origin-unit42.paloaltonetworks.com Open in urlscan Pro
34.96.108.115 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://origin-unit42.paloaltonetworks.com/north-korean-threat-group-play-ransomware/
Submission: On October 31 via api (October 31st 2024, 9:51:04 am UTC) from IN — Scanned from US

Summary HTTP 174 Redirects Links 100 Behaviour Indicators

Summary

This website contacted 44 IPs in 2 countries across 32 domains to perform 174 HTTP transactions. The main IP is 34.96.108.115, located in Kansas City, United States and belongs to GOOGLE-CLOUD-PLATFORM, US. The main domain is origin-unit42.paloaltonetworks.com.
TLS certificate: Issued by Go Daddy Secure Certificate Authority... on August 9th 2024. Valid for: a year.

This is the only time origin-unit42.paloaltonetworks.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
64	34.96.108.115 34.96.108.115	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
21	2600:1408:ac0... 2600:1408:ac00:19b::1e80	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	2600:1408:c40... 2600:1408:c400:180::c3a	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	146.75.76.157 146.75.76.157	54113 (FASTLY) (FASTLY)
1 4	52.20.18.175 52.20.18.175	14618 (AMAZON-AES) (AMAZON-AES)
11	2606:4700::68... 2606:4700::6812:572a	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	63.140.39.9 63.140.39.9	14618 (AMAZON-AES) (AMAZON-AES)
1	2606:4700:440... 2606:4700:4400::6812:2089	13335 (CLOUDFLAR...) (CLOUDFLARENET)
6	2607:f8b0:400... 2607:f8b0:4004:c0b::61	15169 (GOOGLE) (GOOGLE)
2	18.160.10.89 18.160.10.89	16509 (AMAZON-02) (AMAZON-02)
2	13.249.39.123 13.249.39.123	16509 (AMAZON-02) (AMAZON-02)
2	63.140.39.82 63.140.39.82	14618 (AMAZON-AES) (AMAZON-AES)
2	23.13.172.203 23.13.172.203	16625 (AKAMAI-AS) (AKAMAI-AS)
1	2600:1408:c40... 2600:1408:c400:5::17c7:3716	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
3	2620:1ec:33::10 2620:1ec:33::10	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
2	162.159.140.229 162.159.140.229	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	104.244.42.131 104.244.42.131	13414 (TWITTER) (TWITTER)
3 5	2620:1ec:21::14 2620:1ec:21::14	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1 1	2606:4700:440... 2606:4700:4400::ac40:92d7	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	13.107.42.14 13.107.42.14	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
2	2620:1ec:bdf::40 2620:1ec:bdf::40	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
2	2607:f8b0:400... 2607:f8b0:4004:c06::68	15169 (GOOGLE) (GOOGLE)
1	2607:f8b0:400... 2607:f8b0:4004:c0b::9d	15169 (GOOGLE) (GOOGLE)
3	2607:f8b0:400... 2607:f8b0:4004:c21::9a	15169 (GOOGLE) (GOOGLE)
1	192.28.144.124 192.28.144.124	15224 (OMNITURE) (OMNITURE)
1 2	20.110.205.119 20.110.205.119	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1 1	2620:1ec:c11:... 2620:1ec:c11::237	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1 2	142.251.163.149 142.251.163.149	15169 (GOOGLE) (GOOGLE)
1	142.251.16.149 142.251.16.149	15169 (GOOGLE) (GOOGLE)
2	20.119.174.243 20.119.174.243	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	2001:4860:480... 2001:4860:4802:34::181	15169 (GOOGLE) (GOOGLE)
1	2607:f8b0:400... 2607:f8b0:4004:c1b::9c	15169 (GOOGLE) (GOOGLE)
2	2a03:2880:f00... 2a03:2880:f003:100:face:b00c:0:3	32934 (FACEBOOK) (FACEBOOK)
1	54.239.153.227 54.239.153.227	16509 (AMAZON-02) (AMAZON-02)
1	2606:4700::68... 2606:4700::6812:1247	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	3.167.72.96 3.167.72.96	16509 (AMAZON-02) (AMAZON-02)
1	34.96.71.22 34.96.71.22	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1	2600:9000:200... 2600:9000:2009:3000:1d:8d6d:3b40:93a1	16509 (AMAZON-02) (AMAZON-02)
1	172.67.75.100 172.67.75.100	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	34.111.208.231 34.111.208.231	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
2	2a03:2880:f10... 2a03:2880:f103:181:face:b00c:0:25de	32934 (FACEBOOK) (FACEBOOK)
2	2607:f8b0:400... 2607:f8b0:4004:c06::61	15169 (GOOGLE) (GOOGLE)
1 6	34.117.77.79 34.117.77.79	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1 2	15.197.193.217 15.197.193.217	16509 (AMAZON-02) (AMAZON-02)
2 2	35.244.154.8 35.244.154.8	15169 (GOOGLE) (GOOGLE)
1 1	35.71.131.137 35.71.131.137	16509 (AMAZON-02) (AMAZON-02)
2 2	68.67.160.184 68.67.160.184	29990 (ASN-APPNEX) (ASN-APPNEX)
2 3	50.16.174.192 50.16.174.192	14618 (AMAZON-AES) (AMAZON-AES)
174	44

64 34.96.108.115 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 115.108.96.34.bc.googleusercontent.com

origin-unit42.paloaltonetworks.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

21 2600:1408:ac00:19b::1e80 (Ashburn, United States)

ASN20940 (AKAMAI-ASN1, NL)

assets.adobedtm.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:1408:c400:180::c3a (Ashburn, United States)

ASN20940 (AKAMAI-ASN1, NL)

www.paloaltonetworks.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 146.75.76.157 (Chicago, United States)

ASN54113 (FASTLY, US)

static.ads-twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 52.20.18.175 (Ashburn, United States) 1 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-20-18-175.compute-1.amazonaws.com

dpm.demdex.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

11 2606:4700::6812:572a (United States)

ASN13335 (CLOUDFLARENET, US)

cdn.cookielaw.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 63.140.39.9 (United States)

ASN14618 (AMAZON-AES, US)
PTR: ip-63-140-39-9.data.adobedc.net

sstats.paloaltonetworks.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:4400::6812:2089 (United States)

ASN13335 (CLOUDFLARENET, US)

geolocation.onetrust.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2607:f8b0:4004:c0b::61 (Washington, United States)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 18.160.10.89 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-160-10-89.iad12.r.cloudfront.net

scripts.demandbase.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
tag.demandbase.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 13.249.39.123 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-249-39-123.iad89.r.cloudfront.net

api.company-target.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 63.140.39.82 (United States)

ASN14618 (AMAZON-AES, US)
PTR: ip-63-140-39-82.data.adobedc.net

paloaltonetworks.tt.omtrdc.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 23.13.172.203 (Ashburn, United States)

ASN16625 (AKAMAI-AS, US)
PTR: a23-13-172-203.deploy.static.akamaitechnologies.com

munchkin.marketo.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:1408:c400:5::17c7:3716 (Ashburn, United States)

ASN20940 (AKAMAI-ASN1, NL)

snap.licdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2620:1ec:33::10 (United States)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

bat.bing.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 162.159.140.229 (None, )

ASN13335 (CLOUDFLARENET, US)

t.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 104.244.42.131 (United States)

ASN13414 (TWITTER, US)

analytics.twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2620:1ec:21::14 (United States) 3 redirects

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

px.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:4400::ac40:92d7 (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

www.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.107.42.14 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

px4.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2620:1ec:bdf::40 (United States)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

www.clarity.ms	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2607:f8b0:4004:c06::68 (Washington, United States)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2607:f8b0:4004:c0b::9d (Washington, United States)

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2607:f8b0:4004:c21::9a (Washington, United States)

ASN15169 (GOOGLE, US)

td.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 192.28.144.124 (United States)

ASN15224 (OMNITURE, US)

531-ocs-018.mktoresp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 20.110.205.119 (Boydton, United States) 1 redirects

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

c.clarity.ms	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2620:1ec:c11::237 (United States) 1 redirects

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

c.bing.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 142.251.163.149 (Farmingdale, United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: wv-in-f149.1e100.net

12123386.fls.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.251.16.149 (Farmingdale, United States)

ASN15169 (GOOGLE, US)
PTR: bl-in-f149.1e100.net

ad.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 20.119.174.243 (Boydton, United States)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

r.clarity.ms	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2001:4860:4802:34::181 (United States)

ASN15169 (GOOGLE, US)

analytics.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2607:f8b0:4004:c1b::9c (Washington, United States)

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f003:100:face:b00c:0:3 (Ashburn, United States)

ASN32934 (FACEBOOK, US)

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 54.239.153.227 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-54-239-153-227.iad50.r.cloudfront.net

d10lpsik1i8c69.cloudfront.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6812:1247 (United States)

ASN13335 (CLOUDFLARENET, US)

trk.techtarget.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 3.167.72.96 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-3-167-72-96.iad61.r.cloudfront.net

js.adsrvr.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.96.71.22 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 22.71.96.34.bc.googleusercontent.com

s.company-target.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:2009:3000:1d:8d6d:3b40:93a1 (United States)

ASN16509 (AMAZON-02, US)

tag-logger.demandbase.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 172.67.75.100 (United States)

ASN13335 (CLOUDFLARENET, US)

settings.luckyorange.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 34.111.208.231 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 231.208.111.34.bc.googleusercontent.com

ibc-flow.techtarget.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f103:181:face:b00c:0:25de (Ashburn, United States)

ASN32934 (FACEBOOK, US)

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2607:f8b0:4004:c06::61 (Washington, United States)

ASN15169 (GOOGLE, US)

ssl.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 34.117.77.79 (Kansas City, United States) 1 redirects

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 79.77.117.34.bc.googleusercontent.com

ml314.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 15.197.193.217 (Seattle, United States) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: a12b7a488abeaa9e4.awsglobalaccelerator.com

insight.adsrvr.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
match.adsrvr.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 35.244.154.8 (Kansas City, United States) 2 redirects

ASN15169 (GOOGLE, US)
PTR: 8.154.244.35.bc.googleusercontent.com

idsync.rlcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.71.131.137 (United States) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: a6370ebea231e0c9a.awsglobalaccelerator.com

match.adsrvr.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 68.67.160.184 (Colonia, United States) 2 redirects

ASN29990 (ASN-APPNEX, US)
PTR: 669.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net

ib.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 50.16.174.192 (Ashburn, United States) 2 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-50-16-174-192.compute-1.amazonaws.com

ps.eyeota.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
67	paloaltonetworks.com origin-unit42.paloaltonetworks.com develop.paloaltonetworks.com Failed www.paloaltonetworks.com — Cisco Umbrella Rank: 116265 sstats.paloaltonetworks.com — Cisco Umbrella Rank: 147388	2 MB
21	adobedtm.com assets.adobedtm.com — Cisco Umbrella Rank: 430	178 KB
11	cookielaw.org cdn.cookielaw.org — Cisco Umbrella Rank: 326	185 KB
8	doubleclick.net 1 redirects googleads.g.doubleclick.net — Cisco Umbrella Rank: 42 td.doubleclick.net — Cisco Umbrella Rank: 192 12123386.fls.doubleclick.net — Cisco Umbrella Rank: 316421 ad.doubleclick.net — Cisco Umbrella Rank: 150 stats.g.doubleclick.net — Cisco Umbrella Rank: 136	4 KB
7	linkedin.com 4 redirects px.ads.linkedin.com — Cisco Umbrella Rank: 321 www.linkedin.com — Cisco Umbrella Rank: 646 px4.ads.linkedin.com — Cisco Umbrella Rank: 6828	5 KB
6	ml314.com 1 redirects ml314.com — Cisco Umbrella Rank: 1614	40 KB
6	clarity.ms 1 redirects www.clarity.ms — Cisco Umbrella Rank: 634 c.clarity.ms — Cisco Umbrella Rank: 1236 r.clarity.ms — Cisco Umbrella Rank: 6682	30 KB
6	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 39	397 KB
4	adsrvr.org 2 redirects js.adsrvr.org — Cisco Umbrella Rank: 1442 insight.adsrvr.org — Cisco Umbrella Rank: 945 match.adsrvr.org — Cisco Umbrella Rank: 373	7 KB
4	bing.com 1 redirects bat.bing.com — Cisco Umbrella Rank: 348 c.bing.com — Cisco Umbrella Rank: 190	17 KB
4	demdex.net 1 redirects dpm.demdex.net — Cisco Umbrella Rank: 243	3 KB
3	eyeota.net 2 redirects ps.eyeota.net — Cisco Umbrella Rank: 1074	2 KB
3	techtarget.com trk.techtarget.com — Cisco Umbrella Rank: 25487 ibc-flow.techtarget.com — Cisco Umbrella Rank: 23670	2 KB
3	google.com www.google.com — Cisco Umbrella Rank: 3 analytics.google.com — Cisco Umbrella Rank: 147	64 B
3	company-target.com api.company-target.com — Cisco Umbrella Rank: 4087 s.company-target.com — Cisco Umbrella Rank: 1520	2 KB
3	demandbase.com scripts.demandbase.com — Cisco Umbrella Rank: 8945 tag.demandbase.com — Cisco Umbrella Rank: 5931 tag-logger.demandbase.com — Cisco Umbrella Rank: 5266	21 KB
2	adnxs.com 2 redirects ib.adnxs.com — Cisco Umbrella Rank: 267	2 KB
2	rlcdn.com 2 redirects idsync.rlcdn.com — Cisco Umbrella Rank: 462	833 B
2	google-analytics.com ssl.google-analytics.com — Cisco Umbrella Rank: 927	18 KB
2	facebook.com www.facebook.com — Cisco Umbrella Rank: 113	3 KB
2	facebook.net connect.facebook.net — Cisco Umbrella Rank: 180	72 KB
2	twitter.com analytics.twitter.com — Cisco Umbrella Rank: 962	839 B
2	t.co t.co — Cisco Umbrella Rank: 859	791 B
2	marketo.net munchkin.marketo.net — Cisco Umbrella Rank: 3657	6 KB
2	omtrdc.net paloaltonetworks.tt.omtrdc.net — Cisco Umbrella Rank: 299576	1 KB
1	luckyorange.net settings.luckyorange.net — Cisco Umbrella Rank: 13599	777 B
1	cloudfront.net d10lpsik1i8c69.cloudfront.net	3 KB
1	mktoresp.com 531-ocs-018.mktoresp.com — Cisco Umbrella Rank: 303595	318 B
1	licdn.com snap.licdn.com — Cisco Umbrella Rank: 784	14 KB
1	onetrust.com geolocation.onetrust.com — Cisco Umbrella Rank: 498	305 B
1	ads-twitter.com static.ads-twitter.com — Cisco Umbrella Rank: 960	16 KB
0	quora.com Failed a.quora.com Failed
174	32

	Domain	Requested by
64	origin-unit42.paloaltonetworks.com	origin-unit42.paloaltonetworks.com
21	assets.adobedtm.com	origin-unit42.paloaltonetworks.com assets.adobedtm.com
11	cdn.cookielaw.org	assets.adobedtm.com cdn.cookielaw.org
6	ml314.com	1 redirects origin-unit42.paloaltonetworks.com ml314.com
6	www.googletagmanager.com	assets.adobedtm.com www.googletagmanager.com
5	px.ads.linkedin.com	3 redirects snap.licdn.com
4	dpm.demdex.net	1 redirects origin-unit42.paloaltonetworks.com assets.adobedtm.com
3	ps.eyeota.net	2 redirects
3	td.doubleclick.net	www.googletagmanager.com
3	bat.bing.com	assets.adobedtm.com bat.bing.com
2	ib.adnxs.com	2 redirects
2	idsync.rlcdn.com	2 redirects
2	match.adsrvr.org	1 redirects js.adsrvr.org
2	ssl.google-analytics.com	origin-unit42.paloaltonetworks.com
2	www.facebook.com
2	ibc-flow.techtarget.com	trk.techtarget.com
2	connect.facebook.net	origin-unit42.paloaltonetworks.com connect.facebook.net
2	r.clarity.ms	www.clarity.ms
2	12123386.fls.doubleclick.net	1 redirects www.googletagmanager.com
2	c.clarity.ms	1 redirects
2	www.google.com	www.googletagmanager.com
2	www.clarity.ms	bat.bing.com www.clarity.ms
2	analytics.twitter.com
2	t.co
2	munchkin.marketo.net	assets.adobedtm.com munchkin.marketo.net
2	paloaltonetworks.tt.omtrdc.net	assets.adobedtm.com
2	api.company-target.com	assets.adobedtm.com tag.demandbase.com
2	sstats.paloaltonetworks.com	assets.adobedtm.com
1	insight.adsrvr.org	1 redirects
1	settings.luckyorange.net	d10lpsik1i8c69.cloudfront.net
1	tag-logger.demandbase.com	tag.demandbase.com
1	s.company-target.com	tag.demandbase.com
1	js.adsrvr.org	assets.adobedtm.com
1	trk.techtarget.com	origin-unit42.paloaltonetworks.com
1	tag.demandbase.com	origin-unit42.paloaltonetworks.com
1	d10lpsik1i8c69.cloudfront.net	origin-unit42.paloaltonetworks.com
1	stats.g.doubleclick.net	www.googletagmanager.com
1	analytics.google.com	www.googletagmanager.com
1	ad.doubleclick.net
1	c.bing.com	1 redirects
1	531-ocs-018.mktoresp.com	munchkin.marketo.net
1	googleads.g.doubleclick.net	www.googletagmanager.com
1	px4.ads.linkedin.com
1	www.linkedin.com	1 redirects
1	snap.licdn.com	assets.adobedtm.com
1	scripts.demandbase.com	assets.adobedtm.com
1	geolocation.onetrust.com	cdn.cookielaw.org
1	static.ads-twitter.com	assets.adobedtm.com
1	www.paloaltonetworks.com	origin-unit42.paloaltonetworks.com
0	a.quora.com Failed	origin-unit42.paloaltonetworks.com
0	develop.paloaltonetworks.com Failed	origin-unit42.paloaltonetworks.com
174	51

This site contains links to these domains. Also see Links.

Domain
www.paloaltonetworks.com
unit42.paloaltonetworks.com
start.paloaltonetworks.com
www.facebook.com
www.linkedin.com
twitter.com
www.reddit.com
mastodon.social
en.wikipedia.org
www.justice.gov
docs-cortex.paloaltonetworks.com
docs.paloaltonetworks.com
www.cisa.gov
adlumin.com
thehackernews.com
securelist.com
learn.microsoft.com
attack.mitre.org
threatfox.abuse.ch
www.security.com
www.microsoft.com
redcanary.com
github.com
www.cyberthreatalliance.org
jobs.paloaltonetworks.com
investors.paloaltonetworks.com
events.paloaltonetworks.com
panwedd.exterro.net
www.youtube.com

Subject Issuer	Validity	Valid
unit42.paloaltonetworks.com Go Daddy Secure Certificate Authority - G2	`2024-08-09` - `2025-09-10`	a year	crt.sh
assets.adobedtm.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2024-07-09` - `2025-08-09`	a year	crt.sh
*.paloaltonetworks.com DigiCert TLS RSA SHA256 2020 CA1	`2024-03-31` - `2025-04-02`	a year	crt.sh
ads-twitter.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2024-06-25` - `2025-06-24`	a year	crt.sh
cookielaw.org WE1	`2024-10-11` - `2025-01-09`	3 months	crt.sh
sstats.paloaltonetworks.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2024-07-20` - `2025-08-20`	a year	crt.sh
geolocation.onetrust.com WE1	`2024-10-11` - `2025-01-09`	3 months	crt.sh
*.google-analytics.com WR2	`2024-10-07` - `2024-12-30`	3 months	crt.sh
*.demdex.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2024-09-25` - `2025-10-26`	a year	crt.sh
tag.demandbase.com Go Daddy Secure Certificate Authority - G2	`2024-08-27` - `2025-09-28`	a year	crt.sh
api.demandbase.com Go Daddy Secure Certificate Authority - G2	`2024-08-13` - `2025-09-14`	a year	crt.sh
*.tt.omtrdc.net DigiCert TLS RSA SHA256 2020 CA1	`2024-02-26` - `2025-03-28`	a year	crt.sh
*.marketo.net DigiCert TLS RSA SHA256 2020 CA1	`2023-12-08` - `2024-12-11`	a year	crt.sh
snap.licdn.com DigiCert SHA2 Secure Server CA	`2023-12-13` - `2024-12-12`	a year	crt.sh
www.bing.com Microsoft Azure RSA TLS Issuing CA 03	`2024-09-16` - `2025-03-15`	6 months	crt.sh
t.co E5	`2024-09-28` - `2024-12-27`	3 months	crt.sh
*.twitter.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2024-10-07` - `2025-10-06`	a year	crt.sh
www.linkedin.com DigiCert SHA2 Secure Server CA	`2024-10-14` - `2025-04-14`	6 months	crt.sh
www.clarity.ms DigiCert TLS RSA SHA256 2020 CA1	`2024-09-04` - `2025-09-04`	a year	crt.sh
*.google.com WR2	`2024-10-07` - `2024-12-30`	3 months	crt.sh
*.g.doubleclick.net WR2	`2024-10-07` - `2024-12-30`	3 months	crt.sh
*.doubleclick.net WR2	`2024-10-07` - `2024-12-30`	3 months	crt.sh
*.mktoresp.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2024-08-15` - `2025-09-15`	a year	crt.sh
a.clarity.ms Microsoft Azure RSA TLS Issuing CA 08	`2024-06-23` - `2025-06-18`	a year	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2024-08-09` - `2024-11-07`	3 months	crt.sh
*.cloudfront.net Amazon RSA 2048 M01	`2024-07-30` - `2025-07-03`	a year	crt.sh
trk.techtarget.com WE1	`2024-09-20` - `2024-12-19`	3 months	crt.sh
*.adsrvr.org GlobalSign GCC R3 DV TLS CA 2020	`2024-04-23` - `2025-05-25`	a year	crt.sh
*.company-target.com R10	`2024-10-14` - `2025-01-12`	3 months	crt.sh
*.demandbase.com Amazon RSA 2048 M02	`2024-06-10` - `2025-07-08`	a year	crt.sh
luckyorange.net WE1	`2024-09-23` - `2024-12-22`	3 months	crt.sh
ibc-flow.techtarget.com WR3	`2024-10-24` - `2025-01-22`	3 months	crt.sh
event-horizon.gcp.bomm.in WR3	`2024-10-18` - `2025-01-16`	3 months	crt.sh

This page contains 8 frames:

Primary Page: https://origin-unit42.paloaltonetworks.com/north-korean-threat-group-play-ransomware/
Frame ID: 593EC67C90C9AD1FFB239DB135C7ABD0
Requests: 166 HTTP requests in this frame

Frame: https://td.doubleclick.net/td/rul/836073641?random=1730368261299&cv=11&fst=1730368261299&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be4as0v873032592za200&gcd=13l3l3l3l1l1&dma=0&tag_exp=101533421~101823848~101878899~101878944~101925629&u_w=1600&u_h=1200&url=https%3A%2F%2Forigin-unit42.paloaltonetworks.com%2Fnorth-korean-threat-group-play-ransomware%2F&hn=www.googleadservices.com&frm=0&tiba=Jumpy%20Pisces%20Engages%20in%20Play%20Ransomware&npa=0&pscdl=noapi&auid=742671459.1730368261&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&data=event%3Dgtag.config
Frame ID: A5503769EAFAD35B4B854EDEBD1B0D10
Requests: 1 HTTP requests in this frame

Frame: https://www.googletagmanager.com/static/service_worker/4al0/sw_iframe.html?origin=https%3A%2F%2Forigin-unit42.paloaltonetworks.com
Frame ID: 60AEE19FD464E9EABEDC7055FC0DCAEE
Requests: 1 HTTP requests in this frame

Frame: https://12123386.fls.doubleclick.net/activityi;dc_pre=CPKm0oysuIkDFdayWgUdrjAYFw;src=12123386;type=allpa0;cat=globa0;ord=7965954316435;npa=0;auiddc=742671459.1730368261;u1=https%3A%2F%2Forigin-unit42.paloaltonetworks.com%2Fnorth-korean-threat-group-play-ransomware%2F;ps=1;pcor=632655843;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=noapi;frm=0;gtm=45fe4au0h2v9190796217za200;gcd=13l3l3l3l1l1;dma=0;tag_exp=101533421~101823848~101878899~101878944~101925629;epver=2;~oref=https%3A%2F%2Forigin-unit42.paloaltonetworks.com%2Fnorth-korean-threat-group-play-ransomware%2F
Frame ID: 9FBC20FA569CBDE3160DFB61EB6F6E06
Requests: 1 HTTP requests in this frame

Frame: https://td.doubleclick.net/td/fls/rul/activityi;fledge=1;src=12123386;type=allpa0;cat=globa0;ord=7965954316435;npa=0;auiddc=742671459.1730368261;u1=https%3A%2F%2Forigin-unit42.paloaltonetworks.com%2Fnorth-korean-threat-group-play-ransomware%2F;ps=1;pcor=632655843;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=noapi;frm=0;gtm=45fe4au0h2v9190796217za200;gcd=13l3l3l3l1l1;dma=0;tag_exp=101533421~101823848~101878899~101878944~101925629;epver=2;~oref=https%3A%2F%2Forigin-unit42.paloaltonetworks.com%2Fnorth-korean-threat-group-play-ransomware%2F
Frame ID: CE74313DB2AAEFA5E4A3F3BCD96AD7A9
Requests: 1 HTTP requests in this frame

Frame: https://td.doubleclick.net/td/ga/rul?tid=G-KS2MELEEFC&gacid=117368376.1730368262&gtm=45je4as0v880354802za200&dma=0&gcd=13l3l3l3l1l1&npa=0&pscdl=noapi&aip=1&fledge=1&frm=0&tag_exp=101533421~101823848~101878899~101878944~101925629&z=2075528921
Frame ID: C05FEE891CDB9BAFC478F0CCFB8B1FAE
Requests: 1 HTTP requests in this frame

Frame: https://s.company-target.com/s/sync?exc=lr
Frame ID: EAADE2E3921219B64987172151EC9441
Requests: 1 HTTP requests in this frame

Frame: https://match.adsrvr.org/track/upb/?adv=4vc17dm&ref=https%3A%2F%2Forigin-unit42.paloaltonetworks.com%2Fnorth-korean-threat-group-play-ransomware%2F&upid=jnrvx4g&upv=1.1.0&paapi=1
Frame ID: AD890F381B51E69DBA51B0242A388D4C
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Jumpy Pisces Engages in Play Ransomware

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

/wp-(?:content|includes)/

Facebook (Widgets) Expand

Overall confidence: 100%
Detected patterns

//connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

google-analytics\.com/(?:ga|urchin|analytics)\.js

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtag/js

Linkedin Insight Tag (Analytics) Expand

Overall confidence: 100%
Detected patterns

snap\.licdn\.com/li\.lms-analytics/insight\.min\.js

Marketo (Marketing Automation) Expand

Overall confidence: 100%
Detected patterns

munchkin\.marketo\.\w+/(?:([\d.]+)/)?munchkin\.js

OneTrust (Cookie compliance) Expand

Overall confidence: 100%
Detected patterns

cdn\.cookielaw\.org
otSDKStub\.js

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

jQuery Migrate (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]migrate(?:-([\d.]+))?(?:\.min)?\.js(?:\?ver=([\d.]+))?

Page Statistics

174
Requests

55 %
HTTPS

44 %
IPv6

32
Domains

51
Subdomains

44
IPs

2
Countries

3486 kB
Transfer

6582 kB
Size

86
Cookies

100 Outgoing links

These are links going to different origins than the main page.

URL: https://www.paloaltonetworks.com/

Search URL Search Domain Scan URL

URL: https://unit42.paloaltonetworks.com/atoms/
Title: ATOMs

Search URL Search Domain Scan URL

URL: https://www.paloaltonetworks.com/unit42
Title: Security Consulting

Search URL Search Domain Scan URL

URL: https://start.paloaltonetworks.com/contact-unit42.html
Title: Under Attack?

Search URL Search Domain Scan URL

URL: https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Forigin-unit42.paloaltonetworks.com%2Fnorth-korean-threat-group-play-ransomware%2F

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Forigin-unit42.paloaltonetworks.com%2Fnorth-korean-threat-group-play-ransomware%2F&title=Jumpy%20Pisces%20Engages%20in%20Play%20Ransomware

Search URL Search Domain Scan URL

URL: https://twitter.com/intent/tweet?url=https%3A%2F%2Forigin-unit42.paloaltonetworks.com%2Fnorth-korean-threat-group-play-ransomware%2F&text=Jumpy%20Pisces%20Engages%20in%20Play%20Ransomware

Search URL Search Domain Scan URL

URL: https://www.reddit.com/submit?url=https%3A%2F%2Forigin-unit42.paloaltonetworks.com%2Fnorth-korean-threat-group-play-ransomware%2F

Search URL Search Domain Scan URL

URL: https://mastodon.social/share?text=Jumpy%20Pisces%20Engages%20in%20Play%20Ransomware%20https%3A%2F%2Forigin-unit42.paloaltonetworks.com%2Fnorth-korean-threat-group-play-ransomware%2F

Search URL Search Domain Scan URL

URL: https://en.wikipedia.org/wiki/Reconnaissance_General_Bureau
Title: Reconnaissance General Bureau

Search URL Search Domain Scan URL

URL: https://en.wikipedia.org/wiki/Initial_access_broker
Title: initial access broker

Search URL Search Domain Scan URL

URL: https://unit42.paloaltonetworks.com/threat-actor-groups-tracked-by-palo-alto-networks-unit-42/
Title: Jumpy Pisces

Search URL Search Domain Scan URL

URL: https://www.justice.gov/opa/pr/north-korean-government-hacker-charged-involvement-ransomware-attacks-targeting-us-hospitals
Title: indicted by the U.S Justice Department

Search URL Search Domain Scan URL

URL: https://docs-cortex.paloaltonetworks.com/p/XDR
Title: Cortex XDR

Search URL Search Domain Scan URL

URL: https://www.paloaltonetworks.com/cortex/cortex-xsiam
Title: XSIAM

Search URL Search Domain Scan URL

URL: https://docs.paloaltonetworks.com/advanced-wildfire
Title: Advanced WildFire

Search URL Search Domain Scan URL

URL: https://docs.paloaltonetworks.com/advanced-url-filtering/administration/url-filtering-basics/how-url-filtering-works
Title: Advanced URL Filtering

Search URL Search Domain Scan URL

URL: https://docs.paloaltonetworks.com/dns-security/administration/about-dns-security
Title: Advanced DNS Security

Search URL Search Domain Scan URL

URL: https://unit42.paloaltonetworks.com/category/threat-actor-groups/
Title: Threat Actor Groups

Search URL Search Domain Scan URL

URL: https://unit42.paloaltonetworks.com/tag/north-korea/
Title: North Korea

Search URL Search Domain Scan URL

URL: https://unit42.paloaltonetworks.com/category/ransomware/
Title: Ransomware

Search URL Search Domain Scan URL

URL: https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-352a
Title: Play ransomware

Search URL Search Domain Scan URL

URL: https://adlumin.com/post/playcrypt-ransomware-as-a-service-expands-threat-from-script-kiddies-and-sophisticated-attackers/
Title: suggest that Fiddling Scorpius

Search URL Search Domain Scan URL

URL: https://www.paloaltonetworks.com/cyberpedia/what-is-ransomware-as-a-service
Title: ransomware-as-a-service

Search URL Search Domain Scan URL

URL: https://www.paloaltonetworks.com/cyberpedia/what-is-a-dark-web-leak-site
Title: leak site

Search URL Search Domain Scan URL

URL: https://thehackernews.com/2023/01/threat-actors-turn-to-sliver-as-open.html
Title: Sliver

Search URL Search Domain Scan URL

URL: https://securelist.com/andariel-deploys-dtrack-and-maui-ransomware/107063/
Title: DTrack

Search URL Search Domain Scan URL

URL: https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/
Title: Server Message Block (SMB)

Search URL Search Domain Scan URL

URL: https://attack.mitre.org/software/S0357/
Title: Impacket

Search URL Search Domain Scan URL

URL: https://unit42.paloaltonetworks.com/attackers-exploit-public-cobalt-strike-profiles/
Title: Cobalt Strike

Search URL Search Domain Scan URL

URL: https://threatfox.abuse.ch/ioc/1259464/
Title: Sliver C2

Search URL Search Domain Scan URL

URL: https://www.security.com/threat-intelligence/stonefly-north-korea-extortion
Title: IP address

Search URL Search Domain Scan URL

URL: https://www.microsoft.com/en-us/security/blog/2024/07/25/onyx-sleet-uses-array-of-malware-to-gather-intelligence-for-north-korea/
Title: domain

Search URL Search Domain Scan URL

URL: https://thehackernews.com/2022/11/north-korean-hackers-targeting-europe.html
Title: reported incidents attributed to North Korean threat groups

Search URL Search Domain Scan URL

URL: https://redcanary.com/threat-detection-report/threats/mimikatz/
Title: Mimikatz

Search URL Search Domain Scan URL

URL: https://learn.microsoft.com/en-us/sysinternals/downloads/psexec
Title: PsExec

Search URL Search Domain Scan URL

URL: https://github.com/S1ckB0y1337/TokenPlayer
Title: TokenPlayer

Search URL Search Domain Scan URL

URL: https://www.paloaltonetworks.com/products/secure-the-network/wildfire?_gl=1*nq7ug8*_ga*NzQyNjM2NzkuMTY2NjY3OTczNw..*_ga_KS2MELEEFC*MTY2OTcyNDAwMC4zMC4xLjE2Njk3MjQwNjEuNjAuMC4w
Title: Advanced WildFire

Search URL Search Domain Scan URL

URL: https://www.paloaltonetworks.com/network-security/advanced-url-filtering?_gl=1*13pmp8e*_ga*NzQyNjM2NzkuMTY2NjY3OTczNw..*_ga_KS2MELEEFC*MTY2OTczNjA2MS4zMS4wLjE2Njk3MzYwNjEuNjAuMC4w
Title: Advanced URL Filtering

Search URL Search Domain Scan URL

URL: https://www.paloaltonetworks.com/network-security/dns-security?_gl=1*13pmp8e*_ga*NzQyNjM2NzkuMTY2NjY3OTczNw..*_ga_KS2MELEEFC*MTY2OTczNjA2MS4zMS4wLjE2Njk3MzYwNjEuNjAuMC4w
Title: Advanced DNS Security

Search URL Search Domain Scan URL

URL: https://www.cyberthreatalliance.org/
Title: Cyber Threat Alliance

Search URL Search Domain Scan URL

URL: https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-187a
Title: North Korean State-Sponsored Cyber Actors Use Maui Ransomware to Target the Healthcare and Public Health Sector

Search URL Search Domain Scan URL

URL: https://www.paloaltonetworks.com/legal-notices/terms-of-use
Title: Terms of Use

Search URL Search Domain Scan URL

URL: https://www.paloaltonetworks.com/legal-notices/privacy
Title: Privacy Statement.

Search URL Search Domain Scan URL

URL: https://www.paloaltonetworks.com/network-security
Title: Network Security Platform

Search URL Search Domain Scan URL

URL: https://www.paloaltonetworks.com/network-security/security-subscriptions
Title: CLOUD DELIVERED SECURITY SERVICES

Search URL Search Domain Scan URL

URL: https://www.paloaltonetworks.com/network-security/advanced-threat-prevention
Title: Advanced Threat Prevention

Search URL Search Domain Scan URL

URL: https://www.paloaltonetworks.com/network-security/advanced-dns-security
Title: DNS Security

Search URL Search Domain Scan URL

URL: https://www.paloaltonetworks.com/network-security/enterprise-data-loss-prevention
Title: Data Loss Prevention

Search URL Search Domain Scan URL

URL: https://www.paloaltonetworks.com/network-security/enterprise-iot-security
Title: IoT Security

Search URL Search Domain Scan URL

URL: https://www.paloaltonetworks.com/network-security/next-generation-firewall
Title: Next-Generation Firewalls

Search URL Search Domain Scan URL

URL: https://www.paloaltonetworks.com/network-security/next-generation-firewall-hardware
Title: Hardware Firewalls

Search URL Search Domain Scan URL

URL: https://www.paloaltonetworks.com/network-security/strata-cloud-manager
Title: Strata Cloud Manager

Search URL Search Domain Scan URL

URL: https://www.paloaltonetworks.com/sase
Title: SECURE ACCESS SERVICE EDGE

Search URL Search Domain Scan URL

URL: https://www.paloaltonetworks.com/sase/access
Title: Prisma Access

Search URL Search Domain Scan URL

URL: https://www.paloaltonetworks.com/sase/sd-wan
Title: Prisma SD-WAN

Search URL Search Domain Scan URL

URL: https://www.paloaltonetworks.com/sase/adem
Title: Autonomous Digital Experience Management

Search URL Search Domain Scan URL

URL: https://www.paloaltonetworks.com/sase/next-gen-casb
Title: Cloud Access Security Broker

Search URL Search Domain Scan URL

URL: https://www.paloaltonetworks.com/sase/ztna
Title: Zero Trust Network Access

Search URL Search Domain Scan URL

URL: https://www.paloaltonetworks.com/prisma/whyprisma
Title: Code to Cloud Platform

Search URL Search Domain Scan URL

URL: https://www.paloaltonetworks.com/prisma/cloud
Title: Prisma Cloud

Search URL Search Domain Scan URL

URL: https://www.paloaltonetworks.com/content/pan/en_US/prisma/cloud/cloud-native-application-protection-platform
Title: Cloud-Native Application Protection Platform

Search URL Search Domain Scan URL

URL: https://www.paloaltonetworks.com/cortex
Title: AI-Driven Security Operations Platform

Search URL Search Domain Scan URL

URL: https://www.paloaltonetworks.com/cortex/cortex-xdr
Title: Cortex XDR

Search URL Search Domain Scan URL

URL: https://www.paloaltonetworks.com/cortex/cortex-xsoar
Title: Cortex XSOAR

Search URL Search Domain Scan URL

URL: https://www.paloaltonetworks.com/cortex/cortex-xpanse
Title: Cortex Xpanse

Search URL Search Domain Scan URL

URL: https://www.paloaltonetworks.com/cortex/cortex-xpanse/attack-surface-management
Title: External Attack Surface Protection

Search URL Search Domain Scan URL

URL: https://www.paloaltonetworks.com/cortex/security-operations-automation
Title: Security Automation

Search URL Search Domain Scan URL

URL: https://www.paloaltonetworks.com/cortex/detection-and-response
Title: Threat Prevention, Detection & Response

Search URL Search Domain Scan URL

URL: https://www.paloaltonetworks.com/unit42/assess
Title: Proactive Assessments

Search URL Search Domain Scan URL

URL: https://www.paloaltonetworks.com/unit42/respond
Title: Incident Response

Search URL Search Domain Scan URL

URL: https://www.paloaltonetworks.com/unit42/transform
Title: Transform Your Security Strategy

Search URL Search Domain Scan URL

URL: https://www.paloaltonetworks.com/unit42/threat-intelligence-partners
Title: Discover Threat Intelligence

Search URL Search Domain Scan URL

URL: https://www.paloaltonetworks.com/about-us
Title: About Us

Search URL Search Domain Scan URL

URL: https://jobs.paloaltonetworks.com/en/
Title: Careers

Search URL Search Domain Scan URL

URL: https://www.paloaltonetworks.com/company/contact-sales
Title: Contact Us

Search URL Search Domain Scan URL

URL: https://www.paloaltonetworks.com/about-us/corporate-responsibility
Title: Corporate Responsibility

Search URL Search Domain Scan URL

URL: https://www.paloaltonetworks.com/customers
Title: Customers

Search URL Search Domain Scan URL

URL: https://investors.paloaltonetworks.com/
Title: Investor Relations

Search URL Search Domain Scan URL

URL: https://www.paloaltonetworks.com/about-us/locations
Title: Location

Search URL Search Domain Scan URL

URL: https://www.paloaltonetworks.com/company/newsroom
Title: Newsroom

Search URL Search Domain Scan URL

URL: https://www.paloaltonetworks.com/blog/
Title: Blog

Search URL Search Domain Scan URL

URL: https://www.paloaltonetworks.com/communities
Title: Communities

Search URL Search Domain Scan URL

URL: https://www.paloaltonetworks.com/resources
Title: Content Library

Search URL Search Domain Scan URL

URL: https://www.paloaltonetworks.com/cyberpedia
Title: Cyberpedia

Search URL Search Domain Scan URL

URL: https://events.paloaltonetworks.com/
Title: Event Center

Search URL Search Domain Scan URL

URL: https://start.paloaltonetworks.com/preference-center
Title: Manage Email Preferences

Search URL Search Domain Scan URL

URL: https://www.paloaltonetworks.com/products/products-a-z
Title: Products A-Z

Search URL Search Domain Scan URL

URL: https://www.paloaltonetworks.com/legal-notices/trust-center/tech-certs
Title: Product Certifications

Search URL Search Domain Scan URL

URL: https://www.paloaltonetworks.com/security-disclosure
Title: Report a Vulnerability

Search URL Search Domain Scan URL

URL: https://www.paloaltonetworks.com/sitemap
Title: Sitemap

Search URL Search Domain Scan URL

URL: https://docs.paloaltonetworks.com/
Title: Tech Docs

Search URL Search Domain Scan URL

URL: https://unit42.paloaltonetworks.com/
Title: Unit 42

Search URL Search Domain Scan URL

URL: https://panwedd.exterro.net/portal/dsar.htm?target=panwedd
Title: Do Not Sell or Share My Personal Information

Search URL Search Domain Scan URL

URL: https://www.paloaltonetworks.com/legal-notices/trust-center
Title: Trust Center

Search URL Search Domain Scan URL

URL: https://www.paloaltonetworks.com/legal
Title: Documents

Search URL Search Domain Scan URL

URL: https://www.youtube.com/user/paloaltonetworks

Search URL Search Domain Scan URL

URL: https://twitter.com/Unit42_Intel

Search URL Search Domain Scan URL

URL: https://www.facebook.com/PaloAltoNetworks/

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/company/palo-alto-networks

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 67

https://dpm.demdex.net/id?d_visid_ver=5.5.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=9A531C8B532965080A490D4D%40AdobeOrg&d_nsid=0&ts=1730368259825 HTTP 302
https://dpm.demdex.net/id/rd?d_visid_ver=5.5.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=9A531C8B532965080A490D4D%40AdobeOrg&d_nsid=0&ts=1730368259825

Request Chain 110

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=1117&time=1730368261066&li_adsId=dea088e3-884b-4eee-9875-734f9dfb88f9&url=https%3A%2F%2Forigin-unit42.paloaltonetworks.com%2Fnorth-korean-threat-group-play-ransomware%2F HTTP 302
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=1117&time=1730368261066&li_adsId=dea088e3-884b-4eee-9875-734f9dfb88f9&url=https%3A%2F%2Forigin-unit42.paloaltonetworks.com%2Fnorth-korean-threat-group-play-ransomware%2F&cookiesTest=true HTTP 302
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D1117%26time%3D1730368261066%26li_adsId%3Ddea088e3-884b-4eee-9875-734f9dfb88f9%26url%3Dhttps%253A%252F%252Forigin-unit42.paloaltonetworks.com%252Fnorth-korean-threat-group-play-ransomware%252F%26cookiesTest%3Dtrue%26liSync%3Dtrue HTTP 302
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=1117&time=1730368261066&li_adsId=dea088e3-884b-4eee-9875-734f9dfb88f9&url=https%3A%2F%2Forigin-unit42.paloaltonetworks.com%2Fnorth-korean-threat-group-play-ransomware%2F&cookiesTest=true&liSync=true HTTP 302
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=1117&time=1730368261066&li_adsId=dea088e3-884b-4eee-9875-734f9dfb88f9&url=https%3A%2F%2Forigin-unit42.paloaltonetworks.com%2Fnorth-korean-threat-group-play-ransomware%2F&cookiesTest=true&liSync=true&e_ipv6=AQJYLIdWvYxdAQAAAZLh_E4hiuaMmpAQIaoQXLGhVB-vDPrFrjBCfgmvheZPxB2bRTMcsXHqwZD_Vq-TCc6Zc1-pev-BSEA

Request Chain 125

https://c.clarity.ms/c.gif HTTP 302
https://c.bing.com/c.gif?ctsa=mr&CtsSyncId=4BC444B6A0514864B39C219719D6CE5C&RedC=c.clarity.ms&MXFR=13C26189005B6A9A018174A0045B6459 HTTP 302
https://c.clarity.ms/c.gif?ctsa=mr&CtsSyncId=4BC444B6A0514864B39C219719D6CE5C&MUID=15E365BC15816FD02475709514E36E87

Request Chain 126

https://12123386.fls.doubleclick.net/activityi;src=12123386;type=allpa0;cat=globa0;ord=7965954316435;npa=0;auiddc=742671459.1730368261;u1=https%3A%2F%2Forigin-unit42.paloaltonetworks.com%2Fnorth-korean-threat-group-play-ransomware%2F;ps=1;pcor=632655843;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=noapi;frm=0;gtm=45fe4au0h2v9190796217za200;gcd=13l3l3l3l1l1;dma=0;tag_exp=101533421~101823848~101878899~101878944~101925629;epver=2;~oref=https%3A%2F%2Forigin-unit42.paloaltonetworks.com%2Fnorth-korean-threat-group-play-ransomware%2F HTTP 302
https://12123386.fls.doubleclick.net/activityi;dc_pre=CPKm0oysuIkDFdayWgUdrjAYFw;src=12123386;type=allpa0;cat=globa0;ord=7965954316435;npa=0;auiddc=742671459.1730368261;u1=https%3A%2F%2Forigin-unit42.paloaltonetworks.com%2Fnorth-korean-threat-group-play-ransomware%2F;ps=1;pcor=632655843;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=noapi;frm=0;gtm=45fe4au0h2v9190796217za200;gcd=13l3l3l3l1l1;dma=0;tag_exp=101533421~101823848~101878899~101878944~101925629;epver=2;~oref=https%3A%2F%2Forigin-unit42.paloaltonetworks.com%2Fnorth-korean-threat-group-play-ransomware%2F

Request Chain 163

https://insight.adsrvr.org/track/up?adv=4vc17dm&ref=https%3A%2F%2Forigin-unit42.paloaltonetworks.com%2Fnorth-korean-threat-group-play-ransomware%2F&upid=jnrvx4g&upv=1.1.0&paapi=1 HTTP 302
https://match.adsrvr.org/track/upb/?adv=4vc17dm&ref=https%3A%2F%2Forigin-unit42.paloaltonetworks.com%2Fnorth-korean-threat-group-play-ransomware%2F&upid=jnrvx4g&upv=1.1.0&paapi=1

Request Chain 169

https://idsync.rlcdn.com/395886.gif?partner_uid=3648092034157248535 HTTP 307
https://idsync.rlcdn.com/1000.gif?memo=CO6UGBIeChoIARCuXxoTMzY0ODA5MjAzNDE1NzI0ODUzNRAAGg0IhqaNuQYSBQjoBxAAQgBKAA HTTP 307
https://ml314.com/csync.ashx?fp=ed960b81d0f6f1952d3ddfba19e20c2e9e8032bf3ee5e06c5cf2e30cc26fcca4f4cb09cee1a4f8eb&person_id=3648092034157248535&eid=50082

Request Chain 170

https://match.adsrvr.org/track/cmf/generic?ttd_pid=d0tro1j&ttd_tpi=1 HTTP 302
https://ml314.com/utsync.ashx?eid=53819&et=0&fp=b63a40f4-b4dd-441a-b440-82268919ea41&gdpr=0&gdpr_consent=

Request Chain 171

https://ib.adnxs.com/getuid?https://ml314.com/csync.ashx%3Ffp=$UID%26person_id=3648092034157248535%26eid=2 HTTP 307
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fml314.com%2Fcsync.ashx%253Ffp%3D%24UID%2526person_id%3D3648092034157248535%2526eid%3D2 HTTP 302
https://ml314.com/csync.ashx?fp=1872298146528952303&person_id=3648092034157248535&eid=2

Request Chain 172

https://ps.eyeota.net/pixel?pid=r8hrb20&t=gif HTTP 302
https://ps.eyeota.net/pixel/bounce/?pid=r8hrb20&t=gif HTTP 302
https://ml314.com/utsync.ashx?eid=50052&et=0&fp=2Qb9SqfHhzOJ9310CMnYPLSMfVsO0YfkSLJLUaNwavOA&gdpr=0&gdpr_consent=&return=https%3A%2F%2Fps.eyeota.net%2Fmatch%3Fbid%3Dr8hrb20%26uid%3Dnil%26referrer_pid%3Dr8hrb20 HTTP 302
https://ps.eyeota.net/match?bid=r8hrb20&uid=nil&referrer_pid=r8hrb20

174 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
origin-unit42.paloaltonetworks.com/north-korean-threat-group-play-ransomware/ 181 KB
36 KB 1645ms
1549ms Document
text/html 34.96.108.115
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://origin-unit42.paloaltonetworks.com/north-korean-threat-group-play-ransomware/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

34.96.108.115 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

115.108.96.34.bc.googleusercontent.com

Software

Apache /

Resource Hash

badcb3ec01865324d30a9d75a02c6f4c8329695dc7ea62682cc7f4c551883c6f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

alt-svc: clear
content-encoding: gzip
content-length: 36367
content-type: text/html; charset=UTF-8
date: Thu, 31 Oct 2024 09:50:56 GMT
link: <https://origin-unit42.paloaltonetworks.com/wp-json/>; rel="https://api.w.org/", <https://origin-unit42.paloaltonetworks.com/wp-json/wp/v2/posts/137203>; rel="alternate"; title="JSON"; type="application/json", <https://origin-unit42.paloaltonetworks.com/?p=137203>; rel=shortlink
server: Apache
strict-transport-security: max-age=31536000; includeSubDomains
vary: Accept-Encoding
via: 1.1 google

GET criticalTop.min.css
develop.paloaltonetworks.com/etc.clientlibs/panClean/components/mainNavigationComp/clientlibs/panClean/ 0
0

GET criticalTopProductNav.min.css
develop.paloaltonetworks.com/etc.clientlibs/panClean/components/mainNavigationComp/clientlibs/panClean/ 0
0

GET deferedProductNav.min.css
develop.paloaltonetworks.com/etc.clientlibs/panClean/components/mainNavigationComp/clientlibs/panClean/ 0
0

GET
H2 200 crayon.min.css
origin-unit42.paloaltonetworks.com/wp-content/plugins/crayon-syntax-highlighter/css/min/ 20 KB
4 KB 75ms
61ms Stylesheet
text/css 34.96.108.115
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://origin-unit42.paloaltonetworks.com/wp-content/plugins/crayon-syntax-highlighter/css/min/crayon.min.css?ver=_2.7.2_beta

Requested by

Host: origin-unit42.paloaltonetworks.com
URL: https://origin-unit42.paloaltonetworks.com/north-korean-threat-group-play-ransomware/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

34.96.108.115 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

115.108.96.34.bc.googleusercontent.com

Software

Apache /

Resource Hash

e3d961493e244e06bf91a9857442891e2e2ad8d49cf8e0a7781c53f0707443d7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://origin-unit42.paloaltonetworks.com/north-korean-threat-group-play-ransomware/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
content-encoding: gzip
etag: "4ecc-62144eb71bbb1-gzip"
via: 1.1 google
accept-ranges: bytes
alt-svc: clear
content-length: 3959
date: Thu, 31 Oct 2024 09:50:58 GMT
last-modified: Wed, 04 Sep 2024 06:02:31 GMT
vary: Accept-Encoding
server: Apache
content-type: text/css

GET
H2 200 classic.css
origin-unit42.paloaltonetworks.com/wp-content/plugins/crayon-syntax-highlighter/themes/classic/ 4 KB
841 B 65ms
51ms Stylesheet
text/css 34.96.108.115
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://origin-unit42.paloaltonetworks.com/wp-content/plugins/crayon-syntax-highlighter/themes/classic/classic.css?ver=_2.7.2_beta

Requested by

Host: origin-unit42.paloaltonetworks.com
URL: https://origin-unit42.paloaltonetworks.com/north-korean-threat-group-play-ransomware/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

34.96.108.115 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

115.108.96.34.bc.googleusercontent.com

Software

Apache /

Resource Hash

01e43870a4218fe731a3516dd76725698c3aadfb285465086849c6b52ef71719

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://origin-unit42.paloaltonetworks.com/north-korean-threat-group-play-ransomware/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
content-encoding: gzip
etag: "1110-62144eb724851-gzip"
via: 1.1 google
accept-ranges: bytes
alt-svc: clear
content-length: 727
date: Thu, 31 Oct 2024 09:50:58 GMT
last-modified: Wed, 04 Sep 2024 06:02:31 GMT
vary: Accept-Encoding
server: Apache
content-type: text/css

GET
H2 200 monaco.css
origin-unit42.paloaltonetworks.com/wp-content/plugins/crayon-syntax-highlighter/fonts/ 529 B
317 B 66ms
52ms Stylesheet
text/css 34.96.108.115
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://origin-unit42.paloaltonetworks.com/wp-content/plugins/crayon-syntax-highlighter/fonts/monaco.css?ver=_2.7.2_beta

Requested by

Host: origin-unit42.paloaltonetworks.com
URL: https://origin-unit42.paloaltonetworks.com/north-korean-threat-group-play-ransomware/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

34.96.108.115 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

115.108.96.34.bc.googleusercontent.com

Software

Apache /

Resource Hash

8b33eebc11529672afc8f1ac6d5d4ef24bed8dfec1505a2510c805e0dd21565f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://origin-unit42.paloaltonetworks.com/north-korean-threat-group-play-ransomware/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
content-encoding: gzip
etag: "211-62144eb71daf1-gzip"
via: 1.1 google
accept-ranges: bytes
alt-svc: clear
content-length: 240
date: Thu, 31 Oct 2024 09:50:58 GMT
last-modified: Wed, 04 Sep 2024 06:02:31 GMT
vary: Accept-Encoding
server: Apache
content-type: text/css

GET
H2 200 frontend.min.css
origin-unit42.paloaltonetworks.com/wp-content/plugins/post-views-counter/css/ 1 KB
519 B 65ms
51ms Stylesheet
text/css 34.96.108.115
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://origin-unit42.paloaltonetworks.com/wp-content/plugins/post-views-counter/css/frontend.min.css?ver=1.4.7

Requested by

Host: origin-unit42.paloaltonetworks.com
URL: https://origin-unit42.paloaltonetworks.com/north-korean-threat-group-play-ransomware/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

34.96.108.115 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

115.108.96.34.bc.googleusercontent.com

Software

Apache /

Resource Hash

0d585aebb9cb31821fbcc6b030e0d882b5639e17bb403f8eb5ce7b3b19f4a1c9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://origin-unit42.paloaltonetworks.com/north-korean-threat-group-play-ransomware/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
content-encoding: gzip
etag: "422-62144eb7351f1-gzip"
via: 1.1 google
accept-ranges: bytes
alt-svc: clear
content-length: 440
date: Thu, 31 Oct 2024 09:50:58 GMT
last-modified: Wed, 04 Sep 2024 06:02:31 GMT
vary: Accept-Encoding
server: Apache
content-type: text/css

GET
H2 200 style.min.css
origin-unit42.paloaltonetworks.com/wp-content/plugins/sitepress-multilingual-cms/templates/language-switchers/legacy-post-translations/ 563 B
317 B 78ms
65ms Stylesheet
text/css 34.96.108.115
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://origin-unit42.paloaltonetworks.com/wp-content/plugins/sitepress-multilingual-cms/templates/language-switchers/legacy-post-translations/style.min.css?ver=1

Requested by

Host: origin-unit42.paloaltonetworks.com
URL: https://origin-unit42.paloaltonetworks.com/north-korean-threat-group-play-ransomware/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

34.96.108.115 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

115.108.96.34.bc.googleusercontent.com

Software

Apache /

Resource Hash

2fff39fc60bd268cd34d270f80d39a61bd875100c73d7cfb3ac2c93166e8542d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://origin-unit42.paloaltonetworks.com/north-korean-threat-group-play-ransomware/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
content-encoding: gzip
etag: "233-62144eb7b7011-gzip"
via: 1.1 google
accept-ranges: bytes
alt-svc: clear
content-length: 216
date: Thu, 31 Oct 2024 09:50:58 GMT
last-modified: Wed, 04 Sep 2024 06:02:32 GMT
vary: Accept-Encoding
server: Apache
content-type: text/css

GET
H2 200 style.css
origin-unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/ 5 KB
2 KB 74ms
61ms Stylesheet
text/css 34.96.108.115
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://origin-unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/style.css?ver=1.0.0

Requested by

Host: origin-unit42.paloaltonetworks.com
URL: https://origin-unit42.paloaltonetworks.com/north-korean-threat-group-play-ransomware/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

34.96.108.115 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

115.108.96.34.bc.googleusercontent.com

Software

Apache /

Resource Hash

3445e7970c35d64108c64d0e3eb91bf15fd1315e67322b30edc57229a1a20397

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://origin-unit42.paloaltonetworks.com/north-korean-threat-group-play-ransomware/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
content-encoding: gzip
etag: "144b-62144eb8e5bd1-gzip"
via: 1.1 google
accept-ranges: bytes
alt-svc: clear
content-length: 1641
date: Thu, 31 Oct 2024 09:50:58 GMT
last-modified: Wed, 04 Sep 2024 06:02:33 GMT
vary: Accept-Encoding
server: Apache
content-type: text/css

GET
H2 200 head-styles.css
origin-unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/css/ 15 KB
2 KB 64ms
51ms Stylesheet
text/css 34.96.108.115
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://origin-unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/css/head-styles.css?ver=1.0.0

Requested by

Host: origin-unit42.paloaltonetworks.com
URL: https://origin-unit42.paloaltonetworks.com/north-korean-threat-group-play-ransomware/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

34.96.108.115 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

115.108.96.34.bc.googleusercontent.com

Software

Apache /

Resource Hash

27ecea73e029d8b688971e5d15703224f46a89e698a5e3950e948efb83f949e0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://origin-unit42.paloaltonetworks.com/north-korean-threat-group-play-ransomware/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
content-encoding: gzip
etag: "3d81-62144eb8b6dd1-gzip"
via: 1.1 google
accept-ranges: bytes
alt-svc: clear
content-length: 2261
date: Thu, 31 Oct 2024 09:50:58 GMT
last-modified: Wed, 04 Sep 2024 06:02:33 GMT
vary: Accept-Encoding
server: Apache
content-type: text/css

GET
H2 200 main.css
origin-unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/css/ 79 KB
15 KB 77ms
65ms Stylesheet
text/css 34.96.108.115
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://origin-unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/css/main.css?ver=1.0.0

Requested by

Host: origin-unit42.paloaltonetworks.com
URL: https://origin-unit42.paloaltonetworks.com/north-korean-threat-group-play-ransomware/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

34.96.108.115 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

115.108.96.34.bc.googleusercontent.com

Software

Apache /

Resource Hash

f1f8a480e44e7ef96172111c5a5de1717f04cf56a35187191de908b61a01ef1d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://origin-unit42.paloaltonetworks.com/north-korean-threat-group-play-ransomware/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
content-encoding: gzip
etag: "13b35-62144eb8b7d71-gzip"
via: 1.1 google
accept-ranges: bytes
alt-svc: clear
content-length: 15488
date: Thu, 31 Oct 2024 09:50:58 GMT
last-modified: Wed, 04 Sep 2024 06:02:33 GMT
vary: Accept-Encoding
server: Apache
content-type: text/css

GET
H2 200 plugin.css
origin-unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/css/ 1 KB
570 B 82ms
70ms Stylesheet
text/css 34.96.108.115
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://origin-unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/css/plugin.css?ver=1.0.0

Requested by

Host: origin-unit42.paloaltonetworks.com
URL: https://origin-unit42.paloaltonetworks.com/north-korean-threat-group-play-ransomware/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

34.96.108.115 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

115.108.96.34.bc.googleusercontent.com

Software

Apache /

Resource Hash

4fca7d1a40d7a1ddf6f8535e1d1eaa8dd603f002a439b2373e97ef78f6ca0d4d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://origin-unit42.paloaltonetworks.com/north-korean-threat-group-play-ransomware/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
content-encoding: gzip
etag: "540-62144eb8b7d71-gzip"
via: 1.1 google
accept-ranges: bytes
alt-svc: clear
content-length: 491
date: Thu, 31 Oct 2024 09:50:58 GMT
last-modified: Wed, 04 Sep 2024 06:02:33 GMT
vary: Accept-Encoding
server: Apache
content-type: text/css

GET
H2 200 main-redesign.css
origin-unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/css/ 312 KB
33 KB 124ms
113ms Stylesheet
text/css 34.96.108.115
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://origin-unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/css/main-redesign.css?ver=1.0.0

Requested by

Host: origin-unit42.paloaltonetworks.com
URL: https://origin-unit42.paloaltonetworks.com/north-korean-threat-group-play-ransomware/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

34.96.108.115 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

115.108.96.34.bc.googleusercontent.com

Software

Apache /

Resource Hash

a55a97d86ace4a0a4643aeae4788ef2d27ff4d32ef97e231ef17ba2ec2925ada

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://origin-unit42.paloaltonetworks.com/north-korean-threat-group-play-ransomware/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
content-encoding: gzip
etag: "4de06-625ae91dacb6d-gzip"
via: 1.1 google
accept-ranges: bytes
alt-svc: clear
content-length: 33620
date: Thu, 31 Oct 2024 09:50:58 GMT
last-modified: Wed, 30 Oct 2024 09:46:01 GMT
vary: Accept-Encoding
server: Apache
content-type: text/css

GET
H2 200 ldc-lite.css
origin-unit42.paloaltonetworks.com/wp-content/plugins/like-dislike-counter-for-posts-pages-and-comments/css/ 892 B
561 B 79ms
68ms Stylesheet
text/css 34.96.108.115
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://origin-unit42.paloaltonetworks.com/wp-content/plugins/like-dislike-counter-for-posts-pages-and-comments/css/ldc-lite.css?ver=1.0.0

Requested by

Host: origin-unit42.paloaltonetworks.com
URL: https://origin-unit42.paloaltonetworks.com/north-korean-threat-group-play-ransomware/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

34.96.108.115 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

115.108.96.34.bc.googleusercontent.com

Software

Apache /

Resource Hash

1d05fb3972ae3db9945a306fcd724db0a5166141c81d849d130345cbd67ecf94

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://origin-unit42.paloaltonetworks.com/north-korean-threat-group-play-ransomware/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
content-encoding: gzip
etag: "37c-62144eb731371-gzip"
via: 1.1 google
accept-ranges: bytes
alt-svc: clear
content-length: 482
date: Thu, 31 Oct 2024 09:50:58 GMT
last-modified: Wed, 04 Sep 2024 06:02:31 GMT
vary: Accept-Encoding
server: Apache
content-type: text/css

GET
H2 200 jquery.min.js Show response
origin-unit42.paloaltonetworks.com/wp-includes/js/jquery/ 86 KB
30 KB 80ms
69ms Script
application/javascript 34.96.108.115
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://origin-unit42.paloaltonetworks.com/wp-includes/js/jquery/jquery.min.js?ver=3.7.1

Requested by

Host: origin-unit42.paloaltonetworks.com
URL: https://origin-unit42.paloaltonetworks.com/north-korean-threat-group-play-ransomware/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

34.96.108.115 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

115.108.96.34.bc.googleusercontent.com

Software

Apache /

Resource Hash

cb6f2d32c49d1c2b25e9ffc9aaafa3f83075346c01bcd4ae6eb187392a4292cf

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://origin-unit42.paloaltonetworks.com/north-korean-threat-group-play-ransomware/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
content-encoding: gzip
etag: "15601-62144eb9291f1-gzip"
via: 1.1 google
accept-ranges: bytes
alt-svc: clear
content-length: 30368
date: Thu, 31 Oct 2024 09:50:58 GMT
last-modified: Wed, 04 Sep 2024 06:02:34 GMT
vary: Accept-Encoding
server: Apache
content-type: application/javascript

GET
H2 200 jquery-migrate.min.js Show response
origin-unit42.paloaltonetworks.com/wp-includes/js/jquery/ 13 KB
5 KB 80ms
70ms Script
application/javascript 34.96.108.115
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://origin-unit42.paloaltonetworks.com/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.4.1

Requested by

Host: origin-unit42.paloaltonetworks.com
URL: https://origin-unit42.paloaltonetworks.com/north-korean-threat-group-play-ransomware/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

34.96.108.115 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

115.108.96.34.bc.googleusercontent.com

Software

Apache /

Resource Hash

5274f11e6fb32ae0cf2dfb9f8043272865c397a7c4223b4cfa7d50ea52fbde89

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://origin-unit42.paloaltonetworks.com/north-korean-threat-group-play-ransomware/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
content-encoding: gzip
etag: "3509-62144eb928251-gzip"
via: 1.1 google
accept-ranges: bytes
alt-svc: clear
content-length: 4872
date: Thu, 31 Oct 2024 09:50:58 GMT
last-modified: Wed, 04 Sep 2024 06:02:34 GMT
vary: Accept-Encoding
server: Apache
content-type: application/javascript

GET
H2 200 crayon.min.js Show response
origin-unit42.paloaltonetworks.com/wp-content/plugins/crayon-syntax-highlighter/js/min/ 22 KB
7 KB 122ms
112ms Script
application/javascript 34.96.108.115
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://origin-unit42.paloaltonetworks.com/wp-content/plugins/crayon-syntax-highlighter/js/min/crayon.min.js?ver=_2.7.2_beta

Requested by

Host: origin-unit42.paloaltonetworks.com
URL: https://origin-unit42.paloaltonetworks.com/north-korean-threat-group-play-ransomware/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

34.96.108.115 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

115.108.96.34.bc.googleusercontent.com

Software

Apache /

Resource Hash

193fbb968733b8a7049da19274546e6b80b76e9a8f1b837fee9a5fdeb8f97c7b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://origin-unit42.paloaltonetworks.com/north-korean-threat-group-play-ransomware/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
content-encoding: gzip
etag: "5741-62144eb71ea91-gzip"
via: 1.1 google
accept-ranges: bytes
alt-svc: clear
content-length: 6790
date: Thu, 31 Oct 2024 09:50:58 GMT
last-modified: Wed, 04 Sep 2024 06:02:31 GMT
vary: Accept-Encoding
server: Apache
content-type: application/javascript

GET
H2 200 frontend.min.js Show response
origin-unit42.paloaltonetworks.com/wp-content/plugins/post-views-counter/js/ 3 KB
1 KB 74ms
64ms Script
application/javascript 34.96.108.115
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://origin-unit42.paloaltonetworks.com/wp-content/plugins/post-views-counter/js/frontend.min.js?ver=1.4.7

Requested by

Host: origin-unit42.paloaltonetworks.com
URL: https://origin-unit42.paloaltonetworks.com/north-korean-threat-group-play-ransomware/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

34.96.108.115 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

115.108.96.34.bc.googleusercontent.com

Software

Apache /

Resource Hash

0ea483a3020f20467311f88198ac887d4c3032485b36f30ec83bfa93af6d12d2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://origin-unit42.paloaltonetworks.com/north-korean-threat-group-play-ransomware/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
content-encoding: gzip
etag: "aec-62144eb736191-gzip"
via: 1.1 google
accept-ranges: bytes
alt-svc: clear
content-length: 1341
date: Thu, 31 Oct 2024 09:50:58 GMT
last-modified: Wed, 04 Sep 2024 06:02:31 GMT
vary: Accept-Encoding
server: Apache
content-type: application/javascript

GET
H2 200 xdomain-data.js Show response
origin-unit42.paloaltonetworks.com/wp-content/plugins/sitepress-multilingual-cms/res/js/ 3 KB
1 KB 40ms
40ms Script
application/javascript 34.96.108.115
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://origin-unit42.paloaltonetworks.com/wp-content/plugins/sitepress-multilingual-cms/res/js/xdomain-data.js?ver=4.6.12

Requested by

Host: origin-unit42.paloaltonetworks.com
URL: https://origin-unit42.paloaltonetworks.com/north-korean-threat-group-play-ransomware/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

34.96.108.115 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

115.108.96.34.bc.googleusercontent.com

Software

Apache /

Resource Hash

68b324a6179651d56917d3b1f3f5d0a1e71b08550b1468790826dde5e22b2b56

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://origin-unit42.paloaltonetworks.com/north-korean-threat-group-play-ransomware/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
content-encoding: gzip
etag: "d2d-62144eb7b50d1-gzip"
via: 1.1 google
accept-ranges: bytes
alt-svc: clear
content-length: 1307
date: Thu, 31 Oct 2024 09:50:58 GMT
last-modified: Wed, 04 Sep 2024 06:02:32 GMT
vary: Accept-Encoding
server: Apache
content-type: application/javascript

GET
H2 200 launch-cc3e77767d1b-development.min.js Show response
assets.adobedtm.com/9273d4aedcd2/0d76ae0322d7/ 632 KB
148 KB 951ms
50ms Script
application/x-javascript 2600:1408:ac00:19b::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://assets.adobedtm.com/9273d4aedcd2/0d76ae0322d7/launch-cc3e77767d1b-development.min.js

Requested by

Host: origin-unit42.paloaltonetworks.com
URL: https://origin-unit42.paloaltonetworks.com/north-korean-threat-group-play-ransomware/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2600:1408:ac00:19b::1e80 Ashburn, United States, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

AkamaiNetStorage /

Resource Hash

0858c92f6c0a651a77d7bc2769349e03defedba5057fd07ebc9675cbad26028a

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://origin-unit42.paloaltonetworks.com/

Response headers

cache-control: max-age=0, no-cache, no-store
timing-allow-origin: *
content-encoding: gzip
etag: "60944bb4775808faf007cf2ea7bff69a:1730191794.625953"
pragma: no-cache
x-content-type-options: nosniff
expires: Thu, 31 Oct 2024 09:50:59 GMT
accept-ranges: bytes
access-control-allow-origin: https://origin-unit42.paloaltonetworks.com
date: Thu, 31 Oct 2024 09:50:59 GMT
content-type: application/x-javascript
last-modified: Tue, 29 Oct 2024 08:49:54 GMT
server: AkamaiNetStorage
vary: Accept-Encoding

GET
H2 200 attribution.js Show response
www.paloaltonetworks.com/content/dam/pan/en_US/includes/ 4 KB
2 KB 294ms
83ms Script
application/javascript 2600:1408:c400:180::c3a
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://www.paloaltonetworks.com/content/dam/pan/en_US/includes/attribution.js

Requested by

Host: origin-unit42.paloaltonetworks.com
URL: https://origin-unit42.paloaltonetworks.com/north-korean-threat-group-play-ransomware/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2600:1408:c400:180::c3a Ashburn, United States, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Akamai Resource Optimizer /

Resource Hash

99939dfff2b476ab02a3e41934cd60f2ab41bd9939898b237e332ff293b4d0d8

Security Headers

Name	Value
Content-Security-Policy	object-src 'none'
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://origin-unit42.paloaltonetworks.com/

Response headers

x-robots-tag: noindex
content-encoding: br
x-content-type-options: nosniff
expires: Sun, 03 Nov 2024 09:50:58 GMT
server-timing: cdn-cache; desc=HIT, edge; dur=2, ak_p; desc="1730368258579_400219995_92455657_239_62111_16_47_219";dur=1
date: Thu, 31 Oct 2024 09:50:58 GMT
content-type: application/javascript
last-modified: Sat, 26 Oct 2024 12:54:26 GMT
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000
content-security-policy: object-src 'none'
cache-control: max-age=259200
access-control-allow-credentials: true
accept-ranges: bytes
content-length: 1362
server: Akamai Resource Optimizer

GET
H2 200 PANW_Parent.png
origin-unit42.paloaltonetworks.com/wp-content/uploads/2021/07/ 9 KB
9 KB 70ms
62ms Image
image/png 34.96.108.115
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://origin-unit42.paloaltonetworks.com/wp-content/uploads/2021/07/PANW_Parent.png

Requested by

Host: origin-unit42.paloaltonetworks.com
URL: https://origin-unit42.paloaltonetworks.com/north-korean-threat-group-play-ransomware/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

34.96.108.115 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

115.108.96.34.bc.googleusercontent.com

Software

Apache /

Resource Hash

8ec11303a508ae99cfde8da8d8418863f5c44c6e4d9ad85d89b751711810ccbe

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://origin-unit42.paloaltonetworks.com/north-korean-threat-group-play-ransomware/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
etag: "2583-5ed6be924f16c"
via: 1.1 google
accept-ranges: bytes
alt-svc: clear
content-length: 9603
date: Thu, 31 Oct 2024 09:50:58 GMT
last-modified: Mon, 14 Nov 2022 10:43:32 GMT
content-type: image/png
server: Apache

GET
H2 200 unit42-logo-white.svg
origin-unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/ 3 KB
3 KB 67ms
52ms Image
image/svg+xml 34.96.108.115
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://origin-unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/unit42-logo-white.svg

Requested by

Host: origin-unit42.paloaltonetworks.com
URL: https://origin-unit42.paloaltonetworks.com/north-korean-threat-group-play-ransomware/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

34.96.108.115 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

115.108.96.34.bc.googleusercontent.com

Software

Apache /

Resource Hash

ce8287c3e0aa69b9b84e99fefcd63c5aa3e5f91d59852efad2a446efb3f07595

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://origin-unit42.paloaltonetworks.com/north-korean-threat-group-play-ransomware/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
etag: "b20-62144eb8d2351"
via: 1.1 google
accept-ranges: bytes
alt-svc: clear
content-length: 2848
date: Thu, 31 Oct 2024 09:50:58 GMT
last-modified: Wed, 04 Sep 2024 06:02:33 GMT
content-type: image/svg+xml
server: Apache

GET
H2 200 icon-clock.svg
origin-unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/ 938 B
1023 B 68ms
61ms Image
image/svg+xml 34.96.108.115
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://origin-unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-clock.svg

Requested by

Host: origin-unit42.paloaltonetworks.com
URL: https://origin-unit42.paloaltonetworks.com/north-korean-threat-group-play-ransomware/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

34.96.108.115 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

115.108.96.34.bc.googleusercontent.com

Software

Apache /

Resource Hash

7497842445124f550c148be30ba12c7f43f2ef87740b690dc51ce17a55dc144c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://origin-unit42.paloaltonetworks.com/north-korean-threat-group-play-ransomware/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
etag: "3aa-62144eb8c5831"
via: 1.1 google
accept-ranges: bytes
alt-svc: clear
content-length: 938
date: Thu, 31 Oct 2024 09:50:58 GMT
last-modified: Wed, 04 Sep 2024 06:02:33 GMT
content-type: image/svg+xml
server: Apache

GET
H2 200 strata_RGB_logo_Icon_Color.png
origin-unit42.paloaltonetworks.com/wp-content/uploads/2024/06/ 4 KB
4 KB 45ms
41ms Image
image/png 34.96.108.115
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://origin-unit42.paloaltonetworks.com/wp-content/uploads/2024/06/strata_RGB_logo_Icon_Color.png

Requested by

Host: origin-unit42.paloaltonetworks.com
URL: https://origin-unit42.paloaltonetworks.com/north-korean-threat-group-play-ransomware/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

34.96.108.115 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

115.108.96.34.bc.googleusercontent.com

Software

Apache /

Resource Hash

b9311d52ce973e614166f03a236d58aca49d21bfce5ed0b0bd66a05d2c03cadf

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://origin-unit42.paloaltonetworks.com/north-korean-threat-group-play-ransomware/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
etag: "e31-61a8d806ead85"
via: 1.1 google
accept-ranges: bytes
alt-svc: clear
content-length: 3633
date: Thu, 31 Oct 2024 09:50:58 GMT
last-modified: Mon, 10 Jun 2024 18:41:47 GMT
content-type: image/png
server: Apache

GET
H2 200 cortex_RGB_logo_Icon_Color.png
origin-unit42.paloaltonetworks.com/wp-content/uploads/2024/06/ 4 KB
4 KB 66ms
53ms Image
image/png 34.96.108.115
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://origin-unit42.paloaltonetworks.com/wp-content/uploads/2024/06/cortex_RGB_logo_Icon_Color.png

Requested by

Host: origin-unit42.paloaltonetworks.com
URL: https://origin-unit42.paloaltonetworks.com/north-korean-threat-group-play-ransomware/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

34.96.108.115 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

115.108.96.34.bc.googleusercontent.com

Software

Apache /

Resource Hash

166f2f4034d2d3162ace9a3542542f443707cd939a4c8efcec6a217e4a3b4356

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://origin-unit42.paloaltonetworks.com/north-korean-threat-group-play-ransomware/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
etag: "1134-61a90bae3143e"
via: 1.1 google
accept-ranges: bytes
alt-svc: clear
content-length: 4404
date: Thu, 31 Oct 2024 09:50:58 GMT
last-modified: Mon, 10 Jun 2024 22:32:53 GMT
content-type: image/png
server: Apache

GET
H2 200 unit42_RGB_logo_Icon_Color.png
origin-unit42.paloaltonetworks.com/wp-content/uploads/2024/06/ 5 KB
5 KB 63ms
50ms Image
image/png 34.96.108.115
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://origin-unit42.paloaltonetworks.com/wp-content/uploads/2024/06/unit42_RGB_logo_Icon_Color.png

Requested by

Host: origin-unit42.paloaltonetworks.com
URL: https://origin-unit42.paloaltonetworks.com/north-korean-threat-group-play-ransomware/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

34.96.108.115 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

115.108.96.34.bc.googleusercontent.com

Software

Apache /

Resource Hash

2c0bb81e5aab07f9886b6fcf2b404ba3150dc0c1e7e7b07d7113cabce33360f1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://origin-unit42.paloaltonetworks.com/north-korean-threat-group-play-ransomware/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
etag: "142f-61a90ba7e9ba4"
via: 1.1 google
accept-ranges: bytes
alt-svc: clear
content-length: 5167
date: Thu, 31 Oct 2024 09:50:58 GMT
last-modified: Mon, 10 Jun 2024 22:32:46 GMT
content-type: image/png
server: Apache

GET
H2 200 icon-profile-grey.svg
origin-unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/ 898 B
977 B 65ms
52ms Image
image/svg+xml 34.96.108.115
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://origin-unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-profile-grey.svg

Requested by

Host: origin-unit42.paloaltonetworks.com
URL: https://origin-unit42.paloaltonetworks.com/north-korean-threat-group-play-ransomware/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

34.96.108.115 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

115.108.96.34.bc.googleusercontent.com

Software

Apache /

Resource Hash

57e51b4b5bdd75d87b695dda2f34edea72d4c758519ed368316706b731dfeb0c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://origin-unit42.paloaltonetworks.com/north-korean-threat-group-play-ransomware/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
etag: "382-62144eb8c5831"
via: 1.1 google
accept-ranges: bytes
alt-svc: clear
content-length: 898
date: Thu, 31 Oct 2024 09:50:58 GMT
last-modified: Wed, 04 Sep 2024 06:02:33 GMT
content-type: image/svg+xml
server: Apache

GET
H2 200 icon-calendar-grey.svg
origin-unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/ 2 KB
2 KB 58ms
45ms Image
image/svg+xml 34.96.108.115
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://origin-unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-calendar-grey.svg

Requested by

Host: origin-unit42.paloaltonetworks.com
URL: https://origin-unit42.paloaltonetworks.com/north-korean-threat-group-play-ransomware/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

34.96.108.115 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

115.108.96.34.bc.googleusercontent.com

Software

Apache /

Resource Hash

9372da202e35b26065aa9cc76e1d68890f04d2b7d4d98e8bd5e95e130acb155b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://origin-unit42.paloaltonetworks.com/north-korean-threat-group-play-ransomware/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
etag: "6d9-62144eb8c5831"
via: 1.1 google
accept-ranges: bytes
alt-svc: clear
content-length: 1753
date: Thu, 31 Oct 2024 09:50:58 GMT
last-modified: Wed, 04 Sep 2024 06:02:33 GMT
content-type: image/svg+xml
server: Apache

GET
H2 200 icon-category.svg
origin-unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/ 798 B
874 B 61ms
48ms Image
image/svg+xml 34.96.108.115
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://origin-unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-category.svg

Requested by

Host: origin-unit42.paloaltonetworks.com
URL: https://origin-unit42.paloaltonetworks.com/north-korean-threat-group-play-ransomware/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

34.96.108.115 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

115.108.96.34.bc.googleusercontent.com

Software

Apache /

Resource Hash

c34fab15144ce735b4059974cbf2912880691e59913c3e60573b849ed86bb606

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://origin-unit42.paloaltonetworks.com/north-korean-threat-group-play-ransomware/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
etag: "31e-62144eb8c5831"
via: 1.1 google
accept-ranges: bytes
alt-svc: clear
content-length: 798
date: Thu, 31 Oct 2024 09:50:58 GMT
last-modified: Wed, 04 Sep 2024 06:02:33 GMT
content-type: image/svg+xml
server: Apache

GET
H2 200 icon-tags-grey.svg
origin-unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/ 2 KB
2 KB 59ms
47ms Image
image/svg+xml 34.96.108.115
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://origin-unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-tags-grey.svg

Requested by

Host: origin-unit42.paloaltonetworks.com
URL: https://origin-unit42.paloaltonetworks.com/north-korean-threat-group-play-ransomware/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

34.96.108.115 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

115.108.96.34.bc.googleusercontent.com

Software

Apache /

Resource Hash

354f2bf6a1d51484f02f3575c3d70de72255aae104c16893fa4a0b562a95bcd4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://origin-unit42.paloaltonetworks.com/north-korean-threat-group-play-ransomware/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
etag: "651-62144eb8c67d1"
via: 1.1 google
accept-ranges: bytes
alt-svc: clear
content-length: 1617
date: Thu, 31 Oct 2024 09:50:58 GMT
last-modified: Wed, 04 Sep 2024 06:02:33 GMT
content-type: image/svg+xml
server: Apache

GET
H2 200 icon-download.svg
origin-unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/ 616 B
691 B 60ms
48ms Image
image/svg+xml 34.96.108.115
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://origin-unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-download.svg

Requested by

Host: origin-unit42.paloaltonetworks.com
URL: https://origin-unit42.paloaltonetworks.com/north-korean-threat-group-play-ransomware/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

34.96.108.115 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

115.108.96.34.bc.googleusercontent.com

Software

Apache /

Resource Hash

3047800b69b9d50542394db5eccac5335c991ee9656dcde02c4ff648bef81b13

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://origin-unit42.paloaltonetworks.com/north-korean-threat-group-play-ransomware/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
etag: "268-62144eb8c5831"
via: 1.1 google
accept-ranges: bytes
alt-svc: clear
content-length: 616
date: Thu, 31 Oct 2024 09:50:58 GMT
last-modified: Wed, 04 Sep 2024 06:02:33 GMT
content-type: image/svg+xml
server: Apache

GET
H2 200 icon-print.svg
origin-unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/ 2 KB
2 KB 60ms
48ms Image
image/svg+xml 34.96.108.115
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://origin-unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-print.svg

Requested by

Host: origin-unit42.paloaltonetworks.com
URL: https://origin-unit42.paloaltonetworks.com/north-korean-threat-group-play-ransomware/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

34.96.108.115 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

115.108.96.34.bc.googleusercontent.com

Software

Apache /

Resource Hash

b2b2d44d40b3e87b6a39823c7f9e7f5eb7ebe9163d5aecbaa97796e9c140d61d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://origin-unit42.paloaltonetworks.com/north-korean-threat-group-play-ransomware/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
etag: "92c-62144eb8c5831"
via: 1.1 google
accept-ranges: bytes
alt-svc: clear
content-length: 2348
date: Thu, 31 Oct 2024 09:50:58 GMT
last-modified: Wed, 04 Sep 2024 06:02:33 GMT
content-type: image/svg+xml
server: Apache

GET
H2 200 down-arrow.svg
origin-unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/ 222 B
299 B 65ms
53ms Image
image/svg+xml 34.96.108.115
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://origin-unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/down-arrow.svg

Requested by

Host: origin-unit42.paloaltonetworks.com
URL: https://origin-unit42.paloaltonetworks.com/north-korean-threat-group-play-ransomware/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

34.96.108.115 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

115.108.96.34.bc.googleusercontent.com

Software

Apache /

Resource Hash

d1d44b81c0031bab343f5aaa0dd47fd43e06b9f0bad37f7da22e79b551de9baf

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://origin-unit42.paloaltonetworks.com/north-korean-threat-group-play-ransomware/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
etag: "de-62144eb8c5831"
via: 1.1 google
accept-ranges: bytes
alt-svc: clear
content-length: 222
date: Thu, 31 Oct 2024 09:50:58 GMT
last-modified: Wed, 04 Sep 2024 06:02:33 GMT
content-type: image/svg+xml
server: Apache

GET
H2 200 icon-share-link.svg
origin-unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/ 2 KB
2 KB 64ms
53ms Image
image/svg+xml 34.96.108.115
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://origin-unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-share-link.svg

Requested by

Host: origin-unit42.paloaltonetworks.com
URL: https://origin-unit42.paloaltonetworks.com/north-korean-threat-group-play-ransomware/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

34.96.108.115 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

115.108.96.34.bc.googleusercontent.com

Software

Apache /

Resource Hash

bae389cf8448c3f3ec86741ba5dcbfafc8e61be27a31c1c723169964bad30825

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://origin-unit42.paloaltonetworks.com/north-korean-threat-group-play-ransomware/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
etag: "691-62144eb8c5831"
via: 1.1 google
accept-ranges: bytes
alt-svc: clear
content-length: 1681
date: Thu, 31 Oct 2024 09:50:58 GMT
last-modified: Wed, 04 Sep 2024 06:02:33 GMT
content-type: image/svg+xml
server: Apache

GET
H2 200 icon-sms.svg
origin-unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/ 839 B
918 B 62ms
51ms Image
image/svg+xml 34.96.108.115
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://origin-unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-sms.svg

Requested by

Host: origin-unit42.paloaltonetworks.com
URL: https://origin-unit42.paloaltonetworks.com/north-korean-threat-group-play-ransomware/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

34.96.108.115 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

115.108.96.34.bc.googleusercontent.com

Software

Apache /

Resource Hash

0eb69b28ac185e20ea3cef133e67074071e8291265e83ec0674fedbdded257f3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://origin-unit42.paloaltonetworks.com/north-korean-threat-group-play-ransomware/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
etag: "347-62144eb8c5831"
via: 1.1 google
accept-ranges: bytes
alt-svc: clear
content-length: 839
date: Thu, 31 Oct 2024 09:50:58 GMT
last-modified: Wed, 04 Sep 2024 06:02:33 GMT
content-type: image/svg+xml
server: Apache

GET
H2 200 icon-fb-share.svg
origin-unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/ 660 B
737 B 60ms
49ms Image
image/svg+xml 34.96.108.115
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://origin-unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-fb-share.svg

Requested by

Host: origin-unit42.paloaltonetworks.com
URL: https://origin-unit42.paloaltonetworks.com/north-korean-threat-group-play-ransomware/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

34.96.108.115 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

115.108.96.34.bc.googleusercontent.com

Software

Apache /

Resource Hash

31b0bce4a0e136afc19d1bfc6fada8ef260af6a3aac1bb4855e61c0ba963d6ef

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://origin-unit42.paloaltonetworks.com/north-korean-threat-group-play-ransomware/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
etag: "294-62144eb8c5831"
via: 1.1 google
accept-ranges: bytes
alt-svc: clear
content-length: 660
date: Thu, 31 Oct 2024 09:50:58 GMT
last-modified: Wed, 04 Sep 2024 06:02:33 GMT
content-type: image/svg+xml
server: Apache

GET
H2 200 icon-linkedin-share.svg
origin-unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/ 1 KB
1 KB 61ms
51ms Image
image/svg+xml 34.96.108.115
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://origin-unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-linkedin-share.svg

Requested by

Host: origin-unit42.paloaltonetworks.com
URL: https://origin-unit42.paloaltonetworks.com/north-korean-threat-group-play-ransomware/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

34.96.108.115 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

115.108.96.34.bc.googleusercontent.com

Software

Apache /

Resource Hash

1c94082596ab0f9ad7273be7208793962c1c6ef0ffd7e4feffaed42d47c738d4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://origin-unit42.paloaltonetworks.com/north-korean-threat-group-play-ransomware/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
etag: "46b-62144eb8c5831"
via: 1.1 google
accept-ranges: bytes
alt-svc: clear
content-length: 1131
date: Thu, 31 Oct 2024 09:50:58 GMT
last-modified: Wed, 04 Sep 2024 06:02:33 GMT
content-type: image/svg+xml
server: Apache

GET
H2 200 icon-twitter-share.svg
origin-unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/ 630 B
710 B 70ms
60ms Image
image/svg+xml 34.96.108.115
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://origin-unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-twitter-share.svg

Requested by

Host: origin-unit42.paloaltonetworks.com
URL: https://origin-unit42.paloaltonetworks.com/north-korean-threat-group-play-ransomware/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

34.96.108.115 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

115.108.96.34.bc.googleusercontent.com

Software

Apache /

Resource Hash

0baad9e25b241b32129e0527c9a7ee951f37948d20d93cbc598ec96762a6213f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://origin-unit42.paloaltonetworks.com/north-korean-threat-group-play-ransomware/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
etag: "276-62144eb8c67d1"
via: 1.1 google
accept-ranges: bytes
alt-svc: clear
content-length: 630
date: Thu, 31 Oct 2024 09:50:58 GMT
last-modified: Wed, 04 Sep 2024 06:02:33 GMT
content-type: image/svg+xml
server: Apache

GET
H2 200 icon-reddit-share.svg
origin-unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/ 2 KB
2 KB 66ms
55ms Image
image/svg+xml 34.96.108.115
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://origin-unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-reddit-share.svg

Requested by

Host: origin-unit42.paloaltonetworks.com
URL: https://origin-unit42.paloaltonetworks.com/north-korean-threat-group-play-ransomware/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

34.96.108.115 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

115.108.96.34.bc.googleusercontent.com

Software

Apache /

Resource Hash

c37a9c678929e0442a0a7e0f11998ee0abb8631456316638a0ab7682b4a98538

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://origin-unit42.paloaltonetworks.com/north-korean-threat-group-play-ransomware/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
etag: "80b-62144eb8c5831"
via: 1.1 google
accept-ranges: bytes
alt-svc: clear
content-length: 2059
date: Thu, 31 Oct 2024 09:50:58 GMT
last-modified: Wed, 04 Sep 2024 06:02:33 GMT
content-type: image/svg+xml
server: Apache

GET
H2 200 icon-mastodon-share.svg
origin-unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/ 1 KB
1 KB 69ms
59ms Image
image/svg+xml 34.96.108.115
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://origin-unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-mastodon-share.svg

Requested by

Host: origin-unit42.paloaltonetworks.com
URL: https://origin-unit42.paloaltonetworks.com/north-korean-threat-group-play-ransomware/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

34.96.108.115 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

115.108.96.34.bc.googleusercontent.com

Software

Apache /

Resource Hash

f099d9f9adff4bc42967b5896dc94c743a34bdc604f6116d2c3a48182262969f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://origin-unit42.paloaltonetworks.com/north-korean-threat-group-play-ransomware/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
etag: "4a9-62144eb8c5831"
via: 1.1 google
accept-ranges: bytes
alt-svc: clear
content-length: 1193
date: Thu, 31 Oct 2024 09:50:58 GMT
last-modified: Wed, 04 Sep 2024 06:02:33 GMT
content-type: image/svg+xml
server: Apache

GET
H2 200 icon-right-arrow-withtail.svg
origin-unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/ 344 B
424 B 71ms
62ms Image
image/svg+xml 34.96.108.115
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://origin-unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg

Requested by

Host: origin-unit42.paloaltonetworks.com
URL: https://origin-unit42.paloaltonetworks.com/north-korean-threat-group-play-ransomware/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

34.96.108.115 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

115.108.96.34.bc.googleusercontent.com

Software

Apache /

Resource Hash

0adff2e981d149d803d1d0e7ccb64ffa349186ea961d2ccd5ad2ee585f11db2f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://origin-unit42.paloaltonetworks.com/north-korean-threat-group-play-ransomware/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
etag: "158-62144eb8c5831"
via: 1.1 google
accept-ranges: bytes
alt-svc: clear
content-length: 344
date: Thu, 31 Oct 2024 09:50:58 GMT
last-modified: Wed, 04 Sep 2024 06:02:33 GMT
content-type: image/svg+xml
server: Apache

GET
H2 200 slider-arrow-left.svg
origin-unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/ 226 B
304 B 64ms
55ms Image
image/svg+xml 34.96.108.115
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://origin-unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/slider-arrow-left.svg

Requested by

Host: origin-unit42.paloaltonetworks.com
URL: https://origin-unit42.paloaltonetworks.com/north-korean-threat-group-play-ransomware/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

34.96.108.115 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

115.108.96.34.bc.googleusercontent.com

Software

Apache /

Resource Hash

589665e95bbc6f03b514b403976bc328d5a08f93f7bb6e6381f95a0f28589e67

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://origin-unit42.paloaltonetworks.com/north-korean-threat-group-play-ransomware/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
etag: "e2-62144eb8c7771"
via: 1.1 google
accept-ranges: bytes
alt-svc: clear
content-length: 226
date: Thu, 31 Oct 2024 09:50:58 GMT
last-modified: Wed, 04 Sep 2024 06:02:33 GMT
content-type: image/svg+xml
server: Apache

GET
H2 200 close-modal.svg
origin-unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/ 363 B
443 B 69ms
60ms Image
image/svg+xml 34.96.108.115
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://origin-unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/close-modal.svg

Requested by

Host: origin-unit42.paloaltonetworks.com
URL: https://origin-unit42.paloaltonetworks.com/north-korean-threat-group-play-ransomware/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

34.96.108.115 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

115.108.96.34.bc.googleusercontent.com

Software

Apache /

Resource Hash

b30aa424747edc9582a65ea92e5286aec6fdd9ef4915921f6762035a3099aaca

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://origin-unit42.paloaltonetworks.com/north-korean-threat-group-play-ransomware/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
etag: "16b-62144eb8c5831"
via: 1.1 google
accept-ranges: bytes
alt-svc: clear
content-length: 363
date: Thu, 31 Oct 2024 09:50:58 GMT
last-modified: Wed, 04 Sep 2024 06:02:33 GMT
content-type: image/svg+xml
server: Apache

GET
H2 200 icon-loader.svg
origin-unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/ 473 B
553 B 67ms
57ms Image
image/svg+xml 34.96.108.115
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://origin-unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-loader.svg

Requested by

Host: origin-unit42.paloaltonetworks.com
URL: https://origin-unit42.paloaltonetworks.com/north-korean-threat-group-play-ransomware/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

34.96.108.115 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

115.108.96.34.bc.googleusercontent.com

Software

Apache /

Resource Hash

af9a9e8da8e44dd6cc658f23dd5637b8ee029b8a0e59e849496ecf6aeb752e32

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://origin-unit42.paloaltonetworks.com/north-korean-threat-group-play-ransomware/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
etag: "1d9-62144eb8c5831"
via: 1.1 google
accept-ranges: bytes
alt-svc: clear
content-length: 473
date: Thu, 31 Oct 2024 09:50:58 GMT
last-modified: Wed, 04 Sep 2024 06:02:33 GMT
content-type: image/svg+xml
server: Apache

GET
H2 200 globe-icon.svg
origin-unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/ 2 KB
2 KB 66ms
57ms Image
image/svg+xml 34.96.108.115
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://origin-unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/globe-icon.svg

Requested by

Host: origin-unit42.paloaltonetworks.com
URL: https://origin-unit42.paloaltonetworks.com/north-korean-threat-group-play-ransomware/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

34.96.108.115 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

115.108.96.34.bc.googleusercontent.com

Software

Apache /

Resource Hash

07cc631c7527ce71e44b76347c19beffd8ebdae6a52afe2c964ed16c8e721c1c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://origin-unit42.paloaltonetworks.com/north-korean-threat-group-play-ransomware/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
etag: "686-62144eb8c5831"
via: 1.1 google
accept-ranges: bytes
alt-svc: clear
content-length: 1670
date: Thu, 31 Oct 2024 09:50:58 GMT
last-modified: Wed, 04 Sep 2024 06:02:33 GMT
content-type: image/svg+xml
server: Apache

GET
H2 200 player-play-icon.svg
origin-unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/ 349 B
429 B 62ms
53ms Image
image/svg+xml 34.96.108.115
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://origin-unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-play-icon.svg

Requested by

Host: origin-unit42.paloaltonetworks.com
URL: https://origin-unit42.paloaltonetworks.com/north-korean-threat-group-play-ransomware/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

34.96.108.115 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

115.108.96.34.bc.googleusercontent.com

Software

Apache /

Resource Hash

c6cb81d06bf52c3a82de80233ffbc044714592d72611b8e9f45abdd1ec98e895

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://origin-unit42.paloaltonetworks.com/north-korean-threat-group-play-ransomware/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
etag: "15d-62144eb8c67d1"
via: 1.1 google
accept-ranges: bytes
alt-svc: clear
content-length: 349
date: Thu, 31 Oct 2024 09:50:58 GMT
last-modified: Wed, 04 Sep 2024 06:02:33 GMT
content-type: image/svg+xml
server: Apache

GET
H2 200 player-pause-icon1.svg
origin-unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/ 32 KB
33 KB 65ms
56ms Image
image/svg+xml 34.96.108.115
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://origin-unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-pause-icon1.svg

Requested by

Host: origin-unit42.paloaltonetworks.com
URL: https://origin-unit42.paloaltonetworks.com/north-korean-threat-group-play-ransomware/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

34.96.108.115 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

115.108.96.34.bc.googleusercontent.com

Software

Apache /

Resource Hash

0cfdf8d7980fb03f598b7477c3d3d2b7f92da5c681d604538fe07abe70ce19b5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://origin-unit42.paloaltonetworks.com/north-korean-threat-group-play-ransomware/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
etag: "81f3-62144eb8c67d1"
via: 1.1 google
accept-ranges: bytes
alt-svc: clear
content-length: 33267
date: Thu, 31 Oct 2024 09:50:58 GMT
last-modified: Wed, 04 Sep 2024 06:02:33 GMT
content-type: image/svg+xml
server: Apache

GET
H2 200 icon-minimize.svg
origin-unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/ 864 B
944 B 64ms
56ms Image
image/svg+xml 34.96.108.115
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://origin-unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-minimize.svg

Requested by

Host: origin-unit42.paloaltonetworks.com
URL: https://origin-unit42.paloaltonetworks.com/north-korean-threat-group-play-ransomware/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

34.96.108.115 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

115.108.96.34.bc.googleusercontent.com

Software

Apache /

Resource Hash

c920551b2d9526b41abadaa128f83a9586b4c9e5e0722b9ab3b3ce3738d869fa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://origin-unit42.paloaltonetworks.com/north-korean-threat-group-play-ransomware/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
etag: "360-62144eb8c5831"
via: 1.1 google
accept-ranges: bytes
alt-svc: clear
content-length: 864
date: Thu, 31 Oct 2024 09:50:58 GMT
last-modified: Wed, 04 Sep 2024 06:02:33 GMT
content-type: image/svg+xml
server: Apache

GET
H2 200 right-arrow.svg
origin-unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/ 357 B
437 B 68ms
60ms Image
image/svg+xml 34.96.108.115
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://origin-unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/right-arrow.svg

Requested by

Host: origin-unit42.paloaltonetworks.com
URL: https://origin-unit42.paloaltonetworks.com/north-korean-threat-group-play-ransomware/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

34.96.108.115 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

115.108.96.34.bc.googleusercontent.com

Software

Apache /

Resource Hash

5ac0e3835aaaeddc641968ac4527e3037992ea917ab0d68c7e14d36a7610492e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://origin-unit42.paloaltonetworks.com/north-korean-threat-group-play-ransomware/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
etag: "165-62144eb8c7771"
via: 1.1 google
accept-ranges: bytes
alt-svc: clear
content-length: 357
date: Thu, 31 Oct 2024 09:50:58 GMT
last-modified: Wed, 04 Sep 2024 06:02:33 GMT
content-type: image/svg+xml
server: Apache

GET
H2 200 icon-volume.svg
origin-unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/ 2 KB
2 KB 69ms
62ms Image
image/svg+xml 34.96.108.115
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://origin-unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-volume.svg

Requested by

Host: origin-unit42.paloaltonetworks.com
URL: https://origin-unit42.paloaltonetworks.com/north-korean-threat-group-play-ransomware/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

34.96.108.115 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

115.108.96.34.bc.googleusercontent.com

Software

Apache /

Resource Hash

97c70802c2d1ff852ae0e87245e4910a6135b47a3563b04c559b040822cf6158

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://origin-unit42.paloaltonetworks.com/north-korean-threat-group-play-ransomware/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
etag: "7d8-62144eb8c67d1"
via: 1.1 google
accept-ranges: bytes
alt-svc: clear
content-length: 2008
date: Thu, 31 Oct 2024 09:50:58 GMT
last-modified: Wed, 04 Sep 2024 06:02:33 GMT
content-type: image/svg+xml
server: Apache

GET
H2 200 wpdevart_lightbox_front.css
origin-unit42.paloaltonetworks.com/wp-content/plugins/lightbox-popup/includes/style/ 1 KB
513 B 42ms
41ms Stylesheet
text/css 34.96.108.115
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://origin-unit42.paloaltonetworks.com/wp-content/plugins/lightbox-popup/includes/style/wpdevart_lightbox_front.css?ver=6.6.1

Requested by

Host: origin-unit42.paloaltonetworks.com
URL: https://origin-unit42.paloaltonetworks.com/north-korean-threat-group-play-ransomware/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

34.96.108.115 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

115.108.96.34.bc.googleusercontent.com

Software

Apache /

Resource Hash

a245df6da22f0700461deb2f6f840edce1f07613bab8e44eaa076f97bc40995f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://origin-unit42.paloaltonetworks.com/north-korean-threat-group-play-ransomware/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
content-encoding: gzip
etag: "528-62144eb731371-gzip"
via: 1.1 google
accept-ranges: bytes
alt-svc: clear
content-length: 434
date: Thu, 31 Oct 2024 09:50:58 GMT
last-modified: Wed, 04 Sep 2024 06:02:31 GMT
vary: Accept-Encoding
server: Apache
content-type: text/css

GET
H2 200 script.js Show response
origin-unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/js/ 194 KB
53 KB 54ms
52ms Script
application/javascript 34.96.108.115
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://origin-unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/js/script.js?ver=1.0.0

Requested by

Host: origin-unit42.paloaltonetworks.com
URL: https://origin-unit42.paloaltonetworks.com/north-korean-threat-group-play-ransomware/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

34.96.108.115 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

115.108.96.34.bc.googleusercontent.com

Software

Apache /

Resource Hash

dde9e030eebe6e275960fd345eb913edd26116ccd156b9cb7f900605a7cde511

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://origin-unit42.paloaltonetworks.com/north-korean-threat-group-play-ransomware/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
content-encoding: gzip
etag: "307fa-625ae91db09ee-gzip"
via: 1.1 google
accept-ranges: bytes
alt-svc: clear
content-length: 54482
date: Thu, 31 Oct 2024 09:50:58 GMT
last-modified: Wed, 30 Oct 2024 09:46:01 GMT
vary: Accept-Encoding
server: Apache
content-type: application/javascript

GET
H2 200 unit-nav-renderer.php Show response
origin-unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/ 0
48 B 61ms
55ms XHR
text/html 34.96.108.115
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://origin-unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/unit-nav-renderer.php

Requested by

Host: origin-unit42.paloaltonetworks.com
URL: https://origin-unit42.paloaltonetworks.com/north-korean-threat-group-play-ransomware/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

34.96.108.115 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

115.108.96.34.bc.googleusercontent.com

Software

Apache /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://origin-unit42.paloaltonetworks.com/north-korean-threat-group-play-ransomware/

Response headers

via: 1.1 google
strict-transport-security: max-age=31536000; includeSubDomains
alt-svc: clear
content-length: 0
date: Thu, 31 Oct 2024 09:50:58 GMT
content-type: text/html; charset=UTF-8
server: Apache

GET
H2 200 Pisces-NK-A-1920x900-1.png
origin-unit42.paloaltonetworks.com/wp-content/uploads/2024/10/ 2 MB
2 MB 43ms
41ms Image
image/png 34.96.108.115
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://origin-unit42.paloaltonetworks.com/wp-content/uploads/2024/10/Pisces-NK-A-1920x900-1.png

Requested by

Host: origin-unit42.paloaltonetworks.com
URL: https://origin-unit42.paloaltonetworks.com/north-korean-threat-group-play-ransomware/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

34.96.108.115 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

115.108.96.34.bc.googleusercontent.com

Software

Apache /

Resource Hash

709faebeaefb00235ef95157e10729dd8cedc9f8b153732a0e07a0a2fa4697be

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://origin-unit42.paloaltonetworks.com/north-korean-threat-group-play-ransomware/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
etag: "1bb42b-625a51e5e36f8"
via: 1.1 google
accept-ranges: bytes
alt-svc: clear
content-length: 1815595
date: Thu, 31 Oct 2024 09:50:58 GMT
last-modified: Tue, 29 Oct 2024 22:29:29 GMT
content-type: image/png
server: Apache

GET
H2 200 icon-right-arrow-small.svg
origin-unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/ 220 B
298 B 43ms
42ms Image
image/svg+xml 34.96.108.115
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://origin-unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-small.svg

Requested by

Host: origin-unit42.paloaltonetworks.com
URL: https://origin-unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/css/main-redesign.css?ver=1.0.0

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

34.96.108.115 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

115.108.96.34.bc.googleusercontent.com

Software

Apache /

Resource Hash

ad6765112dfccdd75e5adffd7a9eb342583713e8b87ee1b238cbb0119c587f2f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://origin-unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/css/main-redesign.css?ver=1.0.0

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
etag: "dc-62144eb8c5831"
via: 1.1 google
accept-ranges: bytes
alt-svc: clear
content-length: 220
date: Thu, 31 Oct 2024 09:50:58 GMT
last-modified: Wed, 04 Sep 2024 06:02:33 GMT
content-type: image/svg+xml
server: Apache

GET
H2 200 unit42-overlay-3.svg
origin-unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/ 6 KB
6 KB 50ms
50ms Image
image/svg+xml 34.96.108.115
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://origin-unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/unit42-overlay-3.svg

Requested by

Host: origin-unit42.paloaltonetworks.com
URL: https://origin-unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/css/main-redesign.css?ver=1.0.0

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

34.96.108.115 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

115.108.96.34.bc.googleusercontent.com

Software

Apache /

Resource Hash

19596433f7b115d1869fa0b307a2d793b76904e14efbdfa99a4eb71aafe7669a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://origin-unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/css/main-redesign.css?ver=1.0.0

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
etag: "177c-62144eb8d2351"
via: 1.1 google
accept-ranges: bytes
alt-svc: clear
content-length: 6012
date: Thu, 31 Oct 2024 09:50:58 GMT
last-modified: Wed, 04 Sep 2024 06:02:33 GMT
content-type: image/svg+xml
server: Apache

GET
H2 200 buttons.png
origin-unit42.paloaltonetworks.com/wp-content/plugins/crayon-syntax-highlighter/css/images/toolbar/ 2 KB
2 KB 50ms
49ms Image
image/png 34.96.108.115
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://origin-unit42.paloaltonetworks.com/wp-content/plugins/crayon-syntax-highlighter/css/images/toolbar/buttons.png

Requested by

Host: origin-unit42.paloaltonetworks.com
URL: https://origin-unit42.paloaltonetworks.com/wp-content/plugins/crayon-syntax-highlighter/css/min/crayon.min.css?ver=_2.7.2_beta

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

34.96.108.115 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

115.108.96.34.bc.googleusercontent.com

Software

Apache /

Resource Hash

630d0a3cc8f4c4aa7bf49b40ae6f59f3a137707e0d7bba46ba44e2e5f2c53aab

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://origin-unit42.paloaltonetworks.com/wp-content/plugins/crayon-syntax-highlighter/css/min/crayon.min.css?ver=_2.7.2_beta

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
etag: "8bc-62144eb71bbb1"
via: 1.1 google
accept-ranges: bytes
alt-svc: clear
content-length: 2236
date: Thu, 31 Oct 2024 09:50:58 GMT
last-modified: Wed, 04 Sep 2024 06:02:31 GMT
content-type: image/png
server: Apache

GET
H2 200 icon-left-arrow-thin.svg
origin-unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/ 220 B
280 B 54ms
53ms Image
image/svg+xml 34.96.108.115
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://origin-unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-left-arrow-thin.svg

Requested by

Host: origin-unit42.paloaltonetworks.com
URL: https://origin-unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/css/main-redesign.css?ver=1.0.0

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

34.96.108.115 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

115.108.96.34.bc.googleusercontent.com

Software

Apache /

Resource Hash

a7cf8b244d991409d4714c6b310dc5596b0d3bd82e5415b7795f329ff4cfef58

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://origin-unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/css/main-redesign.css?ver=1.0.0

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
etag: "dc-62144eb8c5831"
via: 1.1 google
accept-ranges: bytes
alt-svc: clear
content-length: 220
date: Thu, 31 Oct 2024 09:50:58 GMT
last-modified: Wed, 04 Sep 2024 06:02:33 GMT
content-type: image/svg+xml
server: Apache

GET
H2 200 unit42-background-light.jpg
origin-unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/ 200 KB
200 KB 47ms
46ms Image
image/jpeg 34.96.108.115
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://origin-unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/unit42-background-light.jpg

Requested by

Host: origin-unit42.paloaltonetworks.com
URL: https://origin-unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/css/main-redesign.css?ver=1.0.0

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

34.96.108.115 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

115.108.96.34.bc.googleusercontent.com

Software

Apache /

Resource Hash

dceb3f43117d511db2c153a4ce60247146397015c7143cff4007aa2b4e14206b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://origin-unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/css/main-redesign.css?ver=1.0.0

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
etag: "31ee4-62144eb8d2351"
via: 1.1 google
accept-ranges: bytes
alt-svc: clear
content-length: 204516
date: Thu, 31 Oct 2024 09:50:58 GMT
last-modified: Wed, 04 Sep 2024 06:02:33 GMT
content-type: image/jpeg
server: Apache

GET
H2 200 TTHoves-DemiBold.woff2
origin-unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/css/fonts/ 44 KB
44 KB 50ms
47ms Font
font/woff2 34.96.108.115
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://origin-unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/css/fonts/TTHoves-DemiBold.woff2

Requested by

Host: origin-unit42.paloaltonetworks.com
URL: https://origin-unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/css/main-redesign.css?ver=1.0.0

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

34.96.108.115 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

115.108.96.34.bc.googleusercontent.com

Software

Apache /

Resource Hash

d641d350bcc57bd3783d53547afc639594db0919f88dfc20578b944a303eee13

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Origin: https://origin-unit42.paloaltonetworks.com
Referer: https://origin-unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/css/main-redesign.css?ver=1.0.0

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
etag: "b120-62144eb8b6dd1"
via: 1.1 google
accept-ranges: bytes
alt-svc: clear
content-length: 45344
date: Thu, 31 Oct 2024 09:50:58 GMT
last-modified: Wed, 04 Sep 2024 06:02:33 GMT
content-type: font/woff2
server: Apache

GET
H2 200 TTHoves-Medium.woff2
origin-unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/css/fonts/ 44 KB
44 KB 51ms
47ms Font
font/woff2 34.96.108.115
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://origin-unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/css/fonts/TTHoves-Medium.woff2

Requested by

Host: origin-unit42.paloaltonetworks.com
URL: https://origin-unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/css/main-redesign.css?ver=1.0.0

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

34.96.108.115 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

115.108.96.34.bc.googleusercontent.com

Software

Apache /

Resource Hash

d2050a121d9e9ec55ca000c98893b5875497e189c407937392c9bacf580fd03d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Origin: https://origin-unit42.paloaltonetworks.com
Referer: https://origin-unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/css/main-redesign.css?ver=1.0.0

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
etag: "afb4-62144eb8b6dd1"
via: 1.1 google
accept-ranges: bytes
alt-svc: clear
content-length: 44980
date: Thu, 31 Oct 2024 09:50:58 GMT
last-modified: Wed, 04 Sep 2024 06:02:33 GMT
content-type: font/woff2
server: Apache

GET
H2 200 TTHoves-Regular.woff2
origin-unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/css/fonts/ 43 KB
43 KB 51ms
47ms Font
font/woff2 34.96.108.115
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://origin-unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/css/fonts/TTHoves-Regular.woff2

Requested by

Host: origin-unit42.paloaltonetworks.com
URL: https://origin-unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/css/main-redesign.css?ver=1.0.0

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

34.96.108.115 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

115.108.96.34.bc.googleusercontent.com

Software

Apache /

Resource Hash

c31fcddd46165ce65b0fba30b4141e8fb2cd03930c9c7e18c1d8496ba36ebf94

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Origin: https://origin-unit42.paloaltonetworks.com
Referer: https://origin-unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/css/main-redesign.css?ver=1.0.0

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
etag: "ab54-62144eb8b6dd1"
via: 1.1 google
accept-ranges: bytes
alt-svc: clear
content-length: 43860
date: Thu, 31 Oct 2024 09:50:58 GMT
last-modified: Wed, 04 Sep 2024 06:02:33 GMT
content-type: font/woff2
server: Apache

GET
H2 200 TTHoves-Bold.woff2
origin-unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/css/fonts/ 43 KB
43 KB 51ms
48ms Font
font/woff2 34.96.108.115
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://origin-unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/css/fonts/TTHoves-Bold.woff2

Requested by

Host: origin-unit42.paloaltonetworks.com
URL: https://origin-unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/css/main-redesign.css?ver=1.0.0

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

34.96.108.115 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

115.108.96.34.bc.googleusercontent.com

Software

Apache /

Resource Hash

aee6ccc3af644a2cb7e9968062e98dc2ba4f290c20a5789f1c8b9fba25c9fe39

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Origin: https://origin-unit42.paloaltonetworks.com
Referer: https://origin-unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/css/main-redesign.css?ver=1.0.0

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
etag: "ac34-62144eb8b5e31"
via: 1.1 google
accept-ranges: bytes
alt-svc: clear
content-length: 44084
date: Thu, 31 Oct 2024 09:50:58 GMT
last-modified: Wed, 04 Sep 2024 06:02:33 GMT
content-type: font/woff2
server: Apache

GET
H2 200 monaco-webfont.woff
origin-unit42.paloaltonetworks.com/wp-content/plugins/crayon-syntax-highlighter/fonts/monaco/ 21 KB
21 KB 41ms
39ms Font
font/woff 34.96.108.115
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://origin-unit42.paloaltonetworks.com/wp-content/plugins/crayon-syntax-highlighter/fonts/monaco/monaco-webfont.woff

Requested by

Host: origin-unit42.paloaltonetworks.com
URL: https://origin-unit42.paloaltonetworks.com/wp-content/plugins/crayon-syntax-highlighter/fonts/monaco.css?ver=_2.7.2_beta

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

34.96.108.115 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

115.108.96.34.bc.googleusercontent.com

Software

Apache /

Resource Hash

9c2e1d2864f53c224d6542bed9a1ab1de620dae21a2146eb4ff982dd8fcd4567

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Origin: https://origin-unit42.paloaltonetworks.com
Referer: https://origin-unit42.paloaltonetworks.com/wp-content/plugins/crayon-syntax-highlighter/fonts/monaco.css?ver=_2.7.2_beta

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
etag: "537c-62144eb71daf1"
via: 1.1 google
accept-ranges: bytes
alt-svc: clear
content-length: 21372
date: Thu, 31 Oct 2024 09:50:58 GMT
last-modified: Wed, 04 Sep 2024 06:02:31 GMT
content-type: font/woff
server: Apache

POST
H2 200 admin-ajax.php Show response
origin-unit42.paloaltonetworks.com/wp-admin/ 136 B
403 B 500ms
498ms Fetch
text/html 34.96.108.115
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://origin-unit42.paloaltonetworks.com/wp-admin/admin-ajax.php

Requested by

Host: origin-unit42.paloaltonetworks.com
URL: https://origin-unit42.paloaltonetworks.com/wp-content/plugins/post-views-counter/js/frontend.min.js?ver=1.4.7

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

34.96.108.115 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

115.108.96.34.bc.googleusercontent.com

Software

Apache /

Resource Hash

b05efca8d14cab7b75fa86ee66b6ac76b12439aa0738f61e34cb38d3a6ff27f1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=utf-8
Referer: https://origin-unit42.paloaltonetworks.com/north-korean-threat-group-play-ransomware/

Response headers

x-robots-tag: noindex
content-encoding: gzip
x-content-type-options: nosniff
expires: Wed, 11 Jan 1984 05:00:00 GMT
alt-svc: clear
date: Thu, 31 Oct 2024 09:50:59 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: no-cache, must-revalidate, max-age=0
access-control-allow-credentials: true
referrer-policy: strict-origin-when-cross-origin
via: 1.1 google
access-control-allow-origin: https://origin-unit42.paloaltonetworks.com
content-length: 129
server: Apache

GET
H2 200 uwt.js Show response
static.ads-twitter.com/ 57 KB
16 KB 229ms
23ms Script
application/javascript 146.75.76.157
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://static.ads-twitter.com/uwt.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/9273d4aedcd2/0d76ae0322d7/launch-cc3e77767d1b-development.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 146.75.76.157 Chicago, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: d4963b8afebfa0063b5d17b4c80f49bce702a37ea5c9b91bb3c996bb9dea4b60

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://origin-unit42.paloaltonetworks.com/

Response headers

vary: Accept-Encoding,Host
cache-control: no-cache
content-encoding: gzip
etag: "4328e910de583ad53b3a7a76455af005+gzip+gzip"
accept-ranges: bytes
x-cache: HIT, HIT
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
content-length: 15926
date: Thu, 31 Oct 2024 09:51:00 GMT
x-tw-cdn: FT
last-modified: Tue, 29 Oct 2024 20:04:45 GMT
content-type: application/javascript; charset=utf-8
x-served-by: cache-iad-kcgs7200099-IAD, cache-chi-kigq8000084-CHI
x-amz-server-side-encryption: AES256

GET
H2

200

rd Show response
dpm.demdex.net/id/
Redirect Chain

https://dpm.demdex.net/id?d_visid_ver=5.5.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=9A531C8B532965080A490D4D%40AdobeOrg&d_nsid=0&ts=1730368259825
https://dpm.demdex.net/id/rd?d_visid_ver=5.5.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=9A531C8B532965080A490D4D%40AdobeOrg&d_nsid=0&ts=1730368259825

217 B
825 B

18ms
17ms

XHR
application/json

52.20.18.175
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://dpm.demdex.net/id/rd?d_visid_ver=5.5.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=9A531C8B532965080A490D4D%40AdobeOrg&d_nsid=0&ts=1730368259825

Requested by

Host: origin-unit42.paloaltonetworks.com
URL: https://origin-unit42.paloaltonetworks.com/north-korean-threat-group-play-ransomware/

Protocol

Server

52.20.18.175 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-52-20-18-175.compute-1.amazonaws.com

Software

Resource Hash

80af5f1d338567e6ad99f5e2ed705d60e119502f6b9c623194afe94be1f53ba6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://origin-unit42.paloaltonetworks.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
cache-control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
dcs: dcs-prod-va6-2-v066-0c7beda70.edge-va6.demdex.com 2 ms
content-encoding: gzip
pragma: no-cache
access-control-allow-credentials: true
x-tid: Gons46D0T1U=
expires: Thu, 01 Jan 1970 00:00:00 UTC
access-control-allow-origin: https://origin-unit42.paloaltonetworks.com
content-length: 210
p3p: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
date: Thu, 31 Oct 2024 09:50:59 GMT
content-type: application/json;charset=utf-8
vary: Origin

Redirect headers

strict-transport-security: max-age=31536000; includeSubDomains
cache-control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
location: https://dpm.demdex.net/id/rd?d_visid_ver=5.5.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=9A531C8B532965080A490D4D%40AdobeOrg&d_nsid=0&ts=1730368259825
dcs: dcs-prod-va6-2-v066-0e6efe763.edge-va6.demdex.com 1 ms
pragma: no-cache
access-control-allow-credentials: true
x-tid: GHEM7AiQQt8=
expires: Thu, 01 Jan 1970 00:00:00 UTC
access-control-allow-origin: https://origin-unit42.paloaltonetworks.com
content-length: 0
p3p: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
date: Thu, 31 Oct 2024 09:50:59 GMT
vary: Origin

GET
H2 200 AppMeasurement.min.js Show response
assets.adobedtm.com/extensions/EP8757b503532a44a68eee17773f6f10a0/ 35 KB
13 KB 16ms
16ms Script
application/x-javascript 2600:1408:ac00:19b::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://assets.adobedtm.com/extensions/EP8757b503532a44a68eee17773f6f10a0/AppMeasurement.min.js

Requested by

Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/9273d4aedcd2/0d76ae0322d7/launch-cc3e77767d1b-development.min.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2600:1408:ac00:19b::1e80 Ashburn, United States, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

AkamaiNetStorage /

Resource Hash

b3bce010c0f5a7c24a82ae511194baf67bf8c2cee737a3a118f6b9590d322b15

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://origin-unit42.paloaltonetworks.com/

Response headers

cache-control: no-cache
timing-allow-origin: *
content-encoding: gzip
etag: "d8232f86c8016a8e0acaa7ecfdf72b3e:1722493571.189276"
x-content-type-options: nosniff
expires: Thu, 31 Oct 2024 10:50:59 GMT
accept-ranges: bytes
access-control-allow-origin: https://origin-unit42.paloaltonetworks.com
content-length: 13012
date: Thu, 31 Oct 2024 09:50:59 GMT
content-type: application/x-javascript
last-modified: Thu, 01 Aug 2024 06:26:11 GMT
server: AkamaiNetStorage
vary: Accept-Encoding

GET
H2 200 AppMeasurement_Module_ActivityMap.min.js Show response
assets.adobedtm.com/extensions/EP8757b503532a44a68eee17773f6f10a0/ 3 KB
2 KB 18ms
17ms Script
application/x-javascript 2600:1408:ac00:19b::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://assets.adobedtm.com/extensions/EP8757b503532a44a68eee17773f6f10a0/AppMeasurement_Module_ActivityMap.min.js

Requested by

Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/9273d4aedcd2/0d76ae0322d7/launch-cc3e77767d1b-development.min.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2600:1408:ac00:19b::1e80 Ashburn, United States, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

AkamaiNetStorage /

Resource Hash

9a54e6b1253d785972ccaab75a888119d13083bfb1f80343aef9454d5cd5bb6d

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://origin-unit42.paloaltonetworks.com/

Response headers

cache-control: no-cache
timing-allow-origin: *
content-encoding: gzip
etag: "bb4b6453e3ab80111a2b227318d22efb:1722493571.614634"
x-content-type-options: nosniff
expires: Thu, 31 Oct 2024 10:50:59 GMT
accept-ranges: bytes
access-control-allow-origin: https://origin-unit42.paloaltonetworks.com
content-length: 1597
date: Thu, 31 Oct 2024 09:50:59 GMT
content-type: application/x-javascript
last-modified: Thu, 01 Aug 2024 06:26:11 GMT
server: AkamaiNetStorage
vary: Accept-Encoding

GET
H2 200 otSDKStub.js Show response
cdn.cookielaw.org/scripttemplates/ 22 KB
8 KB 121ms
24ms Script
application/javascript 2606:4700::6812:572a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/otSDKStub.js

Requested by

Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/9273d4aedcd2/0d76ae0322d7/launch-cc3e77767d1b-development.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:572a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7358c5616f671017f307d161644d253f0f81083b0be68f3a3fefefa33b59de5d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://origin-unit42.paloaltonetworks.com/

Response headers

content-md5: qVqAwzZMp5y69q24H0KNhg==
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
content-encoding: gzip
x-ms-version: 2009-09-19
etag: 0x8DCF832FB5A8B8E
x-ms-lease-status: unlocked
cf-cache-status: HIT
age: 63540
x-content-type-options: nosniff
date: Thu, 31 Oct 2024 09:50:59 GMT
content-type: application/javascript
last-modified: Tue, 29 Oct 2024 16:01:42 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: max-age=86400
cross-origin-resource-policy: cross-origin
x-ms-request-id: ea261024-a01e-0045-1c1e-2a4e1b000000
cf-ray: 8db2be78ad335e70-EWR
accept-ranges: bytes
access-control-allow-origin: *
content-length: 7212
x-ms-blob-type: BlockBlob
server: cloudflare

GET
H2 200 id Show response
sstats.paloaltonetworks.com/ 48 B
483 B 356ms
16ms XHR
application/x-javascript 63.140.39.9
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://sstats.paloaltonetworks.com/id?d_visid_ver=5.5.0&d_fieldgroup=A&mcorgid=9A531C8B532965080A490D4D%40AdobeOrg&mid=19891220542191872223108456436506835943&ts=1730368259948

Requested by

Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/9273d4aedcd2/0d76ae0322d7/launch-cc3e77767d1b-development.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

63.140.39.9 , United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ip-63-140-39-9.data.adobedc.net

Software

jag /

Resource Hash

420aa7514c70283aa532ee4bcd1b8e95dc4e87fc1627737b0f27bfc41550a0f2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Referer: https://origin-unit42.paloaltonetworks.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
cache-control: no-cache, no-store, max-age=0, no-transform, private
access-control-allow-credentials: true
x-content-type-options: nosniff
access-control-allow-origin: https://origin-unit42.paloaltonetworks.com
p3p: CP="This is not a P3P policy"
content-length: 48
date: Thu, 31 Oct 2024 09:51:00 GMT
x-xss-protection: 1; mode=block
content-type: application/x-javascript;charset=utf-8
vary: Origin
server: jag

GET
H2 200 8380accb-00d6-4b05-90ec-6d405f7310d6.json Show response
cdn.cookielaw.org/consent/8380accb-00d6-4b05-90ec-6d405f7310d6/ 6 KB
2 KB 52ms
27ms XHR
application/json 2606:4700::6812:572a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/consent/8380accb-00d6-4b05-90ec-6d405f7310d6/8380accb-00d6-4b05-90ec-6d405f7310d6.json

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:572a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

eb553f40c9e6dc7c36c0224ea7d628ef44143002e9bdb0efba72655ad4b8affe

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://origin-unit42.paloaltonetworks.com/

Response headers

content-md5: 1tCk2UGK5Hg0oWGVxSWqCw==
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
content-encoding: gzip
cf-cache-status: HIT
etag: 0x8DCE1149105676A
age: 58646
x-ms-lease-status: unlocked
x-content-type-options: nosniff
x-ms-version: 2009-09-19
expires: Fri, 01 Nov 2024 09:51:00 GMT
date: Thu, 31 Oct 2024 09:51:00 GMT
content-type: application/json
last-modified: Mon, 30 Sep 2024 05:56:02 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin, cross-origin
x-ms-request-id: 7026b6e4-d01e-0068-1766-26cddb000000
cf-ray: 8db2be7919c10f59-EWR
accept-ranges: bytes
access-control-allow-origin: *
content-length: 1841
x-ms-blob-type: BlockBlob
server: cloudflare

GET
H2 200 RC6b55ab6198c8481ebd95baa7f10783d1-source.min.js Show response
assets.adobedtm.com/9273d4aedcd2/0d76ae0322d7/f42344af45de/ 3 KB
2 KB 23ms
23ms Script
application/x-javascript 2600:1408:ac00:19b::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://assets.adobedtm.com/9273d4aedcd2/0d76ae0322d7/f42344af45de/RC6b55ab6198c8481ebd95baa7f10783d1-source.min.js

Requested by

Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/9273d4aedcd2/0d76ae0322d7/launch-cc3e77767d1b-development.min.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2600:1408:ac00:19b::1e80 Ashburn, United States, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

AkamaiNetStorage /

Resource Hash

a50bafb67b5319215ad7db7e8e67bd06e176820a8c6e890739268e79f64f2c3d

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://origin-unit42.paloaltonetworks.com/

Response headers

cache-control: max-age=3600
timing-allow-origin: *
content-encoding: gzip
etag: "52584a5d6b74c667f201b70c2af5c363:1730191796.013404"
x-content-type-options: nosniff
expires: Thu, 31 Oct 2024 10:51:00 GMT
accept-ranges: bytes
access-control-allow-origin: https://origin-unit42.paloaltonetworks.com
content-length: 1383
date: Thu, 31 Oct 2024 09:51:00 GMT
content-type: application/x-javascript
last-modified: Tue, 29 Oct 2024 08:49:56 GMT
server: AkamaiNetStorage
vary: Accept-Encoding

GET
H2 200 location Show response
geolocation.onetrust.com/cookieconsentpub/v1/geo/ 69 B
305 B 291ms
24ms XHR
application/json 2606:4700:4400::6812:2089
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://geolocation.onetrust.com/cookieconsentpub/v1/geo/location

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::6812:2089 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

59e58524340cd7ad353be010374b124c242fdde10a0ed41047fe2fd4bb9e5a2e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
accept: application/json
Referer: https://origin-unit42.paloaltonetworks.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
access-control-allow-methods: GET, OPTIONS
cf-ray: 8db2be7b1e2d0f77-EWR
access-control-allow-origin: *
date: Thu, 31 Oct 2024 09:51:00 GMT
content-type: application/json
vary: Accept-Encoding
server: cloudflare
access-control-allow-headers: Content-Type

GET
H2 200 icon-Unit42-180x180-1.png
origin-unit42.paloaltonetworks.com/wp-content/uploads/2024/06/ 4 KB
4 KB 42ms
41ms Other
image/png 34.96.108.115
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://origin-unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-Unit42-180x180-1.png

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

34.96.108.115 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

115.108.96.34.bc.googleusercontent.com

Software

Apache /

Resource Hash

733573f99d112cb0a60ff0fc365854a8ebc8eec2a2e5f8f613616db3e3d29ae5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://origin-unit42.paloaltonetworks.com/north-korean-threat-group-play-ransomware/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
etag: "ec0-619fa7460c8f9"
via: 1.1 google
accept-ranges: bytes
alt-svc: clear
content-length: 3776
date: Thu, 31 Oct 2024 09:51:00 GMT
last-modified: Mon, 03 Jun 2024 11:15:45 GMT
content-type: image/png
server: Apache

GET
H2 200 otBannerSdk.js Show response
cdn.cookielaw.org/scripttemplates/202409.1.0/ 457 KB
111 KB 23ms
23ms Script
application/javascript 2606:4700::6812:572a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/202409.1.0/otBannerSdk.js

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:572a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

81a50b09cb85e4ff68788f763b8dcdc549414cecf42ca228a55ab77c971f1286

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://origin-unit42.paloaltonetworks.com/

Response headers

content-md5: Mq8sWt7aN99kE/VZ97+T8Q==
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
content-encoding: gzip
x-ms-version: 2009-09-19
etag: 0x8DCED8C88D357E6
x-ms-lease-status: unlocked
cf-cache-status: HIT
age: 11231
x-content-type-options: nosniff
expires: Fri, 01 Nov 2024 09:51:00 GMT
date: Thu, 31 Oct 2024 09:51:00 GMT
content-type: application/javascript
last-modified: Wed, 16 Oct 2024 02:45:02 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
x-ms-request-id: 22d7a51e-001e-000c-58ed-247d7b000000
cf-ray: 8db2be7b4edf5e70-EWR
accept-ranges: bytes
access-control-allow-origin: *
content-length: 113760
x-ms-blob-type: BlockBlob
server: cloudflare

GET
H2 200 en.json Show response
cdn.cookielaw.org/consent/8380accb-00d6-4b05-90ec-6d405f7310d6/018df4a9-4a0d-75e2-bc86-b4105f493f68/ 211 KB
36 KB 27ms
27ms Fetch
application/json 2606:4700::6812:572a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/consent/8380accb-00d6-4b05-90ec-6d405f7310d6/018df4a9-4a0d-75e2-bc86-b4105f493f68/en.json

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/202409.1.0/otBannerSdk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:572a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d5e54857c4548cecb4b0e39a89f7f3daa87a978364b5605269d1af92b8cc7c13

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://origin-unit42.paloaltonetworks.com/

Response headers

content-md5: C58fBmJnbjqNspbpHJmuzg==
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
content-encoding: gzip
cf-cache-status: HIT
etag: 0x8DCE11491D0AD11
age: 58646
x-ms-lease-status: unlocked
x-content-type-options: nosniff
x-ms-version: 2009-09-19
expires: Fri, 01 Nov 2024 09:51:00 GMT
date: Thu, 31 Oct 2024 09:51:00 GMT
content-type: application/json
last-modified: Mon, 30 Sep 2024 05:56:04 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin, cross-origin
x-ms-request-id: 819f5c74-001e-0025-3c66-260b39000000
cf-ray: 8db2be7babbf0f59-EWR
accept-ranges: bytes
access-control-allow-origin: *
content-length: 37002
x-ms-blob-type: BlockBlob
server: cloudflare

GET
H2 200 otFlat.json Show response
cdn.cookielaw.org/scripttemplates/202409.1.0/assets/ 13 KB
3 KB 22ms
21ms Fetch
application/json 2606:4700::6812:572a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/202409.1.0/assets/otFlat.json

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/202409.1.0/otBannerSdk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:572a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d890abf66010907c7a0a61236d25c3c98bcb7edec34b13dc887f5be122bfef7e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://origin-unit42.paloaltonetworks.com/

Response headers

content-md5: RGlYb2KBTfdkPpxIxwwu0g==
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
content-encoding: gzip
x-ms-version: 2009-09-19
etag: 0x8DCED8C8519203B
x-ms-lease-status: unlocked
cf-cache-status: HIT
age: 58646
x-content-type-options: nosniff
date: Thu, 31 Oct 2024 09:51:00 GMT
content-type: application/json
last-modified: Wed, 16 Oct 2024 02:44:56 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: max-age=86400
cross-origin-resource-policy: cross-origin
x-ms-request-id: 272e6737-f01e-00f7-6203-20b561000000
cf-ray: 8db2be7c1c150f59-EWR
accept-ranges: bytes
access-control-allow-origin: *
content-length: 3003
x-ms-blob-type: BlockBlob
server: cloudflare

GET
H2 200 otPcCenter.json Show response
cdn.cookielaw.org/scripttemplates/202409.1.0/assets/v2/ 62 KB
13 KB 21ms
20ms Fetch
application/json 2606:4700::6812:572a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/202409.1.0/assets/v2/otPcCenter.json

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/202409.1.0/otBannerSdk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:572a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7dbc72c3f0511495fdf45d42283a246613db44b0906199cef195a773068d822f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://origin-unit42.paloaltonetworks.com/

Response headers

content-md5: vNMewq08o3u2s0ZPUoZf8g==
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
content-encoding: gzip
x-ms-version: 2009-09-19
etag: 0x8DCED8C86774DF1
x-ms-lease-status: unlocked
cf-cache-status: HIT
age: 58646
x-content-type-options: nosniff
date: Thu, 31 Oct 2024 09:51:00 GMT
content-type: application/json
last-modified: Wed, 16 Oct 2024 02:44:58 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: max-age=86400
cross-origin-resource-policy: cross-origin
x-ms-request-id: a8cd7123-801e-003f-297b-1f2456000000
cf-ray: 8db2be7c1c170f59-EWR
accept-ranges: bytes
access-control-allow-origin: *
content-length: 12723
x-ms-blob-type: BlockBlob
server: cloudflare

GET
H2 200 otCommonStyles.css Show response
cdn.cookielaw.org/scripttemplates/202409.1.0/assets/ 24 KB
4 KB 22ms
22ms Fetch
text/css 2606:4700::6812:572a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/202409.1.0/assets/otCommonStyles.css

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/202409.1.0/otBannerSdk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:572a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7c2092048f21074425f3e025db78fb6505f75d6fcf2e121ced055c8d53bcb1b3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://origin-unit42.paloaltonetworks.com/

Response headers

content-md5: HyPJ72TNHxdfOI82cqKVqA==
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
x-ms-version: 2009-09-19
x-ms-lease-status: unlocked
cf-cache-status: HIT
age: 58646
content-encoding: gzip
x-content-type-options: nosniff
date: Thu, 31 Oct 2024 09:51:00 GMT
content-type: text/css
last-modified: Wed, 16 Oct 2024 02:45:07 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: max-age=86400
cross-origin-resource-policy: cross-origin
x-ms-request-id: 5641071c-a01e-0001-413c-279277000000
cf-ray: 8db2be7c1c180f59-EWR
access-control-allow-origin: *
x-ms-blob-type: BlockBlob
server: cloudflare

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 327 KB
109 KB 160ms
27ms Script
application/javascript 2607:f8b0:4004:c0b::61
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-KS2MELEEFC&l=dataLayer

Requested by

Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/9273d4aedcd2/0d76ae0322d7/launch-cc3e77767d1b-development.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c0b::61 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

0f3e216c87c073a9ec6b295233c11d03c4758b3f4e16b3577d1962165ce5f31d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://origin-unit42.paloaltonetworks.com/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],}
expires: Thu, 31 Oct 2024 09:51:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 31 Oct 2024 09:51:00 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 111348
x-xss-protection: 0
server: Google Tag Manager

GET
H2 200 id Show response
dpm.demdex.net/ 217 B
829 B 20ms
18ms XHR
application/json 52.20.18.175
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://dpm.demdex.net/id?d_visid_ver=5.5.0&d_fieldgroup=AAM&d_rtbd=json&d_ver=2&d_orgid=9A531C8B532965080A490D4D%40AdobeOrg&d_nsid=0&d_mid=19891220542191872223108456436506835943&d_blob=RKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y&d_cid_ic=ecid_id%0119891220542191872223108456436506835943%011&ts=1730368260497

Requested by

Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/9273d4aedcd2/0d76ae0322d7/launch-cc3e77767d1b-development.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.20.18.175 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-52-20-18-175.compute-1.amazonaws.com

Software

Resource Hash

4d43527ed7e9b1cf579f2ac2e33ca96e49fb3b40192ad0701c49c8d0bd8751be

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Referer: https://origin-unit42.paloaltonetworks.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
cache-control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
dcs: dcs-prod-va6-2-v066-0540d89c2.edge-va6.demdex.com 2 ms
content-encoding: gzip
pragma: no-cache
access-control-allow-credentials: true
x-tid: 7sMxq5NMQIY=
expires: Thu, 01 Jan 1970 00:00:00 UTC
access-control-allow-origin: https://origin-unit42.paloaltonetworks.com
content-length: 213
p3p: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
date: Thu, 31 Oct 2024 09:51:00 GMT
content-type: application/json;charset=utf-8
vary: Origin

GET
H2 200 e78feef73ff94c88.min.js Show response
scripts.demandbase.com/adobeanalytics/ 8 KB
3 KB 146ms
14ms Script
application/javascript 18.160.10.89
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://scripts.demandbase.com/adobeanalytics/e78feef73ff94c88.min.js

Requested by

Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/9273d4aedcd2/0d76ae0322d7/launch-cc3e77767d1b-development.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.160.10.89 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-160-10-89.iad12.r.cloudfront.net

Software

AmazonS3 /

Resource Hash

f38eb48171eed2313e3952632eab4dc722602c444a46827cac9a9b0e99e83aff

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://origin-unit42.paloaltonetworks.com/

Response headers

content-encoding: gzip
etag: W/"efcba3ec699799b095156f01362d1dea"
x-amz-version-id: clbvuUuEZNAb3S_zPKrzNrFP700xhOoe
age: 11117
x-cache: Hit from cloudfront
x-amz-cf-id: Chrnm79y6XZzzSE9Uf6A9vS4SF3795qm-rYDlZubon1E1otJKSivRg==
date: Thu, 31 Oct 2024 06:45:44 GMT
content-type: application/javascript
vary: accept-encoding
last-modified: Fri, 09 Aug 2024 00:42:45 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
via: 1.1 fb1dc2e3bf4105b403e3bfa3a5067970.cloudfront.net (CloudFront)
permissions-policy: accelerometer=(), camera=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), payment=(), usb=(), interest-cohort=()
x-amz-cf-pop: IAD12-P3
server: AmazonS3
x-amz-server-side-encryption: AES256

GET
H2 200 RC28af36aced42454081fe164153d8348f-source.min.js Show response
assets.adobedtm.com/9273d4aedcd2/0d76ae0322d7/f42344af45de/ 354 B
514 B 49ms
49ms Script
application/x-javascript 2600:1408:ac00:19b::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://assets.adobedtm.com/9273d4aedcd2/0d76ae0322d7/f42344af45de/RC28af36aced42454081fe164153d8348f-source.min.js

Requested by

Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/9273d4aedcd2/0d76ae0322d7/launch-cc3e77767d1b-development.min.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2600:1408:ac00:19b::1e80 Ashburn, United States, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

AkamaiNetStorage /

Resource Hash

700f4bb32d3aee7003dc4a736ddadb440c59749146d865ee41fcc634df26987e

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://origin-unit42.paloaltonetworks.com/

Response headers

cache-control: max-age=3600
timing-allow-origin: *
content-encoding: gzip
etag: "52584a5d6b74c667f201b70c2af5c363:1730191796.013404"
x-content-type-options: nosniff
expires: Thu, 31 Oct 2024 10:51:00 GMT
accept-ranges: bytes
access-control-allow-origin: https://origin-unit42.paloaltonetworks.com
content-length: 222
date: Thu, 31 Oct 2024 09:51:00 GMT
content-type: application/x-javascript
last-modified: Tue, 29 Oct 2024 08:49:56 GMT
server: AkamaiNetStorage
vary: Accept-Encoding

GET
H2 200 ot_close.svg
cdn.cookielaw.org/logos/static/ 651 B
601 B 21ms
20ms Image
image/svg+xml 2606:4700::6812:572a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cdn.cookielaw.org/logos/static/ot_close.svg

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:572a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

901bb0e03b8c3c0a1cf4c487a177417328bb7d8c94106ecefceedd7d7f6c4ddc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://origin-unit42.paloaltonetworks.com/

Response headers

content-md5: pcXWFGpuVeSg/jVnYCseRg==
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
x-ms-version: 2009-09-19
x-ms-lease-status: unlocked
cf-cache-status: HIT
age: 43602
content-encoding: gzip
x-content-type-options: nosniff
date: Thu, 31 Oct 2024 09:51:00 GMT
content-type: image/svg+xml
last-modified: Wed, 30 Oct 2024 03:57:55 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: max-age=86400
cross-origin-resource-policy: cross-origin
x-ms-request-id: ffe72063-201e-00dc-5bfb-2ac1d9000000
cf-ray: 8db2be7d28425e70-EWR
access-control-allow-origin: *
x-ms-blob-type: BlockBlob
server: cloudflare

GET
H2 200 ot_guard_logo.svg Show response
cdn.cookielaw.org/logos/static/ 497 B
495 B 23ms
22ms Fetch
image/svg+xml 2606:4700::6812:572a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/logos/static/ot_guard_logo.svg

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/202409.1.0/otBannerSdk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:572a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

691dcdb24853a0f5ce4e6597e5713dea66799b57ffe2c2a10f28f98e0b569b19

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://origin-unit42.paloaltonetworks.com/

Response headers

content-md5: tXyZydHjxQshFMbbBT1/8A==
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
x-ms-version: 2009-09-19
x-ms-lease-status: unlocked
cf-cache-status: HIT
age: 58645
content-encoding: gzip
x-content-type-options: nosniff
date: Thu, 31 Oct 2024 09:51:00 GMT
content-type: image/svg+xml
last-modified: Tue, 29 Oct 2024 16:01:48 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: max-age=86400
cross-origin-resource-policy: cross-origin
x-ms-request-id: bb051deb-801e-00f3-7742-2a40e3000000
cf-ray: 8db2be7d3cdc0f59-EWR
access-control-allow-origin: *
x-ms-blob-type: BlockBlob
server: cloudflare

GET
H2 200 ot_company_logo.png
cdn.cookielaw.org/logos/static/ 4 KB
4 KB 27ms
15ms Image
image/png 2606:4700::6812:572a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cdn.cookielaw.org/logos/static/ot_company_logo.png

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:572a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a335fc1da4a5ffc1fcacfa3eab57506faa41f026954496becb59cf5fbcd99d0e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://origin-unit42.paloaltonetworks.com/

Response headers

content-md5: E8+sk/ECzKgTUVtDLikiIA==
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
x-ms-version: 2009-09-19
x-ms-lease-status: unlocked
etag: 0x8DCF897090A453A
age: 33386
cf-cache-status: HIT
x-content-type-options: nosniff
date: Thu, 31 Oct 2024 09:51:00 GMT
content-type: image/png
last-modified: Wed, 30 Oct 2024 03:57:55 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: max-age=86400
cross-origin-resource-policy: cross-origin
x-ms-request-id: 946a8f3d-101e-003a-29f7-2ad029000000
cf-ray: 8db2be7d68715e70-EWR
accept-ranges: bytes
access-control-allow-origin: *
content-length: 4036
x-ms-blob-type: BlockBlob
server: cloudflare

GET
H2 200 powered_by_logo.svg
cdn.cookielaw.org/logos/static/ 5 KB
2 KB 32ms
19ms Image
image/svg+xml 2606:4700::6812:572a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cdn.cookielaw.org/logos/static/powered_by_logo.svg

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:572a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5fa00d047acd959697b9d7772c31dcd37bec33c70c6fbf80ab8316205d1d286d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://origin-unit42.paloaltonetworks.com/

Response headers

content-md5: Y+c301RBZNK39PvKQWrIBw==
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
x-ms-version: 2009-09-19
x-ms-lease-status: unlocked
cf-cache-status: HIT
age: 58192
content-encoding: gzip
x-content-type-options: nosniff
date: Thu, 31 Oct 2024 09:51:00 GMT
content-type: image/svg+xml
last-modified: Wed, 30 Oct 2024 03:57:55 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: max-age=86400
cross-origin-resource-policy: cross-origin
x-ms-request-id: 10006a89-b01e-001e-51f0-2a4967000000
cf-ray: 8db2be7d68735e70-EWR
access-control-allow-origin: *
x-ms-blob-type: BlockBlob
server: cloudflare

GET
H2 200 ip.json Show response
api.company-target.com/api/v3/ 509 B
750 B 240ms
38ms Script
application/javascript 13.249.39.123
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://api.company-target.com/api/v3/ip.json?auth=mTSWoP7tDDj1bmrfd7DoCwq1MAt3SukHko7rQP5o&callback=Dmdbase_CDC.callback
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/9273d4aedcd2/0d76ae0322d7/launch-cc3e77767d1b-development.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.249.39.123 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-249-39-123.iad89.r.cloudfront.net
Software: nginx /
Resource Hash: 8f55274889284faaee3117c41f0e0c513fe9e190a7f8d427f972fd8d74e50579

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://origin-unit42.paloaltonetworks.com/

Response headers

cache-control: no-cache, no-store, max-age=0, must-revalidate
content-encoding: gzip
pragma: no-cache
api-version: v3
identification-source: CENTRAL
request-id: 8ba64764-e768-41ab-bb21-cc297ccc1281
via: 1.1 7c4bbd97f5be908e33f403c3794f629a.cloudfront.net (CloudFront)
expires: Wed, 30 Oct 2024 09:51:00 GMT
x-cache: Miss from cloudfront
x-amz-cf-id: PvMcXQHUMCL3o5r8G2TMPfabZhln94KIo08-yCtx5CCqB0e-0YHgoQ==
date: Thu, 31 Oct 2024 09:51:00 GMT
content-type: application/javascript;charset=utf-8
vary: Accept-Encoding, Origin
server: nginx
x-amz-cf-pop: IAD89-C1

POST
H2 200 delivery Show response
paloaltonetworks.tt.omtrdc.net/rest/v1/ 516 B
935 B 176ms
32ms XHR
application/json 63.140.39.82
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://paloaltonetworks.tt.omtrdc.net/rest/v1/delivery?client=paloaltonetworks&sessionId=9ad39a62a53c4b94a0b81d9afa7587a9&version=2.10.3

Requested by

Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/9273d4aedcd2/0d76ae0322d7/launch-cc3e77767d1b-development.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

63.140.39.82 , United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ip-63-140-39-82.data.adobedc.net

Software

jag /

Resource Hash

757cf815bc0fc1197050c789f247fdf11d91ca82ada5fb14b73ab6f1221543c3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://origin-unit42.paloaltonetworks.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
x-request-id: 6f1b2668-54f8-4671-a37f-ae939fdc0ba1
cache-control: no-cache, no-store, max-age=0, no-transform, private
timing-allow-origin: *
content-encoding: gzip
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List
access-control-allow-credentials: true
referrer-policy: strict-origin-when-cross-origin
x-content-type-options: nosniff
access-control-allow-origin: https://origin-unit42.paloaltonetworks.com
date: Thu, 31 Oct 2024 09:51:01 GMT
x-xss-protection: 1; mode=block
content-type: application/json;charset=UTF-8
vary: origin,access-control-request-method,access-control-request-headers,accept-encoding
server: jag

GET
H2 200 RC7d646ca6a266471b8b1bbf709829b670-source.min.js Show response
assets.adobedtm.com/9273d4aedcd2/0d76ae0322d7/f42344af45de/ 662 B
694 B 24ms
21ms Script
application/x-javascript 2600:1408:ac00:19b::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://assets.adobedtm.com/9273d4aedcd2/0d76ae0322d7/f42344af45de/RC7d646ca6a266471b8b1bbf709829b670-source.min.js

Requested by

Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/9273d4aedcd2/0d76ae0322d7/launch-cc3e77767d1b-development.min.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2600:1408:ac00:19b::1e80 Ashburn, United States, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

AkamaiNetStorage /

Resource Hash

85149e421da51caa7ce4941a139ffedb9facacf1288cb58889ac38405f9d8992

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://origin-unit42.paloaltonetworks.com/

Response headers

cache-control: max-age=3600
timing-allow-origin: *
content-encoding: gzip
etag: "52584a5d6b74c667f201b70c2af5c363:1730191796.013404"
x-content-type-options: nosniff
expires: Thu, 31 Oct 2024 10:51:00 GMT
accept-ranges: bytes
access-control-allow-origin: https://origin-unit42.paloaltonetworks.com
content-length: 402
date: Thu, 31 Oct 2024 09:51:00 GMT
content-type: application/x-javascript
last-modified: Tue, 29 Oct 2024 08:49:56 GMT
server: AkamaiNetStorage
vary: Accept-Encoding

GET
H2 200 RC34b76ac432444262961778f97b726c8f-source.min.js Show response
assets.adobedtm.com/9273d4aedcd2/0d76ae0322d7/f42344af45de/ 3 KB
1 KB 22ms
18ms Script
application/x-javascript 2600:1408:ac00:19b::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://assets.adobedtm.com/9273d4aedcd2/0d76ae0322d7/f42344af45de/RC34b76ac432444262961778f97b726c8f-source.min.js

Requested by

Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/9273d4aedcd2/0d76ae0322d7/launch-cc3e77767d1b-development.min.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2600:1408:ac00:19b::1e80 Ashburn, United States, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

AkamaiNetStorage /

Resource Hash

42b6fbca1903d9687db341dabf468cac459c478d3afb79d8a5d6859dc6bb1f4c

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://origin-unit42.paloaltonetworks.com/

Response headers

cache-control: max-age=3600
timing-allow-origin: *
content-encoding: gzip
etag: "52584a5d6b74c667f201b70c2af5c363:1730191796.013404"
x-content-type-options: nosniff
expires: Thu, 31 Oct 2024 10:51:00 GMT
accept-ranges: bytes
access-control-allow-origin: https://origin-unit42.paloaltonetworks.com
content-length: 737
date: Thu, 31 Oct 2024 09:51:00 GMT
content-type: application/x-javascript
last-modified: Tue, 29 Oct 2024 08:49:56 GMT
server: AkamaiNetStorage
vary: Accept-Encoding

GET
H2 200 RCc8e353d2880f4911b4ae8de67798604e-source.min.js Show response
assets.adobedtm.com/9273d4aedcd2/0d76ae0322d7/f42344af45de/ 630 B
679 B 28ms
25ms Script
application/x-javascript 2600:1408:ac00:19b::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://assets.adobedtm.com/9273d4aedcd2/0d76ae0322d7/f42344af45de/RCc8e353d2880f4911b4ae8de67798604e-source.min.js

Requested by

Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/9273d4aedcd2/0d76ae0322d7/launch-cc3e77767d1b-development.min.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2600:1408:ac00:19b::1e80 Ashburn, United States, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

AkamaiNetStorage /

Resource Hash

b4e60138a0aec24caaa4536aaf38941d6eb5a2d27863b4f9ea6947b025a9c554

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://origin-unit42.paloaltonetworks.com/

Response headers

cache-control: max-age=3600
timing-allow-origin: *
content-encoding: gzip
etag: "52584a5d6b74c667f201b70c2af5c363:1730191796.013404"
x-content-type-options: nosniff
expires: Thu, 31 Oct 2024 10:51:00 GMT
accept-ranges: bytes
access-control-allow-origin: https://origin-unit42.paloaltonetworks.com
content-length: 386
date: Thu, 31 Oct 2024 09:51:00 GMT
content-type: application/x-javascript
last-modified: Tue, 29 Oct 2024 08:49:56 GMT
server: AkamaiNetStorage
vary: Accept-Encoding

GET
H/1.1 200
OK munchkin.js Show response
munchkin.marketo.net/ 1 KB
1 KB 161ms
61ms Script
application/x-javascript 23.13.172.203
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://munchkin.marketo.net/munchkin.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/9273d4aedcd2/0d76ae0322d7/launch-cc3e77767d1b-development.min.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.13.172.203 Ashburn, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-13-172-203.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 57d030752d740552eb7759a0dd8e487e96ca86b03c0aa53a7e2b1c213ae74f5f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://origin-unit42.paloaltonetworks.com/

Response headers

Content-Encoding: gzip
ETag: "49bb20382072bfb6b798a6f4c6ab8354:1730261707.305765"
Connection: keep-alive
Accept-Ranges: bytes
P3P: policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR"
Content-Length: 746
Date: Thu, 31 Oct 2024 09:51:01 GMT
Content-Type: application/x-javascript
Last-Modified: Wed, 30 Oct 2024 04:15:07 GMT
Server: AkamaiNetStorage
Vary: Accept-Encoding

GET
H2 200 RCe5d226ef2c2a44a4926fd34f4c9486f1-source.min.js Show response
assets.adobedtm.com/9273d4aedcd2/0d76ae0322d7/f42344af45de/ 1 KB
920 B 31ms
30ms Script
application/x-javascript 2600:1408:ac00:19b::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://assets.adobedtm.com/9273d4aedcd2/0d76ae0322d7/f42344af45de/RCe5d226ef2c2a44a4926fd34f4c9486f1-source.min.js

Requested by

Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/9273d4aedcd2/0d76ae0322d7/launch-cc3e77767d1b-development.min.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2600:1408:ac00:19b::1e80 Ashburn, United States, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

AkamaiNetStorage /

Resource Hash

e1cf65d6f8192da8c46306ee906f6aec18d8a788d3949d4d904b1aee571d92f2

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://origin-unit42.paloaltonetworks.com/

Response headers

cache-control: max-age=3600
timing-allow-origin: *
content-encoding: gzip
etag: "52584a5d6b74c667f201b70c2af5c363:1730191796.013404"
x-content-type-options: nosniff
expires: Thu, 31 Oct 2024 10:51:01 GMT
accept-ranges: bytes
access-control-allow-origin: https://origin-unit42.paloaltonetworks.com
content-length: 627
date: Thu, 31 Oct 2024 09:51:01 GMT
content-type: application/x-javascript
last-modified: Tue, 29 Oct 2024 08:49:56 GMT
server: AkamaiNetStorage
vary: Accept-Encoding

GET
H2 200 RCbd5c2f0812594f2482f0055c2adc3e7b-source.min.js Show response
assets.adobedtm.com/9273d4aedcd2/0d76ae0322d7/f42344af45de/ 919 B
791 B 24ms
23ms Script
application/x-javascript 2600:1408:ac00:19b::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://assets.adobedtm.com/9273d4aedcd2/0d76ae0322d7/f42344af45de/RCbd5c2f0812594f2482f0055c2adc3e7b-source.min.js

Requested by

Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/9273d4aedcd2/0d76ae0322d7/launch-cc3e77767d1b-development.min.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2600:1408:ac00:19b::1e80 Ashburn, United States, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

AkamaiNetStorage /

Resource Hash

71db677358e887db6da1f158b5d6fbb43d8f7908f7ead5e457abb081fa2fa474

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://origin-unit42.paloaltonetworks.com/

Response headers

cache-control: max-age=3600
timing-allow-origin: *
content-encoding: gzip
etag: "52584a5d6b74c667f201b70c2af5c363:1730191796.013404"
x-content-type-options: nosniff
expires: Thu, 31 Oct 2024 10:51:00 GMT
accept-ranges: bytes
access-control-allow-origin: https://origin-unit42.paloaltonetworks.com
content-length: 498
date: Thu, 31 Oct 2024 09:51:00 GMT
content-type: application/x-javascript
last-modified: Tue, 29 Oct 2024 08:49:56 GMT
server: AkamaiNetStorage
vary: Accept-Encoding

GET
H2 200 RC05b877f004fb4eeca593d2b02eb203e7-source.min.js Show response
assets.adobedtm.com/9273d4aedcd2/0d76ae0322d7/f42344af45de/ 1 KB
846 B 28ms
22ms Script
application/x-javascript 2600:1408:ac00:19b::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://assets.adobedtm.com/9273d4aedcd2/0d76ae0322d7/f42344af45de/RC05b877f004fb4eeca593d2b02eb203e7-source.min.js

Requested by

Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/9273d4aedcd2/0d76ae0322d7/launch-cc3e77767d1b-development.min.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2600:1408:ac00:19b::1e80 Ashburn, United States, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

AkamaiNetStorage /

Resource Hash

527233b144bed93cbc45b8a187bce2f5468dcbf4b6be4c566349ce3528ef8b3b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://origin-unit42.paloaltonetworks.com/

Response headers

cache-control: max-age=3600
timing-allow-origin: *
content-encoding: gzip
etag: "52584a5d6b74c667f201b70c2af5c363:1730191796.013404"
x-content-type-options: nosniff
expires: Thu, 31 Oct 2024 10:51:01 GMT
accept-ranges: bytes
access-control-allow-origin: https://origin-unit42.paloaltonetworks.com
content-length: 553
date: Thu, 31 Oct 2024 09:51:01 GMT
content-type: application/x-javascript
last-modified: Tue, 29 Oct 2024 08:49:56 GMT
server: AkamaiNetStorage
vary: Accept-Encoding

GET
H2 200 insight.min.js Show response
snap.licdn.com/li.lms-analytics/ 40 KB
14 KB 70ms
14ms Script
application/javascript 2600:1408:c400:5::17c7:3716
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://snap.licdn.com/li.lms-analytics/insight.min.js

Requested by

Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/9273d4aedcd2/0d76ae0322d7/launch-cc3e77767d1b-development.min.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2600:1408:c400:5::17c7:3716 Ashburn, United States, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Resource Hash

4e8276aea0a3c7fe3600e6718c7f484d49c347c8d5763d89be95900d526a14da

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://origin-unit42.paloaltonetworks.com/

Response headers

cache-control: max-age=24917
content-encoding: gzip
x-cdn: AKAM
x-content-type-options: nosniff
accept-ranges: bytes
content-length: 14628
date: Thu, 31 Oct 2024 09:51:01 GMT
last-modified: Thu, 22 Aug 2024 11:06:54 GMT
content-type: application/javascript;charset=utf-8
vary: Accept-Encoding
x-amz-server-side-encryption: AES256

GET
H2 200 RC907e8db187884e00b0a52415cea7d3bb-source.min.js Show response
assets.adobedtm.com/9273d4aedcd2/0d76ae0322d7/f42344af45de/ 1 KB
903 B 27ms
22ms Script
application/x-javascript 2600:1408:ac00:19b::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://assets.adobedtm.com/9273d4aedcd2/0d76ae0322d7/f42344af45de/RC907e8db187884e00b0a52415cea7d3bb-source.min.js

Requested by

Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/9273d4aedcd2/0d76ae0322d7/launch-cc3e77767d1b-development.min.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2600:1408:ac00:19b::1e80 Ashburn, United States, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

AkamaiNetStorage /

Resource Hash

77bb0181e1343a160ca09a32f8bf7fa666e3f5558ecc2156889b2e9cdc44fdcb

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://origin-unit42.paloaltonetworks.com/

Response headers

cache-control: max-age=3600
timing-allow-origin: *
content-encoding: gzip
etag: "52584a5d6b74c667f201b70c2af5c363:1730191796.013404"
x-content-type-options: nosniff
expires: Thu, 31 Oct 2024 10:51:01 GMT
accept-ranges: bytes
access-control-allow-origin: https://origin-unit42.paloaltonetworks.com
content-length: 611
date: Thu, 31 Oct 2024 09:51:01 GMT
content-type: application/x-javascript
last-modified: Tue, 29 Oct 2024 08:49:56 GMT
server: AkamaiNetStorage
vary: Accept-Encoding

GET
H2 200 bat.js Show response
bat.bing.com/ 50 KB
15 KB 121ms
25ms Script
application/javascript 2620:1ec:33::10
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://bat.bing.com/bat.js

Requested by

Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/9273d4aedcd2/0d76ae0322d7/launch-cc3e77767d1b-development.min.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2620:1ec:33::10 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

aabc88a6db8b22022f96ca88e4f0a7be426abef2b35169a71515a2d55246402a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://origin-unit42.paloaltonetworks.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: private,max-age=1800
content-encoding: gzip
etag: "028e0691d20db1:0"
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 6513E41011F848C38EE09EC788D27761 Ref B: EWR30EDGE1021 Ref C: 2024-10-31T09:51:01Z
accept-ranges: bytes
x-cache: CONFIG_NOCACHE
content-length: 14570
date: Thu, 31 Oct 2024 09:51:00 GMT
content-type: application/javascript
last-modified: Wed, 16 Oct 2024 22:47:44 GMT
vary: Accept-Encoding

GET
H2 200 RC804c51da85a14ee9a5fb1c7d837bc14c-source.min.js Show response
assets.adobedtm.com/9273d4aedcd2/0d76ae0322d7/f42344af45de/ 2 KB
1 KB 26ms
22ms Script
application/x-javascript 2600:1408:ac00:19b::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://assets.adobedtm.com/9273d4aedcd2/0d76ae0322d7/f42344af45de/RC804c51da85a14ee9a5fb1c7d837bc14c-source.min.js

Requested by

Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/9273d4aedcd2/0d76ae0322d7/launch-cc3e77767d1b-development.min.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2600:1408:ac00:19b::1e80 Ashburn, United States, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

AkamaiNetStorage /

Resource Hash

adc1a92ef35a0861a5e047c17abaadb2553e81993727edf9ef6a4c80c9bdb348

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://origin-unit42.paloaltonetworks.com/

Response headers

cache-control: max-age=3600
timing-allow-origin: *
content-encoding: gzip
etag: "52584a5d6b74c667f201b70c2af5c363:1730191796.013404"
x-content-type-options: nosniff
expires: Thu, 31 Oct 2024 10:51:01 GMT
accept-ranges: bytes
access-control-allow-origin: https://origin-unit42.paloaltonetworks.com
content-length: 873
date: Thu, 31 Oct 2024 09:51:01 GMT
content-type: application/x-javascript
last-modified: Tue, 29 Oct 2024 08:49:56 GMT
server: AkamaiNetStorage
vary: Accept-Encoding

GET
H2 200 RCf6d5e26d452f4c7c9f8c8fd1b87a3dc2-source.min.js Show response
assets.adobedtm.com/9273d4aedcd2/0d76ae0322d7/f42344af45de/ 797 B
755 B 28ms
25ms Script
application/x-javascript 2600:1408:ac00:19b::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://assets.adobedtm.com/9273d4aedcd2/0d76ae0322d7/f42344af45de/RCf6d5e26d452f4c7c9f8c8fd1b87a3dc2-source.min.js

Requested by

Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/9273d4aedcd2/0d76ae0322d7/launch-cc3e77767d1b-development.min.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2600:1408:ac00:19b::1e80 Ashburn, United States, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

AkamaiNetStorage /

Resource Hash

b8134eb6ee8a0f57c2bc5eb023e409088f9bf66bb938c3f8d6f8d47c212b948b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://origin-unit42.paloaltonetworks.com/

Response headers

cache-control: max-age=3600
timing-allow-origin: *
content-encoding: gzip
etag: "52584a5d6b74c667f201b70c2af5c363:1730191796.013404"
x-content-type-options: nosniff
expires: Thu, 31 Oct 2024 10:51:01 GMT
accept-ranges: bytes
access-control-allow-origin: https://origin-unit42.paloaltonetworks.com
content-length: 462
date: Thu, 31 Oct 2024 09:51:01 GMT
content-type: application/x-javascript
last-modified: Tue, 29 Oct 2024 08:49:56 GMT
server: AkamaiNetStorage
vary: Accept-Encoding

GET
H2 200 adsct
t.co/i/ 43 B
627 B 114ms
74ms Image
image/gif 162.159.140.229
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://t.co/i/adsct?bci=3&dv=Pacific%2FHonolulu%26en-US%2Cen%26Google%20Inc.%26Linux%20x86_64%26255%261600%261200%2616%2624%261600%261200%260%26na&eci=2&event_id=16917bb9-0f52-4e2f-8d85-735dae5824cd&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=bf32ad68-c7fd-4ac3-b863-efe98bc87507&tw_document_href=https%3A%2F%2Forigin-unit42.paloaltonetworks.com%2Fnorth-korean-threat-group-play-ransomware%2F&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=nx71z&type=javascript&version=2.3.31

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.159.140.229 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare tsa_b /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://origin-unit42.paloaltonetworks.com/

Response headers

strict-transport-security: max-age=0
x-transaction-id: 0d1e57fad6a1eac7
cache-control: no-cache, no-store, max-age=0
x-connection-hash: d6735e5fa69e4314a82e80004b66afcb3f64ac6bbf09ad45357b24a67b95acf6
cf-cache-status: DYNAMIC
cf-ray: 8db2be7f9db18c4e-EWR
x-response-time: 5
content-length: 43
date: Thu, 31 Oct 2024 09:51:01 GMT
content-type: image/gif;charset=utf-8
perf: 7402827104
server: cloudflare tsa_b

GET
H2 200 adsct
analytics.twitter.com/i/ 43 B
394 B 195ms
47ms Image
image/gif 104.244.42.131
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://analytics.twitter.com/i/adsct?bci=3&dv=Pacific%2FHonolulu%26en-US%2Cen%26Google%20Inc.%26Linux%20x86_64%26255%261600%261200%2616%2624%261600%261200%260%26na&eci=2&event_id=16917bb9-0f52-4e2f-8d85-735dae5824cd&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=bf32ad68-c7fd-4ac3-b863-efe98bc87507&tw_document_href=https%3A%2F%2Forigin-unit42.paloaltonetworks.com%2Fnorth-korean-threat-group-play-ransomware%2F&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=nx71z&type=javascript&version=2.3.31

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.244.42.131 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_b /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://origin-unit42.paloaltonetworks.com/

Response headers

strict-transport-security: max-age=631138519
x-transaction-id: 870b38b38a9675a2
cache-control: no-cache, no-store, max-age=0
x-connection-hash: 70f85acf4864d50906779f0570ee470fadbf63ec4bfb5c6f5ac8e6a5b9afb810
x-response-time: 7
content-length: 43
date: Thu, 31 Oct 2024 09:51:00 GMT
perf: 7402827104
content-type: image/gif;charset=utf-8
server: tsa_b

GET
H2 200 RCf6d4826d37ce4f1ba34849c12d842c48-source.min.js Show response
assets.adobedtm.com/9273d4aedcd2/0d76ae0322d7/f42344af45de/ 579 B
658 B 190ms
187ms Script
application/x-javascript 2600:1408:ac00:19b::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://assets.adobedtm.com/9273d4aedcd2/0d76ae0322d7/f42344af45de/RCf6d4826d37ce4f1ba34849c12d842c48-source.min.js

Requested by

Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/9273d4aedcd2/0d76ae0322d7/launch-cc3e77767d1b-development.min.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2600:1408:ac00:19b::1e80 Ashburn, United States, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

AkamaiNetStorage /

Resource Hash

25e69ce7cbe74899e00042ac10797cb8023ff7d83bf27aae9f05a20c7003054f

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://origin-unit42.paloaltonetworks.com/

Response headers

cache-control: max-age=3600
timing-allow-origin: *
content-encoding: gzip
etag: "52584a5d6b74c667f201b70c2af5c363:1730191796.013404"
x-content-type-options: nosniff
expires: Thu, 31 Oct 2024 10:51:01 GMT
accept-ranges: bytes
access-control-allow-origin: https://origin-unit42.paloaltonetworks.com
content-length: 365
date: Thu, 31 Oct 2024 09:51:01 GMT
content-type: application/x-javascript
last-modified: Tue, 29 Oct 2024 08:49:56 GMT
server: AkamaiNetStorage
vary: Accept-Encoding

GET
H2 200 RC34ff6b65ee6a440dbe8e14e408a797c5-source.min.js Show response
assets.adobedtm.com/9273d4aedcd2/0d76ae0322d7/f42344af45de/ 704 B
728 B 26ms
23ms Script
application/x-javascript 2600:1408:ac00:19b::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://assets.adobedtm.com/9273d4aedcd2/0d76ae0322d7/f42344af45de/RC34ff6b65ee6a440dbe8e14e408a797c5-source.min.js

Requested by

Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/9273d4aedcd2/0d76ae0322d7/launch-cc3e77767d1b-development.min.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2600:1408:ac00:19b::1e80 Ashburn, United States, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

AkamaiNetStorage /

Resource Hash

1acd6883d1f0d8bdfd0fcc06d8c058e3ad544e281f1924cc3d212c1ff2d40792

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://origin-unit42.paloaltonetworks.com/

Response headers

cache-control: max-age=3600
timing-allow-origin: *
content-encoding: gzip
etag: "52584a5d6b74c667f201b70c2af5c363:1730191796.013404"
x-content-type-options: nosniff
expires: Thu, 31 Oct 2024 10:51:01 GMT
accept-ranges: bytes
access-control-allow-origin: https://origin-unit42.paloaltonetworks.com
content-length: 435
date: Thu, 31 Oct 2024 09:51:01 GMT
content-type: application/x-javascript
last-modified: Tue, 29 Oct 2024 08:49:56 GMT
server: AkamaiNetStorage
vary: Accept-Encoding

POST
H2 200 delivery Show response
paloaltonetworks.tt.omtrdc.net/rest/v1/ 379 B
399 B 108ms
33ms XHR
application/json 63.140.39.82
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://paloaltonetworks.tt.omtrdc.net/rest/v1/delivery?client=paloaltonetworks&sessionId=9ad39a62a53c4b94a0b81d9afa7587a9&version=2.10.3

Requested by

Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/9273d4aedcd2/0d76ae0322d7/launch-cc3e77767d1b-development.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

63.140.39.82 , United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ip-63-140-39-82.data.adobedc.net

Software

jag /

Resource Hash

856bf4319c0b31d0cc7e014d593f5595083e23f031cd8dd9f96d8f86ec1b56cf

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://origin-unit42.paloaltonetworks.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
x-request-id: 0411493a-48f5-4e65-90ff-487c5f264661
cache-control: no-cache, no-store, max-age=0, no-transform, private
timing-allow-origin: *
content-encoding: gzip
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List
access-control-allow-credentials: true
referrer-policy: strict-origin-when-cross-origin
x-content-type-options: nosniff
access-control-allow-origin: https://origin-unit42.paloaltonetworks.com
date: Thu, 31 Oct 2024 09:51:01 GMT
x-xss-protection: 1; mode=block
content-type: application/json;charset=UTF-8
vary: origin,access-control-request-method,access-control-request-headers,accept-encoding
server: jag

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 286 KB
98 KB 37ms
32ms Script
application/javascript 2607:f8b0:4004:c0b::61
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-836073641

Requested by

Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/9273d4aedcd2/0d76ae0322d7/launch-cc3e77767d1b-development.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c0b::61 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

f193ea401004a2e647cc84ff26e74e77d422e2a669bd1126d80f617279dc88a8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://origin-unit42.paloaltonetworks.com/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],}
expires: Thu, 31 Oct 2024 09:51:01 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 31 Oct 2024 09:51:01 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Thu, 31 Oct 2024 09:00:00 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 100286
x-xss-protection: 0
server: Google Tag Manager

GET
H2 200 attribution_trigger Show response
px.ads.linkedin.com/ 2 B
762 B 121ms
79ms XHR
application/json 2620:1ec:21::14
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://px.ads.linkedin.com/attribution_trigger?pid=1117&time=1730368261066&url=https%3A%2F%2Forigin-unit42.paloaltonetworks.com%2Fnorth-korean-threat-group-play-ransomware%2F
Requested by: Host: snap.licdn.com
URL: https://snap.licdn.com/li.lms-analytics/insight.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:21::14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Accept: *
Referer: https://origin-unit42.paloaltonetworks.com/

Response headers

x-li-pop: afd-prod-ltx1-x
content-encoding: gzip
x-fs-uuid: 000625c2c1894217dbc382e8a6e16e12
x-msedge-ref: Ref A: FD3C56724E9B4CD39C7A9781C711505E Ref B: EWR311000102051 Ref C: 2024-10-31T09:51:01Z
x-li-fabric: prod-ltx1
x-restli-protocol-version: 1.0.0
access-control-allow-methods: GET, OPTIONS
x-li-uuid: AAYlwsGJQhfbw4LopuFuEg==
x-li-proto: http/2
access-control-allow-origin: *
x-cache: CONFIG_NOCACHE
date: Thu, 31 Oct 2024 09:51:01 GMT
content-type: application/json
access-control-allow-headers: *

GET
H2

200

collect
px4.ads.linkedin.com/
Redirect Chain

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=1117&time=1730368261066&li_adsId=dea088e3-884b-4eee-9875-734f9dfb88f9&url=https%3A%2F%2Forigin-unit42.paloaltonetworks.com%2Fnorth-korean-threat-g...
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=1117&time=1730368261066&li_adsId=dea088e3-884b-4eee-9875-734f9dfb88f9&url=https%3A%2F%2Forigin-unit42.paloaltonetworks.com%2Fnorth-korean-threat-g...
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D1117%26time%3D1730368261066%26li_adsId%3Ddea088e3-884b-4eee-9875-734f9dfb88f9%26u...
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=1117&time=1730368261066&li_adsId=dea088e3-884b-4eee-9875-734f9dfb88f9&url=https%3A%2F%2Forigin-unit42.paloaltonetworks.com%2Fnorth-korean-threat-g...
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=1117&time=1730368261066&li_adsId=dea088e3-884b-4eee-9875-734f9dfb88f9&url=https%3A%2F%2Forigin-unit42.paloaltonetworks.com%2Fnorth-korean-threat-...

0
705 B

234ms
79ms

Image
application/javascript

13.107.42.14
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=1117&time=1730368261066&li_adsId=dea088e3-884b-4eee-9875-734f9dfb88f9&url=https%3A%2F%2Forigin-unit42.paloaltonetworks.com%2Fnorth-korean-threat-group-play-ransomware%2F&cookiesTest=true&liSync=true&e_ipv6=AQJYLIdWvYxdAQAAAZLh_E4hiuaMmpAQIaoQXLGhVB-vDPrFrjBCfgmvheZPxB2bRTMcsXHqwZD_Vq-TCc6Zc1-pev-BSEA
Protocol: H2
Server: 13.107.42.14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://origin-unit42.paloaltonetworks.com/

Response headers

linkedin-action: 1
x-li-pop: afd-prod-lva1-x
nel: {"report_to":"network-errors","max_age":1296000,"success_fraction":0.00066,"failure_fraction":1,"include_subdomains":true}
x-msedge-ref: Ref A: 8CFAC6773ED543199C146696FD8C1137 Ref B: EWR30EDGE0722 Ref C: 2024-10-31T09:51:01Z
x-li-fabric: prod-lva1
report-to: {"group":"network-errors","max_age":2592000,"endpoints":[{"url":"https://www.linkedin.com/li/rep"}],"include_subdomains":true}
x-li-uuid: AAYlwsGUc/U1xw93VTxC/w==
x-li-proto: http/2
x-cache: CONFIG_NOCACHE
content-length: 0
date: Thu, 31 Oct 2024 09:51:01 GMT
content-type: application/javascript

Redirect headers

linkedin-action: 1
x-li-pop: afd-prod-lva1-x
nel: {"report_to":"network-errors","max_age":1296000,"success_fraction":0.00066,"failure_fraction":1,"include_subdomains":true}
location: https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=1117&time=1730368261066&li_adsId=dea088e3-884b-4eee-9875-734f9dfb88f9&url=https%3A%2F%2Forigin-unit42.paloaltonetworks.com%2Fnorth-korean-threat-group-play-ransomware%2F&cookiesTest=true&liSync=true&e_ipv6=AQJYLIdWvYxdAQAAAZLh_E4hiuaMmpAQIaoQXLGhVB-vDPrFrjBCfgmvheZPxB2bRTMcsXHqwZD_Vq-TCc6Zc1-pev-BSEA
x-msedge-ref: Ref A: 8C58EB9D1B0146FF9CF8CECABB2C8E6C Ref B: EWR30EDGE1613 Ref C: 2024-10-31T09:51:01Z
x-li-fabric: prod-lva1
report-to: {"group":"network-errors","max_age":2592000,"endpoints":[{"url":"https://www.linkedin.com/li/rep"}],"include_subdomains":true}
x-li-uuid: AAYlwsGRGAuPLud03iDDVw==
x-li-proto: http/2
x-cache: CONFIG_NOCACHE
content-length: 0
date: Thu, 31 Oct 2024 09:51:01 GMT

GET
H2 200 icon-lens-zoom.svg
origin-unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/ 984 B
1 KB 44ms
42ms Image
image/svg+xml 34.96.108.115
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://origin-unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-lens-zoom.svg

Requested by

Host: origin-unit42.paloaltonetworks.com
URL: https://origin-unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/css/main-redesign.css?ver=1.0.0

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

34.96.108.115 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

115.108.96.34.bc.googleusercontent.com

Software

Apache /

Resource Hash

3f8289c21d5f69b8ffd08af47c6429bfd504461890b71d4ce7ab60af2e94b8d4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://origin-unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/css/main-redesign.css?ver=1.0.0

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
etag: "3d8-62144eb8c5831"
via: 1.1 google
accept-ranges: bytes
alt-svc: clear
content-length: 984
date: Thu, 31 Oct 2024 09:51:01 GMT
last-modified: Wed, 04 Sep 2024 06:02:33 GMT
content-type: image/svg+xml
server: Apache

GET
H2 200 211019041.js Show response
bat.bing.com/p/action/ 4 KB
2 KB 24ms
23ms Script
application/javascript 2620:1ec:33::10
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://bat.bing.com/p/action/211019041.js

Requested by

Host: bat.bing.com
URL: https://bat.bing.com/bat.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2620:1ec:33::10 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

30e6b6e74480e2d8e957c4d32524e0d2a14dfe90355153e91dba112c565b6236

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://origin-unit42.paloaltonetworks.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: private,max-age=60
content-encoding: br
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: AB6B13139C8243FA91FFE858DE99C336 Ref B: EWR30EDGE1021 Ref C: 2024-10-31T09:51:01Z
x-cache: CONFIG_NOCACHE
date: Thu, 31 Oct 2024 09:51:00 GMT
content-type: application/javascript; charset=utf-8
vary: Accept-Encoding

GET
H/1.1 200
OK munchkin.js Show response
munchkin.marketo.net/163/ 11 KB
5 KB 16ms
15ms Script
application/x-javascript 23.13.172.203
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://munchkin.marketo.net/163/munchkin.js
Requested by: Host: munchkin.marketo.net
URL: https://munchkin.marketo.net/munchkin.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.13.172.203 Ashburn, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-13-172-203.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 68cc280ce370c6f1f51a4fc5950103fc38df80a429552c549add04ebd8bd3a23

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://origin-unit42.paloaltonetworks.com/

Response headers

Cache-Control: max-age=8640000
Content-Encoding: gzip
ETag: "ea7826f34518d7c2295738f39c7640fa:1672972000.238769"
Connection: keep-alive
Expires: Sat, 08 Feb 2025 09:51:01 GMT
Accept-Ranges: bytes
Content-Length: 4741
P3P: policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR"
Date: Thu, 31 Oct 2024 09:51:01 GMT
Content-Type: application/x-javascript
Last-Modified: Fri, 06 Jan 2023 02:26:40 GMT
Server: AkamaiNetStorage
Vary: Accept-Encoding

GET
H2 200 211019041 Show response
www.clarity.ms/tag/uet/ 1 KB
1 KB 91ms
43ms Script
application/x-javascript 2620:1ec:bdf::40
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.clarity.ms/tag/uet/211019041
Requested by: Host: bat.bing.com
URL: https://bat.bing.com/p/action/211019041.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2620:1ec:bdf::40 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: 271f3cf328dfef60a3d2d4b98ed42d83186679c95f01a4a035a19f04fbc1b1bd

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://origin-unit42.paloaltonetworks.com/

Response headers

cache-control: no-cache, no-store
request-context: appId=cid-v1:bdfb7149-d2ee-45f0-9a22-f0b1c5035608
expires: -1
accept-ranges: bytes
x-cache: CONFIG_NOCACHE
content-length: 1032
date: Thu, 31 Oct 2024 09:51:01 GMT
content-type: application/x-javascript
x-azure-ref: 20241031T095101Z-178ffc657599f6frsrcuzkubng000000038000000000bnte

GET
H2 204 0
bat.bing.com/action/ 0
360 B 23ms
21ms Image
text/plain 2620:1ec:33::10
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://bat.bing.com/action/0?ti=211019041&tm=al001&Ver=2&mid=ed46589d-0d62-4356-b439-3a78989c4172&bo=1&sid=a2deac10976d11ef887c4f6369ae0b48&vid=a2def890976d11efb4667b9ca53d3dc0&vids=1&msclkid=N&pi=918639831&lg=en-US&sw=1600&sh=1200&sc=24&tl=Jumpy%20Pisces%20Engages%20in%20Play%20Ransomware&p=https%3A%2F%2Forigin-unit42.paloaltonetworks.com%2Fnorth-korean-threat-group-play-ransomware%2F&r=&lt=3382&pt=1730368256728,,,,,0,2,59,59,96,69,97,1647,1666,1666,2277,2277,2279,3351,3352,3382&pn=0,0&evt=pageLoad&sv=1&cdb=AQET&rn=941435

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2620:1ec:33::10 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://origin-unit42.paloaltonetworks.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: no-cache, must-revalidate
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: B69284A28AA64C08AD7A2B93F38EFC76 Ref B: EWR30EDGE1021 Ref C: 2024-10-31T09:51:01Z
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: *
x-cache: CONFIG_NOCACHE
date: Thu, 31 Oct 2024 09:51:00 GMT

POST
H2 200 s9915817264165 Show response
sstats.paloaltonetworks.com/b/ss/panw-dev/1/JS-2.27.0-LEWM/ 43 B
352 B 20ms
18ms XHR
image/gif 63.140.39.9
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://sstats.paloaltonetworks.com/b/ss/panw-dev/1/JS-2.27.0-LEWM/s9915817264165

Requested by

Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/extensions/EP8757b503532a44a68eee17773f6f10a0/AppMeasurement.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

63.140.39.9 , United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ip-63-140-39-9.data.adobedc.net

Software

jag /

Resource Hash

55c9d2f019f9d7ddfd69b2ad0351c5617338a222362aebb02b3b98a4dbc18486

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Referer: https://origin-unit42.paloaltonetworks.com/

Response headers

etag: 3715937547290705920-4618538389588307789
x-content-type-options: nosniff
expires: Wed, 30 Oct 2024 09:51:01 GMT
p3p: CP="This is not a P3P policy"
date: Thu, 31 Oct 2024 09:51:01 GMT
last-modified: Fri, 01 Nov 2024 09:51:01 GMT
vary: *
content-type: image/gif;charset=utf-8
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: no-cache, no-store, max-age=0, no-transform, private
pragma: no-cache
access-control-allow-credentials: true
access-control-allow-origin: https://origin-unit42.paloaltonetworks.com
content-length: 43
x-xss-protection: 1; mode=block
server: jag

POST
H3 200 collect
www.google.com/ccm/ 0
0 269ms
35ms Ping
text/html 2607:f8b0:4004:c06::68
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://www.google.com/ccm/collect?en=page_view&dl=https%3A%2F%2Forigin-unit42.paloaltonetworks.com%2Fnorth-korean-threat-group-play-ransomware%2F&scrsrc=www.googletagmanager.com&frm=0&rnd=428929524.1730368261&auid=742671459.1730368261&npa=0&gtm=45be4as0v873032592za200&gcd=13l3l3l3l1l1&dma=0&tag_exp=101533421~101823848~101878899~101878944~101925629&tft=1730368261311&tfd=4584&apve=1
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-836073641
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2607:f8b0:4004:c06::68 Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://origin-unit42.paloaltonetworks.com/

Response headers

GET
H3 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/836073641/ 5 KB
2 KB 242ms
38ms Script
text/javascript 2607:f8b0:4004:c0b::9d
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/836073641/?random=1730368261299&cv=11&fst=1730368261299&bg=ffffff&guid=ON&async=1&gtm=45be4as0v873032592za200&gcd=13l3l3l3l1l1&dma=0&tag_exp=101533421~101823848~101878899~101878944~101925629&u_w=1600&u_h=1200&url=https%3A%2F%2Forigin-unit42.paloaltonetworks.com%2Fnorth-korean-threat-group-play-ransomware%2F&hn=www.googleadservices.com&frm=0&tiba=Jumpy%20Pisces%20Engages%20in%20Play%20Ransomware&npa=0&pscdl=noapi&auid=742671459.1730368261&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&data=event%3Dgtag.config&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-836073641

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c0b::9d Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d258f87b0bcfa474930a6df7ef638b9661edcdde06453ee1932a302163c50538

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://origin-unit42.paloaltonetworks.com/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
content-encoding: br
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 2375
date: Thu, 31 Oct 2024 09:51:01 GMT
x-xss-protection: 0
content-type: text/javascript; charset=UTF-8
content-disposition: attachment; filename="f.txt"
server: cafe

GET
H2 200 836073641
td.doubleclick.net/td/rul/ Frame A550 0
0 107ms
41ms Document
text/html 2607:f8b0:4004:c21::9a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://td.doubleclick.net/td/rul/836073641?random=1730368261299&cv=11&fst=1730368261299&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be4as0v873032592za200&gcd=13l3l3l3l1l1&dma=0&tag_exp=101533421~101823848~101878899~101878944~101925629&u_w=1600&u_h=1200&url=https%3A%2F%2Forigin-unit42.paloaltonetworks.com%2Fnorth-korean-threat-group-play-ransomware%2F&hn=www.googleadservices.com&frm=0&tiba=Jumpy%20Pisces%20Engages%20in%20Play%20Ransomware&npa=0&pscdl=noapi&auid=742671459.1730368261&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&data=event%3Dgtag.config

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-836073641

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c21::9a Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://origin-unit42.paloaltonetworks.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-encoding: br
content-length: 16
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 31 Oct 2024 09:51:01 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 226 KB
81 KB 35ms
34ms Script
application/javascript 2607:f8b0:4004:c0b::61
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=DC-12123386

Requested by

Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/9273d4aedcd2/0d76ae0322d7/launch-cc3e77767d1b-development.min.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c0b::61 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

22bbdf52ea1a957ba39c622cf147856080931b1b5776be89d47b2e4a26a96a40

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://origin-unit42.paloaltonetworks.com/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],}
expires: Thu, 31 Oct 2024 09:51:01 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 31 Oct 2024 09:51:01 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Thu, 31 Oct 2024 09:00:00 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 82776
x-xss-protection: 0
server: Google Tag Manager

GET
H3 204 td
www.googletagmanager.com/ 0
18 B 32ms
32ms Image
text/plain 2607:f8b0:4004:c0b::61
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.googletagmanager.com/td?id=AW-836073641&v=3&t=t&pid=43094103&dl=origin-unit42.paloaltonetworks.com%2Fnorth-korean-threat-group-play-ransomware%2F&tdp=AW-836073641;73032592;0;0;0&frm=0&rtg=73032592&rlo=107&slo=31&hlo=57&lst=3&z=0
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2607:f8b0:4004:c0b::61 Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://origin-unit42.paloaltonetworks.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsgtc:59:0"}],}
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsgtc:59:0
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 0
date: Thu, 31 Oct 2024 09:51:01 GMT
content-type: text/plain
server: Golfe2

POST
H/1.1 200
OK visitWebPage
531-ocs-018.mktoresp.com/webevents/ 2 B
318 B 276ms
87ms Ping
text/plain 192.28.144.124
OMNITURE

General

Check archive.org

Show headers Download Go to

Full URL: https://531-ocs-018.mktoresp.com/webevents/visitWebPage?_mchNc=1730368261375&_mchCn=&_mchId=531-OCS-018&_mchTk=_mch-paloaltonetworks.com-1730368261374-74840&_mchHo=origin-unit42.paloaltonetworks.com&_mchPo=&_mchRu=%2Fnorth-korean-threat-group-play-ransomware%2F&_mchPc=https%3A&_mchVr=163&_mchEcid=9A531C8B532965080A490D4D%40AdobeOrg%3A7%3A19891220542191872223108456436506835943&_mchHa=&_mchRe=&_mchQp=
Requested by: Host: munchkin.marketo.net
URL: https://munchkin.marketo.net/163/munchkin.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 192.28.144.124 , United States, ASN15224 (OMNITURE, US),
Reverse DNS
Software: nginx/1.20.1 /
Resource Hash: 565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://origin-unit42.paloaltonetworks.com/

Response headers

Transfer-Encoding: chunked
X-Request-Id: a70bf4f1-6cbb-4790-9927-6cfb2c5e4b9e
Content-Encoding: gzip
Connection: keep-alive
Access-Control-Allow-Origin: *
Date: Thu, 31 Oct 2024 09:51:01 GMT
Content-Type: text/plain; charset=UTF-8
Server: nginx/1.20.1

GET
H2 200 sw_iframe.html
www.googletagmanager.com/static/service_worker/4al0/ Frame 60AE 0
0 50ms
18ms Document
text/html 2607:f8b0:4004:c0b::61
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/static/service_worker/4al0/sw_iframe.html?origin=https%3A%2F%2Forigin-unit42.paloaltonetworks.com

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-836073641

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c0b::61 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: br
content-length: 1476
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/analytics-container-tag-serving
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="analytics-container-tag-serving"
cross-origin-resource-policy: cross-origin
date: Thu, 31 Oct 2024 09:51:01 GMT
expires: Fri, 31 Oct 2025 09:51:01 GMT
last-modified: Mon, 21 Oct 2024 16:58:00 GMT
report-to: {"group":"analytics-container-tag-serving","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/analytics-container-tag-serving"}]}
server: sffe
service-worker-allowed: /static/service_worker
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 clarity.js Show response
www.clarity.ms/s/0.7.49/ 64 KB
27 KB 19ms
18ms Script
application/javascript 2620:1ec:bdf::40
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.clarity.ms/s/0.7.49/clarity.js
Requested by: Host: www.clarity.ms
URL: https://www.clarity.ms/tag/uet/211019041
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2620:1ec:bdf::40 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: 09fa04e84d7038cc32f19bedcba454b9e637a35f4de496e8ec9148c47550f0fc

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://origin-unit42.paloaltonetworks.com/

Response headers

x-azure-ref: 20241031T095101Z-178ffc657599f6frsrcuzkubng000000038000000000bntk
cache-control: public, max-age=86400
x-ms-version: 2018-03-28
content-encoding: br
etag: W/"0x8DCF3CA14C9A428"
x-fd-int-roxy-purgeid: 51562430
x-ms-request-id: e4022565-b01e-0053-0f71-290def000000
access-control-allow-origin: *
x-cache: TCP_HIT
date: Thu, 31 Oct 2024 09:51:01 GMT
content-type: application/javascript;charset=utf-8
vary: Accept-Encoding
last-modified: Thu, 24 Oct 2024 01:20:43 GMT

GET
H2

200

c.gif
c.clarity.ms/
Redirect Chain

https://c.clarity.ms/c.gif
https://c.bing.com/c.gif?ctsa=mr&CtsSyncId=4BC444B6A0514864B39C219719D6CE5C&RedC=c.clarity.ms&MXFR=13C26189005B6A9A018174A0045B6459
https://c.clarity.ms/c.gif?ctsa=mr&CtsSyncId=4BC444B6A0514864B39C219719D6CE5C&MUID=15E365BC15816FD02475709514E36E87

42 B
442 B

28ms
27ms

Image
image/gif

20.110.205.119
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://c.clarity.ms/c.gif?ctsa=mr&CtsSyncId=4BC444B6A0514864B39C219719D6CE5C&MUID=15E365BC15816FD02475709514E36E87
Protocol: H2
Server: 20.110.205.119 Boydton, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: 99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://origin-unit42.paloaltonetworks.com/

Response headers

cache-control: private, no-cache, proxy-revalidate, no-store
pragma: no-cache
etag: "8d3dafd6e71fdb1:0"
accept-ranges: bytes
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
content-length: 42
date: Thu, 31 Oct 2024 09:51:01 GMT
content-type: image/gif
last-modified: Wed, 16 Oct 2024 16:24:13 GMT
server: Microsoft-IIS/10.0
x-powered-by: ASP.NET

Redirect headers

cache-control: private, no-cache, proxy-revalidate, no-store
location: https://c.clarity.ms/c.gif?ctsa=mr&CtsSyncId=4BC444B6A0514864B39C219719D6CE5C&MUID=15E365BC15816FD02475709514E36E87
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 3AF652DA4DAB4885AE6B9E8EBE6B234B Ref B: EWR30EDGE1121 Ref C: 2024-10-31T09:51:01Z
x-cache: CONFIG_NOCACHE
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
content-length: 0
date: Thu, 31 Oct 2024 09:51:01 GMT
x-powered-by: ASP.NET

GET
H2

200

activityi;dc_pre=CPKm0oysuIkDFdayWgUdrjAYFw;src=12123386;type=allpa0;cat=globa0;ord=7965954316435;npa=0;auiddc=742671459.1730368261;u1=https%3A%2F%2Forigin-unit42.paloaltonetworks.com%2Fnorth-korea...
12123386.fls.doubleclick.net/ Frame 9FBC
Redirect Chain

https://12123386.fls.doubleclick.net/activityi;src=12123386;type=allpa0;cat=globa0;ord=7965954316435;npa=0;auiddc=742671459.1730368261;u1=https%3A%2F%2Forigin-unit42.paloaltonetworks.com%2Fnorth-ko...
https://12123386.fls.doubleclick.net/activityi;dc_pre=CPKm0oysuIkDFdayWgUdrjAYFw;src=12123386;type=allpa0;cat=globa0;ord=7965954316435;npa=0;auiddc=742671459.1730368261;u1=https%3A%2F%2Forigin-unit...

0
0

51ms
43ms

Document
text/html

142.251.163.149
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://12123386.fls.doubleclick.net/activityi;dc_pre=CPKm0oysuIkDFdayWgUdrjAYFw;src=12123386;type=allpa0;cat=globa0;ord=7965954316435;npa=0;auiddc=742671459.1730368261;u1=https%3A%2F%2Forigin-unit42.paloaltonetworks.com%2Fnorth-korean-threat-group-play-ransomware%2F;ps=1;pcor=632655843;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=noapi;frm=0;gtm=45fe4au0h2v9190796217za200;gcd=13l3l3l3l1l1;dma=0;tag_exp=101533421~101823848~101878899~101878944~101925629;epver=2;~oref=https%3A%2F%2Forigin-unit42.paloaltonetworks.com%2Fnorth-korean-threat-group-play-ransomware%2F?

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=DC-12123386

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.163.149 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

wv-in-f149.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://origin-unit42.paloaltonetworks.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=0
content-encoding: br
content-length: 400
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 31 Oct 2024 09:51:01 GMT
expires: Thu, 31 Oct 2024 09:51:01 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 31 Oct 2024 09:51:01 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
follow-only-when-prerender-shown: 1
location: https://12123386.fls.doubleclick.net/activityi;dc_pre=CPKm0oysuIkDFdayWgUdrjAYFw;src=12123386;type=allpa0;cat=globa0;ord=7965954316435;npa=0;auiddc=742671459.1730368261;u1=https%3A%2F%2Forigin-unit42.paloaltonetworks.com%2Fnorth-korean-threat-group-play-ransomware%2F;ps=1;pcor=632655843;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=noapi;frm=0;gtm=45fe4au0h2v9190796217za200;gcd=13l3l3l3l1l1;dma=0;tag_exp=101533421~101823848~101878899~101878944~101925629;epver=2;~oref=https%3A%2F%2Forigin-unit42.paloaltonetworks.com%2Fnorth-korean-threat-group-play-ransomware%2F?
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 activityi;fledge=1;src=12123386;type=allpa0;cat=globa0;ord=7965954316435;npa=0;auiddc=742671459.1730368261;u1=https%3A%2F%2Forigin-unit42.paloaltonetworks.com%2Fnorth-korean-threat-group-play-ranso...
td.doubleclick.net/td/fls/rul/ Frame CE74 0
0 48ms
40ms Document
text/html 2607:f8b0:4004:c21::9a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://td.doubleclick.net/td/fls/rul/activityi;fledge=1;src=12123386;type=allpa0;cat=globa0;ord=7965954316435;npa=0;auiddc=742671459.1730368261;u1=https%3A%2F%2Forigin-unit42.paloaltonetworks.com%2Fnorth-korean-threat-group-play-ransomware%2F;ps=1;pcor=632655843;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=noapi;frm=0;gtm=45fe4au0h2v9190796217za200;gcd=13l3l3l3l1l1;dma=0;tag_exp=101533421~101823848~101878899~101878944~101925629;epver=2;~oref=https%3A%2F%2Forigin-unit42.paloaltonetworks.com%2Fnorth-korean-threat-group-play-ransomware%2F?

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=DC-12123386

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c21::9a Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://origin-unit42.paloaltonetworks.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-encoding: br
content-length: 16
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 31 Oct 2024 09:51:01 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 327 KB
109 KB 39ms
38ms Script
application/javascript 2607:f8b0:4004:c0b::61
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-KS2MELEEFC

Requested by

Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/9273d4aedcd2/0d76ae0322d7/launch-cc3e77767d1b-development.min.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c0b::61 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

1a9faad9e590108fcb4c4fbd20431f3b3c7a8fab9a61f144d1d13116012d094b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://origin-unit42.paloaltonetworks.com/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],}
expires: Thu, 31 Oct 2024 09:51:01 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 31 Oct 2024 09:51:01 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 111459
x-xss-protection: 0
server: Google Tag Manager

GET
H3 200 activity;register_conversion=1;src=12123386;type=allpa0;cat=globa0;ord=7965954316435;npa=0;auiddc=742671459.1730368261;u1=https%3A%2F%2Forigin-unit42.paloaltonetworks.com%2Fnorth-korean-threat-grou...
ad.doubleclick.net/ 0
24 B 75ms
40ms Image
image/png 142.251.16.149
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ad.doubleclick.net/activity;register_conversion=1;src=12123386;type=allpa0;cat=globa0;ord=7965954316435;npa=0;auiddc=742671459.1730368261;u1=https%3A%2F%2Forigin-unit42.paloaltonetworks.com%2Fnorth-korean-threat-group-play-ransomware%2F;ps=1;pcor=632655843;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=noapi;frm=0;gtm=45fe4au0h2v9190796217za200;gcd=13l3l3l3l1l1;dma=0;tag_exp=101533421~101823848~101878899~101878944~101925629;epver=2;~oref=https%3A%2F%2Forigin-unit42.paloaltonetworks.com%2Fnorth-korean-threat-group-play-ransomware%2F?

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.16.149 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

bl-in-f149.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://origin-unit42.paloaltonetworks.com/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 0
date: Thu, 31 Oct 2024 09:51:01 GMT
attribution-reporting-register-trigger: {"aggregatable_deduplication_keys":[{"deduplication_key":"13074737593695639581"}],"aggregatable_trigger_data":[{"filters":[{"14":["12826186"]}],"key_piece":"0x28d3c5e721453043","source_keys":["12","13","14","15","16","17","18","19","20","21","19881960","19881961","19881962","19881963","22956344","22956345","22956346","22956347","24843764","24843765","24843766","24843767","642861428","642861429","642861430","642861431"]},{"key_piece":"0xd5c8d29a1568bec","not_filters":{"14":["12826186"]},"source_keys":["12","13","14","15","16","17","18","19","20","21","19881960","19881961","19881962","19881963","22956344","22956345","22956346","22956347","24843764","24843765","24843766","24843767","642861428","642861429","642861430","642861431"]}],"aggregatable_values":{"12":65,"13":65,"14":65,"15":6356,"16":65,"17":65,"18":6356,"19":65,"19881960":32,"19881961":32,"19881962":32,"19881963":3177,"20":65,"21":6356,"22956344":36,"22956345":36,"22956346":36,"22956347":3530,"24843764":34,"24843765":34,"24843766":34,"24843767":3345,"642861428":38,"642861429":38,"642861430":38,"642861431":3739},"aggregation_coordinator_origin":"https://publickeyservice.msmt.aws.privacysandboxservices.com","debug_key":"12594945943108789095","debug_reporting":true,"event_trigger_data":[{"deduplication_key":"13074737593695639581","filters":[{"14":["12826186"],"source_type":["event"]}],"priority":"10","trigger_data":"1"},{"deduplication_key":"13074737593695639581","filters":[{"14":["12826186"],"source_type":["navigation"]}],"priority":"10","trigger_data":"6"},{"deduplication_key":"13074737593695639581","filters":[{"source_type":["event"]}],"priority":"0","trigger_data":"0"},{"deduplication_key":"13074737593695639581","filters":[{"source_type":["navigation"]}],"priority":"0","trigger_data":"7"}],"filters":{"8":["12123386"]}}
content-type: image/png
x-xss-protection: 0
server: cafe

POST
H/1.1 204
No Content collect Show response
r.clarity.ms/ 0
298 B 308ms
39ms XHR
text/plain 20.119.174.243
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://r.clarity.ms/collect
Requested by: Host: www.clarity.ms
URL: https://www.clarity.ms/s/0.7.49/clarity.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 20.119.174.243 Boydton, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Accept: application/x-clarity-gzip
Referer: https://origin-unit42.paloaltonetworks.com/

Response headers

Request-Context: appId=cid-v1:bdfb7149-d2ee-45f0-9a22-f0b1c5035608
Access-Control-Allow-Origin: https://origin-unit42.paloaltonetworks.com
Date: Thu, 31 Oct 2024 09:51:01 GMT
Vary: Origin
Server: nginx
Connection: keep-alive
Access-Control-Allow-Credentials: true

GET
H3 200 /
www.google.com/pagead/1p-user-list/836073641/ 42 B
64 B 31ms
30ms Image
image/gif 2607:f8b0:4004:c06::68
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/836073641/?random=1730368261299&cv=11&fst=1730365200000&bg=ffffff&guid=ON&async=1&gtm=45be4as0v873032592za200&gcd=13l3l3l3l1l1&dma=0&tag_exp=101533421~101823848~101878899~101878944~101925629&u_w=1600&u_h=1200&url=https%3A%2F%2Forigin-unit42.paloaltonetworks.com%2Fnorth-korean-threat-group-play-ransomware%2F&hn=www.googleadservices.com&frm=0&tiba=Jumpy%20Pisces%20Engages%20in%20Play%20Ransomware&npa=0&pscdl=noapi&auid=742671459.1730368261&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&data=event%3Dgtag.config&rfmt=3&fmt=3&is_vtc=1&cid=CAQSGwCa7L7drG-3d_pTf2lNmujRDNLHDjFOAKXHEg&random=2204120511&rmt_tld=0&ipr=y

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c06::68 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://origin-unit42.paloaltonetworks.com/

Response headers

content-security-policy: script-src 'none'; object-src 'none'
cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 42
date: Thu, 31 Oct 2024 09:51:01 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

POST
H2 204 collect
analytics.google.com/g/ 0
0 240ms
40ms Fetch
text/plain 2001:4860:4802:34::181
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://analytics.google.com/g/collect?v=2&tid=G-KS2MELEEFC&gtm=45je4as0v880354802za200&_p=1730368260495&_gaz=1&gcd=13l3l3l3l1l1&npa=0&dma=0&tag_exp=101533421~101823848~101878899~101878944~101925629&tt=&cid=117368376.1730368262&ul=en-us&sr=1600x1200&ir=1&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&pae=1&frm=0&pscdl=noapi&_eu=EA&_s=1&dl=https%3A%2F%2Forigin-unit42.paloaltonetworks.com%2Fnorth-korean-threat-group-play-ransomware%2F&sid=1730368261&sct=1&seg=0&dt=Jumpy%20Pisces%20Engages%20in%20Play%20Ransomware&en=page_view&_fv=1&_nsi=1&_ss=1&_ee=1&ep.search_term=&ep.channel=unit42&ep.gtm_internalonlytags=&ep.page_name=unit42%3Anorth-korean-threat-group-play-ransomware&ep.target_audience_persona=&tfd=4998
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-KS2MELEEFC&l=dataLayer
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:34::181 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://origin-unit42.paloaltonetworks.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:136:0
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:136:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://origin-unit42.paloaltonetworks.com
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 31 Oct 2024 09:51:01 GMT
content-type: text/plain
server: Golfe2

POST
H2 204 collect
stats.g.doubleclick.net/g/ 0
558 B 221ms
24ms Ping
text/plain 2607:f8b0:4004:c1b::9c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://stats.g.doubleclick.net/g/collect?v=2&tid=G-KS2MELEEFC&cid=117368376.1730368262&gtm=45je4as0v880354802za200&aip=1&dma=0&gcd=13l3l3l3l1l1&npa=0&frm=0&tag_exp=101533421~101823848~101878899~101878944~101925629
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-KS2MELEEFC&l=dataLayer
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2607:f8b0:4004:c1b::9c Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://origin-unit42.paloaltonetworks.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:111:0
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:111:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://origin-unit42.paloaltonetworks.com
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 31 Oct 2024 09:51:01 GMT
content-type: text/plain
server: Golfe2

GET
H3 200 rul
td.doubleclick.net/td/ga/ Frame C05F 0
0 37ms
35ms Document
text/html 2607:f8b0:4004:c21::9a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://td.doubleclick.net/td/ga/rul?tid=G-KS2MELEEFC&gacid=117368376.1730368262&gtm=45je4as0v880354802za200&dma=0&gcd=13l3l3l3l1l1&npa=0&pscdl=noapi&aip=1&fledge=1&frm=0&tag_exp=101533421~101823848~101878899~101878944~101925629&z=2075528921

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-KS2MELEEFC&l=dataLayer

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c21::9a Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://origin-unit42.paloaltonetworks.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-encoding: br
content-length: 16
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 31 Oct 2024 09:51:01 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 fbevents.js Show response
connect.facebook.net/en_US/ 229 KB
58 KB 153ms
21ms Script
application/x-javascript 2a03:2880:f003:100:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Host: origin-unit42.paloaltonetworks.com
URL: https://origin-unit42.paloaltonetworks.com/north-korean-threat-group-play-ransomware/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f003:100:face:b00c:0:3 Ashburn, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

668c6828672fa8600b7a0632cb328ee63a31361be6734987b04985fcd9d08d4f

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' data: blob: ;script-src 'nonce-BldtcHUu' .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* blob: data: 'self' https://.google-analytics.com .google.com;style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com: wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: .cdninstagram.com 'self' https://.google-analytics.com;img-src 'self' data: blob: * https://*.google-analytics.com;block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://origin-unit42.paloaltonetworks.com/

Response headers

content-encoding: gzip
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
x-content-type-options: nosniff
expires: Sat, 01 Jan 2000 00:00:00 GMT
alt-svc: h3=":443"; ma=86400
date: Thu, 31 Oct 2024 09:51:01 GMT
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
priority: u=3,i
x-frame-options: DENY
strict-transport-security: max-age=31536000; preload; includeSubDomains
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
content-security-policy: default-src 'self' data: blob: *;script-src 'nonce-BldtcHUu' *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* blob: data: 'self' https://*.google-analytics.com *.google.com;style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' https://*.google-analytics.com;img-src 'self' data: blob: * https://*.google-analytics.com;block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
cache-control: public, max-age=1200
timing-allow-origin: *
cross-origin-opener-policy: same-origin-allow-popups
x-fb-connection-quality: EXCELLENT; q=0.9, rtt=23, rtx=0, c=23, mss=1232, tbw=4573, tp=11, tpl=0, uplat=0, ullat=-1
pragma: public
x-fb-debug: AuLVgPA0gaX/Tllx4XnFpdNzNYHcON83B2nJr3AribLVDEKaQYtKszBNtHNMegvLE69nzEZnCXE4JuIX63qO/g==
cross-origin-resource-policy: cross-origin
permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
document-policy: force-load-at-top
content-length: 59722
x-xss-protection: 0
origin-agent-cluster: ?1

GET
H2 200 w.js Show response
d10lpsik1i8c69.cloudfront.net/ 5 KB
3 KB 229ms
28ms Script
application/javascript 54.239.153.227
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d10lpsik1i8c69.cloudfront.net/w.js
Requested by: Host: origin-unit42.paloaltonetworks.com
URL: https://origin-unit42.paloaltonetworks.com/north-korean-threat-group-play-ransomware/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 54.239.153.227 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-54-239-153-227.iad50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 6cb6821219dae9fa9a21519d86d7ec7acaf0c4dd61463eb336eb92964feebef3

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://origin-unit42.paloaltonetworks.com/

Response headers

vary: accept-encoding
cache-control: max-age=3600
content-encoding: gzip
etag: W/"e31293f40e8a324de552ff593ee76a9b"
age: 2561
via: 1.1 929cbb64d024a9973633b197e2a23482.cloudfront.net (CloudFront)
x-cache: Hit from cloudfront
x-amz-cf-id: UVYtEsp3hheV9u5c9Xur9v6L1ssPKgBNA7b_F3UqBV4vM1u4u3w2Bw==
date: Thu, 31 Oct 2024 09:08:21 GMT
content-type: application/javascript
last-modified: Thu, 25 Jan 2024 18:19:40 GMT
server: AmazonS3
x-amz-cf-pop: IAD50-C2
x-amz-server-side-encryption: AES256

GET
H2 200 e78feef73ff94c88.min.js Show response
tag.demandbase.com/ 61 KB
18 KB 74ms
24ms Script
application/javascript 18.160.10.89
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://tag.demandbase.com/e78feef73ff94c88.min.js

Requested by

Host: origin-unit42.paloaltonetworks.com
URL: https://origin-unit42.paloaltonetworks.com/north-korean-threat-group-play-ransomware/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.160.10.89 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-160-10-89.iad12.r.cloudfront.net

Software

AmazonS3 /

Resource Hash

eed601083fb568a2b3275668cc6f3cddb0782cb28c094d5b5a5e1a1637cc7c54

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://origin-unit42.paloaltonetworks.com/

Response headers

content-encoding: gzip
x-amz-version-id: kxcuODpKC.kpFtGIKMcKkl7WJ.2kqx8T
etag: W/"588dcd135efe13299fb738f29f21fb29"
age: 3305
x-cache: Hit from cloudfront
x-amz-cf-id: 3JQDqBk8scUdkLsechGbFwcf6xWDRZ6lnEW7dSCcMHgi02-wkJYFmA==
date: Thu, 31 Oct 2024 08:55:57 GMT
content-type: application/javascript; charset=utf-8
vary: accept-encoding
last-modified: Thu, 17 Oct 2024 13:51:10 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
cache-control: public, max-age=3600
via: 1.1 fb1dc2e3bf4105b403e3bfa3a5067970.cloudfront.net (CloudFront)
permissions-policy: accelerometer=(), camera=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), payment=(), usb=(), interest-cohort=()
x-amz-cf-pop: IAD12-P3
server: AmazonS3
x-amz-server-side-encryption: AES256

GET
H2 200 tracking.js Show response
trk.techtarget.com/ 3 KB
2 KB 227ms
31ms Script
text/javascript 2606:4700::6812:1247
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://trk.techtarget.com/tracking.js

Requested by

Host: origin-unit42.paloaltonetworks.com
URL: https://origin-unit42.paloaltonetworks.com/north-korean-threat-group-play-ransomware/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:1247 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0c07b854855b0e2bd7839c3659defa45307e96e281b3c00571d09f213eb6a76e

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://origin-unit42.paloaltonetworks.com/

Response headers

strict-transport-security: max-age=0; includeSubDomains; preload
cache-control: public, max-age=1200
content-encoding: br
cf-bgj: minify
cf-cache-status: HIT
age: 63061
via: 1.1 google
cf-ray: 8db2be852a010c92-EWR
expires: Thu, 31 Oct 2024 10:11:01 GMT
date: Thu, 31 Oct 2024 09:51:01 GMT
content-type: text/javascript
last-modified: Tue, 13 Dec 2022 15:01:39 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 adsct
t.co/1/i/ 43 B
164 B 78ms
72ms Image
image/gif 162.159.140.229
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://t.co/1/i/adsct?bci=5&dv=Pacific%2FHonolulu%26en-US%2Cen%26Google%20Inc.%26Linux%20x86_64%26255%261600%261200%2616%2624%261600%261200%260%26na&eci=3&event=%7B%7D&event_id=152147b8-867b-404f-9973-d6eb5bd136d1&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=bf32ad68-c7fd-4ac3-b863-efe98bc87507&tw_document_href=https%3A%2F%2Forigin-unit42.paloaltonetworks.com%2Fnorth-korean-threat-group-play-ransomware%2F&tw_iframe_status=0&txn_id=nvh9f&type=javascript&version=2.3.31

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.159.140.229 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare tsa_b /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://origin-unit42.paloaltonetworks.com/

Response headers

strict-transport-security: max-age=0
x-transaction-id: 64b180b100de9b0f
cache-control: no-cache, no-store, max-age=0
x-connection-hash: a07b578ea345592d612c340e26d39ea74d25bd4632fdcd24cc69504a78cb6018
cf-cache-status: DYNAMIC
cf-ray: 8db2be83f8b78c4e-EWR
x-response-time: 7
content-length: 43
date: Thu, 31 Oct 2024 09:51:01 GMT
content-type: image/gif;charset=utf-8
perf: 7402827104
server: cloudflare tsa_b

GET
H2 200 adsct
analytics.twitter.com/1/i/ 43 B
445 B 117ms
111ms Image
image/gif 104.244.42.131
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://analytics.twitter.com/1/i/adsct?bci=5&dv=Pacific%2FHonolulu%26en-US%2Cen%26Google%20Inc.%26Linux%20x86_64%26255%261600%261200%2616%2624%261600%261200%260%26na&eci=3&event=%7B%7D&event_id=152147b8-867b-404f-9973-d6eb5bd136d1&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=bf32ad68-c7fd-4ac3-b863-efe98bc87507&tw_document_href=https%3A%2F%2Forigin-unit42.paloaltonetworks.com%2Fnorth-korean-threat-group-play-ransomware%2F&tw_iframe_status=0&txn_id=nvh9f&type=javascript&version=2.3.31

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.244.42.131 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_b /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://origin-unit42.paloaltonetworks.com/

Response headers

strict-transport-security: max-age=631138519
x-transaction-id: a0160c9a12472a79
cache-control: no-cache, no-store, max-age=0
x-connection-hash: 70f85acf4864d50906779f0570ee470fadbf63ec4bfb5c6f5ac8e6a5b9afb810
x-response-time: 72
content-length: 43
date: Thu, 31 Oct 2024 09:51:01 GMT
perf: 7402827104
content-type: image/gif;charset=utf-8
server: tsa_b

GET
H2 200 RCced539bfc42a4483b505ca9eb4a11693-source.min.js Show response
assets.adobedtm.com/9273d4aedcd2/0d76ae0322d7/f42344af45de/ 924 B
773 B 33ms
28ms Script
application/x-javascript 2600:1408:ac00:19b::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://assets.adobedtm.com/9273d4aedcd2/0d76ae0322d7/f42344af45de/RCced539bfc42a4483b505ca9eb4a11693-source.min.js

Requested by

Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/9273d4aedcd2/0d76ae0322d7/launch-cc3e77767d1b-development.min.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2600:1408:ac00:19b::1e80 Ashburn, United States, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

AkamaiNetStorage /

Resource Hash

d86347ab8ba59eb52915d14a3d6f1f83cedb6f81778c444c192ef791309cfc18

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://origin-unit42.paloaltonetworks.com/

Response headers

cache-control: max-age=3600
timing-allow-origin: *
content-encoding: gzip
etag: "52584a5d6b74c667f201b70c2af5c363:1730191796.013404"
x-content-type-options: nosniff
expires: Thu, 31 Oct 2024 10:51:01 GMT
accept-ranges: bytes
access-control-allow-origin: https://origin-unit42.paloaltonetworks.com
content-length: 480
date: Thu, 31 Oct 2024 09:51:01 GMT
content-type: application/x-javascript
last-modified: Tue, 29 Oct 2024 08:49:56 GMT
server: AkamaiNetStorage
vary: Accept-Encoding

GET
H2 200 RCf7caa0653f2e4dad8230aa618eb63891-source.min.js Show response
assets.adobedtm.com/9273d4aedcd2/0d76ae0322d7/f42344af45de/ 786 B
759 B 33ms
28ms Script
application/x-javascript 2600:1408:ac00:19b::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://assets.adobedtm.com/9273d4aedcd2/0d76ae0322d7/f42344af45de/RCf7caa0653f2e4dad8230aa618eb63891-source.min.js

Requested by

Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/9273d4aedcd2/0d76ae0322d7/launch-cc3e77767d1b-development.min.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2600:1408:ac00:19b::1e80 Ashburn, United States, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

AkamaiNetStorage /

Resource Hash

c38366b005a9ae7215ea4dbaee4529a37591bfa4c040d1b2a4d12955f75c485d

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://origin-unit42.paloaltonetworks.com/

Response headers

cache-control: max-age=3600
timing-allow-origin: *
content-encoding: gzip
etag: "52584a5d6b74c667f201b70c2af5c363:1730191796.013404"
x-content-type-options: nosniff
expires: Thu, 31 Oct 2024 10:51:01 GMT
accept-ranges: bytes
access-control-allow-origin: https://origin-unit42.paloaltonetworks.com
content-length: 466
date: Thu, 31 Oct 2024 09:51:01 GMT
content-type: application/x-javascript
last-modified: Tue, 29 Oct 2024 08:49:56 GMT
server: AkamaiNetStorage
vary: Accept-Encoding

GET
H2 200 RC41352cb856824ce28244bb1b4777d220-source.min.js Show response
assets.adobedtm.com/9273d4aedcd2/0d76ae0322d7/f42344af45de/ 872 B
804 B 143ms
140ms Script
application/x-javascript 2600:1408:ac00:19b::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://assets.adobedtm.com/9273d4aedcd2/0d76ae0322d7/f42344af45de/RC41352cb856824ce28244bb1b4777d220-source.min.js

Requested by

Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/9273d4aedcd2/0d76ae0322d7/launch-cc3e77767d1b-development.min.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2600:1408:ac00:19b::1e80 Ashburn, United States, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

AkamaiNetStorage /

Resource Hash

972daca0742f92a7c64c1911795cbc326307281e5cbb8dc68c12ffcf686570e8

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://origin-unit42.paloaltonetworks.com/

Response headers

cache-control: max-age=3600
timing-allow-origin: *
content-encoding: gzip
etag: "52584a5d6b74c667f201b70c2af5c363:1730191796.013404"
x-content-type-options: nosniff
expires: Thu, 31 Oct 2024 10:51:01 GMT
accept-ranges: bytes
access-control-allow-origin: https://origin-unit42.paloaltonetworks.com
content-length: 512
date: Thu, 31 Oct 2024 09:51:01 GMT
content-type: application/x-javascript
last-modified: Tue, 29 Oct 2024 08:49:56 GMT
server: AkamaiNetStorage
vary: Accept-Encoding

GET
H2 200 RC8c319fd96d8c46a8ac32dc6375ae4ba1-source.min.js Show response
assets.adobedtm.com/9273d4aedcd2/0d76ae0322d7/f42344af45de/ 2 KB
1 KB 31ms
28ms Script
application/x-javascript 2600:1408:ac00:19b::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://assets.adobedtm.com/9273d4aedcd2/0d76ae0322d7/f42344af45de/RC8c319fd96d8c46a8ac32dc6375ae4ba1-source.min.js

Requested by

Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/9273d4aedcd2/0d76ae0322d7/launch-cc3e77767d1b-development.min.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2600:1408:ac00:19b::1e80 Ashburn, United States, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

AkamaiNetStorage /

Resource Hash

019ed979f6455f41921fe236c6f520bee56f15631983336001f694376bacee90

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://origin-unit42.paloaltonetworks.com/

Response headers

cache-control: max-age=3600
timing-allow-origin: *
content-encoding: gzip
etag: "52584a5d6b74c667f201b70c2af5c363:1730191796.013404"
x-content-type-options: nosniff
expires: Thu, 31 Oct 2024 10:51:01 GMT
accept-ranges: bytes
access-control-allow-origin: https://origin-unit42.paloaltonetworks.com
content-length: 773
date: Thu, 31 Oct 2024 09:51:01 GMT
content-type: application/x-javascript
last-modified: Tue, 29 Oct 2024 08:49:56 GMT
server: AkamaiNetStorage
vary: Accept-Encoding

GET
H/1.1 200
OK up_loader.1.1.0.js Show response
js.adsrvr.org/ 15 KB
6 KB 297ms
17ms Script
application/x-javascript 3.167.72.96
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://js.adsrvr.org/up_loader.1.1.0.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/9273d4aedcd2/0d76ae0322d7/launch-cc3e77767d1b-development.min.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 3.167.72.96 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-167-72-96.iad61.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: c87aa708d354d2db657ba47b08aae2cc50653369ccbffa36448d7b47fd3e9fe6

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://origin-unit42.paloaltonetworks.com/

Response headers

Transfer-Encoding: chunked
Vary: accept-encoding
Content-Encoding: gzip
ETag: W/"407149e43d6d6f4c2458e9179af5b3a2"
Age: 9433
Connection: keep-alive
Via: 1.1 a6bf7abd5e218b2f4e6f0f8b71520248.cloudfront.net (CloudFront)
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: kkxNL4o-7KdLkiGwmEz3J7aLBBTzqZT4iC5VwuDc7lYOjUAAQlJA1Q==
Date: Thu, 31 Oct 2024 07:13:50 GMT
Content-Type: application/x-javascript
Last-Modified: Thu, 31 Oct 2024 07:10:39 GMT
Server: AmazonS3
X-Amz-Cf-Pop: IAD61-P6
x-amz-server-side-encryption: AES256

GET
H2 200 sync
s.company-target.com/s/ Frame EAAD 0
0 253ms
15ms Document
text/html 34.96.71.22
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://s.company-target.com/s/sync?exc=lr

Requested by

Host: tag.demandbase.com
URL: https://tag.demandbase.com/e78feef73ff94c88.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

34.96.71.22 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

22.71.96.34.bc.googleusercontent.com

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Referer: https://origin-unit42.paloaltonetworks.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

access-control-allow-methods: GET,OPTIONS
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 634
content-type: text/html; charset=UTF-8
date: Thu, 31 Oct 2024 09:51:02 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
via: 1.1 google

POST
H2 200 ip.json Show response
api.company-target.com/api/v3/ 483 B
1 KB 64ms
61ms XHR
application/json 13.249.39.123
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://api.company-target.com/api/v3/ip.json?referrer=&page=https%3A%2F%2Forigin-unit42.paloaltonetworks.com%2Fnorth-korean-threat-group-play-ransomware%2F&page_title=Jumpy%20Pisces%20Engages%20in%20Play%20Ransomware

Requested by

Host: tag.demandbase.com
URL: https://tag.demandbase.com/e78feef73ff94c88.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.249.39.123 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-249-39-123.iad89.r.cloudfront.net

Software

nginx /

Resource Hash

be0a1dd7435d16e9a2006b70bc9cd54d31bab4c5e2c7d021633a58da858fa24c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://origin-unit42.paloaltonetworks.com/

Response headers

access-control-max-age: 7200
access-control-expose-headers: x-amz-cf-id
content-encoding: gzip
identification-source: CENTRAL
access-control-allow-methods: GET, POST, OPTIONS
request-id: 607ec48d-af17-4fe0-a771-94251cc13f39
expires: Wed, 30 Oct 2024 09:51:01 GMT
x-cache: Miss from cloudfront
x-amz-cf-id: q-4iV1TJhboTXEH00W3qdN-16_sNswZE2KhmoadT9h0ReQHTSLKsJg==
date: Thu, 31 Oct 2024 09:51:01 GMT
content-type: application/json;charset=utf-8
vary: Accept-Encoding, Origin
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
api-version: v3
access-control-allow-credentials: true
via: 1.1 7c4bbd97f5be908e33f403c3794f629a.cloudfront.net (CloudFront)
access-control-allow-origin: https://origin-unit42.paloaltonetworks.com
x-amz-cf-pop: IAD89-C1
server: nginx

GET
H2 200 RCb7f90ed4e560455faf4912cffe14ac18-source.min.js Show response
assets.adobedtm.com/9273d4aedcd2/0d76ae0322d7/f42344af45de/ 652 B
694 B 62ms
50ms Script
application/x-javascript 2600:1408:ac00:19b::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://assets.adobedtm.com/9273d4aedcd2/0d76ae0322d7/f42344af45de/RCb7f90ed4e560455faf4912cffe14ac18-source.min.js

Requested by

Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/9273d4aedcd2/0d76ae0322d7/launch-cc3e77767d1b-development.min.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2600:1408:ac00:19b::1e80 Ashburn, United States, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

AkamaiNetStorage /

Resource Hash

a99a80bebca5858f6b7de455004cd13841edf6bc20416c7b73d5a697534abf22

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://origin-unit42.paloaltonetworks.com/

Response headers

cache-control: max-age=3600
timing-allow-origin: *
content-encoding: gzip
etag: "52584a5d6b74c667f201b70c2af5c363:1730191796.013404"
x-content-type-options: nosniff
expires: Thu, 31 Oct 2024 10:51:01 GMT
accept-ranges: bytes
access-control-allow-origin: https://origin-unit42.paloaltonetworks.com
content-length: 402
date: Thu, 31 Oct 2024 09:51:01 GMT
content-type: application/x-javascript
last-modified: Tue, 29 Oct 2024 08:49:56 GMT
server: AkamaiNetStorage
vary: Accept-Encoding

POST
H2 204 / Show response
px.ads.linkedin.com/wa/ 0
211 B 51ms
44ms XHR
text/plain 2620:1ec:21::14
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://px.ads.linkedin.com/wa/
Requested by: Host: snap.licdn.com
URL: https://snap.licdn.com/li.lms-analytics/insight.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:21::14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://origin-unit42.paloaltonetworks.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Accept: *
Content-Type: text/plain;charset=UTF-8

Response headers

linkedin-action: 1
x-li-pop: afd-prod-lva1-x
nel: {"report_to":"network-errors","max_age":1296000,"success_fraction":0.00066,"failure_fraction":1,"include_subdomains":true}
x-msedge-ref: Ref A: E76784824E8C433AACAF23898C471F1B Ref B: EWR30EDGE1613 Ref C: 2024-10-31T09:51:01Z
x-li-fabric: prod-lva1
access-control-allow-credentials: true
report-to: {"group":"network-errors","max_age":2592000,"endpoints":[{"url":"https://www.linkedin.com/li/rep"}],"include_subdomains":true}
x-li-uuid: AAYlwsGVm8pD6+MRcpwYbg==
x-li-proto: http/2
access-control-allow-origin: https://origin-unit42.paloaltonetworks.com
x-cache: CONFIG_NOCACHE
date: Thu, 31 Oct 2024 09:51:01 GMT
vary: Origin

GET
H2 200 bg9s Show response
tag-logger.demandbase.com/ 0
418 B 199ms
22ms XHR
text/html 2600:9000:2009:3000:1d:8d6d:3b40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tag-logger.demandbase.com/bg9s?x-amz-cf-id=q-4iV1TJhboTXEH00W3qdN-16_sNswZE2KhmoadT9h0ReQHTSLKsJg==&api-version=v3
Requested by: Host: tag.demandbase.com
URL: https://tag.demandbase.com/e78feef73ff94c88.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2009:3000:1d:8d6d:3b40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://origin-unit42.paloaltonetworks.com/

Response headers

x-amz-version-id: 8SdDCdpJvGjkSiMFPv08XcVSgwOMVVmH
etag: "d41d8cd98f00b204e9800998ecf8427e"
age: 16957
x-cache: Error from cloudfront
x-amz-cf-id: EIkCFoiTdDyxaGSwkYGYbW4ZNMkw4tlNtt_49miM3_7vnCJc6Kqbpw==
date: Thu, 31 Oct 2024 05:08:26 GMT
content-type: text/html
vary: accept-encoding
last-modified: Tue, 07 Mar 2023 20:47:02 GMT
via: 1.1 2cfc0bae5f623e4a6a6bc0939f1d71c8.cloudfront.net (CloudFront)
accept-ranges: bytes
access-control-allow-origin: *
content-length: 0
x-amz-cf-pop: IAD66-C2
server: AmazonS3
x-amz-server-side-encryption: AES256

GET criticalTopBase.min.js
develop.paloaltonetworks.com/etc.clientlibs/panClean/components/mainNavigationComp/clientlibs/panClean/ 0
0

GET criticalTopProductNav.min.js
develop.paloaltonetworks.com/etc.clientlibs/panClean/components/mainNavigationComp/clientlibs/panClean/ 0
0

GET defered.min.js
develop.paloaltonetworks.com/etc.clientlibs/panClean/components/mainNavigationComp/clientlibs/panClean/ 0
0

GET
H3 200 292776655893647 Show response
connect.facebook.net/signals/config/ 68 KB
13 KB 15ms
15ms Script
application/x-javascript 2a03:2880:f003:100:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/292776655893647?v=2.9.174&r=stable&domain=origin-unit42.paloaltonetworks.com&hme=ead923021ccd3483ef3b9b04703d0a78b943fbdc01e8d7cec21c5059f1f4a5e9&ex_m=70%2C121%2C107%2C111%2C61%2C4%2C100%2C69%2C16%2C97%2C89%2C51%2C54%2C172%2C175%2C187%2C183%2C184%2C186%2C29%2C101%2C53%2C77%2C185%2C167%2C170%2C180%2C181%2C188%2C131%2C41%2C189%2C190%2C34%2C143%2C15%2C50%2C194%2C193%2C133%2C18%2C40%2C1%2C43%2C65%2C66%2C67%2C71%2C93%2C17%2C14%2C96%2C92%2C91%2C108%2C52%2C110%2C39%2C109%2C30%2C94%2C26%2C168%2C171%2C140%2C86%2C56%2C84%2C33%2C73%2C0%2C95%2C32%2C28%2C82%2C83%2C88%2C47%2C46%2C87%2C37%2C11%2C12%2C13%2C6%2C7%2C25%2C22%2C23%2C57%2C62%2C64%2C75%2C102%2C27%2C76%2C9%2C8%2C80%2C48%2C21%2C104%2C103%2C105%2C98%2C10%2C20%2C3%2C38%2C74%2C19%2C5%2C90%2C81%2C44%2C35%2C85%2C2%2C36%2C63%2C42%2C106%2C45%2C79%2C68%2C112%2C60%2C59%2C31%2C99%2C58%2C55%2C49%2C78%2C72%2C24%2C113

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f003:100:face:b00c:0:3 Ashburn, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

da9f63e67636bf79c09121cd0c3ccfd73a4fe9a348b22de3806af7177f03a95b

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' data: blob: ;script-src 'nonce-7L1zezoR' .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* blob: data: 'self' https://.google-analytics.com .google.com;style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com: wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: .cdninstagram.com 'self' https://.google-analytics.com;img-src 'self' data: blob: * https://*.google-analytics.com;block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://origin-unit42.paloaltonetworks.com/

Response headers

content-encoding: gzip
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
x-content-type-options: nosniff
expires: Sat, 01 Jan 2000 00:00:00 GMT
alt-svc: h3=":443"; ma=86400
date: Thu, 31 Oct 2024 09:51:02 GMT
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
priority: u=3,i
x-frame-options: DENY
strict-transport-security: max-age=31536000; preload; includeSubDomains
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
content-security-policy: default-src 'self' data: blob: *;script-src 'nonce-7L1zezoR' *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* blob: data: 'self' https://*.google-analytics.com *.google.com;style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' https://*.google-analytics.com;img-src 'self' data: blob: * https://*.google-analytics.com;block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
cache-control: public, max-age=1200
timing-allow-origin: *
cross-origin-opener-policy: same-origin-allow-popups
x-fb-connection-quality: EXCELLENT; q=0.9, rtt=29, rtx=0, c=50, mss=1232, tbw=67965, tp=65, tpl=0, uplat=1, ullat=-1
pragma: public
x-fb-debug: PBbzoJtTLBVRZgGeF9Q5fHVb+g1VaJCh50faclJXJD7RaQVLMztpOmvouhDTodw7KCBB84GIV2oCfrpsMWnsRw==
cross-origin-resource-policy: cross-origin
permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
document-policy: force-load-at-top
cross-origin-opener-policy-report-only: restrict-properties;report-to="coop_report"
content-length: 13560
x-xss-protection: 0
origin-agent-cluster: ?1

GET
H2 200 / Show response
settings.luckyorange.net/ 129 B
777 B 181ms
40ms Fetch
application/json 172.67.75.100
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://settings.luckyorange.net/?u=https%3A%2F%2Forigin-unit42.paloaltonetworks.com%2Fnorth-korean-threat-group-play-ransomware%2F&s=109287

Requested by

Host: d10lpsik1i8c69.cloudfront.net
URL: https://d10lpsik1i8c69.cloudfront.net/w.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.67.75.100 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

3d269f79c894bff2b3fafeee9166f3661607900e8339b7400c22f00e7d858edc

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://origin-unit42.paloaltonetworks.com/

Response headers

x-frame-options: SAMEORIGIN
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: gzip
cf-cache-status: DYNAMIC
access-control-allow-credentials: true
access-control-allow-methods: GET, POST, OPTIONS
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=8jlhjuovHKbHS3x0pprh8b6v%2FSQp5EY8kj0UVgjdEg4marzDoFXdkQZxWldpnfyBQnafOlXQdgywH8jtscHT8yJbzXCnoUgtp4GcmVzOYWlY%2B2UMe0PYMSMwDL4NPirhzUwS4jQLhuTOXA%3D%3D"}],"group":"cf-nel","max_age":604800}
cf-ray: 8db2be86894a436a-EWR
access-control-allow-origin: https://origin-unit42.paloaltonetworks.com
content-length: 121
date: Thu, 31 Oct 2024 09:51:02 GMT
content-type: application/json
vary: Accept-Encoding
server: cloudflare
access-control-allow-headers: Authorization,Content-Type,Accept,Origin,User-Agent,DNT,Cache-Control,Keep-Alive,X-Requested-With,If-Modified-Since

GET
H2 200 gif.gif Show response
ibc-flow.techtarget.com/a/ 43 B
440 B 54ms
41ms XHR
image/gif 34.111.208.231
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://ibc-flow.techtarget.com/a/gif.gif?actTypeId=31&cid=1266478&r=1730368262019&ref=https%3A%2F%2Forigin-unit42.paloaltonetworks.com%2Fnorth-korean-threat-group-play-ransomware%2F&version=2.4
Requested by: Host: trk.techtarget.com
URL: https://trk.techtarget.com/tracking.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.111.208.231 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 231.208.111.34.bc.googleusercontent.com
Software: nginx/1.20.2 /
Resource Hash: 2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
ibc_rate_tier: 1266478
Referer: https://origin-unit42.paloaltonetworks.com/

Response headers

x-goog-metageneration: 1
x-goog-hash: crc32c=7uenZA==, md5=/JT7DD7YqPkJ28djCgmH/w==
etag: "fc94fb0c3ed8a8f909dbc7630a0987ff"
access-control-allow-methods: GET, POST, OPTIONS
x-goog-stored-content-encoding: identity
expires: Thu, 31 Oct 2024 10:51:02 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-goog-stored-content-length: 43
date: Thu, 31 Oct 2024 09:51:02 GMT
content-type: image/gif
last-modified: Thu, 08 Dec 2022 21:19:29 GMT
vary: Origin
x-guploader-uploadid: AHmUCY0JaR8GasJlt-3vxvh30n_gEu0jB3HUODbigqdCXKQc10Oh61fOycFfwPwooSfupi528qk
access-control-allow-headers: ibc_header,ibc_rate_tier,User-Agent,X-Requested-With,Cache-Control,Content-Type,Range
cache-control: public, max-age=3600
x-goog-storage-class: STANDARD
via: 1.1 google
accept-ranges: bytes
access-control-allow-origin: *
x-goog-generation: 1670534369365034
content-length: 43
server: nginx/1.20.2

OPTIONS
H2 200 gif.gif
ibc-flow.techtarget.com/a/ Frame 0
0 169ms
29ms Preflight
text/html 34.111.208.231
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://ibc-flow.techtarget.com/a/gif.gif?actTypeId=31&cid=1266478&r=1730368262019&ref=https%3A%2F%2Forigin-unit42.paloaltonetworks.com%2Fnorth-korean-threat-group-play-ransomware%2F&version=2.4
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.111.208.231 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 231.208.111.34.bc.googleusercontent.com
Software: nginx/1.20.2 /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: ibc_rate_tier
Access-Control-Request-Method: GET
Origin: https://origin-unit42.paloaltonetworks.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

access-control-allow-headers: ibc_header,ibc_rate_tier,User-Agent,X-Requested-With,Cache-Control,Content-Type,Range
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=0
content-length: 0
content-type: text/html; charset=UTF-8
date: Thu, 31 Oct 2024 09:51:02 GMT
expires: Thu, 31 Oct 2024 09:51:02 GMT
server: nginx/1.20.2
vary: Origin
via: 1.1 google
x-guploader-uploadid: AHmUCY1m9tePS1a7-jjzhtd2p3V4GZChMkTvNKyxEL9jboQ0KxcAbO2M4aWcHd-zLNn8QLG61kI

GET
H2 200 /
www.facebook.com/tr/ 0
274 B 90ms
23ms Image
text/plain 2a03:2880:f103:181:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=292776655893647&ev=PageView&dl=https%3A%2F%2Forigin-unit42.paloaltonetworks.com%2Fnorth-korean-threat-group-play-ransomware%2F&rl=&if=false&ts=1730368262152&sw=1600&sh=1200&v=2.9.174&r=stable&ec=0&o=4125&fbp=fb.1.1730368262147.355858189743525448&ler=empty&cdl=API_unavailable&it=1730368262014&coo=false&rqm=GET

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f103:181:face:b00c:0:25de Ashburn, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://origin-unit42.paloaltonetworks.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
x-fb-connection-quality: EXCELLENT; q=0.9, rtt=12, rtx=0, c=10, mss=1328, tbw=2971, tp=-1, tpl=-1, uplat=0, ullat=0
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin
alt-svc: h3=":443"; ma=86400
content-length: 0
date: Thu, 31 Oct 2024 09:51:02 GMT
content-type: text/plain
server: proxygen-bolt

GET
H2 200 /
www.facebook.com/privacy_sandbox/pixel/register/trigger/ 67 B
3 KB 243ms
175ms Image
image/png 2a03:2880:f103:181:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/privacy_sandbox/pixel/register/trigger/?id=292776655893647&ev=PageView&dl=https%3A%2F%2Forigin-unit42.paloaltonetworks.com%2Fnorth-korean-threat-group-play-ransomware%2F&rl=&if=false&ts=1730368262152&sw=1600&sh=1200&v=2.9.174&r=stable&ec=0&o=4125&fbp=fb.1.1730368262147.355858189743525448&ler=empty&cdl=API_unavailable&it=1730368262014&coo=false&rqm=FGET

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f103:181:face:b00c:0:25de Ashburn, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

aa7b6c81e85551eeb5c4809f1e683efa0b780c33d12ddfc2067a1b136803e45a

Security Headers

Name	Value
Content-Security-Policy	default-src data: blob: 'self' https://.fbsbx.com 'unsafe-inline' .facebook.com .fbcdn.net 'unsafe-eval';script-src .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* 'unsafe-inline' blob: data: 'self' connect.facebook.net 'unsafe-eval' https://.google-analytics.com .google.com;style-src .fbcdn.net data: .facebook.com 'unsafe-inline' https://fonts.googleapis.com;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com:* wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: .cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net .fbsbx.com .fb.com https://.google-analytics.com;font-src data: .facebook.com .fbcdn.net .fbsbx.com https://fonts.gstatic.com;img-src .fbcdn.net .facebook.com data: https://.fbsbx.com facebook.com .cdninstagram.com fbsbx.com fbcdn.net connect.facebook.net .carriersignal.info blob: android-webview-video-poster: .whatsapp.net .fb.com .oculuscdn.com .tenor.co .tenor.com .giphy.com https://paywithmybank.com/ https://.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://.google-analytics.com;media-src .cdninstagram.com blob: .fbcdn.net .fbsbx.com www.facebook.com .facebook.com data: .tenor.co .tenor.com https://.giphy.com;frame-src .facebook.com .fbsbx.com fbsbx.com data: www.instagram.com .fbcdn.net https://paywithmybank.com/ https://.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://www.google.com https://td.doubleclick.net .google.com .doubleclick.net;worker-src blob: .facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://origin-unit42.paloaltonetworks.com/

Response headers

content-encoding: zstd
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown&brsid=7431875097239722360"}]}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
x-content-type-options: nosniff
expires: Sat, 01 Jan 2000 00:00:00 GMT
alt-svc: h3=":443"; ma=86400
date: Thu, 31 Oct 2024 09:51:02 GMT
content-type: image/png
vary: Accept-Encoding
x-fb-debug: q49GXDrvyag/fC3O9aTDOz/50qDST4H8mwDpBNnMCDGWg+lPsPWJoxozxT90t+6PoLPUjVGPZbM0QzKCc8PfxQ==
x-frame-options: DENY
strict-transport-security: max-age=15552000; preload
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", default="https://www.facebook.com/ajax/browser_error_reports/?device_level=unknown&brsid=7431875097239722360", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
content-security-policy: default-src data: blob: 'self' https://*.fbsbx.com 'unsafe-inline' *.facebook.com *.fbcdn.net 'unsafe-eval';script-src *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* 'unsafe-inline' blob: data: 'self' connect.facebook.net 'unsafe-eval' https://*.google-analytics.com *.google.com;style-src *.fbcdn.net data: *.facebook.com 'unsafe-inline' https://fonts.googleapis.com;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net *.fbsbx.com *.fb.com https://*.google-analytics.com;font-src data: *.facebook.com *.fbcdn.net *.fbsbx.com https://fonts.gstatic.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net connect.facebook.net *.carriersignal.info blob: android-webview-video-poster: *.whatsapp.net *.fb.com *.oculuscdn.com *.tenor.co *.tenor.com *.giphy.com https://paywithmybank.com/ https://*.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://*.google-analytics.com;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com data: *.tenor.co *.tenor.com https://*.giphy.com;frame-src *.facebook.com *.fbsbx.com fbsbx.com data: www.instagram.com *.fbcdn.net https://paywithmybank.com/ https://*.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://www.google.com https://td.doubleclick.net *.google.com *.doubleclick.net;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;
cache-control: private, no-store, no-cache, must-revalidate
x-fb-connection-quality: EXCELLENT; q=0.9, rtt=13, rtx=0, c=17, mss=1328, tbw=3289, tp=-1, tpl=-1, uplat=162, ullat=0
cross-origin-opener-policy: same-origin-allow-popups;report-to="coop_report"
pragma: no-cache
cross-origin-resource-policy: cross-origin
permissions-policy: accelerometer=(), attribution-reporting=(self), autoplay=(), bluetooth=(), browsing-topics=(self), camera=(self), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(self), clipboard-write=(self), compute-pressure=(), display-capture=(self), encrypted-media=(self), fullscreen=(self), gamepad=*, geolocation=(self), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(self), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(self), midi=(), otp-credentials=(), payment=(), picture-in-picture=(self), private-state-token-issuance=(), publickey-credentials-get=(self), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=(self);report-to="permissions_policy"
document-policy: force-load-at-top
x-xss-protection: 0
origin-agent-cluster: ?0

GET qevents.js
a.quora.com/ 0
0

GET
H2 200 ga.js Show response
ssl.google-analytics.com/ 45 KB
17 KB 72ms
16ms Script
text/javascript 2607:f8b0:4004:c06::61
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ssl.google-analytics.com/ga.js

Requested by

Host: origin-unit42.paloaltonetworks.com
URL: https://origin-unit42.paloaltonetworks.com/north-korean-threat-group-play-ransomware/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c06::61 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

1259ea99bd76596239bfd3102c679eb0a5052578dc526b0452f4d42f8bcdd45f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://origin-unit42.paloaltonetworks.com/

Response headers

content-encoding: gzip
age: 6257
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsgac:215:0"}],}
x-content-type-options: nosniff
expires: Thu, 31 Oct 2024 10:06:45 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 31 Oct 2024 08:06:45 GMT
last-modified: Tue, 12 Dec 2023 18:09:08 GMT
content-type: text/javascript
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsgac:215:0
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 17168
server: Golfe2

GET
H2 200 tag.aspx Show response
ml314.com/ 38 KB
39 KB 74ms
10ms Script
application/javascript 34.117.77.79
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://ml314.com/tag.aspx?309
Requested by: Host: origin-unit42.paloaltonetworks.com
URL: https://origin-unit42.paloaltonetworks.com/north-korean-threat-group-play-ransomware/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.117.77.79 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 79.77.117.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: d0e12af8c4e560fe89643639e0c3ed4dc76125c62adeb2879b761d73dbaecf50

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://origin-unit42.paloaltonetworks.com/

Response headers

x-goog-metageneration: 1
x-goog-hash: crc32c=6sDw2Q==, md5=YyYW/xWCXwMKqzORpY7wQg==
etag: "632616ff15825f030aab3391a58ef042"
age: 4
x-goog-stored-content-encoding: identity
x-cache-hit: hit
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-goog-stored-content-length: 39162
date: Thu, 31 Oct 2024 09:50:58 GMT
last-modified: Wed, 24 Jul 2024 19:30:50 GMT
content-type: application/javascript
x-guploader-uploadid: AHmUCY3WDTeCGEM8K6SNI_Q5PH-BLpqefRCOzzalCD5ayWAsTgQZW4BokaMlSrwpkQ0ipd4qSKJg8onhwA
cache-control: public,max-age=3600
x-goog-storage-class: STANDARD
via: 1.1 google
cache-id: LGA-991dec68
accept-ranges: bytes
x-goog-generation: 1721849450340665
content-length: 39162
server: UploadServer

GET
H2

200

/
match.adsrvr.org/track/upb/ Frame AD89
Redirect Chain

https://insight.adsrvr.org/track/up?adv=4vc17dm&ref=https%3A%2F%2Forigin-unit42.paloaltonetworks.com%2Fnorth-korean-threat-group-play-ransomware%2F&upid=jnrvx4g&upv=1.1.0&paapi=1
https://match.adsrvr.org/track/upb/?adv=4vc17dm&ref=https%3A%2F%2Forigin-unit42.paloaltonetworks.com%2Fnorth-korean-threat-group-play-ransomware%2F&upid=jnrvx4g&upv=1.1.0&paapi=1

0
0

16ms
15ms

Document
text/html

15.197.193.217
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://match.adsrvr.org/track/upb/?adv=4vc17dm&ref=https%3A%2F%2Forigin-unit42.paloaltonetworks.com%2Fnorth-korean-threat-group-play-ransomware%2F&upid=jnrvx4g&upv=1.1.0&paapi=1
Requested by: Host: js.adsrvr.org
URL: https://js.adsrvr.org/up_loader.1.1.0.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 15.197.193.217 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a12b7a488abeaa9e4.awsglobalaccelerator.com
Software: Kestrel /
Resource Hash

Request headers

Referer: https://origin-unit42.paloaltonetworks.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

content-encoding: gzip
content-type: text/html
date: Thu, 31 Oct 2024 09:51:02 GMT
server: Kestrel
vary: Accept-Encoding

Redirect headers

content-length: 407
date: Thu, 31 Oct 2024 09:51:02 GMT
location: https://match.adsrvr.org/track/upb/?adv=4vc17dm&ref=https%3A%2F%2Forigin-unit42.paloaltonetworks.com%2Fnorth-korean-threat-group-play-ransomware%2F&upid=jnrvx4g&upv=1.1.0&paapi=1
server: Kestrel

POST
H/1.1 204
No Content collect Show response
r.clarity.ms/ 0
298 B 83ms
53ms XHR
text/plain 20.119.174.243
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://r.clarity.ms/collect
Requested by: Host: www.clarity.ms
URL: https://www.clarity.ms/s/0.7.49/clarity.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 20.119.174.243 Boydton, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Accept: application/x-clarity-gzip
Referer: https://origin-unit42.paloaltonetworks.com/

Response headers

Request-Context: appId=cid-v1:bdfb7149-d2ee-45f0-9a22-f0b1c5035608
Access-Control-Allow-Origin: https://origin-unit42.paloaltonetworks.com
Date: Thu, 31 Oct 2024 09:51:02 GMT
Vary: Origin
Server: nginx
Connection: keep-alive
Access-Control-Allow-Credentials: true

GET
BLOB 200
OK c4213405-6348-48b3-9ef5-d94ca79b611e
https://origin-unit42.paloaltonetworks.com/ 43 B
0 Image
image/gif

General

Check archive.org

Show headers Download Go to Show image

Full URL: blob:https://origin-unit42.paloaltonetworks.com/c4213405-6348-48b3-9ef5-d94ca79b611e
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/gif
Content-Length: 43

GET
H2 200 __utm.gif
ssl.google-analytics.com/r/ 35 B
410 B 25ms
23ms Image
image/gif 2607:f8b0:4004:c06::61
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ssl.google-analytics.com/r/__utm.gif?utmwv=5.7.2&utms=1&utmn=1341260513&utmhn=origin-unit42.paloaltonetworks.com&utmcs=UTF-8&utmsr=1600x1200&utmvp=1600x1200&utmsc=24-bit&utmul=en-us&utmje=0&utmfl=-&utmdt=Jumpy%20Pisces%20Engages%20in%20Play%20Ransomware&utmhid=484458532&utmr=-&utmp=%2Fnorth-korean-threat-group-play-ransomware%2F&utmht=1730368262265&utmac=UA-494959-2&utmcc=__utma%3D85376408.117368376.1730368262.1730368262.1730368262.1%3B%2B__utmz%3D85376408.1730368262.1.1.utmcsr%3D(direct)%7Cutmccn%3D(direct)%7Cutmcmd%3D(none)%3B&utmjid=603676092&utmredir=1&utmu=qBAAAAAAAAAAAAAAAAABAAAE~

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c06::61 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://origin-unit42.paloaltonetworks.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsgac:169:0"}],}
x-content-type-options: nosniff
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsgac:169:0
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 35
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 31 Oct 2024 09:51:02 GMT
last-modified: Sun, 17 May 1998 03:00:00 GMT
content-type: image/gif
server: Golfe2

GET
H2 200 utsync.ashx Show response
ml314.com/ 641 B
1 KB 42ms
41ms Script
application/javascript 34.117.77.79
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://ml314.com/utsync.ashx?pub=&adv=&et=0&eid=50023&ct=js&pi=&fp=&clid=&if=0&ps=&cl=&mlt=&data=&&cp=https%3A%2F%2Forigin-unit42.paloaltonetworks.com%2Fnorth-korean-threat-group-play-ransomware%2F&pv=1730368262270_c09zdrqbl&bl=en-us&cb=3574150&return=&ht=&d=&dc=&si=1730368262270_c09zdrqbl&cid=&s=1600x1200&rp=&v=2.7.4.212
Requested by: Host: ml314.com
URL: https://ml314.com/tag.aspx?309
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.117.77.79 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 79.77.117.34.bc.googleusercontent.com
Software: Google Frontend /
Resource Hash: cf9f9253545706a59a03bbfe1fe9e598a8028c430e80efd8fdfc20b90f6f826a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://origin-unit42.paloaltonetworks.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
via: 1.1 google
expires: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: CP="NON DSP COR ADMo PSAo DEVo BUS COM UNI NAV DEM STA"
date: Thu, 31 Oct 2024 09:51:02 GMT
content-type: application/javascript
server: Google Frontend

GET
H2 200 ibs:dpid=22052&dpuuid=3648092034157248535&redir=
dpm.demdex.net/ 42 B
715 B 20ms
17ms Image
image/gif 52.20.18.175
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dpm.demdex.net/ibs:dpid=22052&dpuuid=3648092034157248535&redir=

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.20.18.175 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-52-20-18-175.compute-1.amazonaws.com

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://origin-unit42.paloaltonetworks.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
cache-control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
dcs: dcs-prod-va6-1-v066-06208a95e.edge-va6.demdex.com 2 ms
content-encoding: gzip
pragma: no-cache
x-content-type-options: nosniff
x-tid: cKCpQUeXS70=
expires: Thu, 01 Jan 1970 00:00:00 UTC
content-length: 59
p3p: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
date: Thu, 31 Oct 2024 09:51:02 GMT
content-type: image/gif

GET
H3

200

csync.ashx
ml314.com/
Redirect Chain

https://idsync.rlcdn.com/395886.gif?partner_uid=3648092034157248535
https://idsync.rlcdn.com/1000.gif?memo=CO6UGBIeChoIARCuXxoTMzY0ODA5MjAzNDE1NzI0ODUzNRAAGg0IhqaNuQYSBQjoBxAAQgBKAA
https://ml314.com/csync.ashx?fp=ed960b81d0f6f1952d3ddfba19e20c2e9e8032bf3ee5e06c5cf2e30cc26fcca4f4cb09cee1a4f8eb&person_id=3648092034157248535&eid=50082

43 B
56 B

45ms
44ms

Image
image/gif

34.117.77.79
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ml314.com/csync.ashx?fp=ed960b81d0f6f1952d3ddfba19e20c2e9e8032bf3ee5e06c5cf2e30cc26fcca4f4cb09cee1a4f8eb&person_id=3648092034157248535&eid=50082
Protocol: H3
Server: 34.117.77.79 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 79.77.117.34.bc.googleusercontent.com
Software: Google Frontend /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://origin-unit42.paloaltonetworks.com/

Response headers

via: 1.1 google
expires: Fri, 01 Nov 2024 09:51:02 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 31 Oct 2024 09:51:02 GMT
content-type: image/gif
server: Google Frontend

Redirect headers

cache-control: no-cache, no-store
timing-allow-origin: *
location: https://ml314.com/csync.ashx?fp=ed960b81d0f6f1952d3ddfba19e20c2e9e8032bf3ee5e06c5cf2e30cc26fcca4f4cb09cee1a4f8eb&person_id=3648092034157248535&eid=50082
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
content-length: 0
date: Thu, 31 Oct 2024 09:51:02 GMT

GET
H3

200

utsync.ashx
ml314.com/
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=d0tro1j&ttd_tpi=1
https://ml314.com/utsync.ashx?eid=53819&et=0&fp=b63a40f4-b4dd-441a-b440-82268919ea41&gdpr=0&gdpr_consent=

43 B
61 B

59ms
55ms

Image
image/gif

34.117.77.79
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ml314.com/utsync.ashx?eid=53819&et=0&fp=b63a40f4-b4dd-441a-b440-82268919ea41&gdpr=0&gdpr_consent=
Protocol: H3
Server: 34.117.77.79 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 79.77.117.34.bc.googleusercontent.com
Software: Google Frontend /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://origin-unit42.paloaltonetworks.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
via: 1.1 google
expires: 0,Fri, 01 Nov 2024 09:51:02 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: CP="NON DSP COR ADMo PSAo DEVo BUS COM UNI NAV DEM STA"
date: Thu, 31 Oct 2024 09:51:02 GMT
content-type: image/gif
server: Google Frontend

Redirect headers

location: https://ml314.com/utsync.ashx?eid=53819&et=0&fp=b63a40f4-b4dd-441a-b440-82268919ea41&gdpr=0&gdpr_consent=
content-length: 241
date: Thu, 31 Oct 2024 09:51:02 GMT
server: Kestrel

GET
H3

200

csync.ashx
ml314.com/
Redirect Chain

https://ib.adnxs.com/getuid?https://ml314.com/csync.ashx%3Ffp=$UID%26person_id=3648092034157248535%26eid=2
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fml314.com%2Fcsync.ashx%253Ffp%3D%24UID%2526person_id%3D3648092034157248535%2526eid%3D2
https://ml314.com/csync.ashx?fp=1872298146528952303&person_id=3648092034157248535&eid=2

43 B
56 B

46ms
46ms

Image
image/gif

34.117.77.79
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ml314.com/csync.ashx?fp=1872298146528952303&person_id=3648092034157248535&eid=2
Protocol: H3
Server: 34.117.77.79 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 79.77.117.34.bc.googleusercontent.com
Software: Google Frontend /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://origin-unit42.paloaltonetworks.com/

Response headers

via: 1.1 google
expires: Fri, 01 Nov 2024 09:51:02 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 31 Oct 2024 09:51:02 GMT
content-type: image/gif
server: Google Frontend

Redirect headers

cache-control: no-store, no-cache, private
location: https://ml314.com/csync.ashx?fp=1872298146528952303&person_id=3648092034157248535&eid=2
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
x-proxy-origin: 5.181.234.132; 5.181.234.132; 669.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
access-control-allow-origin: *
an-x-request-uuid: 627c1e69-8395-4842-bd3f-ab9343a020e5
content-length: 0
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Thu, 31 Oct 2024 09:51:02 GMT
x-xss-protection: 0
content-type: text/html; charset=utf-8
server: nginx/1.23.4

GET
H/1.1

200
OK

match
ps.eyeota.net/
Redirect Chain

https://ps.eyeota.net/pixel?pid=r8hrb20&t=gif
https://ps.eyeota.net/pixel/bounce/?pid=r8hrb20&t=gif
https://ml314.com/utsync.ashx?eid=50052&et=0&fp=2Qb9SqfHhzOJ9310CMnYPLSMfVsO0YfkSLJLUaNwavOA&gdpr=0&gdpr_consent=&return=https%3A%2F%2Fps.eyeota.net%2Fmatch%3Fbid%3Dr8hrb20%26uid%3Dnil%26referrer_p...
https://ps.eyeota.net/match?bid=r8hrb20&uid=nil&referrer_pid=r8hrb20

70 B
440 B

16ms
15ms

Image
image/gif

50.16.174.192
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ps.eyeota.net/match?bid=r8hrb20&uid=nil&referrer_pid=r8hrb20
Protocol: HTTP/1.1
Server: 50.16.174.192 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-50-16-174-192.compute-1.amazonaws.com
Software: /
Resource Hash: de9d3fd0eb948bd294477d0eda60a73b85caff1794803530d0463193a113da98

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://origin-unit42.paloaltonetworks.com/

Response headers

Content-Length: 70
P3P: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml"
Date: Thu, 31 Oct 2024 09:51:02 GMT
Content-Type: image/gif

Redirect headers

cache-control: no-cache, no-store, must-revalidate
location: https://ps.eyeota.net/match?bid=r8hrb20&uid=nil&referrer_pid=r8hrb20
pragma: no-cache
via: 1.1 google
expires: 0,Fri, 01 Nov 2024 09:51:02 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: CP="NON DSP COR ADMo PSAo DEVo BUS COM UNI NAV DEM STA"
content-length: 43
date: Thu, 31 Oct 2024 09:51:02 GMT
content-type: image/gif
x-cloud-trace-context: 3bdbc40850c199df68626e84e8b2c28a
server: Google Frontend

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: develop.paloaltonetworks.com
URL: https://develop.paloaltonetworks.com/etc.clientlibs/panClean/components/mainNavigationComp/clientlibs/panClean/criticalTop.min.css

Domain: develop.paloaltonetworks.com
URL: https://develop.paloaltonetworks.com/etc.clientlibs/panClean/components/mainNavigationComp/clientlibs/panClean/criticalTopProductNav.min.css

Domain: develop.paloaltonetworks.com
URL: https://develop.paloaltonetworks.com/etc.clientlibs/panClean/components/mainNavigationComp/clientlibs/panClean/deferedProductNav.min.css

Domain: develop.paloaltonetworks.com
URL: https://develop.paloaltonetworks.com/etc.clientlibs/panClean/components/mainNavigationComp/clientlibs/panClean/criticalTopBase.min.js

Domain: develop.paloaltonetworks.com
URL: https://develop.paloaltonetworks.com/etc.clientlibs/panClean/components/mainNavigationComp/clientlibs/panClean/criticalTopProductNav.min.js

Domain: develop.paloaltonetworks.com
URL: https://develop.paloaltonetworks.com/etc.clientlibs/panClean/components/mainNavigationComp/clientlibs/panClean/defered.min.js

Domain: a.quora.com
URL: https://a.quora.com/qevents.js

Verdicts & Comments Add Verdict or Comment

178 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

86 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
origin-unit42.paloaltonetworks.com/north-korean-threat-group-play-ransomware	1969-12-31 23:59:59	Name: DriftPlaybook Value: A
origin-unit42.paloaltonetworks.com/	1970-01-21 00:40:54	Name: pvc_visits[0] Value: 1730454659b137203
.demdex.net/	1970-01-21 04:58:40	Name: demdex Value: 14080158306517841982536641086731138039
.paloaltonetworks.com/	1969-12-31 23:59:59	Name: AMCVS_9A531C8B532965080A490D4D%40AdobeOrg Value: 1
.paloaltonetworks.com/	1970-01-21 10:15:28	Name: s_ecid Value: MCMID%7C19891220542191872223108456436506835943
.paloaltonetworks.com/	1970-01-21 10:15:28	Name: AMCV_9A531C8B532965080A490D4D%40AdobeOrg Value: 179643557%7CMCIDTS%7C20028%7CMCMID%7C19891220542191872223108456436506835943%7CMCAAMLH-1730973060%7C7%7CMCAAMB-1730973060%7CRKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y%7CMCOPTOUT-1730375460s%7CNONE%7CMCAID%7CNONE%7CMCCIDH%7C-1538190790%7CvVersion%7C5.5.0
.paloaltonetworks.com/	1970-01-21 09:25:04	Name: OptanonConsent Value: isGpcEnabled=0&datestamp=Wed+Oct+30+2024+23%3A51%3A00+GMT-1000+(Hawaii-Aleutian+Standard+Time)&version=202409.1.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=71f0aefc-3e75-4491-a4f3-447fe9954538&interactionCount=0&isAnonUser=1&landingPath=https%3A%2F%2Forigin-unit42.paloaltonetworks.com%2Fnorth-korean-threat-group-play-ransomware%2F&groups=C0001%3A1%2CC0002%3A1%2CC0003%3A1%2CC0004%3A1
.paloaltonetworks.com/	1970-01-21 00:39:30	Name: dmdbase_cdc Value: DBSET
origin-unit42.paloaltonetworks.com/	1969-12-31 23:59:59	Name: __anaEvent23Sent Value: true
.paloaltonetworks.com/	1969-12-31 23:59:59	Name: at_check Value: true
.t.co/	1970-01-21 10:15:28	Name: muc_ads Value: 25219f38-7880-4bbd-a0fa-03db3f8fedf4
.t.co/	1970-01-21 00:39:30	Name: __cf_bm Value: 53lj0PGhWTiq7uKVqYFEAk0YM8_GKIJ80x1vD5WixC4-1730368261-1.0.1.1-DHAiyIRnP7w8An9BCcEti3M4i0QI.0StCs02OABF78OUHbbCfEhxa4U.JG8Fp.5XlmzTKk42CR4jhUNbwEGdTw
.paloaltonetworks.com/	1970-01-21 00:40:54	Name: _uetsid Value: a2deac10976d11ef887c4f6369ae0b48
.paloaltonetworks.com/	1970-01-21 10:01:04	Name: _uetvid Value: a2def890976d11efb4667b9ca53d3dc0
.paloaltonetworks.com/	1970-01-21 10:15:28	Name: mbox Value: session#9ad39a62a53c4b94a0b81d9afa7587a9#1730370122\|PC#9ad39a62a53c4b94a0b81d9afa7587a9.34_0#1793613062
.linkedin.com/	1970-01-21 02:49:04	Name: li_sugr Value: 4e55eb73-f25f-4d4c-8ac9-2b86948fba93
.linkedin.com/	1970-01-21 09:25:04	Name: bcookie Value: "v=2&50fc6d9f-d119-4b93-8cf1-6c57396fac17"
.linkedin.com/	1970-01-21 00:40:54	Name: lidc Value: "b=VGST01:s=V:r=V:a=V:p=V:g=3382:u=1:x=1:i=1730368261:t=1730454661:v=2:sig=AQFno0rU3iBjnp10vVF_WZeoLcJ9f1qL"
.bing.com/	1970-01-21 10:01:04	Name: MUID Value: 15E365BC15816FD02475709514E36E87
.bat.bing.com/	1970-01-21 00:49:33	Name: MR Value: 0
.linkedin.com/	1970-01-21 01:22:40	Name: UserMatchHistory Value: AQJ5gpkp5n8YPgAAAZLh_ExE8dho_GwP4lOTvEKfLgeA_FVUlRvFPsOBji2hj-S7uGikS0iGdTq4_g
.linkedin.com/	1970-01-21 01:22:40	Name: AnalyticsSyncHistory Value: AQIR8X39BOezjAAAAZLh_ExE9FOgetmebPE3a9ZXMiGcYhe9GGHDxqdNmy0h68lymM4hWuUr4G2RhMYIipjutw
.twitter.com/	1970-01-21 10:15:28	Name: personalization_id Value: "v1_cA162JZvGGQy+RMHqT4wzA=="
.paloaltonetworks.com/	1970-01-21 10:15:28	Name: s_lv Value: 1730368261237
.paloaltonetworks.com/	1970-01-21 00:39:30	Name: s_lv_s Value: First%20Visit
.paloaltonetworks.com/	1970-01-21 00:40:55	Name: s_vnum Value: 1730455200243%26vn%3D1
.paloaltonetworks.com/	1970-01-21 00:39:30	Name: s_invisit Value: true
.paloaltonetworks.com/	1970-01-21 01:22:40	Name: s_nr Value: 1730368261245-New
.paloaltonetworks.com/	1969-12-31 23:59:59	Name: s_plt Value: unit42%3Anorth-korean-threat-group-play-ransomware
.paloaltonetworks.com/	1970-01-21 00:39:30	Name: gpv_v9 Value: unit42%3Anorth-korean-threat-group-play-ransomware
.paloaltonetworks.com/	1970-01-21 00:39:30	Name: s_ppn Value: unit42%3Anorth-korean-threat-group-play-ransomware
www.clarity.ms/	1970-01-21 09:25:04	Name: CLID Value: a41bc6c092284a2d9fd1d217bbf6ad50.20241031.20251031
.paloaltonetworks.com/	1969-12-31 23:59:59	Name: s_ppvl Value: %5B%5BB%5D%5D
.paloaltonetworks.com/	1969-12-31 23:59:59	Name: s_ppv Value: unit42%253Anorth-korean-threat-group-play-ransomware%2C10%2C10%2C1200%2C1600%2C1200%2C1600%2C1200%2C1%2CP
.paloaltonetworks.com/	1969-12-31 23:59:59	Name: s_cc Value: true
.paloaltonetworks.com/	1970-01-21 02:49:04	Name: _gcl_au Value: 1.1.742671459.1730368261
.paloaltonetworks.com/	1970-01-21 10:15:28	Name: _mkto_trk Value: id:531-OCS-018&token:_mch-paloaltonetworks.com-1730368261374-74840
.paloaltonetworks.com/	1970-01-21 09:25:04	Name: _clck Value: 1c274t5%7C2%7Cfqh%7C0%7C1765
.www.linkedin.com/	1970-01-21 09:25:04	Name: bscookie Value: "v=1&20241031095101e7601a6b-9f91-444a-8c11-8c7b4eed0e8dAQGgaN1GRA21tx9rUaj7OQqf_zkwduVA"
.linkedin.com/	1970-01-21 00:39:30	Name: __cf_bm Value: .BPak9iULUgCmNMT52OaUR1JukI5yoZhJ1.cTCEHs5M-1730368261-1.0.1.1-l333BnZ3avJI2qahu3PRO_bLjTAwDqef_u4MLus9ST4llbCVeS47pdjBsZ8H2vsT0Bt3qj4ROvlOQWtu_D19cQ
.doubleclick.net/	1970-01-21 01:22:40	Name: ar_debug Value: 1
.doubleclick.net/	1970-01-21 10:15:28	Name: IDE Value: AHWqTUm1u5SyF2VD-9D8JSB5VoLAcs32v5nu1Yf6H8iA3usWzttHi17Ik_-I44kd
.paloaltonetworks.com/	1970-01-21 10:15:28	Name: _ga Value: GA1.1.117368376.1730368262
.twitter.com/	1970-01-21 10:15:28	Name: guest_id_marketing Value: v1%3A173036826177441942
.twitter.com/	1970-01-21 10:15:28	Name: guest_id_ads Value: v1%3A173036826177441942
.twitter.com/	1970-01-21 10:15:28	Name: guest_id Value: v1%3A173036826177441942
.c.bing.com/	1970-01-21 00:49:33	Name: MR Value: 0
.c.bing.com/	1970-01-21 10:01:04	Name: SRM_B Value: 15E365BC15816FD02475709514E36E87
.c.clarity.ms/	1969-12-31 23:59:59	Name: SM Value: C
.clarity.ms/	1970-01-21 10:01:04	Name: MUID Value: 15E365BC15816FD02475709514E36E87
.c.clarity.ms/	1970-01-21 00:49:33	Name: MR Value: 0
.c.clarity.ms/	1970-01-21 00:39:28	Name: ANONCHK Value: 0
.techtarget.com/	1970-01-21 00:39:30	Name: __cf_bm Value: chmdNvcpWV4ICFB4yhzsoCSCAECWwNcFzJvvVKV6aNo-1730368261-1.0.1.1-9qNlOGqqFLpuC5_PpBcLMJeePwurwm3e.oIlmvSIo0Wii6ooa6o6qjCR4Twz5BVHUyq85owjct3wLCC4psKyOA
.paloaltonetworks.com/	1970-01-21 10:15:28	Name: _ga_KS2MELEEFC Value: GS1.1.1730368261.1.0.1730368261.60.0.0
.doubleclick.net/	1970-01-21 04:58:40	Name: receive-cookie-deprecation Value: 1
.paloaltonetworks.com/	1970-01-21 00:40:54	Name: _clsk Value: 1onophf%7C1730368261988%7C1%7C1%7Cr.clarity.ms%2Fcollect
.paloaltonetworks.com/	1970-01-21 02:49:04	Name: _fbp Value: fb.1.1730368262147.355858189743525448
.company-target.com/	1970-01-21 10:15:28	Name: tuuid Value: 194e8e58-b986-417e-a613-d884808dc93a
.company-target.com/	1970-01-21 10:15:28	Name: tuuid_lu Value: 1730368262\|ix:0\|mctv:0\|rp:0
.paloaltonetworks.com/	1970-01-21 10:15:28	Name: __utma Value: 85376408.117368376.1730368262.1730368262.1730368262.1
.paloaltonetworks.com/	1969-12-31 23:59:59	Name: __utmc Value: 85376408
.paloaltonetworks.com/	1970-01-21 05:02:16	Name: __utmz Value: 85376408.1730368262.1.1.utmcsr=(direct)\|utmccn=(direct)\|utmcmd=(none)
.adsrvr.org/	1970-01-21 09:25:04	Name: TDID Value: b63a40f4-b4dd-441a-b440-82268919ea41
.paloaltonetworks.com/	1970-01-21 00:39:28	Name: __utmt Value: 1
.paloaltonetworks.com/	1970-01-21 00:39:30	Name: __utmb Value: 85376408.1.10.1730368262
.casalemedia.com/	1970-01-21 09:25:04	Name: CMID Value: ZyNTBkt3udkAACj3ALHd-gAA
.casalemedia.com/	1970-01-21 02:49:04	Name: CMPS Value: 1285
.casalemedia.com/	1970-01-21 02:49:04	Name: CMPRO Value: 1285
.tremorhub.com/	1970-01-21 09:25:25	Name: tvid Value: 7fb027e68e1b477ca16f17a80e44afff
.tremorhub.com/	1970-01-21 10:15:28	Name: tv_UIDM Value: 194e8e58-b986-417e-a613-d884808dc93a
.ml314.com/	1970-01-21 09:25:04	Name: pi Value: 3648092034157248535
.ml314.com/	1970-01-21 00:59:37	Name: tp Value: 4%253B10%252F31%252F2024%2B09%253A51%253A02
.dpm.demdex.net/	1970-01-21 04:58:40	Name: dpm Value: 14080158306517841982536641086731138039
.adnxs.com/	1970-01-21 10:15:28	Name: receive-cookie-deprecation Value: 1
.adnxs.com/	1970-01-21 02:49:04	Name: XANDR_PANID Value: bv53ZYsVqCWNs3KCCOivsbHRYMJpVBnzUYPOidqLOwVI1YUa3vCJrZrn1UJzDJoVdbg_5i-t5qKwOgo90PZ-jPIt44V9oCg_Dln-tCLJJHc.
.adnxs.com/	1970-01-21 02:49:04	Name: uuid2 Value: 1872298146528952303
.eyeota.net/	1970-01-21 09:25:04	Name: mako_uid Value: 192e1fc50fc-1e100000010a4df6
.eyeota.net/	1970-01-21 00:39:28	Name: SERVERID Value: 19958~DM
.adsrvr.org/	1970-01-21 09:25:04	Name: TDCPM Value: CAESFgoHcnViaWNvbhILCN66xIDy5rw9EAUSFQoGZ29vZ2xlEgsI2IuAgvLmvD0QBRIXCghhcHBuZXh1cxILCO7-xIDy5rw9EAUSFgoHZDB0cm8xahILCOL2tYHy5rw9EAUYASACKAIyCwiM7biuiOe8PRAFOAFaB2QwdHJvMWpgAg..
.ml314.com/	1970-01-21 00:39:28	Name: u Value: aHR0cHM6Ly9vcmlnaW4tdW5pdDQyLnBhbG9hbHRvbmV0d29ya3MuY29tLw%3D%3D
.rlcdn.com/	1970-01-21 09:25:04	Name: rlas3 Value: qTDrwAxP8BUiEbrKr1XnyjIrEyn2mmzqGzc3NHJPF0I=
.rlcdn.com/	1970-01-21 02:05:52	Name: pxrc Value: CIamjbkGEgUI6AcQABIFCNtOEAA=
.rubiconproject.com/	1970-01-21 09:25:04	Name: audit_p Value: 1\|KsDp1S3VcnYjBJBcZD24xqzDSN/mcB6i3RHfU5YCYkuMaGpsUGBQ3iZ5OdhM8LWzR08ySAJInMmM1KxoLazIt9i2Wk5FrGos0XY24Ec+XLuwzarQB55cdN9DYTco7dIk5L9WH1YqgYyioRDRYSe991B1FCnq+ZeaOpWvBGztqNVbOz6AjJtUa8ZnH3r7x5VAdeodiyl5GGjkt77VmXBK7kiCfUmSYXqD+ohH/uuQN8oOr/S07bYDcYQkZmofZQkSVSwKu1RXSJT0/fhu8/pkBO4VeIulq+4M1TRwmTZWV3Xc6UO785F0Pw==
.rubiconproject.com/	1970-01-21 09:25:04	Name: khaos Value: M2X4L4EX-J-BQO0
.rubiconproject.com/	1970-01-21 09:25:04	Name: khaos_p Value: M2X4L4EX-J-BQO0
.rubiconproject.com/	1970-01-21 09:25:04	Name: audit Value: 1\|KsDp1S3VcnYjBJBcZD24xqzDSN/mcB6i3RHfU5YCYkuMaGpsUGBQ3iZ5OdhM8LWzR08ySAJInMmM1KxoLazIt9i2Wk5FrGos0XY24Ec+XLuwzarQB55cdN9DYTco7dIk5L9WH1YqgYyioRDRYSe991B1FCnq+ZeaOpWvBGztqNVbOz6AjJtUa8ZnH3r7x5VAdeodiyl5GGjkt77VmXBK7kiCfUmSYXqD+ohH/uuQN8oOr/S07bYDcYQkZmofZQkSVSwKu1RXSJT0/fhu8/pkBO4VeIulq+4M1TRwmTZWV3Xc6UO785F0Pw==

8 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://develop.paloaltonetworks.com/etc.clientlibs/panClean/components/mainNavigationComp/clientlibs/panClean/criticalTop.min.css Message: Failed to load resource: net::ERR_NAME_NOT_RESOLVED
network	error	URL: https://develop.paloaltonetworks.com/etc.clientlibs/panClean/components/mainNavigationComp/clientlibs/panClean/deferedProductNav.min.css Message: Failed to load resource: net::ERR_NAME_NOT_RESOLVED
network	error	URL: https://develop.paloaltonetworks.com/etc.clientlibs/panClean/components/mainNavigationComp/clientlibs/panClean/criticalTopProductNav.min.css Message: Failed to load resource: net::ERR_NAME_NOT_RESOLVED
rendering	warning	URL: https://origin-unit42.paloaltonetworks.com/north-korean-threat-group-play-ransomware/ Message: [GroupMarkerNotSet(crbug.com/242999)!:A0708920AC100000]Automatic fallback to software WebGL has been deprecated. Please use the --enable-unsafe-swiftshader flag to opt in to lower security guarantees for trusted content.
network	error	URL: https://develop.paloaltonetworks.com/etc.clientlibs/panClean/components/mainNavigationComp/clientlibs/panClean/criticalTopBase.min.js Message: Failed to load resource: net::ERR_NAME_NOT_RESOLVED
network	error	URL: https://develop.paloaltonetworks.com/etc.clientlibs/panClean/components/mainNavigationComp/clientlibs/panClean/criticalTopProductNav.min.js Message: Failed to load resource: net::ERR_NAME_NOT_RESOLVED
network	error	URL: https://develop.paloaltonetworks.com/etc.clientlibs/panClean/components/mainNavigationComp/clientlibs/panClean/defered.min.js Message: Failed to load resource: net::ERR_NAME_NOT_RESOLVED
network	error	URL: https://a.quora.com/qevents.js Message: Failed to load resource: net::ERR_BLOCKED_BY_RESPONSE.NotSameOrigin

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

12123386.fls.doubleclick.net
531-ocs-018.mktoresp.com
a.quora.com
ad.doubleclick.net
analytics.google.com
analytics.twitter.com
api.company-target.com
assets.adobedtm.com
bat.bing.com
c.bing.com
c.clarity.ms
cdn.cookielaw.org
connect.facebook.net
d10lpsik1i8c69.cloudfront.net
develop.paloaltonetworks.com
dpm.demdex.net
geolocation.onetrust.com
googleads.g.doubleclick.net
ib.adnxs.com
ibc-flow.techtarget.com
idsync.rlcdn.com
insight.adsrvr.org
js.adsrvr.org
match.adsrvr.org
ml314.com
munchkin.marketo.net
origin-unit42.paloaltonetworks.com
paloaltonetworks.tt.omtrdc.net
ps.eyeota.net
px.ads.linkedin.com
px4.ads.linkedin.com
r.clarity.ms
s.company-target.com
scripts.demandbase.com
settings.luckyorange.net
snap.licdn.com
ssl.google-analytics.com
sstats.paloaltonetworks.com
static.ads-twitter.com
stats.g.doubleclick.net
t.co
tag-logger.demandbase.com
tag.demandbase.com
td.doubleclick.net
trk.techtarget.com
www.clarity.ms
www.facebook.com
www.google.com
www.googletagmanager.com
www.linkedin.com
www.paloaltonetworks.com
a.quora.com
develop.paloaltonetworks.com
104.244.42.131
13.107.42.14
13.249.39.123
142.251.16.149
142.251.163.149
146.75.76.157
15.197.193.217
162.159.140.229
172.67.75.100
18.160.10.89
192.28.144.124
20.110.205.119
20.119.174.243
2001:4860:4802:34::181
23.13.172.203
2600:1408:ac00:19b::1e80
2600:1408:c400:180::c3a
2600:1408:c400:5::17c7:3716
2600:9000:2009:3000:1d:8d6d:3b40:93a1
2606:4700:4400::6812:2089
2606:4700:4400::ac40:92d7
2606:4700::6812:1247
2606:4700::6812:572a
2607:f8b0:4004:c06::61
2607:f8b0:4004:c06::68
2607:f8b0:4004:c0b::61
2607:f8b0:4004:c0b::9d
2607:f8b0:4004:c1b::9c
2607:f8b0:4004:c21::9a
2620:1ec:21::14
2620:1ec:33::10
2620:1ec:bdf::40
2620:1ec:c11::237
2a03:2880:f003:100:face:b00c:0:3
2a03:2880:f103:181:face:b00c:0:25de
3.167.72.96
34.111.208.231
34.117.77.79
34.96.108.115
34.96.71.22
35.244.154.8
35.71.131.137
50.16.174.192
52.20.18.175
54.239.153.227
63.140.39.82
63.140.39.9
68.67.160.184
019ed979f6455f41921fe236c6f520bee56f15631983336001f694376bacee90
01e43870a4218fe731a3516dd76725698c3aadfb285465086849c6b52ef71719
07cc631c7527ce71e44b76347c19beffd8ebdae6a52afe2c964ed16c8e721c1c
0858c92f6c0a651a77d7bc2769349e03defedba5057fd07ebc9675cbad26028a
09fa04e84d7038cc32f19bedcba454b9e637a35f4de496e8ec9148c47550f0fc
0adff2e981d149d803d1d0e7ccb64ffa349186ea961d2ccd5ad2ee585f11db2f
0baad9e25b241b32129e0527c9a7ee951f37948d20d93cbc598ec96762a6213f
0c07b854855b0e2bd7839c3659defa45307e96e281b3c00571d09f213eb6a76e
0cfdf8d7980fb03f598b7477c3d3d2b7f92da5c681d604538fe07abe70ce19b5
0d585aebb9cb31821fbcc6b030e0d882b5639e17bb403f8eb5ce7b3b19f4a1c9
0ea483a3020f20467311f88198ac887d4c3032485b36f30ec83bfa93af6d12d2
0eb69b28ac185e20ea3cef133e67074071e8291265e83ec0674fedbdded257f3
0f3e216c87c073a9ec6b295233c11d03c4758b3f4e16b3577d1962165ce5f31d
1259ea99bd76596239bfd3102c679eb0a5052578dc526b0452f4d42f8bcdd45f
166f2f4034d2d3162ace9a3542542f443707cd939a4c8efcec6a217e4a3b4356
193fbb968733b8a7049da19274546e6b80b76e9a8f1b837fee9a5fdeb8f97c7b
19596433f7b115d1869fa0b307a2d793b76904e14efbdfa99a4eb71aafe7669a
1a9faad9e590108fcb4c4fbd20431f3b3c7a8fab9a61f144d1d13116012d094b
1acd6883d1f0d8bdfd0fcc06d8c058e3ad544e281f1924cc3d212c1ff2d40792
1c94082596ab0f9ad7273be7208793962c1c6ef0ffd7e4feffaed42d47c738d4
1d05fb3972ae3db9945a306fcd724db0a5166141c81d849d130345cbd67ecf94
22bbdf52ea1a957ba39c622cf147856080931b1b5776be89d47b2e4a26a96a40
25e69ce7cbe74899e00042ac10797cb8023ff7d83bf27aae9f05a20c7003054f
271f3cf328dfef60a3d2d4b98ed42d83186679c95f01a4a035a19f04fbc1b1bd
27ecea73e029d8b688971e5d15703224f46a89e698a5e3950e948efb83f949e0
2c0bb81e5aab07f9886b6fcf2b404ba3150dc0c1e7e7b07d7113cabce33360f1
2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363
2fff39fc60bd268cd34d270f80d39a61bd875100c73d7cfb3ac2c93166e8542d
3047800b69b9d50542394db5eccac5335c991ee9656dcde02c4ff648bef81b13
30e6b6e74480e2d8e957c4d32524e0d2a14dfe90355153e91dba112c565b6236
31b0bce4a0e136afc19d1bfc6fada8ef260af6a3aac1bb4855e61c0ba963d6ef
3445e7970c35d64108c64d0e3eb91bf15fd1315e67322b30edc57229a1a20397
354f2bf6a1d51484f02f3575c3d70de72255aae104c16893fa4a0b562a95bcd4
3d269f79c894bff2b3fafeee9166f3661607900e8339b7400c22f00e7d858edc
3f8289c21d5f69b8ffd08af47c6429bfd504461890b71d4ce7ab60af2e94b8d4
420aa7514c70283aa532ee4bcd1b8e95dc4e87fc1627737b0f27bfc41550a0f2
42b6fbca1903d9687db341dabf468cac459c478d3afb79d8a5d6859dc6bb1f4c
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
4d43527ed7e9b1cf579f2ac2e33ca96e49fb3b40192ad0701c49c8d0bd8751be
4e8276aea0a3c7fe3600e6718c7f484d49c347c8d5763d89be95900d526a14da
4fca7d1a40d7a1ddf6f8535e1d1eaa8dd603f002a439b2373e97ef78f6ca0d4d
527233b144bed93cbc45b8a187bce2f5468dcbf4b6be4c566349ce3528ef8b3b
5274f11e6fb32ae0cf2dfb9f8043272865c397a7c4223b4cfa7d50ea52fbde89
55c9d2f019f9d7ddfd69b2ad0351c5617338a222362aebb02b3b98a4dbc18486
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3
57d030752d740552eb7759a0dd8e487e96ca86b03c0aa53a7e2b1c213ae74f5f
57e51b4b5bdd75d87b695dda2f34edea72d4c758519ed368316706b731dfeb0c
589665e95bbc6f03b514b403976bc328d5a08f93f7bb6e6381f95a0f28589e67
59e58524340cd7ad353be010374b124c242fdde10a0ed41047fe2fd4bb9e5a2e
5ac0e3835aaaeddc641968ac4527e3037992ea917ab0d68c7e14d36a7610492e
5fa00d047acd959697b9d7772c31dcd37bec33c70c6fbf80ab8316205d1d286d
630d0a3cc8f4c4aa7bf49b40ae6f59f3a137707e0d7bba46ba44e2e5f2c53aab
668c6828672fa8600b7a0632cb328ee63a31361be6734987b04985fcd9d08d4f
68b324a6179651d56917d3b1f3f5d0a1e71b08550b1468790826dde5e22b2b56
68cc280ce370c6f1f51a4fc5950103fc38df80a429552c549add04ebd8bd3a23
691dcdb24853a0f5ce4e6597e5713dea66799b57ffe2c2a10f28f98e0b569b19
6cb6821219dae9fa9a21519d86d7ec7acaf0c4dd61463eb336eb92964feebef3
700f4bb32d3aee7003dc4a736ddadb440c59749146d865ee41fcc634df26987e
709faebeaefb00235ef95157e10729dd8cedc9f8b153732a0e07a0a2fa4697be
71db677358e887db6da1f158b5d6fbb43d8f7908f7ead5e457abb081fa2fa474
733573f99d112cb0a60ff0fc365854a8ebc8eec2a2e5f8f613616db3e3d29ae5
7358c5616f671017f307d161644d253f0f81083b0be68f3a3fefefa33b59de5d
7497842445124f550c148be30ba12c7f43f2ef87740b690dc51ce17a55dc144c
757cf815bc0fc1197050c789f247fdf11d91ca82ada5fb14b73ab6f1221543c3
77bb0181e1343a160ca09a32f8bf7fa666e3f5558ecc2156889b2e9cdc44fdcb
7c2092048f21074425f3e025db78fb6505f75d6fcf2e121ced055c8d53bcb1b3
7dbc72c3f0511495fdf45d42283a246613db44b0906199cef195a773068d822f
80af5f1d338567e6ad99f5e2ed705d60e119502f6b9c623194afe94be1f53ba6
81a50b09cb85e4ff68788f763b8dcdc549414cecf42ca228a55ab77c971f1286
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
85149e421da51caa7ce4941a139ffedb9facacf1288cb58889ac38405f9d8992
856bf4319c0b31d0cc7e014d593f5595083e23f031cd8dd9f96d8f86ec1b56cf
8b33eebc11529672afc8f1ac6d5d4ef24bed8dfec1505a2510c805e0dd21565f
8ec11303a508ae99cfde8da8d8418863f5c44c6e4d9ad85d89b751711810ccbe
8f55274889284faaee3117c41f0e0c513fe9e190a7f8d427f972fd8d74e50579
901bb0e03b8c3c0a1cf4c487a177417328bb7d8c94106ecefceedd7d7f6c4ddc
9372da202e35b26065aa9cc76e1d68890f04d2b7d4d98e8bd5e95e130acb155b
972daca0742f92a7c64c1911795cbc326307281e5cbb8dc68c12ffcf686570e8
97c70802c2d1ff852ae0e87245e4910a6135b47a3563b04c559b040822cf6158
99939dfff2b476ab02a3e41934cd60f2ab41bd9939898b237e332ff293b4d0d8
99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12
9a54e6b1253d785972ccaab75a888119d13083bfb1f80343aef9454d5cd5bb6d
9c2e1d2864f53c224d6542bed9a1ab1de620dae21a2146eb4ff982dd8fcd4567
a245df6da22f0700461deb2f6f840edce1f07613bab8e44eaa076f97bc40995f
a335fc1da4a5ffc1fcacfa3eab57506faa41f026954496becb59cf5fbcd99d0e
a50bafb67b5319215ad7db7e8e67bd06e176820a8c6e890739268e79f64f2c3d
a55a97d86ace4a0a4643aeae4788ef2d27ff4d32ef97e231ef17ba2ec2925ada
a7cf8b244d991409d4714c6b310dc5596b0d3bd82e5415b7795f329ff4cfef58
a99a80bebca5858f6b7de455004cd13841edf6bc20416c7b73d5a697534abf22
aa7b6c81e85551eeb5c4809f1e683efa0b780c33d12ddfc2067a1b136803e45a
aabc88a6db8b22022f96ca88e4f0a7be426abef2b35169a71515a2d55246402a
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
ad6765112dfccdd75e5adffd7a9eb342583713e8b87ee1b238cbb0119c587f2f
adc1a92ef35a0861a5e047c17abaadb2553e81993727edf9ef6a4c80c9bdb348
aee6ccc3af644a2cb7e9968062e98dc2ba4f290c20a5789f1c8b9fba25c9fe39
af9a9e8da8e44dd6cc658f23dd5637b8ee029b8a0e59e849496ecf6aeb752e32
b05efca8d14cab7b75fa86ee66b6ac76b12439aa0738f61e34cb38d3a6ff27f1
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b2b2d44d40b3e87b6a39823c7f9e7f5eb7ebe9163d5aecbaa97796e9c140d61d
b30aa424747edc9582a65ea92e5286aec6fdd9ef4915921f6762035a3099aaca
b3bce010c0f5a7c24a82ae511194baf67bf8c2cee737a3a118f6b9590d322b15
b4e60138a0aec24caaa4536aaf38941d6eb5a2d27863b4f9ea6947b025a9c554
b8134eb6ee8a0f57c2bc5eb023e409088f9bf66bb938c3f8d6f8d47c212b948b
b9311d52ce973e614166f03a236d58aca49d21bfce5ed0b0bd66a05d2c03cadf
badcb3ec01865324d30a9d75a02c6f4c8329695dc7ea62682cc7f4c551883c6f
bae389cf8448c3f3ec86741ba5dcbfafc8e61be27a31c1c723169964bad30825
be0a1dd7435d16e9a2006b70bc9cd54d31bab4c5e2c7d021633a58da858fa24c
c31fcddd46165ce65b0fba30b4141e8fb2cd03930c9c7e18c1d8496ba36ebf94
c34fab15144ce735b4059974cbf2912880691e59913c3e60573b849ed86bb606
c37a9c678929e0442a0a7e0f11998ee0abb8631456316638a0ab7682b4a98538
c38366b005a9ae7215ea4dbaee4529a37591bfa4c040d1b2a4d12955f75c485d
c6cb81d06bf52c3a82de80233ffbc044714592d72611b8e9f45abdd1ec98e895
c87aa708d354d2db657ba47b08aae2cc50653369ccbffa36448d7b47fd3e9fe6
c920551b2d9526b41abadaa128f83a9586b4c9e5e0722b9ab3b3ce3738d869fa
cb6f2d32c49d1c2b25e9ffc9aaafa3f83075346c01bcd4ae6eb187392a4292cf
ce8287c3e0aa69b9b84e99fefcd63c5aa3e5f91d59852efad2a446efb3f07595
cf9f9253545706a59a03bbfe1fe9e598a8028c430e80efd8fdfc20b90f6f826a
d0e12af8c4e560fe89643639e0c3ed4dc76125c62adeb2879b761d73dbaecf50
d1d44b81c0031bab343f5aaa0dd47fd43e06b9f0bad37f7da22e79b551de9baf
d2050a121d9e9ec55ca000c98893b5875497e189c407937392c9bacf580fd03d
d258f87b0bcfa474930a6df7ef638b9661edcdde06453ee1932a302163c50538
d4963b8afebfa0063b5d17b4c80f49bce702a37ea5c9b91bb3c996bb9dea4b60
d5e54857c4548cecb4b0e39a89f7f3daa87a978364b5605269d1af92b8cc7c13
d641d350bcc57bd3783d53547afc639594db0919f88dfc20578b944a303eee13
d86347ab8ba59eb52915d14a3d6f1f83cedb6f81778c444c192ef791309cfc18
d890abf66010907c7a0a61236d25c3c98bcb7edec34b13dc887f5be122bfef7e
da9f63e67636bf79c09121cd0c3ccfd73a4fe9a348b22de3806af7177f03a95b
dceb3f43117d511db2c153a4ce60247146397015c7143cff4007aa2b4e14206b
dde9e030eebe6e275960fd345eb913edd26116ccd156b9cb7f900605a7cde511
de9d3fd0eb948bd294477d0eda60a73b85caff1794803530d0463193a113da98
e1cf65d6f8192da8c46306ee906f6aec18d8a788d3949d4d904b1aee571d92f2
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e3d961493e244e06bf91a9857442891e2e2ad8d49cf8e0a7781c53f0707443d7
eb553f40c9e6dc7c36c0224ea7d628ef44143002e9bdb0efba72655ad4b8affe
eed601083fb568a2b3275668cc6f3cddb0782cb28c094d5b5a5e1a1637cc7c54
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f099d9f9adff4bc42967b5896dc94c743a34bdc604f6116d2c3a48182262969f
f193ea401004a2e647cc84ff26e74e77d422e2a669bd1126d80f617279dc88a8
f1f8a480e44e7ef96172111c5a5de1717f04cf56a35187191de908b61a01ef1d
f38eb48171eed2313e3952632eab4dc722602c444a46827cac9a9b0e99e83aff

origin-unit42.paloaltonetworks.com Open in urlscan Pro 34.96.108.115 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

174 Requests

55 %HTTPS

44 %IPv6

32 Domains

51 Subdomains

44 IPs

2 Countries

3486 kBTransfer

6582 kBSize

86 Cookies

100 Outgoing links

Redirected requests

174 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

origin-unit42.paloaltonetworks.com Open in urlscan Pro
34.96.108.115 Public Scan

Screenshot
Live screenshot

Full Image

174
Requests

55 %
HTTPS

44 %
IPv6

32
Domains

51
Subdomains

44
IPs

2
Countries

3486 kB
Transfer

6582 kB
Size

86
Cookies

174 HTTP transactions
0 data transactions