=790a6047c49abfbb31072012ce13ae60&evid=89ef6faa-3a52-4102-b7c8-390925a30ff1&dmn=www.cybereason.com
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 95.101.111.153 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a95-101-111-153.deploy.static.akamaitechnologies.com
Software: /
Resource Hash

Request headers

Referer: https://www.cybereason.com/blog/cuckoo-spear-pt2-threat-actor-arsenal
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

Cache-Control: max-age=604800
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 1181
Content-Type: text/html
Date: Sat, 05 Oct 2024 15:46:47 GMT
Expires: Sat, 12 Oct 2024 15:46:47 GMT
X-Robots-Tag: noindex, nofollow

OPTIONS
H3 204 getSubscriptions
js.zi-scripts.com/unified/v1/master/ Frame 0
0 716ms
190ms Preflight 172.64.150.44
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js.zi-scripts.com/unified/v1/master/getSubscriptions
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.64.150.44 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: authorization,content-type,visited_url
Access-Control-Request-Method: GET
Origin: https://www.cybereason.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

access-control-allow-headers: Origin,X-Requested-With,Content-Type,Accept,Authorization,X-Amp-Device-Id,X-Amp-Session-Id,visited_url,_zitok,forwarded,x-ziaccesstoken
access-control-allow-methods: POST, GET, OPTIONS, PATCH, DELETE, PUT
access-control-allow-origin: https://www.cybereason.com
apigw-requestid: fLvYUimsPHcEMgA=
cf-cache-status: DYNAMIC
cf-ray: 8cde8bea59c89520-LHR
date: Sat, 05 Oct 2024 15:46:48 GMT
server: cloudflare
vary: Origin
via: 1.1 af0ad6fe38e7d108cc69818822aae89c.cloudfront.net (CloudFront)
x-amz-cf-id: iuxJg1xYpc6jSyX2QLLkNr-vZk9cT8ZciktQ3uJ98KGR6W5edmmdDQ==
x-amz-cf-pop: LHR62-C2
x-cache: Miss from cloudfront
x-powered-by: Express

GET
H3 200 getSubscriptions Show response
js.zi-scripts.com/unified/v1/master/ 146 B
527 B 434ms
434ms Fetch
application/json 172.64.150.44
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js.zi-scripts.com/unified/v1/master/getSubscriptions
Requested by: Host: js.zi-scripts.com
URL: https://js.zi-scripts.com/zi-tag.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.64.150.44 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash: 6f609439b64e6b2d282fa2f4803d94f702079dab55c3ce69d8d149dc3e959e42

Request headers

Authorization: Bearer 99ddf485491721841607
Referer: https://www.cybereason.com/blog/cuckoo-spear-pt2-threat-actor-arsenal
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Content-Type: application/json
visited_url: https://www.cybereason.com/blog/cuckoo-spear-pt2-threat-actor-arsenal

Response headers

server: cloudflare
content-encoding: gzip
cf-cache-status: DYNAMIC
etag: W/"92-/REN52Iw2EeMjWClBGYit8foUk0"
via: 1.1 96375daee9a769fe353f0e47c5e49196.cloudfront.net (CloudFront)
cf-ray: 8cde8beb8b719520-LHR
apigw-requestid: fLvYYhSlPHcEP6Q=
access-control-allow-origin: https://www.cybereason.com
x-cache: Miss from cloudfront
x-amz-cf-id: EPWLFrj67IoDjd9ht8iRfhvT_DyUE9QBn9ZJLWop5l8N1g1c8CmukA==
date: Sat, 05 Oct 2024 15:46:48 GMT
content-type: application/json; charset=utf-8
x-powered-by: Express
vary: Origin
x-amz-cf-pop: LHR62-C2

POST
H2 200 / Show response
content.hotjar.io/ 56 B
171 B 223ms
90ms XHR
application/json 54.73.193.221
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://content.hotjar.io/?site_id=704918&gzip=1
Requested by: Host: script.hotjar.com
URL: https://script.hotjar.com/modules.ca70bc16369dcd35d4ef.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 54.73.193.221 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-73-193-221.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: 67fbb3dd1c47260dd57733417d1b321ccdeb7f056e4fcba3f7d99aedcaa93377

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Content-Type: text/plain; charset=UTF-8
Referer: https://www.cybereason.com/blog/cuckoo-spear-pt2-threat-actor-arsenal

Response headers

access-control-max-age: 86400
access-control-allow-origin: *
content-length: 56
date: Sat, 05 Oct 2024 15:46:47 GMT
content-type: application/json

GET
BLOB 200
OK 57cbcd51-3426-4838-9d13-01e208e2ffe3
https://www.cybereason.com/ 43 B
0 Image
image/gif

General

Check archive.org

Show headers Download Go to Show image

Full URL: blob:https://www.cybereason.com/57cbcd51-3426-4838-9d13-01e208e2ffe3
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/gif
Content-Length: 43

GET
H2 200 sync
s.company-target.com/s/ Frame 3C3A 0
0 208ms
109ms Document
text/html 34.96.71.22
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://s.company-target.com/s/sync?exc=lr

Requested by

Host: tag.demandbase.com
URL: https://tag.demandbase.com/6e1424cff90e9cd4.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

34.96.71.22 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

22.71.96.34.bc.googleusercontent.com

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Referer: https://www.cybereason.com/blog/cuckoo-spear-pt2-threat-actor-arsenal
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

access-control-allow-methods: GET,OPTIONS
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 634
content-type: text/html; charset=UTF-8
date: Sat, 05 Oct 2024 15:46:47 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
via: 1.1 google

GET
H2 451 464526.gif
id.rlcdn.com/ 0
98 B 127ms
42ms Image
text/plain 35.244.174.68
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://id.rlcdn.com/464526.gif
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.174.68 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 68.174.244.35.bc.googleusercontent.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.cybereason.com/blog/cuckoo-spear-pt2-threat-actor-arsenal

Response headers

via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
date: Sat, 05 Oct 2024 15:46:47 GMT

POST
H2 200 ip.json Show response
api.company-target.com/api/v3/ 467 B
1020 B 212ms
110ms XHR
application/json 18.66.102.75
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://api.company-target.com/api/v3/ip.json?referrer=&page=https%3A%2F%2Fwww.cybereason.com%2Fblog%2Fcuckoo-spear-pt2-threat-actor-arsenal&page_title=CUCKOO%20SPEAR%20Part%202%3A%20Threat%20Actor%20Arsenal

Requested by

Host: tag.demandbase.com
URL: https://tag.demandbase.com/6e1424cff90e9cd4.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.66.102.75 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-66-102-75.fra56.r.cloudfront.net

Software

nginx /

Resource Hash

5775a5f20b0d9e11daa3abd873d1c8d7d9665dcdd38ebf33bdaf0a2f361ce49d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://www.cybereason.com/blog/cuckoo-spear-pt2-threat-actor-arsenal

Response headers

access-control-max-age: 7200
access-control-expose-headers: x-amz-cf-id
content-encoding: gzip
identification-source: CENTRAL
access-control-allow-methods: GET, POST, OPTIONS
request-id: 4b0bd3a8-ce67-463d-a3be-f7e2772159f0
expires: Fri, 04 Oct 2024 15:46:47 GMT
x-cache: Miss from cloudfront
x-amz-cf-id: QeSyqSZwUC8-97YarTKST97VStsvNIzbfYNTpcZWHDKIhNz5WU3wng==
date: Sat, 05 Oct 2024 15:46:47 GMT
content-type: application/json;charset=utf-8
vary: Accept-Encoding, Origin
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
api-version: v3
access-control-allow-credentials: true
via: 1.1 6faa38f38a1fee24a829fec7c748876c.cloudfront.net (CloudFront)
access-control-allow-origin: https://www.cybereason.com
x-amz-cf-pop: FRA56-P2
server: nginx

GET
H2 200 core
js.driftt.com/ Frame 73C2 0
0 241ms
153ms Document
text/html 18.245.86.77
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core?d=1&embedId=zdcd6x8yhg85&eId=zdcd6x8yhg85&region=US&forceShow=false&skipCampaigns=false&sessionId=ca3b825f-22da-4169-bea9-486a4ba157da&sessionStarted=1728143207.797&campaignRefreshToken=d2a27962-d665-4271-8903-19b503d19082&hideController=false&pageLoadStartTime=1728143205330&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.cybereason.com%2Fblog%2Fcuckoo-spear-pt2-threat-actor-arsenal

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/include/1728143400000/zdcd6x8yhg85.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.245.86.77 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-245-86-77.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://www.cybereason.com/blog/cuckoo-spear-pt2-threat-actor-arsenal
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: *
cache-control: no-cache
content-encoding: gzip
content-type: text/html; charset=utf-8
date: Sat, 05 Oct 2024 15:46:47 GMT
etag: W/"61dfcbf4873f0f79619a148371fe5ad6"
last-modified: Thu, 03 Oct 2024 17:03:48 GMT
server: istio-envoy
strict-transport-security: max-age=31536000; includeSubDomains
vary: Accept-Encoding
via: 1.1 cae5c5323232533718f592c973f01432.cloudfront.net (CloudFront)
x-amz-cf-id: cP17U5agoitHdhLQI-l2DIDI_3SeuYRBRsDYTv4pwOskkBfLVakDPg==
x-amz-cf-pop: FRA60-P6
x-amz-server-side-encryption: AES256
x-amz-version-id: FGgsKWLfZQkZs2shTS1MPmeannUG2gmW
x-cache: RefreshHit from cloudfront
x-envoy-upstream-service-time: 23

GET
H2 200 chat
js.driftt.com/core/ Frame D181 0
0 238ms
152ms Document
text/html 18.245.86.77
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1728143205330

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/include/1728143400000/zdcd6x8yhg85.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.245.86.77 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-245-86-77.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://www.cybereason.com/blog/cuckoo-spear-pt2-threat-actor-arsenal
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: *
cache-control: no-cache
content-encoding: gzip
content-type: text/html; charset=utf-8
date: Sat, 05 Oct 2024 15:46:47 GMT
etag: W/"61dfcbf4873f0f79619a148371fe5ad6"
last-modified: Thu, 03 Oct 2024 17:03:48 GMT
server: istio-envoy
strict-transport-security: max-age=31536000; includeSubDomains
vary: Accept-Encoding
via: 1.1 cae5c5323232533718f592c973f01432.cloudfront.net (CloudFront)
x-amz-cf-id: 8_4KzG6izKBiDafM-JLqDmcGb5g4DUjSRK_2w6kaAOoJZdboI2xyfg==
x-amz-cf-pop: FRA60-P6
x-amz-server-side-encryption: AES256
x-amz-version-id: FGgsKWLfZQkZs2shTS1MPmeannUG2gmW
x-cache: RefreshHit from cloudfront
x-envoy-upstream-service-time: 23

GET
H2 200 bg9s Show response
tag-logger.demandbase.com/ 0
419 B 521ms
415ms XHR
text/html 2600:9000:2724:c00:1d:8d6d:3b40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tag-logger.demandbase.com/bg9s?x-amz-cf-id=QeSyqSZwUC8-97YarTKST97VStsvNIzbfYNTpcZWHDKIhNz5WU3wng==&api-version=v3
Requested by: Host: tag.demandbase.com
URL: https://tag.demandbase.com/6e1424cff90e9cd4.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2724:c00:1d:8d6d:3b40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.cybereason.com/blog/cuckoo-spear-pt2-threat-actor-arsenal

Response headers

x-amz-version-id: 8SdDCdpJvGjkSiMFPv08XcVSgwOMVVmH
etag: "d41d8cd98f00b204e9800998ecf8427e"
age: 26092
x-cache: Error from cloudfront
x-amz-cf-id: CauIWXKUJI_NVYfiEorCeZriPtxBdd4iLtjSyBG2hOrWH_T30TOSsw==
date: Sat, 05 Oct 2024 08:32:02 GMT
content-type: text/html
vary: Accept-Encoding
last-modified: Tue, 07 Mar 2023 20:47:02 GMT
via: 1.1 b542963649ffc3f71c6540a2347be55a.cloudfront.net (CloudFront)
accept-ranges: bytes
access-control-allow-origin: *
content-length: 0
x-amz-cf-pop: FRA56-P12
server: AmazonS3
x-amz-server-side-encryption: AES256

POST
H2 204 collect
region1.google-analytics.com/g/ 0
0 118ms
41ms Fetch
text/plain 2001:4860:4802:34::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://region1.google-analytics.com/g/collect?v=2&tid=G-PZ3FE06790&gtm=45je4a20v893336776z8830287785za200zb830287785&_p=1728143206257&gcs=G100&gcd=13p3p3p3p5l1&npa=1&dma_cps=-&dma=0&tag_exp=101671035~101747727&gdid=dZTQ1Zm.dYWJhMj&cid=92479693.1728143208&ul=en-gb&sr=1600x1200&ir=1&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=denied&_eu=Eg&_s=1&sid=1728143207&sct=1&seg=0&dl=https%3A%2F%2Fwww.cybereason.com%2Fblog%2Fcuckoo-spear-pt2-threat-actor-arsenal&dt=CUCKOO%20SPEAR%20Part%202%3A%20Threat%20Actor%20Arsenal&en=page_view&_fv=1&_nsi=1&_ss=1&tfd=3423
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-PZ3FE06790&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:34::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.cybereason.com/blog/cuckoo-spear-pt2-threat-actor-arsenal

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:86:0
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:86:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://www.cybereason.com
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 05 Oct 2024 15:46:48 GMT
content-type: text/plain
server: Golfe2

GET
H2

200

src=10428681;dc_pre=CLyswJDL94gDFYb0OwId7ksyXg;type=cyber0;cat=cyber0;ord=890413546279;npa=1;gdid=dZTQ1Zm.dYWJhMj;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=denied;frm=0;gtm=45fe4a20v91818...
ade.googlesyndication.com/ddm/activity/
Redirect Chain

https://ade.googlesyndication.com/ddm/activity/src=10428681;type=cyber0;cat=cyber0;ord=890413546279;npa=1;gdid=dZTQ1Zm.dYWJhMj;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=denied;frm=0;gtm=4...
https://ade.googlesyndication.com/ddm/activity/src=10428681;dc_pre=CLyswJDL94gDFYb0OwId7ksyXg;type=cyber0;cat=cyber0;ord=890413546279;npa=1;gdid=dZTQ1Zm.dYWJhMj;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;ua...

42 B
118 B

78ms
78ms

Image
image/gif

216.58.206.66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ade.googlesyndication.com/ddm/activity/src=10428681;dc_pre=CLyswJDL94gDFYb0OwId7ksyXg;type=cyber0;cat=cyber0;ord=890413546279;npa=1;gdid=dZTQ1Zm.dYWJhMj;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=denied;frm=0;gtm=45fe4a20v9181802817z8830287785za201zb830287785;gcs=G100;gcd=13p3p3p3p5l1;dma_cps=-;dma=0;tag_exp=101533421~101671035~101747727;epver=2;~oref=https%3A%2F%2Fwww.cybereason.com%2Fblog%2Fcuckoo-spear-pt2-threat-actor-arsenal?

Protocol

Server

216.58.206.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

tzfraa-aa-in-f2.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.cybereason.com/blog/cuckoo-spear-pt2-threat-actor-arsenal

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 42
date: Sat, 05 Oct 2024 15:46:48 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

Redirect headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
location: https://ade.googlesyndication.com/ddm/activity/src=10428681;dc_pre=CLyswJDL94gDFYb0OwId7ksyXg;type=cyber0;cat=cyber0;ord=890413546279;npa=1;gdid=dZTQ1Zm.dYWJhMj;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=denied;frm=0;gtm=45fe4a20v9181802817z8830287785za201zb830287785;gcs=G100;gcd=13p3p3p3p5l1;dma_cps=-;dma=0;tag_exp=101533421~101671035~101747727;epver=2;~oref=https%3A%2F%2Fwww.cybereason.com%2Fblog%2Fcuckoo-spear-pt2-threat-actor-arsenal?
pragma: no-cache
cross-origin-resource-policy: cross-origin
follow-only-when-prerender-shown: 1
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Sat, 05 Oct 2024 15:46:48 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: cafe

POST
H3 200 landing
pagead2.googlesyndication.com/pagead/ 42 B
64 B 156ms
61ms Ping
image/gif 142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/landing?gcs=G100&gcd=13p3p3p3p5l1&tag_exp=101529665~101671035~101747727&rnd=591442080.1728143208&url=https%3A%2F%2Fwww.cybereason.com%2Fblog%2Fcuckoo-spear-pt2-threat-actor-arsenal&dma_cps=-&dma=0&npa=1&gtm=45He4a20n81TJVVB7Cv830287785za200

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TJVVB7C

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s52-in-f2.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.cybereason.com/blog/cuckoo-spear-pt2-threat-actor-arsenal

Response headers

content-security-policy: script-src 'none'; object-src 'none'
cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 42
date: Sat, 05 Oct 2024 15:46:48 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

POST
H2 204 collect
region1.google-analytics.com/g/ 0
0 97ms
38ms Fetch
text/plain 2001:4860:4802:34::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://region1.google-analytics.com/g/collect?v=2&tid=G-PZ3FE06790&gtm=45je4a20v893336776z8830287785za200zb830287785&_p=1728143206257&gcs=G100&gcd=13p3p3p3p5l1&npa=1&dma_cps=-&dma=0&tag_exp=101671035~101747727&gdid=dZTQ1Zm.dYWJhMj&cid=92479693.1728143208&ul=en-gb&sr=1600x1200&ir=1&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=denied&_eu=EA&sid=1728143207&sct=1&seg=0&dl=https%3A%2F%2Fwww.cybereason.com%2Fblog%2Fcuckoo-spear-pt2-threat-actor-arsenal&dt=CUCKOO%20SPEAR%20Part%202%3A%20Threat%20Actor%20Arsenal&_s=2&tfd=3444
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-PZ3FE06790&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:34::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://www.cybereason.com/blog/cuckoo-spear-pt2-threat-actor-arsenal

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:86:0
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:86:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://www.cybereason.com
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 05 Oct 2024 15:46:48 GMT
content-type: text/plain
server: Golfe2

GET
H3 200 / Show response
ws.zoominfo.com/pixel/1cwYCUDAYD26hHzYzki9/ 3 KB
2 KB 407ms
365ms Fetch
text/javascript 104.16.117.43
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://ws.zoominfo.com/pixel/1cwYCUDAYD26hHzYzki9/?iszitag=true

Requested by

Host: js.zi-scripts.com
URL: https://js.zi-scripts.com/zi-tag.js

Protocol

Security

QUIC, , AES_128_GCM

Server

104.16.117.43 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / Express

Resource Hash

960d63b26bc409b94c56172001bfb0b9d21816e16f30290b5331c96e57c1db30

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

_zitok: a2c4d502a07979a7027c1728143208
_vtok: MjE3LjEzOC4xOTYuMTAw
visited-url: https://www.cybereason.com/blog/cuckoo-spear-pt2-threat-actor-arsenal
Referer: https://www.cybereason.com/blog/cuckoo-spear-pt2-threat-actor-arsenal
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Content-Type: text/javascript

Response headers

x-robots-tag: noindex, nofollow
content-encoding: gzip
cf-cache-status: DYNAMIC
access-control-allow-credentials: true
x-content-type-options: nosniff
via: 1.1 google
cf-ray: 8cde8bf02fc5cd2d-LHR
access-control-allow-origin: https://www.cybereason.com
alt-svc: h3=":443"; ma=86400
date: Sat, 05 Oct 2024 15:46:49 GMT
content-type: text/javascript
vary: Accept-Encoding
x-powered-by: Express
server: cloudflare
access-control-allow-headers: Content-Type,cf-ipcountry,service-version,x-appengine-user-ip,x-forwarded-for, x-ws-collect-type,requestFromZITag,unifiedScriptVerified,_zitok,_vtok,visited-url

OPTIONS
H3 200 /
ws.zoominfo.com/pixel/1cwYCUDAYD26hHzYzki9/ Frame 0
0 255ms
209ms Preflight
text/html 104.16.117.43
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://ws.zoominfo.com/pixel/1cwYCUDAYD26hHzYzki9/?iszitag=true

Protocol

Security

QUIC, , AES_128_GCM

Server

104.16.117.43 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / Express

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept: */*
Access-Control-Request-Headers: _vtok,_zitok,content-type,visited-url
Access-Control-Request-Method: GET
Origin: https://www.cybereason.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Content-Type,cf-ipcountry,service-version,x-appengine-user-ip,x-forwarded-for,x-ws-collect-type,requestFromZITag,unifiedScriptVerified,_zitok,_vtok,visited-url
access-control-allow-origin: https://www.cybereason.com
allow: GET,HEAD
cf-cache-status: DYNAMIC
cf-ray: 8cde8bee9d7793e2-LHR
content-encoding: gzip
content-type: text/html; charset=utf-8
date: Sat, 05 Oct 2024 15:46:48 GMT
server: cloudflare
via: 1.1 google
x-content-type-options: nosniff
x-powered-by: Express
x-robots-tag: noindex, nofollow

GET
H2 200 ip.json Show response
api.company-target.com/api/v3/ 467 B
1020 B 180ms
92ms Fetch
application/json 18.66.102.75
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://api.company-target.com/api/v3/ip.json?auth=demandbase_UBcrPOQv880H7H03hUjDU1ih1EpeWrsScR1YmUME&page=https%3A%2F%2Fwww.cybereason.com%2Fblog%2Fcuckoo-spear-pt2-threat-actor-arsenal&page_title=CUCKOO%20SPEAR%20Part%202%3A%20Threat%20Actor%20Arsenal&referrer=

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/include/1728143400000/zdcd6x8yhg85.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.66.102.75 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-66-102-75.fra56.r.cloudfront.net

Software

nginx /

Resource Hash

5775a5f20b0d9e11daa3abd873d1c8d7d9665dcdd38ebf33bdaf0a2f361ce49d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.cybereason.com/blog/cuckoo-spear-pt2-threat-actor-arsenal

Response headers

access-control-max-age: 7200
access-control-expose-headers: x-amz-cf-id
content-encoding: gzip
identification-source: CENTRAL
access-control-allow-methods: GET, POST, OPTIONS
request-id: 34d80b2d-3fd7-4b57-9d58-48a12edc936f
expires: Fri, 04 Oct 2024 15:46:49 GMT
x-cache: Miss from cloudfront
x-amz-cf-id: 9GyxOymVtRQ-bA4fZVPIYHgS1Egi6pCZSkHU27W2GhWvdn1rfAtIuw==
date: Sat, 05 Oct 2024 15:46:49 GMT
content-type: application/json;charset=utf-8
vary: Accept-Encoding, Origin
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
api-version: v3
access-control-allow-credentials: true
via: 1.1 cb4c4a25e4ef534686959996782c8476.cloudfront.net (CloudFront)
access-control-allow-origin: https://www.cybereason.com
x-amz-cf-pop: FRA56-P2
server: nginx

GET
BLOB 200
OK 58929be7-4026-4251-938c-6ed3257d9562 Show response
https://www.cybereason.com/ 3 KB
0 Script
text/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://www.cybereason.com/58929be7-4026-4251-938c-6ed3257d9562
Requested by: Host: js.zi-scripts.com
URL: https://js.zi-scripts.com/zi-tag.js
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 960d63b26bc409b94c56172001bfb0b9d21816e16f30290b5331c96e57c1db30

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: text/javascript
Content-Length: 3029

GET
H2 200 up
insight.adsrvr.org/track/ Frame 5456 0
0 45ms
44ms Document
text/html 52.223.40.198
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://insight.adsrvr.org/track/up?adv=ahlj4b0&ref=https%3A%2F%2Fwww.cybereason.com%2Fblog%2Fcuckoo-spear-pt2-threat-actor-arsenal&upid=l8ht5d1&upv=1.1.0&paapi=1
Requested by: Host: js.adsrvr.org
URL: https://js.adsrvr.org/up_loader.1.1.0.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.223.40.198 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a6370ebea231e0c9a.awsglobalaccelerator.com
Software: Kestrel /
Resource Hash

Request headers

Referer: https://www.cybereason.com/blog/cuckoo-spear-pt2-threat-actor-arsenal
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

content-encoding: gzip
content-type: text/html
date: Sat, 05 Oct 2024 15:46:49 GMT
server: Kestrel
vary: Accept-Encoding

Verdicts & Comments Add Verdict or Comment

135 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

46 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.www.cybereason.com/	1970-01-21 00:02:25	Name: __cf_bm Value: ayUZCvlnhOoqdlwPhnWVYOTQy5S_mu4DN7f8GQDGgcM-1728143205-1.0.1.1-5Aki1K.7mXsro1sIwlSwcr17zIcK2Ph3LVqAXeg00_fySMQI3Z3sVZGh1w7HOOcPYYQrbqSiunLw1pUdbyHiFA
.www.cybereason.com/	1969-12-31 23:59:59	Name: __cfruid Value: d43a516f1f128ffcd54424955643b5b650501e43-1728143205
.cybereason.com/	1970-01-21 08:46:58	Name: visid_incap_2710048 Value: tcA/R4/qR1m/UzN5FmNdnmRfAWcAAAAAQUIPAAAAAAAZOVHIYbRDLmN26uffu+2K
.cybereason.com/	1969-12-31 23:59:59	Name: nlbi_2710048 Value: qB+2J5Vbew0gUyyv2P/mMAAAAAAWbnZ7jLQYp0Vgky0fWUd1
.cybereason.com/	1969-12-31 23:59:59	Name: incap_ses_259_2710048 Value: MB32MqvVtijuycOxNSeYA2RfAWcAAAAABJu6rgFIgPQPhAqd1l4Ezw==
.hubspot.com/	1970-01-21 00:02:25	Name: __cf_bm Value: 40ddt_sv_8DH4tZReuRvnnt6fOxiyvS3fidyiPkuNZ0-1728143206-1.0.1.1-FlWmK9PhjBa0mk3GBYclSmO0Hy6T7mMkn7JqBguygSNJLR_Yl44QKCRKvdMC2cg6AzjnlXspGnXjWt5_tHcekA
.hubspot.com/	1969-12-31 23:59:59	Name: _cfuvid Value: iDc6pVrFscaemtqKrVeqJnMxq7CQNt42aj8Q4BIlWRA-1728143206208-0.0.1.1-604800000
.hsforms.com/	1970-01-21 00:02:25	Name: __cf_bm Value: fhf5CZUy7Jan70vOggsvMOwcJT8HjjEQTBlMyUGjHR4-1728143206-1.0.1.1-3SqP5Bh7KpjPF2iirG5xm_bP8lzOnd7I6lj4Ie_71O4mGGo7jVAd2xRRcSQ5m4lWxoPhpe7DEaiKmGqxCaWWkw
.hsforms.com/	1969-12-31 23:59:59	Name: _cfuvid Value: VZTgpqYI.Eec9.RKijEsqK8mfHYJfz99rMasgPWAAuU-1728143206352-0.0.1.1-604800000
.cybereason.com/	1970-01-21 04:21:35	Name: __hstc Value: 85683782.d60ee04feffed21d44dc7f8f0aa53c91.1728143206737.1728143206737.1728143206737.1
.cybereason.com/	1970-01-21 04:21:35	Name: hubspotutk Value: d60ee04feffed21d44dc7f8f0aa53c91
.cybereason.com/	1969-12-31 23:59:59	Name: __hssrc Value: 1
.cybereason.com/	1970-01-21 00:02:25	Name: __hssc Value: 85683782.1.1728143206737
.cybereason.com/	1970-01-21 08:47:59	Name: OptanonConsent Value: isGpcEnabled=0&datestamp=Sat+Oct+05+2024+16%3A46%3A47+GMT%2B0100+(British+Summer+Time)&version=6.38.0&isIABGlobal=false&hosts=&landingPath=https%3A%2F%2Fwww.cybereason.com%2Fblog%2Fcuckoo-spear-pt2-threat-actor-arsenal&groups=C0001%3A1%2CC0004%3A1%2CC0002%3A1%2CC0003%3A1
.techtarget.com/	1970-01-21 00:02:25	Name: __cf_bm Value: KSlH48z3Icbqj7dQwUn66K.79KsflJ7wPROOKWTMcXA-1728143207-1.0.1.1-MPQsStl8EgnStiBSk9dPjrCyh_umpI2vsmA7O6g7TezBIHupnvZodFZv87T4Ct0SFKJto8xCKqg9hpktfMq3Bw
.o11.tech/	1970-01-21 09:38:23	Name: _autid__p Value: 67015f679cd01702116c9d51
.o11.tech/	1970-01-21 09:38:23	Name: _autid Value: 67015f679cd01702116c9d51
.cybereason.com/	1970-01-21 08:47:59	Name: _hjSessionUser_704918 Value: eyJpZCI6IjFlZmRjY2YxLWIxMTItNTYzNS1iYTI2LWFmNGJhODEyYzVmOSIsImNyZWF0ZWQiOjE3MjgxNDMyMDc1NjgsImV4aXN0aW5nIjp0cnVlfQ==
.linkedin.com/	1970-01-21 08:47:59	Name: bcookie Value: "v=2&930b0626-5b0b-4ffc-8572-df1e9bbb463f"
.linkedin.com/	1970-01-21 04:21:35	Name: li_gc Value: MTswOzE3MjgxNDMyMDc7MjswMjF+GP4nd062khIRoEAwnbTS5ZkNgDjMAOfKHL0Lv+PHbg==
.linkedin.com/	1970-01-21 00:03:49	Name: lidc Value: "b=OGST08:s=O:r=O:a=O:p=O:g=3006:u=1:x=1:i=1728143207:t=1728229607:v=2:sig=AQHhFZQsAky6ZrZNP6XVygEB202Ba3yA"
.cybereason.com/	1970-01-21 00:02:25	Name: _hjSession_704918 Value: eyJpZCI6IjA3OGI5ODY4LTFkMjUtNDFmOS1hMTU3LTY4MGU1MjQ5ODAyNSIsImMiOjE3MjgxNDMyMDc1NjksInMiOjEsInIiOjEsInNiIjowLCJzciI6MCwic2UiOjAsImZzIjoxLCJzcCI6MH0=
analytics.o11.tech/	1969-12-31 23:59:59	Name: c076Page_default_c076 Value: 1_0_0
.twitter.com/	1970-01-21 09:38:23	Name: guest_id_marketing Value: v1%3A172814320753043724
.twitter.com/	1970-01-21 09:38:23	Name: guest_id_ads Value: v1%3A172814320753043724
.twitter.com/	1970-01-21 09:38:23	Name: personalization_id Value: "v1_Yvw8GkoPL91iNqBq0if3mA=="
.twitter.com/	1970-01-21 09:38:23	Name: guest_id Value: v1%3A172814320753043724
www.cybereason.com/	1970-01-21 00:02:25	Name: drift_campaign_refresh Value: d2a27962-d665-4271-8903-19b503d19082
.t.co/	1970-01-21 09:38:23	Name: muc_ads Value: bc682d4c-0ec7-452b-b3ba-44ea8ef3a417
.t.co/	1970-01-21 00:02:25	Name: __cf_bm Value: sXscC.B.4dxbV0XgocDH3ZEbAxk8KxxMyTWXzpTm0wQ-1728143207-1.0.1.1-tX9RCYjto2kGHUfOvcPdTfS1zhcqjQDSePypPQUH740v5.JAUjh2tE19FH4Ykfg9E_5EZLHyDRAilzcSEDB8dg
.company-target.com/	1970-01-21 09:38:23	Name: tuuid Value: 58ee616d-5c6a-4d17-b622-7796d5bd8c6a
.company-target.com/	1970-01-21 09:38:23	Name: tuuid_lu Value: 1728143207\|ix:0\|mctv:0\|rp:0
.casalemedia.com/	1970-01-21 08:47:59	Name: CMID Value: ZwFfZ7lQJdIAAHYHAKxRNwAA
.casalemedia.com/	1970-01-21 02:11:59	Name: CMPS Value: 5101
.casalemedia.com/	1970-01-21 02:11:59	Name: CMPRO Value: 5101
.tremorhub.com/	1970-01-21 08:48:20	Name: tvid Value: 7d4f4a60ee0a4faaac0653ae0ddf2bbb
.tremorhub.com/	1970-01-21 09:38:23	Name: tv_UIDM Value: 58ee616d-5c6a-4d17-b622-7796d5bd8c6a
.a.usbrowserspeed.com/	1970-01-21 08:47:59	Name: tuid Value: c13c218f-2140-45b3-a00a-a4b1aebc6a76
.www.cybereason.com/	1970-01-21 08:47:59	Name: _zitok Value: a2c4d502a07979a7027c1728143208
.adsrvr.org/	1970-01-21 08:47:59	Name: TDID Value: d641290c-023b-42a2-85b4-d16d3e0b9e16
www.cybereason.com/	1970-01-21 09:38:23	Name: drift_aid Value: 4e97d769-d58e-4ee7-9aae-b0006e003d15
www.cybereason.com/	1970-01-21 09:38:23	Name: driftt_aid Value: 4e97d769-d58e-4ee7-9aae-b0006e003d15
.zoominfo.com/	1970-01-21 00:02:25	Name: __cf_bm Value: Mahh45WbsGm9kPEb9L3DHDx5SE.h7KUpFX01jZnjpbI-1728143209-1.0.1.1-u6oSIr_ZS8mcxam41l_TRxC8LhIVsItgXKdAuNsP8vS3NIZaNRLf1WhwMs8FaxLR9IoQ4ZCivWKqSI0STBXqDA
.zoominfo.com/	1969-12-31 23:59:59	Name: _cfuvid Value: q78FT3J3YeUZzL12BwKzAzcEV7CFyTCOZdY1z42TckY-1728143209220-0.0.1.1-604800000
.adsrvr.org/	1970-01-21 08:47:59	Name: TDCPM Value: CAEYBSgDMgsIoL-agvXXsj0QBUIPIg0IARIJCgV0aWVyMhABWgdhaGxqNGIwYAE.
analytics.o11.tech/	1969-12-31 23:59:59	Name: c076BcnLcy Value: 44

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://id.rlcdn.com/464526.gif Message: Failed to load resource: the server responded with a status of 451 ()

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	deny

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

7052064.fs1.hubspotusercontent-na1.net
ade.googlesyndication.com
ajax.googleapis.com
analytics.o11.tech
analytics.twitter.com
api.company-target.com
app.hubspot.com
cdn.cookielaw.org
cdn2.hubspot.net
cdnjs.cloudflare.com
connect.facebook.net
content.hotjar.io
cta-service-cms2.hubspot.com
fast.wistia.com
fonts.googleapis.com
fonts.gstatic.com
forms.hubspot.com
geolocation.onetrust.com
ibc-flow.techtarget.com
id.rlcdn.com
insight.adsrvr.org
js.adsrvr.org
js.driftt.com
js.hs-analytics.net
js.hs-banner.com
js.hs-scripts.com
js.hsleadflows.net
js.hubspot.com
js.zi-scripts.com
p.typekit.net
pagead2.googlesyndication.com
perf-na1.hsforms.com
platform.linkedin.com
platform.twitter.com
px.ads.linkedin.com
px4.ads.linkedin.com
region1.google-analytics.com
s.company-target.com
script.hotjar.com
snap.licdn.com
static.ads-twitter.com
static.hotjar.com
static.hsappstatic.net
t.co
tag-logger.demandbase.com
tag.demandbase.com
track.hubspot.com
trk.techtarget.com
use.typekit.net
ws.zoominfo.com
www.cybereason.com
www.googletagmanager.com
104.16.117.43
104.18.80.204
104.18.91.62
104.244.42.67
13.107.42.14
13.32.27.21
142.250.181.227
142.250.185.194
146.75.52.157
157.240.0.6
162.159.140.229
172.64.150.44
18.172.103.101
18.245.46.22
18.245.86.77
18.245.86.87
18.66.102.75
18.66.192.39
2001:4860:4802:34::36
216.58.206.66
2600:9000:2724:c00:1d:8d6d:3b40:93a1
2606:2800:233:66b5:799a:7cd3:f74d:7071
2606:4700:4400::6812:28f0
2606:4700:4400::6812:297c
2606:4700:4400::ac40:9b77
2606:4700::6810:7674
2606:4700::6810:89d1
2606:4700::6810:a0a8
2606:4700::6811:190e
2606:4700::6811:ad5b
2606:4700::6812:1347
2606:4700::6812:562a
2606:4700::6812:8a11
2620:1ec:21::14
2a00:1450:4001:81c::2008
2a00:1450:4001:830::200a
2a00:1450:4001:831::200a
2a02:26f0:3500:10::210:a9a
2a02:26f0:3500:16::215:148b
2a02:26f0:3500:16::215:148f
2a04:4e42:600::644
34.111.208.231
34.96.71.22
35.244.174.68
45.60.64.106
52.223.40.198
54.73.193.221
95.101.111.153
08190a325d7e937d066f7ff1adfc9d3a1debfc7efe6316006191ab6230a5c988
09edf98c454b11870a1a667cacab183aaf34e51f53dedb3fa735b9afac34f402
0b281bf2f4179c06ba68f0a427f2341287c41eacc2ce9d534c6f5c513ac633fb
0b454edb897d49bf8a73b07627b670a55f0972988094770495a308e5a5e39d1b
0c07b854855b0e2bd7839c3659defa45307e96e281b3c00571d09f213eb6a76e
0c33072c2e37faa2b2acd3f76a15c44139cadb7999ec9405382b67eab4161003
0d8601a776b7dc777cd23bc42392d05a43df0d6402328e8913b58811083b513d
0dfb22afe7173c577144301206aee5fa3939268bfefb7adb44906fa81cb7a1d2
0ee74aaadfb29cd478645c275a4dc5c13a4c81b2f5ec9af6d6dd1bad3b2908a0
0f62e3e5f677efe75860052589b895e2252887cb0831bec361b5130ea2a67bc0
0f94c946a13b9ebe43281550b7d0c00edf4694ad06bcb4c8679bee6d48df5115
119bf322a2ce6d2a82422b51404bc54b375c881f12a120205598d1691fa48820
12127e3110351f54262db955bafe353593dd58c89c7f6b6fc159c10515e93c61
14e4d1596c6b58896dfce1fc1ec45372bab4d2259ba82828fa3f96cc4f859fc4
173460e89e6a7244218badae2016f65c48a3eae9d400802273eeca18b07336f1
17770d05051a8a4f270ba5bdf049b90cc166ac42bd4513f419308a5804d7a161
17a31aae550a664382ab9d8085efc03a10a4548985f33ac4e5a533d5ab5e9339
1881e98c1d0475105f722991f9f574e5fd0e0c1da957e4b6efa0e5e1a870c7d1
1b49717ee4566c527ce824a1f6db23dc4b1ceb5d539c0a249cc16010af88c096
1c2a954cb77231d3d9a46cf23119222b85c72b17a0cc4cac72b9eec7a03e6641
1ef8b59b832109ecbec2f9ed52e8073e2ab73862fa5e6697e1fe05d1c8358a02
20e041cb509df34abb6a3ac62c3702931561a0dcbc2d683a5ad85adae7b88f15
266d85b7ad351501b8651b0e659d6d74fbe07085d3226cd3f7601f6522fbdf97
26e34b9fbbd2ecafe25af980f19ddc63342ffad01477b0fe851ac8c35bfea847
28d99ad8103f148a1cf63a25d1369e0bd7d220f97ca36ac12cf8a8c7b2060fcc
2b14e8397d552f351a4396dec25ec5da1348865683100e94c4ab0faea4a9a254
2ba7f20b1d8990e17a47fe3d88e4c766628aaa2baf1dd30fca0a0db59836f5f9
2ca281bdcd543e2e3559e6505c323c8d64df73f2a594a043780df3007e16d161
2d2c4912162eaa41299aaf5063ecb92a26d76071fe6d1f77742b32c833daab99
2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363
2e497e2756df72cc07a32f2d68865371a1730c7e4aefe5120e5ee5a86f0b8a4b
2ea67d47ba2486d31cf12a043b8d710b694ae26f952431e684c166810c09699e
30ab6527385008d2f7c64691b0dbd29102f2fd6b1f2af518fe570efc7bef9e24
33ec52ebf1d0e926879a2d1c1521b2de1e8e49d220ce284adc0c021e4a2017f8
33ff6b6486bdc5883c2c63e8278e8a547ca86b1f6026667f7733fec6b52a1303
356bb4bf2245a68ee5de5732b5574260dd2016a2c3987e17ad97fb2586a883d1
38b5fa249791d286db654d516dfb6173cc332a8d725c41b58d08c642b26bc641
3a9e725bae41656623ccda8be25cbdd295ee1c73c8d3016023549a83c261a3ab
3c4d6a1421c7ddb7e404521fe8c4cd5be5af446d7689cd880be26612eaad3cfa
401e5a188c00ddf1fc3a3ba85a63d419cb7d63d280eb436ee5efa39ee8fdff99
42b2b9d16fbf8d3c6be72420699360790966e58fe30d8794fd90a71c8aef122d
42c7e51d284cd7256caf3bfebf641141876657ea0d6e5588ac7e69dce1e9cf7e
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
458235328e4f7da4ccbe1e308d9f688e6cc5079212285f307cfa43e076c1dbee
4818b055ad8fa3c21287632e967a1a62be06b93cd1e9b372fdfc33c11477ef26
4d15ff2317e16ccd8ca1d3248fea7d91130e022369bb032824a84ad9967064df
4da5f291444be7904d482692a15149cffbeeb170eef7103e5d9c7d45918586eb
510835fe8939dd32b7388d00f583d2f080f9d6bcfc2c9d21098407d000065c22
512a1cee111dc4ffd6894ffdc978346708aaae7aa654981d93dbc5cddfcd60a4
5775a5f20b0d9e11daa3abd873d1c8d7d9665dcdd38ebf33bdaf0a2f361ce49d
594b91ae8f514c76d055bc50825da7f35b28fe6e7b65ee51594b1b3e549c89ca
599dd661a1d9e0af96d614fab0ea7396bf06de4265029166a265c2b10cc1a1b0
5c8d63abd4075c4ebd692fbd02e35fb72950f214a6486607c1819d4279ad526f
5fa00d047acd959697b9d7772c31dcd37bec33c70c6fbf80ab8316205d1d286d
5fbaeb9f8e25d7e0143bae61d4b1802c16ce7390b96ceb2d498b0d96ff4c853f
64567dded855d508db3d27ca19fb1e2e55412e9922a1dd7ac593830eda89c7a0
65a47caa5183b035bf78d0f93adbe5cea500333410259c54abf2de356740df7e
65a923b747d84787bc4e01270fa29f4314d3d36df432cd3eb801c30f8adfd466
66ba9d76c09ad6dd52135d52c368f6d87ac40b5b4ce418e41a105fb221c7e470
67fbb3dd1c47260dd57733417d1b321ccdeb7f056e4fcba3f7d99aedcaa93377
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992
6b0fdaa32feffbdbd15bda3619624e0aa8e1d647fd720e31b7645654e7fb551e
6f609439b64e6b2d282fa2f4803d94f702079dab55c3ce69d8d149dc3e959e42
72493a3f42ed0260f03b6ffd3ea131be38a1070845bfae24927f643a3fcf3255
72fe18777ebf37b44d58c82be9b67edceefb88c2c6984c614c72991d6e3b8853
799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd
7c152f38b97c00d547b1068c56a5d9cf38e5da19b76010bed69f656b3a9c5553
81c836c05ab1f2d37b7aa60d509a656c7a441e2a4fabf035c1b0666a4daa50fa
843803aeba82f94da6f1cbe1f853ccd12f5d7cc6a3afa20923e57e5df60c412d
85ce42d99ae7d93a9df2304eedc16e1b26d492c38f5b9d034ea5c09c8a996c8f
875f8e591b4fbc6567e2b33553bea9ca2d0e18593bd857783a569fe7bf4ba097
87d049fc6d16da1f81063235c0e3d31a4656800cbbdca8277d6ae56614a52aba
88a9bb80d6a834eb8ba22c53c171e797474b21a5dbc09ff7e736aabb0578fa15
8a27dc7b44ebe886390bfa0a9beeea36ea5a3f37479f0e0836b6c9b80d9b35ed
8ae2c031d4437921725504cc0dde011afa318561961ad23d28d64bc61de45341
8b9d0d77fab58e1e1ec4fd77f06ecebedf37e54ad7b3a3f0d6641de0204fcaa9
8da927b6b1240ffca4323fbb2a12c8e5abb541040965c2bc5b7d09a2eb963b02
8de5d2a9505e1e8cda39b4b6da5deb50c8f03dd5048f60bc51094e00958a4cc0
8f657cd3617d00d51bbc4dee693b71bde939c80310034a8d82641804d4eb7e16
8fb95734be01fd3e163c6ebfb1c8d8d3f60e9339c7e4ec6a3040611cb1ed022c
95d5bb11fee6ddf9b6af49e5c0621d6dd3b84fdc5798795e38254ff8bbaace63
960d63b26bc409b94c56172001bfb0b9d21816e16f30290b5331c96e57c1db30
9678aa8bcf6755f11c34fa207e763cbfcc33a5756bea8cb706f1bd1af567b0a3
9967a27efc89a8cefe9665100ec51cded3a8c89f95cdca1285bfce207666cd11
9b9265c69a5cc295d1ab0d04e0273b3677db1a6216ce2ccf4efc8c277ed84b39
9cec59b071d9d61e74c42ac4db8d2815aaace7e51983afe2481c14b97f332258
9d943fe5fde08d5b742d383b625031f75e3e89035369f2cde2778f4c6cf5c119
9eb7fabe6f662e9e026fb996288d6e4e5b4fd739c45b260269a73b15eabcb7a3
a09d0f89e99cf5a081315ff701187632005dabd23f3ca116a75790003faa7e8f
a4803d7bdeb478a5b9238fe74d8aaa98dafe2e8e68fccbd0e3f4dced823f27f0
a6728e3326fe3805e12f697731cbc97f2a5b773533c1cb4be0c56da998a94db6
abb03b2160dd9f75fa8eb557ca242d7cd93f159d53708c58f4d2887bd4f05ead
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
af91213cd670d6270b32ebdeb00a09625f6b74ccd780d12ff6724a14ea1efaff
b48f9a7031474a0f73f92f2e6cbbfad730b5466cda96d86a4459c06efc986173
b66b9b351cf699e4269a636d7dc515b51aaadbcf14af4a756d8a00b1929e9fe0
b6c9f9a48bd0a163671773a199c876dc64d66947d47ac509c95e29177046c9a3
c0c36470d3b6f534495768bdd7ed92dbb0d6d8d1f3b7b69adba7153b68b90f35
c1233a49c4ecec12fed969bc83cd6ba59d8b2b88bef31988d9384f7e54c42e20
c7487308ed9b62d88a038230040fc84aa6d4e9de5848e226b8a98c21306551fe
c9130ee8c979a74ab038cf5e8a06db5cb94253eab35ea5242f515d605f4781ad
cb5224674e43d02db0037517f4aa29ba5ce9ddd0672e513cc7289714ba657522
cef073e9d2b0a3c33807cde69c66d9b20d3b20be5255901bbb4ae666271506e0
d2733f3936960eead81ec9f71738a38869367d6711831096d3aad134338c2795
d33307c095bc94921f4f3be5daacd40022c008168cf2829bebc5021921c3093c
d61bc5a683625b3980e8f48b9141dfb2dfea199059f0df327c8e3a92bcb57f97
d82231820461c83d1b0966caae71bd2732bd89e9a910fdb90d193c3dca16dbc7
db311174b0e3c340727b63c055cfb5b317808e909503e1bda11cc58af444f12b
dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4
dcd1c4f42f60b4b47c4e548e2b2623d3c9d2acebd088c4be52defd5279f413e3
dd8ce52adc4b0ab60f82c29ba12f25e2f6446245fc8c0b5f4bd6dab3146f9ef7
dff757e0f7208bd207eec7d4d78e52d0c6df01ccbec7914c431f9647d4ab7fdd
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e5c7050c3c28b5afcab7a60b4865bcd6f8d8027a642302fa10be82efbae70b06
e779904e434d50e426e79dfac680cdb8a04564e67121c257974278a02979e407
e90344957225c9e0caa52e2591fd6066740e0650bc100c422435762160fb2e33
ec1857dc06172ece7a701e3ff295788e6693551ff5bdb55ce76280415aa52d60
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
efad755939e511f2bc1feb0d58d6014006e8598a4d431f27a66dd59e14fc19cb
f052ee44c3728dfd23aba8a4567150bc314d23903026fbb6ad089422c2df56af
f212e942ac33fd93669f03a55e2c0192224cdb6870b376fac8d3c5255cd01225
f24560f5b81158a42b8d38ffe5795d9959eb2308ee6780ea912a6594bb999d1e
f3f2822ba3d24c1f7f53bff8959801c644b2c1c556eb8c15ca36a86717f1ae7d
f64368e7be69abe40585911860d83acfa8b14179d3008b2594166ae4c10ec0fd
f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d
f9db6465a204cc4186368b72a0ba4f063e64569aa4fc96e0f40c7ac69423121b
fb121c45f498cba0f88de6e2235d95cf3307bb9ed5376f6a793b8253a520592f
fcba0ef5c17fd435aaa6cfac66375e7bfae52f5116b7a6e126c8b0f38b841613

www.cybereason.com Open in urlscan Pro 45.60.64.106 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

155 Requests

97 %HTTPS

46 %IPv6

37 Domains

52 Subdomains

49 IPs

5 Countries

4397 kBTransfer

9363 kBSize

46 Cookies

14 Outgoing links

Redirected requests

155 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

www.cybereason.com Open in urlscan Pro
45.60.64.106 Public Scan

Screenshot
Live screenshot

Full Image

155
Requests

97 %
HTTPS

46 %
IPv6

37
Domains

52
Subdomains

49
IPs

5
Countries

4397 kB
Transfer

9363 kB
Size

46
Cookies

155 HTTP transactions
1 data transactions